joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53451f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push qword [rbp + 0x18]
push 1
call fcn.005a3f4f
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 0xc
jne 0x5345a1
mov qword [rbp - 8], rax
mov rbx, qword [rbp + 0x18]
mov rbx, qword [rbx]
lock inc dword [rbx]
cmp dword [rbx + 4], 0xc
jne 0x5345a1
mov qword [rbp - 0x10], rbx
mov rbx, qword [rbx + 8]
mov esi, dword [rbx]
mov rdi, qword [rbp - 0x10]
lock dec dword [rdi]
dec esi
mov rax, qword [rax + 8]
mov ebx, dword [rax]
cmp esi, ebx
jae 0x5345a1
imul esi, esi, 0x18
mov rbx, qword [rbp + 0x10]
mov rdi, qword [rbx]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
mov qword [rax + rsi + 8], rdi
mov qword [rax + rsi + 0x10], rcx
mov qword [rax + rsi + 0x18], rdx
mov rax, qword [rbp - 8]
lock dec dword [rax]
leave
ret 0x10
int 5

Function at 0x5345a3
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x820
mov ax, word [rbp + 0x18]
mov word [rbp - 2], ax
lea rcx, [rbp - 0x818]
mov edx, 0x802
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov ax, word [rbp - 2]
mov word [rbp - 0x818], ax
imul eax, dword [rbp + 0x18], 2
mov dword [rbp - 0x81c], eax
mov eax, 0x802
sub eax, dword [rbp - 0x81c]
jb 0x5346c2
cmp eax, 2
jb 0x5346c2
imul eax, dword [rbp + 0x18], 2
cmp eax, dword [rbp - 0x81c]
jne 0x5346c2
mov r8d, eax
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp - 0x816]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
imul eax, dword [rbp + 0x18], 2
add eax, 2
mov dword [rbp - 0xc], eax
mov dword [rbp - 8], 0
lea rax, [rbp - 0x10]
push rax
push 0xa
call fcn.0050fb79
push qword [rbp + 0x20]
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x820], eax
mov eax, 0x802
sub eax, dword [rbp - 0x820]
jb 0x5346c4
push qword [rbp - 0x820]
lea rax, [rbp - 0x818]
push rax
lea rax, [rbp - 8]
push rax
call fcn.00531e9d
mov dword [rbp - 0x81c], eax
mov eax, dword [rbp - 8]
cmp eax, dword [rbp - 0xc]
jne 0x53468d
xor eax, eax
leave
ret 0x18
cmp dword [rbp - 0x81c], 0
jge 0x53469f
mov eax, 0xffffffff
leave
ret 0x18
push rax
push qword [rbp - 0x10]
call fcn.004832dc
pop rcx
test al, al
je 0x5346b6
mov eax, 0xffffffff
leave
ret 0x18
push qword [rbp + 0x20]
push 1
call fcn.00531fcd
jmp 0x534648
int 5
int 5
Function at 0x5346c6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x18]
cmp qword [rax], 0
jne 0x5346df
xor eax, eax
jmp 0x534706
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 0xc
jne 0x5348c4
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov rsi, qword [rbp - 0x18]
lock dec dword [rsi]
mov eax, ebx
mov dword [rbp - 4], eax
cmp dword [rbp + 0x10], 0
jl 0x5348c6
mov eax, dword [rbp + 0x10]
cmp eax, dword [rbp - 4]
jge 0x5348c6
mov eax, dword [rbp - 4]
dec eax
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0x5555555
jae 0x5348c8
imul eax, eax, 0x18
add eax, 8
mov r8d, eax
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov ebx, dword [rbp - 0x14]
mov dword [rax], ebx
call fcn.006defae
mov dword [rax + 4], 0xc
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 0xc
jne 0x5348ca
mov qword [rbp - 0x18], rax
mov ebx, dword [rbp + 0x10]
mov dword [rbp - 0x1c], ebx
mov rax, qword [rax + 8]
mov ebx, dword [rax]
sub ebx, dword [rbp - 0x1c]
jb 0x5348ca
mov rbx, qword [rbp + 0x18]
mov rbx, qword [rbx]
lock inc dword [rbx]
cmp dword [rbx + 4], 0xc
jne 0x5348ca
mov qword [rbp - 0x28], rbx
mov esi, dword [rbp + 0x10]
mov dword [rbp - 0x2c], esi
mov rbx, qword [rbx + 8]
mov esi, dword [rbx]
sub esi, dword [rbp - 0x2c]
jb 0x5348ca
mov esi, dword [rbp - 0x2c]
cmp esi, dword [rbp - 0x1c]
jne 0x5348ca
imul esi, esi, 0x18
mov r8d, esi
lea rdx, [rbx + 8]
lea rcx, [rax + 8]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov rax, qword [rbp - 0x28]
lock dec dword [rax]
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 0xc
jne 0x5348cc
mov qword [rbp - 0x18], rax
mov ebx, dword [rbp - 4]
sub ebx, dword [rbp + 0x10]
dec ebx
mov dword [rbp - 0x1c], ebx
mov rax, qword [rax + 8]
mov ebx, dword [rax]
sub ebx, dword [rbp - 0x1c]
jb 0x5348cc
cmp ebx, dword [rbp + 0x10]
jb 0x5348cc
imul ebx, dword [rbp + 0x10], 0x18
mov rsi, qword [rbp + 0x18]
mov rsi, qword [rsi]
lock inc dword [rsi]
cmp dword [rsi + 4], 0xc
jne 0x5348cc
mov qword [rbp - 0x28], rsi
mov edi, dword [rbp + 0x10]
inc edi
mov ecx, dword [rbp - 4]
sub ecx, dword [rbp + 0x10]
dec ecx
mov dword [rbp - 0x2c], ecx
mov rsi, qword [rsi + 8]
mov ecx, dword [rsi]
sub ecx, dword [rbp - 0x2c]
jb 0x5348cc
cmp ecx, edi
jb 0x5348cc
imul edi, edi, 0x18
mov ecx, dword [rbp - 0x2c]
cmp ecx, dword [rbp - 0x1c]
jne 0x5348cc
imul ecx, ecx, 0x18
mov r8d, ecx
lea rdx, [rsi + rdi + 8]
lea rcx, [rax + rbx + 8]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov rax, qword [rbp - 0x28]
lock dec dword [rax]
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov ebx, 0xc
call fcn.006df099
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 0x10]
mov qword [rax], rbx
leave
ret 0x10
int 5
int 5
int 5
int 5
int 5
Function at 0x5348ce
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jle 0x5349e2
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
cmp eax, dword [rbp + 0x20]
jb 0x5348fb
mov eax, 0xffffb1d4
leave
ret 0x20
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp + 0x20]
sub ebx, dword [rax]
mov dword [rbp - 8], ebx
cmp dword [rbp - 8], 0x16d0
jbe 0x534917
mov dword [rbp - 8], 0x16d0
push 0
push qword [rbp - 8]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
cmp eax, dword [rbp + 0x20]
jae 0x5349e4
mov rbx, qword [rbp + 0x18]
lea rax, [rbx + rax]
push rax
mov rax, qword [rbp + 0x28]
push qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [sym.imp.ws2_32.dll_recv]
add rsp, 0x20
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
jne 0x5349ba
call fcn.0042464b
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffd8cd
je 0x534977
cmp dword [rbp - 4], 0xfffffff4
jne 0x53497d
xor eax, eax
leave
ret 0x20
cmp dword [rbp - 4], 0xffffd8bc
je 0x5349aa
cmp dword [rbp - 4], 0xffffd8be
je 0x5349aa
cmp dword [rbp - 4], 0xffffd8bd
je 0x5349aa
cmp dword [rbp - 4], 0xffffd8bb
je 0x5349aa
cmp dword [rbp - 4], 0xffffd8ba
jne 0x5349b3
mov eax, 0xffffb1d3
leave
ret 0x20
mov eax, dword [rbp - 4]
leave
ret 0x20
cmp dword [rbp - 4], 0
jne 0x5349c9
mov eax, 0xffffb1d3
leave
ret 0x20
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 4]
add dword [rax], ebx
mov rax, qword [rbp + 0x28]
mov ebx, dword [rbp - 4]
add dword [rax + 0x2c], ebx
xor eax, eax
leave
ret 0x20
int 5
int 5
Function at 0x534b80
Capabilities:
Encode data using base64

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rcx, qword [rbp + 0x18]
mov edx, dword [rbp + 0x20]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 8], 0
mov dword [rbp - 4], 0
jmp 0x534cae
mov dword [rbp - 0x10], 3
mov dword [rbp - 0x18], 0
