joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a80cc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1400a80fe
call fcn.140096a98
mov dword [rax], 0x16
call fcn.140091f00
jmp 0x1400a821d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400a821d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400a821d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400a812d
lock or dword [rcx + 0x14], 0x10
jmp 0x1400a821d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400a8141
call fcn.1400a8238
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1400a4498
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1400a7b64
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1400a820b
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1400a81d6
mov rcx, rsi
call fcn.1400a4498
cmp eax, edi
je 0x1400a81c1
mov rcx, rsi
call fcn.1400a4498
cmp eax, 0xfffffffe
je 0x1400a81c1
mov rcx, rsi
call fcn.1400a4498
movsxd rbx, eax
lea r14, [0x1401292c0]
mov rcx, rsi
sar rbx, 6
call fcn.1400a4498
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400a81c8
lea rdx, [0x140117620]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400a81d6
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1400a81fa
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1400a81fa
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1400a81fa
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1400a8220
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1400aec48
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400aeccf
mov rsi, rbx
cmp word [rax], bp
je 0x1400aec8e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400aec78
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400aec74
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400a32f8
mov rdi, rax
test rax, rax
je 0x1400aecbc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400b20f0
mov rbp, rdi
xor ecx, ecx
call fcn.1400a32bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b1a40
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400a73dc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400a73dc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400b1b90
cmp rax, 0xffffffffffffffff
je 0x1400b1b90
xor edi, edi
test rbp, rbp
jle 0x1400b1b3b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400a48a0
mov rbx, rax
test rax, rax
jne 0x1400b1ac8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400b1b31
mov edx, 0x8000
mov ecx, r14d
call fcn.1400a0d1c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400a6e54
cmp eax, 0xffffffff
je 0x1400b1b11
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400b1ad8
mov edx, r15d
mov ecx, r14d
call fcn.1400a0d1c
jmp 0x1400b1b31
cmp byte [rsi + 0x38], dil
je 0x1400b1b28
cmp dword [rsi + 0x34], 5
jne 0x1400b1b28
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400b1b31
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400a32bc
jmp 0x1400b1ba4
jns 0x1400b1ba4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400a73dc
cmp rax, 0xffffffffffffffff
jne 0x1400b1b5c
cmp byte [rsi + 0x30], dil
je 0x1400b1ba4
mov edi, dword [rsi + 0x2c]
jmp 0x1400b1ba4
mov ecx, r14d
call fcn.1400af190
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400b1ba4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400b1ba4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400b1b9d
mov eax, dword [rsi + 0x2c]
jmp 0x1400b1ba2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400a73dc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400b1d20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b1d48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400b1d48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18000def8
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rax - 0x38], xmm6
xor r12d, r12d
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x180078be8]
test rax, rax
je 0x18000e0b4
cmp qword [0x180078ba0], r12
je 0x18000e0b4
cmp byte [rax + 0x670], 4
je 0x18000e0b4
mov rax, qword [0x180078c28]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax + 0x4b60]
mov rcx, qword [rcx]
call fcn.180013224
mov rcx, qword [0x180078c00]
mov r15, rax
mov r14, qword [rcx]
mov rcx, qword [0x180078bf8]
mov rsi, qword [rcx]
test rsi, rsi
je 0x18000e0b4
mov rax, qword [0x180078bf0]
xorps xmm6, xmm6
and dword [rbp - 0x40], r12d
xorps xmm7, xmm7
and dword [rbp - 0x3c], r12d
movzx edi, r12w
and dword [rbp - 0x38], r12d
movss xmm0, dword [0x1800728b0]
movss dword [rbp - 0x30], xmm6
movss dword [rbp - 0x2c], xmm7
movss dword [rbp + 0x30], xmm0
cmp byte [rax], r12b
jle 0x18000e06c
movzx eax, di
mov rbx, qword [r14 + rax*8]
test rbx, rbx
je 0x18000e045
mov rbx, qword [rbx + 0x700]
test rbx, rbx
je 0x18000e045
mov rcx, rbx
call fcn.180001010
test al, al
je 0x18000e045
cmp rbx, rsi
je 0x18000e045
test dword [rbx + 0x1278], 0x7000014
jne 0x18000e045
movss xmm0, dword [rbx + 0xbb0]
ucomiss xmm0, dword [0x180072718]
jp 0x18000e00b
je 0x18000e045
lea rax, [rbp + 0x30]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
lea rax, [rbp - 0x40]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.18000114c
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], r15
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call fcn.1800046f4
mov rax, qword [0x180078bf0]
inc di
movsx ecx, byte [rax]
movzx eax, di
cmp eax, ecx
jl 0x18000dfc3
movss xmm7, dword [rbp - 0x2c]
movss xmm6, dword [rbp - 0x30]
movss xmm0, dword [rbp + 0x30]
cmp byte [0x180078c08], r12b
je 0x18000e0b4
ucomiss xmm6, dword [0x180072718]
jp 0x18000e08b
jne 0x18000e08b
ucomiss xmm7, dword [0x180072718]
jp 0x18000e08b
je 0x18000e0b4
comiss xmm0, dword [0x180078094]
ja 0x18000e0b4
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000e0b4
mov rax, qword [0x180078b98]
movss dword [rax], xmm6
movss dword [rax + 4], xmm7
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180010068
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x1800100c2
mov r11b, 0x23
lea rbx, [0x18006d030]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x1800100ac
cmp rdx, 2
jb 0x1800100ac
cmp byte [r10], r11b
jne 0x1800100ac
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x18001008a
jmp 0x180010103
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180010103
mov r11b, 0x23
lea rbx, [0x18006d030]
cmp dl, r11b
jne 0x1800100e7
cmp byte [r10], r11b
jne 0x1800100e7
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x1800100d5
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x180010270
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180010291
and qword [r8], 0
lea rdx, [0x18006cb30]
call fcn.180010114
mov rbx, rax
test rax, rax
je 0x180010354
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x18001034b
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001034b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001034b
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001034b
mov rsi, rdi
cmp rdi, 0xffffffffffffffff
je 0x18001034b
mov rcx, rdi
call fcn.180013104
mov rdi, rax
test rax, rax
je 0x18001034b
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x180010338
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call fcn.18001314c
jmp 0x180010354
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180010346
mov qword [r14], rsi
mov rax, rdi
jmp 0x180010356
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18001b6e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0x108]
mov r11d, 4
mov rax, qword [rcx + 0x110]
mov r9, rcx
mov dword [rsp + 0x20], edx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x18006d030]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x18001b723
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x4094], ebx
jne 0x18001b75d
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.180025578
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180049300
add rsp, 0x30
pop rbx
ret

Function at 0x18001b774
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rsp + 0x10], rax
movss xmm2, dword [rcx + 0x128]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x12c]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0x110]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0x108]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x18006d030]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x18001b7f1
not r8d
mov eax, r8d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.180049300
add rsp, 0x28
ret

Function at 0x1800242bc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6050], 0
lea rdi, [rcx + 0x6058]
mov rbx, rcx
mov rsi, r8
mov rcx, rdi
mov rbp, rdx
je 0x180024339
xor edx, edx
call fcn.180026274
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.180010cdc
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x6050]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x180078c20]
movsxd r8, eax
mov rax, qword [rbx + 0x6060]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18002433e
call fcn.180010cdc
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180024958
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180078c28]
mov rbx, rcx
and dword [rax + 0x5fac], 0
test rcx, rcx
je 0x1800249c1
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.1800249cc
lea rdx, [0x18006cb34]
mov rcx, rbx
mov rdi, rax
call fcn.180010114
mov rbx, rax
test rax, rax
je 0x1800249c1
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180034828
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180078c28]
test rax, rax
je 0x180034843
mov rbx, qword [rax + 0x90]
jmp 0x180034845
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180034870
and dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x180048678
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1800486dc
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800486ca
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800486c3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180048697
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x180078c40]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800486ec
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [r11 - 0x18]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180078d20]
mov r8, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18004875d
mov eax, 0xa
jmp 0x1800487ea
test esi, esi
je 0x18004877f
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18004879e
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18004879e
test byte [rbx + 0x20], 1
lea rdx, [rbx + 0x18]
mov rcx, rdi
mov r8d, 7
jne 0x180048798
mov r8d, 5
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, sil
shl sil, 2
add al, al
xor al, byte [rbx + 0x20]
and al, 2
xor al, byte [rbx + 0x20]
xor sil, al
and sil, 4
xor sil, al
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180049300
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x180048c68
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x180048c7f
cmp r8b, 0x90
je 0x180048c7f
cmp r8b, 0xcc
jne 0x180048ca1
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180048c9d
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180048ca1
add edx, r10d
cmp edx, r9d
jb 0x180048c8d
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x180049030
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18004906c
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
and qword [rsp + 0x28], 0
lea r8, [0x180049004]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x4ad01000
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x4ad2e1c8]
jne 0x4ad16131
rol rcx, 0x10
test cx, 0xffff
jne 0x4ad1612d
ret 0
ror rcx, 0x10
jmp 0x4ad27960
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x4ad2e3a0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x4ad2e498]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x4ad279e5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x4ad2e3a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x4ad27a07
mov rax, qword [rsp + 0x88]
mov qword [0x4ad2e498], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x4ad2e438], rax
mov rax, qword [0x4ad2e498]
mov qword [0x4ad2e310], rax
mov rax, qword [rsp + 0x90]
mov qword [0x4ad2e420], rax
mov dword [0x4ad2e300], 0xc0000409
mov dword [0x4ad2e304], 1
mov rax, qword [0x4ad2e1c8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x4ad2e1d0]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x4ad29ec0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x4ad0134c
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov r8, rcx
mov byte [0x4ad2e0ce], bl
cmp rdx, rbx
je 0x4ad01381
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
neg rcx
sbb rax, rax
and rdx, rax
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x4ad2e2a0]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.4ad013d4
cmp edi, ebx
sete bl
mov qword [0x4ad2e2a0], rax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x4ad013d4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
mov rdi, rbp
cmp rax, rbp
je 0x4ad01464
mov rcx, rax
cmp word [rax], bp
je 0x4ad01421
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, word [rcx]
add rcx, 2
cmp ax, bp
jne 0x4ad01410
cmp word [rcx], bp
jne 0x4ad01410
sub rcx, rbx
add rcx, 2
sar rcx, 1
lea esi, [rcx + rcx]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, rbp
je 0x4ad0145b
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x4ad01554
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14d, r8d
mov r15d, edx
mov r12, rcx
mov ecx, 0x208
call fcn.4ad016dc
mov r13, rax
test rax, rax
je 0x4ad1851e
mov rcx, r12
call fcn.4ad02be0
mov rsi, rax
test rax, rax
je 0x4ad18527
mov r8d, 0x104
mov rdx, r13
mov rcx, r12
call fcn.4ad04b40
mov edi, 1
cmp eax, edi
jne 0x4ad08172
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov rcx, rsi
call fcn.4ad02c84
nop
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
mov r9, rsi
mov r8d, r14d
mov edx, r15d
mov rcx, r12
call fcn.4ad03be4
mov edi, eax
cmp qword [0x4ad2e1e8], 0
je 0x4ad0797f
mov eax, edi
jmp 0x4ad0161b
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call entry0
lea r11, [rsp + 0x250]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
cmp byte [0x4ad2e0cc], 0
je 0x4ad01617
jmp 0x4ad1852f
cmp eax, 2
jne 0x4ad0b967
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov rcx, rsi
call fcn.4ad02c84
nop
xor r9d, r9d
mov r8d, 0x104
mov rdx, r13
mov rcx, r12
call fcn.4ad05bc0
mov edi, eax
cmp qword [0x4ad2e1e8], 0
jne 0x4ad081c1
cmp byte [0x4ad2e0cc], 0
jne 0x4ad18546
mov eax, edi
jmp 0x4ad0161b
cmp eax, 5
je 0x4ad1855d
mov ecx, dword [0x4ad2e13c]
mov dword [0x4ad2e188], ecx
cmp eax, 3
je 0x4ad1856c
mov eax, 0x2331
cmp ecx, eax
je 0x4ad0b99c
xor edx, edx
call fcn.4ad0b8b0
mov eax, edi
jmp 0x4ad0161b
mov r8, qword [r12 + 0x70]
mov edx, edi
mov ecx, eax
call fcn.4ad0b8b0
jmp 0x4ad0b995
lea eax, [r13 + 1]
jmp 0x4ad0161b
lea eax, [rsi + 1]
jmp 0x4ad0161b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
and dword [0x4ad2e15c], 0
jmp 0x4ad01617
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
and dword [0x4ad2e15c], 0
jmp 0x4ad081c1
xor edx, edx
mov rcx, r13
call fcn.4ad07dc0
jmp 0x4ad0161b
mov eax, edi
jmp 0x4ad0161b