joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048b90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x1f90
call fcn.18006c190
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1fc8], rbx
mov qword [rsp + 0x1fd0], rbp
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x1f80], rax
mov r13, rcx
test rcx, rcx
je 0x180048e02
cmp rcx, 0xffffffffffffffff
je 0x180048e02
mov eax, 0x5a4d
cmp ax, word [rcx]
jne 0x180048dfe
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
je 0x180048c0b
xor eax, eax
jmp 0x180048e04
movzx r14d, word [rdx + 6]
test r14w, r14w
jg 0x180048c1d
xor eax, eax
jmp 0x180048e04
movzx eax, word [rdx + 0x14]
lea rsi, [rax + rdx + 0x18]
xor ebx, ebx
lea r12d, [rbx + 1]
movzx ebp, bx
cmp bx, r14w
jge 0x180048dfa
nop dword [rax]
test rsi, rsi
je 0x180048ccd
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180002aa4
nop
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], 0
je 0x180048cb2
lea rdx, [0x180085cf8]
mov rcx, rax
call fcn.180052958
test eax, eax
cmove r12d, ebx
lea rcx, [rsp + 0x20]
call fcn.1800024f0
mov rax, qword [rsp + 0x20]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180048ccd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r12d, r12d
je 0x180048ce8
inc bp
add rsi, 0x28
cmp bp, r14w
jl 0x180048c40
jmp 0x180048dfa
test rsi, rsi
je 0x180048df5
mov byte [rsp + 0x1f70], 0xcc
mov byte [rsp + 0x1f71], 0xcc
mov byte [rsp + 0x1f72], 0xcc
mov byte [rsp + 0x1f73], 0x48
mov byte [rsp + 0x1f74], 0x89
mov byte [rsp + 0x1f75], 0x5c
mov byte [rsp + 0x1f76], 0x24
mov byte [rsp + 0x1f77], 8
mov byte [rsp + 0x1f78], 0x90
mov byte [rsp + 0x1f79], 0x90
mov byte [rsp + 0x1f7a], 0x90
mov byte [rsp + 0x1f7b], 0x48
mov byte [rsp + 0x1f7c], 0x89
mov byte [rsp + 0x1f7d], 0x5c
mov byte [rsp + 0x1f7e], 0x24
mov byte [rsp + 0x1f7f], 8
mov edi, dword [rsi + 0xc]
add rdi, r13
mov r8d, ebx
mov r10d, dword [rsi + 8]
add r10, 0xffffffffffffffee
je 0x180048dcd
mov rdx, rbx
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x1f70]
mov rax, qword [rsp + 0x1f78]
nop dword [rax]
cmp qword [rdx + rdi], rcx
je 0x180048dac
cmp qword [rdx + rdi], rax
jne 0x180048dc2
cmp ebx, 0x3e7
jae 0x180048dc2
lea rdx, [rdx + rdi + 3]
mov qword [r9], rdx
inc ebx
add r9, 8
inc r8d
mov edx, r8d
cmp rdx, r10
jb 0x180048da0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call fcn.180053e24
lea ecx, [rax + rdi]
call fcn.180053e0c
call fcn.180053e24
lea ecx, [rbx - 2]
cdq
idiv ecx
movsxd rax, edx
mov rbx, qword [rsp + rax*8 + 0x30]
mov rax, rbx
jmp 0x180048e04
xor eax, eax
jmp 0x180048e04
xor eax, eax
jmp 0x180048e04
xor eax, eax
mov rcx, qword [rsp + 0x1f80]
xor rcx, rsp
call fcn.1800520e0
lea r11, [rsp + 0x1f90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800491d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
movsxd rax, dword [rcx + 0x3c]
mov r11, rdx
mov rbx, rcx
mov r8d, dword [rax + rcx + 0x88]
test r8d, r8d
je 0x1800492d5
cmp dword [rax + rcx + 0x8c], 0
je 0x1800492d5
mov r10d, dword [rcx + r8 + 0x20]
mov edx, dword [rcx + r8 + 0x10]
lea rax, [rcx + r8]
mov qword [rsp + 0x10], rbp
mov ebp, dword [rax + 0x24]
mov qword [rsp + 0x18], rsi
mov esi, dword [rax + 0x1c]
add r10, rcx
add rbp, rcx
add rsi, rcx
mov qword [rsp + 0x20], rdi
mov edi, dword [rax + 0x18]
test r11d, 0xffff0000
jne 0x18004925f
cmp r11d, edx
jb 0x1800492a3
mov eax, dword [rax + 0x14]
lea ecx, [rax + rdx - 1]
cmp r11d, ecx
ja 0x1800492a3
mov rbp, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x20]
sub r11d, edx
mov eax, dword [rsi + r11*4]
mov rsi, qword [rsp + 0x18]
add rax, rbx
pop rbx
ret
xor r9d, r9d
test edi, edi
jle 0x1800492a3
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, r11
add r8, rbx
sub r8, r11
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180049293
inc rax
test ecx, ecx
jne 0x180049280
test edx, edx
je 0x1800492b6
inc r9d
add r10, 4
cmp r9d, edi
jl 0x180049270
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x20]
xor eax, eax
pop rbx
ret
mov rdi, qword [rsp + 0x20]
movsxd rax, r9d
movzx ecx, word [rbp + rax*2]
mov rbp, qword [rsp + 0x10]
mov eax, dword [rsi + rcx*4]
mov rsi, qword [rsp + 0x18]
add rax, rbx
pop rbx
ret
xor eax, eax
pop rbx
ret
Function at 0x180049560
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov rbp, rdx
mov r12, rcx
xor esi, esi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.Global_
or rbx, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1800495d5
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.180002d04
test rax, rax
je 0x1800495f2
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180002bbc
jmp 0x1800495f2
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x70]
call fcn.1800029d0
nop
mov r8, r12
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.1800130a0
mov r8, qword [rax]
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rdi, rax
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180049635
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x180049652
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rdi, rdi
je 0x1800496a0
mov qword [rsp + 0x20], reloc.WS2_32.dll_inet_ntoa
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x180049693
mov rcx, qword [rax]
mov qword [rbp], rcx
mov ecx, dword [rax + 8]
mov dword [rbp + 8], ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1800496a2
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1800496c0
Capabilities:
Read file via mapping

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov r12, rdx
mov rbp, rcx
xor esi, esi
mov r13d, dword [r8 + 8]
mov r15d, dword [r8]
mov r14d, dword [r8 + 4]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, str.Global_
or rbx, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x18004974b
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.180002d04
test rax, rax
je 0x18004976b
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.180002bbc
jmp 0x18004976b
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x90]
call fcn.1800029d0
nop
mov r8, rbp
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x98]
call fcn.1800130a0
mov r8, qword [rax]
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbp, rax
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1800497b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1800497d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rbp, rbp
je 0x180049826
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180049819
mov r8, r13
lea rdx, [rax + r14]
mov rcx, r12
call fcn.18005a1e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x180049828
mov eax, esi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004f020
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18004f130
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18004f11d
mov rax, qword [0x18009c540]
cmp qword [rsp + 0x20], rax
jb 0x18004f07b
mov rax, qword [0x18009c548]
cmp qword [rsp + 0x20], rax
ja 0x18004f07b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18004f03d
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180054ba0
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18004f0aa
jmp 0x18004f11d
cmp dword [rsp + 0x48], 0x10000
jne 0x18004f101
cmp qword [rsp + 0x40], 0x10000
jb 0x18004f101
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x18004f0ef
mov rax, qword [rsp + 0x58]
jmp 0x18004f11f
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18004f118
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
call fcn.18004f130
mov qword [rsp + 0x20], rax
jmp 0x18004f03d
xor eax, eax
add rsp, 0x68
ret

Function at 0x18004f180
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x78]
sub rcx, 0x10000
call fcn.18004f290
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18004f283
mov rax, qword [0x18009c540]
cmp qword [rsp + 0x20], rax
jb 0x18004f1e2
mov rax, qword [0x18009c548]
cmp qword [rsp + 0x20], rax
ja 0x18004f1e2
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18004f1a4
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180054ba0
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18004f211
jmp 0x18004f283
cmp dword [rsp + 0x48], 0x10000
jne 0x18004f268
cmp qword [rsp + 0x40], 0x10000
jb 0x18004f268
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x18004f256
mov rax, qword [rsp + 0x58]
jmp 0x18004f285
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18004f27e
mov rcx, qword [rsp + 0x30]
sub rcx, 0x10000
call fcn.18004f290
mov qword [rsp + 0x20], rax
jmp 0x18004f1a4
xor eax, eax
add rsp, 0x68
ret
Function at 0x18004f470
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, gethostbyname
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18004f4b5
xor al, al
jmp 0x18004f533
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x50]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x18004f4dc
xor al, al
jmp 0x18004f533
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xe8]
mov rax, qword [rsp + 0x50]
add rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x18004f52b
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rdx, qword [rsp + 0x50]
add rdx, rax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xec]
mov rax, rdx
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x18004f52b
mov al, 1
jmp 0x18004f533
jmp 0x18004f531
xor al, al
add rsp, 0x78
ret

Function at 0x18004f5b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800a33a8]
mov qword [rsp + 0x20], rax
jmp 0x18004f5d0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18004f601
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18004f5ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18004f603
jmp 0x18004f5c2
xor eax, eax
add rsp, 0x38
ret
Function at 0x18004f610
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1800a33c0], eax
je 0x18004f62c
mov eax, 0x10dd
jmp 0x18004f747
mov rax, qword [0x1800a33d8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18004f6d0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx edx, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 0x28]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x18004f6a0
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x18004f6a0
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x20]
call fcn.18004f7c0
mov r11, qword [rsp + 0x20]
mov qword [r11 + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1800520c4
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x18004f638
mov qword [0x1800a33d8], 0
call fcn.18004f750
mov rax, qword [0x1800a33d0]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18004f730
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1800520c4
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x18004f6ec
mov qword [0x1800a33d0], 0
mov dword [0x1800a33c0], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x18004fe50
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x18004fe6d
xor eax, eax
jmp 0x18004ff06
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x18004fea8
mov eax, dword [rsp + 0x18]
add eax, 1
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x18004ff01
movsxd rcx, dword [rsp + 0x18]
imul rcx, rcx, 0x60
mov rax, qword [rsp + 0x10]
cmp qword [rax + rcx + 0x48], 0
je 0x18004feff
movsxd rdx, dword [rsp + 0x18]
imul rdx, rdx, 0x60
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp]
cmp qword [rcx + rdx + 0x48], rax
jb 0x18004fefb
movsxd rdx, dword [rsp + 0x18]
imul rdx, rdx, 0x60
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
cmp qword [rcx + rdx + 0x48], rax
jb 0x18004feff
xor eax, eax
jmp 0x18004ff06
jmp 0x18004fe9d
mov eax, 1
add rsp, 0x28
ret

Function at 0x18004fff0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1800a33c4], 0
je 0x18005000d
mov eax, dword [0x1800a33c4]
jmp 0x1800500d1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x180050021
xor eax, eax
jmp 0x1800500d1
mov ecx, reloc.WS2_32.dll_recv
call fcn.180052a04
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18005008a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18005006f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.1800520c4
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1800a33c4], eax
mov qword [0x1800a33c8], 0
mov eax, dword [rsp + 0x20]
jmp 0x1800500d1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1800500a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x18005004a
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x50]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x1800a33d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [0x1800a33d0], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x180050c70
