joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011f60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x18005edd0]
lea r10, [0x18004fa20]
movsxd r9, ecx
mov rbx, qword [r8 + 0x1c20]
add rbx, 0xc8
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx edx, dil
xor rdx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov eax, r9d
xor rdx, rcx
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x1c54], edi
jne 0x180012005
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.1800197e0
mov ecx, dword [rbx + 4]
mov eax, dword [rbx]
cmp eax, ecx
jne 0x18001203a
lea r8d, [rax + 1]
test ecx, ecx
je 0x180012021
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x180012026
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.18001a6d0
mov eax, dword [rbx]
movsxd rcx, eax
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180013180
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18005e010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x18005edd0]
mov edi, ecx
cmp byte [rbx + 0x1fb5], 0
jne 0x1800131e1
cmp byte [rbx + 0x1fb6], 0
jne 0x1800131e1
movsx r9d, word [rbx + 0x3096]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180004eb0
test dil, 1
je 0x180013308
jmp 0x18001326a
movss xmm1, dword [rbx + 0x1628]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x3096]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1800555bc]
mulss xmm1, dword [0x1800555ac]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d30], rax
mov dword [rbx + 0x1d1c], 1
movss dword [rbx + 0x1d28], xmm0
movss dword [rbx + 0x1d2c], xmm1
movss xmm0, dword [rbx + 0x1684]
mulss xmm0, dword [0x1800554ec]
or dword [rbx + 0x1d18], 0x41
movss dword [rbx + 0x1d78], xmm0
call fcn.180004eb0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1800132c0
lea r11, [0x18004fa20]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1800132a3
cmp byte [r8], r9b
jne 0x1800132a3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180013290
not ecx
call fcn.18000ca00
test rax, rax
je 0x180013308
cmp byte [rax + 0x8e], 0
je 0x180013308
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x3096]
mov edx, 0x10
movsx r9d, word [rbx + 0x3096]
call fcn.180004eb0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18000f230
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18004ca20
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800185b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3138], 0
lea rbx, [rcx + 0x3140]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180018653
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x180018606
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.18001a500
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180005a80
mov eax, dword [rbx]
lea rcx, [0x18005edc8]
mov r9, qword [rdi + 0x3138]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x3148]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001865b
mov rcx, rbx
call fcn.180005a80
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180018df0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x18005edd0]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x30d4], ecx
test rbx, rbx
je 0x180018e5f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.180018e70
lea rdx, [0x180053c60]
mov rcx, rbx
mov rdi, rax
call fcn.180005070
mov rbx, rax
test rax, rax
je 0x180018e5a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180029a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x70
mov r8, rcx
movaps xmmword [rsp + 0x30], xmm9
movzx ecx, word [rsp + 0xa8]
movaps xmm9, xmm2
mov rsi, rdx
mov qword [rsp + 0x20], r9
movsxd rax, dword [r8 + 0x18]
cmp rcx, rax
jb 0x180029a36
mov rbx, qword [r8 + 0x38]
jmp 0x180029a5a
mov rax, qword [r8 + 0x20]
movzx ecx, word [rax + rcx*2]
mov eax, 0xffff
cmp cx, ax
jne 0x180029a4e
mov rbx, qword [r8 + 0x38]
jmp 0x180029a5a
mov rax, qword [r8 + 0x30]
lea rcx, [rcx + rcx*4]
lea rbx, [rax + rcx*8]
test rbx, rbx
je 0x180029c1c
mov ecx, dword [rbx]
test cl, 2
je 0x180029c1c
mov qword [rsp + 0x80], rdi
xorps xmm0, xmm0
mov edi, dword [rsp + 0xa0]
or edi, 0xffffff
movaps xmmword [rsp + 0x60], xmm6
and cl, 1
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm8
cmove edi, dword [rsp + 0xa0]
comiss xmm9, xmm0
jb 0x180029aaf
divss xmm9, dword [r8 + 0x14]
jmp 0x180029ab8
movss xmm9, dword [0x180055524]
cvttss2si eax, dword [rsp + 0x20]
mov edx, 6
mov rcx, rsi
lea r8d, [rdx - 2]
movd xmm6, eax
cvttss2si eax, dword [rsp + 0x24]
cvtdq2ps xmm6, xmm6
movd xmm7, eax
cvtdq2ps xmm7, xmm7
call fcn.180022b10
movzx edx, word [rsi + 0x34]
mov rax, qword [rsi + 0x50]
movss xmm8, dword [rbx + 0x24]
movaps xmm1, xmm9
mulss xmm1, dword [rbx + 0x10]
lea ecx, [rdx + 1]
movss xmm4, dword [rbx + 0x20]
movaps xmm3, xmm9
mulss xmm3, dword [rbx + 0x14]
movaps xmm2, xmm9
mulss xmm2, dword [rbx + 8]
addss xmm1, xmm6
mulss xmm9, dword [rbx + 0xc]
addss xmm3, xmm7
movss xmm5, dword [rbx + 0x18]
addss xmm2, xmm6
movss xmm0, dword [rbx + 0x1c]
mov word [rax], dx
addss xmm9, xmm7
mov rax, qword [rsi + 0x50]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x60]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rsi + 0x50]
mov word [rax + 4], cx
mov rax, qword [rsi + 0x50]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rsi + 0x50]
mov word [rax + 8], cx
mov rax, qword [rsi + 0x50]
mov word [rax + 0xa], dx
mov rax, qword [rsi + 0x48]
movss dword [rax], xmm2
movss dword [rax + 4], xmm9
mov rax, qword [rsi + 0x48]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm0
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x10], edi
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm9
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x1c], xmm4
movss dword [rax + 0x20], xmm0
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x24], edi
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x28], xmm1
movss dword [rax + 0x2c], xmm3
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x30], xmm4
movss dword [rax + 0x34], xmm8
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x38], edi
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x3c], xmm2
movss dword [rax + 0x40], xmm3
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm8
mov rax, qword [rsi + 0x48]
movaps xmm8, xmmword [rsp + 0x40]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x70
pop rsi
ret
Function at 0x180040cd0
Capabilities:
Hash data with crc32

Disassembly:
test dword [rcx + 0x10], 0x100000
je 0x180040d4d
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180040d26
lea r11, [0x18004fa20]
cmp r9b, 0x23
jne 0x180040d09
cmp byte [r8], r9b
jne 0x180040d09
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180040cf6
mov rcx, qword [0x18005edd0]
not eax
cmp dword [rcx + 0x1c6c], eax
jne 0x180040d3d
mov dword [rcx + 0x1c70], eax
cmp dword [rcx + 0x1ca8], eax
jne 0x180040d60
mov byte [rcx + 0x1cac], 1
ret
mov rax, qword [0x18005edd0]
mov rcx, qword [rax + 0x1c20]
jmp fcn.180007500
ret

Function at 0x180044f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x18005e010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x180044f66
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x180044f36
cmp byte [rax], cl
jne 0x180044f62
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x180044f27
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004ca20
add rsp, 0x90
pop rbx
ret
movzx ecx, byte [r8]
cmp cl, 0x25
jne 0x180044f46
cmp byte [r8 + 1], cl
je 0x180044f46
lea r11, [rsp + 0x20]
mov r9, r8
movzx edx, cl
nop dword [rax]
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x180044f9d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x180044fc5
sub dl, 0x61
cmp dl, 0x19
ja 0x180044fb7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x180044fc5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x180044f80
jmp 0x180044fc8
inc r9
cmp r8, r9
jae 0x180044fff
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x180044ff4
bt rdx, rax
jb 0x180044ffa
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x180044fe0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.180004eb0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x180045038
nop
inc rcx
cmp byte [rcx], 0x20
je 0x180045030
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1800450bb
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x18004505a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x180045068
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x1800450a6
movss xmm2, dword [0x1800555b0]
nop
cmp al, 0x39
ja 0x1800450a6
movzx eax, al
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x180045080
cmp r9b, 0x2d
jne 0x1800450c8
xorps xmm1, xmmword [0x1800559c0]
movaps xmm0, xmm1
jmp 0x180044f49
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x180044f49
Function at 0x1800450d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x18005e010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x180045136
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x180045106
cmp byte [rax], cl
jne 0x180045132
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x1800450f7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004ca20
add rsp, 0x90
pop rbx
ret
movzx ecx, byte [r8]
cmp cl, 0x25
jne 0x180045116
cmp byte [r8 + 1], cl
je 0x180045116
lea r11, [rsp + 0x20]
mov r9, r8
movzx edx, cl
nop dword [rax]
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x18004516d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x180045195
sub dl, 0x61
cmp dl, 0x19
ja 0x180045187
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x180045195
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x180045150
jmp 0x180045198
inc r9
cmp r8, r9
jae 0x1800451cf
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1800451c4
bt rdx, rax
jb 0x1800451ca
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1800451b0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.180004eb0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x180045208
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x180045200
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x180045289
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x18004522a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x180045238
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x180045274
movsd xmm2, qword [0x180055568]
nop
cmp al, 0x39
ja 0x180045274
movzx eax, al
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x180045250
cmp r9b, 0x2d
jne 0x180045292
xorps xmm1, xmmword [0x1800559b0]
movaps xmm0, xmm1
jmp 0x180045119
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x180045119
Function at 0x180048840
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp byte [0x18005f400], 0
je 0x180048865
lea rcx, [0x18005f400]
call fcn.180003560
lea rcx, [0x18005f100]
call fcn.180003560
cmp byte [0x18005ef80], 0
je 0x18004889e
lea rcx, [0x18005ef80]
call fcn.180003560
lea rcx, [0x18005eec0]
call fcn.180003560
lea rcx, [0x18005f280]
call fcn.180003480
lea rcx, [0x18005f340]
call fcn.180003480
cmp byte [0x18005f580], 0
je 0x1800488bf
lea rcx, [0x18005f580]
call fcn.180003560
lea rcx, [0x18005f040]
call fcn.180003560
cmp byte [0x18005f1c0], 0
je 0x1800488d4
lea rcx, [0x18005f1c0]
call fcn.180003560
cmp byte [0x18005f4c0], 0
je 0x1800488e9
lea rcx, [0x18005f4c0]
call fcn.180003560
lea rcx, [0x18005e0cc]
mov byte [0x18005e0cd], 0
call fcn.1800024a0
lea rcx, [0x18005e0cc]
call fcn.1800027f0
mov ecx, 0xbb8
mov byte [0x18005e0cd], 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x18005e5cd], 0
jne 0x180048964
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, qword [0x18005ede0]
test rcx, rcx
je 0x180048964
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x180054a50]
lea rdx, str.CONOUT_
lea rcx, [0x18005ede0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
xor eax, eax
lea r8, [0x180048820]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x18004b070
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18004b09f
xor eax, eax
mov qword [0x18005e5a0], rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180049690]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18004b830
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp dword [rcx + 0xc], ebx
jbe 0x18004b87c
mov rax, qword [rdi]
xor edx, edx
mov r8d, dword [rax + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004b875
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x18004b849
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x18005eea0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]

Function at 0x18004b8a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x40]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x18005f730]
mov r8, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rbp, [r8 - 5]
cmove rbp, r8
lea rdi, [r8 - 5]
test al, al
lea r14, [rcx*2 + 5]
cmove rdi, r8
mov rdx, r14
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18004b90b
mov eax, 0xa
jmp 0x18004b997
test esi, esi
je 0x18004b92d
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18004b94e
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18004b94e
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18004b948
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18004b94e
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18004bd48
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18004bd5f
cmp r8b, 0x90
je 0x18004bd5f
cmp r8b, 0xcc
jne 0x18004bd81
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18004bd7d
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18004bd81
add edx, r10d
cmp edx, r9d
jb 0x18004bd6d
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x18004c0e8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18004c132
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x18005f720]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x18004c16f
cmp rbx, rsi
jb 0x18004c16a
cmp rbx, r15
jae 0x18004c16a
cmp qword [rbx + 8], 0
jne 0x18004c2cb
mov rbx, qword [rbx]
jmp 0x18004c150
mov r14, rdi
cmp rdi, rsi
jb 0x18004c1f3
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x18004c1ea
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004c1ea
cmp dword [rbp - 0x10], 0x10000
je 0x18004c1ba
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x18004c1ea
jmp 0x18004c186
test r14, r14
je 0x18004c1ea
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18004c28b
cmp r14, rsi
jae 0x18004c177
test rbx, rbx
jne 0x18004c28b
cmp rdi, r15
ja 0x18004c2cb
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18004c2cb
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004c2cb
cmp dword [rbp - 0x10], 0x10000
je 0x18004c261
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x18004c21a
test rdi, rdi
je 0x18004c2cb
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x18004c1ed
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x18004c29e
mov rax, qword [0x18005f720]
mov qword [rbx], rax
mov qword [0x18005f720], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14144dc30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14144dc3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14144dc4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14144dc35
lea eax, [rcx + 1]
jmp 0x14144dc5b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14144dc6e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14144dc54
sub eax, 3
jb 0x14144dc8e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14144dcdd
sar eax, 1
movsxd rbp, eax
jb 0x14144dcc4
jmp 0x14144dc9c
add ebx, ebx
jne 0x14144dc9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14144dcc4
inc ecx
add ebx, ebx
jne 0x14144dcaa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14144dcc4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14144dcbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14144dcac
add ecx, 2
jmp 0x14144dcc9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14144dbf2
jmp 0x14144dc3d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x141b000]
mov eax, dword [rdi]
or eax, eax
je 0x14144dd3d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x14a8114]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14144dced
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14144dd37
mov qword [rbx], rax
add rbx, 8
jmp 0x14144dd0d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14144dd81
cmp al, 0xef
ja 0x14144dd69
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14144dd49
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14144dd58
mov eax, dword [rdi]
add rdi, 4
jmp 0x14144dd58
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14144de00], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14144de00
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14144ddf0
sub rsp, 0xffffffffffffff80
jmp 0x1400013c9