joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180074500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov r8, rcx
mov r10, qword [rcx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x18007452e
mov rdx, qword [rcx]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov ecx, edi
movabs rsi, 0x100000001b3
test r10, r10
je 0x180074563
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, rsi
inc rcx
cmp rcx, r10
jb 0x180074550
lea rdx, [rsp + 0x28]
call fcn.180076010
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800745e3
lea r10, [rax + 0x30]
mov rdx, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x18007458c
mov rcx, qword [r14]
test rdx, rdx
je 0x1800745a4
movzx eax, byte [rcx + rdi]
xor rbx, rax
imul rbx, rsi
inc rdi
cmp rdi, rdx
jb 0x180074591
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, r10
call fcn.180076480
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800745d7
mov rax, qword [rax + 0x30]
jmp 0x1800745c9
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800a1d58
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800a1d58
int3

Function at 0x180074600
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov r8, rcx
mov r10, qword [rcx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x18007462e
mov rdx, qword [rcx]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov ecx, edi
movabs rsi, 0x100000001b3
test r10, r10
je 0x180074663
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, rsi
inc rcx
cmp rcx, r10
jb 0x180074650
lea rdx, [rsp + 0x28]
call fcn.180076010
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800746e3
lea r10, [rax + 0x70]
mov rdx, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x18007468c
mov rcx, qword [r14]
test rdx, rdx
je 0x1800746a4
movzx eax, byte [rcx + rdi]
xor rbx, rax
imul rbx, rsi
inc rdi
cmp rdi, rdx
jb 0x180074691
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, r10
call fcn.180076480
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800746d7
mov rax, qword [rax + 0x30]
jmp 0x1800746c9
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800a1d58
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800a1d58
int3
Function at 0x180077b40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x180077b65
cvtsi2ss xmm0, rdx
jmp 0x180077b7a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1800ccb9c
movss xmm1, dword [0x180342ed8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x180077ba8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180077ba8
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x180077bda
cmp rbx, 0x200
jae 0x180077bd7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x180077bda
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180075960
Function at 0x180086b90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180086bf1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180086bb0
mov ecx, dword [r9]
jmp 0x180086cdb
cmp ecx, 0x4e0
jb 0x180086cdb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180086c10
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180086c60
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800891e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
cmp byte [rcx + 8], 0
je 0x180089364
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180089364
mov rsi, qword [0x180361b58]
cmp qword [rsi + 8], 0
je 0x180089364
mov rbx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180008b90
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x180360298]
call fcn.180074500
mov rdx, qword [rbx]
mov r9, qword [rdx + 0x320]
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, rbx
call r9
mov ebx, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1800892b5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800892b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008937a
call fcn.1800a3080
cmp ebx, 4
jne 0x180089364
mov rsi, qword [0x180361b58]
mov edi, dword [rdi + 0x20]
cmp qword [rsi + 8], 0
je 0x180089364
mov rbx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180008b90
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x180360298]
call fcn.180074500
mov r8, qword [rbx]
mov r10, qword [r8 + 0x368]
mov r9d, edi
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, rbx
call r10
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180089364
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008935f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180089374
call fcn.1800a3080
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1800acf80
int3
call fcn.1800acf80
int3
Function at 0x18008eb90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp byte [rcx + 8], 0
mov rbx, r8
mov rdi, rcx
je 0x18008ec81
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008ec81
