joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180029e10
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180178b40]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov byte [rcx + 0x60], 0
mov rcx, qword [rcx + 0x48]
xor esi, esi
test rcx, rcx
je 0x180029e4c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbx + 0x48], rsi
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x180029e61
jle 0x180029e5d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rsi
mov edi, esi
mov edx, edi
mov rcx, rbx
call fcn.180029b70
inc edi
cmp edi, 4
jl 0x180029e63
cmp qword [rbx + 0x10], rsi
je 0x180029eec
call fcn.180001740
mov rcx, qword [rbx]
mov dword [rsp + 0x40], esi
mov edx, dword [rcx + 8]
mov rcx, qword [rax]
mov dword [rsp + 0x44], edx
cmp rcx, 0xffffffffffffffff
jne 0x180029e9c
lea rcx, [rbx + 8]
jmp 0x180029edb
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x44]
mov dword [rsp + 0x28], esi
mov r9d, 4
mov edx, 0x8005e020
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbx + 8]
test eax, eax
jne 0x180029edb
mov rax, qword gs:[0x30]
call fcn.180029fc0
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x58], rsi
mov qword [rbx + 0x50], rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800e5bd0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18002aff0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180178b40]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rcx + 8], rdx
lea rax, vtable.blackbone::Native.0
mov qword [rcx], rax
xorps xmm0, xmm0
xor eax, eax
xor esi, esi
mov rdi, rcx
mov qword [rcx + 0x10], rsi
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x54], eax
movzx ebx, r8b
mov dword [rsp + 0x28], esi
movups xmmword [rsp + 0x2c], xmm0
movups xmmword [rsp + 0x3c], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [rsp + 0x2c]
mov dword [rdi + 0x18], ecx
test bl, bl
je 0x18002b067
mov word [rdi + 0x14], 0x101
mov byte [rdi + 0x16], 1
jmp 0x18002b0c3
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x24], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov ecx, dword [rsp + 0x20]
cmp ecx, 1
mov edx, dword [rsp + 0x24]
sete al
cmp edx, 1
mov byte [rdi + 0x14], al
sete al
mov byte [rdi + 0x15], al
cmp ecx, 1
jne 0x18002b0e9
cmp edx, ecx
je 0x18002b0c3
cmp ecx, 1
mov byte [rdi + 0x17], 1
setne sil
add esi, 2
mov dword [rdi + 0x10], esi
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800e5bd0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
test ecx, ecx
jne 0x18002b0b5
test edx, edx
jne 0x18002b0b5
mov dword [rdi + 0x10], 1
jmp 0x18002b0c6
Function at 0x18002b1c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x180178b40]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], r9
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
xor ebx, ebx
mov qword [rsp + 0x70], rbx
call fcn.18000b090
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r8d, 0x14
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rsp + 0x38]
call fcn.18000b890
nop
call fcn.1800274b0
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x38]
mov rbp, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
cmp r15, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x18002b294
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rsi
jb 0x18002b280
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rdi, r12
je 0x18002b2fe
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x18002b2d2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
cmp r15, 0xf
cmova rcx, rbp
cmp rsi, rax
jne 0x18002b2f0
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002b2fb
cmp rdi, r14
je 0x18002b2fe
mov rdi, qword [rdi + 8]
jmp 0x18002b2c0
mov rbx, rdi
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x18002b351
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18002b357
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 8]
call rbx
mov ebx, eax
jmp 0x18002b35c
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r15, 0xf
jbe 0x18002b396
lea rdx, [r15 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x18002b38e
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002b38e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.1800e5744
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800e5bd0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002b4c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x180178b40]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x60], rcx
xor ebx, ebx
mov dword [rsp + 0x68], ebx
call fcn.18000b090
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.18000b890
nop
call fcn.1800274b0
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x38]
mov rbp, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
cmp r15, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x18002b594
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rsi
jb 0x18002b580
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rdi, r12
je 0x18002b5fe
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x18002b5d2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
cmp r15, 0xf
cmova rcx, rbp
cmp rsi, rax
jne 0x18002b5f0
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002b5fb
cmp rdi, r14
je 0x18002b5fe
mov rdi, qword [rdi + 8]
jmp 0x18002b5c0
mov rbx, rdi
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x18002b643
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18002b649
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call rbx
mov ebx, eax
jmp 0x18002b64e
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r15, 0xf
jbe 0x18002b688
lea rdx, [r15 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x18002b680
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002b680
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.1800e5744
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800e5bd0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002b6b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x50], rcx
call fcn.18000b090
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov r8d, 0x17
lea rdx, str.NtSetInformationProcess
lea rcx, [rsp + 0x28]
call fcn.18000b890
nop
call fcn.1800274b0
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x28]
mov rbp, qword [rsp + 0x28]
mov r15, qword [rsp + 0x40]
cmp r15, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x18002b765
movabs r9, 0x100000001b3
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rsi
jb 0x18002b751
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rdi, r12
je 0x18002b7ce
mov r14, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x18002b7a2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x28]
cmp r15, 0xf
cmova rcx, rbp
cmp rsi, rax
jne 0x18002b7c0
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002b7cb
cmp rdi, r14
je 0x18002b7ce
mov rdi, qword [rdi + 8]
jmp 0x18002b790
mov rbx, rdi
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x18002b809
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18002b80f
mov r9d, dword [rsp + 0x20]
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
call rbx
mov ebx, eax
jmp 0x18002b814
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r15, 0xf
jbe 0x18002b84e
lea rdx, [r15 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x18002b846
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002b846
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.1800e5744
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002b870
Capabilities:
Create thread
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r8
mov r12, rdx
mov qword [rsp + 0x90], rcx
call fcn.18000b090
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor ebx, ebx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
lea rcx, [rsp + 0x70]
call fcn.18000b890
nop
call fcn.1800274b0
lea r13, [rbp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x88]
cmp r14, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rdi, qword [rsp + 0x80]
test rdi, rdi
je 0x18002b944
movabs r9, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x18002b930
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x18002b9af
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x18002b982
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x18002b9a0
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002b9ab
cmp rbx, rbp
je 0x18002b9af
mov rbx, qword [rbx + 8]
jmp 0x18002b970
xor edi, edi
jmp 0x18002b9b3
xor edi, edi
mov ebx, edi
test rbx, rbx
cmove rbx, r15
mov rcx, r13
cmp rbx, r15
je 0x18002b9ce
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18002b9d7
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, rdi
cmp r14, 0xf
jbe 0x18002ba11
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18002ba09
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002ba09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1800e5744
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 8]
mov eax, dword [rsp + 0x110]
mov r9, qword [rsp + 0x68]
xor r8d, r8d
test rbx, rbx
je 0x18002ba79
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, rcx
mov edx, dword [rsp + 0x118]
mov rcx, r12
call rbx
test eax, eax
jns 0x18002bab6
mov qword [r12], rdi
jmp 0x18002bab6
and eax, 1
shl eax, 2
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [r12], rax
test rax, rax
je 0x18002baa7
mov eax, edi
jmp 0x18002bab6
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002bb00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
cmp byte [rcx + 0x15], 0
jne 0x18002bb2b
xor eax, eax
jmp 0x18002bcb3
call fcn.18000b090
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov r8d, 0x15
lea rdx, str.Wow64GetThreadContext
lea rcx, [rsp + 0x20]
call fcn.18000b890
nop
call fcn.1800274b0
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x20]
mov rsi, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebp
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x18002bbc4
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x18002bbb0
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rbx, r12
je 0x18002bc2b
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x18002bc02
mov rdx, qword [rdx]
lea rcx, [rsp + 0x20]
cmp r15, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x18002bc20
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002bc2e
cmp rbx, r14
je 0x18002bc2b
mov rbx, qword [rbx + 8]
jmp 0x18002bbf0
mov rbx, rbp
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x18002bc5c
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18002bc62
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call rbx
mov ebx, eax
jmp 0x18002bc64
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, ebp
cmp r15, 0xf
jbe 0x18002bc9e
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18002bc96
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002bc96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1800e5744
test ebx, ebx
jne 0x18002bcb1
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x1250]
mov eax, ebp
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002bd00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
cmp byte [rcx + 0x15], 0
jne 0x18002bd2b
xor eax, eax
jmp 0x18002beb3
call fcn.18000b090
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov r8d, 0x15
lea rdx, str.Wow64SetThreadContext
lea rcx, [rsp + 0x20]
call fcn.18000b890
nop
call fcn.1800274b0
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x20]
mov rsi, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebp
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x18002bdc4
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x18002bdb0
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rbx, r12
je 0x18002be2b
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x18002be02
mov rdx, qword [rdx]
lea rcx, [rsp + 0x20]
cmp r15, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x18002be20
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002be2e
cmp rbx, r14
je 0x18002be2b
mov rbx, qword [rbx + 8]
jmp 0x18002bdf0
mov rbx, rbp
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x18002be5c
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18002be62
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call rbx
mov ebx, eax
jmp 0x18002be64
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, ebp
cmp r15, 0xf
jbe 0x18002be9e
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18002be96
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002be96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1800e5744
test ebx, ebx
jne 0x18002beb1
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x1250]
mov eax, ebp
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002c230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180178b40]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r13, rdx
mov r15, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
cmp byte [rcx + 0x15], bl
jne 0x18002c26b
xor eax, eax
jmp 0x18002c444
mov qword [rsp + 0x60], rbx
call fcn.18000b090
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x40]
call fcn.18000b890
nop
mov dword [rsp + 0x30], 1
call fcn.1800274b0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov rcx, rbx
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x18002c314
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x18002c300
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [rbp + 8]
cmp rbx, r12
je 0x18002c37b
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x18002c352
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x18002c370
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002c37d
cmp rbx, rbp
je 0x18002c37b
mov rbx, qword [rbx + 8]
jmp 0x18002c340
xor ebx, ebx
test rbx, rbx
cmove rbx, r12
mov rcx, qword [rsp + 0x38]
cmp rbx, r12
je 0x18002c3d0
mov rdi, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x18002c3d6
lea rbx, [r15 + 8]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x60]
mov edx, 0x1a
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x18002c3da
test r13, r13
je 0x18002c3da
mov dil, 1
jmp 0x18002c3e0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [r15 + 8]
xor dil, dil
mov rbx, rcx
cmp r14, 0xf
jbe 0x18002c41a
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18002c412
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002c412
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1800e5744
test dil, dil
je 0x18002c43f
mov qword [rsp + 0x20], 0
mov r9d, 0x250
mov r8, r13
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800e5bd0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret