joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094b9c
Capabilities:
Read file on windows

Disassembly:
jmp 0x140094ba4
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140094bec
call fcn.1400903b8
mov dword [rax], 0x16
call fcn.14008fc88
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140094bd4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140094bd4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140094c1e
lock or dword [rax + 0x14], 0x10
jmp 0x140094bd4
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140094c3b
mov rcx, qword [rbp + 0x10]
call fcn.1400984fc
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140091924
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140095468
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140094c92
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140094bd4
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140094cfe
mov rcx, qword [rbp + 0x10]
call fcn.140091924
cmp eax, 0xffffffff
je 0x140094ce5
mov rcx, qword [rbp + 0x10]
call fcn.140091924
cmp eax, 0xfffffffe
je 0x140094ce5
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140091924
movsxd rdi, eax
lea rsi, [0x1400cfc20]
mov rcx, rbx
sar rdi, 6
call fcn.140091924
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140094cec
lea rax, [0x1400ca690]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140094cfe
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140094d34
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140094d30
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140094d30
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140094bd7
Function at 0x140002270
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
mov rax, qword [rdx + 0x10]
cmp rax, 0xf
jbe 0x1400022cc
mov rdx, rax
call fcn.140010ad0
mov qword [rbx + 0x10], rbp
mov rax, qword [rdi + 0x10]
mov r15d, 0xfffffffa
cmp qword [rdi + 0x18], 0xf
jbe 0x1400022e4
mov r14, qword [rdi]
mov rcx, r14
mov rdi, r14
jmp 0x1400022ea
mov r14, rdi
mov rcx, rdi
lea r13, [rax + rcx]
cmp rdi, r13
je 0x1400023e1
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
shl ebp, 8
movzx eax, byte [r14]
add ebp, eax
add r15d, 8
js 0x140002386
movsxd r12, ebp
movsxd rsi, r15d
lea ecx, [r15 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov edi, edx
imul eax, edx, 0xfffffffa
add r15d, eax
nop dword [rax + rax]
mov rax, r12
mov rcx, rsi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14000236d
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140002362
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000237c
mov rcx, rbx
call fcn.140010c20
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rsi, 6
sub rdi, 1
jne 0x140002330
inc r14
cmp r14, r13
jne 0x140002300
cmp r15d, 0xfffffffa
jle 0x1400023e1
lea ecx, [r15 + 8]
shl ebp, 8
movsxd rax, ebp
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400023d9
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1400023ce
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400023e1
mov rcx, rbx
call fcn.140010c20
mov rcx, qword [rbx + 0x10]
test cl, 3
je 0x140002429
nop word [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140002415
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14000240d
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x140002420
mov r9b, 0x3d
mov rcx, rbx
call fcn.140010c20
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x1400023f0
mov rax, rbx
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002cf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140002d5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x140002d5a
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 1
call fcn.14000e050
mov r9d, edi
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
js 0x140002d23
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140002d80
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea edi, [rcx + 1]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], r8d
lea rdx, [rsp + 0x40]
mov ecx, edi
mov dword [rsp + 0x40], 1
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140002e22
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x140002e22
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 1
call fcn.14000e050
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
js 0x140002de0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001c970
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x1400033e0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x468
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x450], rax
movzx eax, word [rcx]
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp ax, 2
je 0x140003418
cmp ax, 0x17
jne 0x14000348d
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rsi], eax
mov r8d, 0x401
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x40]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x14000348d
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140003472
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000cee0
mov al, 1
jmp 0x14000348f
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14001c970
add rsp, 0x468
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140004720
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdx, qword [rcx + 8]
mov rdi, rcx
mov rax, qword [rcx + 0x20]
xor r9d, r9d
mov r8, qword [rcx + 0x28]
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x38]
lea ebx, [rdx + 1]
mov qword [rsp + 0x58], rdx
mov dword [rsp + 0x3c], r8d
mov ecx, ebx
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 1
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
test eax, eax
jns 0x1400047d1
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x1400047e7
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 1
call fcn.14000e050
lea rax, [rsp + 0x38]
xor r9d, r9d
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
test eax, eax
js 0x140004790
test rcx, rcx
je 0x1400047e7
mov rcx, qword [rdi + 8]
call fcn.140002e50
test al, al
je 0x1400047e7
mov al, 1
jmp 0x1400047e9
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001c970
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140004940
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9, qword [rcx + 8]
mov rbp, r8
mov rax, qword [rcx + 0x20]
lea r8, [rsp + 0x50]
mov r10, qword [rcx + 0x28]
mov rsi, rdx
mov dword [rsp + 0x40], eax
mov rdi, rcx
lea ebx, [r9 + 1]
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], 1
mov ecx, ebx
mov dword [rsp + 0x44], r10d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
test eax, eax
jns 0x140004a05
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x140004a70
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 1
call fcn.14000e050
lea rax, [rsp + 0x40]
xor r9d, r9d
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
test eax, eax
js 0x1400049c0
test rcx, rcx
je 0x140004a70
mov rcx, qword [rdi + 8]
call fcn.140002e50
test al, al
je 0x140004a70
mov rdi, qword [rdi + 8]
xor r9d, r9d
mov rcx, rdi
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x140004a6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x140004a6b
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 1
call fcn.14000e050
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
js 0x140004a34
mov rax, rbx
jmp 0x140004a77
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001c970
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140004b20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140004b79
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.1400033e0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14001c970
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x14000c2a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 8
call fcn.14001cab0
lea rcx, [0x14000bf90]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140015dc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000c32e
cmp dword [rsp + 0x38], 0
je 0x14000c322
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000c322
nop dword [rax]
jmp 0x14000c320
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14000ccc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14000ccf4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14000cce0
ret
Function at 0x14001a580
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14001a645
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14001a645
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14001a65e
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x14001a635
cmp byte [rcx], 0x5c
jne 0x14001a62e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x14001a62e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14001a61c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x14001a62b
test r8b, 0x10
jne 0x14001a62e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x14001a62e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140015010
test edi, edi
jne 0x14001a5a0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140015000
int3

