joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001a24
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x60
mov rsi, rcx
lea rax, [rdx - 0x80000000]
mov ecx, 0x80000000
xor r14d, r14d
cmp rdx, rcx
mov rbx, rdx
mov edx, 0x30
lea rcx, [r11 - 0x38]
cmova r14, rax
mov edi, r8d
call qword [sym.imp.KERNEL32.dll_RtlZeroMemory]
xor ebp, ebp
cmp rbx, r14
jbe 0x180001ba8
cmp rbp, 0x3e8
jae 0x180001ba8
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x180001b74
cmp dword [rsp + 0x50], 0x10000
jne 0x180001b2c
mov rax, qword [0x180014958]
test rax, rax
je 0x180001adc
mov r8, qword [rsp + 0x30]
lea rdx, str.About_to_alloc_page___llx_n
lea rcx, [0x18000ee80]
call rax
lea rcx, [0x18000ee80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x30]
mov r9d, 0x3000
mov r8d, 0x1000
mov dword [rsp + 0x20], 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x180001b5f
mov rdx, qword [rsp + 0x30]
mov r9, rax
mov rcx, rsi
call fcn.1800019a0
mov rdx, rax
test rax, rax
je 0x180001b5f
mov ecx, dword [rax + 0x18]
mov rax, rcx
add rax, qword [rdx + 0x20]
add ecx, edi
mov dword [rdx + 0x18], ecx
jmp 0x180001baa
mov rdx, qword [0x18000d5f0]
jmp 0x180001b55
cmp qword [rdx + 8], rsi
jne 0x180001b52
mov rax, qword [rsp + 0x30]
cmp qword [rdx + 0x10], rax
jne 0x180001b52
mov eax, 0x1000
sub eax, dword [rdx + 0x18]
cmp eax, edi
ja 0x180001b5a
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180001b35
test rdx, rdx
jne 0x180001b6f
mov rbx, qword [rsp + 0x30]
dec rbx
inc rbp
jmp 0x180001a6d
mov ecx, dword [rdx + 0x18]
jmp 0x180001b1e
cmp qword [0x180014958], 0
je 0x180001ba8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.VirtualQuery_failed:__08X_n
lea rcx, [0x18000ee80]
call qword [0x180014958]
lea rcx, [0x18000ee80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180001bc8
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rsi, [rcx + 0x18]
add rsi, r9
mov ebp, r8d
sub edx, ecx
xor r10d, r10d
mov r14, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx r8d, word [r9 + rcx + 6]
add rsi, rax
test r8d, r8d
je 0x180001c2e
mov eax, dword [rsi + 8]
test eax, eax
jne 0x180001c15
mov eax, dword [rsi + 0x10]
mov ecx, dword [rsi + 0xc]
cmp edx, ecx
jb 0x180001c22
add eax, ecx
cmp edx, eax
jb 0x180001c30
inc r10d
add rsi, 0x28
cmp r10d, r8d
jb 0x180001c0b
xor esi, esi
test rsi, rsi
je 0x180001ce8
mov eax, dword [rsi + 0x10]
sub eax, dword [rsi + 8]
cmp eax, ebp
jb 0x180001ce8
mov ebx, dword [rsi + 0xc]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [0x18000d5f0]
mov edi, 0x1000
jmp 0x180001c72
cmp qword [rdx + 8], rax
jne 0x180001c6f
cmp qword [rdx + 0x10], rbx
jne 0x180001c6f
cmp edi, dword [rdx + 0x18]
jne 0x180001c77
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180001c5e
test rdx, rdx
je 0x180001cb5
mov ebx, dword [rsi + 0xc]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [0x18000d5f0]
jmp 0x180001ca6
cmp qword [rdx + 8], rax
jne 0x180001ca3
cmp qword [rdx + 0x10], rbx
jne 0x180001ca3
mov ecx, edi
sub ecx, dword [rdx + 0x18]
cmp ecx, ebp
ja 0x180001cab
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180001c8e
test rdx, rdx
je 0x180001ce8
mov ecx, dword [rdx + 0x18]
jmp 0x180001cda
mov edi, dword [rsi + 0xc]
lea rbx, [rdi + r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rbx
mov edx, edi
mov rcx, rax
call fcn.1800019a0
mov rdx, rax
test rax, rax
je 0x180001ce8
mov ecx, dword [rsi + 8]
mov rax, rcx
add rax, qword [rdx + 0x20]
add ecx, ebp
mov dword [rdx + 0x18], ecx
jmp 0x180001cea
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180001d08
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rsi, rax
jne 0x180001d45
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor ecx, ecx
test eax, eax
jne 0x180001da9
lea rax, [rdi + rbx]
jmp 0x180001d9a
cmp edi, 0x80
ja 0x180001da9
lea rax, [rsp + 0xc0]
mov r9, rdi
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor ecx, ecx
test eax, eax
je 0x180001da9
cmp qword [rsp + 0xc0], rdi
jne 0x180001da9
lea rax, [rsp + 0x30]
add rax, rdi
lea rbx, [rsp + 0x30]
jmp 0x180001d9a
cmp byte [rbx], 0xcc
je 0x180001d97
cmp byte [rbx], 0x90
jne 0x180001d9f
inc rbx
cmp rbx, rax
jb 0x180001d8d
cmp rbx, rax
sete cl
mov eax, ecx
jmp 0x180001dab
xor eax, eax
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180002b0c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, word [rdx + 0x14]
lea r11, [rdx + 0x18]
movzx edx, word [rdx + 6]
add r11, rax
xor r10d, r10d
mov edi, ecx
mov rsi, r8
mov r9, r11
mov ebx, r10d
test edx, edx
je 0x180002b60
mov eax, dword [r9 + 8]
test eax, eax
jne 0x180002b48
mov eax, dword [r9 + 0x10]
mov ecx, dword [r9 + 0xc]
cmp edi, ecx
jb 0x180002b56
add eax, ecx
cmp edi, eax
jb 0x180002b63
inc ebx
add r9, 0x28
cmp ebx, edx
jb 0x180002b3c
mov r9, r10
mov r8d, dword [r9 + 0xc]
mov eax, r11d
sub r8d, dword [r9 + 0x14]
sub eax, esi
test edx, edx
je 0x180002b8f
cmp r11, r9
je 0x180002b87
inc r10d
add r11, 0x28
cmp r10d, edx
jb 0x180002b74
jmp 0x180002b8f
mov eax, dword [r11 + 0xc]
sub eax, dword [r11 + 0x14]
mov rbx, qword [rsp + 8]
mov ecx, eax
movsxd rax, r8d
sub rcx, rax
lea rax, [rsi + rcx]
mov rsi, qword [rsp + 0x10]
add rax, rdi
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180002bb0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rdx]
mov r15, r9
mov r14d, dword [rdx + 0x10]
add rbx, rcx
add r14, rcx
mov r12, r8
xor edi, edi
mov rbp, rcx
mov rax, qword [rbx]
test rax, rax
je 0x180002cbc
movabs rcx, 0x8000000000000000
test rcx, rax
jne 0x180002c6b
lea rsi, [rax + rbp]
mov edx, 0x1000
lea rcx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
je 0x180002c5a
mov r10, qword [0x180014958]
test r10, r10
je 0x180002c6b
mov rax, qword [rbx]
lea rdx, str.LDNTVDM:_Cannot_check_for_IAT_entry__s_of_module___08X._Thunk_08X__AddressOfData_08X__ForwarderString_08X_n
mov qword [rsp + 0x30], rax
lea rcx, [0x18000fed0]
mov qword [rsp + 0x28], rax
mov r9, rbp
mov r8, r12
mov qword [rsp + 0x20], rbx
call r10
lea rcx, [0x18000fed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x180002c6b
mov rdx, r12
lea rcx, [rsi + 2]
call qword [0x180014950]
test eax, eax
je 0x180002c76
add rbx, 8
inc edi
jmp 0x180002be4
movsxd rax, edi
lea rdx, [r14 + rax*8]
mov rax, qword [rbx]
cmp qword [rdx], rax
jne 0x180002cb5
mov rax, qword [0x180014958]
test rax, rax
je 0x180002cae
lea rdx, str.IAT_entry_is_not_bound_yet_n
lea rcx, [0x18000fed0]
call rax
lea rcx, [0x18000fed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0xfffffffd
jmp 0x180002cc1
mov qword [r15], rdx
xor eax, eax
jmp 0x180002cc1
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x180002ce0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
lea r9, [rax + 8]
mov r8d, 4
mov rdi, rdx
mov rbx, rcx
mov dword [rax + 8], r8d
lea edx, [r8 + 4]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test rsi, rsi
je 0x180002d1c
mov rax, qword [rbx]
mov qword [rsi], rax
mov rax, qword [0x180014958]
test rax, rax
je 0x180002d50
mov r9, qword [rbx]
lea rdx, str.Hooked__08X:__08X_____08X_n
mov r8, rbx
mov qword [rsp + 0x20], rdi
lea rcx, [0x18000fed0]
call rax
lea rcx, [0x18000fed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov edx, 8
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180002d80
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180014958]
or esi, 0xffffffff
mov r14, qword [rsp + 0x90]
mov rbp, r9
mov r12, r8
mov r15, rdx
mov rdi, rcx
test rax, rax
je 0x180002de9
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r9
mov r9, rdx
mov qword [r11 - 0x48], r8
lea rdx, str.Hook_IAT_x64_IAT__X___s___s___08X___08X__n
mov r8, rcx
lea rcx, [0x18000fed0]
call rax
lea rcx, [0x18000fed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movsxd rax, dword [rdi + 0x3c]
mov ebx, dword [rax + rdi + 0x90]
add rbx, rdi
jmp 0x180002e0f
mov ecx, eax
mov rdx, r15
add rcx, rdi
call qword [0x180014948]
test eax, eax
je 0x180002e18
add rbx, 0x14
mov eax, dword [rbx + 0xc]
test eax, eax
jne 0x180002df9
xor ebx, ebx
test rbx, rbx
je 0x180002e48
lea r9, [rsp + 0x70]
mov r8, r12
mov rdx, rbx
mov rcx, rdi
call fcn.180002bb0
mov esi, eax
test eax, eax
jne 0x180002e48
mov rcx, qword [rsp + 0x70]
mov r8, r14
mov rdx, rbp
call fcn.180002ce0
jmp 0x180002e76
mov rax, qword [0x180014958]
test rax, rax
je 0x180002e74
mov r8d, esi
lea rdx, str.Hooking_failed___d__n
lea rcx, [0x18000fed0]
call rax
lea rcx, [0x18000fed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180002e90
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd rsi, dword [rcx + 0x3c]
xor ebx, ebx
mov rdi, qword [0x180014958]
add rsi, rcx
mov r12, rdx
mov rbp, rcx
test rdi, rdi
je 0x180002eff
mov qword [rax - 0x40], r9
mov r9, rdx
mov qword [rax - 0x48], r8
lea rdx, str.Hook_IAT_x64__08X___s___s___08X__n
mov r8, rcx
lea rcx, [0x18000fed0]
call rdi
lea rcx, [0x18000fed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdi, qword [0x180014958]
mov ecx, dword [rsi + 0xf0]
mov r15d, dword [rsi + 0xf4]
test ecx, ecx
je 0x180003012
test r15d, r15d
je 0x180003012
mov r8, rbp
mov rdx, rsi
call fcn.180002b0c
mov r14, rax
test rax, rax
je 0x180003012
test r15d, r15d
je 0x180002ff0
mov ecx, dword [r14 + 4]
test ecx, ecx
je 0x180002fe9
mov r13d, dword [r14]
mov r8, rbp
mov rdx, rsi
and r13d, 1
call fcn.180002b0c
mov rdx, r12
mov rcx, rax
call qword [0x180014950]
test eax, eax
jne 0x180002fdb
mov ecx, dword [r14 + 0x10]
mov r8, rbp
mov rdx, rsi
call fcn.180002b0c
mov rdi, rax
mov r12d, ebx
mov rcx, qword [rax]
test rcx, rcx
je 0x180002fd6
movsxd r13, r13d
movabs rax, 0x8000000000000000
test rax, rcx
jne 0x180002fc7
mov r8, rbp
mov rdx, rsi
test r13, r13
je 0x180002fa9
mov ecx, dword [rdi]
jmp 0x180002fac
sub ecx, dword [rsi + 0x30]
call fcn.180002b0c
mov rdx, qword [rsp + 0x80]
lea rcx, [rax + 2]
call qword [0x180014950]
test eax, eax
je 0x180003029
add rdi, 8
inc r12d
mov rcx, qword [rdi]
test rcx, rcx
jne 0x180002f8b
mov r12, qword [rsp + 0x78]
add r14, 0x20
add r15d, 0xffffffe0
jne 0x180002f3d
mov rdi, qword [0x180014958]
test rdi, rdi
je 0x180003012
lea rdx, str.Hook_IAT_x64_failed_n
lea rcx, [0x18000fed0]
call rdi
lea rcx, [0x18000fed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r14 + 0xc]
mov r8, rbp
mov rdx, rsi
call fcn.180002b0c
mov rdx, qword [rsp + 0x88]
xor r8d, r8d
mov ecx, r12d
lea rcx, [rax + rcx*8]
call fcn.180002ce0
test eax, eax
sete bl
mov eax, ebx
jmp 0x180003014
Function at 0x1800035f8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r14
lea rbp, [rax - 0x338]
sub rsp, 0x420
xor esi, esi
lea r8, [rbp + 0x348]
mov rbx, rcx
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 8]
lea edx, [rsi + 0x1a]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x18000366f
mov r9, qword [0x180014958]
test r9, r9
je 0x180003668
mov r8d, eax
