joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180024680
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rdx, qword [0x18009b3e0]
mov r15, rcx
cmp rcx, rdx
jbe 0x1800246a1
add rdx, qword [0x18009b3e8]
cmp rcx, rdx
jb 0x1800246bb
lea rax, [rcx - 0x10000]
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
ja 0x180024838
mov rax, qword [0x180001b58]
cmp rax, 0x402402
jne 0x180024810
lea rdx, [0x18000af28]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000af48]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x1800247f2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800247ba
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x1800247ba
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1800247b5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180024780
cmp r9d, 0xf3f452e3
je 0x18002481f
test r10d, r10d
jne 0x180024760
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x1800247d0
cmp qword [rax + 0x30], 0
jne 0x180024730
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000af38]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001b58], rax
mov rax, qword [rax]
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800247d2
xor eax, eax
add rsp, 0x30
pop r15
ret
Function at 0x180024850
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x180001b68]
mov r12, rdx
cmp rax, 0x402402
jne 0x180024996
lea rdx, [0x18000b080]
lea rcx, [0x18000b098]
call fcn.180020ca0
mov r15, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x18002497d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18002495e
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18002495e
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180024959
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180024920
cmp r9d, 0xf3f452e3
je 0x180024a95
test r10d, r10d
jne 0x180024900
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180024974
cmp qword [rax + 0x30], 0
jne 0x1800248d0
xor eax, eax
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b08c]
mov rcx, r15
call rax
mov qword [0x180001b68], rax
mov r15, qword [rax]
mov rax, qword [0x18009b410]
test rax, rax
jne 0x180024a69
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rsi, r14
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180024a4a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180024a4a
mov ebp, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0x700a4e6b
lea rax, [r11 + r10*4]
mov eax, dword [rax + rbp]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180024a45
nop
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180024a10
cmp r9d, 0x89473e9a
je 0x180024ab1
test r10d, r10d
jne 0x1800249f0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r14
je 0x180024a60
cmp qword [rax + 0x30], 0
jne 0x1800249c0
xor eax, eax
mov qword [0x18009b410], rax
mov rcx, r12
call rax
mov rcx, rax
mov rax, r15
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180024976
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180024a62
Function at 0x180024ad0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x180001b60]
mov r15, rdx
cmp rax, 0x402402
jne 0x180024c30
lea rdx, [0x18000b058]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000b074]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180024c12
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180024bda
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180024bda
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180024bd5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180024ba0
cmp r9d, 0xf3f452e3
je 0x180024c3f
test r10d, r10d
jne 0x180024b80
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180024bf0
cmp qword [rax + 0x30], 0
jne 0x180024b50
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 1
lea rdx, [0x18000b068]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001b60], rax
mov rax, qword [rax]
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180024bf2
Function at 0x180024c60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [0x18009b3e0]
cmp rbx, rcx
jbe 0x180024c84
mov rdx, qword [0x18009b3e8]
add rdx, rcx
cmp rbx, rdx
jb 0x180024c9e
lea rax, [rbx - 0x10000]
movabs rcx, 0x7ffffffdfffe
cmp rax, rcx
ja 0x180024e5a
mov rax, qword [0x180001b78]
mov qword [rsp + 0x30], r15
cmp rax, 0x402402
jne 0x180024cdb
mov r9b, 1
mov byte [rsp + 0x20], 0
lea r8, [0x18000b13f]
lea rdx, [0x18000b450]
lea rcx, [0x18000b460]
call fcn.180024ed0
mov qword [0x180001b78], rax
mov r15, qword [rax + rbx]
mov rax, qword [0x180001b70]
cmp rax, 0x402402
jne 0x180024e2d
lea rdx, [0x18000b0f9]
mov qword [rsp + 0x68], r12
lea rcx, [0x18000b110]
call fcn.180020ca0
mov r9, qword [0x18009b450]
mov r12, rax
test r9, r9
jne 0x180024e0e
mov rcx, qword gs:[0x60]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov rdx, qword [rcx + 0x18]
mov qword [rsp + 0x38], r14
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rcx]
mov rsi, rbp
nop dword [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180024dda
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180024dda
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180024dd5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180024da0
cmp r9d, 0xf3f452e3
je 0x180024e40
test r10d, r10d
jne 0x180024d80
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180024df0
cmp qword [rax + 0x30], 0
jne 0x180024d50
xor r9d, r9d
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [0x18009b450], r9
mov r8d, 0xffffffff
lea rdx, [0x18000b100]
mov rcx, r12
call r9
mov r12, qword [rsp + 0x68]
mov qword [0x180001b70], rax
mov rax, qword [rax]
mov rcx, r15
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov r9d, dword [rcx + rdx*4]
add r9, r11
jmp 0x180024df3
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x180025540
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x180001ba0]
mov r15, rdx
cmp rax, 0x402402
jne 0x1800256a0
lea rdx, [0x18000b640]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000b658]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180025682
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18002564a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18002564a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov edx, dword [rax + r11]
add rdx, r11
movzx r8d, byte [rdx]
inc rdx
test r8b, r8b
je 0x180025645
movsx eax, r8b
lea rdx, [rdx + 1]
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rdx - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test r8b, r8b
jne 0x180025610
cmp r9d, 0xf3f452e3
je 0x1800256af
test r10d, r10d
jne 0x1800255f0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180025660
cmp qword [rax + 0x30], 0
jne 0x1800255c0
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b650]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001ba0], rax
mov rax, qword [rax]
mov rcx, r15
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180025662
Function at 0x1800256d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x180001b88]
mov r15d, edx
cmp rax, 0x402402
jne 0x180025830
lea rdx, [0x18000b518]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000b52c]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180025812
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800257da
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x1800257da
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1800257d5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x1800257a0
cmp r9d, 0xf3f452e3
je 0x18002583f
test r10d, r10d
jne 0x180025780
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x1800257f0
cmp qword [rax + 0x30], 0
jne 0x180025750
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b524]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001b88], rax
mov rax, qword [rax]
mov ecx, r15d
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x1800257f2
Function at 0x180025860
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x180001b80]
mov r15d, edx
cmp rax, 0x402402
jne 0x1800259c0
lea rdx, [0x18000b4f0]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000b50c]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x1800259a2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x18002596a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x18002596a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180025965
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180025930
cmp r9d, 0xf3f452e3
je 0x1800259cf
test r10d, r10d
jne 0x180025910
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180025980
cmp qword [rax + 0x30], 0
jne 0x1800258e0
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b500]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001b80], rax
mov rax, qword [rax]
mov ecx, r15d
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180025982
Function at 0x1800259f0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x180001b90]
mov r15d, ecx
cmp rax, 0x402402
jne 0x180025b50
lea rdx, [0x18000b5b8]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000b5d8]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180025b32
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180025afa
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180025afa
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180025af5
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180025ac0
cmp r9d, 0xf3f452e3
je 0x180025b5f
test r10d, r10d
jne 0x180025aa0
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180025b10
cmp qword [rax + 0x30], 0
jne 0x180025a70
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b5c8]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001b90], rax
mov rax, qword [rax]
mov ecx, r15d
add rsp, 0x30
pop r15
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180025b12
Function at 0x180025b80
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov rax, qword [0x180001b98]
mov r15, rdx
cmp rax, 0x402402
jne 0x180025ce0
lea rdx, [0x18000b5e0]
mov qword [rsp + 0x28], r12
lea rcx, [0x18000b604]
call fcn.180020ca0
mov r12, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180025cc2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180025c8a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180025c8a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180025c85
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180025c50
cmp r9d, 0xf3f452e3
je 0x180025cef
test r10d, r10d
jne 0x180025c30
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180025ca0
cmp qword [rax + 0x30], 0
jne 0x180025c00
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b5f0]
mov rcx, r12
call rax
mov r12, qword [rsp + 0x28]
mov qword [0x180001b98], rax
mov rcx, r15
call qword [rax]
mov rax, r15
add rsp, 0x30
pop r15
ret
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180025ca2
Function at 0x180025d10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180001ba8]
cmp rax, 0x402402
jne 0x180025e70
lea rdx, [0x18000b790]
mov qword [rsp + 0x20], r15
lea rcx, [0x18000b7c8]
call fcn.180020ca0
mov r15, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180025e52
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180025e1a
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180025e1a
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180025e15
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180025de0
cmp r9d, 0xf3f452e3
je 0x180025e77
test r10d, r10d
jne 0x180025dc0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x180025e30
cmp qword [rax + 0x30], 0
jne 0x180025d90
xor eax, eax
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b798]
mov rcx, r15
call rax
mov r15, qword [rsp + 0x20]
mov qword [0x180001ba8], rax
add rsp, 0x38
jmp qword [rax]
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180025e32
Function at 0x180025e90
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r12
push r15
sub rsp, 0x38
mov rax, qword [0x180001bb0]
mov r15d, edx
mov r12, rcx
cmp rax, 0x402402
jne 0x180025ff0
lea rdx, [0x18000b809]
mov qword [rsp + 0x28], r13
lea rcx, [0x18000b818]
call fcn.180020ca0
mov r13, rax
mov rax, qword [0x18009b450]
test rax, rax
jne 0x180025fd2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x180025f9a
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x180025f9a
mov r14d, dword [rdi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0xc70114cc
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180025f95
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180025f60
cmp r9d, 0xf3f452e3
je 0x180026004
test r10d, r10d
jne 0x180025f40
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x180025fb0
cmp qword [rax + 0x30], 0
jne 0x180025f10
xor eax, eax
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x18009b450], rax
mov r8d, 0xffffffff
lea rdx, [0x18000b810]
mov rcx, r13
call rax
mov r13, qword [rsp + 0x28]
mov qword [0x180001bb0], rax
mov rax, qword [rax]
mov edx, r15d
mov rcx, r12
add rsp, 0x38
pop r15
pop r12
jmp rax
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180025fb2