Function at 0x14001d64c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001d696
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001d696
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001d696
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001d696
cmp dword [rcx + 0x84], 0xe
jbe 0x14001d696
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001d698
xor al, al
add rsp, 0x28
ret
Function at 0x110101038
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
ror esi, 0xd
ror eax, 2
add ebx, edi
add ebx, esi
and ebx, 0x400
je 0x1101014e6
ror eax, 0x1f
rol eax, 0x18
sub esi, 0xe68366fb
rol ebx, 2
sub ecx, 0x4cf5ecc0
add ebx, eax
add ebx, ecx
and ebx, 8
je 0x110102521
ror eax, 5
add edi, 0x9a32bdc2
xor edi, dword [rbp - 0x20]
sub edx, 0x8aa91e19
add esi, 0x7ebdc03a
jmp fcn.1101095e4
add dword [rbp - 0x18], 0x7fef75b7
xor ebx, dword [rbp - 0x18]
add dword [rbp - 0x18], 0xe937e333
xor ebx, dword [rbp - 0x18]
sub esi, 0x6590e9ba
sub edi, 0x97c367d0
ror ecx, 0x19
xor ecx, 0x516f2d79
ror esi, 0xe
add ebx, edx
add ebx, edi
add ebx, eax
and ebx, 4
je 0x110106113
sub esi, 0x278e8bd7
xor ecx, 0x27111f4b
ror ecx, 2
add ebx, 0x973681fd
sub edi, 0x47205f28
add ebx, esi
add ebx, ecx
and ebx, 0x100000
je 0x11010806a
rol ecx, 0x1e
add eax, 0xd62a3c58
ror ecx, 2
rol ebx, 0x1e
add ebx, ecx
add ebx, esi
add ebx, edi
and ebx, 0x80000
invalid
invalid

Function at 0x1101012a0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov ebp, 0x81000090
call 0xf3ce6b84
xor eax, dword [rbp - 0x20]
rol edx, 0xd
sub ecx, 0x74f2f1a1
xor eax, 0x8c9df266
invalid
rol byte [rsi], 0

Function at 0x110101410
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, 0x300984b8
add ebx, ecx
add ebx, esi
and ebx, 0x100000
je fcn.11010202e
rol edx, 0x17
ror ecx, 0xa
add esi, 0x70655732
ror ecx, 2
add ebx, edi
add ebx, eax
add ebx, esi
and ebx, 0x80
je fcn.1101094d9
xor eax, 0x36d8c041
add ebx, 0xb3cef8c2
add esi, 0x61573f19
jmp 0x11010403f
add dword [rbp - 0x18], 0x94705fb2
xor ebx, dword [rbp - 0x18]
add ecx, 0x8c676ea7
xor edx, dword [rbp - 0x18]
ror ecx, 0x17
xor ecx, ebx
add ebx, esi
add ebx, eax
add ebx, edx
and ebx, 0x800
je 0x1101077ff
sub ebx, 0x2b857f35
rol eax, 0x15
ror esi, 8
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x400000
je 0x110109118
xor ecx, edx
xor edi, ebx
add ecx, 0xe383281c
add edi, 0xbee35e5a
add eax, 0xbf6d27ef
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x400
je 0x110101d0a
add ebx, 0xc14be63a
rol edx, 2
xor ecx, 0x80a04c9
invalid
invalid

