joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180040880
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xor ebx, ebx
cmp byte [0x180148870], bl
je 0x180040911
lea ecx, ds:[rbx + 1]
call fcn.1800984f0
mov qword [rbp + 0x67], rax
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1800515e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x180040a51
nop word [rax + rax]
cmp dword [rbp - 0x11], ebx
je 0x180040a45
vmovups xmm0, xmmword [rbp - 0x19]
vmovdqa xmmword [rbp - 9], xmm0
lea rcx, [rbp - 9]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
nop dword [rax]
test eax, eax
jne 0x180040a45
vpxor xmm0, xmm0, xmm0
vmovdqa xmmword [rbp - 0x19], xmm0
cmp byte [0x180148871], 0
je 0x180040991
mov ecx, 1
call fcn.1800984f0
mov qword [rbp + 0x67], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1800516c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x180040a6c
cmp dword ds:[rbp - 1], 0
je 0x180040a60
vmovups xmm0, xmmword [rbp - 9]
vmovdqa xmmword [rbp + 7], xmm0
lea rcx, [rbp + 7]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
nop word [rax + rax]
test eax, eax
jne 0x180040a60
vpxor xmm0, xmm0, xmm0
vmovdqa xmmword [rbp - 9], xmm0
cmp byte [0x180148859], 0
je 0x1800409b6
lea rax, [0x1800ebb28]
mov qword [rbp + 0x17], rax
lea rax, [rbp + 0x17]
mov qword [rbp + 0x4f], rax
lea rdx, [rbp + 0x17]
call fcn.18003fe20
movzx edx, byte [0x180148872]
lea rcx, [0x180149af0]
call fcn.18004c620
movzx edx, byte [0x180148858]
lea rcx, [0x180149a60]
call fcn.18004c620
movzx edx, byte [0x180148875]
lea rcx, [0x1801498e0]
call fcn.18004c620
movzx edx, byte [0x180148820]
lea rcx, [0x180149b90]
nop dword [rax]
call fcn.18004c620
movzx edx, byte [0x180148821]
lea rcx, [0x180149970]
call fcn.18004c620
lea rax, [0x1800eb5d8]
mov qword [rbp + 0x17], rax
lea rax, [rbp + 0x17]
mov qword [rbp + 0x4f], rax
lea rdx, [rbp + 0x17]
call fcn.18003fe20
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x11], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 1], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x18004a9e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp edx, 1
jne 0x18004aa7e
lea r9, str.TTU_INJECTED
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
test rax, rax
je 0x18004aa3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
cmp eax, 0xb7
jne 0x18004aa39
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rax, [0x180148878]
mov qword [0x180148868], rdi
mov qword [rsp + 0x28], rax
lea r8, [0x18004c230]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180148880], rax
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180051400
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov r8d, 1
bsr rcx, rax
shlx rax, r8, rcx
cmp rdx, rax
jbe 0x180051433
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180149d48]
or rax, r8
bsr rcx, rax
mov qword [rsp + 0x20], rdi
inc ecx
shlx rdi, r8, rcx
mov r8, rbx
lea rcx, [0x180149d58]
lea rdx, [rdi + rdi]
call fcn.18000d340
mov rax, qword [0x180149d48]
lea r9, [rdi - 1]
mov qword [0x180149d70], r9
mov qword [0x180149d78], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800515bc
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180149d58]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800514ff
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180051578
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18005153c
mov r10, qword [rdx]
cmp r10, rax
je 0x180051536
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180051578
nop dword [rax]
cmp r9, rdx
je 0x180051554
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180051591
cmp r9, rdx
jne 0x180051545
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800515b7
mov r9, qword [0x180149d70]
jmp 0x1800514b0
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180051578
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1800524c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
mov ecx, 1
call fcn.1800984f0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180051900]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword ds:[rsp + 0x30], rax
test rax, rax
je 0x18005253b
cmp dword [rsp + 0x38], 0
je 0x18005252f
vmovups xmm0, xmmword ds:[rsp + 0x30]
vmovdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x18005252f
add rsp, 0x58
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800527c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Player_id:
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
call fcn.18000f3a0
mov edx, dword [0x180148848]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov rcx, rax
lea rdx, [fcn.18000f580]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [0x180148798]
xor ebx, ebx
mov ecx, dword [0x180148848]
mov rax, qword [rdx + 0x10]
mov dword [rdx + 8], ebx
mov dword [rdx + 0x18], ebx
mov dword [rax], ecx
inc dword [rdx + 8]
movabs rdx, 0x50fac3a3e030a6e1
call fcn.180009dc0
mov rdx, qword [0x180148798]
mov rax, qword [rdx]
mov ecx, dword [rax]
mov rax, qword [rdx + 0x10]
mov dword [rdx + 8], ebx
mov dword [rdx + 0x18], ebx
mov dword [rax], ecx
inc dword [rdx + 8]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], ebx
inc dword [rdx + 8]
movabs rdx, 0x3fef770d40960d5a
call fcn.180009dc0
mov rcx, qword [0x180148798]
movabs rdx, 0xd80958fc74e988a6
mov rax, qword [rcx]
vmovups xmm6, xmmword [rax]
vmovsd xmm7, qword [rax + 0x10]
mov dword [rcx + 8], ebx
mov dword [rcx + 0x18], ebx
call fcn.180009dc0
mov rdx, qword [0x180148798]
mov rax, qword [rdx]
mov ecx, dword [rax]
mov rax, qword [rdx + 0x10]
mov dword [rdx + 8], ebx
mov dword [rdx + 0x18], ebx
mov dword [rax], ecx
inc dword [rdx + 8]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
vmovss dword [rax + rcx*8], xmm6
inc dword [rdx + 8]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
vextractps dword [rax + rcx*8], xmm6, 2
inc dword [rdx + 8]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
vmovss dword [rax + rcx*8], xmm7
inc dword [rdx + 8]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], 1
inc dword [rdx + 8]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], ebx
inc dword [rdx + 8]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], ebx
inc dword [rdx + 8]
movabs rdx, 0x239a3351ac1da385
vmovaps xmm6, xmmword [rsp + 0x50]
vmovaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
jmp fcn.180009dc0
Function at 0x18005f280
Capabilities:
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov r9d, 1
bsr r8, rax
mov rsi, rcx
shlx rax, r9, r8
cmp rdx, rax
jbe 0x18005f2b5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
or rax, r9
mov qword [rsp + 0x40], rdi
mov rdi, qword [rsi + 8]
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x48], r14
inc ecx
shlx rbx, r9, rcx
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.18000d340
mov qword ds:[rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x18005f3fa
mov qword [rsp + 0x38], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx r9d, byte ds:[rax + 0x10]
movzx edx, byte [rax + 0x11]
xor r9, rbp
mov r11, qword [rsi + 0x30]
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rdi
jne 0x18005f36e
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18005f3e9
mov rdx, qword [r11 + 8]
movzx r9d, word [rax + 0x10]
cmp r9w, word [rdx + 0x10]
jne 0x18005f3ad
mov r10, qword [rdx]
cmp r10, rax
je 0x18005f3a7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18005f3e9
cmp r8, rdx
je 0x18005f3c5
mov rdx, qword [rdx + 8]
cmp r9w, word [rdx + 0x10]
je 0x18005f40f
nop dword [rax]
cmp r8, rdx
jne 0x18005f3b2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x18005f330
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18005f3e9
Function at 0x180060ba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1801091c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdx, qword [0x18013e520]
mov r8, 0xffffffffffffffff
movsxd rax, ecx
add rdx, 0x1005
imul r14, rax, 0x3058
vpxor xmm0, xmm0, xmm0
add rdx, r14
mov qword [rsp + 0x40], 0
vmovups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], 0
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x180060c00
lea rcx, [rsp + 0x30]
call fcn.18000b3e0
mov rbp, qword ds:[rsp + 0x48]
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
cmp rbp, 0xf
mov r8, qword [rsp + 0x40]
movabs rbx, 0xcbf29ce484222325
cmova rdx, rsi
xor ecx, ecx
test r8, r8
je 0x180060c65
movabs r9, 0x100000001b3
nop
movzx eax, byte ds:[rdx + rcx]
inc rcx
xor rbx, rax
imul rbx, r9
cmp rcx, r8
jb 0x180060c50
mov r9, rbx
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.18004f0e0
mov rdi, qword ds:[rax + 8]
test rdi, rdi
je 0x180060cff
and rbx, qword [0x18013e510]
mov rcx, qword [0x18013e4f8]
shl rbx, 4
add rcx, rbx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x180060cc5
cmp rax, rdi
jne 0x180060cbb
mov rax, qword [0x18013e4e8]
mov qword [rcx], rax
mov qword [rcx + 8], rax
jmp 0x180060cd0
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x180060cd0
cmp rax, rdi
jne 0x180060cd0
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdx, qword [rdi]
lea rcx, [rdi + 0x10]
dec qword [0x18013e4f0]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
call fcn.18000b6c0
mov edx, 0x30
mov rcx, rdi
call fcn.180098974
nop
cmp rbp, 0xf
jbe 0x180060d3a
lea rdx, [rbp + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180060d32
