joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140254990
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1402549b8
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140254a2c
test rax, rax
jle 0x140254a0c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140254a2c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140254a2c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140255ad0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x140255c88
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x140255b48
cmp eax, 0x40
jae 0x140255b32
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x140255b20
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.140255db0
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x140255b50
lea rsi, [rbx + 0x2c]
jae 0x140255b62
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x140255b50
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.140255db0
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140255ca0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x1402572f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140257342
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140257342
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140257342
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140257342
cmp dword [rcx + 0x84], 0xe
jbe 0x140257342
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140257344
xor al, al
add rsp, 0x28
ret

Function at 0x140257548
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140257582
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140257587
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1402575d0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1402575d0
dec r8
sub rdx, 1
jne 0x1402575b6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140098314
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
test r8, r8
je 0x14009833d
movzx eax, byte [r10 + rdx]
inc r10
add eax, dword [rcx]
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor eax, r9d
mov dword [rcx], eax
cmp r10, r8
jb 0x14009831c
ret

Function at 0x140a9c909
Capabilities:
Encode data using xor

Disassembly:
push rcx
movabs rcx, 0x7852eb78d05b98
mov rcx, qword [rsp]
call fcn.1409938c1
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
call fcn.140e8cdb8
jns 0x140a9c998
xlatb
mov edx, 0xd5e974a9
cli
mov dl, 0x41
sar edx, cl
push rsi
mov esi, 0xbf852adf
test dword [rsi], 0xe694522
cli
and al, byte [rbp - 0x30]
add bl, byte [rdx - 0x24]
jp 0x140a9c8f4
mov gs, word [rax + 0x38a1fac9]
invalid
adc edi, edi
xchg dword [rsi - 0x6f62e1f8], ecx
cmpsd dword [rsi], dword [rdi]
mov edi, 0x9c4f56f0
cmpsd dword [rsi], dword [rdi]
add al, byte [rbp + rbx*8 + 0x248fd616]
and bl, byte [rcx + riz*4 - 0x1e]
xlatb
loop 0x140a9ca07
lock and byte [rdi - 0xc55f29b], bl
sbb al, 0
sahf
fisub word [rbx + 0x5c]
out 0xeb, al
cmp eax, 0xfa39a920
fbld tbyte [rdx - 0x39209e91]
popfq
mov r11b, 0x1e
pop rax
popfq
sbb eax, 0xa34023e1
xor al, bl
jrcxz 0x140a9c9bf
int3
mov edx, 0x6be6a23a
xchg ecx, eax
retf 0xadf8
Function at 0x14001fe00
Capabilities:
Encode data using xor

Disassembly:
fsubr st(1), st(0)
add dword [rbp - 0x7c974657], ecx
and edx, esi
add dword [rdx + 0x23], 0xffffffd6
xor al, 0xad
loop 0x14001fe07
fiadd word [0x12e9d3ee1]
xor bl, byte [rbx + 0x32e58eed]
cmp bh, byte [rbx - 0x127f3e0b]
sahf
fdiv qword [rcx + 0x6b292dbb]
mov bpl, 0xa2
sbb ch, byte [rdi - 3]
pop rcx
fidiv dword es:[rsi - 0x4b]
pop rax
int3

Function at 0x140023f34
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xd27b7107
invalid
jg 0x140023ed0
int3

Function at 0x14002c534
Capabilities:
Encode data using xor

Disassembly:
or byte ds:[rbp + 0x79], bh
jns 0x14002c51c
insb byte [rdi], dx
jge 0x14002c4f4
push sp
add esp, dword [rdi + 0x3c]
sub ah, bh
enter 0xffffffffffff9fb6, 0xffffffffffffffa8
xchg esp, eax
cmp ecx, edx
invalid
std
jns 0x14002c4ed
enter 0x1a32, 0xffffffffffffffaf
xchg esp, eax
pop rdx
xchg ebp, eax
push 0xffffffff8049e67b
call [r14 + 0x3b0b3ed6]
jle 0x14002c4ee
pop rsi
invalid
xchg ecx, eax
in al, 0xa1
wait
add cl, byte ds:[0x1a678ce9a]
jnp 0x14002c554
invalid
xchg esp, eax
jp 0x14002c4c0
invalid
xchg esp, eax
invalid
Function at 0x1400385b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov al, 0xbc
mov word [rsp + 0x182], 0xcda9
mov r8b, byte [rsp + 0x195]
mov r9b, r8b
not r9b
mov byte [rsp + 0x195], r9b
mov byte [rsp + 0x181], 0x58
mov dword [rsp + 0x17c], 0x4396a3f2
mov r9b, r8b
or r9b, 0xdb
mov byte [rsp + 0x195], r9b
mov qword [rsp + 0x170], 0x110199e7
mov r10, qword [rsp + 0x188]
mov qword [rsp + 0x188], 0
mov r11d, dword [rsp + 0x17c]
mov esi, r11d
add esi, 0x1280ab5f
mov dword [rsp + 0xbc], esi
movzx esi, word [rsp + 0x196]
mov di, si
add esi, 0x5568
mov bx, si
lea r14, [rsp + 0x140]
mov word [rsp + 0x196], bx
mov byte [rsp + 0x195], 0xe6
movaps xmm0, xmmword [0x1400420e0]
movaps xmmword [rsp + 0x140], xmm0
mov r15, r10
xor r15, 0xc09960f
mov qword [rsp + 0x188], r15
mov r9b, al
sub r9b, byte [rsp + 0x181]
mov bpl, r8b
and bpl, bpl
mov byte [rsp + 0x195], bpl
mov byte [rsp + 0x150], r9b
sub al, byte [rsp + 0x181]
mov byte [rsp + 0x151], al
mov dword [rsp + 0x184], 0x14ad47f
mov al, byte [rsp + 0x181]
mov esi, r11d
sub esi, 0x50ca0471
mov dword [rsp + 0x184], esi
add al, 0x1a
mov byte [rsp + 0x195], 0x26
mov byte [rsp + 0x152], al
mov bx, di
add bx, 0x26d
mov word [rsp + 0x196], bx
mov al, byte [rsp + 0x181]
add al, 0xd
mov byte [rsp + 0x153], al
mov al, byte [rsp + 0x181]
mov esi, r11d
xor esi, 0xffffffff
mov dword [rsp + 0x184], esi
xor al, 0x2b
mov byte [rsp + 0x154], al
mov esi, r11d
sub esi, 0x6e2e2d76
mov dword [rsp + 0x184], esi
mov al, r8b
sub al, 0x78
mov r9b, byte [rsp + 0x181]
mov byte [rsp + 0x195], al
xor r9b, 0x2b
mov byte [rsp + 0x155], r9b
mov esi, r11d
or esi, esi
mov dword [rsp + 0x184], esi
imul bx, di, 0x7bf5
mov al, byte [rsp + 0x181]
add al, 0xa8
mov word [rsp + 0x196], bx
mov byte [rsp + 0x156], al
mov dword [rsp + 0x184], 0xcdb70acf
mov al, byte [rsp + 0x181]
add al, 0x7c
mov qword [rsp + 0x188], r10
mov byte [rsp + 0x157], al
mov esi, r11d
and esi, 0x3830e433
mov dword [rsp + 0x184], esi
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x184], 0x3c461127
cmp rdx, 0
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x70], r14
mov byte [rsp + 0x6f], r8b
outsd dx, dword [rsi]

Function at 0x140039564
Capabilities:
Encode data using xor

Disassembly:
mov rcx, r11
mov qword [rsp + 0x30], rdx
mov rdx, r14
mov qword [rsp + 0x28], r9
call fcn.14003ec60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
add rax, rcx
mov rcx, qword [rsp + 0x100]
movzx r10d, word [rcx]
mov ecx, r10d
ror dword [rax - 0x75], 1
push rsp
and al, 0x30
Function at 0x14003c82c
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov ch, byte [rsp + 0x107]
mov rbx, rdi
sub rbx, 0x7d4994fd
mov qword [rsp + 0x108], rbx
sub r8b, bpl
mov byte [rsp + 0xc6], r8b
sub dl, byte [rsp + 0x107]
mov byte [rsp + 0xc7], dl
sub ax, r11w
mov word [rsp + 0x104], ax
mov rbx, qword [rsp + 0xf0]
add rbx, 0xffffffffe0ff94b5
mov qword [rsp + 0x60], rbx
mov dl, bpl
or dl, dl
mov byte [rsp + 0x117], dl
cmp rcx, 0
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x3c], r10d
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x2f], bpl
mov word [rsp + 0x2c], r11w
je 0x14003cf4f
jmp 0x14003ca60
mov eax, 0x1c2a91b
mov cx, word [rsp + 0x2c]
and cx, 0xca1d
mov edx, dword [rsp + 0xfc]
mov word [rsp + 0x104], cx
sub eax, edx
mov dword [rsp + 0x24], eax
mov edx, dword [rsp + 0x24]
mov r8, qword gs:[edx]
mov rax, qword [r8 + 0x60]
mov r8, qword [rsp + 0x30]
add r8, 0xe9017a6
mov qword [rsp + 0x108], r8
mov r9d, dword [rsp + 0x3c]
or r9d, 0x55630365
mov dword [rsp + 0x110], r9d
mov r8, qword [rsp + 0x30]
sub r8, 0x169cc5db
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x108], r8
mov r8, qword [rsp + 0x30]
and r8, r8
add rax, 0x20
mov qword [rsp + 0x108], r8
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov r10b, byte [rsp + 0x2f]
mov byte [rsp + 0x117], r10b
mov rax, qword [rax]
mov cx, word [rsp + 0x2c]
and cx, 0xf5c4
mov word [rsp + 0x104], cx
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xe0]
mov qword [rsp + 0xb0], 0
cmp r8, rax
je 0x14003ccdc
jmp 0x14003cd76
mov eax, dword [rsp + 0x3c]
imul ecx, eax, 0x6ea1ee15
mov dword [rsp + 0x110], ecx
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x90], rdx
jmp 0x14003cf00
mov rax, qword [rsp + 0xd0]
add rax, 0x20
mov rcx, qword [rsp + 0xf0]
add rcx, 0xffffffffca193ceb
mov qword [rsp + 0x108], 0x8b06188
mov qword [rsp + 0xb8], rax
mov dx, word [rsp + 0x2c]
imul r8w, dx, 0x87c5
mov word [rsp + 0x104], r8w
cmp rcx, qword [rsp + 0x60]
jne 0x14003ce00
jmp 0x14003cf4f
mov al, 0x13
mov cl, byte [rsp + 0x107]
mov rdx, qword [rsp + 0x90]
sub al, cl
mov qword [rsp + 0xd0], rdx
mov cl, byte [rsp + 0xc7]
mov r8w, word [rsp + 0x2c]
mov word [rsp + 0x104], r8w
mov r9d, dword [rsp + 0x3c]
xor r9d, 0xffffffff
mov dword [rsp + 0x110], r9d
cmp cl, al
je 0x14003c8b3
jmp 0x14003ceb0
lea rax, [0x14003bb70]
mov qword [rsp + 0x78], rax
jmp 0x14003cbc1
Function at 0x1800014e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x18004f040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov rax, qword [0x180050d18]
test rax, rax
jne 0x18000154b
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180050d18], rax
mov dword [rsp + 0x30], 2
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, str.xxxxx
mov qword [rsp + 0x20], rcx
lea r9, [0x180041828]
mov rcx, rax
call fcn.18003d250
mov r15d, r12d
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
sub r14, rdi
sar r14, 3
test r14, r14
je 0x1800016a6
mov rbx, rdi
nop dword [rax + rax]
mov dword [rsp + 0x68], 0xe5885100
mov byte [rsp + 0x6c], 0
mov rsi, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x1800015da
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180050d18], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rsi, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x180001627
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180050d18], rax
mov qword [rsp + 0x20], r12
mov r9d, 5
lea r8, [rsp + 0x68]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [rsp + 0x48]
mov rbp, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x180001674
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180050d18], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, 8
mov rdx, rbp
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
add rbx, 8
movsxd rax, r15d
cmp rax, r14
jb 0x1800015a0
test rdi, rdi
je 0x1800016e7
mov rdx, qword [rsp + 0x60]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800016df
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800016df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18003ebec
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18003e820
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180001720
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x18004f040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov rax, qword [0x180050d18]
test rax, rax
jne 0x18000178b
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180050d18], rax
mov dword [rsp + 0x30], 2
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, str.xxxxx
mov qword [rsp + 0x20], rcx
lea r9, [0x180041830]
mov rcx, rax
call fcn.18003d250
mov r15d, r12d
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
sub r14, rdi
sar r14, 3
test r14, r14
je 0x1800018e6
mov rbx, rdi
nop dword [rax + rax]
mov dword [rsp + 0x68], 0xe5870100
mov byte [rsp + 0x6c], 0
mov rsi, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x18000181a
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180050d18], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rsi, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x180001867
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180050d18], rax
mov qword [rsp + 0x20], r12
mov r9d, 5
lea r8, [rsp + 0x68]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [rsp + 0x48]
mov rbp, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x1800018b4
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180050d18], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, 8
mov rdx, rbp
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
add rbx, 8
movsxd rax, r15d
cmp rax, r14
jb 0x1800017e0
test rdi, rdi
je 0x180001927
mov rdx, qword [rsp + 0x60]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x18000191f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000191f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18003ebec
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18003e820
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180001960
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18004f040]
xor rax, rsp
mov qword [rbp - 8], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
xor r13d, r13d
mov qword [rbp - 0x20], r13
mov rax, qword [0x180050d18]
test rax, rax
jne 0x1800019c8
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r13d
mov qword [0x180050d18], rax
mov dword [rsp + 0x30], 4
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, str.xxxxxxxxxxxxxx
mov qword [rsp + 0x20], rcx
lea r9, [0x180041848]
mov rcx, rax
call fcn.18003d250
mov r12d, r13d
mov r15, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x30]
sub r15, rdi
sar r15, 3
test r15, r15
je 0x180001b1f
mov rbx, rdi
mov dword [rbp - 0x18], 0xbdd0b010
mov dword [rbp - 0x14], 0x47702000
mov dword [rbp - 0x10], 0xf00e92d
mov word [rbp - 0xc], 0xb097
mov rsi, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x180001a59
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rbp - 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r13d
mov qword [0x180050d18], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rsi, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x180001aa4
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rbp - 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r13d
mov qword [0x180050d18], rax
mov qword [rsp + 0x20], r13
mov r9d, 0xe
lea r8, [rbp - 0x18]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [rbp - 0x38]
mov r14, qword [rbx]
mov rax, qword [0x180050d18]
test rax, rax
jne 0x180001aee
lea ecx, [rax + 0x10]
call fcn.18003e840
mov qword [rbp - 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r13d
mov qword [0x180050d18], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, 8
mov rdx, r14
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r12d
add rbx, 8
movsxd rax, r12d
cmp rax, r15
jb 0x180001a12
test rdi, rdi
je 0x180001b5f
mov rdx, qword [rbp - 0x20]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x180001b57
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001b57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18003ebec
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18003e820
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret