joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006781c
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov r12, r8
mov edi, edx
mov rbx, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.14006c5b0
mov r8d, edi
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.1400640b0
lea rcx, [rsp + 0x60]
call fcn.1400640c0
mov edx, 0x8000
lea rcx, [rsp + 0x48]
mov r15d, eax
call fcn.140064cd0
test r15d, r15d
jle 0x14006789e
mov edx, r15d
lea rcx, [rsp + 0x48]
call fcn.140064d00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.140067a8c
test eax, eax
je 0x1400678b9
lea rsi, [0x140080d68]
jmp 0x1400678d2
call fcn.140067ae4
test eax, eax
lea rcx, [0x140080d68]
lea rsi, [0x140080d6c]
cmovne rsi, rcx
mov eax, 0x1000
mov dword [rsp + 0x40], eax
mov ecx, eax
call fcn.14006dc2c
mov rdi, rax
test rax, rax
je 0x14006792c
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.14006c5b0
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov ecx, 5
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, eax
test eax, eax
jns 0x14006791e
mov rcx, rdi
call fcn.14006dc24
cmp ebx, 0xc0000004
jne 0x14006792c
mov eax, dword [rsp + 0x40]
jmp 0x1400678db
cmp dword [rdi], 0
mov rbx, rdi
je 0x140067a19
call fcn.140067a7c
mov r8d, dword [rbx + 0x50]
neg eax
sbb ecx, ecx
xor edx, edx
and ecx, 0xc00
add ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x140067985
mov rcx, qword [rbx + 0x50]
lea r8, [rbx + 0x38]
mov r9, qword [rbx + 0x58]
lea rdx, str._wZ_t_d_t_d_n
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.140064d4c
jmp 0x140067a02
mov r8d, 0x800
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.140067aec
test eax, eax
jne 0x14006799e
mov byte [rbp - 0x80], al
mov ecx, dword [rbx + 0x50]
lea rdx, [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x1400679b5
or dword [rsp + 0x44], 0xffffffff
mov rcx, r14
call fcn.140067a8c
mov r9, qword [rbx + 0x58]
lea rcx, [0x140080d6c]
test eax, eax
lea r8, [rbx + 0x38]
mov eax, dword [rsp + 0x44]
lea rdx, str._wZ_t_d_t_d_t_s_t_s_t_d_n
mov dword [rsp + 0x38], eax
cmove rcx, rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140064d4c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx]
add rbx, rax
cmp dword [rbx], 0
jne 0x140067938
lea rcx, [rsp + 0x48]
call fcn.1400640f0
lea rcx, [rsp + 0x48]
mov ebx, eax
call fcn.140064e08
mov rcx, rax
mov edx, ebx
mov r8d, shutdown
test r15d, r15d
je 0x140067a45
mov r8d, reloc.WS2_32.dll_shutdown
call r12
mov rcx, rdi
call fcn.14006dc24
lea rcx, [rsp + 0x48]
call fcn.140064cac
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x890
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14006814c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
xor ebx, ebx
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
test r8d, r8d
jle 0x1400681ae
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400681d2
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400681d2
add ebx, eax
cmp ebx, edi
jl 0x14006817c
or eax, 0xffffffff
cmp ebx, edi
cmovne ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
jmp 0x1400681b8

Function at 0x1400691a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400691ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400691ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400691ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400691ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400691ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400691f0
xor al, al
add rsp, 0x28
ret
Function at 0x14006d9b0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14006d784
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006d784
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006d784
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006d784
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006d784
cmp dword [rcx + 0x84], 0xe
jbe 0x14006d784
cmp dword [rcx + 0xf8], esi
je 0x14006d784
mov ecx, r14d
call fcn.14006d8cc
mov ecx, 2
call fcn.140073278
nop
cmp byte [0x1400b8770], 0
jne 0x14006d84e
mov r15d, 1
mov eax, r15d
xchg dword [0x1400b8760], eax
test ebx, ebx
jne 0x14006d7f7
mov rdi, qword [0x1400b34a8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400b8768]
cmp rcx, rax
je 0x14006d7ee
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140068fc8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400b89c0]
jmp 0x14006d803
cmp ebx, r15d
jne 0x14006d809
lea rcx, [0x1400b89d8]
call fcn.140072500
nop
test ebx, ebx
jne 0x14006d820
lea rdx, [0x1400804f8]
lea rcx, [0x1400804d8]
call fcn.140071e28
lea rdx, [0x140080508]
lea rcx, [0x140080500]
call fcn.140071e28
movzx eax, byte [0x1400b8770]
test esi, esi
cmove eax, r15d
mov byte [0x1400b8770], al
jmp 0x14006d84e
mov ecx, 2
call fcn.1400732cc
test esi, esi
jne 0x14006d865
mov ecx, r14d
call fcn.14006d880
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14006d714
Function at 0x140075268
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140075108
call fcn.140073c9c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140073b7c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400750f0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400750f0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14007513a
lock or dword [rax + 0x14], 0x10
jmp 0x1400750f0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140075157
mov rcx, qword [rbp + 0x10]
call fcn.14007b984
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140073f30
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140074b40
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400751ae
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400750f0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14007521a
mov rcx, qword [rbp + 0x10]
call fcn.140073f30
cmp eax, 0xffffffff
je 0x140075201
mov rcx, qword [rbp + 0x10]
call fcn.140073f30
cmp eax, 0xfffffffe
je 0x140075201
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140073f30
movsxd rdi, eax
lea rsi, [0x1400b8de0]
mov rcx, rbx
sar rdi, 6
call fcn.140073f30
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140075208
lea rax, [0x1400b3700]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14007521a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140075250
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14007524c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14007524c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400750f3
jmp 0x1400750c0
Function at 0x140009970
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14000f2a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400099b7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140003850
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140009680
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140003850
add rsp, 0x38
ret

Function at 0x18006bfb3
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x25
invalid
pop rsi
jae 0x18006bf37
cmp bh, ah
and bl, byte [rsp + rax*2]
invalid

Function at 0x18073e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18073e237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18073e0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18073e0c7
add dl, dl
jne 0x18073e0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18073e14e
xor eax, eax
add dl, dl
jne 0x18073e0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18073e205
add dl, dl
jne 0x18073e10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18073e11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18073e128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18073e135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18073e142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18073e0d6
mov eax, 1
add dl, dl
jne 0x18073e15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18073e16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18073e153
sub eax, ebx
mov ebx, 1
jne 0x18073e1a4
mov ecx, 1
add dl, dl
jne 0x18073e186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18073e193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18073e17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073e0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18073e1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18073e1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18073e1b5
cmp eax, 0x7d00
jae 0x18073e1f3
cmp eax, 0x500
jb 0x18073e1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073e0d6
cmp eax, 0x7f
ja 0x18073e1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18073e0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18073e22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18073e0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140006ce8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140006e30
Function at 0x14000e3e4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000e46b
mov rsi, rbx
cmp word [rax], bp
je 0x14000e42a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000e414
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000e410
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000ae30
mov rdi, rax
test rax, rax
je 0x14000e458
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000c4c0
mov rbp, rdi
xor ecx, ecx
call fcn.140009ee0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140012218
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001222e
mov al, 1
jmp 0x14001228e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001223f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001228c
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000e8dc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001228c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001228c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001228c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001228e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18000bd10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
movdqa xmm0, xmmword [0x1801fe410]
lea rax, [rbp + 0xb0]
movdqa xmm1, xmmword [0x1801fea10]
lea rdx, [rsp + 0x55]
movdqu xmmword [rsp + 0x54], xmm0
mov rbx, rcx
mov r9d, 0x20019
movdqa xmm0, xmmword [0x1801fec40]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rbp + 0xa8], 0xff
movdqu xmmword [rsp + 0x74], xmm0
xor edi, edi
mov dword [rbp - 0x7c], 0x6e6f69
movdqu xmmword [rsp + 0x64], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000bdd7
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x6b6e5553
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
lea rax, [rsp + 0x31]
mov qword [rbx + 0x18], rdi
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x34], 0x6e776f6e
mov byte [rsp + 0x38], dil
inc r8
cmp byte [rax + r8], dil
jne 0x18000bdc4
lea rdx, [rsp + 0x31]
jmp 0x18000be9d
movdqa xmm0, xmmword [0x1801fecf0]
lea rax, [rbp + 0xa8]
mov rcx, qword [rbp + 0xb0]
lea rdx, [rsp + 0x3a]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov dword [rsp + 0x49], 0x726572
xor r8d, r8d
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x39], xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0xb0]
test eax, eax
je 0x18000be70
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x6b6e557b
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
lea rax, [rsp + 0x31]
mov qword [rbx + 0x18], rdi
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x34], 0x6e776f6e
mov byte [rsp + 0x38], dil
nop word [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x18000be60
lea rdx, [rsp + 0x31]
jmp 0x18000be9d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rax, [rbp - 0x70]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
nop
inc r8
cmp byte [rax + r8], dil
jne 0x18000be90
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.18003a510
lea r11, [rsp + 0x190]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180012d80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x180232fa8]
mov r15, rcx
test rax, rax
jne 0x180012e77
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180012e58
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180012e58
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc2b2c2d1
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx eax, byte [r8]
inc r8
test al, al
je 0x180012e53
nop
movsx ecx, al
lea r8, [r8 + 1]
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
movzx eax, byte [r8 - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test al, al
jne 0x180012e20
cmp r9d, 0x9fd8f01f
je 0x180012f96
test r10d, r10d
jne 0x180012e00
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180012e6e
cmp qword [rax + 0x30], 0
jne 0x180012dd0
xor eax, eax
mov qword [0x180232fa8], rax
mov edx, 4
lea r9, [rsp + 0x48]
mov r8d, edx
mov rcx, r15
call rax
xor eax, eax
mov dword [r15], eax
mov rax, qword [0x180233020]
test rax, rax
jne 0x180012f69
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180012f4a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180012f4a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xb832d1bd
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180012f45
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180012f10
cmp r9d, 0xad798edb
je 0x180012fb2
test r10d, r10d
jne 0x180012ef0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180012f60
cmp qword [rax + 0x30], 0
jne 0x180012ec0
xor eax, eax
mov qword [0x180233020], rax
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov edx, 4
mov rcx, r15
call rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180012e70
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180012f62
Function at 0x180012fd0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180232fc0]
test rax, rax
jne 0x1800130c7
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r14
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x18001309e
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x18001309e
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x51583a20
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180013099
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180013060
cmp r9d, 0xf799fb41
je 0x18001314b
test r10d, r10d
jne 0x180013040
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1800130b4
cmp qword [rax + 0x30], 0
jne 0x180013010
xor eax, eax
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [0x180232fc0], rax
xor ecx, ecx
call rax
movdqa xmm0, xmmword [0x1801fdf50]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x18
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
mov dword [rsp + 0x34], 0x1c
mov dword [rsp + 0x38], 0x24
movsx eax, word [rdi + 6]
test eax, eax
jle 0x18001313b
add rdi, 0xf8
mov esi, eax
nop dword [rax]
xor ebx, ebx
movsxd rcx, dword [rsp + rbx*4 + 0x20]
add rcx, rdi
call fcn.180012d80
inc rbx
cmp rbx, 7
jl 0x180013112
lea rcx, [rdi + 0x20]
call fcn.180012d80
add rdi, 0x28
sub rsi, 1
jne 0x180013110
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800130b6
Function at 0x180015db0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x150
mov r14, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], sil
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x48]
lea rcx, [rax + 0x10]
call fcn.180015f60
lea rdx, [rax + 1]
mov r8d, 0x101
nop
movzx ecx, byte [rax]
xor byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x180015e10
mov byte [rax + 0x102], r8b
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8 + 1], 0
jne 0x180015e40
lea rdx, [rax + 1]
lea rcx, [rsp + 0x28]
call fcn.18003a510
nop
mov rdx, qword [r14 + 0x10]
cmp qword [rdi + 0x18], rdx
jae 0x180015e77
mov rbx, qword [rdi + 0x10]
sub rdx, rbx
mov rcx, rdi
call fcn.180039fb0
mov qword [rdi + 0x10], rbx
mov r15, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x28]
cmp qword [r14 + 0x10], 0
jbe 0x180015f06
mov r12, qword [rsp + 0x38]
movzx ebx, byte [rsp + 0x180]
mov r8, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x180015ea2
mov r8, qword [r14]
lea rcx, [rsp + 0x28]
cmp r15, 0xf
cmova rcx, rbp
xor edx, edx
mov rax, rsi
div r12
movzx r9d, byte [rdx + rcx]
xor r9b, byte [r8 + rsi]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180015eec
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x180015ee1
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180015efd
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.18003a100
inc rsi
cmp rsi, qword [r14 + 0x10]
jb 0x180015e95
cmp r15, 0xf
jbe 0x180015f39
lea rdx, [r15 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x180015f31
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015f58
mov rcx, rbp
call fcn.1800c17e8
mov rax, rdi
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1800e1ef4
int3