joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008b650
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180140080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rbp, rcx
xor ebx, ebx
mov dword [rsp + 0x60], ebx
call fcn.18006e8a0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea r8d, [rbx + 0x19]
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x30]
call fcn.180006a60
nop
call fcn.180086630
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x18008b703
movabs r8, 0x100000001b3
nop
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x18008b6f0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.18006f090
mov r10, qword [rax + 8]
test r10, r10
je 0x18008b754
cmp r10, qword [rsi + 8]
je 0x18008b754
mov rbx, qword [r10 + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18008b75e
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, qword [rbp + 8]
call rbx
mov ebx, eax
jmp 0x18008b763
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x30]
call fcn.180005910
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180100f50
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18008b790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rbp, rcx
call fcn.18006e8a0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x17]
lea rdx, str.NtSetInformationProcess
lea rcx, [rsp + 0x20]
call fcn.180006a60
nop
call fcn.180086630
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x18008b833
movabs r8, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x18008b820
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.18006f090
mov r10, qword [rax + 8]
test r10, r10
je 0x18008b87a
cmp r10, qword [rsi + 8]
je 0x18008b87a
mov rbx, qword [r10 + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18008b884
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, qword [rbp + 8]
call rbx
mov ebx, eax
jmp 0x18008b889
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x20]
call fcn.180005910
mov eax, ebx
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18008b8b0
Capabilities:
Create thread
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov r12, r9
mov r15, r8
mov rsi, rdx
mov r13, rcx
call fcn.18006e8a0
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea r8d, [rbx + 0x10]
lea rdx, str.NtCreateThreadEx
lea rcx, [rsp + 0x60]
call fcn.180006a60
nop
call fcn.180086630
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x18008b955
movabs r10, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18008b942
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov rcx, r14
call fcn.18006f090
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x18008b989
cmp rdi, qword [r14 + 8]
je 0x18008b989
mov rdi, qword [rdi + 0x30]
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18008b996
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, rbx
lea rcx, [rsp + 0x60]
call fcn.180005910
mov rcx, qword [r13 + 8]
mov eax, dword [rsp + 0x100]
xor r8d, r8d
test rdi, rdi
je 0x18008b9f5
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov r9, rcx
mov edx, dword [rsp + 0x108]
mov rcx, rsi
call rdi
test eax, eax
jns 0x18008ba2d
mov qword [rsi], rbx
jmp 0x18008ba2d
and eax, 1
shl eax, 2
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsi], rax
test rax, rax
jne 0x18008ba2b
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
mov eax, ebx
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18008ba80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rbp, rdx
cmp byte [rcx + 0x15], 0
jne 0x18008baa5
xor eax, eax
jmp 0x18008bb9c
call fcn.18006e8a0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x15]
lea rdx, str.Wow64GetThreadContext
lea rcx, [rsp + 0x20]
call fcn.180006a60
nop
call fcn.180086630
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x18008bb33
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18008bb20
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18006f090
mov r8, qword [rax + 8]
test r8, r8
je 0x18008bb72
cmp r8, qword [rdi + 8]
je 0x18008bb72
mov rdi, qword [r8 + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x18008bb7b
mov rdx, r14
mov rcx, rbp
call rdi
mov edi, eax
jmp 0x18008bb7d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, ebx
lea rcx, [rsp + 0x20]
call fcn.180005910
test edi, edi
jne 0x18008bb9a
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x18008bbf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rbp, rdx
cmp byte [rcx + 0x15], 0
jne 0x18008bc15
xor eax, eax
jmp 0x18008bd0c
call fcn.18006e8a0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x15]
lea rdx, str.Wow64SetThreadContext
lea rcx, [rsp + 0x20]
call fcn.180006a60
nop
call fcn.180086630
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x18008bca3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18008bc90
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18006f090
mov r8, qword [rax + 8]
test r8, r8
je 0x18008bce2
cmp r8, qword [rdi + 8]
je 0x18008bce2
mov rdi, qword [r8 + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x18008bceb
mov rdx, r14
mov rcx, rbp
call rdi
mov edi, eax
jmp 0x18008bced
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, ebx
lea rcx, [rsp + 0x20]
call fcn.180005910
test edi, edi
jne 0x18008bd0a
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x18008bd30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r15, r9
mov r14, r8
mov rbp, rdx
cmp dword [rcx + 0x10], 3
jne 0x18008be41
call fcn.18006e8a0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea r8d, [rsi + 0x16]
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rsp + 0x30]
call fcn.180006a60
nop
call fcn.180086630
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
movabs r9, 0xcbf29ce484222325
mov ecx, esi
mov r10, qword [rsp + 0x40]
test r10, r10
je 0x18008bde4
movabs rdx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x18008bdd0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18006f090
mov r9, qword [rax + 8]
test r9, r9
je 0x18008be2e
cmp r9, qword [rbx + 8]
je 0x18008be2e
mov rbx, qword [r9 + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18008be37
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov rcx, rbp
call rbx
mov ebx, eax
jmp 0x18008be3c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
jmp 0x18008bf2c
call fcn.18006e8a0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea r8d, [rsi + 0x10]
lea rdx, str.NtQueueApcThread
lea rcx, [rsp + 0x30]
call fcn.180006a60
nop
call fcn.180086630
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
movabs r9, 0xcbf29ce484222325
mov ecx, esi
mov r10, qword [rsp + 0x40]
test r10, r10
je 0x18008bed4
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x18008bec0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18006f090
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18008bf1e
cmp rdx, qword [rbx + 8]
je 0x18008bf1e
mov rbx, qword [rdx + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18008bf27
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov rcx, rbp
call rbx
mov ebx, eax
jmp 0x18008bf2c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x30]
call fcn.180005910
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18008bf50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x180140080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
cmp byte [rcx + 0x15], r14b
jne 0x18008bf8f
xor eax, eax
jmp 0x18008c0c9
mov qword [rsp + 0x68], r14
call fcn.18006e8a0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.180006a60
nop
mov dword [rsp + 0x30], 1
call fcn.180086630
lea rbp, [rdi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov rcx, r14
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x18008c025
movabs r10, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18008c012
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.18006f090
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18008c086
cmp rdx, qword [rdi + 8]
je 0x18008c086
mov rdi, qword [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x18008c08f
add rbx, 8
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rsp + 0x68]
lea edx, [r9 + 0x12]
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x18008c093
test rsi, rsi
je 0x18008c093
mov dil, 1
jmp 0x18008c099
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 8]
xor dil, dil
mov rbx, rcx
lea rcx, [rsp + 0x38]
call fcn.180005910
test dil, dil
je 0x18008c0c4
mov qword [rsp + 0x20], r14
mov r9d, 0x250
mov r8, rsi
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180100f50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18008c0f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x180140080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rdx
mov rbp, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x40], xmm0
mov dword [r11 - 0x30], r14d
call fcn.18006e8a0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
lea r8d, [r14 + 0x19]
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.180006a60
nop
mov dword [rsp + 0x30], 1
call fcn.180086630
lea rbx, [rdi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov ecx, r14d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x18008c1d3
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18008c1c0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.18006f090
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18008c23a
cmp rdx, qword [rdi + 8]
je 0x18008c23a
mov rdi, qword [rdx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x18008c243
lea rbx, [rbp + 8]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x18008c247
test rsi, rsi
je 0x18008c247
mov dil, 1
jmp 0x18008c24d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp + 8]
xor dil, dil
mov rbx, rcx
lea rcx, [rsp + 0x38]
call fcn.180005910
test dil, dil
je 0x18008c278
mov qword [rsp + 0x20], r14
mov r9d, 0x388
mov r8, rsi
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180100f50
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18008c2b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x180140080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, r8
mov r14, rdx
mov rbp, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp byte [rcx + 0x15], r15b
jne 0x18008c2f3
xor eax, eax
jmp 0x18008c44a
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x98], r15d
call fcn.18006e8a0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.180006a60
nop
mov dword [rsp + 0x30], 1
call fcn.180086630
lea rsi, [rbx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov rcx, r15
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x18008c3a3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18008c390
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.18006f090
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18008c402
cmp rcx, qword [rbx + 8]
je 0x18008c402
mov rbx, qword [rcx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18008c40b
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r14
call rbx
test eax, eax
js 0x18008c40b
test rdi, rdi
je 0x18008c40b
mov bl, 1
jmp 0x18008c40d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.180005910
test bl, bl
je 0x18008c43f
mov rdx, qword [rsp + 0x70]
add rdx, 0x2000
mov qword [rsp + 0x20], r15
mov r9d, 0x1000
mov r8, rdi
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
add rax, 0x2000
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180100f50
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18008c480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x180140080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, r8
mov r14, rdx
mov rbp, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x40], r15d
call fcn.18006e8a0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
lea r8d, [r15 + 0x18]
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.180006a60
nop
mov dword [rsp + 0x30], 1
call fcn.180086630
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov ecx, r15d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x18008c563
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18008c550
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.18006f090
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18008c5c2
cmp rcx, qword [rbx + 8]
je 0x18008c5c2
mov rbx, qword [rcx + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x18008c5cb
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r14
call rbx
test eax, eax
js 0x18008c5cb
test rsi, rsi
je 0x18008c5cb
mov bl, 1
jmp 0x18008c5cd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.180005910
test bl, bl
je 0x18008c5f8
mov qword [rsp + 0x20], r15
mov r9d, 0x1838
mov r8, rsi
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180100f50
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180095300
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi + 8], eax
jne 0x180095325
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rdi]
mov rcx, qword [rax + 0x10]
cmp dword [rcx + 0x10], 3
jne 0x180095398
cmp byte [rcx + 0x16], 0
jne 0x180095398
call fcn.18006e8a0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Wow64SuspendThread
lea rcx, [rsp + 0x20]
call fcn.180006a60
nop
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800953c0
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x20]
call fcn.180005910
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1800953c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rbx, rdx
mov rsi, rcx
call fcn.180086630
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
mov r10, qword [rbx + 0x10]
jbe 0x1800953f6
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x180095424
movabs r8, 0x100000001b3
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, r8
cmp rcx, r10
jb 0x180095411
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.18006f090
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x18009546c
cmp rbx, qword [rsi + 8]
je 0x18009546c
mov rbx, qword [rbx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180095476
mov rcx, qword [r14]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
jmp rax
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret