joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2614058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.026141df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x2614089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x261406f
add dl, dl
jne 0x2614096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x26140f6
xor eax, eax
add dl, dl
jne 0x26140a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x26141ad
add dl, dl
jne 0x26140b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26140c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26140d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26140dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x26140ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x261407e
mov eax, 1
add dl, dl
jne 0x2614106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2614113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x26140fb
sub eax, ebx
mov ebx, 1
jne 0x261414c
mov ecx, 1
add dl, dl
jne 0x261412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x261413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x2614123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x261407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2614168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2614175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x261415d
cmp eax, 0x7d00
jae 0x261419b
cmp eax, 0x500
jb 0x2614196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x261407e
cmp eax, 0x7f
ja 0x261419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x261407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x26141d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x261407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140048b00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x430
cmp dword [0x140127c64], 3
mov r14d, dword [0x140127c4c]
mov rbp, qword [0x140127c68]
mov ecx, r14d
jne 0x140048c79
mov qword [rax + 8], rbx
mov ebx, r14d
mov qword [rax + 0x10], rsi
call fcn.14004b0d4
xor edi, edi
mov rsi, rax
test rax, rax
je 0x140048b5e
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.14004de00
mov byte [rsi], dil
jmp 0x140048b61
mov rsi, rdi
lea eax, [r14 - 1]
mov rcx, rdi
movsxd r8, eax
test eax, eax
js 0x140048b92
lea rdx, [r8 + rsi]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
inc rcx
mov byte [rdx], al
lea rdx, [rdx - 1]
cmp rcx, r8
jle 0x140048b80
test r8, r8
js 0x140048bc0
mov rcx, rbp
lea rdx, [r8 + 1]
sub rsi, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140048bb0
mov rsi, qword [rsp + 0x448]
mov rcx, rdi
test r14d, r14d
je 0x140048c3d
cmp rbx, 0x20
jb 0x140048c19
movdqa xmm2, xmmword [str._________________]
mov rax, rbx
and eax, 0x1f
mov rdx, rbx
sub rdx, rax
lea rax, [rbp + 0x10]
nop
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x20
lea rax, [rax + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm1, xmmword [rax - 0x20]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, rdx
jb 0x140048bf0
cmp rcx, rbx
jae 0x140048c3d
lea rax, [rcx + rbp]
sub rbx, rcx
nop word [rax + rax]
xor byte [rax], 0x40
lea rax, [rax + 1]
sub rbx, 1
jne 0x140048c30
lea rcx, str.jason
mov qword [rsp + 0x420], rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rcx, [rsp + 0x20]
call fcn.140048f70
mov r8d, r14d
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.140049050
mov rbx, qword [rsp + 0x440]
jmp 0x140048ced
xor edi, edi
test r14d, r14d
je 0x140048ced
cmp rcx, 0x20
jb 0x140048cc9
movdqa xmm2, xmmword [str._________________]
mov rax, rcx
and eax, 0x1f
mov rdx, rcx
sub rdx, rax
lea rax, [rbp + 0x10]
nop
movdqu xmm0, xmmword [rax - 0x10]
add rdi, 0x20
lea rax, [rax + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm1, xmmword [rax - 0x20]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp rdi, rdx
jb 0x140048ca0
cmp rdi, rcx
jae 0x140048ced
lea rax, [rdi + rbp]
sub rcx, rdi
nop word [rax + rax]
xor byte [rax], 0x40
lea rax, [rax + 1]
sub rcx, 1
jne 0x140048ce0
lea r11, [rsp + 0x430]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140048d10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x430
xor ebx, ebx
mov r14d, edx
cmp dword [0x140127c64], 3
mov rdi, rcx
jne 0x140048e72
lea rcx, str.jason
mov qword [rax + 8], rbp
mov qword [rax - 0x18], rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rcx, [rsp + 0x20]
call fcn.140048f70
mov r8d, r14d
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140049050
mov edx, ebx
test r14d, r14d
je 0x140048ded
cmp r14, 0x20
jb 0x140048dc9
movdqa xmm2, xmmword [str._________________]
mov eax, r14d
and eax, 0x1f
mov ecx, r14d
sub rcx, rax
lea rax, [rdi + 0x10]
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add rdx, 0x20
lea rax, [rax + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm1, xmmword [rax - 0x20]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp rdx, rcx
jb 0x140048da0
cmp rdx, r14
jae 0x140048ded
mov rcx, r14
lea rax, [rdx + rdi]
sub rcx, rdx
nop dword [rax + rax]
xor byte [rax], 0x40
lea rax, [rax + 1]
sub rcx, 1
jne 0x140048de0
mov rcx, r14
call fcn.14004b0d4
mov rsi, rax
test rax, rax
je 0x140048e0e
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.14004de00
mov byte [rsi], bl
jmp 0x140048e11
mov rsi, rbx
mov rbp, qword [rsp + 0x440]
lea eax, [r14 - 1]
movsxd rdx, eax
test eax, eax
js 0x140048e42
lea rcx, [rdx + rsi]
nop dword [rax + rax]
movzx eax, byte [rbx + rdi]
inc rbx
mov byte [rcx], al
lea rcx, [rcx - 1]
cmp rbx, rdx
jle 0x140048e30
test rdx, rdx
js 0x140048eed
sub rsi, rdi
lea rcx, [rdx + 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi + rdi]
mov byte [rdi], al
lea rdi, [rdi + 1]
sub rcx, 1
jne 0x140048e60
jmp 0x140048eed
mov rcx, r14
test edx, edx
je 0x140048eed
cmp rcx, 0x20
jb 0x140048ec9
movdqa xmm2, xmmword [str._________________]
mov rax, rcx
and eax, 0x1f
mov rdx, rcx
sub rdx, rax
lea rax, [rdi + 0x10]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add rbx, 0x20
lea rax, [rax + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm1, xmmword [rax - 0x20]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp rbx, rdx
jb 0x140048ea0
cmp rbx, rcx
jae 0x140048eed
lea rax, [rbx + rdi]
sub rcx, rbx
nop word [rax + rax]
xor byte [rax], 0x40
lea rax, [rax + 1]
sub rcx, 1
jne 0x140048ee0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140016490
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400164da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400164da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400164da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400164da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400164da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400164dc
xor al, al
add rsp, 0x28
ret
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x14190a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14190a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14190a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14190a06f
add dl, dl
jne 0x14190a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14190a0f6
xor eax, eax
add dl, dl
jne 0x14190a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14190a1ad
add dl, dl
jne 0x14190a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14190a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14190a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14190a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14190a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14190a07e
mov eax, 1
add dl, dl
jne 0x14190a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14190a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14190a0fb
sub eax, ebx
mov ebx, 1
jne 0x14190a14c
mov ecx, 1
add dl, dl
jne 0x14190a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14190a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14190a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14190a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14190a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14190a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14190a15d
cmp eax, 0x7d00
jae 0x14190a19b
cmp eax, 0x500
jb 0x14190a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14190a07e
cmp eax, 0x7f
ja 0x14190a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14190a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14190a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14190a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800c0760
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x430
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3a8], 0xfffffffffffffffe
mov rax, qword [0x180328350]
movabs rdi, 0x79b77b86bf15cd1e
movabs rdx, 0xc58e1a0dba3d8300
mov rax, qword [rax + rdi]
add rax, rdx
mov qword [rbp + 0x3a0], rcx
call rax
lea rdx, [rbp - 0x60]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rax, qword [0x180328370]
movabs r14, 0x19726853b8c3b630
movabs rbx, 0xce58fd4fc9debd7b
mov rax, qword [rax + r14]
add rax, rbx
lea rsi, [rbp - 0x60]
mov rcx, rsi
call rax
mov rcx, qword [0x180328370]
movabs r15, 0x19726853b8c3b638
mov rdx, qword [rcx + r15]
add rdx, rbx
mov rcx, rax
call rdx
mov rcx, qword [0x180328370]
movabs r12, 0x19726853b8c3b640
mov r9, qword [rcx + r12]
add r9, rbx
mov rcx, qword [rbp + 0x3a0]
mov rdx, rsi
mov r8, rax
call r9
mov rax, qword [0x180328350]
movabs rcx, 0x79b77b86bf15cd26
mov rax, qword [rax + rcx]
movabs rcx, 0xc58e1a0dba3d8300
add rax, rcx
movabs rdx, 0x79b77b86bf15cdd7
add rdx, qword [0x180328358]
lea rcx, [0x180366455]
call rax
mov rsi, qword [0x180328360]
add rsi, rdi
mov rax, qword [0x180328370]
mov rax, qword [rax + r14]
add rax, rbx
mov rcx, rsi
call rax
mov rcx, qword [0x180328370]
mov rdx, qword [rcx + r15]
add rdx, rbx
mov rcx, rax
call rdx
mov rcx, qword [0x180328370]
add rbx, qword [rcx + r12]
mov rcx, qword [rbp + 0x3a0]
mov rdx, rsi
mov r8, rax
call rbx
mov rax, qword [0x180328368]
movabs rcx, 0x84f27a76c212b6a3
add rcx, qword [rax + rdi]
mov rsi, qword [rbp + 0x3a0]
jmp rcx

Function at 0x180131340
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, gethostbyname
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180131382
xor al, al
jmp 0x180131400
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x1801313ac
xor al, al
jmp 0x180131400
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x78], rax
jb 0x1801313f8
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0xec]
add rax, rcx
cmp qword [rsp + 0x78], rax
jae 0x1801313f8
mov al, 1
jmp 0x180131400
xor al, al
jmp 0x180131400
add rsp, 0x68
ret

Function at 0x180131490
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180367de0]
mov qword [rsp + 0x20], rax
jmp 0x1801314b0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1801314d5
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1801314a2
add rsp, 0x38
ret
Function at 0x1801314e0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180367df8], eax
je 0x1801314fc
mov eax, 0x10dd
jmp 0x180131619
mov rax, qword [0x180367e10]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1801315a2
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x180131572
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x180131572
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
call fcn.180131690
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1801381ec
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x180131508
mov qword [0x180367e10], 0
call fcn.180131620
mov rax, qword [0x180367e08]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180131602
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1801381ec
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1801315be
mov qword [0x180367e08], 0
mov dword [0x180367df8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180131d90
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x180131dad
xor eax, eax
jmp 0x180131e45
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x180131de7
mov eax, dword [rsp + 0x18]
inc eax
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x180131e40
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
cmp qword [rcx + rax + 0x48], 0
je 0x180131e3e
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180131e3a
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180131e3e
xor eax, eax
jmp 0x180131e45
jmp 0x180131ddd
mov eax, 1
add rsp, 0x28
ret
Function at 0x180132b40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180132c40
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180132c38
cmp qword [rsp + 0x20], 0x50000000
jb 0x180132b90
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x180132b90
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
jmp 0x180132b5d
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1801b4ba0
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180132bbf
jmp 0x180132c38
cmp dword [rsp + 0x48], 0x10000
jne 0x180132c16
cmp qword [rsp + 0x40], 0x10000
jb 0x180132c16
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180132c04
mov rax, qword [rsp + 0x58]
jmp 0x180132c3a
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180132c33
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180132c40
mov qword [rsp + 0x20], rax
jmp 0x180132b5d
xor eax, eax
add rsp, 0x68
ret

Function at 0x180132c90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180132da0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180132d8b
cmp qword [rsp + 0x20], 0x50000000
jb 0x180132ce8
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x180132ce8
mov qword [rsp + 0x20], 0x4fff0000
jmp 0x180132cb6
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1801b4ba0
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180132d17
jmp 0x180132d8b
cmp dword [rsp + 0x48], 0x10000
jne 0x180132d6e
cmp qword [rsp + 0x40], 0x10000
jb 0x180132d6e
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180132d5c
mov rax, qword [rsp + 0x58]
jmp 0x180132d8d
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180132d86
mov rax, qword [rsp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.180132da0
mov qword [rsp + 0x20], rax
jmp 0x180132cb6
xor eax, eax
add rsp, 0x68
ret
Function at 0x180133020
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0
jne 0x18013303f
mov qword [rsp + 0x20], 0x10000
jmp 0x180133052
mov rax, qword [rsp + 0x80]
add rax, 0x10000
mov qword [rsp + 0x20], rax
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1801b4ba0
jmp 0x18013307b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x18013309b
jmp 0x180133138
cmp dword [rsp + 0x48], 0x1000
jne 0x1801330c0
mov eax, dword [rsp + 0x4c]
and eax, 0xff
cmp eax, 1
je 0x1801330c0
mov eax, dword [rsp + 0x4c]
and eax, 0x100
test eax, eax
je 0x1801330c2
jmp 0x180133066
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1801330f8
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x40]
ja 0x1801330f8
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x1801330fd
jmp 0x180133066
mov rax, qword [rsp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
jne 0x180133066
mov rax, qword [rsp + 0x58]
jmp 0x18013313a
xor eax, eax
add rsp, 0x78
ret
Function at 0x180133140
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x60], 0
jne 0x180133168
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180133189
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180133307
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1801331c1
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180133307
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x1801331e0
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180133307
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], 0
jmp 0x18013320c
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x38], eax
jae 0x1801332e9
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call fcn.1801c8110
test eax, eax
jne 0x1801332e4
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0xc], 0
je 0x180133271
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x10], 0
jne 0x180133273
jmp 0x1801332e9
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x1801332b9
mov rax, qword [rsp + 0x40]
cmp dword [rax + 4], 0x727444
je 0x1801332bb
jmp 0x1801332e9
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0
jne 0x1801332d5
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x40]
jmp 0x180133307
jmp 0x180133202
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180133307
add rsp, 0x58
ret