joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000139c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rcx, qword [0x140015078]
test rcx, rcx
je 0x1400013e4
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rsi, [rsp + 0x24]
mov edx, 8
mov r8d, 0x40
mov r9, rsi
call rdi
mov qword [0x140015078], 0
mov r8d, dword [rsi]
mov edx, 8
xor ecx, ecx
mov r9, rsi
call rdi
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400013ec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.VirtualAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140015078], rax
lea rsi, [0x140015078]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdi, [rsp + 0x2c]
mov edx, 8
mov rcx, rsi
mov r8d, 0x40
mov r9, rdi
call rbx
lea rax, [0x140001392]
mov qword [0x140015078], rax
mov r8d, dword [rdi]
mov edx, 8
mov rcx, rsi
mov r9, rdi
call rbx
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140001c2f
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov rsi, rcx
lea rdi, [rsp + 0x20]
mov ecx, 0x100
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rsi
mov rdx, rdi
call fcn.140001250
mov rax, rsi
add rsp, 0x128
pop rdi
pop rsi
ret
Function at 0x140003aa6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rdx
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x140003abb
test r8, r8
je 0x140003ae5
xor r9d, r9d
movabs r10, 0x100000001b3
movzx eax, byte [rdx + r9]
xor rax, rcx
imul rax, r10
inc r9
mov rcx, rax
cmp r8, r9
jne 0x140003acd
ret
mov rax, rcx
ret

Function at 0x14000622a
Capabilities:
Parse credit card information

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, edx
mov rsi, rcx
mov edi, 1
cmp edx, 0x3a
je 0x140006259
xor edi, edi
cmp ebp, 0x3d
je 0x140006259
xor eax, eax
cmp ebp, 0x2e
mov edi, 0xe
cmove edi, eax
mov rbx, qword [rsi]
xor r14d, r14d
movabs r15, 0x4800800000000001
mov eax, dword [rsi + 0x7c]
lea ecx, [rax + 1]
cmp ecx, 0x3e
ja 0x14000627a
bt r15, rcx
jb 0x140006287
mov rcx, rsi
call fcn.140004cbe
inc r14
jmp 0x140006269
cmp eax, ebp
jne 0x1400062d9
cmp ebp, 0x3a
jne 0x140006307
mov r14, qword [rsi + 0x68]
mov ecx, dword [rsi + 0x70]
mov edx, 0x100
call fcn.140003ea4
test eax, eax
setne r9b
mov r8, qword [rsi]
mov rcx, r14
mov rdx, rbx
call fcn.14000581a
mov ebx, eax
test ax, ax
jne 0x1400062c9
mov rcx, rsi
mov edx, 1
call fcn.1400048a0
lea rcx, [rsi + 0x40]
mov edx, ebx
xor r8d, r8d
call fcn.140005974
jmp 0x1400062e3
mov rcx, rsi
mov edx, edi
call fcn.1400048a0
mov rcx, rsi
call fcn.140004cbe
mov rcx, rsi
mov edx, 0x5d
mov r8d, edi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140004ef2
cmp ebp, 0x2e
je 0x14000632a
cmp ebp, 0x3d
jne 0x1400062e3
mov r8, qword [rsi]
cmp rbx, r8
je 0x140006343
lea rcx, [rsi + 0x40]
mov rdx, rbx
mov r9, r14
call fcn.14000634a
jmp 0x1400062e3
mov r8, qword [rsi]
cmp rbx, r8
je 0x140006343
lea rcx, [rsi + 0x40]
mov rdx, rbx
mov r9, r14
call fcn.140006446
jmp 0x1400062e3
mov rcx, rsi
xor edx, edx
jmp 0x1400062de