Function at 0x1101014f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add edx, 0xa20af082
rol edi, 0xe
sub ebx, 0x5fc8366b
rol ecx, 0x16
xor esi, 0x44f297e5
add ebx, ecx
add ebx, esi
and ebx, 0x20000
je 0x1101055d4
xor edi, eax
ror edi, 0x1f
xor edx, 0xcdf46886
add ebx, ecx
add ebx, eax
and ebx, 0x200000
je fcn.1101017a9
sub ecx, 0x5893293b
ror ebx, 0xb
rol ecx, 4
rol edx, 9
sub eax, 0x7e8da4c
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x10
je fcn.110103fb1
ror esi, 0xe
xor eax, 0x6c2a3d1a
Function at 0x110101560
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x8029e6b6
ror ecx, 0x16
rol ebx, 5
jmp 0x110107ece

Function at 0x1101018d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x760f9d17
xor ebx, dword [rbp - 0x18]
sub ebx, 0xa93610cf
sub esi, 0x7c452d3
sub esi, 0xb4d8c3c
rol eax, 4
add ebx, eax
add ebx, edi
and ebx, 0x10000000
je fcn.1101094d9
ror eax, 3
sub esi, 0x2d49992b
ror edi, 0xa
xor edx, esi
rol edx, 0xd
add ebx, edi
add ebx, ecx
and ebx, 0x200
je 0x110106190
add esi, 0x786912bb
ror esi, 0x10
add ecx, 0xcb681f9c
add ebx, esi
add ebx, edx
and ebx, 0x8000
add byte [rax], 0
je fcn.1101085ab
rol ecx, 2
ror ebx, 0x1c
ror edx, 0x1f
jmp fcn.1101032b9
add dword [rbp - 0x18], 0xeee65c7a
xor ebx, dword [rbp - 0x18]
ror edi, 6
iretd
invalid
rol ebx, 4
add ecx, 0xf5e1e6fe
sub eax, 0x2171f0b6
add ebx, eax
add ebx, ecx
add ebx, edi
and ebx, 0x10
je fcn.1101022c7
xor ecx, esi
xor ecx, 0xa688dbb4
sub edx, 0x6581c944
add ebx, esi
add ebx, edx
add ebx, edi
and ebx, 0x80000000
je 0x1101072a7
xor ecx, 0xbcd5c70
add edi, 0xc641008e
sub eax, 0xaf37caff
ror ecx, 0x1e
xor eax, 0xf2ede5b3
add ebx, edx
add ebx, edi
and ebx, 0x100000
je 0x110107aa2
rol edi, 0xd
sub edx, 0x5722f269
sub ecx, 0x81c10d8e
jmp 0x11010186a
add dword [rbp - 0x18], 0xbaf75012
xor ebx, dword [rbp - 0x18]
rol ecx, 2
ror ebx, 0xa
ror ebx, 0x1e
rol edi, 0xf
ror eax, 6
add ebx, eax
add ebx, esi
add ebx, edi
and ebx, 0x800000
jrcxz 0x110102fe2
add byte [rax - 0x3f7bf100], al
out dx, al
invalid
invalid
sub ebx, 0x490b9ec8
xor eax, edi
xor eax, ecx
add ebx, esi
add ebx, eax
and ebx, 8
je 0x110102625
xor ebx, 0x644e763d
ror edi, 0xb
sub ebx, 0x3ced4d3f
rol edx, 0x19
add ebx, edi
add ebx, ecx
and ebx, 0x1000000
je 0x11010806a
sub edx, 0x7d371c06
ror edx, 0x1b
ror ebx, 6
rol edi, 0x1f
add esi, 0x4b214701
jmp 0x110101d0a
add dword [rbp - 0x18], 0xb5f3e58a
xor ebx, dword [rbp - 0x18]
add esi, 0xfbf40493
sub ecx, 0xadd0d190
ror edi, 5
add ebx, edi
add ebx, ecx
add ebx, esi
and ebx, 2
je 0x110109564
rol esi, 2
ror esi, 5
rol ebx, 0x13
ror edi, 0x15
ror esi, 0xa
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x2000
je 0x110101d0a
ror ecx, 0x19
ror eax, 4
ror esi, 0x17
ror eax, 0x1a
rol edx, 0x1c
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 0x400000
je 0x110102737
add edi, 0xc9b38822
rol ecx, 0x11
sub esi, 0xdc70843f
ror eax, 0x19
add ecx, 0x1101ab03
jmp 0x110101357
add dword [rbp - 0x18], 0x974f1cb7
xor ebx, dword [rbp - 0x18]
xor edi, eax
sub esi, 0xf55db6b5
sub ecx, 0x3a96de1
ror eax, 0x18
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x800
je 0x110102842
xor ecx, eax
ror edx, 0x12
rol edx, 0xe
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 0x4000
je 0x1101080f5
add edx, 0x9a1f64d3
rol edx, 0x12
ror edx, 8
add ebx, edx
add ebx, esi
and ebx, 0x40000000
je fcn.110102cb4
ror esi, 0xf
sub ebx, 0xaff72393
add ebx, 0xa2e1cc54
xor ebx, 0xf6aa613a
rol ecx, 0x1b
jmp 0x1101055d4
Function at 0x110101a90
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
rol edi, 0x1c
rol ebx, 0x1a
jmp 0x110106d3e
add dword [rbp - 0x18], 0x6b158c58
xor ebx, dword [rbp - 0x18]
ror ecx, 0x1e
add edx, 0x7b857e76
xor ecx, eax
sub ecx, 0x66fc5fc3
add ebx, esi
add ebx, edx
and ebx, 0x2000000
je fcn.1101094d9
rol edi, 0x1b
sub ecx, 0x412bd16f
add edx, 0x12fcd8e3
rol eax, 8
xor ecx, esi
add ebx, edx
add ebx, esi
add ebx, edi

