joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002f130
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rbx, rcx
lea rdi, [rcx + 0x10]
mov rcx, qword [rdi]
xor ebp, ebp
test rcx, rcx
je 0x18002f163
jle 0x18002f160
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rdi], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18002f178
jle 0x18002f174
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rbp
mov rcx, qword [rbx]
test rcx, rcx
je 0x18002f18b
jle 0x18002f188
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x18002f1a0
jle 0x18002f19c
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbx + 0x48], rbp
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x28], rbp
lea rcx, [rbx + 0xf8]
mov rdx, rsi
call fcn.180028430
mov byte [rbx + 0x1c], 0
cmp qword [rsi + 0x18], 7
jbe 0x18002f1c5
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x120089
lea r8d, [r9 + 7]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov rcx, qword [rbx]
cmp rax, rcx
je 0x18002f207
test rcx, rcx
jle 0x18002f201
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov rcx, rsi
test rcx, rcx
jle 0x18002f307
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov rcx, qword [rbx + 8]
cmp rax, rcx
je 0x18002f248
test rcx, rcx
jle 0x18002f241
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, rsi
xor r9d, r9d
test rcx, rcx
jle 0x18002f270
mov byte [rbx + 0x18], r9b
mov qword [rsp + 0x20], rbp
xor r8d, r8d
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
lea rax, [rsp + 0x40]
jmp 0x18002f2cc
mov byte [rbx + 0x18], 1
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov rcx, qword [rbx + 8]
cmp rax, rcx
je 0x18002f2aa
test rcx, rcx
jle 0x18002f2a3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, rsi
test rcx, rcx
jle 0x18002f2f7
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
lea rax, [rsp + 0x48]
cmp rax, rdi
je 0x18002f2e9
mov rcx, qword [rdi]
cmp rsi, rcx
je 0x18002f2f7
test rcx, rcx
jle 0x18002f2e4
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rdi], rsi
jmp 0x18002f2f7
test rsi, rsi
jle 0x18002f2f7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp qword [rdi], 0
je 0x18002f307
mov rcx, rbx
call fcn.18002f420
jmp 0x18002f316
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18002f330
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, dl
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
xor esi, esi
test rcx, rcx
je 0x18002f35c
jle 0x18002f358
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18002f371
jle 0x18002f36d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x18002f384
jle 0x18002f381
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x18002f399
jle 0x18002f395
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
test dil, dil
jne 0x18002f405
lea rcx, [rbx + 0xf8]
cmp qword [rbx + 0x110], 7
jbe 0x18002f3be
mov rcx, qword [rbx + 0xf8]
mov qword [rbx + 0x108], rsi
mov word [rcx], si
cmp byte [rbx + 0x1c], 0
je 0x18002f3ea
add rbx, 0x118
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x18002f3e2
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x18002f3f1
add rbx, 0x118
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x18002f3fe
mov rax, qword [rbx]
mov qword [rbx + 0x10], rsi
mov word [rax], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180031a90
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1800b70c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rcx + 8], rdx
lea rax, vtable.blackbone::Native.0
mov qword [rcx], rax
xorps xmm0, xmm0
xor eax, eax
xor esi, esi
mov rdi, rcx
mov qword [rcx + 0x10], rsi
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x54], eax
movzx ebx, r8b
mov dword [rsp + 0x28], esi
movups xmmword [rsp + 0x2c], xmm0
movups xmmword [rsp + 0x3c], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [rsp + 0x2c]
mov dword [rdi + 0x18], ecx
test bl, bl
je 0x180031b07
mov word [rdi + 0x14], 0x101
mov byte [rdi + 0x16], 1
jmp 0x180031b63
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x24], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov ecx, dword [rsp + 0x20]
cmp ecx, 1
mov edx, dword [rsp + 0x24]
sete al
cmp edx, 1
mov byte [rdi + 0x14], al
sete al
mov byte [rdi + 0x15], al
cmp ecx, 1
jne 0x180031b89
cmp edx, ecx
je 0x180031b63
cmp ecx, 1
mov byte [rdi + 0x17], 1
setne sil
add esi, 2
mov dword [rdi + 0x10], esi
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004bb30
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
test ecx, ecx
jne 0x180031b55
test edx, edx
jne 0x180031b55
mov dword [rdi + 0x10], 1
jmp 0x180031b66
Function at 0x180031c60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1800b70c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r9
mov r13d, r8d
mov r12, rdx
mov r15, rcx
xor ebx, ebx
mov qword [rsp + 0x68], rbx
call fcn.180025ac0
mov r14, rax
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rsp + 0x38]
call fcn.180011710
nop
call fcn.18002a050
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rsi, 0xf
cmova rcx, rdi
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x180031d13
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x180031d00
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.1800266d0
mov r10, qword [rax + 8]
test r10, r10
je 0x180031d73
cmp r10, qword [r14 + 8]
je 0x180031d73
mov rbx, qword [r10 + 0x30]
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180031d7d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x30]
mov r8d, r13d
mov rdx, r12
mov rcx, qword [r15 + 8]
call rbx
mov ebx, eax
jmp 0x180031d82
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rsi, 0xf
jbe 0x180031db5
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180031dad
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031dd8
mov rcx, rdi
call fcn.18004b4cc
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18004bb30
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18005212c
int3
Function at 0x180031ee0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1800b70c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], r9d
mov r13, r8
mov r12d, edx
mov r15, rcx
xor ebx, ebx
mov dword [rsp + 0x68], ebx
call fcn.180025ac0
mov r14, rax
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.180011710
nop
call fcn.18002a050
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rsi, 0xf
cmova rcx, rdi
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x180031f93
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x180031f80
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.1800266d0
mov r10, qword [rax + 8]
test r10, r10
je 0x180031fe6
cmp r10, qword [r14 + 8]
je 0x180031fe6
mov rbx, qword [r10 + 0x30]
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180031ff0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, r13
mov edx, r12d
mov rcx, qword [r15 + 8]
call rbx
mov ebx, eax
jmp 0x180031ff5
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rsi, 0xf
jbe 0x180032028
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180032020
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003204b
mov rcx, rdi
call fcn.18004b4cc
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18004bb30
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18005212c
int3
Function at 0x180032060
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov r13d, r9d
mov r12, r8
mov r15d, edx
mov r14, rcx
call fcn.180025ac0
mov rdi, rax
lea rdx, str.NtSetInformationProcess
lea rcx, [rsp + 0x20]
call fcn.180011710
nop
call fcn.18002a050
lea rbp, [rdi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 0xf
cmova rdx, rbx
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x1800320f3
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800320e0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1800266d0
mov r10, qword [rax + 8]
test r10, r10
je 0x180032139
cmp r10, qword [rdi + 8]
je 0x180032139
mov rdi, qword [r10 + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x180032142
mov r9d, r13d
mov r8, r12
mov edx, r15d
mov rcx, qword [r14 + 8]
call rdi
mov edi, eax
jmp 0x180032147
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0xc0000138
cmp rsi, 0xf
jbe 0x18003217a
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180032172
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003218d
mov rcx, rbx
call fcn.18004b4cc
mov eax, edi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18005212c
int3
Function at 0x1800321a0
Capabilities:
Create thread
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov r13, r9
mov r12, r8
mov rsi, rdx
mov qword [rsp + 0x60], rcx
call fcn.180025ac0
mov r15, rax
lea rdx, str.NtCreateThreadEx
lea rcx, [rsp + 0x68]
call fcn.180011710
nop
call fcn.18002a050
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x68]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x80]
cmp r14, 0xf
cmova rdx, rdi
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x180032243
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180032230
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x88]
mov rcx, r15
call fcn.1800266d0
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x180032279
cmp rbx, qword [r15 + 8]
je 0x180032279
mov rbx, qword [rbx + 0x30]
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebp, ebp
jmp 0x180032287
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebp, ebp
mov ebx, ebp
cmp r14, 0xf
jbe 0x1800322be
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800322b6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180032366
mov rcx, rdi
call fcn.18004b4cc
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
mov eax, dword [rsp + 0x110]
xor r8d, r8d
test rbx, rbx
je 0x180032318
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, rcx
mov edx, dword [rsp + 0x118]
mov rcx, rsi
call rbx
test eax, eax
jns 0x180032352
mov qword [rsi], rbp
jmp 0x180032352
and eax, 1
shl eax, 2
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsi], rax
test rax, rax
je 0x180032343
mov eax, ebp
jmp 0x180032352
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18005212c
int3
Function at 0x1800323a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r8
mov r12, rdx
cmp byte [rcx + 0x15], 0
jne 0x1800323c7
xor eax, eax
jmp 0x1800324d7
call fcn.180025ac0
mov r15, rax
lea rdx, str.Wow64GetThreadContext
lea rcx, [rsp + 0x20]
call fcn.180011710
nop
call fcn.18002a050
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x38]
cmp r14, 0xf
cmova rdx, rbx
xor esi, esi
movabs r9, 0xcbf29ce484222325
mov ecx, esi
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x180032443
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180032430
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.1800266d0
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x180032483
cmp rdi, qword [r15 + 8]
je 0x180032483
mov rdi, qword [rdi + 0x30]
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x18003248d
mov rdx, r13
mov rcx, r12
call rdi
mov edi, eax
jmp 0x18003248f
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, esi
cmp r14, 0xf
jbe 0x1800324c2
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800324ba
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800324ef
mov rcx, rbx
call fcn.18004b4cc
test edi, edi
jne 0x1800324d5
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x1250]
mov eax, esi
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18005212c
int3
Function at 0x180032530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r8
mov r12, rdx
cmp byte [rcx + 0x15], 0
jne 0x180032557
xor eax, eax
jmp 0x180032667
call fcn.180025ac0
mov r15, rax
lea rdx, str.Wow64SetThreadContext
lea rcx, [rsp + 0x20]
call fcn.180011710
nop
call fcn.18002a050
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x38]
cmp r14, 0xf
cmova rdx, rbx
xor esi, esi
movabs r9, 0xcbf29ce484222325
mov ecx, esi
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x1800325d3
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800325c0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.1800266d0
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x180032613
cmp rdi, qword [r15 + 8]
je 0x180032613
mov rdi, qword [rdi + 0x30]
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x18003261d
mov rdx, r13
mov rcx, r12
call rdi
mov edi, eax
jmp 0x18003261f
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, esi
cmp r14, 0xf
jbe 0x180032652
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18003264a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003267f
mov rcx, rbx
call fcn.18004b4cc
test edi, edi
jne 0x180032665
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x1250]
mov eax, esi
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18005212c
int3
Function at 0x180032690
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r12, r9
mov r15, r8
mov r14, rdx
cmp dword [rcx + 0x10], 3
jne 0x1800327d8
call fcn.180025ac0
mov rbx, rax
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rsp + 0x30]
call fcn.180011710
nop
call fcn.18002a050
lea rbp, [rbx + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
cmp rsi, 0xf
cmova r8, rdi
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r10, qword [rsp + 0x40]
test r10, r10
je 0x180032734
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x180032720
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1800266d0
mov r9, qword [rax + 8]
test r9, r9
je 0x180032782
cmp r9, qword [rbx + 8]
je 0x180032782
mov rbx, qword [r9 + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18003278b
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r12
mov rdx, r15
mov rcx, r14
call rbx
mov ebx, eax
jmp 0x180032790
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rsi, 0xf
jbe 0x1800327c7
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800327bf
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800328e7
mov rcx, rdi
call fcn.18004b4cc
mov eax, ebx
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.180025ac0
mov rbx, rax
lea rdx, str.NtQueueApcThread
lea rcx, [rsp + 0x30]
call fcn.180011710
nop
call fcn.18002a050
lea rbp, [rbx + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
cmp rsi, 0xf
cmova r8, rdi
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r10, qword [rsp + 0x40]
test r10, r10
je 0x180032854
movabs rdx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x180032840
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1800266d0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1800328a2
cmp rdx, qword [rbx + 8]
je 0x1800328a2
mov rbx, qword [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1800328ab
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r12
mov rdx, r15
mov rcx, r14
call rbx
mov ebx, eax
jmp 0x1800328b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rsi, 0xf
jbe 0x1800327c7
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800327bf
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800327bf
call fcn.18005212c
int3
Function at 0x1800328f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1800b70c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
cmp byte [rcx + 0x15], r12b
jne 0x180032933
xor eax, eax
jmp 0x180032a90
mov qword [rsp + 0x68], r12
call fcn.180025ac0
mov rdi, rax
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.180011710
nop
mov dword [rsp + 0x30], 1
call fcn.18002a050
lea rbp, [rdi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
cmp r15, 0xf
cmova rdx, rsi
movabs r9, 0xcbf29ce484222325
mov rcx, r12
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1800329c3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800329b0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1800266d0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x180032a24
cmp rdx, qword [rdi + 8]
je 0x180032a24
mov rdi, qword [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x180032a2d
add rbx, 8
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x68]
lea edx, [r9 + 0x12]
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x180032a31
test r14, r14
je 0x180032a31
mov dil, 1
jmp 0x180032a37
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 8]
xor dil, dil
mov rbx, rcx
cmp r15, 0xf
jbe 0x180032a6a
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180032a62
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180032ab9
mov rcx, rsi
call fcn.18004b4cc
test dil, dil
je 0x180032a8b
mov qword [rsp + 0x20], r12
mov r9d, 0x250
mov r8, r14
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18004bb30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.18005212c
int3