joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e9a34
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14033a6c0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1400e9a92
cmp word [rdx], r12w
jne 0x1400e9a92
or byte [rax + r8*8 + 0x38], cl
jmp 0x1400e9a98
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1400e9bf3
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1400e9bce
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1400e9ad1
mov rcx, r9
jmp 0x1400e9af4
cmp r9, rdx
jae 0x1400e9b0b
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1400e9ab5
jmp 0x1400e9bf3
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e9bc8
cmp dword [rsp + 0x80], edi
je 0x1400e9bc8
mov rdx, r14
lea r11, [0x14033a6c0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1400e9ba1
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1400e9b74
mov word [rbx], r12w
jmp 0x1400e9bef
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1400e9b7d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1400e9bef
cmp word [rsp + 0x70], r12w
jne 0x1400e9bae
cmp rbx, rsi
je 0x1400e9b6e
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1400e8d18
cmp word [rsp + 0x70], r12w
je 0x1400e9bf3
mov word [rbx], r13w
jmp 0x1400e9bef
lea r11, [0x14033a6c0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1400e9beb
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1400e9bf3
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400efdb8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400efe3f
mov rsi, rbx
cmp word [rax], bp
je 0x1400efdfe
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400efde8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400efde4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400e1c1c
mov rdi, rax
test rax, rax
je 0x1400efe2c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400b54f0
mov rbp, rdi
xor ecx, ecx
call fcn.1400e1be0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f4474
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400e8d18
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400e8d18
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400f45c4
cmp rax, 0xffffffffffffffff
je 0x1400f45c4
xor edi, edi
test rbp, rbp
jle 0x1400f456f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400e1b68
mov rbx, rax
test rax, rax
jne 0x1400f44fc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400f4565
mov edx, 0x8000
mov ecx, r14d
call fcn.1400e19c0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400e8200
cmp eax, 0xffffffff
je 0x1400f4545
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400f450c
mov edx, r15d
mov ecx, r14d
call fcn.1400e19c0
jmp 0x1400f4565
cmp byte [rsi + 0x38], dil
je 0x1400f455c
cmp dword [rsi + 0x34], 5
jne 0x1400f455c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x1400f4565
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400e1be0
jmp 0x1400f45d8
jns 0x1400f45d8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400e8d18
cmp rax, 0xffffffffffffffff
jne 0x1400f4590
cmp byte [rsi + 0x30], dil
je 0x1400f45d8
mov edi, dword [rsi + 0x2c]
jmp 0x1400f45d8
mov ecx, r14d
call fcn.1400e9788
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400f45d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x1400f45d8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400f45d1
mov eax, dword [rsi + 0x2c]
jmp 0x1400f45d6
mov eax, SafeArrayUnaccessData
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400e8d18
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14010cc64
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x788]
sub rsp, 0x888
mov rax, qword [0x14031fcc0]
xor rax, rsp
mov qword [rbp + 0x770], rax
cmp byte [0x14033b020], 0
mov rsi, rdx
movsxd rbx, ecx
je 0x14010cdb8
mov r12d, 0x800
lea rcx, [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.1400b5ba0
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, str._EWID
movsx edi, byte [rbx + rcx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x6e]
movzx edx, word [rsp + 0x6c]
movzx r10d, word [rsp + 0x6a]
movzx r11d, word [rsp + 0x68]
movzx ebx, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x38], edx
lea rdx, str._04u__02u__02u__02u:_02u:_02u._03u_T_u___c____s_
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call fcn.14010c1e0
movsxd rsi, eax
lea rbx, [rsp + 0x70]
mov edi, r12d
lea r14, [rbp + 0x7d8]
sub rdi, rsi
add rbx, rsi
call fcn.140006930
mov r9, qword [rbp + 0x7d0]
mov r8, rdi
mov qword [rsp + 0x28], r14
mov rdx, rbx
and qword [rsp + 0x20], 0
mov rcx, qword [rax]
call fcn.1400c6d2c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [r12 - 2]
add esi, eax
movsxd rax, esi
cmp rax, rcx
cmova rax, rcx
mov byte [rsp + rax + 0x70], 0xa
lea eax, [rsi + 1]
movsxd rcx, eax
lea eax, [r12 - 1]
cmp rcx, rax
ja 0x14010cda8
mov rax, rcx
cmp rcx, r12
jae 0x14010cdd7
lea rcx, [rsp + 0x70]
mov byte [rsp + rax + 0x70], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.1400b27c0
add rsp, 0x888
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400b3784
int3
Function at 0x140110120
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14031fcc0]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], send
mov byte [rcx], dil
lea rdx, [0x1402d2493]
call fcn.140049d4c
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, SHFlushSFCache
lea rcx, [rbp - 0x80]
call fcn.1400b5ba0
lea rdx, [rbp - 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14011024b
movdqa xmm0, xmmword [0x1402d4280]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], di
lea rcx, [rbp - 0x80]
call fcn.1400dfdc4
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14000b378
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.14012f138
mov rdx, rax
mov rcx, rbx
call fcn.14001f6f4
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14011022e
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140110229
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140110272
call fcn.1400b2b3c
movdqa xmm0, xmmword [0x1402d4290]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], dil
lea rcx, [rsp + 0x58]
call fcn.14000a1e8
mov rax, rbx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400b27c0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400c7698
int3

Function at 0x140110280
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rdi, edx
mov rbx, rcx
cmp byte [rdi + rcx], 0
jne 0x14011029d
mov eax, 0x1505
jmp 0x1401102ad
inc edx
call fcn.140110280
movsx ecx, byte [rdi + rbx]
imul eax, eax, 0x21
xor eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14012afa8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14031fcc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.1400b5ba0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x30], rax
lea r8, str.CommercialId
lea rax, [rsp + 0x50]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
and qword [rbx + 0x10], 0
lea rdx, [rsp + 0x50]
mov qword [rbx + 0x18], send
mov rcx, rbx
mov byte [rbx], 0
call fcn.140049d4c
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400b27c0
add rsp, 0x170
pop rbx
ret

Function at 0x14012b05c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14031fcc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.1400b5ba0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x30], rax
lea r8, str.BuildLabEx
lea rax, [rsp + 0x50]
mov r9d, 0x10002
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
and qword [rbx + 0x10], 0
lea rdx, [rsp + 0x50]
mov qword [rbx + 0x18], send
mov rcx, rbx
mov byte [rbx], 0
call fcn.140049d4c
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400b27c0
add rsp, 0x170
pop rbx
ret
Function at 0x140152a98
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, rcx
lea rax, vtable.Microsoft::Applications::Events::HttpClient_WinInet.0
mov qword [rcx], rax
add rcx, 0x10
mov edx, 0x102
call fcn.14008ef8c
nop
lea rbx, [rdi + 0x60]
mov qword [rsp + 0x58], rbx
and qword [rbx], 0
and qword [rbx + 8], 0
mov rcx, rbx
call fcn.14012526c
mov qword [rbx], rax
mov byte [rdi + 0x70], 0
mov dword [rsp + 0x20], 0x10000000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi + 8], rax
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140180fb8
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140093b40
or dword [rbx + 0x1384], 0xffffffff
lea r8, [rbx + 8]
mov dword [rbx + 4], eax
mov ecx, 1
mov r9d, 0x26f
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
inc ecx
mov dword [r8], eax
lea r8, [r8 + 4]
sub r9, 1
jne 0x140180fdf
movabs rax, 0x3ff0000000000000
mov dword [rbx], 0x270
and qword [rbx + 0x1388], r9
mov qword [rbx + 0x1390], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1402645f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140264618
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140264618
xor eax, eax
mov ecx, SHFlushSFCache
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800014c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x18000154c
cmp edx, 1
jne 0x180001559
lea rcx, str.EROVERLAY_BY_SOARQIN
call qword [sym.imp.KERNEL32.dll_FindAtomW]
test ax, ax
je 0x1800014f0
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rcx, str.EROVERLAY_BY_SOARQIN
call qword [sym.imp.KERNEL32.dll_AddAtomW]
cmp qword [0x1800d6330], 0
mov word [0x1800d630c], ax
jne 0x180001515
mov qword [0x1800d6330], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov r9, qword [0x1800d6330]
lea r8, [0x180001570]
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
movzx ecx, word [0x1800d630c]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18000ba90
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18000bab4
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x18000bb42
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000bb10
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18000bb10
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.180087be0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000bb2d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18000bb35
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x18000bad1
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x18000bc20
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x18000bb59
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000bb5b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000bb8d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.180087be0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18000bc1d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000bbc8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18000bbfe
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.18006da84
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18000bc1d
cmp rsi, rax
ja 0x18000bbd1
test rsi, rsi
je 0x18000bc1d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18006da84
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x180025690
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800b3100]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov r14d, edx
mov qword [rcx], r15
mov rbx, rcx
mov qword [rcx + 8], r15
xor edx, edx
mov ecx, 4
mov ebp, r8d
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002584a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1800257d8
mov edi, 1
cmp dword [rsp + 0x20], 0x10
jb 0x180025792
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180025792
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180025792
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180025754
mov rcx, qword [0x1800d6568]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x1800257bb
jmp 0x180025785
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180025785
mov rcx, qword [0x1800d6568]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rbx + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x1800257bb
mov qword [rbx], rax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180025702
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1800257d8
mov r8, qword [rbx]
mov edi, r15d
test r8, r8
je 0x1800257d8
mov rcx, qword [0x1800d6568]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x18002584a
cmp qword [rbx], r15
je 0x180025845
mov edi, r15d
cmp dword [rbx + 0xc], r15d
jbe 0x180025845
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, edi
mov ecx, 0x5a
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18002583e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1800254e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180025800
mov eax, r15d
jmp 0x18002584f
mov eax, 9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005bff0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180025870
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x1800258e1
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x1800258ca
mov qword [rsp + 0x38], rsi
mov r8, qword [rdi]
xor edx, edx
mov ecx, 0x5a
mov r8d, dword [r8 + rbx*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800258be
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180025890
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1800d6568]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800258f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800d9690]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180025954
mov eax, 0xa
jmp 0x1800259e7
test esi, esi
je 0x180025976
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180025999
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180025999
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180025992
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180025999
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180025a00
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x1800d969c]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x180025a47
mov rax, qword [0x1800d9690]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180025a54
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x180025a30
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x180025a47
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.180025690
mov edi, eax
test eax, eax
jne 0x180025b3f
mov r9d, dword [0x1800d969c]
cmp ebx, r9d
jae 0x180025acc
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x1800d9690]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x180025ac5
mov edx, esi
mov ecx, ebx
call fcn.1800258f0
mov edi, eax
test eax, eax
jne 0x180025acc
mov r9d, dword [0x1800d969c]
inc ebx
cmp ebx, r9d
jb 0x180025a90
cmp qword [rsp + 0x20], 0
je 0x180025b3d
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180025b29
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180025b1a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180025af0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800d6568]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret