joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007f94
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x75bfe258
xor ebx, dword [rbp - 0x18]
sub edx, 0x99539c47
add ecx, 0x251b0393
add ebx, 0xa09a931d
xor esi, 0x5e2f5c30
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x400000
je 0x18000940d
xor ebx, esi
ror ebx, 0x16
xor edi, 0xb25eafb9
add edi, 0x342e8d3
add ebx, esi
add ebx, edx
add ebx, eax
and ebx, 0x80000000
je 0x1800043d7
ror esi, 0x18
sub ecx, 0xf44e4e64
rol esi, 0x1d
ror eax, 0x18
rol esi, 0x17
add ebx, ecx
add ebx, edx
add ebx, edi
and ebx, 0x800
je 0x180004f6a
sub ebx, 0x61bca4eb
sub eax, 0xbbfe2b7e
add esi, 0x5e2c4df
rol ecx, 0x17
jmp 0x180005c06
add ebx, eax
and ebx, 0x1000
je 0x180005c06
rol eax, 8
add ebx, 0x293387e0
add edi, 0x6d7a814c
xor edx, 0x53b493db
ror ebx, 0x1f
add ebx, esi
add ebx, ecx
and ebx, 0x10000
je 0x180002708
xor edi, edx
rol eax, 6
rol edi, 0x1c
sub eax, 0xc255cc62
xor edi, 0xe0a76c04
jmp 0x180002fdd
mov edi, 0xed8aacc7
mov edx, 0x8a1285d2
mov esi, 0x4483da95
mov ecx, 0xcdc7fca6
mov rsp, rbp
mov dword [rbp - 0x18], 0x627c036c
sub rsp, 0x20
mov ebx, 0xec8a00c1
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
jmp 0x180003bbb

Function at 0x1800080b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and ebx, 4
je 0x1800064c4
add ebx, 0x6dd0d4d5
sub esi, 0xbf575bd7
sub ebx, 0x3accc10f
ror eax, 0x16
add ebx, eax
add ebx, edx
and ebx, 0x8000
je 0x180004f6a
ror ebx, 0xc
rol ebx, 0xf
add ebx, 0xd306359d
rol edi, 0x1c
ror edx, 4
add ebx, ecx
add ebx, eax
add ebx, edx
and ebx, 0x80000000
je 0x180007771
ror edx, 8
add esi, 0xf477699e
rol edx, 0xd
jmp 0x18000518c
Function at 0x180008750
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0xcdc7fca6
mov edi, 0xed8aacc7
mov esi, 0x4483da95
mov edx, 0x8a1285d2
mov rsp, rbp
sub rsp, 0x20
mov dword [rbp - 0x18], 0x627c036c
mov ebx, 0xec8a00c1
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
jmp 0x180003bbb
enter 0xffffffffffffc11c, 0xffffffffffffffcf
adc dword [rcx + 0x7c8c68c1], eax
add ebx, edi
add ebx, eax
add ebx, edx
and ebx, 0x2000000
je 0x180009d05
xor eax, dword [rbp - 0x18]
add edi, 0x96f5a95e
sub ecx, 0x3ed50793
jmp 0x180003737
Function at 0x180009028
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0xbed809fc
xor ebx, dword [rbp - 0x18]
rol esi, 0x10
xor edx, 0xf80ebe4f
sub ebx, 0x55e9c45e
rol edi, 0x1b
ror edi, 0x12
add ebx, edx
add ebx, edi
add ebx, esi
and ebx, 0x2000000
je sym.SspiCli.dll_QueryContextAttributesW
invalid
xor esi, ebx
xor eax, 0xd94b63df
xor edx, 0x4988038c
xor ecx, esi
ror edx, 9
add ebx, esi
add ebx, edi
add ebx, edx
and ebx, 0x10000000
je 0x18000390a
add ecx, 0xaf96afd9
ror edx, 0x14
add eax, 0x8046d47
xor edx, 0xf7fd01a4
xor ecx, 0xa7369ad1
add ebx, eax
add ebx, edx
and ebx, 0x20000000
je 0x18000267c
xor ebx, 0xc3b9ddcb
sub ecx, 0xa74604f7
xor ecx, 0x4e0a1f22
jmp 0x180001838
jmp section..text

Function at 0x180009118
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x41988a19
xor ebx, dword [rbp - 0x18]
xor ebx, 0xed6b8638
xor edx, dword [rbp - 0x18]
rol eax, 0xb
add edi, 0xd766daa7
sub eax, 0xe37d9a75
add ebx, edx
add ebx, ecx
and ebx, 0x4000
je 0x180004249
rol esi, 0x1f
add ecx, 0xb59eb419
sub esi, 0xcc9b83b5
add ebx, ecx
add ebx, esi
and ebx, 0x1000000
je 0x1800090b4
rol eax, 5
rol ecx, 0x19
ror eax, 0x1b
add ebx, esi
add ebx, ecx
and ebx, 0x80000
je 0x1800014e2
rol ebx, 0x12
xor ecx, edx
sub ecx, 0x81d26f29
sub ebx, 0xd447a50d
jmp 0x1800056d9
add dword [rbp - 0x18], 0xcc92905
xor ebx, dword [rbp - 0x18]
ror ecx, 0x12
add edi, 0xd16349c9
xor ecx, 0xb156c5d4
add ebx, 0x74c1ff1e
add ebx, eax
add ebx, esi
and ebx, 0x10000
je 0x180001838
rol edi, 3
ror esi, 0x1f
xor eax, edx
add ebx, eax
add ebx, edx
add ebx, esi
and ebx, 0x200000
je 0x180002a3d
sub eax, 0xa5ec98bf
xor esi, 0x48a3959b
rol ecx, 0x1d
sub ecx, 0x2bf53bf4
add ebx, esi
add ebx, eax
and ebx, 0x40
je 0x180004cce
xor esi, edx
sub esi, 0x54271243
sub eax, 0x975ee7cd
ror edx, 0x18
jmp 0x180006312
add byte [rax], al
je 0x18000a7bd
rol ebx, 0x13
rol edi, 0xf
ror edx, 0x1a
xor esi, 0x118c682
add esi, 0x9cc2c28b
add ebx, edx
add ebx, ecx
and ebx, 0x80000
je 0x18000217e
ror edx, 0x12
rol edx, 0x13
add edx, 0xe89344c2
sub ebx, 0x3042cdcd
add ebx, 0xf2d9097c
jmp 0x18000267c

Function at 0x18000917c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x8a1285d2
mov edi, 0xed8aacc7
mov esi, 0x4483da95
mov rsp, rbp
mov ecx, 0xcdc7fca6
mov dword [rbp - 0x18], 0x627c036c
sub rsp, 0x20
mov ebx, 0xec8a00c1
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
jmp 0x180003bbb
and ebx, 0x2000
je 0x180004cce
xor eax, dword [rbp - 8]
add edx, 0x31e09323
sub ecx, 0x6a8afbf8
xor edi, dword [rbp - 8]
add ebx, eax
add ebx, edx
and ebx, 0x800000
je 0x1800028f6
add ebx, 0xe6f67c8b
rol eax, 0x18
rol eax, 0xc
add edx, 0xbba6d913
rol ecx, 0xd
jmp 0x180006209
Function at 0x18000944c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edi, 0xed8aacc7
mov edx, 0x8a1285d2
mov ebx, 0xec8a00c1
mov rsp, rbp
sub rsp, 0x20
mov dword [rbp - 0x18], 0x627c036c
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
jmp 0x180003bbb

Function at 0x180009a00
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0xb1e0d3ad
xor ebx, dword [rbp - 0x18]
rol esi, 0x1e
add ecx, 0xabfa0392
rol eax, 7
add ebx, eax
add ebx, edx
and ebx, 0x400000
je 0x18000a015
rol edx, 8
ror edx, 0x19
rol ebx, 0x1f
add ebx, edi
add ebx, eax
and ebx, 1
je 0x180003a1c
ror edi, 0x11
xor edx, 0xf0237201
add esi, 0x9daf9388
xor edx, 0x7c439852
rol ecx, 0x1d
add ebx, ecx
add ebx, edi
and ebx, 0x4000000
je 0x18000a5e5
add ebx, 0x34f1d1cf
sub eax, 0x4e8f3303
sub edi, 0xc06fa6c5
xor eax, dword [rbp - 8]
jmp 0x180007aec
mov edi, 0xed8aacc7
mov rsp, rbp
mov edx, 0x8a1285d2
sub rsp, 0x20
mov ebx, 0xec8a00c1
mov esi, 0x4483da95
inc dword [rbp - 8]
mov dword [rbp - 0x18], 0x627c036c
mov ecx, 0xcdc7fca6
mov eax, dword [rbp - 8]
jmp 0x180003bbb
add dword [rbp - 0x18], 0xeef4d304
xor ebx, dword [rbp - 0x18]