Function at 0x110101bc0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
je 0x110109c6d
xor ecx, 0xa3e3a165
rol edi, 9
add ebx, 0x39cb2fe6
ror edx, 0xd
jmp 0x1101055d4
add dword [rbp - 0x18], 0x18a96169
xor ebx, dword [rbp - 0x18]
xor ebx, dword [rbp - 0x18]
rol eax, 2
sub edx, 0x353acbac
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x2000000
je 0x110107aa2
add edi, 0xa872d436
rol edx, 0x12
rol edi, 0xc
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x100000
je 0x110109118
sub ecx, 0xee439297
ror edx, 0xf
add ebx, 0x933c47e3
add ebx, edx
add ebx, edi
and ebx, 0x2000
je 0x110105b0f
add esi, 0xfc507f39
rol eax, 5
add esi, 0x50a4c716
add eax, 0x3b785740
add eax, 0xa85c3f62
jmp fcn.11010202e

Function at 0x110101e20
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0xd24a0189
xor ebx, dword [rbp - 0x18]
sub edx, 0x6354f89e
add edx, 0x372ff136
ror ecx, 5
ror ebx, 0x15
rol edi, 0xb
add ebx, esi
add ebx, edi
add ebx, edx
and ebx, 0x10
je 0x110106940
xor edi, dword [rbp - 0x20]
xor ebx, dword [rbp - 0x18]
add eax, 0xf1efaf78
add edi, 0x3633956c
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x200
je 0x110101d0a
sub ebx, 0xfcf89196
ror esi, 0x19
ror esi, 0x1c
add ecx, 0xc83f3b8c
add ebx, esi
add ebx, edi
and ebx, 0x200
je fcn.11010533c
ror esi, 0xd
xor esi, 0x358c0777
rol esi, 4
sub eax, 0xdc7247c
jmp fcn.110103880
add dword [rbp - 0x18], 0xad3736c4
xor ebx, dword [rbp - 0x18]
sub edi, 0x7674086b
xor edx, dword [rbp - 0x20]
add ecx, 0xe2bbd4d7
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 0x2000000
je fcn.11010487c
add edi, 0xfad7b5ca
sub ebx, 0x64359a0
ror edi, 6
xor ecx, dword [rbp - 0x18]
ror edx, 2
add ebx, esi
add ebx, eax
add ebx, edi
and ebx, 0x80
je 0x110109118
sub ecx, 0x5e4e273b
sub ebx, 0x6184ef49
ror eax, 3
add edx, 0x3839d315
xor ebx, dword [rbp - 0x20]
add ebx, esi
add ebx, ecx
add ebx, eax
and ebx, 0x20000
je 0x110104b56
ror ebx, 0x14
sub eax, 0xa11f7ed0
xor esi, ecx
ror edi, 2
jmp fcn.110103880

Function at 0x110101fc0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
fiadd word [0x91f87cf9]
out dx, eax
adc ebx, ecx
call [rax]
invalid
out dx, eax
rcr byte [rsi - 0x75], 1