joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005860
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
lahf
xor ebx, dword [rbp - 8]
xor esi, dword [rbp - 0x10]
rol ebx, 0x12
xor ebx, eax
xor eax, edi
rol esi, 0xf
add ebx, edx
add ebx, edi
and ebx, 0x200000
je 0x180009551
sub edx, 0xc05e7aa5
xor ebx, 0xa740b456
rol eax, 0xd
ror eax, 0x19
add ebx, edx
add ebx, ecx
and ebx, 0x2000
je 0x1800057f8
sub edi, 0x3abf061e
xor edx, 0x354a8fd6
ror ecx, 0xb
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x8000000
je 0x180007b7c
add ebx, 0x95ec12fc
rol edx, 0x14
rol edi, 0xd
add ecx, 0xff0986
rol edi, 0x13
jmp 0x180001384
mov ebx, 0x44930c65
mov esi, 0x21d39701
mov rsp, rbp
mov edi, 0xe6bd2129
sub rsp, 0x20
mov dword [rbp - 8], 0x1515a8c0
mov ecx, 0x210e4c2d
mov edx, 0xf78cc2fe
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp 0x180006430
add dword [rbp - 8], 0x37d309cc
xor ebx, dword [rbp - 8]
sub esi, 0x88793b83
rol esi, 0x15
rol esi, 0xd
xor esi, dword [rbp - 8]
add esi, 0x65f0cb0f
add ebx, ecx
add ebx, edx
and ebx, 4
je 0x180007483
rol ecx, 5
ror eax, 2
sub ecx, 0xa903d458
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x1000
je 0x180007a6b
xor edi, 0x68cfd193
xor edi, ebx
rol ecx, 0x12
add ebx, edi
add ebx, eax
and ebx, 0x100000
je 0x18000413c
rol eax, 3
add eax, 0x110d2a32
ror ecx, 0xf
add esi, 0x255a75b3
jmp 0x180003e2c
add dword [rbp - 8], 0xd1d4ede9
xor ebx, dword [rbp - 8]
sub ecx, 0xa0ccd0a4
add esi, 0x4915f18f
sub ebx, 0x5aca52b2
ror edx, 0xf
ror edi, 6
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x200000
je 0x1800036be
ror edx, 0x19
ror edi, 6
rol eax, 0x16
rol esi, 0x12
add ebx, edx
add ebx, esi
and ebx, 0x40
je 0x180002413
add edx, 0x3c2495d6
ror edi, 0xb
add ecx, 0xca943ec5
xor esi, dword [rbp - 8]
add ebx, edi
add ebx, edx
and ebx, 0x10
je 0x180003d23
xor ebx, eax
sub ecx, 0x1829d9fc
sub eax, 0x31d0b48e
rol ecx, 0x17
xor edi, 0xa3347f35
jmp 0x180007f1d
add dword [rbp - 8], 0x193785c4
xor ebx, dword [rbp - 8]
sub ecx, 0xa831e2ff
rol ecx, 0x1c
add ebx, 0xb0b78772
sub eax, 0x847c2ca0
add ebx, edx
add ebx, eax
add ebx, esi
and ebx, 0x400000
je 0x18000a23f
add esi, 0x2e4f7b32
rol ecx, 0x19
add ecx, 0x1c79e8f9
xor ecx, 0xfb40e1ce
add ebx, esi
add ebx, edi
and ebx, 0x2000000
je 0x1800036be
xor edx, ecx
xor ecx, 0x2071323
add ebx, 0x7ff890e5
add eax, 0x83d99afe
ror eax, 9
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 0x800
je 0x180009b76
xor ebx, 0x30eedf6a
rol ecx, 0x1c
ror ebx, 0xf
sub ecx, 0x15e2e10
rol esi, 0x16
jmp 0x180004714
Function at 0x180005a10
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add ebx, edx
add ebx, eax
and ebx, 0x2000
je 0x180002b9c
rol ebx, 0xb
rol edx, 5
rol edi, 0xa
add ebx, eax
add ebx, esi
and ebx, 2
je 0x180002413
xor eax, esi
rol ecx, 5
rol edi, 8
add ebx, 0xb289193d
add ebx, edx
add ebx, esi
add ebx, eax
and ebx, 0x20000000
je 0x180006a21
xor eax, 0x57900b2
add eax, 0xc279b827
sub esi, 0xd4da63ca
