joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000a120
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x88
mov rax, qword [0x180417240]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x38], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x18000a1a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x34], eax
call fcn.180009ff0
mov r8, rax
mov edx, dword [rsp + 0x34]
lea rcx, [rsp + 0x58]
call fcn.180009580
mov dword [rsp + 0x20], 0x1a
lea r9, str.win_tss_ptr_create
mov r8d, 0x2e
lea rdx, str.C:UsersNCGDesktopVCPKG_vcpkginstalledx64_windows_staticinclude_boost_asiodetailimplwin_tss_ptr.ipp
lea rcx, [rsp + 0x40]
call fcn.180007e50
mov r8, rax
lea rdx, [0x1803ed6d0]
lea rcx, [rsp + 0x58]
call fcn.180009db0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1801ce080
add rsp, 0x88
ret

Function at 0x18000a1f0
Capabilities:
Initialize winsock library

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov rax, qword [0x180417240]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1f0]
mov ecx, 1
lock xadd dword [rax], ecx
inc ecx
mov eax, ecx
cmp eax, 1
jne 0x18000a27d
movzx eax, byte [rsp + 0x1f8]
and rax, 0xff
movzx eax, al
movzx ecx, byte [rsp + 0x200]
and rcx, 0xff
movzx ecx, cl
shl ecx, 8
or eax, ecx
lea rdx, [rsp + 0x30]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x1f0]
add rax, 4
mov ecx, dword [rsp + 0x20]
xchg dword [rax], ecx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1801ce080
add rsp, 0x1e8
ret
Function at 0x180010200
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x180417240]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x180010234
xor eax, eax
jmp 0x18001042a
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x180010265
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.180011d20
jmp 0x18001042a
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call fcn.180013f50
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x180010313
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.180007920
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call fcn.180014170
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.180006350
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call fcn.1800140d0
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x18001041a
mov rcx, qword [rsp + 0x80]
call fcn.180013650
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x1800103c8
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.1801da1b8
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x1800103c3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x18001042a
jmp 0x18001033f
cmp qword [rsp + 0x50], 0
jbe 0x18001041a
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.1801da1b8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801ce080
add rsp, 0x78
ret
Function at 0x18001d450
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x18001df00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x68], rax
add rsp, 0x38
ret
Function at 0x180092c00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x180417240]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1800965d0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.180098710
nop
lea rax, [0x180098780]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.180007ea0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call fcn.1801e01e4
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x180092ca2
lea rcx, [rsp + 0x40]
call fcn.180097000
jmp 0x180092cb9
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1801adf08
nop
lea rcx, [rsp + 0x40]
call fcn.180097030
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ce080
add rsp, 0x58
ret

Function at 0x1800b4050
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1800b40ba
cmp dword [rsp + 0x30], 1
je 0x1800b407a
jmp 0x1800b40bf
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x1800b4000]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x18041e350]
call fcn.18001d450
jmp 0x1800b40bf
call fcn.180134d80
mov eax, 1
add rsp, 0x48
ret
Function at 0x1800ce5d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x18024f090]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x1800ce65e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x1800ce602
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x1800ce670
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x18024f090]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x1800ce774
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x1800ce76f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x1800ce744
cmp qword [rsp + 0x38], 2
jb 0x1800ce744
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800ce744
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800ce744
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1800ce6b7
jmp 0x1800ce806
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x1800ce806
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x1800ce7dc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800ce7dc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800ce7dc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1800ce774
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1800cea60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1801da1b8
add rsp, 0x28
ret
Function at 0x18010e950
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x18010e976
mov dword [rsp + 0x20], 1
jmp 0x18010e97e
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x18011abb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x18041e0b0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x3b90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x3b98]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.1800aa250
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x30], rax
jae 0x18011acfe
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x18011acc0
movss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax]
call fcn.1800f1130
mov rax, qword [rsp + 0x70]
movss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x18011acbb
jmp 0x18011acfe
jmp 0x18011ac31
cmp dword [rsp + 0x28], 0xd
jne 0x18011accc
jmp 0x18011ac31
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.180112810
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x18011ac31
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rax]
jbe 0x18011ad1d
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
movss dword [rax], xmm0
cmp qword [rsp + 0x90], 0
je 0x18011ad59
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1800aa250
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x1803f2260]
ja 0x18011ad7d
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
ucomiss xmm0, dword [0x1803f2260]
jp 0x18011ad97
jne 0x18011ad97
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
cmp qword [rsp + 0x88], 0
je 0x18011adb2
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x180136880
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180417240]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x180136a11
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180136a06
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x1801369e6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x3c], eax
jne 0x1801369e6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x38], eax
je 0x1801369e6
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x180136953
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x18041e0b8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x180136951
jmp 0x180136a06
jmp 0x1801369bd
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x1801369bd
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18041e0b8]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18013699e
jmp 0x180136a06
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x38]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1801368d6
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801ce080
add rsp, 0x68
ret
Function at 0x180136a30
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.180136880
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x180136af2
mov dword [rsp + 0x20], 0
jmp 0x180136a8f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x180136af2
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180136af0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.1801366d0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180136a85
add rsp, 0x38
ret

Function at 0x180136b00
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x180136b8f
mov dword [rsp + 0x20], 0
jmp 0x180136b28
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x180136b78
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180136b76
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180136b1e
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18041e0b8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x38
ret
Function at 0x180136ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x180417240]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x18042ded0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180136c1e
mov rax, qword [rsp + 0x28]
sub rax, 5
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x48]
mov r8d, 0x40
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180136c47
mov eax, 0xa
jmp 0x180136d73
cmp dword [rsp + 0x88], 0
je 0x180136cb5
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x28]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180136cb3
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x40]
mov byte [rax + 1], 0xf9
jmp 0x180136cf3
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180136cde
mov rax, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
lea rsi, [rax + 0x18]
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
jmp 0x180136cf3
mov rax, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
lea rsi, [rax + 0x18]
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801ce080
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x180137350
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x1801373a9
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x1801373a9
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x1801373a9
xor eax, eax
jmp 0x1801373f0
mov dword [rsp], 1
jmp 0x1801373ba
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x1801373eb
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x1801373e9
xor eax, eax
jmp 0x1801373f0
jmp 0x1801373b2
mov eax, 1
add rsp, 0x18
ret
Function at 0x18014f070
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov dword [rax + 0x28], 0
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x5be0cd19
ret
Function at 0x180154100
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [fcn.1801e0658]
mov rdi, rax
test rax, rax
je 0x18015417d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1801541a8
cmp ebx, esi
je 0x1801541a8
cmp ebx, 0x8000
ja 0x1801541a8
cmp ebx, esi
jb 0x1801541a3
mov edx, ebx
mov rcx, rdi
call qword [fcn.1801e0658]
mov rdi, rax
test rax, rax
jne 0x180154140
mov rcx, rbp
call qword [fcn.1801d9d94]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x180154188
mov rcx, rdi
jmp 0x180154180
Function at 0x180162a00
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1801ec2e4
cdqe
add rsp, 0x28
ret