lea rdx, str.NtQueryInformationProcess_failed:__08X_n
lea rcx, [0x180010ed0]
call r9
lea rcx, [0x180010ed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x18000381e
mov rdx, qword [rbp + 0x348]
test rdx, rdx
jne 0x180003699
mov rax, qword [0x180014958]
test rax, rax
je 0x180003668
lea rdx, str.Not_a_WOW64_proces___n
lea rcx, [0x180010ed0]
call rax
jmp 0x18000365b
mov r9d, 0x14c
mov qword [rsp + 0x20], rsi
lea r8, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1800036e7
cmp qword [0x180014958], rsi
je 0x180003668
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rbp + 0x348]
lea rdx, str.Reading_PEB___X_failed:__08X_n
mov r9d, eax
lea rcx, [0x180010ed0]
call qword [0x180014958]
jmp 0x18000365b
mov eax, dword [rbp - 0x34]
mov rcx, rbx
test eax, eax
je 0x180003819
mov edx, eax
mov qword [rsp + 0x20], rsi
mov r9d, 0x24
lea r8, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180003743
cmp qword [0x180014958], rsi
je 0x180003668
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rbp - 0x34]
lea rdx, str.Reading_LoaderData___X_failed:__08X_n
mov r9d, eax
lea rcx, [0x180010ed0]
call qword [0x180014958]
jmp 0x18000365b
mov eax, dword [rbp - 0x64]
mov r14d, 0x105
mov edi, eax
mov r9d, 0x58
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800037e3
cmp dword [rsp + 0x48], esi
je 0x1800037cb
cmp word [rsp + 0x5c], r14w
lea r8, [rbp + 0x110]
movzx eax, word [rsp + 0x5c]
mov r9, r14
mov edx, dword [rsp + 0x60]
cmovb r9, rax
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800037cb
movzx eax, word [rsp + 0x5c]
lea rdx, [0x18000aa08]
shr rax, 1
lea rcx, [rbp + 0x110]
mov word [rbp + rax*2 + 0x110], si
call qword [0x180014960]
test eax, eax
je 0x1800037dd
mov eax, dword [rsp + 0x30]
cmp rax, rdi
je 0x180003668
jmp 0x18000374e
mov eax, dword [rsp + 0x48]
jmp 0x18000381e
cmp qword [0x180014958], rsi
je 0x180003816
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Reading_process_list_entry_failed:__08X_n
lea rcx, [0x180010ed0]
call qword [0x180014958]
lea rcx, [0x180010ed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call fcn.1800034e0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180003838
Capabilities:
Get common file path
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov edx, 0x105
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea rcx, [rsp + 0x40]
sub rcx, 2
xor edi, edi
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180003860
mov eax, dword [0x18000abbc]
mov dword [rcx], eax
lea rcx, [rsp + 0x40]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x18000387a
movups xmm0, xmmword [0x18000aa08]
mov eax, dword [0x18000aa18]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 3
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x20], r8d
mov edx, 0x80000000
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x180003936
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 8], rax
test rax, rax
je 0x18000392d
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x18000394d
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x1800048e4
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov dword [rsp + 0x20], 0x30
lea rax, [0x18000d228]
xorps xmm0, xmm0
lea r8, [r11 - 0x38]
xor ebx, ebx
lea rcx, [r11 + 0x10]
mov qword [r11 - 0x30], rbx
mov edx, 0x20019
mov dword [rsp + 0x38], 0x40
mov qword [r11 - 0x28], rax
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x18000498c
mov rcx, qword [rsp + 0x68]
lea r9d, [rbx + 4]
lea r8, [rsp + 0x60]
lea rdx, str.ExecutionState
call fcn.180005a64
test eax, eax
js 0x180004981
mov rax, qword [0x180014958]
test rax, rax
je 0x180004979
mov r8d, dword [rsp + 0x60]
lea rdx, str.Windows_updates_are_pending:_ExecutionState___d_n
lea rcx, [0x1800116d0]
call rax
lea rcx, [0x1800116d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rsp + 0x60], 1
seta bl
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x180004994
Capabilities:
Print debug messages
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x820
mov rdi, rcx
lea r9, str.ldntvdm.ini
lea rcx, str.blacklist
mov r8d, 0x400
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor esi, esi
test eax, eax
je 0x180004a04
lea rbx, [rsp + 0x20]
cmp word [rsp + 0x20], si
je 0x180004a04
mov rdx, rbx
mov rcx, rdi
call qword [0x180014960]
test eax, eax
je 0x180004a1b
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], si
jne 0x1800049ee
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], si
jne 0x1800049da
xor eax, eax
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, qword [0x180014958]
test rax, rax
je 0x180004a47
mov r8, rdi
lea rdx, str.Process__S_is_blacklisted__not_injecting._n
lea rcx, [0x1800116d0]
call rax
lea rcx, [0x1800116d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
jmp 0x180004a06
Function at 0x180004ef0
Capabilities:
Get file size
Print debug messages
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov rdi, rdx
and dword [rax - 0x20], 0
mov r8d, 3
mov edx, 0x80000000
mov dword [rax - 0x28], r8d
xor r9d, r9d
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x18000501c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rdi]
xor edx, edx
and dword [rsp + 0x20], 0
mov dword [rdi + 0x18], eax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rdi + 8], rax
test rax, rax
je 0x180004fd5
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x180004f8d
xor eax, eax
jmp 0x180005058
cmp qword [0x180014958], 0
je 0x180004fc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rdx, str.Cannot_map_view_of_file__s:__d
mov r9d, eax
lea rcx, [0x1800120f0]
call qword [0x180014958]
lea rcx, [0x1800120f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rdi + 8]
mov ebx, 0xfffffffd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180005011
cmp qword [0x180014958], 0
je 0x18000500c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rdx, str.Cannot_map_view_of_file__s:__d
mov r9d, eax
lea rcx, [0x1800120f0]
call qword [0x180014958]
lea rcx, [0x1800120f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, 0xfffffffe
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180005056
cmp qword [0x180014958], 0
je 0x180005053
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rdx, str.Cannot_open_file__s:__d
mov r9d, eax
lea rcx, [0x1800120f0]
call qword [0x180014958]
lea rcx, [0x1800120f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180005064
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x10]
mov rdi, rcx
mov eax, dword [rcx + 0x18]
mov rbx, r9
lea r11, [r9 - 7]
add r11, rax
cmp r9, r11
jae 0x1800050c5
lea r8, [0x18000bb78]
neg r8
xor ecx, ecx
lea rdx, [0x18000bb78]
mov r10b, byte [rdx]
cmp r10b, 0x99
je 0x1800050ad
lea rax, [r8 + rdx]
cmp byte [rax + rbx], r10b
jne 0x1800050b7
inc ecx
inc rdx
cmp ecx, 7
jb 0x18000509a
cmp ecx, 7
je 0x1800050d2
add rbx, 2
cmp rbx, r11
jb 0x180005091
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180014958]
test rax, rax
je 0x180005101
mov r8, rbx
lea rdx, str.MatchEng_Pattern_found_at__X_n
sub r8, r9
lea rcx, [0x1800120f0]
call rax
lea rcx, [0x1800120f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub rbx, qword [rdi + 0x10]
mov rax, rbx
jmp 0x1800050c7