Function at 0x14000a7b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx], 0
je 0x14000a7e1
mov eax, 0x75776791
mov edx, 1
xor r8d, r8d
movzx r8d, word [r8 + rcx]
mov r9d, eax
rol r9d, 0x18
add r9d, r8d
xor eax, r9d
mov r8d, edx
inc edx
cmp byte [rcx + r8], 0
jne 0x14000a7c2
ret
mov eax, 0x75776791
ret
Function at 0x14000a7e7
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, 1
cmp dword [0x140015090], 0
jne 0x14000a99e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x14000a916
xor r8d, r8d
mov ecx, 0xdfdfdfdf
mov rbx, rdx
movsxd rdx, dword [rdx + 0x3c]
mov edx, dword [rdx + rbx + 0x88]
test rdx, rdx
je 0x14000a873
mov r8d, dword [rdx + rbx + 0xc]
add rdx, rbx
mov r9d, dword [r8 + rbx]
and r9d, ecx
cmp r9d, 0x4c44544e
jne 0x14000a870
mov r9d, dword [r8 + rbx + 4]
and r9d, ecx
mov r8, rdx
cmp r9d, 0x4c440e4c
jne 0x14000a873
jmp 0x14000a88b
mov r8, rdx
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
test rdx, rdx
jne 0x14000a82f
mov rdx, r8
test r8, r8
je 0x14000a916
mov r14d, dword [rdx + 0x18]
mov r15d, dword [rdx + 0x1c]
add r15, rbx
mov r12d, dword [rdx + 0x20]
add r12, rbx
mov r13d, dword [rdx + 0x24]
add r13, rbx
lea ebp, [r14 - 1]
xor edi, edi
lea rsi, [0x140015090]
mov ecx, dword [r12 + rbp*4]
movzx eax, word [rcx + rbx]
cmp eax, 0x775a
jne 0x14000a8f3
add rcx, rbx
call fcn.14000a7b0
mov ecx, edi
shl rcx, 4
mov dword [rcx + rsi + 8], eax
movzx eax, word [r13 + rbp*2]
mov eax, dword [r15 + rax*4]
mov dword [rcx + rsi + 0xc], eax
mov qword [rcx + rsi + 0x10], 0
inc edi
cmp edi, 0x258
je 0x14000a91d
dec r14d
dec rbp
test r14d, r14d
jne 0x14000a8b1
mov dword [0x140015090], edi
mov r15d, edi
dec r15d
mov eax, 1
jne 0x14000a937
jmp 0x14000a99e
xor eax, eax
jmp 0x14000a99e
mov dword [0x140015090], 0x258
mov edi, 0x258
mov r15d, 0x257
mov eax, 1
xor ecx, ecx
lea rdx, [0x1400150b0]
mov r8d, r15d
mov r8d, r8d
inc ecx
cmp edi, ecx
je 0x14000a996
mov r10d, dword [0x14001509c]
mov r9, r8
mov r11, rdx
mov esi, dword [r11 - 4]
cmp r10d, esi
jbe 0x14000a98a
mov ebx, dword [r11 - 0x18]
mov r14, qword [r11 - 0x10]
mov ebp, dword [r11 - 8]
mov dword [r11 - 0x18], ebp
mov dword [r11 - 0x14], esi
mov rsi, qword [r11]
mov qword [r11 - 0x10], rsi
mov dword [r11 - 8], ebx
mov dword [r11 - 4], r10d
mov qword [r11], r14
jmp 0x14000a98d
mov r10d, esi
add r11, 0x10
dec r9
jne 0x14000a959
dec r8d
cmp ecx, r15d
jne 0x14000a943
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000aa00
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8395cb5a
call fcn.14000a9af
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x14000b168
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b1b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b1b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b1b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b1b2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b1b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b1b4
xor al, al
add rsp, 0x28
ret

Function at 0x14000baa0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140015000]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14000badc
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.14000b160
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call fcn.14000cf50
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14000bb98
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14000bbfe
test ebx, ebx
jne 0x14000bbfe
lea ecx, [rax + 2]
call fcn.14000b160
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.14000c990
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x14000bd40
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bd9c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bd9c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bd9c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bd9c
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bd9c
cmp dword [rcx + 0xf8], 0
je 0x14000bd9c
mov ecx, ebx
call fcn.14000bfb0
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x1400176f8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.14000c130
cmp dword [rsp + 0x60], 0
jne 0x14000bddf
mov ecx, ebx
call fcn.14000c030
int3
add rsp, 0x40
pop rbx
ret

Function at 0x14000bdf0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000be52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000be52
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x14000be52
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x14000be52
cmp dword [rdx + 0x84], 0xe
jbe 0x14000be52
cmp dword [rdx + 0xf8], 0
je 0x14000be52
mov ecx, ebx
call fcn.14000bfb0
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x1400176f8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.14000c130
cmp dword [rsp + 0x60], 0
jne 0x14000be95
mov ecx, ebx
call fcn.14000c030
int3
add rsp, 0x40
pop rbx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140046fe0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140046ff0]
mov dword [rax], 1
mov rax, qword [0x140047000]
mov dword [rax], 1
mov rax, qword [0x140046f40]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140046fd0]
mov dword [0x14004f00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400470c0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400470a0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140046f20]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x1400014a1
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov rcx, qword [rbp + 0x10]
call sym.puts
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
lea rax, section..rdata
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001519
lea rax, str.Error_opening_file__n
mov rcx, rax
call sym.printf
mov ecx, 1
call sym.exit
mov rax, qword [rbp - 8]
mov r9, rax
mov r8d, 0x12
mov edx, 1
lea rax, [0x140041017]
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov ecx, 0
call sym.exit
nop
Function at 0x140001d73
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.th_unhandledExceptionFilter]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14003fa00]
add rsp, 0x30
pop rbp
ret

Function at 0x140001dc6
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.th_outputDebugString]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14003fa04]
add rsp, 0x30
pop rbp
ret

Function at 0x140001e19
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.th_ntClose]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14004f030]
add rsp, 0x30
pop rbp
ret

Function at 0x140001e6c
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.th_popfd_TrapFlag]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14003fa08]
add rsp, 0x30
pop rbp
ret

Function at 0x140001ebf
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.th_ctrl_exception_handling]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14003fa0c]
add rsp, 0x30
pop rbp
ret

Function at 0x140001f12
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.th_DebugBreak]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14003fa10]
add rsp, 0x30
pop rbp
ret

Function at 0x140001fc1
Capabilities:
Get explorer pid

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 4], 0
mov rax, qword [sym.imp.USER32.dll_GetShellWindow]
call rax
mov rcx, rax
lea rax, [rbp - 4]
mov rdx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call rax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x1400021e8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x54], 0
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x4c]
mov eax, eax
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000227e
mov eax, 0
jmp 0x140002313
mov rax, qword [rbp - 0x10]
mov r8d, 1
mov edx, 0xc3
mov rcx, rax
call sym.memset
mov eax, dword [rbp - 0x4c]
mov ecx, eax
lea rdx, [rbp - 0x54]
mov rax, qword [rbp - 0x10]
mov r9, rdx
mov r8d, 0x140
mov rdx, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
jne 0x1400022c5
mov eax, 0
jmp 0x140002313
lea rax, [dbg.excepPageGuard]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x10]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, dword [0x14003fa20]
sub rsp, 0xffffffffffffff80
pop rbp
ret

Function at 0x1400023cd
Capabilities:
Check for protected handle exception

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea r8, str.Random_name
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14000241e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateMutex_error:__ld_n
mov rcx, rax
call sym.printf_1
mov eax, 1
jmp 0x1400024a0
cmp qword [rbp - 8], 0
je 0x140002440
mov rax, qword [rbp - 8]
mov r8d, 2
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
test eax, eax
jne 0x14000249a
lea rax, [dbg.setHandleInfoExc]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov qword [rbp - 0x10], rax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_RaiseException]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov eax, dword [0x14003fa24]
add rsp, 0x30
pop rbp
ret
Function at 0x140002759
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.th_instructionPrefixes]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14003fa28]
add rsp, 0x30
pop rbp
ret

Function at 0x140002894
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.th_dbgExcp]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14003fa2c]
add rsp, 0x30
pop rbp
ret

Function at 0x1400028e7
Capabilities:
Check for unexpected memory writes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp - 4], 0
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x8000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140002942
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAlloc_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov eax, dword [rbp - 4]
jmp 0x140002a60
mov r9d, 4
mov r8d, 0x203000
mov edx, 0x1000000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x1400029a9
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAlloc_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov eax, dword [rbp - 4]
jmp 0x140002a60
mov rax, qword [rbp - 0x18]
mov dword [rax], 0x4d2
mov qword [rbp - 0x20], 0x1000
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
lea rdx, [rbp - 0x24]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetWriteWatch]
call rax
test eax, eax
je 0x140002a16
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.GetWriteWatch_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
jmp 0x140002a27
mov rax, qword [rbp - 0x20]
cmp rax, 1
je 0x140002a27
mov rax, qword [rbp - 0x20]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [rbp - 0x18]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, dword [rbp - 4]
add rsp, 0x60
pop rbp
ret
Function at 0x140002dd5
Capabilities:
Check for unexpected memory writes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp - 4], 0
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x8000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140002e30
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAlloc_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov eax, dword [rbp - 4]
jmp 0x140002f68
mov r9d, 4
mov r8d, 0x203000
mov edx, 0x1000000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140002e97
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAlloc_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov eax, dword [rbp - 4]
jmp 0x140002f68
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
mov rdx, qword [rbp - 0x18]
mov dword [rdx], eax
mov qword [rbp - 0x20], 0x1000
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
lea rdx, [rbp - 0x24]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetWriteWatch]
call rax
test eax, eax
je 0x140002f09
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.GetWriteWatch_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
jmp 0x140002f2f
mov rax, qword [rbp - 0x20]
cmp rax, 1
je 0x140002f2f
mov rax, qword [rbp - 0x18]
mov eax, dword [rax]
cmp eax, 1
jne 0x140002f2f
mov rax, qword [rbp - 0x18]
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp - 0x20]
or eax, edx
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [rbp - 0x18]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, dword [rbp - 4]
add rsp, 0x60
pop rbp
ret