joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001d800
Capabilities:
Hash data using fnv

Disassembly:
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x18001d820
movzx eax, byte [rdx]
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
movzx r8d, byte [rdx + 1]
xor r8, rax
imul r8, rcx
movzx r9d, byte [rdx + 2]
xor r9, r8
imul r9, rcx
movzx eax, byte [rdx + 3]
xor rax, r9
imul rax, rcx
ret

Function at 0x180020d80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180020db7
mov r9, rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x180020c60]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180027a40
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x180027b6d
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x180027a9d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x180027a9d
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x180027bb2
cmp qword [rdi + 0x80], 0
je 0x180027b71
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x180027ad7
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x180027b78
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x180027b91
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x180027b5d
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x180027bb0
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x180027bab
xor esi, esi
jmp 0x180027bb2
mov esi, 0xffffffff
jmp 0x180027bb2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x180027bb2
cmp eax, 3
jne 0x180027bb0
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800cf260
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180028020
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x18002805b
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x180028062
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x180028159
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800280b5
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x1800280b5
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x1800280c6
jmp 0x180028156
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x180028156
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1800280f2
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop dword [rax]
cmp r14, 0x1000
jb 0x180028131
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x180028100
jmp 0x180028156
test r14, r14
je 0x180028153
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x180028156
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180028170
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1800281a6
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800281f3
test rsi, rsi
jle 0x1800281f3
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x1800281f3
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x1800281fb
jmp 0x18002821b
mov r14, rsi
test r14, r14
jle 0x18002821b
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18002821b
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180028610
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x1800286ba
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x1800286ba
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800286b8
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x1800286d1
cmp eax, 1
je 0x180028687
test eax, eax
jne 0x1800286b8
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1800286ae
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1800286b8
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x1800286ba
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800cf260
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x1800286ba

Function at 0x18003e600
Capabilities:
Allocate or change rwx memory
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx + 8]
add rcx, 0x40
lea rdi, [rsi + 0x60]
cmp byte [rax + 0xe], 0
je 0x18003e62a
call fcn.18001c290
mov rcx, rdi
call fcn.18001c290
jmp 0x18003e637
call fcn.18001c1d0
mov rcx, rdi
call fcn.18001c1d0
mov rax, qword [rsi + 8]
cmp byte [rax + 0xd], 0
je 0x18003e663
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18003e663
add rsi, 0x20
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.18001c290
add rsi, 0x20
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.18001c1d0

Function at 0x18003e6f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 8]
cmp byte [rax + 0x10], 0
je 0x18003e772
mov rsi, rcx
mov rax, qword [rcx + 0x18]
cmp qword [rax], 0
je 0x18003e772
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18003e772
mov rax, qword [rsi + 0x18]
mov rcx, qword [rax]
call qword [0x180127ae0]
test rax, rax
je 0x18003e772
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x18]
mov rdx, qword [rdx]
movsd xmm0, qword [rdx + 0x20]
movss xmm1, dword [rcx + 0x38]
unpcklps xmm1, xmm1
mulps xmm1, xmm0
movlps qword [rsp + 0x28], xmm1
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [0x180127af0]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800cf260
nop
add rsp, 0x40
pop rsi
ret
Function at 0x18003e930
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [rcx + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x18003e989
cmp qword [rax + 0x48], 0
je 0x18003e989
mov rsi, rcx
mov rax, qword [rcx + 8]
add rcx, 0x20
lea rdi, [rsi + 0x40]
cmp byte [rax + 6], 0
je 0x18003e990
call fcn.18001c290
mov rcx, rdi
call fcn.18001c290
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x3c]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
movss dword [rax + 0x3b8], xmm0
jmp 0x18003e99d
add rsp, 0x28
pop rdi
pop rsi
ret
call fcn.18001c1d0
mov rcx, rdi
call fcn.18001c1d0
mov rax, qword [rsi + 8]
lea rcx, [rax + 0x40]
lea rdx, [rax + 0x28]
cmp byte [rax + 7], 0
cmove rcx, rdx
movss xmm1, dword [rcx]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x18003e9d0
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx + 0x60]
movss xmm0, dword [rcx]
ucomiss xmm0, xmm1
jne 0x18003e9fd
jnp 0x18003ea37
movaps xmm6, xmm1
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdi, [rsp + 0x24]
mov edx, 8
mov r8d, 0x40
mov r9, rdi
call rbx
mov rax, qword [rsi + 0x60]
movss dword [rax], xmm6
mov r8d, dword [rsp + 0x24]
mov rcx, qword [rsi + 0x60]
mov edx, 8
mov r9, rdi
call rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800cf260
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003e9d0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [rcx + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x18003e989
cmp qword [rax + 0x48], 0
je 0x18003e989
mov rsi, rcx
mov rax, qword [rcx + 8]
add rcx, 0x20
lea rdi, [rsi + 0x40]
cmp byte [rax + 6], 0
je 0x18003e990
call fcn.18001c290
mov rcx, rdi
call fcn.18001c290
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x3c]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
movss dword [rax + 0x3b8], xmm0
jmp 0x18003e99d
add rsp, 0x28
pop rdi
pop rsi
ret
call fcn.18001c1d0
mov rcx, rdi
call fcn.18001c1d0
mov rax, qword [rsi + 8]
lea rcx, [rax + 0x40]
lea rdx, [rax + 0x28]
cmp byte [rax + 7], 0
cmove rcx, rdx
movss xmm1, dword [rcx]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x18003e9d0
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx + 0x60]
movss xmm0, dword [rcx]
ucomiss xmm0, xmm1
jne 0x18003e9fd
jnp 0x18003ea37
movaps xmm6, xmm1
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdi, [rsp + 0x24]
mov edx, 8
mov r8d, 0x40
mov r9, rdi
