joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001a9c0
Capabilities:
Access peb ldr_data
Encode data using xor
Get number of processors
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbx, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rax + 0x60]
mov r10d, 0xd1d4f8ce
movzx r8d, word [rax + 0x58]
shr r8, 1
lea r11, [rdx + r8*2]
cmp rdx, r11
je 0x18001aa43
nop dword [rax + rax]
movsx ecx, byte [rdx]
mov r8d, ecx
sub cl, 0x41
mov r9d, r8d
or r9d, 0x20
cmp cl, 0x19
cmova r9d, r8d
add rdx, 2
xor r9d, r10d
imul r10d, r9d, 0x1000193
cmp rdx, r11
jne 0x18001aa10
cmp r10d, 0xf562912a
je 0x18001aa48
mov rax, qword [rax]
jmp 0x18001a9f0
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
add rdx, qword [rbx]
xor esi, esi
mov r8d, 8
mov qword [rsp + 0x30], rsi
call fcn.180091750
mov rdx, qword [rsp + 0x30]
movabs rdi, 0x7ffffffdfffe
mov rcx, qword [0x18009b3e0]
cmp rdx, rcx
jbe 0x18001aa8d
add rcx, qword [0x18009b3e8]
cmp rdx, rcx
jb 0x18001aa9d
lea rax, [rdx - 0x10000]
cmp rax, rdi
ja 0x18001abbb
add rdx, 0xb8
mov qword [rsp + 0x38], rsi
mov r8d, 8
lea rcx, [rsp + 0x38]
call fcn.180091750
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
add rdx, qword [rbx + 8]
mov r8d, 8
mov qword [rsp + 0x30], rsi
call fcn.180091750
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x18009b3e0]
cmp rdx, rcx
jbe 0x18001aaf4
add rcx, qword [0x18009b3e8]
cmp rdx, rcx
jb 0x18001ab04
lea rax, [rdx - 0x10000]
cmp rax, rdi
ja 0x18001abbb
mov rcx, rbx
call fcn.18001ada0
mov edx, eax
mov rcx, rbx
call fcn.18001abd0
mov r9, rax
mov rax, qword [0x18009b3e0]
cmp r9, rax
jbe 0x18001ab34
mov rdx, qword [0x18009b3e8]
add rdx, rax
cmp r9, rdx
jb 0x18001ab40
lea rcx, [r9 - 0x10000]
cmp rcx, rdi
ja 0x18001abbb
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x30]
add rdx, r9
mov qword [rsp + 0x30], rsi
mov r8d, 8
call fcn.180091750
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x18009b3e0]
cmp rdx, rcx
jbe 0x18001ab79
add rcx, qword [0x18009b3e8]
cmp rdx, rcx
jb 0x18001ab85
lea rax, [rdx - 0x10000]
cmp rax, rdi
ja 0x18001abbb
mov rcx, rbx
call fcn.18001ada0
mov edx, eax
mov rcx, rbx
call fcn.18001abd0
mov rdx, qword [0x18009b3e0]
cmp rax, rdx
jbe 0x18001abaf
add rdx, qword [0x18009b3e8]
cmp rax, rdx
jb 0x18001abbd
lea rcx, [rax - 0x10000]
cmp rcx, rdi
jbe 0x18001abbd
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18001abd0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov ebx, edx
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x60]
mov r10d, 0xc62ee939
movzx r9d, word [rax + 0x58]
shr r9, 1
lea r11, [r8 + r9*2]
cmp r8, r11
je 0x18001ac53
nop dword [rax + rax]
movsx ecx, byte [r8]
mov edx, ecx
sub cl, 0x41
mov r9d, edx
or r9d, 0x20
cmp cl, 0x19
cmova r9d, edx
add r8, 2
xor r9d, r10d
imul r10d, r9d, 0x1000193
cmp r8, r11
jne 0x18001ac20
cmp r10d, 0xf7ff6ef5
je 0x18001ac58
mov rax, qword [rax]
jmp 0x18001ac00
mov rdi, qword [rax + 0x30]
lea rcx, [rsp + 0x58]
mov edx, dword [r14 + 0x18]
mov eax, ebx
mov esi, ebx
add rdx, 0x10
and eax, 7
sar esi, 3
dec rax
movsxd rbp, esi
xor r15d, r15d
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rbx, [rax + rax*4]
shl rbx, 3
add rdx, rbx
add rdx, rdi
call fcn.180091750
mov eax, dword [rsp + 0x58]
cmp rbp, rax
jae 0x18001ad84
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, rbx
mov qword [rsp + 0x50], r15
add rdx, rdi
mov r8d, 8
call fcn.180091750
movabs rax, 0x1ffffffffffffffc
mov dword [rsp + 0x58], r15d
mov rdx, rbp
lea rcx, [rsp + 0x58]
shr rdx, 3
mov r8d, 4
and rdx, rax
add rdx, qword [rsp + 0x50]
call fcn.180091750
mov eax, dword [rsp + 0x58]
and esi, 0x1f
bt eax, esi
jae 0x18001ad84
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, 8
mov qword [rsp + 0x50], r15
add rdx, rbx
mov r8d, 8
add rdx, rdi
call fcn.180091750
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rbp*8]
mov eax, dword [r14 + 0x18]
add rax, rbx
cmp byte [rax + rdi + 0x14], 1
jbe 0x18001ad69
mov r8d, 8
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x60]
call fcn.180091750
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rcx, [rsp + 0x58]
call fcn.180091750
mov eax, dword [rsp + 0x58]
not eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001bca0
Capabilities:
Encode data using xor

Disassembly:
push r14
sub rsp, 0x40
sub rdx, rcx
movabs rax, 0x6666666666666667
imul rdx
mov r10, rcx
mov r14, rdx
sar r14, 4
mov rax, r14
shr rax, 0x3f
add r14, rax
mov r11, r14
sar r11, 1
test r11, r11
jle 0x18001be73
mov qword [rsp + 0x50], rbx
lea rax, [r11 + r11*4]
mov qword [rsp + 0x58], rbp
lea rbp, [r14 - 1]
mov qword [rsp + 0x60], rsi
lea rsi, [rcx + rax*8]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x38], r12
mov r12d, 0x50
mov qword [rsp + 0x30], r15
movsxd rbx, r9d
sar rbp, 1
nop
movups xmm3, xmmword [rsi - 0x28]
lea rsi, [rsi - 0x28]
dec r11
movsd xmm5, qword [rsi + 0x20]
mov r9, r11
movsd qword [rsp + 0x20], xmm5
mov rdi, r11
movups xmm4, xmmword [rsi + 0x10]
movups xmmword [rsp], xmm3
movups xmmword [rsp + 0x10], xmm4
cmp r11, rbp
jge 0x18001bda4
nop
lea rdx, [rdi + rdi]
lea rax, [rdx + rdx*4]
lea r8, [r10 + rax*8]
movss xmm0, dword [r8 + rbx + 0x28]
lea rax, [r9 + r9*4]
comiss xmm0, dword [r8 + rbx + 0x50]
seta cl
movzx edi, cl
xor rdi, 1
inc rdi
add rdi, rdx
mov edx, 0x28
test cl, cl
mov r9, rdi
cmove rdx, r12
movups xmm0, xmmword [rdx + r8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [rdx + r8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [rdx + r8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp rdi, rbp
jl 0x18001bd40
cmp r9, rbp
jne 0x18001bde0
test r14b, 1
jne 0x18001bde0
lea rax, [r9 + r9*4]
lea rcx, [r14 + r14*4]
movups xmm0, xmmword [r10 + rcx*8 - 0x28]
lea r9, [r14 - 1]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rcx*8 - 0x18]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rcx*8 - 8]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp r11, r9
jge 0x18001be36
movss xmm2, dword [rsp + rbx]
nop word [rax + rax]
lea rcx, [r9 - 1]
sar rcx, 1
lea rdx, [rcx + rcx*4]
lea rax, [rbx + rdx*8]
comiss xmm2, dword [rax + r10]
jbe 0x18001be36
lea rax, [r9 + r9*4]
mov r9, rcx
movups xmm0, xmmword [r10 + rdx*8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rdx*8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rdx*8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp r11, rcx
jl 0x18001bdf0
lea rax, [r9 + r9*4]
movups xmmword [r10 + rax*8], xmm3
movups xmmword [r10 + rax*8 + 0x10], xmm4
movsd qword [r10 + rax*8 + 0x20], xmm5
test r11, r11
jg 0x18001bd10
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r14
ret
Function at 0x18001ca10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
movsxd rsi, dword [rsp + 0x40]
mov r10, rdx
mov qword [rsp + 0x18], rbx
mov r11, rcx
mov qword [rsp + 0x20], rdi
mov rbx, r8
mov qword [rsp + 0x30], r15
mov rbp, rdx
lea r15, [r8 - 1]
mov rdi, r15
sar rdi, 1
cmp rdx, rdi
jge 0x18001caaf
mov qword [rsp + 0x28], r14
nop word [rax + rax]
add rdx, rdx
mov r8, rdx
shl r8, 5
add r8, r11
movss xmm0, dword [rsi + r8 + 0x20]
comiss xmm0, dword [rsi + r8 + 0x40]
seta cl
shl r10, 5
movzx eax, cl
xor rax, 1
inc rax
add rdx, rax
movzx eax, cl
xor rax, 1
inc rax
shl rax, 5
movups xmm0, xmmword [rax + r8]
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rax + r8 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, rdx
cmp rdx, rdi
jl 0x18001ca50
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jne 0x18001cadd
test bl, 1
jne 0x18001cadd
shl rbx, 5
shl r10, 5
movups xmm0, xmmword [rbx + r11 - 0x20]
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rbx + r11 - 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, r15
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x18]
cmp rbp, r10
jge 0x18001cb41
movsxd r8, dword [rsp + 0x48]
nop dword [rax]
nop word [rax + rax]
movss xmm0, dword [r8 + r9]
lea rcx, [r10 - 1]
sar rcx, 1
mov rdx, rcx
shl rdx, 5
lea rax, [rdx + rsi]
comiss xmm0, dword [rax + r11]
jbe 0x18001cb41
movups xmm0, xmmword [rdx + r11]
shl r10, 5
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rdx + r11 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, rcx
cmp rbp, rcx
jl 0x18001cb00
movups xmm0, xmmword [r9]
shl r10, 5
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
pop rsi
pop rbp
ret
Function at 0x18001cb60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x18
movsxd rsi, dword [rsp + 0x58]
mov r11, rdx
mov qword [rsp + 0x30], rbx
mov r10, rcx
mov qword [rsp + 0x38], rdi
mov rbp, rdx
lea rdi, [r8 - 1]
mov qword [rsp + 0x40], r12
sar rdi, 1
mov rbx, rdx
mov qword [rsp + 8], r14
mov r14, r8
cmp rdx, rdi
jge 0x18001cc1d
mov qword [rsp + 0x10], r13
mov r13d, 0x50
mov qword [rsp], r15
nop
lea rdx, [rbx + rbx]
lea rax, [rdx + rdx*4]
lea r8, [r10 + rax*8]
movss xmm0, dword [rsi + r8 + 0x28]
lea rax, [r11 + r11*4]
comiss xmm0, dword [rsi + r8 + 0x50]
seta cl
movzx ebx, cl
xor rbx, 1
inc rbx
add rbx, rdx
mov edx, 0x28
test cl, cl
mov r11, rbx
cmove rdx, r13
movups xmm0, xmmword [rdx + r8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [rdx + r8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [rdx + r8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp rbx, rdi
jl 0x18001cbb0
mov r15, qword [rsp]
mov r13, qword [rsp + 0x10]
cmp rbx, rdi
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jne 0x18001cc63
test r14b, 1
jne 0x18001cc63
lea rax, [r11 + r11*4]
lea rcx, [r14 + r14*4]
movups xmm0, xmmword [r10 + rcx*8 - 0x28]
lea r11, [r14 - 1]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rcx*8 - 0x18]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rcx*8 - 8]
movsd qword [r10 + rax*8 + 0x20], xmm0
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x40]
cmp rbp, r11
jge 0x18001cccc
movsxd r8, dword [rsp + 0x60]
nop word [rax + rax]
movss xmm0, dword [r8 + r9]
lea rcx, [r11 - 1]
sar rcx, 1
lea rdx, [rcx + rcx*4]
lea rax, [rsi + rdx*8]
comiss xmm0, dword [rax + r10]
jbe 0x18001cccc
lea rax, [r11 + r11*4]
mov r11, rcx
movups xmm0, xmmword [r10 + rdx*8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rdx*8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rdx*8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp rbp, rcx
jl 0x18001cc80
movups xmm0, xmmword [r9]
lea rax, [r11 + r11*4]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r9 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
add rsp, 0x18
pop rsi
pop rbp
ret
Function at 0x18001e970
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rdx
movsx rdx, byte [rcx]
test dl, dl
je 0x18001e994
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
inc rcx
jmp fcn.18001e970
ret
Function at 0x1800204f0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r12
push r15
sub rsp, 0x28
mov rax, qword [0x18009b428]
mov r15, rdx
mov r12, rcx
test rax, rax
jne 0x180020602
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov r8, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [r8 + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800205ca
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x1800205ca
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xf2bf816c
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1800205c5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180020590
cmp r9d, 0xf43ccd50
je 0x180020613
test r10d, r10d
jne 0x180020570
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x1800205e0
cmp qword [rax + 0x30], 0
jne 0x180020540
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b428], rax
mov rdx, r15
mov rcx, r12
add rsp, 0x28
pop r15
pop r12
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800205e2
Function at 0x180021120
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x18009b410]
mov r15, rcx
test rax, rax
jne 0x180021232
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rdx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1800211fa
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1800211fa
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x700a4e6b
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1800211f5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x1800211c0
cmp r9d, 0x89473e9a
je 0x18002123e
test r10d, r10d
jne 0x1800211a0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x180021210
cmp qword [rax + 0x30], 0
jne 0x180021170
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b410], rax
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180021212
Function at 0x180022080
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r12
push r15
sub rsp, 0x38
mov r15, rdx
mov r12, rcx
call fcn.180027290
subss xmm0, dword [0x18009b468]
movss xmm1, dword [0x180009ff4]
comiss xmm1, xmm0
jbe 0x1800220b8
mov eax, dword [0x18009b46c]
inc eax
mov dword [0x18009b46c], eax
jmp 0x1800220d5
mov dword [0x18009b46c], 1
call fcn.180027290
mov eax, dword [0x18009b46c]
movss dword [0x18009b468], xmm0
cmp eax, 0x14
jge 0x180022238
mov rax, qword [0x180001b00]
cmp rax, 0x402402
jne 0x180022230
lea rdx, [0x180009f52]
mov qword [rsp + 0x28], r13
lea rcx, [0x180009f80]
call fcn.180020ca0
mov r13, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180022212
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800221da
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x1800221da
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x1800221d5
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x1800221a0
cmp r9d, 0xf3f452e3
je 0x180022241
test r10d, r10d
jne 0x180022180
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x1800221f0
cmp qword [rax + 0x30], 0
jne 0x180022150
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x18009b450], rax
mov r8d, 1
lea rdx, [0x180009f70]
mov rcx, r13
call rax
mov r13, qword [rsp + 0x28]
mov qword [0x180001b00], rax
mov rdx, r15
mov rcx, r12
call qword [rax]
add rsp, 0x38
pop r15
pop r12
ret
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800221f2
Function at 0x180023cc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180001b40]
cmp rax, 0x402402
jne 0x180023e20
lea rdx, [0x18000adf8]
mov qword [rsp + 0x20], r15
lea rcx, [0x18000ae14]
call fcn.180020ca0
mov r15, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180023e02
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180023dca
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180023dca
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180023dc5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180023d90
cmp r9d, 0xf3f452e3
je 0x180023e27
test r10d, r10d
jne 0x180023d70
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x180023de0
cmp qword [rax + 0x30], 0
jne 0x180023d40
xor eax, eax
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000ae08]
mov rcx, r15
call rax
mov r15, qword [rsp + 0x20]
mov qword [0x180001b40], rax
add rsp, 0x38
jmp qword [rax]
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180023de2
Function at 0x180023e40
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r12
push r15
sub rsp, 0x38
mov rax, qword [0x180001b48]
mov r15, rdx
mov r12, rcx
cmp rax, 0x402402
jne 0x180023fa0
lea rdx, [0x18000ae20]
mov qword [rsp + 0x28], r13
lea rcx, [0x18000ae40]
call fcn.180020ca0
mov r13, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180023f82
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180023f4a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180023f4a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180023f45
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180023f10
cmp r9d, 0xf3f452e3
je 0x180023fb4
test r10d, r10d
jne 0x180023ef0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180023f60
cmp qword [rax + 0x30], 0
jne 0x180023ec0
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000ae30]
mov rcx, r13
call rax
mov r13, qword [rsp + 0x28]
mov qword [0x180001b48], rax
mov rdx, r12
mov rcx, r15
call qword [rax]
mov rax, r15
add rsp, 0x38
pop r15
pop r12
ret
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180023f62
Function at 0x180023fd0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push r12
push r15
sub rsp, 0x40
mov rax, qword [0x180001b50]
mov r15, r8
mov r12, rdx
mov rbx, rcx
cmp rax, 0x402402
jne 0x180024134
lea rdx, [0x18000ae48]
mov qword [rsp + 0x38], r13
lea rcx, [0x18000ae6c]
call fcn.180020ca0
mov r13, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180024116
mov rax, qword gs:[0x60]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800240de
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x1800240de
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1800240d9
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x1800240a0
cmp r9d, 0xf3f452e3
je 0x180024161
test r10d, r10d
jne 0x180024080
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x1800240f4
cmp qword [rax + 0x30], 0
jne 0x180024050
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov qword [0x18009b450], rax
mov r8d, 1
lea rdx, [0x18000ae58]
mov rcx, r13
call rax
mov r13, qword [rsp + 0x38]
mov qword [0x180001b50], rax
mov ecx, dword [r15 + 8]
lea r8, [rsp + 0x20]
movsd xmm0, qword [r15]
mov rdx, rbx
mov dword [rsp + 0x28], ecx
mov rcx, r12
movsd qword [rsp + 0x20], xmm0
call qword [rax]
mov rax, r12
add rsp, 0x40
pop r15
pop r12
pop rbx
ret
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800240f6