joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009b060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
mov r11, rdx
mov r9d, ecx
test rdx, rdx
je 0x18009b0e5
lea rdi, [0x1800c4290]
not r9d
cmp r8d, 8
jb 0x18009b0bc
mov edx, r8d
shr rdx, 3
add r8d, 0xfffffff8
mov ebx, 8
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rdi + rax*4]
sub rbx, 1
jne 0x18009b098
sub rdx, 1
jne 0x18009b08f
test r8d, r8d
je 0x18009b0df
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rdi + rax*4]
add r8d, 0xffffffff
jne 0x18009b0c1
not r9d
mov r10d, r9d
mov rbx, qword [rsp + 8]
mov eax, r10d
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140001c50
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x190
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140001d27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140070830
mov rsi, rax
mov dword [rsp + 0x28], ebx
test ebx, ebx
je 0x140001d27
lea rax, [0x1400ce3f8]
mov qword [rsp + 0x1a0], rax
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x40]
call fcn.1400887d0
lea rax, vtable.boost::system::system_error.0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x80], shutdown
mov qword [rsp + 0x78], 0
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x120]
call fcn.140004530
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140004580
lea rdx, [0x140107820]
lea rcx, [rsp + 0x90]
call fcn.1400905b8
nop
mov eax, edi
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140007490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x14010b358]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword [rcx]
mov rbx, rcx
lea rdx, [rbp - 0x39]
mov qword [rbp - 0x79], rax
mov rax, qword [rcx + 8]
xor r8d, r8d
mov qword [rbp - 0x71], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x69], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x61], rax
mov rax, qword [rcx + 0x20]
mov qword [rbp - 0x59], rax
mov rax, qword [rcx + 0x28]
mov qword [rbp - 0x51], rax
mov rax, qword [rcx + 0x30]
mov qword [rbp - 0x49], rax
mov rax, qword [rcx + 0x38]
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x41], rax
call fcn.140005b60
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
mov r8d, 1
call fcn.140005b60
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
mov r8d, 2
call fcn.140005b60
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
mov r8d, 3
call fcn.140005b60
mov edi, 4
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
mov r8d, edi
call fcn.140005b60
lea r8d, [rdi + 1]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140005b60
lea r8d, [rdi + 2]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140005b60
lea r8d, [rdi + 3]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140005b60
lea r8d, [rdi + 4]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140005b60
lea r8d, [rdi + 5]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.140005b60
lea rdx, [rbp - 0x79]
lea r8, [rbp - 0x75]
sub rdx, rbx
lea rax, [rbx + 8]
sub r8, rbx
nop dword [rax]
mov ecx, dword [rdx + rax - 8]
lea rax, [rax + 0x10]
xor dword [rax - 0x18], ecx
mov ecx, dword [r8 + rax - 0x18]
xor dword [rax - 0x14], ecx
mov ecx, dword [rdx + rax - 0x10]
xor dword [rax - 0x10], ecx
mov ecx, dword [r8 + rax - 0x10]
xor dword [rax - 0xc], ecx
dec rdi
jne 0x1400075c0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140088760
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140008f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x14010b358]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
lea rsi, reloc.WS2_32.dll_accept
lea r14, sym.NsGpuCNMiner.exe_.t_bF._Ay7_Z__E9S6_euXX:_ghT:_5mi
lea r15, str.Nabil_S._Al_Ramli
nop
mov rax, qword [rbx + 0x28]
mov r9d, 4
mov r10, rbx
xor rax, qword [rbx + 0xa0]
lea r11d, [r9 + 1]
xor rax, qword [rbx + 0x50]
xor rax, qword [rbx]
xor rax, qword [rbx + 0x78]
mov qword [rsp], rax
mov rax, qword [rbx + 0x80]
xor rax, qword [rbx + 0x30]
xor rax, qword [rbx + 8]
xor rax, qword [rbx + 0xa8]
xor rax, qword [rbx + 0x58]
mov qword [rsp + 8], rax
mov rax, qword [rbx + 0x38]
xor rax, qword [rbx + 0xb0]
xor rax, qword [rbx + 0x60]
xor rax, qword [rbx + 0x88]
xor rax, qword [rbx + 0x10]
mov qword [rsp + 0x10], rax
mov rax, qword [rbx + 0xb8]
xor rax, qword [rbx + 0x68]
xor rax, qword [rbx + 0x90]
xor rax, qword [rbx + 0x18]
xor rax, qword [rbx + 0x40]
mov qword [rsp + 0x18], rax
mov rax, qword [rbx + 0x98]
xor rax, qword [rbx + 0x20]
xor rax, qword [rbx + 0x48]
xor rax, qword [rbx + 0xc0]
xor rax, qword [rbx + 0x70]
mov qword [rsp + 0x20], rax
nop word [rax + rax]
lea ecx, [r9 - 3]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
mov ecx, r9d
mov r8, qword [rsp + rax*8]
mov eax, 0x66666667
rol r8, 1
imul r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
mov ecx, 5
xor r8, qword [rsp + rax*8]
mov rax, r10
nop dword [rax + rax]
xor qword [rax], r8
lea rax, [rax + 0x28]
dec rcx
jne 0x1400090d0
inc r9d
add r10, 8
dec r11
jne 0x140009080
mov r9, qword [rbx + 8]
xor r8d, r8d
nop
movsxd rax, dword [r8 + r14 + 0xd84d0]
mov ecx, dword [r8 + r14 + 0xd8470]
add r8, 4
mov rdx, qword [rbx + rax*8]
rol r9, cl
mov qword [rbx + rax*8], r9
mov r9, rdx
cmp r8, 0x60
jl 0x1400090f0
lea r11, [rbx + 0x10]
mov edi, 5
mov r10, qword [r11 - 0x10]
mov r9, qword [r11 - 8]
mov rcx, qword [r11]
mov rdx, qword [r11 + 8]
mov r8, qword [r11 + 0x10]
mov rax, r9
not rax
lea r11, [r11 + 0x28]
and rax, rcx
not rcx
and rcx, rdx
xor rax, r10
not rdx
mov qword [r11 - 0x38], rax
xor qword [r11 - 0x30], rcx
and rdx, r8
xor qword [r11 - 0x28], rdx
not r8
and r8, r10
not r10
xor qword [r11 - 0x20], r8
and r10, r9
xor qword [r11 - 0x18], r10
dec rdi
jne 0x140009121
mov rax, qword [rsi]
add rsi, 8
xor qword [rbx], rax
cmp rsi, r15
jl 0x140008fd0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140088760
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140010790
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, 0x8080
call fcn.14009af70
sub rsp, rax
mov rax, qword [0x14010b358]
xor rax, rsp
mov qword [rsp + 0x8060], rax
mov ebx, ecx
lea r8, [rsp + 0x80a0]
lea rcx, [rsp + 0x60]
call fcn.14008a1e0
cmp ebx, dword [0x140136de4]
jg 0x1400107e5
lea rcx, [rsp + 0x60]
call fcn.1400105f0
cmp byte [0x140132ed0], 0
je 0x14001095d
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov rax, rbx
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140010800
dec eax
movsxd rcx, eax
cmp rcx, 0x4000
jae 0x140010976
mov qword [rsp + 0x8078], rdi
mov byte [rsp + rcx + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x48]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [0x140132ec0]
movzx edx, word [rsp + 0x56]
test ecx, ecx
je 0x14001088c
cmp ecx, 0xffffffff
jne 0x140010872
movzx ecx, dx
mov dword [0x140132ec0], ecx
test ecx, ecx
jne 0x140010863
mov ecx, 1
jmp 0x140010883
cmp ecx, 0x3bb
jle 0x140010889
mov ecx, 0x3bb
jmp 0x140010883
mov eax, dword [0x140132ec8]
add eax, 3
mov dword [0x140132ec8], eax
add ecx, eax
mov dword [0x140132ec0], ecx
movzx edx, cx
movzx ecx, word [rsp + 0x54]
movzx r9d, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
movzx eax, dx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._.2d:_.2d:_.2d:_.3d_t_x_t_s_r_n
lea rcx, [rsp + 0x4060]
call fcn.140089494
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [0x140132ed0]
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140010955
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x4060]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140010921
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x4060]
mov r8, rbx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x8078]
mov rcx, qword [rsp + 0x8060]
xor rcx, rsp
call fcn.140088760
add rsp, 0x8080
pop rbx
ret
call fcn.140089f2c
int3
Function at 0x1400118d0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14010b358]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdx, [rsp + 0x40]
mov r8d, 0x12c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x30], 0
mov esi, 1
lea rcx, [rsp + 0x40]
mov r8d, esi
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001197c
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x190], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
lea ebx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [0x140132ecc]
cmp ebx, 0x1e847e
mov rbx, qword [rsp + 0x190]
cmovbe eax, esi
mov byte [0x140132ecc], al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140088760
mov rsi, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
Function at 0x1400119a0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x4f8]
sub rsp, 0x5e0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14010b358]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov rbx, rcx
