joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400580c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, [0x14008f620]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14008f600]
test rbx, rbx
je 0x140058125
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rbx]
call r12
mov rsi, rax
call rdi
test rsi, rsi
je 0x14005811c
test eax, eax
jne 0x14005811c
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140058100
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140058490
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14006fe20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400584b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400584b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400584b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14005850d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140058504
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400584b0
add rax, 0x28
cmp rax, r9
jne 0x1400584f0
xor eax, eax
ret

Function at 0x140058510
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14006fe20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14005852f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140058538
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14005852f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400585d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14006fe20]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400585ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400585f8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400a74e9
Capabilities:
Authenticate hmac

Disassembly:
xor edx, 0x8c2ea098
mov qword [rsp + r11*8 - 0x100fd910], 0xffffffffa82ba234
bt rdi, 0xc
add bl, 0xc
dec edx
movsx r9d, r11w
mov qword [rsp + r11 - 0x201fb13], r11
push rcx
xor edx, 0x588818bc
not r9b
mov qword [rsp + r11*2 - 0x403f63e], 0xffffffffd4b149ae
Function at 0x1400af11f
Capabilities:
Authenticate hmac

Disassembly:
lea rbx, [r11*8 - 0x48d87600]
call fcn.1400bbbcc
jmp 0x1400d7c3c
add rsi, 2
movzx ebx, dx
btc ebx, ebx
lea r10, [r10 + rbx*8 - 0x9949]
rol dx, 0xc
add dx, dx
mov ecx, 0xda180e99
movzx eax, byte [r10 + rbx*4 - 0x4ca4]
or bl, bh
xor al, bpl
xchg bh, bl
add al, 0xb7
ror al, 1
xchg dh, cl
sal dx, cl
movzx r9d, dl
not al
neg al
shr cl, cl
setns bl
btr rcx, 0x85
adc al, 0xb3
sal rbx, cl
shr r9b, 6
xor bpl, al
xor bx, 0x66aa
adc rax, rsp
dec r9b
not dx
movsx edi, r9w
mov word [rax + rbx*2 - 0x76cf54], r11w
push rbx
push rcx
lea r10, [r10 + rbx*2 - 0x76cf58]
push rdi
xchg byte [rsp + rbx*2 - 0x76cf40], r9b
rol word [rsp + rbx*2 - 0x76cf41], cl
mov edx, dword [rbx + r10 - 0x3b67aa]
ror ecx, cl
xor edx, ebp
ror edx, 1
xor edx, 0x76220a3b
mov r11d, 0xc3b52834
btc r9d, edi
bswap edx
adc edx, edi
mov qword [rsp + rbx*4 - 0xed9e98], rbp
mov ebp, 0x86b8d02d
not word [rsp + rbx - 0x3b679e]
xor dword [rsp + rbx - 0x3b679a], edx
xchg rdi, rbp
sal bx, 0x86
mov rbp, qword [rsp + rbx*2 - 0x77d4f0]
movsxd rdx, edx
jbe 0x1400c7bc4
mov qword [rsp + rbx - 0x3bea70], 0x100aaa29
add r8, rdx
xadd qword [rsp + rbx - 0x3bea70], rbx
adc word [rsp + rcx*2 - 0x11b4301a], r9w
neg dword [rsp + rbx - 0x100aaa19]
mov qword [rsp + rbx*2 - 0x20155452], r8
ret 0x10
jne 0x1400b99f4
mov r11w, word [rsi]
mov edx, 0xac071129
jmp 0x1400b0c5d

Function at 0x1400b329a
Capabilities:
Authenticate hmac

Disassembly:
mov r9w, word [rsi + rbx*2 - 0x2a7ba736]
mov qword [rsp + rbx - 0x153dd39c], rbx
lea rsi, [rsi + rbx - 0x153dd39a]
add ax, r9w
jmp 0x1400bbc9d
mov word [rsi + rbx*4 - 0x54f74e70], ax
mov edx, dword [rsp + rbx - 0x153dd39a]
mov byte [rsp + rbx*4 - 0x54f74e6c], dl
lea r10, [r10 + rbx - 0x153dd3a0]
mov edx, dword [r10 + rdx*2 - 0x2a7a]
lea rax, [rbx*2 - 0x3969c16b]
xor edx, ebp
sub dword [rsp + rbx*2 - 0x2a7ba737], 0x91383300
lea edx, [rdx + rbx*2 - 0x204d7eb6]
not qword [rsp + rax + 0xeee1a33]
mov r11d, dword [rsp + rbx*4 - 0x54f74e6c]
sbb dword [rsp + rbx*2 - 0x2a7ba738], 0x49110635
bswap edx
setno byte [rsp + rbx - 0x153dd39b]
setne byte [rsp + rbx*4 - 0x54f74e70]
jl 0x1400bce2f
ror edx, 1
pop rdi
neg edx
btr edi, edi
bswap edx
movsx ecx, al
push rbp
xor dword [rsp + rbx*4 - 0x54f74e70], edx
xadd ebx, eax
add rdi, rax
pop rbp
bts ax, r11w
mov r9d, eax
movsxd rdx, edx
rol edi, 0x19
add r8, rdx
cqo
add rdx, r8
jmp rdx
Function at 0x1400b50d1
Capabilities:
Encode data using base64

Disassembly:
mov dil, byte [rsi + rdi - 0x6780eb98]
mov qword [rsp + rax - 0xeba0], 0xffffffff9727108e
movsx edx, byte [rsp + rax - 0xeb9e]
lea rsi, [rsi + rax*2 - 0x1d736]
lea rcx, [rbx + rbx + 0x8986cbe]
sub qword [rsp + rax - 0xeba0], rdx
imul bx
mov byte ss:[rax + r9 - 0xfaa0], dil
mov edi, dword [rsp + rax - 0xfaa0]
lea r10, [rax + r10 - 0xfaa4]
lea rdi, [rcx*2 - 0x2be0c36c]
sub cl, byte [rsp + rax - 0xfa9e]
mov edi, dword [rax + r10 - 0xfaa0]
xor edi, ebp
dec byte [rsp + rax - 0xfa9f]
inc cl
bswap edi
setne cl
mov r11d, 0x2bb27907
dec bx
not edi
dec edi
or r11d, ebx
shr ebx, cl
bswap edi
mov qword [rsp + rax*2 - 0x1f540], rbp
jge 0x1400cdad6
not ebx
mov r9d, 0x5d0fc91d
xor dword [rsp + rax - 0xfaa0], edi
div rax
sub dl, cl
pop rbp
mul r11b
cqo
ror ax, 0xab
movsxd rdi, edi
rol rcx, 0x90
add r8, rdi
add rdx, r8
jmp rdx

Function at 0x1400b6272
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec di
lea eax, [rax + rbx*2 + 0x1e3ab904]
and r11d, ebx
sal rdx, 0xb4
mov qword [rsp + rbx], r9
bswap eax
cmove rbx, rdi
lea eax, [rax + rbx*2 + 0x509171c]
xor rcx, rbx
mov qword [rsp + rbx + 8], rbp
xor dword [rsp + rdi*2 - 0x48], eax
call fcn.1400d37ec

Function at 0x1400b63a5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.1400c7013
mov ecx, 0x15395a84
movzx r11d, cx
lea rcx, [rcx + rcx - 0x7f749b53]
mov r9w, word [rsi + rcx + 0x5501e64b]
movzx ecx, byte [r11 + r10 - 0x5a85]
movzx eax, r11b
xor cl, bpl
dec cl
bts r11w, 8
neg cl
movzx edi, r11b
rol cl, 1
xor cl, 0xa0
xchg r11b, dil
mov ebx, 0x91bf1f18
sar r11, 0x16
inc cl
xor bpl, cl
add rcx, rsp
mov byte [r11 + rcx], r9b
btr bx, bx
mov r9d, dword [r10 + r11*2 - 5]
xor r9d, ebp
rol r9d, 2
dec r9d
xor bl, bh
movsx edx, bx
ja 0x1400cf249
mov r9d, 0x171a953b
call fcn.1400b8c98

