joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800983e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180315280]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
cmp byte [rcx + 0x50], 0
je 0x180098640
mov rcx, qword [0x180316800]
add rcx, 0x18
call fcn.180067050
mov ecx, dword [rbx + 0x6c]
cmp eax, 9
jg 0x1800984b1
cmp ecx, 1
jne 0x180098640
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180098640
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rcx, qword [0x180316800]
add rcx, 0x88
lea rdx, [rsp + 0x20]
call fcn.180066ad0
nop
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180066d30
nop
cmp byte [rsp + 0x30], 0
je 0x18009849e
cmp qword [0x180316340], 0
je 0x18009849e
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x18009849e
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov r8, qword [rax + 0xb0]
call r8
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a9a10
add rsp, 0x40
pop rbx
ret
test ecx, ecx
jne 0x18009850f
lea rcx, [rbx + 0x28]
mov rax, qword [rcx + 0x18]
cmp rax, 9
jb 0x180098503
mov rbx, rcx
cmp rax, 0xf
jbe 0x1800984cf
mov rbx, qword [rcx]
mov qword [rcx + 0x10], 9
mov r8d, 9
lea rdx, str.___Normal
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a9a10
add rsp, 0x40
pop rbx
ret
lea r9, str.___Normal
jmp 0x180098636
cmp ecx, 1
jne 0x1800985dc
lea rcx, [rbx + 0x28]
mov rax, qword [rcx + 0x18]
cmp rax, 7
jb 0x180098555
mov rbx, rcx
cmp rax, 0xf
jbe 0x180098532
mov rbx, qword [rcx]
mov qword [rcx + 0x10], 7
mov r8d, 7
lea rdx, str.___Jump
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x180098566
lea r9, str.___Jump
mov edx, 7
call fcn.18006e220
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rcx, qword [0x180316800]
add rcx, 0x88
lea rdx, [rsp + 0x20]
call fcn.180066ad0
nop
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.180066d30
nop
cmp byte [rsp + 0x30], 0
je 0x1800985c9
cmp qword [0x180316340], 0
je 0x1800985c9
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x1800985c9
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov r8, qword [rax + 0xb0]
call r8
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a9a10
add rsp, 0x40
pop rbx
ret
cmp ecx, 2
jne 0x180098640
lea rcx, [rbx + 0x28]
mov rax, qword [rcx + 0x18]
cmp rax, 9
jb 0x18009862f
mov rbx, rcx
cmp rax, 0xf
jbe 0x1800985fb
mov rbx, qword [rcx]
mov qword [rcx + 0x10], 9
mov r8d, 9
lea rdx, str.___Cancel
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a9a10
add rsp, 0x40
pop rbx
ret
lea r9, str.___Cancel
mov edx, 9
call fcn.18006e220
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a9a10
add rsp, 0x40
pop rbx
ret
Function at 0x18009a470
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180315280]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx], 0
mov rbx, rcx
jne 0x18009a505
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], 0
cmp byte [rcx], 0xe9
jne 0x18009a4e1
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18009a4e1
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x38
mov rcx, rbx
call fcn.1800a9fd4
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a9a10
add rsp, 0x30
pop rbx
ret
Function at 0x18009a840
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180315280]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x180099a10]
mov qword [rcx + 8], rax
mov rcx, qword [0x180316750]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006ec60
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov byte [rbx + 1], al
lea r8d, [rdx + 0x32]
call fcn.18006fc80
mov qword [rbx + 0x20], rax
mov rcx, rax
test rax, rax
jne 0x18009a8dc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_allocate_memory_n
call fcn.180006120
jmp 0x18009a9da
mov rax, qword [rbx + 8]
mov r8d, 0x3000
mov qword [rbx + 0x2e], rax
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + 0xc], ax
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18009a8c4
mov qword [0x180316738], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
lea r8d, [rdx + 0x3b]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18009a9ab
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
call fcn.180006120
jmp 0x18009a9d5
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a9a10
add rsp, 0x30
pop rbx
ret
Function at 0x18009a9f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180315280]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x180099950]
mov qword [rcx + 8], rax
mov rcx, qword [0x180316710]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006ec60
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov byte [rbx + 1], al
lea r8d, [rdx + 0x32]
call fcn.18006fc80
mov qword [rbx + 0x20], rax
mov rcx, rax
test rax, rax
jne 0x18009aa8c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_allocate_memory_n
call fcn.180006120
jmp 0x18009ab8a
mov rax, qword [rbx + 8]
mov r8d, 0x3000
mov qword [rbx + 0x2e], rax
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + 0xc], ax
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18009aa74
mov qword [0x180316728], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
lea r8d, [rdx + 0x3b]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18009ab5b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
call fcn.180006120
jmp 0x18009ab85
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a9a10
add rsp, 0x30
pop rbx
ret
Function at 0x18009d030
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rdx]
mov rbx, r8
dec eax
mov r8, rdx
mov rdi, rcx
cmp eax, 0x20
ja case.0x18009d119.4
lea rsi, [0x180000000]
nop dword [rax]
cdqe
movzx eax, byte [rsi + rax + 0x9d298]
mov ecx, dword [rsi + rax*4 + 0x9d26c]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0xd0]
movzx r8d, byte [r8 + 1]
add rax, 0xffffffffffffffc4
lea r8, [rax + r8*2]
movzx eax, byte [r8]
dec eax
cmp eax, 0x20
jbe 0x18009d060
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xcc]
movzx edx, word [rsi + rax*2 + 0xb3f20]
mov rcx, rdi
call fcn.18009b8e0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x9c]
cmp al, 8
jae case.0x18009d119.4
lea edx, [rax + 0x6d]
mov rcx, rdi
call fcn.18009b8e0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [r8 + 1]
add eax, 0xfffffffe
cmp eax, 0x1a
ja case.0x18009d119.4
cdqe
movzx eax, byte [rsi + rax + 0x9d2c8]
mov ecx, dword [rsi + rax*4 + 0x9d2bc]
add rcx, rsi
jmp rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18009e0d0
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18009d2f0
movzx eax, byte [rbx + 0xa2]
mov r9, rbx
mov rcx, rdi
mov rdx, qword [rbx + rax*8 + 0xa8]
inc al
mov byte [rbx + 0xa2], al
call fcn.18009be60
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rbx + 0x34]
mov rcx, rdi
call fcn.18009b8b0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x18009d1ae
lea edx, [rax + 0x35]
jmp 0x18009d1c0
cmp eax, 1
jne 0x18009d1bb
lea edx, [rax + 0x1f]
lea eax, [rdx + 0x19]
jmp 0x18009d1c5
mov edx, 0x39
mov eax, 0x20
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.18009b8e0
movsxd rax, dword [rbx + 8]
mov rcx, rdi
movzx edx, byte [rax + rsi + 0xb40e0]
call fcn.18009b8e0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x18009d207
lea edx, [rax + 0x31]
jmp 0x18009d219
cmp eax, 1
jne 0x18009d214
lea edx, [rax + 0x19]
lea eax, [rdx - 0xa]
jmp 0x18009d21e
mov edx, 0x10
mov eax, 0x1a
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.18009b8e0
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xb8]
jmp 0x18009d0ae
movzx edx, byte [rbx + 0xa0]
and edx, 7
add edx, 0x85
jmp 0x18009d0b6
movsxd rax, dword [rbx + 0x98]
jmp 0x18009d0ae
Function at 0x1800a83b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x1803185e0]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x1800a83e6
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x40]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800a841c
mov eax, 0xa
jmp 0x1800a84ab
test esi, esi
je 0x1800a843e
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800a845f
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800a845f
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800a8459
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800a845f
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, sil
shl sil, 2
add al, al
xor al, byte [rbx + 0x20]
and al, 2
xor al, byte [rbx + 0x20]
xor sil, al
and sil, 4
xor sil, al
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1800a8500
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180315280]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r15d, edx
mov rdi, rcx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
xor edx, edx
mov r14d, r8d
mov esi, ebx
lea ecx, [rbx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1800a869c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800a863e
lea esi, [rbx + 1]
cmp dword [rsp + 0x20], 0x10
jb 0x1800a85fa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1800a85fa
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x1800a85fa
mov rdx, qword [rdi]
test rdx, rdx
jne 0x1800a85bc
mov dword [rdi + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x180315d48]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x1800a8622
jmp 0x1800a85ed
mov eax, dword [rdi + 8]
cmp dword [rdi + 0xc], eax
jb 0x1800a85ed
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rdi + 8], eax
mov rcx, qword [0x180315d48]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x1800a8622
mov qword [rdi], rax
mov ecx, dword [rdi + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rdi + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800a856a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1800a863e
mov esi, ebx
cmp qword [rdi], rbx
je 0x1800a863e
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x180315d48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1800a869c
cmp qword [rdi], rbx
je 0x1800a86a1
mov esi, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x1800a86a1
mov r8, qword [rdi]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0x1800a8693
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, r14d
mov edx, r15d
mov rcx, rbp
call fcn.1800a8ab8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rdi + 0xc]
jb 0x1800a8657
jmp 0x1800a86a1
mov ebx, 9
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800a9a10
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a8c48
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1800a8cac
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800a8c9a
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800a8c93
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800a8c67
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x180315d48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800a8d48
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x1800a8d92
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x1803185d0]
lea r12, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r12
cmovbe r12, qword [rbp - 0x50]
sub r12, 0xfff
xor esi, esi
jmp 0x1800a8dcb
cmp rbx, r14
jb 0x1800a8dc8
cmp rbx, r12
jae 0x1800a8dc8
cmp qword [rbx + 8], rsi
jne 0x1800a8f2d
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800a8db4
mov r15, rdi
cmp rdi, r14
jb 0x1800a8ee7
mov r13d, dword [rbp - 0x38]
xor edx, edx
mov rax, r15
div r13
sub r15, rdx
jmp 0x1800a8e17
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800a8e51
cmp dword [rbp - 0x10], 0x10000
je 0x1800a8e21
mov r15, qword [rbp - 0x28]
cmp r15, r13
jb 0x1800a8e51
sub r15, r13
cmp r15, r14
jae 0x1800a8ded
jmp 0x1800a8e51
test r15, r15
je 0x1800a8e51
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800a8ef2
cmp r15, r14
jae 0x1800a8ddc
test rbx, rbx
jmp 0x1800a8ee5
mov r15d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov r14d, r15d
div r15
mov eax, r15d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r12
ja 0x1800a8f2d
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800a8f2d
cmp dword [rbp - 0x10], 0x10000
je 0x1800a8ec0
xor edx, edx
lea edi, [r15 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div r14
sub rdi, rdx
cmp rdi, r12
jbe 0x1800a8e7d
jmp 0x1800a8f2d
test rdi, rdi
je 0x1800a8f2d
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800a8ef2
cmp rdi, r12
jbe 0x1800a8e59
jmp 0x1800a8f2d
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], esi
mov edx, 0x40
mov qword [rcx], rsi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rsi, rax
cmp rdx, 0xfc0
jbe 0x1800a8efe
mov rax, qword [0x1803185d0]
mov qword [rbx], rax
mov qword [0x1803185d0], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800a9328
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x1800a933f
cmp r8b, 0x90
je 0x1800a933f
cmp r8b, 0xcc
jne 0x1800a9361
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x1800a935d
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x1800a9361
add edx, r10d
cmp edx, r9d
jb 0x1800a934d
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x4174c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41764b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435d60
xorps xmm15, xmm15
mov r14, qword [0x00675228]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417525
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417534
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417553
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417563
cmp rbx, 0x1000
jae 0x41752b
jmp 0x4175cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417575
xor edx, edx
jmp 0x4175c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435d60
xorps xmm15, xmm15
mov r14, qword [0x00675228]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417559
jmp 0x417548
call fcn.0046bd60
xorps xmm15, xmm15
mov r14, qword [0x00675228]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043a240
lea rax, [0x0051638b]
mov ebx, 0x18
nop dword [rax]
call fcn.0043aac0
mov rax, qword [rsp + 0x38]
call fcn.0043a800
lea rax, [0x00516916]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043aac0
mov rax, qword [rsp + 0x30]
call fcn.0043a800
call fcn.0043a480
call fcn.0043a2a0
lea rax, [0x00518db6]
mov ebx, 0x21
call fcn.004387a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004174c0