mov byte [rbp - 0x30], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x2f]
call fcn.140091e20
mov r8d, 0x104
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140011a61
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x30]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test eax, eax
je 0x140011a61
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.140016200
nop
mov rdi, qword [rsp + 0x38]
mov r9, rdi
mov r8d, esi
xor edx, edx
lea rcx, [rbp - 0x30]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
jne 0x140011a68
test rdi, rdi
je 0x140011a61
mov rcx, rdi
call fcn.140089328
xor al, al
jmp 0x140011b88
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov edx, ebx
mov rcx, rbx
lea r8, str._RwsjodGjmfHmgl_353835f5_Blls_mxM_nd
nop dword [rax]
movzx eax, byte [rcx + r8]
test dl, 1
je 0x140011a8e
xor al, 1
jmp 0x140011a90
xor al, 3
mov byte [rsp + rcx + 0x60], al
inc edx
inc rcx
cmp edx, 0x24
jl 0x140011a80
mov byte [rbp - 0x7c], 0
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x140011a54
mov esi, dword [rsp + 0x20]
mov r8d, esi
mov rdx, qword [rsp + 0x28]
lea rcx, [rbp + 0xe0]
call fcn.1400889a0
cmp rsi, 0x3e8
jae 0x140011b82
mov byte [rbp + rsi + 0xe0], 0
mov dword [rsp + 0x60], 0x6f72684b
mov dword [rsp + 0x64], 0x736f6e
lea rcx, [rbp + 0xe0]
call fcn.14008e7bc
mov rsi, rax
test rax, rax
je 0x140011a54
lea rcx, [rsp + 0x60]
call fcn.14008e7bc
mov r14, rax
test rax, rax
je 0x140011b60
mov rcx, rax
call fcn.1400aef10
mov rbx, rax
mov rcx, rsi
call fcn.1400aef10
mov rdx, rbx
mov rcx, rax
call fcn.140089c20
mov rbx, rax
test rax, rax
je 0x140011b58
lea rcx, [rbp + 0xe0]
sub rcx, rsi
add rbx, rcx
mov rcx, r14
call fcn.140089874
mov rcx, rsi
call fcn.140089874
test rbx, rbx
je 0x140011a54
test rdi, rdi
je 0x140011b7e
mov rcx, rdi
call fcn.140089328
mov al, 1
jmp 0x140011b88
call fcn.140089f2c
nop
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.140088760
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140016f30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x80
mov r14, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbp, qword [rsp + 0x28]
mov r15, qword [rsp + 0x30]
cmp r14, 0x40000000
jbe 0x140016f70
lea rax, [r14 - 0x40000000]
cmp rbp, rax
cmovb rbp, rax
mov rdi, qword [0x14013afd0]
lea rax, [r14 + 0x40000000]
cmp r15, rax
cmova r15, rax
sub r15, 0xfff
test rdi, rdi
je 0x140016fae
cmp rdi, rbp
jb 0x140016fa6
cmp rdi, r15
jae 0x140016fa6
cmp qword [rdi + 8], 0
jne 0x14001710d
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140016f91
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rsi
mov rbx, r14
cmp r14, rbp
jb 0x140017025
nop word [rax + rax]
mov esi, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rsi
sub rbx, rdx
sub rbx, rsi
cmp rbx, rbp
jb 0x140017025
nop word [rax + rax]
lea rdx, [rsp + 0x50]
mov r8d, gethostbyname
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140017025
cmp dword [rsp + 0x70], 0x10000
je 0x140017085
mov rbx, qword [rsp + 0x58]
cmp rbx, rsi
jb 0x140017025
sub rbx, rsi
cmp rbx, rbp
jae 0x140016ff0
test rdi, rdi
jne 0x1400170ba
cmp r14, r15
ja 0x1400170fd
nop word [rax + rax]
mov r8d, dword [rsp + 0x48]
mov rdx, r15
mov rcx, r14
call fcn.140016e90
mov r14, rax
test rax, rax
je 0x1400170fd
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x1400170ba
cmp r14, r15
jbe 0x140017040
jmp 0x1400170fd
test rbx, rbx
je 0x140017025
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x1400170ba
cmp rbx, rbp
jae 0x140016fd0
jmp 0x14001702e
xor eax, eax
lea rcx, [rdi + 0x40]
mov rdx, rcx
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], eax
sub rdx, rdi
nop dword [rax]
mov rax, qword [rdi + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rdi + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x1400170d0
mov rax, qword [0x14013afd0]
mov qword [0x14013afd0], rdi
mov qword [rdi], rax
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rdi
mov rbp, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x140017bf0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14010b358]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140017cf9
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140017cf0
cmp dword [rsp + 0x20], 0x10
jb 0x140017cd2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x140017cd2
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x140017cd2
mov r8, qword [rbx]
test r8, r8
jne 0x140017c93
mov rcx, qword [0x140135058]
xor edx, edx
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x140017cf0
jmp 0x140017cc2
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x140017cc2
mov rcx, qword [0x140135058]
lea r9d, [rax + rax]
xor edx, edx
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x140017cf0
mov ecx, dword [rbx + 8]
mov qword [rbx], rax
add ecx, ecx
mov dword [rbx + 8], ecx
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rcx + rdx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140017c42
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140088760
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140017d20
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov ebp, r8d
mov r14d, edx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov rdi, rcx
call fcn.140017bf0
cmp qword [rdi], rbx
je 0x140017da8
cmp dword [rdi + 0xc], ebx
jbe 0x140017da8
mov qword [rsp + 0x30], rsi
nop dword [rax + rax]
mov rax, qword [rdi]
mov ecx, ebx
xor edx, edx
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x140017d9c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.140017a30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x140017d60
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140017dc0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
cmp dword [rcx + 0xc], ebx
jbe 0x140017e18
mov qword [rsp + 0x30], rdi
nop dword [rax]
mov rax, qword [rsi]
xor edx, edx
mov r8d, dword [rax + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x140017e0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rsi + 0xc]
jb 0x140017de0
mov rdi, qword [rsp + 0x30]
mov r8, qword [rsi]
mov rcx, qword [0x140135058]
xor edx, edx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]

Function at 0x140017e40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov esi, edx
mov ebp, 5
imul rbx, rbx, 0x38
add rbx, qword [0x14013afc0]
test byte [rbx + 0x20], 1
mov rdi, qword [rbx]
je 0x140017e79
sub rdi, rbp
mov ebp, 7
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140017e9e
mov eax, 0xa
jmp 0x140017f2d
test esi, esi
je 0x140017ec0
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x140017ee3
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x140017ee3
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x140017edc
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x140017ee3
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
movzx eax, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140017f50
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov esi, ecx
mov ecx, dword [0x14013afcc]
mov ebx, edi
test ecx, ecx
je 0x1400180f2
mov rax, qword [0x14013afc0]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x140017fa0
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x140017f80
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
cmp ebx, 0xffffffff
je 0x1400180f2
mov qword [rsp + 0x60], rbp
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
call fcn.140017bf0
mov r12, qword [rsp + 0x20]
mov r13d, dword [rsp + 0x2c]
test r12, r12
je 0x14001803f
test r13d, r13d
je 0x14001803f
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov r15d, r13d
mov r14, r12
mov r8d, dword [r14]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0x14001802c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, edi
test esi, esi
setne r8b
or edx, 0xffffffff
mov rcx, rbp
call fcn.140017a30
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r14, 4
dec r15
jne 0x140017ff0
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r8d, dword [0x14013afcc]
cmp ebx, r8d
jae 0x140018088
nop dword [rax + rax]
mov rax, qword [0x14013afc0]
mov ecx, ebx
imul rcx, rcx, 0x38
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x140018081
mov edx, esi
mov ecx, ebx
call fcn.140017e40
mov edi, eax
test eax, eax
jne 0x140018088
mov r8d, dword [0x14013afcc]
inc ebx
cmp ebx, r8d
jb 0x140018050
test r12, r12
je 0x1400180e3
test r13d, r13d
je 0x1400180d1
mov rsi, r12
mov rbp, r13
nop dword [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1400180c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 4
dec rbp
jne 0x1400180a0
mov rcx, qword [0x140135058]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret