joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800908bb
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1800adcf0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x18025c5cb]
call fcn.1800931ab
nop
mov qword [rbp + 8], 0
jmp 0x1800add2f
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1800add85
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1800add24
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x180091829
Capabilities:
Create thread

Disassembly:
jmp 0x1800f7fe0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x18025d8c7]
call fcn.1800931ab
nop
cmp dword [rbp + 0xe8], 1
jne 0x1800f804a
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xe0]
lea r8, [0x1800925b7]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov eax, 1
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x180091ab3
Capabilities:
Terminate process

Disassembly:
jmp 0x1801a2970
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x18025d8c7]
call fcn.1800931ab
nop
mov cl, 1
call fcn.180093160
movzx eax, al
test eax, eax
je 0x1801a29a9
lea rcx, str.__DEBUG___Il2Cpp_initialized_n
call fcn.180091720
nop
jmp 0x1801a29cb
lea rcx, str.__DEBUG___Il2Cpp_initialize_failed__quitting...
call fcn.180091720
nop
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802498c0], rax
mov rdx, qword [0x1802498c0]
lea rcx, str.__DEBUG___Base_Address:_0x_llX_n
call fcn.180091720
nop
lea rcx, str.GameAssembly.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802498c8], rax
mov rdx, qword [0x1802498c8]
lea rcx, str.__DEBUG___GameAssembly_Base_Address:_0x_llX_n
call fcn.180091720
nop
lea rcx, str.UnityPlayer.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802498d0], rax
mov rdx, qword [0x1802498d0]
lea rcx, str.__DEBUG___UnityPlayer_Base_Address:_0x_llX_n
call fcn.180091720
nop
lea rcx, str.___________________________________________________________n
call fcn.180091720
nop
lea rcx, [0x1801cd6a8]
call fcn.180091720
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x180091b53
Capabilities:
Terminate process

Disassembly:
jmp 0x1801b04b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x180091f77
Capabilities:
Write file on windows

Disassembly:
jmp 0x1800d7450
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x18025d197]
call fcn.1800931ab
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x180092107
Capabilities:
Read file on windows

Disassembly:
jmp 0x1800d73d0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x18025d197]
call fcn.1800931ab
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x180092120
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1800d7a10
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x18025d197]
call fcn.1800931ab
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1801c3840]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1800d7b56
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1800d7aaa
mov dword [rbp + 0x160], 1
jmp 0x1800d7ab4
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1800d7b51
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1800d7b2b
cmp qword [rbp + 0x198], 2
jb 0x1800d7b2b
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d7b2b
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d7b2b
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1800d7a75
jmp 0x1800d7bf0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1800d7bf0
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1800d7bc7
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d7bc7
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d7bc7
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1800d7b56
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1800925d5
Capabilities:
Create thread
Execute command

Disassembly:
jmp 0x18017ba20
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x18025d8c7]
call fcn.1800931ab
nop
lea rcx, [0x1801f750c]
call qword [sym.imp.ucrtbased.dll_system]
nop
call fcn.180091ab3
nop
call fcn.180092251
nop
call fcn.180093372
nop
call fcn.18009334a
nop
lea r8, [0x1800926de]
lea rdx, [0x180249958]
mov cx, 8
call fcn.18009342b
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180090e3d]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x180092de6
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1800d78f0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x18025d197]
call fcn.1800931ab
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1801c3840]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1800d7970
mov dword [rbp + 0x120], 1
jmp 0x1800d797a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1800d79c3
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1800d793b
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x180198360
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov rax, qword [0x1802421c0]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x18025d67e]
call fcn.1800931ab
nop
mov eax, dword [rbp + 0x1a0]
imul rax, rax, 0x38
mov rcx, qword [0x18024a670]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x48], 5
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180198403
mov rax, qword [rbp + 0x68]
sub rax, 5
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 2
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180198429
mov eax, 0xa
jmp 0x18019855c
cmp dword [rbp + 0x1a8], 0
je 0x18019849d
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov byte [rax], 0xe9
mov rax, qword [rbp + 0x68]
add rax, 5
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x88]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18019849b
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0xeb
mov rax, qword [rbp + 0xa8]
mov byte [rax + 1], 0xf9
jmp 0x1801984e6
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1801984cb
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1800917ca
nop
jmp 0x1801984e6
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1800917ca
nop
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
nop
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 1
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 2
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1801f4db0]
call fcn.180092940
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1800917bb
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1801986c0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1802421c0]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x18025d67e]
call fcn.1800931ab
nop
xor edx, edx
mov ecx, 4
call fcn.180091739
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x180198891
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.180091ea0
test eax, eax
je 0x180198886
mov eax, dword [rbp + 0x28]
cmp rax, 0x10
jb 0x18019886a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x34], eax
jne 0x18019886a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x30], eax
je 0x18019886a
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x1801987c5
mov rax, qword [rbp + 0x160]
mov dword [rax + 8], 0x80
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x1802498b0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x160]
mov qword [rcx], rax
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x1801987c3
jmp 0x180198886
jmp 0x18019883a
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x160]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x18019883a
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rbp + 0x160]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1802498b0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x180198816
jmp 0x180198886
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 8], eax
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x68]
mov qword [rax], rcx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x160]
mov rcx, qword [rcx]
mov edx, dword [rbp + 0x30]
mov dword [rcx + rax*4], edx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 0xc], eax
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.18009057d
test eax, eax
jne 0x180198741
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1801f4d30]
call fcn.180092940
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1800917bb
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x180198bc0
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x18025d67e]
call fcn.1800931ab
nop
mov rax, qword [rbp + 0x120]
mov qword [rax], 0
mov rax, qword [rbp + 0x120]
mov dword [rax + 8], 0
mov rax, qword [rbp + 0x120]
mov dword [rax + 0xc], 0
mov rcx, qword [rbp + 0x120]
call fcn.1801986c0
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax], 0
je 0x180198ca5
mov dword [rbp + 4], 0
jmp 0x180198c3e
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 4], eax
jae 0x180198ca5
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x180198ca3
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
nop
mov r8d, dword [rbp + 0x130]
mov edx, dword [rbp + 0x128]
mov rcx, qword [rbp + 0x28]
call fcn.180199a40
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180198c36
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x180199e30
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x18025d67e]
call fcn.1800931ab
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax], 0
je 0x180199ed8
mov dword [rbp + 4], 0
jmp 0x180199e6e
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 4], eax
jae 0x180199ebe
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x180199ebc
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180199e66
mov rax, qword [rbp + 0x120]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1802498b0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x18019a8f0
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x18025d742]
call fcn.1800931ab
nop
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x18019a966
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x18019a966
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x18019a966
xor eax, eax
jmp 0x18019a9b3
mov dword [rbp + 4], 1
jmp 0x18019a977
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x108]
cmp dword [rbp + 4], eax
jae 0x18019a9ae
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x18019a9ac
xor eax, eax
jmp 0x18019a9b3
jmp 0x18019a96f
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140001660
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov r12d, edx
mov rbp, rcx
test rcx, rcx
je 0x14000180b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000180b
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000180b
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
xor esi, esi
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov r15d, dword [rsp + 0x90]
add r15, rbp
mov r13d, dword [r15 + 0x20]
mov ecx, dword [r15 + 0x1c]
add r13, rbp
mov edx, dword [r15 + 0x24]
add rcx, rbp
add rdx, rbp
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x160], rdx
cmp dword [r15 + 0x14], esi
jbe 0x14000180b
nop dword [rax]
movzx eax, word [rdx + rsi*2]
xor ebx, ebx
mov edi, dword [r13 + rsi*4]
add rdi, rbp
mov r14d, dword [rcx + rax*4]
mov rcx, rdi
add r14, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
movsxd rdx, eax
test eax, eax
je 0x1400017b5
nop word [rax + rax]
movsx eax, byte [rdi + rcx]
inc rcx
add ebx, eax
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x1400017a0
lea edi, [rbx + rbx*8]
mov ebx, 0x32
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sub rbx, 1
jne 0x1400017c0
mov eax, edi
mov ebx, 0x32
shr eax, 0xb
xor edi, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sub rbx, 1
jne 0x1400017d8
imul eax, edi, 0x8001
cmp r12d, eax
je 0x140001828
mov rcx, qword [rsp + 0x150]
inc esi
mov rdx, qword [rsp + 0x160]
cmp esi, dword [r15 + 0x14]
jb 0x140001770
xor eax, eax
mov rbx, qword [rsp + 0x158]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, r14
jmp 0x14000180d
Function at 0x140001830
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x140
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword gs:[0x60]
mov ebp, ecx
mov rdx, qword [rax + 0x18]
mov rdi, qword [rdx + 0x20]
test rdi, rdi
je 0x14000195a
mov r14d, 0x104
movzx eax, word [rdi + 0x48]
test ax, ax
je 0x14000195a
cmp ax, r14w
jae 0x14000195a
mov rax, qword [rdi + 0x50]
xor ebx, ebx
movzx ecx, word [rax]
test cx, cx
je 0x1400018ce
xor esi, esi
nop dword [rax + rax]
movzx ecx, cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsp + rsi + 0x20], al
inc ebx
mov rax, qword [rdi + 0x50]
mov esi, ebx
movzx ecx, word [rax + rbx*2]
test cx, cx
jne 0x1400018b0
mov eax, ebx
cmp rax, r14
jae 0x140001990
mov byte [rsp + rbx + 0x20], 0
lea rcx, [rsp + 0x20]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
movsxd rdx, eax
test eax, eax
je 0x140001916
nop dword [rax]
nop dword [rax + rax]
movsx eax, byte [rsp + rcx + 0x20]
inc rcx
add ebx, eax
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x140001900
lea esi, [rbx + rbx*8]
mov ebx, 0x32
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sub rbx, 1
jne 0x140001920
mov eax, esi
mov ebx, 0x32
shr eax, 0xb
xor esi, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sub rbx, 1
jne 0x140001938
imul eax, esi, 0x8001
cmp eax, ebp
je 0x14000198a
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140001881
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140002d00
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [rdi + 0x20]
jmp 0x14000195c
call fcn.140002e28
int3