Function at 0x140001010
Capabilities:
Access peb ldr_data
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
lea r8, str.ntdll.dll
mov ebx, 0x1505
mov dl, 0x6e
mov r9d, ebx
mov rcx, qword [rax + 0x60]
mov rbp, qword [rcx + 0x30]
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001050
mov qword [rsp + 0x30], rsi
call fcn.1400022a0
mov rdi, rax
test rax, rax
je 0x140001cdb
mov r10d, ebx
lea r9, str.RtlAllocateHeap
mov r8b, 0x52
nop word [rax + rax]
lea ecx, [r8 - 0x20]
cmp r8b, 0x61
movzx edx, cl
lea r9, [r9 + 1]
movzx ecx, r8b
movzx r8d, byte [r9]
cmovb edx, ecx
imul eax, r10d, 0x21
movzx ecx, dl
add ecx, eax
mov r10d, ecx
test r8b, r8b
jne 0x1400010a0
mov edx, ecx
mov rcx, rdi
call fcn.140001ef0
mov rsi, rax
test rax, rax
je 0x140001cdb
mov edx, 8
mov r8d, 0x138
mov rcx, rbp
call rsi
mov qword [0x140075400], rax
mov r9d, ebx
mov rdx, qword gs:[0x30]
mov rcx, qword [0x140075400]
mov qword [rcx], rdx
mov dl, 0x52
mov rcx, qword [0x140075400]
mov qword [rcx + 0x110], rdi
lea rdi, str.RtlReAllocateHeap
mov rcx, qword [0x140075400]
mov r8, rdi
mov qword [rcx + 0x18], rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001140
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x20], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.LdrLoadDll
mov dl, 0x4c
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400011a0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 8], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.LdrGetProcedureAddress
mov dl, 0x4c
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001200
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x10], rax
test rax, rax
je 0x140001cdb
mov r8d, ebx
mov dl, 0x52
nop word [rax + rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea rdi, [rdi + 1]
movzx eax, dl
movzx edx, byte [rdi]
cmovb ecx, eax
imul eax, r8d, 0x21
movzx ecx, cl
add ecx, eax
mov r8d, ecx
test dl, dl
jne 0x140001260
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x20], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.RtlFreeHeap
mov dl, 0x52
nop dword [rax + rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400012c0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x28], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtCreateThreadEx
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001320
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x30], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtWaitForSingleObject
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001380
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x38], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtAllocateVirtualMemory
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400013e0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x40], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtWriteVirtualMemory
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001440
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x48], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtFreeVirtualMemory
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400014a0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x50], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtUnmapViewOfSection
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001500
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x58], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtProtectVirtualMemory
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001560
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x60], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtReadVirtualMemory
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400015c0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x68], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.NtQueryVirtualMemory
mov dl, 0x4e
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001620
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x110]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x70], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.Kernel32.dll
mov dl, 0x4b
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001680
call fcn.1400022a0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x118], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.GetStdHandle
mov dl, 0x47
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400016d0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x118]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x78], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.AttachConsole
mov dl, 0x41
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001730
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x118]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x80], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.WriteConsoleA
mov dl, 0x57
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001790
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x118]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x88], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.Sleep
mov dl, 0x53
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400017f0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x118]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x90], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.GetTickCount64
mov dl, 0x47
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001850
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x118]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0x98], rax
test rax, rax
je 0x140001cdb
lea rcx, str.msvcrt.dll
call fcn.140002050
mov rcx, qword [0x140075400]
mov qword [rcx + 0x120], rax
lea rcx, str.bcrypt.dll
call fcn.140002050
mov rcx, qword [0x140075400]
lea r8, str.BCryptOpenAlgorithmProvider
mov r9d, ebx
mov dl, 0x42
mov qword [rcx + 0x128], rax
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400018f0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x128]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xa0], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.BCryptGetProperty
mov dl, 0x42
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001950
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x128]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xa8], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.BCryptSetProperty
mov dl, 0x42
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x1400019b0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x128]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xb0], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.BCryptCreateHash
mov dl, 0x42
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001a10
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x128]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xb8], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.BCryptHashData
mov dl, 0x42
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001a70
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x128]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xc0], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.BCryptFinishHash
mov dl, 0x42
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001ad0
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x128]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xc8], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.BCryptGenerateSymmetricKey
mov dl, 0x42
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001b30
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x128]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xd0], rax
test rax, rax
je 0x140001cdb
mov r9d, ebx
lea r8, str.BCryptDecrypt
mov dl, 0x42
nop
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001b90
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x128]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xd8], rax
test rax, rax
je 0x140001cdb
lea rcx, str.netapi32.dll
call fcn.140002050
mov rcx, qword [0x140075400]
lea r8, str.NetGetJoinInformation
mov r9d, ebx
mov dl, 0x4e
mov qword [rcx + 0x130], rax
nop dword [rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, r9d, 0x21
movzx ecx, cl
add ecx, eax
mov r9d, ecx
test dl, dl
jne 0x140001c10
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x130]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xe0], rax
test rax, rax
je 0x140001cdb
lea r8, str.NetGetAadJoinInformation
mov dl, 0x4e
nop dword [rax + rax]
lea eax, [rdx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea r8, [r8 + 1]
movzx eax, dl
movzx edx, byte [r8]
cmovb ecx, eax
imul eax, ebx, 0x21
movzx ecx, cl
add ecx, eax
mov ebx, ecx
test dl, dl
jne 0x140001c70
mov rax, qword [0x140075400]
mov edx, ecx
mov rcx, qword [rax + 0x130]
call fcn.140001ef0
mov rcx, qword [0x140075400]
mov qword [rcx + 0xe8], rax
test rax, rax
je 0x140001cdb
mov rcx, qword [0x140075400]
mov rcx, qword [rcx + 0x110]
call fcn.140002660
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x140001cdd
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret