joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c404
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400562c0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14003c45b
cmp word [rdx], r13w
jne 0x14003c45b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14003c460
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14003c585
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14003c5a6
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14003c499
mov rdx, r9
mov word [rbx], cx
jmp 0x14003c4c0
cmp r9, r8
jae 0x14003c4d0
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14003c47a
jmp 0x14003c585
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003c57a
cmp dword [rsp + 0x80], esi
je 0x14003c57a
lea r8, [0x1400562c0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14003c552
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14003c522
mov word [rbx], r13w
jmp 0x14003c582
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14003c52f
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14003c582
cmp word [rsp + 0x70], r13w
jne 0x14003c55f
cmp rbx, r14
je 0x14003c51c
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14003c2f4
cmp word [rsp + 0x70], r13w
je 0x14003c585
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400562c0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14003c57f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14003c585
Function at 0x180003af0
Capabilities:
Access peb ldr_data
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov ebx, edx
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x60]
mov r10d, 0xeee41d7a
movzx r9d, word [rax + 0x58]
shr r9, 1
lea r11, [r8 + r9*2]
cmp r8, r11
je 0x180003b73
nop dword [rax + rax]
movsx ecx, byte [r8]
mov edx, ecx
sub cl, 0x41
mov r9d, edx
or r9d, 0x20
cmp cl, 0x19
cmova r9d, edx
add r8, 2
xor r9d, r10d
imul r10d, r9d, 0x1000193
cmp r8, r11
jne 0x180003b40
cmp r10d, 0xaeb38da6
je 0x180003b78
mov rax, qword [rax]
jmp 0x180003b20
mov rdi, qword [rax + 0x30]
lea rcx, [rsp + 0x58]
mov edx, dword [r14 + 0x18]
mov eax, ebx
mov esi, ebx
add rdx, 0x10
and eax, 7
sar esi, 3
dec rax
movsxd rbp, esi
xor r15d, r15d
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rbx, [rax + rax*4]
shl rbx, 3
add rdx, rbx
add rdx, rdi
call fcn.1800b3890
mov eax, dword [rsp + 0x58]
cmp rbp, rax
jae 0x180003ca4
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, rbx
mov qword [rsp + 0x50], r15
add rdx, rdi
mov r8d, 8
call fcn.1800b3890
movabs rax, 0x1ffffffffffffffc
mov dword [rsp + 0x58], r15d
mov rdx, rbp
lea rcx, [rsp + 0x58]
shr rdx, 3
mov r8d, 4
and rdx, rax
add rdx, qword [rsp + 0x50]
call fcn.1800b3890
mov eax, dword [rsp + 0x58]
and esi, 0x1f
bt eax, esi
jae 0x180003ca4
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, 8
mov qword [rsp + 0x50], r15
add rdx, rbx
mov r8d, 8
add rdx, rdi
call fcn.1800b3890
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rbp*8]
mov eax, dword [r14 + 0x18]
add rax, rbx
cmp byte [rax + rdi + 0x14], 1
jbe 0x180003c89
mov r8d, 8
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x60]
call fcn.1800b3890
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rcx, [rsp + 0x58]
call fcn.1800b3890
mov eax, dword [rsp + 0x58]
not eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
add rdx, 0x18
mov r8d, 0x10
movups xmmword [rsp + 0x20], xmm0
call fcn.1800b3890
mov eax, dword [rsp + 0x20]
mov rcx, rbx
mov r8d, eax
shl eax, 0x10
shr r8d, 0x10
or r8d, eax
mov edx, r8d
xor r8d, 0xefbd7154
not edx
shl r8d, 2
shr edx, 0x1e
or edx, r8d
add edx, 0x4878359f
add rsp, 0x30
pop rbx
jmp 0x180003af0
Function at 0x180003cc0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov ebx, edx
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x60]
mov r10d, 0xeee41d7a
movzx r9d, word [rax + 0x58]
shr r9, 1
lea r11, [r8 + r9*2]
cmp r8, r11
je 0x180003b73
nop dword [rax + rax]
movsx ecx, byte [r8]
mov edx, ecx
sub cl, 0x41
mov r9d, edx
or r9d, 0x20
cmp cl, 0x19
cmova r9d, edx
add r8, 2
xor r9d, r10d
imul r10d, r9d, 0x1000193
cmp r8, r11
jne 0x180003b40
cmp r10d, 0xaeb38da6
je 0x180003b78
mov rax, qword [rax]
jmp 0x180003b20
mov rdi, qword [rax + 0x30]
lea rcx, [rsp + 0x58]
mov edx, dword [r14 + 0x18]
mov eax, ebx
mov esi, ebx
add rdx, 0x10
and eax, 7
sar esi, 3
dec rax
movsxd rbp, esi
xor r15d, r15d
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rbx, [rax + rax*4]
shl rbx, 3
add rdx, rbx
add rdx, rdi
call fcn.1800b3890
mov eax, dword [rsp + 0x58]
cmp rbp, rax
jae 0x180003ca4
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, rbx
mov qword [rsp + 0x50], r15
add rdx, rdi
mov r8d, 8
call fcn.1800b3890
movabs rax, 0x1ffffffffffffffc
mov dword [rsp + 0x58], r15d
mov rdx, rbp
lea rcx, [rsp + 0x58]
shr rdx, 3
mov r8d, 4
and rdx, rax
add rdx, qword [rsp + 0x50]
call fcn.1800b3890
mov eax, dword [rsp + 0x58]
and esi, 0x1f
bt eax, esi
jae 0x180003ca4
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, 8
mov qword [rsp + 0x50], r15
add rdx, rbx
mov r8d, 8
add rdx, rdi
call fcn.1800b3890
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rbp*8]
mov eax, dword [r14 + 0x18]
add rax, rbx
cmp byte [rax + rdi + 0x14], 1
jbe 0x180003c89
mov r8d, 8
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x60]
call fcn.1800b3890
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rcx, [rsp + 0x58]
call fcn.1800b3890
mov eax, dword [rsp + 0x58]
not eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
add rdx, 0x18
mov r8d, 0x10
movups xmmword [rsp + 0x20], xmm0
call fcn.1800b3890
mov eax, dword [rsp + 0x20]
mov rcx, rbx
mov r8d, eax
shl eax, 0x10
shr r8d, 0x10
or r8d, eax
mov edx, r8d
xor r8d, 0xefbd7154
not edx
shl r8d, 2
shr edx, 0x1e
or edx, r8d
add edx, 0x4878359f
add rsp, 0x30
pop rbx
jmp 0x180003af0
Function at 0x180004d60
Capabilities:
Encode data using xor

Disassembly:
push r14
sub rsp, 0x40
sub rdx, rcx
movabs rax, 0x6666666666666667
imul rdx
mov r10, rcx
mov r14, rdx
sar r14, 4
mov rax, r14
shr rax, 0x3f
add r14, rax
mov r11, r14
sar r11, 1
test r11, r11
jle 0x180004f33
mov qword [rsp + 0x50], rbx
lea rax, [r11 + r11*4]
mov qword [rsp + 0x58], rbp
lea rbp, [r14 - 1]
mov qword [rsp + 0x60], rsi
lea rsi, [rcx + rax*8]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x38], r12
mov r12d, 0x50
mov qword [rsp + 0x30], r15
movsxd rbx, r9d
sar rbp, 1
nop
movups xmm3, xmmword [rsi - 0x28]
lea rsi, [rsi - 0x28]
dec r11
movsd xmm5, qword [rsi + 0x20]
mov r9, r11
movsd qword [rsp + 0x20], xmm5
mov rdi, r11
movups xmm4, xmmword [rsi + 0x10]
movups xmmword [rsp], xmm3
movups xmmword [rsp + 0x10], xmm4
cmp r11, rbp
jge 0x180004e64
nop
lea rdx, [rdi + rdi]
lea rax, [rdx + rdx*4]
lea r8, [r10 + rax*8]
movss xmm0, dword [r8 + rbx + 0x28]
lea rax, [r9 + r9*4]
comiss xmm0, dword [r8 + rbx + 0x50]
seta cl
movzx edi, cl
xor rdi, 1
inc rdi
add rdi, rdx
mov edx, 0x28
test cl, cl
mov r9, rdi
cmove rdx, r12
movups xmm0, xmmword [rdx + r8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [rdx + r8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [rdx + r8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp rdi, rbp
jl 0x180004e00
cmp r9, rbp
jne 0x180004ea0
test r14b, 1
jne 0x180004ea0
lea rax, [r9 + r9*4]
lea rcx, [r14 + r14*4]
movups xmm0, xmmword [r10 + rcx*8 - 0x28]
lea r9, [r14 - 1]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rcx*8 - 0x18]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rcx*8 - 8]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp r11, r9
jge 0x180004ef6
movss xmm2, dword [rsp + rbx]
nop word [rax + rax]
lea rcx, [r9 - 1]
sar rcx, 1
lea rdx, [rcx + rcx*4]
lea rax, [rbx + rdx*8]
comiss xmm2, dword [rax + r10]
jbe 0x180004ef6
lea rax, [r9 + r9*4]
mov r9, rcx
movups xmm0, xmmword [r10 + rdx*8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rdx*8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rdx*8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp r11, rcx
jl 0x180004eb0
lea rax, [r9 + r9*4]
movups xmmword [r10 + rax*8], xmm3
movups xmmword [r10 + rax*8 + 0x10], xmm4
movsd qword [r10 + rax*8 + 0x20], xmm5
test r11, r11
jg 0x180004dd0
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r14
ret
Function at 0x180005ad0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
movsxd rsi, dword [rsp + 0x40]
mov r10, rdx
mov qword [rsp + 0x18], rbx
mov r11, rcx
mov qword [rsp + 0x20], rdi
mov rbx, r8
mov qword [rsp + 0x30], r15
mov rbp, rdx
lea r15, [r8 - 1]
mov rdi, r15
sar rdi, 1
cmp rdx, rdi
jge 0x180005b6f
mov qword [rsp + 0x28], r14
nop word [rax + rax]
add rdx, rdx
mov r8, rdx
shl r8, 5
add r8, r11
movss xmm0, dword [rsi + r8 + 0x20]
comiss xmm0, dword [rsi + r8 + 0x40]
seta cl
shl r10, 5
movzx eax, cl
xor rax, 1
inc rax
add rdx, rax
movzx eax, cl