call rbx
mov rax, qword [rsi + 0x60]
movss dword [rax], xmm6
mov r8d, dword [rsp + 0x24]
mov rcx, qword [rsi + 0x60]
mov edx, 8
mov r9, rdi
call rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800cf260
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x18003ea60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x18003ea8e
mov rax, qword [rax + 0x48]
test rax, rax
je 0x18003ea8e
mov rcx, qword [rsi + 8]
movss xmm0, dword [rcx + 0x24]
movss dword [rax + 0x3b8], xmm0
lea rcx, [rsi + 0x20]
call fcn.18001c1d0
lea rcx, [rsi + 0x40]
call fcn.18001c1d0
mov rax, qword [rsi + 8]
movss xmm1, dword [rax + 0x28]
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x18003e9d0

Function at 0x18003eb00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rax, vtable.ModuleBase.0
mov qword [rcx], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 8], rax
mov rax, qword [rdx]
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x18], rax
lea rax, vtable.SpooferModule.0
mov qword [rcx], rax
add rcx, 0x20
mov qword [rbp - 8], rcx
call fcn.18003ec10
movabs rax, 0x900000000
mov qword [rsi + 0x98], rax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsi + 0x1428], 0xffffffff
mov dword [rsi + 0xa8], eax
mov ecx, 0x2c
nop dword [rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add rax, rcx
add rax, 0xffffffffffffffd5
mov dword [rsi + rcx*4 - 4], eax
cmp rcx, 0x29a
je 0x18003ebbc
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0xffffffd6
mov dword [rsi + rcx*4], eax
add rcx, 2
jmp 0x18003eb80
mov dword [rsi + 0xa4], 0x270
xorps xmm0, xmm0
movups xmmword [rsi + 0x1430], xmm0
mov qword [rsi + 0x1440], 0
mov qword [rsi + 0x1448], 7
mov rax, rsi
add rsp, 0x38
pop rsi
pop rbp
ret
Function at 0x180040400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
push rax
mov rax, qword [rsp + 0x88]
mov r14, qword [rsp + 0x78]
mov r10, qword [rsp + 0x70]
mov qword [r10], r8
mov qword [rax], r14
mov rcx, qword [r10]
cmp rcx, r9
mov qword [rsp], r8
je 0x1800405f3
mov rsi, qword [rsp + 0x80]
cmp r14, rsi
je 0x1800405f3
movzx ebx, word [rdx]
mov r8d, 1
nop
movzx edi, word [rcx]
cmp bx, 2
jb 0x180040480
lea ebp, [rdi + 0x2000]
movzx ebp, bp
cmp ebp, 0xfc00
jb 0x18004060d
movzx ebx, bx
shl ebx, 0xa
add edi, 0xffff2400
or edi, ebx
jmp 0x1800404c0
mov ebx, edi
and ebx, 0xfc00
cmp ebx, 0xd800
jne 0x1800404c0
shl edi, 0xa
add edi, 0xfca10000
mov bl, 1
cmp edi, 0x7f
jbe 0x1800404c7
mov r12d, edi
cmp edi, 0x7ff
ja 0x1800405b0
shr r12d, 6
or r12b, 0xc0
mov r15d, 1
jmp 0x1800404cd
xor ebx, ebx
cmp edi, 0x7f
ja 0x1800404a0
xor r15d, r15d
mov r12d, edi
lea ebp, [r15 + 1]
mov r13b, 1
mov r11, rsi
sub r11, r14
mov r14d, ebp
cmp r11, r14
jl 0x1800405f3
add rcx, 2
mov qword [r10], rcx
or r13b, bl
cmp r13b, 1
jne 0x180040507
mov rcx, qword [rax]
lea r11, [rcx + 1]
mov qword [rax], r11
mov byte [rcx], r12b
dec ebp
je 0x18004057d
add r15d, r15d
lea ecx, [r15 + r15*2]
add cl, 0xfa
mov r11d, edi
shr r11d, cl
and r11b, 0x3f
or r11b, 0x80
mov rcx, qword [rax]
lea r14, [rcx + 1]
mov qword [rax], r14
mov byte [rcx], r11b
cmp ebp, 2
jb 0x18004057d
lea ecx, [r15 + r15*2]
add cl, 0xf4
mov r11d, edi
shr r11d, cl
and r11b, 0x3f
or r11b, 0x80
mov rcx, qword [rax]
lea r14, [rcx + 1]
mov qword [rax], r14
mov byte [rcx], r11b
add ebp, 0xfffffffd
cmp ebp, 0xfffffffd
ja 0x18004057d
lea ecx, [r15 + r15*2]
add cl, 0xee
mov r11d, edi
shr r11d, cl
and r11b, 0x3f
or r11b, 0x80
mov rcx, qword [rax]
lea r14, [rcx + 1]
mov qword [rax], r14
mov byte [rcx], r11b
shr edi, 0xa
test bl, bl
cmove edi, r8d
mov word [rdx], di
mov rcx, qword [r10]
cmp rcx, r9
je 0x1800405f3
mov ebx, edi
mov r14, qword [rax]
cmp r14, rsi
