joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d17ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d182a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d1821
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d1821
mov rax, qword [rbp - 8]
jmp 0x2fc4d183f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d17f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800025d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x1800026b5
nop dword [rax]
cmp rbx, qword [section..data]
jb 0x18000261e
cmp rbx, qword [0x180067008]
ja 0x18000261e
sub rbx, 0x8000000
jmp 0x1800026ac
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x1800026b5
cmp dword [rsp + 0x40], 0x10000
jne 0x180002690
cmp qword [rsp + 0x38], 0x10000
jb 0x180002690
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call sub.KERNEL32.dll_VirtualAlloc
test rax, rax
jne 0x1800026b7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x1800026b5
sub rbx, 0x10000
jmp 0x1800026ac
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x180002600
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1800026d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1800026f2
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x1800027b7
nop dword [rax + rax]
cmp rbx, qword [section..data]
jb 0x18000271e
cmp rbx, qword [0x180067008]
ja 0x18000271e
add rbx, 0x8000000
jmp 0x1800027ae
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x1800027b7
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180002793
cmp rcx, 0x10000
jb 0x180002793
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call sub.KERNEL32.dll_VirtualAlloc
test rax, rax
jne 0x1800027b9
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x1800027b7
add rbx, 0x10000
jmp 0x1800027ae
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x1800027ae
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x180002700
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800027d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [rcx - 0x7ff80000]
mov r9, rcx
cmp rcx, 0x7ff80000
ja 0x1800027ee
mov ebx, 0x80000
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0x7ff80000]
cmp r9, 0xffffffff80000000
jb 0x18000280a
mov rdi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x180002821
cmp byte [rcx + 1], 0x25
jne 0x180002865
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x18000282d
cmp al, 0xe9
jne 0x180002865
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, r9
cmp rcx, r9
jae 0x180002850
cmp rcx, 0xffffffff80000000
jae 0x180002847
lea rdi, [rcx + 0x7ff80000]
jmp 0x180002865
mov rdi, 0xfffffffffff80000
jmp 0x180002865
lea rbx, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180002865
mov ebx, 0x80000
mov rax, qword [0x18006a118]
mov rcx, qword [0x18006a110]
test rax, rax
jne 0x180002887
test rcx, rcx
je 0x18000289e
mov rax, rcx
mov qword [0x18006a118], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x18000289e
cmp rdx, rbx
jb 0x18000289e
cmp rdx, rdi
jbe 0x180002958
mov qword [0x18006a118], rcx
mov rax, rcx
test rcx, rcx
je 0x1800028e2
mov rdx, rcx
test rcx, rcx
je 0x1800028cc
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x1800028cc
cmp rcx, rbx
jb 0x1800028cc
cmp rcx, rdi
jbe 0x180002958
mov rax, qword [rax + 8]
mov qword [0x18006a118], rax
mov rdx, rax
mov rcx, rax
test rax, rax
jne 0x1800028b0
movzx eax, r9w
mov r8, rdi
sub r9, rax
mov rdx, rbx
mov rcx, r9
call fcn.1800029b0
test rax, rax
je 0x18000299b
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x18006a118], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x18006a110]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x18006a110], rax
nop word [rax + rax]
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x180002940
mov qword [rax + 0x10], r8
mov rdx, qword [rax + 0x10]
cmp rdx, rbx
jb 0x18000299b
cmp rdx, rdi
ja 0x18000299b
mov rcx, qword [rdx + 0x48]
movdqa xmm0, xmmword [0x18004ec30]
mov qword [rax + 0x10], rcx
mov rax, rdx
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm0
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180002cd0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x180002cfd
xor al, al
jmp 0x180002d3f
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x180002d0e
xor al, al
jmp 0x180002d3f
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x180002d35
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x180002d35
mov al, 1
jmp 0x180002d3f
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x180003240
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rsi
sub rsp, 0x28
mov rbp, rdx
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x18006a128], eax
je 0x180003266
mov eax, 0x10dd
add rsp, 0x28
pop rsi
pop rbp
ret
mov eax, dword [0x18006a12c]
test eax, eax
jne 0x1800033a0
test rbp, rbp
jne 0x180003283
lea eax, [rbp + 0x57]
add rsp, 0x28
pop rsi
pop rbp
ret
test rsi, rsi
je 0x18000329f
cmp qword [rsi], 0
jne 0x1800032ab
mov dword [0x18006a12c], 6
mov qword [0x18006a130], rsi
mov eax, 6
add rsp, 0x28
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbx
mov ecx, 0x30
mov qword [rsp + 0x20], rdi
call fcn.180049f4c
mov rdi, rax
test rax, rax
jne 0x1800032cf
lea ebx, [rax + 8]
jmp 0x180003375
mov rcx, qword [rsi]
xor edx, edx
call fcn.180003190
xor edx, edx
mov rcx, rbp
mov rbx, rax
call fcn.180003190
movzx edx, byte [rbx + 0x3e]
mov rbp, qword [rbx + 0x48]
sub rbp, rdx
test dl, dl
je 0x180003367
cmp rdx, 0x1e
ja 0x180003367
cmp qword [rbx + 0x50], rax
jne 0x180003367
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov r8d, 0x40
mov rcx, rbp
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x180003329
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
jmp 0x180003375
mov qword [rdi + 0x20], rbx
mov rbx, qword [rsp + 0x40]
mov dword [rdi + 8], 1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbp
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x28], eax
mov rax, qword [0x18006a140]
mov qword [rdi], rax
xor eax, eax
mov qword [0x18006a140], rdi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbp
ret
cmp dword [0x18006a120], 0
mov ebx, 9
jne 0x180003380
mov dword [0x18006a12c], ebx
test rdi, rdi
je 0x18000338d
mov edx, 0x30
mov rcx, rdi
call fcn.180049f88
mov rdi, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov qword [0x18006a130], rsi
add rsp, 0x28
pop rsi
pop rbp
ret

Function at 0x1800033b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x18006a128], 0
jne 0x180003455
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x18006a128], ecx
jne 0x180003455
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x18006a110]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x18006a140], rdi
mov qword [0x18006a138], rdi
mov qword [0x18006a130], rdi
test rbx, rbx
je 0x18000343e
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x180003437
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180003410
jmp 0x18000343e
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x18006a12c], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x180003a60
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x18006a12c]
mov rdi, rcx
test eax, eax
jne 0x180003b00
call sub.KERNEL32.dll_GetCurrentThread
cmp rdi, rax
jne 0x180003a89
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.180049f4c
mov rbx, rax
test rax, rax
jne 0x180003aa5
lea edi, [rax + 8]
jmp 0x180003ac6
mov rcx, rdi
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x180003ae4
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.180049f88
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x18006a12c], edi
mov qword [0x18006a130], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x18006a138]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x18006a138], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180005070
Capabilities:
Decompress data using quicklz

Disassembly:
lea eax, [r8 + 0x100000]
cmp eax, 0x1fffff
ja 0x1800050d1
mov eax, r8d
mov ecx, r8d
shl ecx, 4
shr eax, 1
xor eax, edx
and eax, 0x7ff
xor eax, edx
mov edx, r8d
xor ecx, eax
shl edx, 6
and ecx, 0x3f0000
xor ecx, eax
xor edx, ecx
and edx, 0x4000000
xor edx, ecx
mov ecx, r8d
shr ecx, 5
xor ecx, edx
shr r8d, 8
and ecx, 0x2000
xor ecx, edx
xor r8d, ecx
and r8d, 0x800
xor r8d, ecx
mov eax, r8d
ret
xor eax, eax
ret
Function at 0x180005f20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r13, rdx
mov r14, rcx
test rcx, rcx
jne 0x180005f52
call sub.KERNEL32.dll_GetModuleHandleW
mov r14, rax
mov eax, 0x5a4d
cmp word [r14], ax
je 0x180005f6e
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
je 0x180005f8d
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
cmp word [rax + r14 + 0x14], 0
jne 0x180005fa7
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
mov ecx, dword [rax + r14 + 0x90]
test ecx, ecx
je 0x180005fb9
lea rdi, [r14 + rcx]
jmp 0x180005fbb
xor edi, edi
mov qword [rsp + 0x28], rdi
test rdi, rdi
jne 0x180005fd6
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
mov ecx, dword [rdi]
test ecx, ecx
je 0x1800060bb
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x1800060ad
mov ebx, eax
add rbx, r14
je 0x1800060ad
lea r15, [r14 + rcx]
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x180006007
lea r12, [r14 + rax]
jmp 0x18000600a
xor r12d, r12d
mov rcx, qword [r12]
call fcn.180006110
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x180006031
mov r8, rbx
mov rdx, rax
mov rcx, r13
call r9
test eax, eax
je 0x1800060bb
xor ebx, ebx
mov dword [rsp + 0x24], ebx
test r15, r15
je 0x18000609f
nop dword [rax]
lea rcx, [rbx*8]
mov rax, qword [rcx + r15]
test rax, rax
je 0x18000608d
xor edx, edx
mov dword [rsp + 0x20], edx
xor r8d, r8d
test rax, rax
jns 0x180006068
movzx edx, ax
mov dword [rsp + 0x20], edx
jmp 0x180006073
add eax, 2
je 0x180006073
mov r8d, eax
add r8, r14
test rsi, rsi
je 0x180006085
lea r9, [rcx + r12]
mov rcx, r13
call rsi
test eax, eax
je 0x18000608d
inc ebx
mov dword [rsp + 0x24], ebx
jmp 0x180006040
test rsi, rsi
je 0x18000609f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rsi
add rdi, 0x14
mov qword [rsp + 0x28], rdi
jmp 0x180005fd6
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1800060cf
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rax
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov eax, 1
jmp 0x1800060e9
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rdx
lea r9, [0x180007ab0]
mov rdx, rcx
lea r8, [0x180007c50]
mov rcx, rax
jmp 0x180005f20
Function at 0x180006110
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x18000614e
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800061da
cmp dword [rsp + 0x40], 0x1000
jne 0x1800061c0
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1800061c0
bt eax, 8
jb 0x1800061c0
mov rbx, qword [rsp + 0x28]
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x180006183
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800061da
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
je 0x18000619e
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800061da
cmp word [rax + rbx + 0x14], 0
jne 0x1800061b4
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800061da
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, rbx
jmp 0x1800061da
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800061da
add rsp, 0x50
pop rbx
ret

Function at 0x180006280
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbx + 8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbx], rax
test rax, rax
mov rax, rbx
jne 0x1800062b2
mov dword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180007a10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [rsp + 0x40]
mov edx, 8
mov rdi, rcx
mov rcx, rbx
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180007a78
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax]
mov r8d, dword [rsp + 0x40]
xor r9d, r9d
mov rcx, qword [rax]
mov qword [rbx], rcx
lea edx, [r9 + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180007a90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r13, rdx
mov r14, rcx
test rcx, rcx
jne 0x180005f52
call sub.KERNEL32.dll_GetModuleHandleW
mov r14, rax
mov eax, 0x5a4d
cmp word [r14], ax
je 0x180005f6e
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
je 0x180005f8d
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
cmp word [rax + r14 + 0x14], 0
jne 0x180005fa7
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
mov ecx, dword [rax + r14 + 0x90]
test ecx, ecx
je 0x180005fb9
lea rdi, [r14 + rcx]
jmp 0x180005fbb
xor edi, edi
mov qword [rsp + 0x28], rdi
test rdi, rdi
jne 0x180005fd6
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
mov ecx, dword [rdi]
test ecx, ecx
je 0x1800060bb
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x1800060ad
mov ebx, eax
add rbx, r14
je 0x1800060ad
lea r15, [r14 + rcx]
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x180006007
lea r12, [r14 + rax]
jmp 0x18000600a
xor r12d, r12d
mov rcx, qword [r12]
call fcn.180006110
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x180006031
mov r8, rbx
mov rdx, rax
mov rcx, r13
call r9
test eax, eax
je 0x1800060bb
xor ebx, ebx
mov dword [rsp + 0x24], ebx
test r15, r15
je 0x18000609f
nop dword [rax]
lea rcx, [rbx*8]
mov rax, qword [rcx + r15]
test rax, rax
je 0x18000608d
xor edx, edx
mov dword [rsp + 0x20], edx
xor r8d, r8d
test rax, rax
jns 0x180006068
movzx edx, ax
mov dword [rsp + 0x20], edx
jmp 0x180006073
add eax, 2
je 0x180006073
mov r8d, eax
add r8, r14
test rsi, rsi
je 0x180006085
lea r9, [rcx + r12]
mov rcx, r13
call rsi
test eax, eax
je 0x18000608d
inc ebx
mov dword [rsp + 0x24], ebx
jmp 0x180006040
test rsi, rsi
je 0x18000609f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rsi
add rdi, 0x14
mov qword [rsp + 0x28], rdi
jmp 0x180005fd6
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800060e9
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1800060cf
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rax
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov eax, 1
jmp 0x1800060e9
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rdx
lea r9, [0x180007ab0]
mov rdx, rcx
lea r8, [0x180007c50]
mov rcx, rax
jmp 0x180005f20

Function at 0x180007e10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rcx, rax
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180007e50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x70
lea rdi, [rcx + rdx]
mov rbx, r8
cmp rcx, rdi
jae 0x180007ee2
nop dword [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180007ee2
mov rax, qword [rsp + 0x38]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp rdx, qword [rbx + 0x10]
je 0x180007ec6
movups xmm0, xmmword [rsp + 0x20]
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rdx], xmm0
movsd qword [rdx + 0x10], xmm1
add qword [rbx + 8], 0x18
jmp 0x180007ed3
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.1800076f0
mov rcx, qword [rsp + 0x38]
add rcx, qword [rsp + 0x50]
cmp rcx, rdi
jb 0x180007e70
mov r8, qword [rbx + 8]
movabs rbp, 0x2aaaaaaaaaaaaaab
mov r9, qword [rbx]
mov rcx, r8
sub rcx, r9
mov rax, rbp
imul rcx
xor edi, edi
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x180007f9d
mov qword [rsp + 0x88], rsi
mov esi, edi
nop
sub r8, r9
mov rax, rbp
imul r8
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, rdi
jbe 0x180007faf
movups xmm1, xmmword [rsi + r9]
lea r9, [rsp + 0x80]
mov r8d, 0x40
movdqa xmm0, xmm1
movq rcx, xmm1
psrldq xmm0, 8
movq rdx, xmm0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbx + 8]
mov rax, rbp
mov r9, qword [rbx]
mov rcx, r8
sub rcx, r9
inc rdi
imul rcx
add rsi, 0x18
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x180007f20
mov rsi, qword [rsp + 0x88]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1800080f0
int3
Function at 0x18000fed0
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0x98]
mov r14, rdx
mov edx, dword [rsp + 0x90]
mov rsi, r8
mov r8d, dword [rsp + 0x80]
mov eax, edx
or eax, ebx
mov rbp, r9
mov r15, rcx
test eax, 0xbfffffff
je 0x18000ff22
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18000ffc8
mov eax, dword [rsp + 0x88]
test r8d, r8d
mov qword [rsp + 0x38], rbp
mov ecx, 0x1000
cmovne ecx, r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
or edx, 1
mov dword [rsp + 0x20], ecx
mov r9d, 1
mov rcx, r15
mov qword [rsp + 0x60], rdi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, rax
test rax, rax
je 0x18000ffb4
mov qword [rsp + 0x30], 0
bts ebx, 7
mov dword [rsp + 0x28], ebx
mov r9, rbp
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x18000ffb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18000ffc3
mov qword [r14], rdi
mov qword [rsi], rax
mov eax, 1
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
Function at 0x1800106b0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x180067dc0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [rcx + 0x5c], 0
mov edi, edx
mov rbx, rcx
je 0x18001088c
mov rcx, qword [rcx + 0x80]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x170], rsi
xor r9d, r9d
xor esi, esi
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180010883
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180010786
nop dword [rax]
mov rcx, qword [rbx + 0x80]
lea r9, [rsp + 0x34]
mov r8d, 0xfa
mov qword [rsp + 0x20], rsi
cmp eax, r8d
lea rdx, [rsp + 0x40]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180010839
mov eax, dword [rsp + 0x34]
cmp rax, 0xfb
jae 0x180010890
lea rdx, [rsp + 0x40]
mov byte [rsp + rax + 0x40], sil
lea rcx, [0x18004f6ec]
call qword [case.0x18002514f.0]
mov eax, dword [rsp + 0x30]
sub eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
jne 0x180010720
mov rcx, qword [rbx + 0x70]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18001087a
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180010823
nop word [rax + rax]
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x34]
mov r8d, 0xfa
mov qword [rsp + 0x20], rsi
cmp eax, r8d
lea rdx, [rsp + 0x40]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180010871
mov eax, dword [rsp + 0x34]
cmp rax, 0xfb
jae 0x180010896
lea rdx, [rsp + 0x40]
mov byte [rsp + rax + 0x40], sil
lea rcx, [0x18004f6ec]
call qword [case.0x18002514f.0]
mov eax, dword [rsp + 0x30]
sub eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
jne 0x1800107c0
mov rcx, qword [rbx + 0x40]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
sete al
jmp 0x180010848
lea rcx, str.AFXERROR:_COutFFMPEGVideoStream::HandleOutAndErr:_StdErr_ReadFile._n
call qword [case.0x18002514f.0]
xor al, al
mov rsi, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18004a020
mov rbx, qword [rsp + 0x178]
add rsp, 0x150
pop rdi
ret
lea rcx, str.AFXERROR:_COutFFMPEGVideoStream::HandleOutAndErr:_StdOut_ReadFile._n
jmp 0x180010840
lea rcx, str.AFXERROR:_COutFFMPEGVideoStream::HandleOutAndErr:_StdOut_PeekNamedPipe._n
jmp 0x180010840
lea rcx, str.AFXERROR:_COutFFMPEGVideoStream::HandleOutAndErr:_StdErr_PeekNamedPipe._n
jmp 0x180010840
xor al, al
jmp 0x180010850
call fcn.18004a158
int3
call fcn.18004a158
int3