Function at 0x1400bbd12
Capabilities:
Authenticate hmac

Disassembly:
sub edi, edx
neg r9d
adc rbx, r11
ror edi, 2
neg cl
or ebx, edx
mov qword [rsp + r9*4], rbp
movzx ebp, r9b
push rcx
xor dword [rsp + r9 + 8], edi
idiv eax
lea rbx, [rax*8 + 0x7bd1b0c]
btc r9d, eax
mov rbp, qword [rsp + r9*2 - 0xffff8]
movsxd rdi, edi
sar eax, cl
ror rdx, cl
adc r8, rdi
movzx edx, byte [r10 + r9 - 0x80005]
push r11
lea r10, [r10 + r9*2 - 0x100005]
mov qword [rsp + r9 - 0x7fff0], r11
movsx edi, cl
sar bl, 1
xor dl, bpl
not byte [rsp + r9 - 0x7fffd]
rol byte [rsp + r9 - 0x7fff1], 0x47
xor r9b, 0x3d
neg dl
ror dl, 1
sub dword [rsp + r9 - 0x80039], eax
xor dl, r11b
and word [rsp + r9 - 0x8002d], 0xed1b
imul r9w, ax
rol dl, 1
add dl, r11b
call fcn.1400b8ccc
Function at 0x1400c91c0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
cdq
adc dword [rsp + rax - 0x78998be7], 0xb4031b3f
mov r9, qword [rax + r10 - 0x78998bf1]
mov qword [rsp + rax - 0x78998bd9], 0x601f7f8e
sar ax, cl
xor r9, rbp
call fcn.1400beb15
movzx eax, word [r10 - 2]
xor ax, bp
push 0x2516412b
mov r9d, 0x51884d96
movsx edi, word [rsp + r9 - 0x51884d93]
ror ax, 1
push rdi
xor ax, 0xa934
pop rcx
rol ax, 1
mov byte [rsp + rdi*2 - 0x46], dil
imul rcx, rcx
inc ax
xor bp, ax
mov r11d, 0x6c973730
not word [rsp + r9 - 0x51884d92]
sar di, 0x4b
mov word [r9 + rsi - 0x51884d98], ax
btr cx, cx
jae 0x1400af784
mov eax, dword [rcx + rsi - 0x4800]
or dx, word [rsp + rcx - 0x47fc]
add cl, byte [rsi + rcx*4 - 0x11ffc]
neg byte [rsp + rbx - 0x6130b010]
sbb r9w, 0x9729
lea rsi, [rsi + rbx - 0x6130b013]
sal eax, cl
push rbx
ror byte [rsp + rdx*2 - 0x1fffe], 0x84
lea rdi, [rbx + r9*8 - 0x24474b64]
mov dword [rbx + rsi - 0x6130b015], eax
mov qword [rsp + rdx - 0xffff], r8
ret 0x10

Function at 0x1400c976e
Capabilities:
Authenticate hmac

Disassembly:
sar edx, 0xed
sal eax, cl
mov dword [r11 + rsi], eax
call fcn.1400c06ab
mov edx, 0xdb09dd80
sub r10, 4
mov edx, dword [r10 + riz]
xor edx, ebp
mov ecx, 0x23a964ba
mov r11d, ecx
lea r9, [rcx + r11 + 0x61a05035]
ror edx, 3
call fcn.1400a7482

Function at 0x1400c97a6
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 8], rbp
call fcn.1400d3007

Function at 0x1400c97b0
Capabilities:
Authenticate hmac

Disassembly:
shr rdx, 0xf2
inc edx
mov qword [rdi + r11], rax
call fcn.1400d3f8a
Function at 0x1400ca1cf
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r9*8 - 0x7f8], rcx
adc r8, rax
add ebx, dword [r9 + rsi - 0xff]
ror byte [rsp + r9 - 0xff], 0x65
neg word [rsp + r9 - 0xfa]
mov edi, dword [rsi + r9*2 - 0x1fa]
call fcn.1400b373e

Function at 0x1400ca201
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg r11b
bswap edx
movsx r9d, bl
push r11
mov qword [rsp + rdi*2 - 0x6c], rbp
xor dword [rsp + rcx - 0x76b9c336], edx
shr r9, 0xe3
cdqe
call fcn.1400bbb0c
movsx ebx, al
lea rdi, [rdx*8 - 0x60d1b6c9]
or rdx, r8
jmp rdx
pop r14
pop r14
call fcn.1400b9d2a
sub r10, 4
mov ecx, 0x76b9c336
mov edx, dword [r10 + rcx - 0x76b9c336]
xor edx, ebp
movzx edi, cl
movzx ebx, cl
btr ebx, edi
lea edx, [rdx + rcx - 0x4b2ac317]
jae 0x1400d1a53
movzx eax, cl
cdqe
neg edx
mov r11d, ecx
sal ax, 0xa
inc bx
xor edx, 0x91095197
jmp 0x1400abde7
Function at 0x1400cc866
Capabilities:
Encode data using base64

Disassembly:
dec al
movsx r9d, al
movzx ebx, word [r11 + r10 - 0x3337a2a8]
btr eax, edi
sar r11w, 0x46
xadd rax, r11
xor bx, bp
movzx edx, r9b
call fcn.1400c198d
mov r11d, dword [rsi]
mov edx, dword [rsi + 4]
mov edi, 0x6e9962b8
movsx ecx, dil
movzx eax, dil
lea rsi, [rdi + rsi - 0x6e9962b4]
movzx r9d, di
bts rax, rdi
or r11d, edx
cqo
not r11d
btc ecx, edi
sbb rdx, rdx
mov dword [rsi + rdi - 0x6e9962b8], r11d
and rcx, r9
lea r11, [rdx + rdx - 0x55efee4a]
shr r11b, 6
lea r10, [rcx + r10 - 0x62bc]
cwde
mov r9d, dword [r10 + rcx*4 - 0x18ae0]
xor r9d, ebp
ror r9d, 3
or cl, ah
ror ax, 0xad
lea r9d, [r9 + rdi - 0x38ee2daf]
jnp 0x1400b80b9
rol r9d, 1
not rcx
sal dl, 0xa3
neg r11d
lea r9d, [r9 + rdi*2 - 0x9880db6]
ror r9d, 1
cdqe
jmp 0x1400d7c0c
xor eax, 0xe6bc8691
neg eax
rol eax, 1
ror r11b, 0x81
sub edi, 0x4220ca1a
jbe 0x1400c0e6a
mov r11d, 0x1016f16
lea rbx, [r11*8 - 0x78f9ad61]
lea r10, [r10 + r11*4 - 0x405bc5c]
movzx r9d, bl
bt r11d, r9d
movzx edi, r9b
mov edi, dword [r11 + r10 - 0x1016f16]
mov ecx, r9d
xor edi, ebp
lea rax, [rcx + rbx*2 + 0x46a7d629]
imul ebx
ror edi, 2
lea edi, [rdi + rax - 0xcaeb19d]
xor rdx, r11
inc r11w
push r11
neg edi
neg bl
inc r9b
btr eax, r9d
rol edi, 2
cwd
xchg rcx, r11
xadd dword [rsp + r11*2 - 0x9b], r11d
mov qword [rsp + r11 - 1], rbp
shr eax, cl
movzx ebp, bl
xor dword [rsp + r11*4 - 4], edi
shr rbp, 0x1d
bt ebx, 0x89
pop rbp
shl ebx, 0xe3
movsxd rdi, edi
sbb r9b, dl
sub bx, 0xc922
add r8, rdi
call fcn.1400cb326
sub word [rsp + 2], r11w
ror r9b, 1
sar rcx, cl
btc rdi, r11
lea rax, [rdi + rcx*4 + 0xa8e5888]
inc r9b
xchg dword [rsp + rcx*2 + 7], ecx
xor r9b, 0x1e
inc al
and di, word [rsp + rcx - 0x18d5d]
sub cx, r11w
inc r9b
btc eax, 8
xor r9b, 0
cwde
movzx ebx, word [rsp + rcx*2 - 0x317b4]
sar dil, 6
xor bpl, r9b
call fcn.1400ac394
mov r9d, 0xb9217f8e
movzx eax, r9w
cdqe
mov rcx, qword [rsi + rax - 0x7f8e]
push r9
jmp 0x1400d3996
lea rsi, [rsi + rcx - 0x593a8c1c]
movzx edi, dx
push rdx
mov word [rsi + rdi*8 - 0x75ed0], r9w
lea r10, [r10 + rdi*2 - 0x1d7b8]
mov eax, dword [rdi + r10 - 0xebda]
mov qword [rsp + rcx - 0x593a8c1a], rdx
lea r11, [rcx*2 + 0x1a12a63b]
xadd qword [rsp + rcx - 0x593a8c1a], rcx
xor eax, ebp
ror dword [rsp + rdi*4 - 0x3af5d], 0x68
bswap eax
jae 0x1400b0001
jb 0x1400b775c
push rbp
shl edx, cl
lea rbp, [rax + rcx*4 - 0x6de248d3]
xor dword [rsp + rdi - 0x6e9962b8], r9d
sal rcx, cl
pop rbp
movsxd r9, r9d
not r11b
add r8, r9
and cx, 0xd396
lea rbx, [r11 + rdx*8 + 0xdae0b20]
jmp r8
Function at 0x1400d8e5a
Capabilities:
Encode data using base64

Disassembly:
dec word [rsp + rdi - 0x18b6]
shr word [rsp + rdi - 0x18b4], 0xc2
lea rsi, [rsi + rdi - 0x18b6]
movsx ecx, dx
mov ebx, dword [rdi + r10 - 0x18c2]
lea r10, [r10 + rdi - 0x18c2]
or rdx, qword [rsp + rdi*4 - 0x62f0]
mov qword [rsp + rdi*2 - 0x317c], rcx
xor ebx, ebp
ror ebx, 1
dec ebx
rol ebx, 2
not di
lea ebx, [rbx + rdi*2 + 0x54aba81e]
movsx eax, byte [rsp + rdi*2 - 0x1ce81]
push r9
add r11w, 0x3421
rol ebx, 1
pop rcx
mov qword [rsp + rdi - 0xe739], rbp
pop rdx
xor dword [rsp + rdi*2 - 0x1ce82], ebx
and edx, r9d
pop rbp
not r11
call fcn.1400b4cd1
mov ebx, 0x91319c22
mov r11d, dword [r10 + riz - 4]
movzx edi, bx
sar dil, 0x21
xor r11d, ebp
mov edx, 0xdab0b38
sub edi, edi
mov eax, edx
sbb r11d, 0xe5a3682a
movzx ecx, dil
lea rbx, [rax*8 + 0xb2f47b5]
rol r11d, 3
div bl
add ebx, 0x6625483f
mov r9d, ecx
neg r11d
and ax, bx
imul dx
or dx, di
ror r11d, 1
xor dl, ch
shl cl, 6
neg r11d
btr edi, ebx
sal r9w, 0x61
and bx, 0x119d
xor r11d, 0x1fbd0630
btc edx, ebx
sal dil, 0x86
or rax, 0xffffffff8aab8c25
dec r11d
call fcn.1400d817d
Function at 0x180002120
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.180008d80
jmp 0x180002168
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, 0x30
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x180002188
jmp 0x180002225
cmp dword [rsp + 0x68], 0x1000
jne 0x1800021ad
mov eax, dword [rsp + 0x6c]
and eax, 0xff
cmp eax, 1
je 0x1800021ad
mov eax, dword [rsp + 0x6c]
and eax, 0x100
test eax, eax
je 0x1800021af
jmp 0x180002153
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1800021e5
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x60]
ja 0x1800021e5
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x1800021ea
jmp 0x180002153
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x180002153
mov rax, qword [rsp + 0x20]
jmp 0x180002227
xor eax, eax
add rsp, 0x88
ret

Function at 0x180002a70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180002c90
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180002b77
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180002ad4
mov rax, qword [0x180029008]
cmp qword [rsp + 0x20], rax
ja 0x180002ad4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180002a96
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180008d80
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002b03
jmp 0x180002b77
cmp dword [rsp + 0x50], 0x10000
jne 0x180002b5a
cmp qword [rsp + 0x48], 0x10000
jb 0x180002b5a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180002b48
mov rax, qword [rsp + 0x28]
jmp 0x180002b79
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180002b72
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180002c90
mov qword [rsp + 0x20], rax
jmp 0x180002a96
xor eax, eax
add rsp, 0x68
ret
Function at 0x180002b80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180002cd0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180002c83
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180002bdb
mov rax, qword [0x180029008]
cmp qword [rsp + 0x20], rax
ja 0x180002bdb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180002b9d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180008d80
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002c0a
jmp 0x180002c83
cmp dword [rsp + 0x50], 0x10000
jne 0x180002c61
cmp qword [rsp + 0x48], 0x10000
jb 0x180002c61
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180002c4f
mov rax, qword [rsp + 0x28]
jmp 0x180002c85
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180002c7e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180002cd0
mov qword [rsp + 0x20], rax
jmp 0x180002b9d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180002d20
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800032b0
mov qword [rsp + 0x28], 0
cmp qword [0x180029d38], 0
jne 0x180002d68
cmp qword [0x180029d30], 0
je 0x180002d68
mov rax, qword [0x180029d30]
mov qword [0x180029d38], rax
cmp qword [0x180029d38], 0
je 0x180002e0e
mov rax, qword [0x180029d38]
cmp qword [rax + 0x10], 0
je 0x180002e0e
mov rax, qword [0x180029d38]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180002e0e
mov rax, qword [0x180029d38]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180002e0e
mov rax, qword [0x180029d38]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180002dd4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180002ddb
xor eax, eax
jmp 0x180002f89
mov rax, qword [0x180029d38]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.180008d80
mov rax, qword [rsp + 0x28]
jmp 0x180002f89
mov rax, qword [0x180029d30]
mov qword [0x180029d38], rax
jmp 0x180002e30
mov rax, qword [0x180029d38]
mov rax, qword [rax + 8]
mov qword [0x180029d38], rax
cmp qword [0x180029d38], 0
je 0x180002e7d
cmp qword [0x180029d38], 0
je 0x180002e7b
mov rax, qword [0x180029d38]
cmp qword [rax + 0x10], 0
je 0x180002e7b
mov rax, qword [0x180029d38]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180002e7b
mov rax, qword [0x180029d38]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180002e7b
jmp 0x180002dac
jmp 0x180002e1e
mov rcx, qword [rsp + 0x60]
call fcn.180005210
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180002f90
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180002f87
mov rax, qword [rsp + 0x48]
mov qword [0x180029d38], rax
mov rax, qword [0x180029d38]
mov dword [rax], 0x52727464
mov rax, qword [0x180029d38]
mov qword [rax + 0x10], 0
mov rax, qword [0x180029d38]
mov rcx, qword [0x180029d30]
mov qword [rax + 8], rcx
mov rax, qword [0x180029d38]
mov qword [0x180029d30], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180029d38]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180002f38
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180002f72
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180002f2e
mov rax, qword [0x180029d38]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180002dac
xor eax, eax
add rsp, 0x58
ret
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400de920]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x1400de930]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x1400e1008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400de890]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.1400c97f0
mov rcx, qword [0x1400de9b0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x1400de910]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.1400c9600
mov ebx, dword [0x1400e1028]
lea r12d, [rbx + 1]
movsxd r12, r12d
shl r12, 3
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, qword [0x1400e1020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub r12, 8
xor ebx, ebx
nop dword [rax]
mov rcx, qword [rdi + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rsi, [rax + rax + 2]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [rdi + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rbx, r12
jne 0x140001288
add rbx, rbp
mov qword [rbx], 0
mov qword [0x1400e1020], rbp
call fcn.1400c9340
mov rax, qword [0x1400de8a0]
mov r8, qword [0x1400e1018]
mov ecx, dword [0x1400e1028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x1400e1020]
call fcn.1400c9360
mov ecx, dword [0x1400e100c]
mov dword [0x1400e1010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x1400e1008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x1400de930]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call fcn.1400ca5a0
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x1400de950]
mov rcx, qword [0x1400de940]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x1400e1010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x1400de970]
mov rcx, qword [0x1400de960]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f5
mov rbx, rax
jmp 0x1400012be
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop