joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18018c2f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18018c510
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18018c3f7
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18018c354
mov rax, qword [0x1802a8008]
cmp qword [rsp + 0x20], rax
ja 0x18018c354
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18018c316
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180194b00
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18018c383
jmp 0x18018c3f7
cmp dword [rsp + 0x50], 0x10000
jne 0x18018c3da
cmp qword [rsp + 0x48], 0x10000
jb 0x18018c3da
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18018c3c8
mov rax, qword [rsp + 0x28]
jmp 0x18018c3f9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18018c3f2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18018c510
mov qword [rsp + 0x20], rax
jmp 0x18018c316
xor eax, eax
add rsp, 0x68
ret

Function at 0x18018c400
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18018c550
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18018c503
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18018c45b
mov rax, qword [0x1802a8008]
cmp qword [rsp + 0x20], rax
ja 0x18018c45b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18018c41d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180194b00
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18018c48a
jmp 0x18018c503
cmp dword [rsp + 0x50], 0x10000
jne 0x18018c4e1
cmp qword [rsp + 0x48], 0x10000
jb 0x18018c4e1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18018c4cf
mov rax, qword [rsp + 0x28]
jmp 0x18018c505
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18018c4fe
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18018c550
mov qword [rsp + 0x20], rax
jmp 0x18018c41d
xor eax, eax
add rsp, 0x68
ret
Function at 0x18018c5a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18018cb30
mov qword [rsp + 0x28], 0
cmp qword [0x1802d86b8], 0
jne 0x18018c5e8
cmp qword [0x1802d86b0], 0
je 0x18018c5e8
mov rax, qword [0x1802d86b0]
mov qword [0x1802d86b8], rax
cmp qword [0x1802d86b8], 0
je 0x18018c68e
mov rax, qword [0x1802d86b8]
cmp qword [rax + 0x10], 0
je 0x18018c68e
mov rax, qword [0x1802d86b8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18018c68e
mov rax, qword [0x1802d86b8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18018c68e
mov rax, qword [0x1802d86b8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18018c654
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18018c65b
xor eax, eax
jmp 0x18018c809
mov rax, qword [0x1802d86b8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.180194b00
mov rax, qword [rsp + 0x28]
jmp 0x18018c809
mov rax, qword [0x1802d86b0]
mov qword [0x1802d86b8], rax
jmp 0x18018c6b0
mov rax, qword [0x1802d86b8]
mov rax, qword [rax + 8]
mov qword [0x1802d86b8], rax
cmp qword [0x1802d86b8], 0
je 0x18018c6fd
cmp qword [0x1802d86b8], 0
je 0x18018c6fb
mov rax, qword [0x1802d86b8]
cmp qword [rax + 0x10], 0
je 0x18018c6fb
mov rax, qword [0x1802d86b8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18018c6fb
mov rax, qword [0x1802d86b8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18018c6fb
jmp 0x18018c62c
jmp 0x18018c69e
mov rcx, qword [rsp + 0x60]
call fcn.18018e9b0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18018c810
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18018c807
mov rax, qword [rsp + 0x48]
mov qword [0x1802d86b8], rax
mov rax, qword [0x1802d86b8]
mov dword [rax], 0x52727464
mov rax, qword [0x1802d86b8]
mov qword [rax + 0x10], 0
mov rax, qword [0x1802d86b8]
mov rcx, qword [0x1802d86b0]
mov qword [rax + 8], rcx
mov rax, qword [0x1802d86b8]
mov qword [0x1802d86b0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1802d86b8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18018c7b8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18018c7f2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18018c7ae
mov rax, qword [0x1802d86b8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18018c62c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1801aece8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1801aed08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18019ce30
or eax, 0xffffffff
jmp 0x1801aed0a
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Get file version info

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x74], 0
lea rcx, [rsp + 0x50]
lea rdx, str.C:WindowsSystem32kernel32.dll
mov r8d, 0x21
call fcn.140014b30
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x140001062
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_file_version_info._Error_code:__lu_n
call fcn.1400011b0
mov dword [rsp + 0x74], 1
jmp 0x1400011a4
mov eax, dword [rsp + 0x48]
mov ecx, eax
call fcn.140004580
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140001097
lea rcx, str.Memory_allocation_failed._n
call fcn.1400011b0
mov dword [rsp + 0x74], 1
jmp 0x1400011a4
mov r9, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x4c]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, 0
jne 0x1400010e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_file_version_info._Error_code:__lu_n
call fcn.1400011b0
mov rcx, qword [rsp + 0x40]
call fcn.140004588
mov dword [rsp + 0x74], 1
jmp 0x1400011a4
mov rcx, qword [rsp + 0x40]
lea rdx, [0x1400163ae]
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x34]
call sub.VERSION.dll_VerQueryValueA
cmp eax, 0
jne 0x140001132
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_query_file_version_info._Error_code:__lu_n
call fcn.1400011b0
mov rcx, qword [rsp + 0x40]
call fcn.140004588
mov dword [rsp + 0x74], 1
jmp 0x1400011a4
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
and rax, 0xffff
movzx ecx, ax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
shr rax, 0x10
and rax, 0xffff
movzx r9d, ax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
and rax, 0xffff
movzx r8d, ax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
shr rax, 0x10
and rax, 0xffff
movzx edx, ax
mov rax, rsp
mov dword [rax + 0x20], ecx
lea rcx, str.File_version:__d._d._d._d_n
call fcn.1400011b0
mov rcx, qword [rsp + 0x40]
call fcn.140004588
mov dword [rsp + 0x74], 0
mov eax, dword [rsp + 0x74]
add rsp, 0x78
ret

Function at 0x1400019c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a10
xor al, al
add rsp, 0x28
ret
Function at 0x14000732c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000739b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000739b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000739b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000739b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000739b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000739b
cmp dword [rcx + 0xf8], 0
je 0x14000739b
mov ecx, ebx
call fcn.14000744c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140007228
nop
cmp dword [rbp + 0x20], 0
je 0x1400073e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400073f4
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14000732c

Function at 0x140007530
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000732c
Function at 0x14000c858
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000c888
xor eax, eax
jmp 0x14000c94b
mov rbp, rbx
cmp word [rax], si
je 0x14000c8ad
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000c894
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000c890
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000c778
movsxd r14, eax
test eax, eax
jne 0x14000c8eb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000c881
mov rcx, r14
call fcn.140007e3c
mov rdi, rax
test rax, rax
jne 0x14000c904
xor ecx, ecx
call fcn.140007e9c
jmp 0x14000c8e0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000c778
test eax, eax
jne 0x14000c935
mov rcx, rdi
call fcn.140007e9c
jmp 0x14000c93f
xor ecx, ecx
call fcn.140007e9c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140010c6c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140010c82
mov al, 1
jmp 0x140010ce2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140010c93
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140010ce0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000d178
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140010ce0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140010ce0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140010ce0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140010ce2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140011d20
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000b848
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140011daa
cmp byte [rbp - 0x21], r15b
je 0x140011da5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140011de0
call fcn.140008644
test eax, eax
jne 0x140011dcc
cmp byte [rbp - 0x21], r15b
je 0x140011dc4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140011de0
cmp byte [rbp - 0x21], r15b
je 0x140011ddd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000ae28
test eax, eax
jne 0x140011e80
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000b848
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140011e1f
cmp byte [rbp - 0x21], r15b
je 0x140011e54
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140011e54
call fcn.140008644
test eax, eax
jne 0x140011e40
cmp byte [rbp - 0x21], r15b
je 0x140011e39
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140011e54
cmp byte [rbp - 0x21], r15b
je 0x140011e51
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000ae28
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140011e80
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140011e83
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140011e91
mov rcx, rdi
call fcn.140007e9c
cmp byte [rbp + 0x3f], r15b
je 0x140011ea0
mov rcx, qword [rbp + 0x27]
call fcn.140007e9c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140014410
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014438
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014438
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1405a2230
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1405a223d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1405a224d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1405a2235
lea eax, [rcx + 1]
jmp 0x1405a225b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1405a226e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1405a2254
sub eax, 3
jb 0x1405a228e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1405a22dd
sar eax, 1
movsxd rbp, eax
jb 0x1405a22c4
jmp 0x1405a229c
add ebx, ebx
jne 0x1405a229a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1405a22c4
inc ecx
add ebx, ebx
jne 0x1405a22aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1405a22c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1405a22bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1405a22ac
add ecx, 2
jmp 0x1405a22c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1405a21f2
jmp 0x1405a223d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x296800
mov dl, 0x31
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1405a232d
cmp rsi, rcx
jae 0x1405a2335
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1405a2314
cmp al, 0x8f
ja 0x1405a2314
cmp byte [rsi - 2], 0xf
je 0x1405a231a
sub al, 0xe8
cmp al, 1
ja 0x1405a22fe
cmp rsi, rcx
jae 0x1405a2335
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1405a2304
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1405a2335
lodsb al, byte [rsi]
jmp 0x1405a2314
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x59f000]
mov eax, dword [rdi]
or eax, eax
je 0x1405a2392
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5a2568]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1405a2342
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1405a238c
mov qword [rbx], rax
add rbx, 8
jmp 0x1405a2362
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1405a23d6
cmp al, 0xef
ja 0x1405a23be
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1405a239e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1405a23ad
mov eax, dword [rdi]
add rdi, 4
jmp 0x1405a23ad
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1405a242a
sub rsp, 0xffffffffffffff80
jmp 0x140062e24
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
xor r9, r9
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14000fee8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140010018
Function at 0x18007fe24
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x18007fe88
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18007fe76
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18007fe6f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18007fe43
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x18020ad98]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18007fe98
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x18020b930]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x18007fece
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x40]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18007ff04
mov eax, 0xa
jmp 0x18007ff93
test esi, esi
je 0x18007ff26
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18007ff47
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18007ff47
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18007ff41
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18007ff47
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, sil
shl sil, 2
add al, al
xor al, byte [rbx + 0x20]
and al, 2
xor al, byte [rbx + 0x20]
xor sil, al
and sil, 4
xor sil, al
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180080458
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18008046f
cmp r8b, 0x90
je 0x18008046f
cmp r8b, 0xcc
jne 0x180080491
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18008048d
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180080491
add edx, r10d
cmp edx, r9d
jb 0x18008047d
mov eax, r10d
ret
xor eax, eax
ret