ror ebx, 0x13
ror eax, 0x1a
add esi, 0x5fb95fd0
add ebx, eax
add ebx, esi
and ebx, 0x20000
je 0x1800016b5
xor ebx, dword [rbp - 8]
sub eax, 0xa0a25a0a
rol edx, 0x1a
add ecx, 0x956c7cae
add ebx, eax
add ebx, ecx
add ebx, edi
and ebx, 0x10000
je 0x180007282
rol edi, 0x1e
ror eax, 0x16
xor edx, 0xb3f70eea
sub ecx, 0x41184c6a
add eax, 0xe4ee0a79
add ebx, edx
add ebx, ecx
and ebx, 0x400000
je 0x180001838
sub eax, 0x4f4a9cec
rol edi, 0xa
rol ecx, 0x1a
xor esi, ebx
sub edx, 0x3204a5e2
add ebx, eax
add ebx, esi
and ebx, 0x40
je 0x180006446
rol ecx, 0x11
sub edx, 0x36070ad9
add edx, 0xddc4d0aa
rol edi, 0x17
add ebx, ecx
add ebx, esi
and ebx, 0x10
je 0x180001747
ror ecx, 0x18
add edi, 0x2d9f3440
xor edi, dword [rbp - 0x18]
ror esi, 0xc
jmp 0x180006209

Function at 0x180009b40
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, edx
add ebx, esi
and ebx, 0x10000000
je 0x1800063a9
Function at 0x180009b50
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0xcdc7fca6
mov edx, 0x8a1285d2
mov edi, 0xed8aacc7
mov ebx, 0xec8a00c1
mov rsp, rbp
mov esi, 0x4483da95
mov dword [rbp - 0x18], 0x627c036c
sub rsp, 0x20
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
jmp 0x180003bbb
add dword [rbp - 0x18], 0xeb5d88e0
xor ebx, dword [rbp - 0x18]
sub edx, 0x9f06f10b
ror ecx, 0x18
ror esi, 4
add ebx, eax
add ebx, edx
add ebx, ecx
and ebx, 0x200000
je 0x1800043d7
ror ecx, 0x18
rol esi, 0xd
rol ecx, 0xc
rol ebx, 0x17
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 0x80000000
je 0x18000a1b3
add esi, 0x1d9a4cca
xor esi, ecx
add ecx, 0x9661fa8e
ror ecx, 9
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 8
je 0x180001747
add eax, 0x151ae575
sub esi, 0x11ccc73a
xor eax, 0xfe28fefe
rol eax, 0x1e
jmp 0x18000a015
sub eax, 0x7e7e34b2
sub esi, 0x71a0051e
sub ebx, 0xc84553b5
rol ecx, 5
add eax, 0xdb37cab6
jmp 0x18000796c
add dword [rbp - 0x18], 0x7a00cf89
xor ebx, dword [rbp - 0x18]
add ecx, 0xdfc6c014
sub eax, 0x865f3d03
ror ecx, 0x14
add ebx, ecx
add ebx, esi
add ebx, edi
and ebx, 0x20000000
je 0x180001dc6
rol eax, 0x18
ror edx, 0xe
rol edx, 0x1f
sub esi, 0xd071c63a
sub eax, 0x8a31ada1
add ebx, esi
add ebx, ecx
and ebx, 0x200000
je 0x180005b51
rol ebx, 0xf
add ecx, 0x14d3fa3
rol edi, 0x19
xor esi, 0x976d2963
sub esi, 0xcc45f371
add ebx, esi
add ebx, edi
add ebx, edx
and ebx, 0x80000
je 0x1800045e0
xor edi, 0xd3466d7a
xor eax, ecx
sub eax, 0xac2980a8
jmp 0x180001ac3
Function at 0x18000a05c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov ebp, 0x8109c7c1
not edx
cmp ch, al

Function at 0x18000a110
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rdi], cl
test byte [rcx - 0x7e000089], ch
mul byte [rbp + 0x64]
and al, 0x6a
rol eax, 0x1b
ror ecx, 0x15
rol edx, 9
jmp 0x180006667

Function at 0x18000a450
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0xf9bd148d
xor ebx, dword [rbp - 0x18]
ror ebx, 0xb
rol esi, 7
sub edi, 0x1359f60e
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 8
je 0x180009a62
sub edi, 0x2c18da7c
rol eax, 0x11
xor ebx, 0x19242363
xor eax, dword [rbp - 8]
ror ecx, 0xe
add ebx, edi
add ebx, edx
add ebx, ecx
and ebx, 0x800
je 0x180009d05
xor ebx, dword [rbp - 0x18]
ror eax, 0x1f
add edi, 0x1c9dab95
xor edx, ebx
rol esi, 2
add ebx, edx
add ebx, eax
add ebx, edi
and ebx, 0x400000
je 0x180002fdd
rol edi, 0x16
sub edx, 0x93ecdb27
add esi, 0xab033f56
sub eax, 0x1fe712a0
jmp 0x180005324
call 0x138ff67e8
xor ebx, dword [rbp - 0x18]
add ecx, 0xe7a6e6fe
ror ecx, 9
rol ecx, 0xc
ror edx, 0xf
rol ecx, 0x19
add ebx, edx
add ebx, edi
add ebx, esi
and ebx, 0x10
je 0x1800037f9
xor ecx, ebx
ror ebx, 9
add edi, 0x58443131
rol edx, 0x18
sub ebx, 0x8785760a
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x4000
je 0x18000155f
sub ebx, 0x290a386
sub ebx, 0x7be9c73
sub edx, 0x64dddc83
rol ecx, 0x1c
xor ebx, 0xc63418a5
add ebx, edi
add ebx, ecx
and ebx, 0x40000000
je 0x180001ec6
add edx, 0xb8c73ddb
add eax, 0x83788c3d
ror edi, 0x12
jmp 0x1800043d7
Function at 0x18000a990
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x41988a19
xor ebx, dword [rbp - 0x18]
xor ebx, 0xed6b8638
xor edx, dword [rbp - 0x18]
rol eax, 0xb
add edi, 0xd766daa7
sub eax, 0xe37d9a75
add ebx, edx
add ebx, ecx
and ebx, 0x4000
je 0x180004249
rol esi, 0x1f
add ecx, 0xb59eb419
sub esi, 0xcc9b83b5
add ebx, ecx
add ebx, esi
and ebx, 0x1000000
je 0x1800090b4
rol eax, 5
rol ecx, 0x19
ror eax, 0x1b
add ebx, esi
add ebx, ecx
and ebx, 0x80000
je 0x1800014e2
rol ebx, 0x12
xor ecx, edx
sub ecx, 0x81d26f29
sub ebx, 0xd447a50d
jmp 0x1800056d9
add dword [rbp - 0x18], 0xcc92905
xor ebx, dword [rbp - 0x18]
ror ecx, 0x12
add edi, 0xd16349c9
xor ecx, 0xb156c5d4
add ebx, 0x74c1ff1e
add ebx, eax
add ebx, esi
and ebx, 0x10000
je 0x180001838
rol edi, 3
ror esi, 0x1f
xor eax, edx
add ebx, eax
add ebx, edx
add ebx, esi
and ebx, 0x200000
je 0x180002a3d
sub eax, 0xa5ec98bf
xor esi, 0x48a3959b
rol ecx, 0x1d
sub ecx, 0x2bf53bf4
add ebx, esi
add ebx, eax
and ebx, 0x40
je 0x180004cce
xor esi, edx
sub esi, 0x54271243
sub eax, 0x975ee7cd
ror edx, 0x18
jmp 0x180006312
add byte [rax], al
je 0x18000a7bd
rol ebx, 0x13
rol edi, 0xf
ror edx, 0x1a
xor esi, 0x118c682
add esi, 0x9cc2c28b
add ebx, edx
add ebx, ecx
and ebx, 0x80000
je 0x18000217e
ror edx, 0x12
rol edx, 0x13
add edx, 0xe89344c2
sub ebx, 0x3042cdcd
add ebx, 0xf2d9097c
jmp 0x18000267c
Function at 0x18000aa10
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, qword gs:[0x60]
push qword [rdi + 0x18]
pop rdi
mov rdi, qword [rdi + 0x20]
mov rbx, qword [rdi + 0x50]
push 0x18
pop rdx
xor rax, rax
xor rcx, rcx
mov cl, byte [rbx]
cmp ecx, 0x61
jb 0x18000aa10
sub ecx, 0x20
add eax, ecx
ror eax, 9
sub eax, ecx
ror eax, 0x1d
xor eax, ecx
ror eax, 0x10
add eax, ecx
add eax, 0x7cac0000
rol eax, 0x15
sub eax, ecx
xor eax, 0x5e0cd000
ror eax, 0x12
dec rdx
inc rbx
cmp rdx, 0
ja 0x18000aa03
push qword [rdi + 0x20]
pop rcx
mov rdi, qword [rdi]
cmp eax, 0x7c5d1d71
jne 0x18000a9f6
mov qword [rbp - 0x38], rcx
mov rdi, qword [rbp - 0x38]
mov qword [rbp - 8], rdi
mov rdx, rdi
mov edx, dword [rdi + 0x3c]
add rdx, rdi
mov edx, dword [rdx + 0x88]
add rdx, rdi
mov esi, dword [rdx + 0x1c]
add rsi, rdi
mov qword [rbp - 0x10], rsi
mov esi, dword [rdx + 0x20]
add rsi, rdi
mov qword [rbp - 0x20], rsi
mov esi, dword [rdx + 0x24]
add rsi, rdi
mov qword [rbp - 0x18], rsi
mov rdx, 0xf
mov rdi, qword [rbp - 0x20]
mov edi, dword [rdi]
add rdi, qword [rbp - 8]
xor rsi, rsi
xor rcx, rcx
mov cl, byte [rdi]
xor esi, ecx
sub esi, 0xbeb40000
ror esi, 0x12
sub esi, ecx
add esi, 0x9bb45000
rol esi, 0xd
sub esi, ecx
xor esi, 0xabde5000
rol esi, 0xf
xor esi, ecx
sub esi, 0x61979000
ror esi, 7
sub esi, ecx
sub esi, 0xb83ed000
ror esi, 0x14
inc rdi
sub rdx, 1
cmp rdx, 0
ja 0x18000aaa0
mov rdi, qword [rbp - 0x18]
mov edi, dword [rdi]
and rdi, 0xffff
add qword [rbp - 0x20], 4
add qword [rbp - 0x18], 2
cmp esi, 0x80a51ba2
jne 0x18000aa8c
imul rdi, rdi, 4
add rdi, qword [rbp - 0x10]
mov edi, dword [rdi]
add rdi, qword [rbp - 8]
mov qword [rbp - 0x30], rdi
call fcn.18000ab38
invalid
Function at 0x18000ab38
Capabilities:
Encode data using xor

Disassembly:
pop rbx
sub rbx, 0xab2c
mov qword [rbp], rbx
sub rsp, 0x40
push 0xb000
pop rdx
mov rcx, qword [rbp]
lea r9, [rbp - 8]
add rcx, 0x2f418
mov r8, 0x40
mov rdi, qword [rbp - 0x30]
call rdi
add rsp, 0x40
mov rbx, 0xffffffffdc5dec87
push 0xb000
mov rax, qword [rbp]
add rax, 0x2f418
pop rdx
mov ecx, dword [rax]
sub ecx, 0x5bc0000
add ecx, 0x70d22000
ror ecx, 0x10
add ecx, ebx
rol ecx, 2
xor ecx, edx
sub ecx, edx
mov dword [rax], ecx
add rax, 4
sub rdx, 4
cmp edx, 0
ja 0x18000ab8c
mov rbx, qword [rbp]
add rbx, 0x2f418
call rbx
add byte [rax], al
mov eax, ebx
mov rbp, qword [rsp + 0x78]
and eax, 0x1fff0000
cmp eax, 0x90000
je case.0x1800145da.1073740961
test ebx, ebx
jne 0x180014434
mov r13, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x48
pop r15
pop r14
pop r12
pop rsi
ret
cmp ebx, 0xc0000133
jg 0x18001453a
je 0x180014530
cmp ebx, 0xc0000008
jg 0x1800144c6
je 0x1800144be
cmp ebx, 0x80092013
jg 0x1800144aa
cmp ebx, 0x80092012
jge case.0x1800145da.1073740964
cmp ebx, 0x8000000d
je case.0x1800144ee.1073741811
cmp ebx, 0x80092010
je case.0x1800145da.1073740964
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns case.0x1800144ee.1073741802
and eax, 0x1fff0000
cmp eax, 0x90000
je case.0x1800145da.1073740961
mov ebx, 0x80090304
jmp case.0x1800145da.1073740961
cmp ebx, 0x80096001
je case.0x1800145da.1073740964
cmp ebx, 0x800b0110
jmp 0x180014476
mov ebx, r13d
jmp case.0x1800145da.1073740961
lea eax, [rbx + 0x3ffffff3]
cmp eax, 0xf9
ja case.0x1800145da.1073740958
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x1464a]
mov ecx, dword [rdx + rax*4 + 0x1461e]
add rcx, rdx
jmp rcx
mov ebx, 0x8009030d
jmp case.0x1800145da.1073740961
mov ebx, 0x80090300
jmp case.0x1800145da.1073740961
mov ebx, 0x80090308
jmp case.0x1800145da.1073740961
mov ebx, 0x80090306
jmp case.0x1800145da.1073740961
mov ebx, 0x80090321
jmp case.0x1800145da.1073740961
mov ebx, 0x80090302
jmp case.0x1800145da.1073740961
mov ebx, 0x80090324
jmp case.0x1800145da.1073740961
cmp ebx, 0xc00002f9
jg 0x18001458e
je case.0x1800145da.1073740964
lea eax, [rbx + 0x3ffffea5]
cmp eax, 0xe1
ja case.0x1800145da.1073740958
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x1475a]
mov ecx, dword [rdx + rax*4 + 0x14746]
add rcx, rdx
jmp rcx
mov ebx, 0x80090311
jmp case.0x1800145da.1073740961
mov ebx, 0x80090303
jmp case.0x1800145da.1073740961
cmp ebx, 0xc0000320
jg 0x1800145ae
je case.0x1800145da.1073740964
cmp ebx, 0xc00002fe
jne case.0x1800145da.1073740958
mov ebx, 0x8009033f
jmp case.0x1800145da.1073740961
lea eax, [rbx + 0x3ffffca5]
cmp eax, 0xd4
ja case.0x1800145da.1073740958
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x1485e]
mov ecx, dword [rdx + rax*4 + 0x1483e]
add rcx, rdx
jmp rcx
mov ebx, 0x80090357
jmp case.0x1800145da.1073740961
mov ebx, 0x80090362
jmp case.0x1800145da.1073740961
mov ebx, 0x8009030c
jmp case.0x1800145da.1073740961
mov ebx, 0x80090350
jmp case.0x1800145da.1073740961
mov ebx, 0x80090346
jmp case.0x1800145da.1073740961
mov ebx, 0x80090361
jmp case.0x1800145da.1073740961
Function at 0x18000b6f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18002a520]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8, qword [rcx]
mov dword [rbp - 0x50], 0x44434241
mov dword [rbp - 0x4c], 0x48474645
mov dword [rbp - 0x48], 0x4c4b4a49
mov dword [rbp - 0x44], 0x504f4e4d
mov dword [rbp - 0x40], 0x54535251
mov dword [rbp - 0x3c], 0x58575655
mov dword [rbp - 0x38], 0x62615a59
mov dword [rbp - 0x34], 0x66656463
mov dword [rbp - 0x30], 0x6a696867
mov dword [rbp - 0x2c], 0x6e6d6c6b
mov dword [rbp - 0x28], 0x7271706f
mov dword [rbp - 0x24], 0x76757473
mov dword [rbp - 0x20], 0x7a797877
mov dword [rbp - 0x1c], 0x33323130
mov dword [rbp - 0x18], 0x37363534
mov dword [rbp - 0x14], 0x2d233938
cmp edx, 0x3f
ja 0x180014cac
mov eax, edx
movzx edx, byte [rbp + rax - 0x50]
mov word [r8], dx
add qword [rcx], 2
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000dc50
add rsp, 0x50
pop rbp
ret
mov eax, 0x3d
mov word [r8], ax
jmp 0x18000b78e

Function at 0x18000b8f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov esi, edx
mov rbx, r8
mov rbp, rcx
test rcx, rcx
je 0x180014cce
test rbx, rbx
je 0x180014cce
mov qword [rsp + 0x38], r14
xor r14d, r14d
test dword [0x18002ac24], 0x20000000
mov dword [r8], r14d
jne 0x180014cd8
cmp esi, 0x20
ja 0x180014cd8
mov ecx, dword [0x18002ac20]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov dword [rbx], r14d
mov rdi, rax
test rax, rax
jne 0x18000b9a0
lea edx, [rax + 0x30]
lea ecx, [rax + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x18000b9cc
test dword [0x18002ac24], 0x20000000
jne 0x18000b99a
mov ecx, dword [0x18002ac20]
mov rdx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
mov dword [rbx], 1
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, r14d
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov eax, 0x80090300
jmp 0x18000b9b1
mov eax, 0x8009035d
jmp 0x18000b9bb
mov eax, 0x80090300
jmp 0x18000b9b6
Function at 0x18000bc60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
test dword [0x18002ac24], 0x20000000
jne 0x18000bcd5
mov ecx, dword [0x18002ac20]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x18000bcd0
mov rcx, qword [rax + 0x28]
test rcx, rcx
jne 0x18000bcdb
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test dword [0x18002ac24], 0x20000000
jne 0x18000bcd0
mov ecx, dword [0x18002ac20]
xor edx, edx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18000bc98

Function at 0x18000becc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test dword [0x18002ac24], 0x20000000
mov rdi, rcx
jne 0x18000bf52
mov ecx, dword [0x18002ac20]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rbx, rax
and dword [rdi], 0
test rbx, rbx
jne 0x18000bf43
lea edx, [rbx + 0x30]
lea ecx, [rbx + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x18000bf43
test dword [0x18002ac24], 0x20000000
jne 0x18000bf3d
mov ecx, dword [0x18002ac20]
mov rdx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
nop dword [rax + rax]
mov dword [rdi], 1
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor ebx, ebx
jmp 0x18000befa
Function at 0x18000d630
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor edx, edx
mov r8, rcx
cmp dword [rcx], 0x201
mov rax, rcx
je 0x180015c44
cmp dword [rax], 0x200
mov ecx, 0x7ffd
je 0x180015d56
test byte [rax + 0x2c], 3
je 0x18000d671
cmp dword [rax + 8], ecx
ja 0x18000d671
cmp dword [rax + 0x18], ecx
ja 0x18000d671
cmp dword [rax + 0x28], ecx
ja 0x18000d671
mov ecx, edx
jmp fcn.180007120
mov edx, 0xc000000d
jmp 0x18000d66a
cmp word [rcx + 4], 0x30
jb 0x18000d671
mov r9d, dword [rcx + 8]
cmp r9d, 0xfff7
ja 0x18000d671
movzx eax, word [rcx + 4]
cmp r9d, eax
jb 0x18000d671
movzx r10d, word [rcx + 0x20]
movzx ecx, word [rcx + 0x18]
mov r11d, dword [r8 + 0x14]
add r11d, ecx
cmp r11d, ecx
jb 0x18000d671
cmp r11d, r9d
ja 0x18000d671
movzx ecx, word [r8 + 0x10]
mov r11d, dword [r8 + 0xc]
add r11d, ecx
cmp r11d, ecx
jb 0x18000d671
cmp r11d, r9d
ja 0x18000d671
movzx ecx, word [r8 + 0x2c]
mov r11d, dword [r8 + 0x28]
add r11d, ecx
cmp r11d, ecx
jb 0x18000d671
cmp r11d, r9d
ja 0x18000d671
mov ecx, dword [r8 + 0x1c]
lea eax, [r10 + rcx]
cmp eax, r10d
jb 0x18000d671
cmp eax, r9d
ja 0x18000d671
test ecx, ecx
je 0x180015d48
mov r11d, 0x1c
cmp r10d, r11d
jb 0x18000d671
mov eax, dword [r8 + 0x24]
and eax, 0x10
test al, al
jne 0x18000d66a
lea rax, [r8 + rcx]
movzx r9d, word [rax + 2]
cmp r9d, r10d
ja 0x18000d671
cmp r9w, word [rax]
jb 0x18000d671
cmp word [rax], r11w
jb 0x18000d671
movzx r8d, word [rax + 0x18]
add r8d, dword [rax + 0x14]
cmp r8d, dword [rax + 0x14]
jb 0x18000d671
cmp r8d, r9d
jmp 0x18000d668
test r10d, r10d
je 0x18000d66a
jmp 0x18000d671
cmp dword [r8 + 4], 0x48
jb 0x18000d671
lea rax, [r8 + 8]
cmp dword [r8 + 0x40], ecx
ja 0x18000d671
jmp 0x18000d655