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.18004ed60
mov qword [rsp + 0x38], 0
cmp qword [0x1800a33b0], 0
jne 0x180050cb8
cmp qword [0x1800a33a8], 0
je 0x180050cb8
mov rax, qword [0x1800a33a8]
mov qword [0x1800a33b0], rax
cmp qword [0x1800a33b0], 0
je 0x180050d5e
mov rax, qword [0x1800a33b0]
cmp qword [rax + 0x10], 0
je 0x180050d5e
mov rcx, qword [0x1800a33b0]
mov rax, qword [rsp + 0x28]
cmp qword [rcx + 0x10], rax
jb 0x180050d5e
mov rcx, qword [0x1800a33b0]
mov rax, qword [rsp + 0x30]
cmp qword [rcx + 0x10], rax
ja 0x180050d5e
mov rax, qword [0x1800a33b0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x38], rax
jb 0x180050d24
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jbe 0x180050d2b
xor eax, eax
jmp 0x180050ed4
mov rcx, qword [0x1800a33b0]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x48]
mov qword [rcx + 0x10], rax
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x38]
call fcn.180054ba0
mov rax, qword [rsp + 0x38]
jmp 0x180050ed4
mov rax, qword [0x1800a33a8]
mov qword [0x1800a33b0], rax
jmp 0x180050d80
mov rax, qword [0x1800a33b0]
mov rax, qword [rax + 8]
mov qword [0x1800a33b0], rax
cmp qword [0x1800a33b0], 0
je 0x180050dcd
cmp qword [0x1800a33b0], 0
je 0x180050dcb
mov rax, qword [0x1800a33b0]
cmp qword [rax + 0x10], 0
je 0x180050dcb
mov rcx, qword [0x1800a33b0]
mov rax, qword [rsp + 0x28]
cmp qword [rcx + 0x10], rax
jb 0x180050dcb
mov rcx, qword [0x1800a33b0]
mov rax, qword [rsp + 0x30]
cmp qword [rcx + 0x10], rax
ja 0x180050dcb
jmp 0x180050cfc
jmp 0x180050d6e
mov rcx, qword [rsp + 0x60]
call fcn.180050ee0
and eax, 0xffff
mov ecx, eax
mov rax, qword [rsp + 0x60]
sub rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.18004eef0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180050ed2
mov rax, qword [rsp + 0x20]
mov qword [0x1800a33b0], rax
mov rax, qword [0x1800a33b0]
mov dword [rax], 0x52727464
mov rax, qword [0x1800a33b0]
mov qword [rax + 0x10], 0
mov rcx, qword [0x1800a33b0]
mov rax, qword [0x1800a33a8]
mov qword [rcx + 8], rax
mov rax, qword [0x1800a33b0]
mov qword [0x1800a33a8], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800a33b0]
add rax, 0x60
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x48], 0x2a8
jmp 0x180050e86
mov eax, dword [rsp + 0x48]
sub eax, 1
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 1
jle 0x180050ebd
movsxd rdx, dword [rsp + 0x48]
imul rdx, rdx, 0x60
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rcx + rdx + 0x48], rax
movsxd rcx, dword [rsp + 0x48]
imul rcx, rcx, 0x60
mov rax, qword [rsp + 0x38]
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180050e7b
mov rcx, qword [0x1800a33b0]
mov rax, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
jmp 0x180050cfc
xor eax, eax
add rsp, 0x58
ret
Function at 0x18005afd7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18009c600]
jne 0x1800520fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1800520f6
repz ret
ror rcx, 0x10
jmp 0x18005af30
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1800a34e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1800a35d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18005afb5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1800a34e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18005afd7
mov rax, qword [rsp + 0x88]
mov qword [0x1800a35d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800a3578], rax
mov rax, qword [0x1800a35d8]
mov qword [0x1800a3450], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800a3560], rax
mov dword [0x1800a3440], 0xc0000409
mov dword [0x1800a3444], 1
mov rax, qword [0x18009c600]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18009c608]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800a34d8], eax
mov ecx, 1
call fcn.18005e140
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18007c050]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800a34d8], 0
jne 0x18005b05e
mov ecx, 1
call fcn.18005e140
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18005da30
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18005d8a4