sub eax, 0xa7b23c9d
jmp 0x180005e50
add dword [rbp - 8], 0xea2f5312
xor ebx, dword [rbp - 8]
add eax, 0xb02b8bff
add edi, 0x36b27378
add edx, 0x8580b1ab
sub edi, 0x61f4adc3
add ebx, edi
add ebx, edx
add ebx, ecx

Function at 0x180005e78
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and ebx, 0x800000
je 0x180005874
rol ecx, 0xf
sub esi, 0xdae37342
ror edx, 0x1f
add ecx, 0xd51456f5
add ebx, edx
add ebx, edi
add ebx, eax
and ebx, 0x100000
je 0x180007d0e
sub esi, 0xa907b036
rol eax, 0x1a
xor esi, ebx
sub ebx, 0x1ca03914
sub eax, 0xfa668334
add ebx, edi
add ebx, eax
add ebx, edx
and ebx, 0x400000
je 0x180009754
ror edi, 0xb
xor ecx, dword [rbp - 8]
add edx, 0x2adb9600
jmp 0x180007041

Function at 0x180005e94
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
and ebx, 0x800000
je 0x180005874
rol ecx, 0xf
sub esi, 0xdae37342
ror edx, 0x1f
add ecx, 0xd51456f5
add ebx, edx
add ebx, edi
add ebx, eax
and ebx, 0x100000
je 0x180007d0e
sub esi, 0xa907b036
rol eax, 0x1a
xor esi, ebx
sub ebx, 0x1ca03914
sub eax, 0xfa668334
add ebx, edi
add ebx, eax
add ebx, edx
and ebx, 0x400000
je 0x180009754
ror edi, 0xb
xor ecx, dword [rbp - 8]
add edx, 0x2adb9600
jmp 0x180007041

Function at 0x180005eec
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub edx, 0x30d1e576
rol edx, 8
rol edx, 0x1c
xor ecx, eax
add ebx, edi
add ebx, esi
and ebx, 0x1000
je 0x180008e74
ror ecx, 0x1c
ror esi, 0xb
rol esi, 0x1e
add ebx, esi
add ebx, ecx
and ebx, 0x800
je 0x18000751f
rol eax, 7
add esi, 0x6e7bbd84
sub edi, 0x2ca7455d
add ebx, esi
add ebx, edi
and ebx, 4
je 0x1800024d1
sub edi, 0x3941dc8d
xor esi, ebx
ror edi, 0x14
add edi, 0xb57c2b29
rol ecx, 2
jmp 0x180001fea
Function at 0x1800068b4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
out 0x8b, eax
mov bh, 0xd
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 1
je 0x18000a1bf
sub edi, 0xb627c7ad
ror esi, 8
add eax, 0x3b27762d
ror edi, 0x1d
rol ebx, 3
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x8000000
je fcn.18000a5a8
rol eax, 0x1d
add edi, 0xff181e63
ror ebx, 0xb
xor ebx, dword [rbp - 8]
jmp 0x18000151e

Function at 0x180006944
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
je 0x180006b46
xor esi, dword [rbp - 0x10]
sub ecx, 0xeff79950
rol edi, 0x11
sub ecx, 0x74dbf1d6
add ebx, ecx
add ebx, edi
and ebx, 0x800000
je 0x180001499
sub eax, 0x4ea377f7
rol edi, 0xa
add esi, 0xbe2092c8
jmp 0x180009551

Function at 0x180006a78
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
ror edx, 0x1a
sub ebx, 0xf6aa98ef
sub edx, 0x7fc3e63c
add ebx, edx
add ebx, edi
and ebx, 0x80
je 0x180009b76
xor esi, 0x879cccea
add eax, 0x826951a5
xor edx, eax
add ecx, 0xb87db802
sub esi, 0xf05cf4fd
jmp 0x18000151e

Function at 0x180006d70
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0x77eb38fe
xor ebx, dword [rbp - 8]
add edx, 0x8af3cb44
sub edi, 0x97c6b99f
rol esi, 0x1f
add ebx, edx
add ebx, edi
and ebx, 0x1000
je 0x1800036be
ror ecx, 0x10
rol esi, 4
add ecx, 0x6cecd50b
sub edi, 0x402a2dc8
ror eax, 0x13
add ebx, edx
add ebx, ecx
add ebx, edi
and ebx, 2
je 0x180008d60
ror ecx, 0x19
sub edx, 0x3b7300b8
add ecx, 0x1bf5f5a
add ebx, eax
add ebx, ecx
add ebx, edx
and ebx, 0x200000
je 0x180003db3
sub eax, 0x7040f7f8
sub ebx, 0xaf70848f
add edi, 0x80b81ee2
ror ecx, 0x11
jmp 0x1800020f8
jmp 0x180006b46
Function at 0x180007424
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add dword [rbp - 8], 0x5d5d095
xor ebx, dword [rbp - 8]
ror ebx, 8
sub edi, 0x7ee69a00
xor edi, 0x8df44d81
xor ebx, 0x2fbd333a
add edx, 0x23ed5566
add ebx, eax
add ebx, esi
and ebx, 0x40000000
je 0x180005c29
sub eax, 0x820f5e8
xor ebx, dword [rbp - 0x10]
add ecx, 0xe1c7104a
rol edx, 0x11
ror esi, 0x1d
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x20
je 0x18000a0bf
rol esi, 0x1f
rol esi, 0x1f
add edi, 0x4b1b63a6
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 0x20
je 0x1800099de
rol eax, 6
ror edx, 0x19
sub edx, 0x90b587a1
rol ecx, 0xd
ror ecx, 0x16
jmp 0x180009551
add dword [rbp - 8], 0xa453ef65
xor ebx, dword [rbp - 8]
add eax, 0xc30f99b1
add eax, 0xb6c3e0d
xor ecx, 0x9fcb8b67
add ebx, esi
add ebx, edx
and ebx, 0x400
add al, 0
add byte [rdi], cl
test byte [rdi - 0x61], dl
invalid
invalid
ror ebx, 0x1a
ror ebx, 2
add edi, 0xc0f37d5f
rol eax, 0x17
rol ebx, 6
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x80000000
je 0x1800072e3
rol edi, 0x1b
add edi, 0xedbae5ce
rol ebx, 0x1c
add ebx, esi
add ebx, edx
add ebx, eax
and ebx, 0x1000
je 0x180002731
ror ebx, 5
ror edi, 0x18
add eax, 0xa75a8c79
ror ecx, 9
jmp 0x180002078
xor esi, edi
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x40000
je 0x180002413
rol ecx, 5
add ecx, 0xc1a1c2a4
add edx, 0xff896406
rol ecx, 0x11
add ebx, edi
add ebx, edx
add ebx, ecx
and ebx, 0x20000
je 0x180007401
sub esi, 0x54959b1b
add edi, 0xfd2ec22d
add ebx, 0xb9f8cc14
rol edx, 0x19
add ebx, ecx
add ebx, edx
and ebx, 0x200
je 0x180002243
rol edi, 0x14
rol edi, 8
ror edx, 0x18
xor eax, esi
sub edi, 0xe1f30265
jmp 0x180005375
Function at 0x180007ba8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add dword [rbp - 8], 0x255ad9e9
xor ebx, dword [rbp - 8]
pop rbp
clc
xor edi, ebx
sub esi, 0x4f37659e
rol eax, 0x1a
add ebx, edi
add ebx, edx
and ebx, 0x10000000
je 0x180002078
sub eax, 0x1c343a66
add ecx, 0x7a94980d
ror esi, 0x17
add eax, 0xecbae37c
add esi, 0xabf86706
add ebx, esi
add ebx, edx
add ebx, edi
and ebx, 0x2000
je 0x180009754
xor edx, dword [rbp - 8]
add esi, 0xdf38b0c6
ror ebx, 0x1a
ror ebx, 0x1b
add ebx, edx
add ebx, edi
and ebx, 2
je 0x180007d0e
sub ebx, 0xcd00ca64
sub edx, 0xd39307a5
add edi, 0xaed0dfd
jmp 0x180007b7c
add dword [rbp - 8], 0x5b4157
xor ebx, dword [rbp - 8]
add ecx, 0xc26bdce1
add ecx, 0xf299b070
sub edx, 0xc3331b57
ror esi, 0x10
sub ebx, 0x8c30ef6d
add ebx, edx
add ebx, ecx
and ebx, 0x400000
je 0x180006175
ror esi, 0xc
sub edi, 0x548a1d0c
ror ebx, 9
xor esi, 0xba5608c5
add ebx, ecx
add ebx, eax
and ebx, 0x200000
je 0x1800099de
add ebx, 0x395eaa1f
xor esi, dword [rbp - 8]
sub ebx, 0x300dbd1c
ror eax, 0x10
add ebx, eax
add ebx, edi
and ebx, 0x10000
je 0x1800072e3
rol esi, 2
ror edx, 6
sub ebx, 0xd9ffd67e
xor edi, ecx
jmp 0x180009b76
mov edx, 0xf78cc2fe
mov rsp, rbp
mov ebx, 0x44930c65
mov esi, 0x21d39701
mov dword [rbp - 8], 0x1515a8c0
test al, 0x15
adc eax, 0xe4c2db9
and dword [rdi - 0x1942ded7], edi
sub rsp, 0x20
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp 0x180006430
and ebx, 2
je 0x1800099de
xor ecx, dword [rbp - 0x10]
add edx, 0xcbdd9878
rol ecx, 4
sub ecx, 0x20730ef5
add edi, 0xd83e15f2
add ebx, eax
add ebx, ecx
and ebx, 0x1000000
je 0x180004a0c
xor ecx, edi
add edi, 0x7c5bcd9d
add ecx, 0x9e76d900
xor edi, 0x73116833
add ebx, edx
add ebx, eax
and ebx, 0x80000000
je 0x18000151e
rol edx, 0x16
xor eax, dword [rbp - 8]
sub ecx, 0xdce91be6
rol ebx, 0x1f
jmp 0x180001384
add dword [rbp - 8], 0xb0fad745
xor ebx, dword [rbp - 8]
ror ebx, 0x12
add eax, 0x9a41f741
rol edx, 8
add esi, 0x3aa6a409
add ebx, eax
add ebx, ecx
add ebx, esi
and ebx, 0x200
je 0x180001fea
xor ebx, 0xeff925f8
rol eax, 5
ror edi, 0x1e
xor esi, 0x61112a14
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x8000000
je 0x180005c29
add eax, 0xeb2b3692
sub ebx, 0xba4d9ba8
ror edx, 0x1b
add ebx, edx
add ebx, eax
and ebx, 0x400000
je 0x180007e2e
add ecx, 0x3e0066c5
rol edi, 0x14
xor ecx, 0xf4534ef
ror ecx, 0x14
sub edx, 0xc964de83
jmp 0x180007483

Function at 0x180007cb0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add cl, al
rcl dword [0x1011e6b3a], 0x4f
in eax, 0x81
jmp 0x144f68472
Function at 0x180007d30
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add dword [rbp - 8], 0x5d5d095
xor ebx, dword [rbp - 8]
ror ebx, 8
sub edi, 0x7ee69a00
xor edi, 0x8df44d81
xor ebx, 0x2fbd333a
add edx, 0x23ed5566
add ebx, eax
add ebx, esi
and ebx, 0x40000000
je 0x180005c29
sub eax, 0x820f5e8
xor ebx, dword [rbp - 0x10]
add ecx, 0xe1c7104a
rol edx, 0x11
ror esi, 0x1d
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x20
je 0x18000a0bf
rol esi, 0x1f
rol esi, 0x1f
add edi, 0x4b1b63a6
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 0x20
je 0x1800099de
rol eax, 6
ror edx, 0x19
sub edx, 0x90b587a1
rol ecx, 0xd
ror ecx, 0x16
jmp 0x180009551
add dword [rbp - 8], 0xa453ef65
xor ebx, dword [rbp - 8]
add eax, 0xc30f99b1
add eax, 0xb6c3e0d
xor ecx, 0x9fcb8b67
add ebx, esi
add ebx, edx
and ebx, 0x400
add al, 0
add byte [rdi], cl
test byte [rdi - 0x61], dl
invalid
invalid
ror ebx, 0x1a
ror ebx, 2
add edi, 0xc0f37d5f
rol eax, 0x17
rol ebx, 6
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x80000000
je 0x1800072e3
rol edi, 0x1b
add edi, 0xedbae5ce
rol ebx, 0x1c
add ebx, esi
add ebx, edx
add ebx, eax
and ebx, 0x1000
je 0x180002731
ror ebx, 5
ror edi, 0x18
add eax, 0xa75a8c79
ror ecx, 9
jmp 0x180002078
xor esi, edi
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x40000
je 0x180002413
rol ecx, 5
add ecx, 0xc1a1c2a4
add edx, 0xff896406
rol ecx, 0x11
add ebx, edi
add ebx, edx
add ebx, ecx
and ebx, 0x20000
je 0x180007401
sub esi, 0x54959b1b
add edi, 0xfd2ec22d
add ebx, 0xb9f8cc14
rol edx, 0x19
add ebx, ecx
add ebx, edx
and ebx, 0x200
je 0x180002243
rol edi, 0x14
rol edi, 8
ror edx, 0x18
xor eax, esi
sub edi, 0xe1f30265
jmp 0x180005375
Function at 0x180009240
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0x255ad9e9
xor ebx, dword [rbp - 8]
pop rbp
clc
xor edi, ebx
sub esi, 0x4f37659e
rol eax, 0x1a
add ebx, edi
add ebx, edx
and ebx, 0x10000000
je 0x180002078
sub eax, 0x1c343a66
add ecx, 0x7a94980d
ror esi, 0x17
add eax, 0xecbae37c
add esi, 0xabf86706
add ebx, esi
add ebx, edx
add ebx, edi
and ebx, 0x2000
je 0x180009754
xor edx, dword [rbp - 8]
add esi, 0xdf38b0c6
ror ebx, 0x1a
ror ebx, 0x1b
add ebx, edx
add ebx, edi
and ebx, 2
je 0x180007d0e
sub ebx, 0xcd00ca64
sub edx, 0xd39307a5
add edi, 0xaed0dfd
jmp 0x180007b7c
add dword [rbp - 8], 0x5b4157
xor ebx, dword [rbp - 8]
add ecx, 0xc26bdce1
add ecx, 0xf299b070
sub edx, 0xc3331b57
ror esi, 0x10
sub ebx, 0x8c30ef6d
add ebx, edx
add ebx, ecx
and ebx, 0x400000
je 0x180006175
ror esi, 0xc
sub edi, 0x548a1d0c
ror ebx, 9
xor esi, 0xba5608c5
add ebx, ecx
add ebx, eax
and ebx, 0x200000
je 0x1800099de
add ebx, 0x395eaa1f
xor esi, dword [rbp - 8]
sub ebx, 0x300dbd1c
ror eax, 0x10
add ebx, eax
add ebx, edi
and ebx, 0x10000
je 0x1800072e3
rol esi, 2
ror edx, 6
sub ebx, 0xd9ffd67e
xor edi, ecx
jmp 0x180009b76
mov edx, 0xf78cc2fe
mov rsp, rbp
mov ebx, 0x44930c65
mov esi, 0x21d39701
mov dword [rbp - 8], 0x1515a8c0
test al, 0x15
adc eax, 0xe4c2db9
and dword [rdi - 0x1942ded7], edi
sub rsp, 0x20
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp 0x180006430
and ebx, 2
je 0x1800099de
xor ecx, dword [rbp - 0x10]
add edx, 0xcbdd9878
rol ecx, 4
sub ecx, 0x20730ef5
add edi, 0xd83e15f2
add ebx, eax
add ebx, ecx
and ebx, 0x1000000
je 0x180004a0c
xor ecx, edi
add edi, 0x7c5bcd9d
add ecx, 0x9e76d900
xor edi, 0x73116833
add ebx, edx
add ebx, eax
and ebx, 0x80000000
je 0x18000151e
rol edx, 0x16
xor eax, dword [rbp - 8]
sub ecx, 0xdce91be6
rol ebx, 0x1f
jmp 0x180001384
add dword [rbp - 8], 0xb0fad745
xor ebx, dword [rbp - 8]
ror ebx, 0x12
add eax, 0x9a41f741
rol edx, 8
add esi, 0x3aa6a409
add ebx, eax
add ebx, ecx
add ebx, esi
and ebx, 0x200
je 0x180001fea
xor ebx, 0xeff925f8
rol eax, 5
ror edi, 0x1e
xor esi, 0x61112a14
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x8000000
je 0x180005c29
add eax, 0xeb2b3692
sub ebx, 0xba4d9ba8
ror edx, 0x1b
add ebx, edx
add ebx, eax
and ebx, 0x400000
je 0x180007e2e
add ecx, 0x3e0066c5
rol edi, 0x14
xor ecx, 0xf4534ef
ror ecx, 0x14
sub edx, 0xc964de83
jmp 0x180007483
Function at 0x180009790
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add dword [rbp - 8], 0x255ad9e9
xor ebx, dword [rbp - 8]
pop rbp
clc
xor edi, ebx
sub esi, 0x4f37659e
rol eax, 0x1a