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180060d32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.180098974
mov r8, qword [0x18013e520]
mov rdx, qword [0x18013e528]
add r8, r14
lea rcx, [r8 + 0x3058]
call fcn.180063ba0
mov rax, qword [0x18013e528]
lea rbx, [rax - 0x1040]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x180060d89
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], 0
mov rax, qword [0x18013e528]
sub rax, 0x3058
mov qword [0x18013e528], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800984d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800613c0
Capabilities:
Hash data using fnv

Disassembly:
movabs rcx, 0x100000001b3
movzx r9d, dx
movabs rax, 0xcbf29ce484222325
mov word [rsp + 0x10], dx
mov rdx, qword [0x180148828]
movzx r8d, r9b
xor r8, rax
movzx eax, byte [rsp + 0x11]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [rdx + 0x30]
and rcx, r8
mov r8, qword [rdx + 0x18]
shl rcx, 4
add r8, rcx
mov rcx, qword [rdx + 8]
mov rax, qword [r8 + 8]
cmp rax, rcx
je 0x180061445
mov rdx, qword ds:[r8]
cmp r9w, word [rax + 0x10]
je 0x180061447
cmp rax, rdx
je 0x180061445
mov rax, qword [rax + 8]
cmp r9w, word [rax + 0x10]
jne 0x180061427
test rax, rax
cmove rax, rcx
cmp rax, rcx
setne al
ret
xor eax, eax
test rax, rax
cmove rax, rcx
cmp rax, rcx
setne al
ret
Function at 0x180064cd0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1801091c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x180064ec9
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180064ebe
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x38]
cmp rax, 0x10
jb 0x180064e50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x44], eax
jne 0x180064e50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x40], eax
je 0x180064e50
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x180064db9
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x180148138]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x180064db7
mov dword [rsp + 0x20], 0
jmp 0x180064e6f
jmp 0x180064e27
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x180064e27
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180148138]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180064e1a
mov dword [rsp + 0x20], 0
jmp 0x180064e6f
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x40]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180064d34
cmp dword [rsp + 0x20], 0
je 0x180064e89
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180064e89
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x180064ebe
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x180064ebe
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180148138]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800984d0
add rsp, 0x68
ret
Function at 0x180064ef0
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.180064cd0
test eax, eax
jne 0x180064f49
mov dword [rsp + 0x24], 9
jmp 0x180064fcb
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x180064fcb
mov dword [rsp + 0x20], 0
jmp 0x180064f68
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x180064fcb
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180064fc9
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.180064b20
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180064f5e
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x180064fe0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18006506f
mov dword [rsp + 0x20], 0
jmp 0x180065008
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x180065058
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180065056
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180064ffe
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180148138]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x38
ret
Function at 0x180065080
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x60]
imul rax, rax, 0x38
mov rcx, qword [0x180149e30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800650ea
mov rax, qword [rsp + 0x30]
sub rax, 5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180065113
mov eax, 0xa
jmp 0x180065244
cmp dword [rsp + 0x68], 0
je 0x18006517e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x30]
add rax, 5
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18006517c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x48]
mov byte [rax + 1], 0xf9
jmp 0x1800651ca
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800651ae
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1800651ca
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
xor eax, eax
add rsp, 0x58
ret