mov dword [rbp - 0x14], 0
jmp 0x534c78
mov eax, dword [rbp - 4]
add eax, dword [rbp - 0x14]
cmp eax, dword [rbp + 0x30]
jae 0x534cc7
mov rbx, qword [rbp + 0x28]
movzx eax, byte [rbx + rax]
mov byte [rbp - 9], al
movzx eax, byte [rbp - 9]
cmp eax, 0x41
jb 0x534bff
movzx eax, byte [rbp - 9]
cmp eax, 0x5a
ja 0x534bff
sub byte [rbp - 9], 0x41
jmp 0x534c66
movzx eax, byte [rbp - 9]
cmp eax, 0x61
jb 0x534c17
movzx eax, byte [rbp - 9]
cmp eax, 0x7a
ja 0x534c17
sub byte [rbp - 9], 0x47
jmp 0x534c66
movzx eax, byte [rbp - 9]
cmp eax, 0x30
jb 0x534c2f
movzx eax, byte [rbp - 9]
cmp eax, 0x39
ja 0x534c2f
sub byte [rbp - 9], 0xfc
jmp 0x534c66
movzx eax, byte [rbp - 9]
cmp eax, 0x2b
jne 0x534c3e
mov byte [rbp - 9], 0x3e
jmp 0x534c66
movzx eax, byte [rbp - 9]
cmp eax, 0x2f
jne 0x534c4d
mov byte [rbp - 9], 0x3f
jmp 0x534c66
movzx eax, byte [rbp - 9]
cmp eax, 0x3d
jne 0x534c5f
mov byte [rbp - 9], 0
dec dword [rbp - 0x10]
jmp 0x534c66
mov byte [rbp - 9], 0
dec dword [rbp - 0x10]
mov eax, dword [rbp - 0x18]
shl eax, 6
movzx ebx, byte [rbp - 9]
add eax, ebx
mov dword [rbp - 0x18], eax
inc dword [rbp - 0x14]
cmp dword [rbp - 0x14], 4
jl 0x534bcd
jmp 0x534ca4
mov eax, dword [rbp - 8]
inc dword [rbp - 8]
cmp eax, dword [rbp + 0x20]
jae 0x534cc9
mov rbx, qword [rbp + 0x18]
mov esi, dword [rbp - 0x18]
shr esi, 0x10
mov byte [rbx + rax], sil
shl dword [rbp - 0x18], 8
dec dword [rbp - 0x10]
cmp dword [rbp - 0x10], 0
jg 0x534c84
add dword [rbp - 4], 4
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x30]
jl 0x534bb3
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 8]
mov dword [rax], ebx
leave
ret 0x28
int 5
int 5
Function at 0x5411f0
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
test byte [0x0175f8bc], 0xff
je 0x54122e
push 0x2a
push str.info:_cwebcam.c_:_close_receiver_from_u__n
movzx eax, word [rbp + 0x10]
mov word [rbp - 0x1a], ax
mov dword [rbp - 0x10], 2
lea rax, [rbp - 0x1a]
mov qword [rbp - 0x18], rax
push 1
lea rax, [rbp - 0x18]
push rax
call fcn.0040280b
mov dword [rbp - 4], 0
jmp 0x5412c8
mov rax, qword [0x0175fa28]
lock inc dword [rax]
cmp dword [rax + 4], 0x50
jne 0x5412f8
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 4]
cmp esi, ebx
jae 0x5412f8
imul esi, esi, 0x2c
movzx eax, word [rax + rsi + 4]
mov rbx, qword [rbp - 0x10]
lock dec dword [rbx]
movzx ebx, word [rbp + 0x10]
cmp eax, ebx
jne 0x5412c5
mov rax, qword [0x0175fa28]
lock inc dword [rax]
cmp dword [rax + 4], 0x50
jne 0x5412fa
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 4]
cmp esi, ebx
jae 0x5412fa
imul esi, esi, 0x2c
mov eax, dword [rax + rsi + 0x18]
mov dword [rbp - 8], eax
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
push 0x175fa28
push qword [rbp - 4]
call fcn.005ab0ce
push qword [rbp - 8]
push 0
call fcn.00435092
jmp 0x5412f2
inc dword [rbp - 4]
mov rax, qword [0x0175fa28]
lock inc dword [rax]
cmp dword [rax + 4], 0x50
jne 0x5412f6
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov rsi, qword [rbp - 0x10]
lock dec dword [rsi]
cmp ebx, dword [rbp - 4]
jg 0x54123a
leave
ret 8
int 5
int 5
int 5
Function at 0x568045
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x0177ec78]
lock inc dword [rax]
cmp dword [rax + 4], 0x60
jne 0x5681c6
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov dword [rbp - 0x18], ebx
lea rax, [rax + 8]
mov qword [rbp - 0x20], rax
mov rax, qword [0x0177ec88]
lock inc dword [rax]
cmp dword [rax + 4], 0x39