add ebx, edi
add ebx, edx
and ebx, 0x10000000
je 0x180002078
sub eax, 0x1c343a66
add ecx, 0x7a94980d
ror esi, 0x17
add eax, 0xecbae37c
add esi, 0xabf86706
add ebx, esi
add ebx, edx
add ebx, edi
and ebx, 0x2000
je 0x180009754
xor edx, dword [rbp - 8]
add esi, 0xdf38b0c6
ror ebx, 0x1a
ror ebx, 0x1b
add ebx, edx
add ebx, edi
and ebx, 2
je 0x180007d0e
sub ebx, 0xcd00ca64
sub edx, 0xd39307a5
add edi, 0xaed0dfd
jmp 0x180007b7c
add dword [rbp - 8], 0x5b4157
xor ebx, dword [rbp - 8]
add ecx, 0xc26bdce1
add ecx, 0xf299b070
sub edx, 0xc3331b57
ror esi, 0x10
sub ebx, 0x8c30ef6d
add ebx, edx
add ebx, ecx
and ebx, 0x400000
je 0x180006175
ror esi, 0xc
sub edi, 0x548a1d0c
ror ebx, 9
xor esi, 0xba5608c5
add ebx, ecx
add ebx, eax
and ebx, 0x200000
je 0x1800099de
add ebx, 0x395eaa1f
xor esi, dword [rbp - 8]
sub ebx, 0x300dbd1c
ror eax, 0x10
add ebx, eax
add ebx, edi
and ebx, 0x10000
je 0x1800072e3
rol esi, 2
ror edx, 6
sub ebx, 0xd9ffd67e
xor edi, ecx
jmp 0x180009b76
mov edx, 0xf78cc2fe
mov rsp, rbp
mov ebx, 0x44930c65
mov esi, 0x21d39701
mov dword [rbp - 8], 0x1515a8c0
test al, 0x15
adc eax, 0xe4c2db9
and dword [rdi - 0x1942ded7], edi
sub rsp, 0x20
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp 0x180006430
and ebx, 2
je 0x1800099de
xor ecx, dword [rbp - 0x10]
add edx, 0xcbdd9878
rol ecx, 4
sub ecx, 0x20730ef5
add edi, 0xd83e15f2
add ebx, eax
add ebx, ecx
and ebx, 0x1000000
je 0x180004a0c
xor ecx, edi
add edi, 0x7c5bcd9d
add ecx, 0x9e76d900
xor edi, 0x73116833
add ebx, edx
add ebx, eax
and ebx, 0x80000000
je 0x18000151e
rol edx, 0x16
xor eax, dword [rbp - 8]
sub ecx, 0xdce91be6
rol ebx, 0x1f
jmp 0x180001384
add dword [rbp - 8], 0xb0fad745
xor ebx, dword [rbp - 8]
ror ebx, 0x12
add eax, 0x9a41f741
rol edx, 8
add esi, 0x3aa6a409
add ebx, eax
add ebx, ecx
add ebx, esi
and ebx, 0x200
je 0x180001fea
xor ebx, 0xeff925f8
rol eax, 5
ror edi, 0x1e
xor esi, 0x61112a14
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x8000000
je 0x180005c29
add eax, 0xeb2b3692
sub ebx, 0xba4d9ba8
ror edx, 0x1b
add ebx, edx
add ebx, eax
and ebx, 0x400000
je 0x180007e2e
add ecx, 0x3e0066c5
rol edi, 0x14
xor ecx, 0xf4534ef
ror ecx, 0x14
sub edx, 0xc964de83
jmp 0x180007483

Function at 0x180009d30
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub eax, 0x2ba6b0d2
rol ebx, 0x11
sub edx, 0xde498e93
jmp 0x1800093c4

Function at 0x180009de8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
lock add dword [rax], eax
add byte [rax], al
mov esi, 0x21d39701
mov ecx, 0x210e4c2d
mov ebx, 0x44930c65
mov eax, dword [rbp - 0x10]
jmp 0x180006430
Function at 0x18000a5a8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0xf78cc2fe
mov esi, 0x21d39701
mov ecx, 0x210e4c2d
mov edi, 0xe6bd2129
mov rsp, rbp
mov dword [rbp - 8], 0x1515a8c0
sub rsp, 0x20
mov ebx, 0x44930c65
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp 0x180006430

Function at 0x18000a85c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
rol esi, 0x13
xor eax, esi
rol esi, 0x14
xor edi, ebx
rol eax, 0x15
jmp 0x18000151e

Function at 0x18000a934
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
sub eax, 0x67bfe97f
add ebx, esi
add ebx, ecx
and ebx, 0x4000
je 0x180005375
sub ecx, 0xdd90766
xor edx, 0x410bf77
xor edx, 0x9fd0d655
xor edi, edx
ror ecx, 5
add ebx, eax
add ebx, edi
add ebx, esi
and ebx, 0x40000
je 0x180006a21
sub edi, 0x13dff9e7
add eax, 0x70599aff
xor ebx, 0x57e30b78
jmp 0x18000413c

Function at 0x18000a984
Capabilities:
Access peb ldr_data
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub eax, 0x67bfe97f
add ebx, esi
add ebx, ecx
and ebx, 0x4000
je 0x180005375
sub ecx, 0xdd90766
xor edx, 0x410bf77
xor edx, 0x9fd0d655
xor edi, edx
ror ecx, 5
add ebx, eax
add ebx, edi
add ebx, esi
and ebx, 0x40000
je 0x180006a21
sub edi, 0x13dff9e7
add eax, 0x70599aff
xor ebx, 0x57e30b78
jmp 0x18000413c
Function at 0x18000c2e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
lea rax, [0x1800c9030]
xor r15d, r15d
mov r14d, 2
mov qword [rcx], rax
mov dword [rcx + 0x30], r15d
lea rsi, [rcx + 0x40]
mov rbx, rcx
mov edi, r14d
mov rcx, rsi
call fcn.18000ce00
add rsi, 0x10
sub rdi, 1
jne 0x18000c319
mov qword [rbx + 0x68], r15
mov qword [rbx + 0x70], r15
mov dword [rbx + 0x38], r15d
mov qword [rbx + 0x7c], r15
mov dword [rbx + 0x78], r15d
mov qword [rbx + 0x60], r15
cmp dword [rbx + 0x30], r15d
jne 0x18000c35e
lea rcx, [rbx + 8]
call qword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
test eax, eax
js 0x18000c35e
mov dword [rbx + 0x30], 1
lea rax, [rbx + 0xa0]
mov qword [rbx + 0x90], 0x11
mov qword [rbx + 0x88], r15
mov ecx, 0xffffffff
mov qword [rbx + 0x98], r15
mov qword [rax + 8], rax
mov qword [rax], rax
mov eax, dword [rbx + 0x90]
shl rax, 3
cmp rax, rcx
ja 0x18000c3d7
mov ecx, eax
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1800371f0
mov edx, r15d
mov qword [rbx + 0x88], rdi
cmp dword [rbx + 0x90], r15d
jbe 0x18000c3d7
mov rax, qword [rbx + 0x88]
mov ecx, edx
inc edx
mov qword [rax + rcx*8], r15
cmp edx, dword [rbx + 0x90]
jb 0x18000c3c0
lea rax, fcn.18000c4b0
mov dword [rbx + 0xb0], r15d
mov qword [rbx], rax
lea rdi, [rbx + 0xf0]
mov dword [rbx + 0xe0], r15d
mov rcx, rdi
call fcn.18000ce00
add rdi, 0x10
sub r14, 1
jne 0x18000c3f6
mov qword [rbx + 0x118], r15
mov qword [rbx + 0x120], r15
mov dword [rbx + 0xe8], r15d
mov qword [rbx + 0x12c], r15
mov dword [rbx + 0x128], r15d
mov qword [rbx + 0x110], r15
cmp dword [rbx + 0xe0], r15d
jne 0x18000c456
lea rcx, [rbx + 0xb8]
call qword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
test eax, eax
js 0x18000c456
mov dword [rbx + 0xe0], 1
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
shr eax, 3
mov dword [rbx + 0x13c], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov dword [rbx + 0x138], eax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc0000017
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_RaiseException]