xor rax, 1
inc rax
shl rax, 5
movups xmm0, xmmword [rax + r8]
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rax + r8 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, rdx
cmp rdx, rdi
jl 0x180005b10
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jne 0x180005b9d
test bl, 1
jne 0x180005b9d
shl rbx, 5
shl r10, 5
movups xmm0, xmmword [rbx + r11 - 0x20]
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rbx + r11 - 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, r15
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x18]
cmp rbp, r10
jge 0x180005c01
movsxd r8, dword [rsp + 0x48]
nop dword [rax]
nop word [rax + rax]
movss xmm0, dword [r8 + r9]
lea rcx, [r10 - 1]
sar rcx, 1
mov rdx, rcx
shl rdx, 5
lea rax, [rdx + rsi]
comiss xmm0, dword [rax + r11]
jbe 0x180005c01
movups xmm0, xmmword [rdx + r11]
shl r10, 5
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rdx + r11 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, rcx
cmp rbp, rcx
jl 0x180005bc0
movups xmm0, xmmword [r9]
shl r10, 5
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
pop rsi
pop rbp
ret
Function at 0x180005c20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x18
movsxd rsi, dword [rsp + 0x58]
mov r11, rdx
mov qword [rsp + 0x30], rbx
mov r10, rcx
mov qword [rsp + 0x38], rdi
mov rbp, rdx
lea rdi, [r8 - 1]
mov qword [rsp + 0x40], r12
sar rdi, 1
mov rbx, rdx
mov qword [rsp + 8], r14
mov r14, r8
cmp rdx, rdi
jge 0x180005cdd
mov qword [rsp + 0x10], r13
mov r13d, 0x50
mov qword [rsp], r15
nop
lea rdx, [rbx + rbx]
lea rax, [rdx + rdx*4]
lea r8, [r10 + rax*8]
movss xmm0, dword [rsi + r8 + 0x28]
lea rax, [r11 + r11*4]
comiss xmm0, dword [rsi + r8 + 0x50]
seta cl
movzx ebx, cl
xor rbx, 1
inc rbx
add rbx, rdx
mov edx, 0x28
test cl, cl
mov r11, rbx
cmove rdx, r13
movups xmm0, xmmword [rdx + r8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [rdx + r8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [rdx + r8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp rbx, rdi
jl 0x180005c70
mov r15, qword [rsp]
mov r13, qword [rsp + 0x10]
cmp rbx, rdi
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jne 0x180005d23
test r14b, 1
jne 0x180005d23
lea rax, [r11 + r11*4]
lea rcx, [r14 + r14*4]
movups xmm0, xmmword [r10 + rcx*8 - 0x28]
lea r11, [r14 - 1]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rcx*8 - 0x18]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rcx*8 - 8]
movsd qword [r10 + rax*8 + 0x20], xmm0
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x40]
cmp rbp, r11
jge 0x180005d8c
movsxd r8, dword [rsp + 0x60]
nop word [rax + rax]
movss xmm0, dword [r8 + r9]
lea rcx, [r11 - 1]
sar rcx, 1
lea rdx, [rcx + rcx*4]
lea rax, [rsi + rdx*8]
comiss xmm0, dword [rax + r10]
jbe 0x180005d8c
lea rax, [r11 + r11*4]
mov r11, rcx
movups xmm0, xmmword [r10 + rdx*8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rdx*8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rdx*8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp rbp, rcx
jl 0x180005d40
movups xmm0, xmmword [r9]
lea rax, [r11 + r11*4]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r9 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
add rsp, 0x18
pop rsi
pop rbp
ret
Function at 0x180007a60
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rdx
movsx rdx, byte [rcx]
test dl, dl
je 0x180007a84
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
inc rcx
jmp fcn.180007a60
ret
Function at 0x18000a8d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r12
push r15
sub rsp, 0x28
mov rax, qword [0x1800d8340]
mov r15, rdx
mov r12, rcx
test rax, rax
jne 0x18000a9e2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov r8, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [r8 + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18000a9aa
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18000a9aa
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x5a19c02c
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x18000a9a5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x18000a970
cmp r9d, 0xd854e290
je 0x18000a9f3
test r10d, r10d
jne 0x18000a950
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x18000a9c0
cmp qword [rax + 0x30], 0
jne 0x18000a920
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x1800d8340], rax
mov rdx, r15
mov rcx, r12
add rsp, 0x28
pop r15
pop r12