jne 0x180040450
jmp 0x1800405f3
cmp edi, 0xffff
ja 0x1800405cb
shr r12d, 0xc
or r12b, 0xe0
mov r15d, 2
jmp 0x1800404cd
shr r12d, 0x12
or r12b, 0xf0
mov ebp, ebx
xor bpl, 1
movzx r15d, bpl
lea ebp, [r15*2 + 1]
mov r15d, 3
xor r13d, r13d
jmp 0x1800404d4
xor eax, eax
cmp rcx, qword [rsp]
sete al
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 2
jmp 0x1800405fc
Function at 0x180041790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rcx
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x30]
lea r14, [rdi - 0x40000000]
cmp r14, rax
cmovbe r14, rax
mov rbx, qword [rsp + 0x38]
cmp rdi, 0x40000001
cmovb r14, rax
lea rax, [rdi + 0x40000000]
cmp rax, rbx
cmovb rbx, rax
add rbx, 0xfffffffffffff001
mov rsi, qword [0x180128518]
mov r15, rdi
test rsi, rsi
jne 0x180041818
jmp 0x180041840
mov rsi, qword [rsi]
test rsi, rsi
je 0x18004182e
cmp r14, rsi
ja 0x180041810
cmp rbx, rsi
jbe 0x180041810
cmp qword [rsi + 8], 0
je 0x180041810
jmp 0x1800419b8
mov r15, rdi
nop word cs:[rax + rax]
cmp r14, r15
ja 0x18004187e
mov r8d, dword [rsp + 0x50]
mov rcx, r15
mov rdx, r14
call fcn.180041ab0
test rax, rax
je 0x18004187e
mov r15, rax
mov edx, 0x1000
mov rcx, rax
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x180041840
jmp 0x1800418d1
xor esi, esi
mov r14, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop word [rax + rax]
cmp rbx, rdi
jb 0x1800419b8
mov r8d, dword [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
call fcn.180041b60
test rax, rax
je 0x1800419b8
mov rdi, rax
mov edx, 0x1000
mov rcx, rax
mov r8d, 0x3000
mov r9d, 0x40
call r14
test rax, rax
je 0x180041890
mov rsi, rax
add rax, 0x40
mov dword [rsi + 0x10], 0
xor ecx, ecx
xor edx, edx
nop word cs:[rax + rax]
lea r8, [rsi + rcx]
add r8, 0x40
mov qword [rsi + rcx + 0x40], rdx
mov qword [rsi + 8], r8
lea rdx, [rsi + rcx + 0x80]
mov qword [rsi + rcx + 0x80], r8
mov qword [rsi + 8], rdx
lea r8, [rsi + rcx + 0xc0]
mov qword [rsi + rcx + 0xc0], rdx
mov qword [rsi + 8], r8
lea rdx, [rsi + rcx + 0x100]
mov qword [rsi + rcx + 0x100], r8
mov qword [rsi + 8], rdx
lea r8, [rsi + rcx + 0x140]
mov qword [rsi + rcx + 0x140], rdx
mov qword [rsi + 8], r8
lea r9, [rsi + rcx + 0x180]
mov qword [rsi + rcx + 0x180], r8
mov qword [rsi + 8], r9
lea rdx, [rax + 0x180]
lea r8, [rsi + rcx]
add r8, 0x1c0
mov qword [rsi + rcx + 0x1c0], r9
mov qword [rsi + 8], r8
add rax, 0x1c0
lea r8, [rcx + 0x1c0]
add rcx, 0x200
cmp rcx, 0xfc1
mov rcx, r8
jb 0x1800418f0
mov rax, qword [0x180128518]
mov qword [rsi], rax
mov qword [0x180128518], rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800cf260
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800420e0
Capabilities:
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, r8d
mov edi, edx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
call fcn.180042820
cmp qword [rbx], 0
je 0x18004216e
cmp dword [rbx + 0xc], 0
je 0x18004216e
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13, qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004213b
inc r15
mov eax, dword [rbx + 0xc]
cmp r15, rax
jae 0x18004216e
mov rax, qword [rbx]
mov r8d, dword [rax + r15*4]
mov ecx, 0x5a
xor edx, edx
call r12
test rax, rax
je 0x180042130
mov r14, rax
mov rcx, rax
call r13
mov rcx, r14
mov edx, edi
mov r8d, esi
call fcn.180042980
mov rcx, r14
call rbp
jmp 0x180042130
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180042180
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov esi, edx
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r15, qword [0x180128530]
mov eax, ecx
imul r12, rax, 0x38
mov rax, qword [r15 + r12]
movzx ecx, byte [r15 + r12 + 0x20]
xor edx, edx
test cl, 1
sete dl
lea rdx, [rdx + rdx*4]
lea rdi, [rax + rdx]
add rdi, 0xfffffffffffffffb
and ecx, 1
lea rbx, [rcx*2 + 5]
lea r9, [rsp + 0x2c]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18004221e
lea r14, [r15 + r12]
add r14, 0x20
test esi, esi
je 0x180042225
mov byte [rdi], 0xe9
mov eax, dword [r15 + r12 + 8]
sub eax, edi
add eax, 0xfffffffb
mov dword [rdi + 1], eax
test byte [r14], 1
je 0x180042247
add r15, r12
mov rax, qword [r15]
mov word [rax], 0xf9eb
jmp 0x180042247
mov esi, 0xa
jmp 0x18004228d
test byte [r14], 1
lea rax, [r15 + r12 + 0x18]
jne 0x18004223d
movzx ecx, byte [rax + 4]
mov byte [rdi + 4], cl
mov eax, dword [rax]
mov dword [rdi], eax
jmp 0x180042247
mov ecx, dword [rax]
mov eax, dword [rax + 3]
mov dword [rdi + 3], eax
mov dword [rdi], ecx
mov r8d, dword [rsp + 0x2c]
lea r9, [rsp + 0x2c]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [r14]
and sil, 1
lea ecx, [rsi + rsi]
and al, 0xf9
or al, cl
shl sil, 2
or sil, al
mov byte [r14], sil
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800cf260
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1800422b0
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r8, qword [rcx]
test r8, r8
je 0x180042322
mov rsi, rcx
cmp dword [rcx + 0xc], 0
je 0x180042333
xor ebx, ebx
mov r14, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r15, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800422fb
inc rbx
mov eax, dword [rsi + 0xc]
cmp rbx, rax
jae 0x180042330
mov rax, qword [rsi]
mov r8d, dword [rax + rbx*4]
mov ecx, 0x5a
xor edx, edx
call r14
test rax, rax
je 0x1800422f0
mov rdi, rax
mov rcx, rax
call r15
mov rcx, rdi
call r12
jmp 0x1800422f0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r8, qword [rsi]
mov rcx, qword [0x180128528]
xor edx, edx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]

Function at 0x180042820
Capabilities:
Enumerate threads

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x180127a40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x180042959
mov rdi, rax
mov dword [rsp + 0x24], 0x1c
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180042950
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r12, qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, qword [sym.imp.KERNEL32.dll_HeapReAlloc]
lea rbx, [rsp + 0x24]
jmp 0x1800428f7
mov dword [rsi + 8], 0x80
mov rcx, qword [0x180128528]
mov r8d, 0x200
xor edx, edx
call r12
mov qword [rsi], rax
test rax, rax
je 0x180042950
mov ecx, dword [rsp + 0x2c]
mov edx, dword [rsi + 0xc]
lea r8d, [rdx + 1]
mov dword [rsi + 0xc], r8d
mov dword [rax + rdx*4], ecx
nop word cs:[rax + rax]
mov dword [rsp + 0x24], 0x1c
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x180042950
cmp dword [rsp + 0x24], 0x10
jb 0x1800428e0
mov ebp, dword [rsp + 0x30]
call r14
cmp ebp, eax
jne 0x1800428e0
mov ebp, dword [rsp + 0x2c]
call r15
cmp ebp, eax
je 0x1800428e0
mov rax, qword [rsi]
test rax, rax
je 0x18004289b
mov r9d, dword [rsi + 8]
cmp dword [rsi + 0xc], r9d
jb 0x1800428c0
add r9d, r9d
shl r9, 2
mov rcx, qword [0x180128528]
xor edx, edx
mov r8, rax
call r13
test rax, rax
je 0x180042950
shl dword [rsi + 8], 1
mov qword [rsi], rax
jmp 0x1800428c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800cf260
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180042f50
Capabilities:
Check for software breakpoints

Disassembly:
movzx r8d, byte [rcx]
xor eax, eax
test r8d, r8d
je 0x180042f6d
cmp r8d, 0xcc
je 0x180042f6d
cmp r8d, 0x90
jne 0x180042f93
cmp edx, 2
jb 0x180042f8e
mov edx, edx
mov r9d, 1
nop word [rax + rax]
cmp byte [rcx + r9], r8b
jne 0x180042f93
inc r9
cmp rdx, r9
jne 0x180042f80
mov eax, 1
ret