mov rcx, rbx
call fcn.18006c060
test al, al
je 0x18008ec81
movaps xmmword [rsp + 0x70], xmm6
lea rdx, [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm7
mov rcx, rbx
movaps xmmword [rsp + 0x50], xmm8
call fcn.18006bd40
movss xmm7, dword [rdi + 0x20]
lea rdx, [rsp + 0x20]
mov rcx, rbx
cvtps2pd xmm7, xmm7
call fcn.18006bba0
movsd xmm0, qword [rax + 8]
movsd xmm8, qword [rax]
mulsd xmm0, qword [0x180342d08]
mulsd xmm8, qword [0x180342d08]
call fcn.1800ccc30
movaps xmm6, xmm0
movaps xmm0, xmm8
mulsd xmm6, xmm7
call fcn.1800d0850
movsd xmm1, qword [rsp + 0x30]
mulsd xmm0, xmm6
subsd xmm1, xmm0
movaps xmm0, xmm8
movsd qword [rsp + 0x30], xmm1
call fcn.1800ccc30
movsd xmm1, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mulsd xmm0, xmm6
mov rcx, rbx
addsd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
call fcn.18006c560
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x18008f110
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp byte [rcx + 8], 0
mov rdi, r8
mov rbx, rcx
je 0x18008f242
lea rdx, [rsp + 0x30]
mov rcx, r8
call fcn.18006bd40
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008f1e4
movaps xmmword [rsp + 0x70], xmm6
lea rdx, [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm7
mov rcx, rdi
movss xmm7, dword [rbx + 0x20]
cvtps2pd xmm7, xmm7
movaps xmmword [rsp + 0x50], xmm8
call fcn.18006bba0
movsd xmm0, qword [rax + 8]
movsd xmm8, qword [rax]
mulsd xmm0, qword [0x180342d08]
mulsd xmm8, qword [0x180342d08]
call fcn.1800ccc30
movaps xmm6, xmm0
movaps xmm0, xmm8
mulsd xmm6, xmm7
call fcn.1800d0850
movsd xmm1, qword [rsp + 0x30]
mulsd xmm0, xmm6
subsd xmm1, xmm0
movaps xmm0, xmm8
movsd qword [rsp + 0x30], xmm1
call fcn.1800ccc30
movsd xmm1, qword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
mulsd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
addsd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008f1fe
movss xmm0, dword [rbx + 0x20]
cvtps2pd xmm0, xmm0
jmp 0x18008f223
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008f220
movss xmm0, dword [rbx + 0x20]
xorps xmm0, xmmword [0x180343340]
cvtss2sd xmm0, xmm0
jmp 0x18008f223
xorps xmm0, xmm0
mov rcx, rdi
movsd qword [rsp + 0x38], xmm0
call fcn.18006c060
test al, al
jne 0x18008f242
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.18006c560
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x180092640
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18035c0c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx], 0
mov rbx, rcx
jne 0x1800926d5
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], 0
cmp byte [rcx], 0xe9
jne 0x1800926b1
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800926b1
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call fcn.1800d23f0
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x38
mov rcx, rbx
call fcn.1800a3080
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a3060
add rsp, 0x30
pop rbx
ret
Function at 0x180092960
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18035c0c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x180091d80]
mov qword [rcx + 8], rax
mov rcx, qword [0x180360190]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.180070a20
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov r8d, 0x40
mov byte [rbx + 1], al
call fcn.180071b20
mov qword [rbx + 0x20], rax
test rax, rax
je 0x180092b03
mov rcx, qword [rbx + 8]
mov r9d, 0x40
mov qword [rbx + 0x2e], rcx
mov r8d, 0x3000
movsd xmm0, qword [rbx + 0x28]
movsd qword [rax], xmm0
mov ecx, dword [rbx + 0x30]
mov dword [rax + 8], ecx
movzx ecx, word [rbx + 0x34]
mov word [rax + 0xc], cx
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180092b03
mov qword [0x180360178], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call fcn.1800d23f0
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
mov r8d, 0x40
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180092ad7
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
lea rcx, [0x18035e050]
call fcn.1800078e0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a3060
add rsp, 0x30
pop rbx
ret
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
jmp 0x180092abc
lea rdx, str.Hook:_Failed_to_allocate_memory_n
lea rcx, [0x18035e050]
call fcn.1800078e0
jmp 0x180092ac1
Function at 0x180092b20
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18035c0c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x180091ca0]
mov qword [rcx + 8], rax
mov rcx, qword [0x180360150]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.180070a20
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov r8d, 0x40
mov byte [rbx + 1], al
call fcn.180071b20
mov qword [rbx + 0x20], rax
test rax, rax
je 0x180092cc3
mov rcx, qword [rbx + 8]
mov r9d, 0x40
mov qword [rbx + 0x2e], rcx
mov r8d, 0x3000
movsd xmm0, qword [rbx + 0x28]
movsd qword [rax], xmm0
mov ecx, dword [rbx + 0x30]
mov dword [rax + 8], ecx
movzx ecx, word [rbx + 0x34]
mov word [rax + 0xc], cx
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180092cc3
mov qword [0x180360168], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call fcn.1800d23f0
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
mov r8d, 0x40
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180092c97
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
lea rcx, [0x18035e050]
call fcn.1800078e0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a3060
add rsp, 0x30
pop rbx
ret
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
jmp 0x180092c7c
lea rdx, str.Hook:_Failed_to_allocate_memory_n
lea rcx, [0x18035e050]
call fcn.1800078e0
jmp 0x180092c81
Function at 0x180095150
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rdx]
mov rbx, r8
dec eax
mov r8, rdx
mov rdi, rcx
cmp eax, 0x20
ja case.0x180095239.4
lea rsi, [0x180000000]
nop dword [rax]
cdqe
movzx eax, byte [rsi + rax + 0x953b8]
mov ecx, dword [rsi + rax*4 + 0x9538c]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0xd0]
movzx r8d, byte [r8 + 1]
add rax, 0xffffffffffffffc4
lea r8, [rax + r8*2]
movzx eax, byte [r8]
dec eax
cmp eax, 0x20
jbe 0x180095180
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xcc]
movzx edx, word [rsi + rax*2 + 0xdcd00]
mov rcx, rdi
call fcn.180093a00
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x9c]
cmp al, 8
jae case.0x180095239.4
lea edx, [rax + 0x6d]
mov rcx, rdi
call fcn.180093a00
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [r8 + 1]
add eax, 0xfffffffe
cmp eax, 0x1a
ja case.0x180095239.4
cdqe
movzx eax, byte [rsi + rax + 0x953e8]
mov ecx, dword [rsi + rax*4 + 0x953dc]
add rcx, rsi
jmp rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800961f0
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180095410
movzx eax, byte [rbx + 0xa2]
mov r9, rbx
mov rcx, rdi
mov rdx, qword [rbx + rax*8 + 0xa8]
inc al
mov byte [rbx + 0xa2], al
call fcn.180093f80
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rbx + 0x34]
mov rcx, rdi
call fcn.1800939d0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x1800952ce
lea edx, [rax + 0x35]
jmp 0x1800952e0
cmp eax, 1
jne 0x1800952db
lea edx, [rax + 0x1f]
lea eax, [rdx + 0x19]
jmp 0x1800952e5
mov edx, 0x39
mov eax, 0x20
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.180093a00
movsxd rax, dword [rbx + 8]
mov rcx, rdi
movzx edx, byte [rax + rsi + 0xdcec0]
call fcn.180093a00
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x180095327
lea edx, [rax + 0x31]
jmp 0x180095339
cmp eax, 1
jne 0x180095334
lea edx, [rax + 0x19]
lea eax, [rdx - 0xa]
jmp 0x18009533e
mov edx, 0x10
mov eax, 0x1a
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.180093a00
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xb8]
jmp 0x1800951ce
movzx edx, byte [rbx + 0xa0]
and edx, 7
add edx, 0x85
jmp 0x1800951d6
movsxd rax, dword [rbx + 0x98]
jmp 0x1800951ce
Function at 0x1800a1604
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1800a1632
xor eax, eax
jmp 0x1800a1718
cmp qword [rcx + 0x68], 0
je 0x1800a1643
call fcn.1800a1734
jmp 0x1800a1718
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800a165a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800a165c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800a168e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1800d23f0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1800a1712
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1800a16c5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1800a16ee
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1800aeffc
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1800a1712
cmp rsi, rbx
ja 0x1800a16cc
test rsi, rsi
je 0x1800a1712
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1800aeffc
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800a91f8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1800a922f
call fcn.1800b61e4
mov dword [rax], 0x16
call fcn.1800acf60
xor eax, eax
jmp 0x1800a92bd
mov rdx, r9
mov rcx, r8
call fcn.1800a9194
mov rbx, rax
test rax, rax
je 0x1800a92ba
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1800a90c0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1800a92a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800b6158
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1800a928e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1800a929d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1800b8f74
jmp 0x1800a92ba
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800a92b7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret