joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180026020
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r12
push r13
push r15
sub rsp, 0x30
mov rax, qword [0x180001bb8]
movzx r15d, r8b
mov r12d, edx
mov r13, rcx
cmp rax, 0x402402
jne 0x18002617d
lea rdx, [0x18000b80a]
lea rcx, [0x18000b830]
call fcn.180020ca0
mov qword [rsp + 0x68], rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180026162
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18002612a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18002612a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180026125
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x1800260f0
cmp r9d, 0xf3f452e3
je 0x180026194
test r10d, r10d
jne 0x1800260d0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180026140
cmp qword [rax + 0x30], 0
jne 0x1800260a0
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x18009b450], rax
mov rcx, qword [rsp + 0x68]
lea rdx, [0x18000b828]
mov r8d, 0xffffffff
call rax
mov qword [0x180001bb8], rax
movzx r8d, r15b
mov edx, r12d
mov rcx, r13
add rsp, 0x30
pop r15
pop r13
pop r12
jmp qword [rax]
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180026142
Function at 0x180026880
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rdx, qword [0x18009b3e0]
mov r15, rcx
cmp rcx, rdx
jbe 0x1800268a1
add rdx, qword [0x18009b3e8]
cmp rcx, rdx
jb 0x1800268bb
lea rax, [rcx - 0x10000]
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
ja 0x180026a38
mov rax, qword [0x180001bc8]
cmp rax, 0x402402
jne 0x180026a10
lea rdx, [0x18000b8d0]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000b8f4]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x1800269f2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800269ba
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x1800269ba
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1800269b5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180026980
cmp r9d, 0xf3f452e3
je 0x180026a1f
test r10d, r10d
jne 0x180026960
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x1800269d0
cmp qword [rax + 0x30], 0
jne 0x180026930
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b8e0]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001bc8], rax
mov rax, qword [rax]
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800269d2
xor al, al
add rsp, 0x30
pop r15
ret
Function at 0x180026a50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180001bd0]
cmp rax, 0x402402
jne 0x180026bb0
lea rdx, [0x18000bd60]
mov qword [rsp + 0x20], r15
lea rcx, [0x18000bd7c]
call fcn.180020ca0
mov r15, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180026b92
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180026b5a
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180026b5a
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180026b55
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180026b20
cmp r9d, 0xf3f452e3
je 0x180026bb7
test r10d, r10d
jne 0x180026b00
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x180026b70
cmp qword [rax + 0x30], 0
jne 0x180026ad0
xor eax, eax
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000bd70]
mov rcx, r15
call rax
mov r15, qword [rsp + 0x20]
mov qword [0x180001bd0], rax
add rsp, 0x38
jmp qword [rax]
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180026b72
Function at 0x180026bd0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180001bd8]
cmp rax, 0x402402
jne 0x180026d30
lea rdx, [0x18000bdf8]
mov qword [rsp + 0x20], r15
lea rcx, [0x18000be18]
call fcn.180020ca0
mov r15, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180026d12
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180026cda
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180026cda
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180026cd5
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180026ca0
cmp r9d, 0xf3f452e3
je 0x180026d37
test r10d, r10d
jne 0x180026c80
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x180026cf0
cmp qword [rax + 0x30], 0
jne 0x180026c50
xor eax, eax
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000be08]
mov rcx, r15
call rax
mov r15, qword [rsp + 0x20]
mov qword [0x180001bd8], rax
add rsp, 0x38
jmp qword [rax]
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180026cf2
Function at 0x180026d50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180001be0]
cmp rax, 0x402402
jne 0x180026eb0
lea rdx, [0x18000bed0]
mov qword [rsp + 0x20], r15
lea rcx, [0x18000bef8]
call fcn.180020ca0
mov r15, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180026e92
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180026e5a
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180026e5a
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180026e55
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180026e20
cmp r9d, 0xf3f452e3
je 0x180026eb7
test r10d, r10d
jne 0x180026e00
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x180026e70
cmp qword [rax + 0x30], 0
jne 0x180026dd0
xor eax, eax
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000bee0]
mov rcx, r15
call rax
mov r15, qword [rsp + 0x20]
mov qword [0x180001be0], rax
add rsp, 0x38
jmp qword [rax]
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180026e72
Function at 0x180026ed0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r13
push r15
sub rsp, 0x38
mov r8, qword [0x18009b3e0]
mov r15, rdx
mov r13, rcx
cmp rcx, r8
jbe 0x180026ef6
add r8, qword [0x18009b3e8]
cmp rcx, r8
jb 0x180026f10
lea rax, [rcx - 0x10000]
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
ja 0x18002708d
mov rax, qword [0x180001be8]
cmp rax, 0x402402
jne 0x180027060
lea rdx, [0x18000bfc8]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000bfe8]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180027042
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18002700a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18002700a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180027005
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180026fd0
cmp r9d, 0xf3f452e3
je 0x180027074
test r10d, r10d
jne 0x180026fb0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180027020
cmp qword [rax + 0x30], 0
jne 0x180026f80
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000bfd8]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001be8], rax
mov rdx, r13
mov rcx, r15
call qword [rax]
mov rax, r15
add rsp, 0x38
pop r15
pop r13
ret
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180027022
xor eax, eax
mov qword [rdx], rax
mov dword [rdx + 8], eax
mov rax, r15
add rsp, 0x38
pop r15
pop r13
ret
Function at 0x1800270b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rdi
push r13
sub rsp, 0x38
mov rax, rdx
mov r13, rcx
mov rcx, rax
mov rdx, r8
call fcn.180020ca0
test rax, rax
je 0x18002727f
mov rcx, rax
call fcn.1800276c0
test rax, rax
je 0x18002727f
mov rcx, rax
call fcn.180027800
mov rdi, rax
test rax, rax
je 0x18002727f
mov qword [rsp + 0x50], rbx
mov rbx, rax
mov rax, qword [0x180001bf0]
cmp rax, 0x402402
jne 0x18002724d
lea rdx, [0x18000c390]
mov qword [rsp + 0x30], r12
lea rcx, [0x18000c3b0]
call fcn.180020ca0
mov r9, qword [0x18009b450]
mov r12, rax
test r9, r9
jne 0x18002722e
mov rcx, qword gs:[0x60]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], r14
mov rdx, qword [rcx + 0x18]
mov qword [rsp + 0x20], r15
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rcx]
mov r14, rbp
nop dword [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1800271fa
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1800271fa
mov r15d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r15 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1800271f5
movsx edx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov ecx, edx
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova ecx, edx
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x1800271c0
cmp r9d, 0xf3f452e3
je 0x180027265
test r10d, r10d
jne 0x1800271a0
mov rax, qword [r14]
mov r14, rax
cmp rax, rbp
je 0x180027210
cmp qword [rax + 0x30], 0
jne 0x180027170
xor r9d, r9d
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov qword [0x18009b450], r9
mov r8d, 1
lea rdx, [0x18000c3a0]
mov rcx, r12
call r9
mov r12, qword [rsp + 0x30]
mov qword [0x180001bf0], rax
mov rax, qword [rax]
mov rdx, rbx
mov rcx, r13
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
pop r13
pop rdi
jmp rax
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov r9d, dword [rcx + rdx*4]
add r9, r11
jmp 0x180027213
xor eax, eax
add rsp, 0x38
pop r13
pop rdi
ret
Function at 0x180027290
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180001bf8]
cmp rax, 0x402402
jne 0x1800273f0
lea rdx, [0x18000c3f0]
mov qword [rsp + 0x20], r15
lea rcx, [0x18000c41c]
call fcn.180020ca0
mov r15, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x1800273d2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x18002739a
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x18002739a
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180027395
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180027360
cmp r9d, 0xf3f452e3
je 0x1800273f7
test r10d, r10d
jne 0x180027340
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1800273b0
cmp qword [rax + 0x30], 0
jne 0x180027310
xor eax, eax
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000c400]
mov rcx, r15
call rax
mov r15, qword [rsp + 0x20]
mov qword [0x180001bf8], rax
add rsp, 0x38
jmp qword [rax]
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800273b2
Function at 0x1800276c0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x18009d490]
mov r15, rcx
test rax, rax
jne 0x1800277d2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rdx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x18002779a
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x18002779a
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x2607b974
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180027795
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180027760
cmp r9d, 0x994cdda7
je 0x1800277de
test r10d, r10d
jne 0x180027740
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1800277b0
cmp qword [rax + 0x30], 0
jne 0x180027710
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009d490], rax
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800277b2
Function at 0x180027800
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x18009d498]
mov r15, rcx
test rax, rax
jne 0x180027912
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rdx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x1800278da
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x1800278da
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x7f246f65
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1800278d5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x1800278a0
cmp r9d, 0x21043bdf
je 0x18002791e
test r10d, r10d
jne 0x180027880
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1800278f0
cmp qword [rax + 0x30], 0
jne 0x180027850
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009d498], rax
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800278f2
Function at 0x180027940
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x180001c00]
mov r15, rcx
cmp rax, 0x402402
jne 0x180027aa0
lea rdx, [0x18000c9e8]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000ca00]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180027a82
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180027a4a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180027a4a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180027a45
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180027a10
cmp r9d, 0xf3f452e3
je 0x180027ab1
test r10d, r10d
jne 0x1800279f0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180027a60
cmp qword [rax + 0x30], 0
jne 0x1800279c0
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 2
lea rdx, [0x18000c9f4]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001c00], rax
xor r8d, r8d
mov dl, 1
mov rcx, r15
add rsp, 0x30
pop r15
jmp qword [rax]
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180027a62
Function at 0x180027b00
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r12
push r15
sub rsp, 0x38
mov rax, qword [0x180001c08]
mov r15d, edx
mov r12, rcx
cmp rax, 0x402402
jne 0x180027c60
lea rdx, [0x18000cbc8]
mov qword [rsp + 0x28], r13
lea rcx, [0x18000cbe8]
call fcn.180020ca0
mov r13, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180027c42
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180027c0a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180027c0a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180027c05
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180027bd0
cmp r9d, 0xf3f452e3
je 0x180027c71
test r10d, r10d
jne 0x180027bb0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180027c20
cmp qword [rax + 0x30], 0
jne 0x180027b80
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000cbd8]
mov rcx, r13
call rax
mov r13, qword [rsp + 0x28]
mov qword [0x180001c08], rax
mov edx, r15d
mov rcx, r12
add rsp, 0x38
pop r15
pop r12
jmp qword [rax]
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180027c22