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x18000a9c2
Function at 0x18000b500
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x1800d8328]
mov r15, rcx
test rax, rax
jne 0x18000b612
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rdx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x18000b5da
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x18000b5da
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x5fa48543
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x18000b5d5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x18000b5a0
cmp r9d, 0xb9b2262
je 0x18000b61e
test r10d, r10d
jne 0x18000b580
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x18000b5f0
cmp qword [rax + 0x30], 0
jne 0x18000b550
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x1800d8328], rax
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x18000b5f2
Function at 0x18000deb0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
mov rax, qword gs:[0x60]
mov rbx, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rdx, qword [rax + 0x60]
mov r10d, 0x117ece6b
movzx r8d, word [rax + 0x58]
shr r8, 1
lea r11, [rdx + r8*2]
cmp rdx, r11
je 0x18000df23
nop dword [rax + rax]
movsx ecx, byte [rdx]
mov r8d, ecx
sub cl, 0x41
mov r9d, r8d
or r9d, 0x20
cmp cl, 0x19
cmova r9d, r8d
add rdx, 2
xor r9d, r10d
imul r10d, r9d, 0x1000193
cmp rdx, r11
jne 0x18000def0
cmp r10d, 0xeff7b0bb
je 0x18000df28
mov rax, qword [rax]
jmp 0x18000ded0
mov rdx, qword [rax + 0x30]
mov rcx, qword [0x1800d82a8]
add rdx, 0x3343340
cmp rdx, rcx
jbe 0x18000df4b
add rcx, qword [0x1800d82b0]
cmp rdx, rcx
jb 0x18000df61
lea rax, [rdx - 0x10000]
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
ja 0x18000df68
mov rcx, rbx
pop rbx
jmp rdx
xor eax, eax
pop rbx
ret
Function at 0x180014680
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
call fcn.18000b080
mov rdx, qword [0x1800da3a8]
mov r15, rax
test rdx, rdx
jne 0x18001477d
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rcx]
mov rdi, rbp
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x18001475e
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x18001475e
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xa65166c
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180014759
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180014720
cmp r9d, 0xf413081f
je 0x180014877
test r10d, r10d
jne 0x180014700
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x180014774
cmp qword [rax + 0x30], 0
jne 0x1800146d0
xor edx, edx
mov qword [0x1800da3a8], rdx
mov rcx, r15
call rdx
mov rdx, qword [0x1800da3b0]
mov r15, rax
test rdx, rdx
jne 0x180014859
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rcx]
mov rsi, rbp
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18001483a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18001483a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xea19c0e1
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180014835
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180014800
cmp r9d, 0x4f3cddbb
je 0x180014893
test r10d, r10d
jne 0x1800147e0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180014850
cmp qword [rax + 0x30], 0
jne 0x1800147b0
xor edx, edx
mov qword [0x1800da3b0], rdx
mov rcx, r15
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp rdx
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov edx, dword [rcx + rdx*4]
add rdx, r11
jmp 0x180014776
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov edx, dword [rcx + rdx*4]
add rdx, r11
jmp 0x180014852
Function at 0x18001a730
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x1800da3a8]
mov r15, rcx
test rax, rax
jne 0x18001a842
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rdx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x18001a80a
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x18001a80a
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xa65166c
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x18001a805
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x18001a7d0
cmp r9d, 0xf413081f
je 0x18001a84e
test r10d, r10d
jne 0x18001a7b0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x18001a820
cmp qword [rax + 0x30], 0
jne 0x18001a780
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x1800da3a8], rax
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x18001a822