jne 0x5681c8
mov qword [rbp - 0x28], rax
mov ebx, dword [0x0177ec90]
mov dword [rbp - 0x3c], ebx
mov rax, qword [rax + 8]
mov ebx, dword [rax]
sub ebx, dword [rbp - 0x3c]
jb 0x5681c8
mov ebx, dword [rbp - 0x3c]
mov dword [rbp - 0x30], ebx
lea rax, [rax + 4]
mov qword [rbp - 0x38], rax
mov dword [rbp - 8], 0
mov dword [rbp - 4], 0
jmp 0x568100
mov eax, dword [rbp - 4]
cmp eax, dword [rbp - 0x30]
jae 0x5681ca
mov rbx, qword [rbp - 0x38]
mov eax, dword [rbx + rax*4]
cmp eax, dword [rbp - 0x18]
jae 0x5681ca
mov rbx, qword [rbp - 0x20]
imul eax, eax, 0x148
mov esi, dword [rbp - 4]
cmp esi, dword [rbx + rax + 0x34]
jne 0x5681cc
inc dword [rbp - 8]
inc dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, dword [rbp - 0x30]
jl 0x5680c7
mov eax, dword [0x0177ec80]
mov dword [rbp - 4], eax
jmp 0x56818a
mov rax, qword [0x0177ec78]
lock inc dword [rax]
cmp dword [rax + 4], 0x60
jne 0x5681ce
mov qword [rbp - 0x40], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 4]
cmp esi, ebx
jae 0x5681ce
imul esi, esi, 0x148
mov eax, dword [rax + rsi + 0x3c]
mov rbx, qword [rbp - 0x40]
lock dec dword [rbx]
cmp eax, 0xffffffff
jne 0x5681d0
mov rax, qword [0x0177ec78]
lock inc dword [rax]
cmp dword [rax + 4], 0x60
jne 0x5681d2
mov qword [rbp - 0x40], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 4]
cmp esi, ebx
jae 0x5681d2
imul esi, esi, 0x148
mov eax, dword [rax + rsi + 0x38]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x40]
lock dec dword [rax]
inc dword [rbp - 8]
cmp dword [rbp - 4], 0xffffffff
jne 0x568113
mov rax, qword [0x0177ec78]
lock inc dword [rax]
cmp dword [rax + 4], 0x60
jne 0x5681d4
mov qword [rbp - 0x40], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov rsi, qword [rbp - 0x40]
lock dec dword [rsi]
cmp ebx, dword [rbp - 8]
jne 0x5681d6
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov rax, qword [rbp - 0x28]
lock dec dword [rax]
leave
ret
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
Function at 0x5681d8
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.005c9081
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 0xcc
jne 0x5683d9
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 8]
cmp esi, ebx
jae 0x5683d9
mov eax, dword [rax + rsi*4 + 4]
mov dword [rbp - 0x10], eax
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov dword [rbp - 0xc], 0xffffffff
jmp 0x568278
mov eax, dword [rbp - 0x10]
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
lock inc dword [rax]
cmp dword [rax + 4], 0xcd
jne 0x5683dd
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 0x10]
cmp esi, ebx
jae 0x5683dd
imul esi, esi, 0x14
mov eax, dword [rax + rsi + 0x14]
mov dword [rbp - 0x10], eax
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
push qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
lock inc dword [rax]
cmp dword [rax + 4], 0xcd
jne 0x5683db
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 0x10]
cmp esi, ebx
jae 0x5683db
imul esi, esi, 0x14
lea rax, [rax + rsi + 5]
push rax
call fcn.005c90c4
mov rbx, qword [rbp - 0x18]
lock dec dword [rbx]
test al, al
je 0x568234
cmp dword [rbp - 0xc], 0xffffffff
jne 0x56833f
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 0xcc
jne 0x5683df
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 8]
cmp esi, ebx
jae 0x5683df
mov rbx, qword [rbp + 0x10]
mov rbx, qword [rbx + 8]
lock inc dword [rbx]
cmp dword [rbx + 4], 0xcd
jne 0x5683df
mov qword [rbp - 0x20], rbx
mov rbx, qword [rbx + 8]
mov edi, dword [rbx]
mov ecx, dword [rbp - 0x10]
cmp ecx, edi
jae 0x5683df
imul ecx, ecx, 0x14
mov ebx, dword [rbx + rcx + 0x14]
mov dword [rax + rsi*4 + 4], ebx
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov rax, qword [rbp - 0x20]
lock dec dword [rax]
jmp 0x5683a9
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
lock inc dword [rax]
cmp dword [rax + 4], 0xcd
jne 0x5683e1
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 0xc]
cmp esi, ebx
jae 0x5683e1
imul esi, esi, 0x14
mov rbx, qword [rbp + 0x10]
mov rbx, qword [rbx + 8]
lock inc dword [rbx]
cmp dword [rbx + 4], 0xcd
jne 0x5683e1
mov qword [rbp - 0x20], rbx
mov rbx, qword [rbx + 8]
mov edi, dword [rbx]
mov ecx, dword [rbp - 0x10]
cmp ecx, edi
jae 0x5683e1
imul ecx, ecx, 0x14
mov ebx, dword [rbx + rcx + 0x14]
mov dword [rax + rsi + 0x14], ebx
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov rax, qword [rbp - 0x20]
lock dec dword [rax]
push rax
push qword [rbp - 0x10]
push qword [rbp + 0x10]
lea rax, [rbp - 1]
push rax
call fcn.005c90db
pop rcx
test byte [rbp - 1], 0xff
je 0x5683d5
mov rax, qword [rbp + 0x10]
test byte [rax + 0x1d], 0xff
je 0x5683d5
push qword [rbp + 0x10]
push 0xffffffffffffffff
call fcn.005c91c9
leave
ret 0x10
int 5
int 5
int 5
int 5
int 5
Function at 0x568797
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x30]
mov eax, dword [rax]
mov dword [rbp - 4], eax
push qword [rbp + 0x38]
mov rax, qword [rbp + 0x18]
push qword [rax + 0x18]
call fcn.004c233c
mov dword [rbp - 8], eax
mov eax, dword [rbp - 4]
cmp eax, dword [rbp - 8]
je 0x5688a8
cmp dword [rbp - 4], 0xffffffff
je 0x5687fc
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x28]
jae 0x5688ac
mov rbx, qword [rbp + 0x20]
cmp dword [rbx + rax*4], 0
jbe 0x5688ae
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x28]
jae 0x5688b0
mov rbx, qword [rbp + 0x20]
dec dword [rbx + rax*4]
mov eax, dword [rbp - 8]
cmp eax, dword [rbp + 0x28]
jae 0x5688b2
mov rbx, qword [rbp + 0x20]
inc dword [rbx + rax*4]
mov rax, qword [rbp + 0x30]
mov ebx, dword [rbp - 8]
mov dword [rax], ebx
mov rax, qword [rbp + 0x18]
mov ebx, dword [rbp - 8]
cmp ebx, dword [rax + 0x1c]
jle 0x56884e
push 1
push qword [rbp - 8]
push qword [rbp + 0x18]
test byte [rbp + 0x10], 0xff
je 0x568839
mov eax, 1
jmp 0x56883e
mov eax, 2
push rax
call fcn.00563a57
mov rax, qword [rbp + 0x18]
mov byte [rax + 0x28], 1
jmp 0x5688a8
mov rax, qword [rbp + 0x18]
mov ebx, dword [rbp - 8]
cmp ebx, dword [rax + 0x1c]
jge 0x5688a8
mov rax, qword [rbp + 0x18]
mov eax, dword [rax + 0x1c]
cmp eax, dword [rbp + 0x28]
jae 0x5688b4
mov rbx, qword [rbp + 0x20]
cmp dword [rbx + rax*4], 0
jne 0x5688a8
mov rax, qword [rbp + 0x18]
mov eax, dword [rax + 0x1c]
mov dword [rbp - 0xc], eax
jmp 0x56887f
dec dword [rbp - 0xc]
mov eax, dword [rbp - 0xc]
cmp eax, dword [rbp + 0x28]
jae 0x5688b6
mov rbx, qword [rbp + 0x20]
cmp dword [rbx + rax*4], 0
je 0x56887c
push 1
push qword [rbp - 0xc]
push qword [rbp + 0x18]
push 1
call fcn.00563a57
mov rax, qword [rbp + 0x18]
mov byte [rax + 0x28], 1
leave
ret 0x30
int 5
int 5
int 5
int 5
int 5
int 5
Function at 0x580e1d
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push rax
push qword [rbp + 0x28]
call fcn.00509527
pop rcx
push rax
push 0x18143c0
call fcn.0040b260
pop rcx
mov rax, qword [rbp + 0x28]
mov ebx, dword [rbp + 0x18]
mov dword [rax + 0x10], ebx
mov rax, qword [rbp + 0x28]
mov ebx, dword [rbp + 0x10]
mov dword [rax + 0x14], ebx
mov rax, qword [rbp + 0x28]
mov r8d, pe_nt_image_headers64
mov rdx, qword [rbp + 0x20]
lea rcx, [rax + 0x18]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp + 0x28]
mov ebx, dword [rbp + 0x18]
shl ebx, 2
imul ebx, dword [rbp + 0x10]
mov dword [rax + 0x108], ebx
mov rax, qword [rbp + 0x28]
mov dword [rax + 0x154], 0xffffffff
mov rax, qword [rbp + 0x28]
mov byte [rax + 0xd8], 0
mov rax, qword [rbp + 0x28]
push 6
push qword [rbp + 0x20]
push 6
push str.DS:_S
lea rax, [rax + 0x98]
mov qword [rsp + 0x20], rax
call fcn.00410e58
cmp eax, 0
setne al
mov rbx, qword [rsp]
mov byte [rbx], al
mov rax, qword [rbp + 0x28]
mov dword [rax + 0xc], 0
push 0
push 0
mov r9, qword [rbp + 0x28]
mov r8d, 0x5dd281
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x580f12
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x580f4d
jmp 0x580f32
mov ecx, 0x14
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_Sleep]
add rsp, 0x20
mov rax, qword [rbp + 0x28]
cmp dword [rax + 0xc], 0
je 0x580f1f
mov rax, qword [rbp + 0x28]
cmp dword [rax + 0xc], 0
jge 0x580f4d
mov dword [rbp - 4], 0xffffffff
push rax
push 0x18143c0
call fcn.0040ba36
pop rcx
mov eax, dword [rbp - 4]
leave
ret 0x20
Function at 0x59d518
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x2c], 0xcc
je 0x59d56a
mov rax, qword [rbp + 0x10]
push rax
push qword [rbp + 0x10]
mov rax, qword [rax + 0x208]
call qword [rax]
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x59d551
xor al, al
leave
ret 8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xa0], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x2c], 0xcc
jmp 0x59d657
jmp 0x59d5fb
mov rax, qword [rbp + 0x10]
cmp qword [rax + 0x18], 0
je 0x59d5b8
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x18]
mov rbx, qword [rbp + 0x10]
mov ebx, dword [rbx + 0xa0]
mov dword [rax + 8], ebx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x18]
mov rbx, qword [rbp + 0x10]
mov ebx, dword [rbx + 0x80]
mov dword [rax + 0xc], ebx
mov rax, qword [rbp + 0x10]
push rax
push qword [rbp + 0x10]
mov rax, qword [rax + 0x18]
call qword [rax]
pop rcx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0xa0]
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
push qword [rbp + 0x10]
push 0
mov rbx, qword [rbp + 0x10]
lea rbx, [rbx + 0xa0]
push rbx
push 0
mov rax, qword [rax + 0x210]
call qword [rax + 8]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0xa0]
cmp eax, dword [rbp - 8]
jne 0x59d5fb
xor al, al
leave
ret 8
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x10]
mov eax, dword [rax + 0xa0]
cmp eax, dword [rbx + 0x80]
jb 0x59d574
mov rax, qword [rbp + 0x10]
push rax
push qword [rbp + 0x10]
mov rax, qword [rax + 0x208]
call qword [rax + 8]
pop rcx
mov rax, qword [rbp + 0x10]
push rax
push qword [rbp + 0x10]
mov rax, qword [rax + 0x208]
call qword [rax]
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x59d649
xor al, al
leave
ret 8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xa0], 0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x208]
test byte [rax + 0x10], 0xff
jne 0x59d56f
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x10]
lea rax, [rax + 0x2c]
mov qword [rsp], rax
test byte [rbx + 0x61], 0xff
je 0x59d689
mov eax, 0xce
jmp 0x59d68e
mov eax, 0xcd
mov rbx, qword [rsp]
mov dword [rbx], eax
mov al, 1
leave
ret 8