joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140109c50
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14018c8f0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140109d54
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140109d4f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140109d24
cmp qword [rsp + 0x38], 2
jb 0x140109d24
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140109d24
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140109d24
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140109c97
jmp 0x140109de6
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140109de6
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140109dbc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140109dbc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140109dbc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140109d54
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret

Function at 0x140109e00
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14018c8f0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140109e8e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140109e32
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x1401360f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140136116
mov dword [rsp + 0x20], 1
jmp 0x14013611e
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14014ae30
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14014ae53
mov byte [rsp + 0x20], 1
jmp 0x14014ae58
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x180001120
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rdi
sub rsp, 0x888
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x860], rax
xor ebp, ebp
movzx edi, cx
test dl, 0x1f
je 0x18000121a
lea rdx, [0x180007428]
mov qword [rsp + 0x880], rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x180001216
mov qword [rsp + 0x878], rsi
lea rsi, [rsp + 0x8b8]
call fcn.180001030
mov r9, qword [rsp + 0x8b0]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rsi
mov r8d, 0x400
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf_s]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea r9d, [rbp + 1]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
movzx edx, di
mov dword [rsp + 0x30], ebp
mov rcx, rbx
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rsi, qword [rsp + 0x878]
mov rbx, qword [rsp + 0x880]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.180005870
add rsp, 0x888
pop rdi
pop rbp
ret
mov eax, ebp
jmp 0x1800011f4
mov eax, ebp
jmp 0x1800011fc

Function at 0x180001220
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x180007430]
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180001308
xor ecx, ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
lea rdx, str.Thank_You
mov dword [rsp + 0x40], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800012fd
cmp dword [rsp + 0x48], 1
jne 0x1800012fd
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x58], rdi
call fcn.1800058e0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov rdi, rax
lea rdx, str.Thank_You
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800012f0
test rdi, rdi
je 0x1800012f0
lea rdx, str.For_supporting_my_work
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
mov rcx, rdi
call fcn.180005894
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x180001320
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREDuo
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800013c2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Booting
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800013b7
cmp dword [rsp + 0x34], 1
jne 0x1800013b7
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov rbx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180005870
add rsp, 0x260
pop rbx
ret

Function at 0x1800013e0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x288
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9, qword [0x18000b900]
lea r8, str.SOFTWAREDuo_s
mov dword [rsp + 0x50], ecx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.180001040
xor ecx, ecx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180001490
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
lea rdx, str.Status
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180005870
add rsp, 0x288
ret

Function at 0x1800014b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9, qword [0x18000b900]
lea r8, str.SOFTWAREDuo_s
mov ebx, 0x64
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov dword [rsp + 0x30], ebx
call fcn.180001040
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000155b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ScaleFactor
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
cmp eax, ebx
jb 0x18000156f
mov ecx, 0xc8
mov ebx, eax
cmp eax, ecx
cmova ebx, ecx
xorps xmm0, xmm0
mov eax, ebx
cvtsi2ss xmm0, rax
divss xmm0, dword [0x180008cbc]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180005870
add rsp, 0x270
pop rbx
ret
Function at 0x1800015a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x278
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp dword [0x18000b914], 0
lea r8, str.SOFTWAREDuo_s
mov r9, qword [0x18000b900]
mov eax, 0x1e
mov ecx, 0x3c
mov edx, 0x104
cmovne eax, ecx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], eax
call fcn.180001040
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180001658
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.RefreshRate
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180005870
add rsp, 0x278
ret
Function at 0x180001680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov dword [rcx], 0
mov rbx, r9
mov dword [rdx], 0x3e8
mov r14, r8
mov dword [r8], 0x3e8
mov rsi, rdx
mov dword [r9], 0xa0
lea r8, str.SOFTWAREDuo_s
mov r9, qword [0x18000b900]
mov rdi, rcx
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.180001040
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180001841
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x34], eax
lea rdx, str.MinLuminance
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x3e8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.MaxFullFrameLuminance
mov dword [rsp + 0x4c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x3e8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.MaxLuminance
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x64]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xa0
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SDRWhiteLevel
mov dword [rsp + 0x54], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
lea eax, [rcx - 0x50]
cmp eax, 0x190
ja 0x18000181b
mov dword [rbx], ecx
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
cmp ecx, eax
jae 0x180001836
mov edx, dword [rsp + 0x3c]
cmp eax, edx
ja 0x180001836
mov dword [rdi], ecx
mov dword [rsi], edx
mov dword [r14], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.180005870
add rsp, 0x290
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180002250
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub rsp, 0x298
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r9, qword [0x18000b900]
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x60], edx
mov edx, 0x104
mov dword [rsp + 0x68], r8d
lea r8, str.SOFTWAREDuo_s
call fcn.180001040
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000239d
mov rcx, qword [rsp + 0x50]
lea rdx, str.Width
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.Width
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.Height
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.Height
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.RefreshRate
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
lea rdx, str.RefreshRate
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180005870
add rsp, 0x298
ret
Function at 0x180004800
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x180004864
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x180004852
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000484b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18000481f
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x18000b920]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180004874
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, ecx
mov esi, 5
imul rdi, rax, 0x38
add rdi, qword [0x18000bb20]
test byte [rdi + 0x20], 1
mov rbx, qword [rdi]
je 0x1800048aa
sub rbx, rsi
mov esi, 7
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800048cc
mov eax, 0xa
jmp 0x180004919
mov byte [rbx], 0xe9
mov eax, dword [rdi + 8]
sub eax, ebx
sub eax, 5
mov dword [rbx + 1], eax
test byte [rdi + 0x20], 1
je 0x1800048e8
mov rax, qword [rdi]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rdi + 0x20], 6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180004bc4
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9, rcx
test r8b, r8b
je 0x180004bde
cmp r8b, 0x90
je 0x180004bde
cmp r8b, 0xcc
je 0x180004bde
xor eax, eax
ret
mov r10d, 1
mov ecx, r10d
cmp edx, r10d
jbe 0x180004bfb
mov eax, ecx
cmp byte [rax + r9], r8b
jne 0x180004bdb
add ecx, r10d
cmp ecx, edx
jb 0x180004bec
mov eax, r10d
ret
Function at 0x180004f98
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
mov r15, qword [rbp - 0x50]
cmp rdi, 0x40000000
jbe 0x180004fe6
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x18000bb18]
lea rax, [rdi + 0x40000000]
cmp r15, rax
cmova r15, rax
sub r15, 0xfff
test rbx, rbx
je 0x180005021
cmp rbx, r14
jb 0x18000501c
cmp rbx, r15
jae 0x18000501c
cmp qword [rbx + 8], 0
jne 0x180005177
mov rbx, qword [rbx]
jmp 0x180005002
mov rsi, rdi
cmp rdi, r14
jb 0x18000509e
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, rsi
div r12
sub rsi, rdx
jmp 0x180005064
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000506c
cmp dword [rbp - 0x10], 0x10000
je 0x18000506e
mov rsi, qword [rbp - 0x28]
cmp rsi, r12
jb 0x18000506c
sub rsi, r12
cmp rsi, r14
jae 0x18000503a
xor esi, esi
test rsi, rsi
je 0x18000509e
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180005137
cmp rsi, r14
jae 0x180005029
test rbx, rbx
jmp 0x18000512a
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x180005103
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180005103
cmp dword [rbp - 0x10], 0x10000
je 0x180005105
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jbe 0x1800050c6
xor edi, edi
test rdi, rdi
je 0x180005177
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180005137
cmp rdi, r15
jbe 0x1800050a6
jmp 0x180005177
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x18000514a
mov rax, qword [0x18000bb18]
mov qword [rbx], rax
mov qword [0x18000bb18], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140001c0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c56
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c58
xor al, al
add rsp, 0x28
ret
Function at 0x140005020
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140011f0c
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140005220]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14000507a
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000dd50
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rbx, rcx
lea rdi, [rcx + 0x18]
cmp qword [rdi], 0xf
jbe 0x14000dd82
mov rcx, qword [rcx]
lea rbp, [rbx + 0x18]
jmp 0x14000dd85
mov rbp, rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [0x14001ee80]
mov rsi, rax
mov r14, rdi
cmp rax, 0xffffffffffffffff
je 0x14000de43
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
test eax, eax
je 0x14000de3a
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x70]
mulsd xmm6, qword [0x140018eb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14000de27
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000de1e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000de33
mov rcx, r8
call fcn.140011f48
lea rdi, [rbx + 0x18]
mov qword [rdi], 0xf
movaps xmm0, xmm6
jmp 0x14000de87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, rbp
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14000de78
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000de73
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000dead
mov rcx, r8
call fcn.140011f48
mov qword [r14], 0xf
movsd xmm0, qword [0x140018ee8]
mov byte [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3