joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033060
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
movsxd r12, edx
mov r15, rcx
xor r13d, r13d
mov rdi, r12
shl rdi, 4
add rdi, qword [rcx + 0x18]
mov rax, qword [rdi + 8]
test rax, rax
je 0x140033095
lock inc dword [rax + 8]
mov rsi, qword [rdi]
mov qword [rsp + 0x30], rsi
mov rdi, qword [rdi + 8]
mov rbx, rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r12d
test rdi, rdi
je 0x1400330c6
lock inc dword [rdi + 8]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
mov rax, qword [rcx]
lea rbp, [rax + r12*8]
mov ecx, select
call fcn.140079d48
mov r14, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x140033167
mov ecx, 0x20
call fcn.140079d48
test rax, rax
je 0x14003312c
mov qword [rax], r15
mov dword [rax + 8], r12d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r13
test rdi, rdi
je 0x140033122
lock inc dword [rdi + 8]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
jmp 0x14003312f
mov rax, r13
mov qword [rsp + 0xb0], rax
lea rdi, [r14 + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x14002db80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r14], rax
test rax, rax
je 0x14003321e
jmp 0x14003316a
mov r14, r13
mov rcx, qword [rbp]
mov qword [rbp], r14
test rcx, rcx
je 0x14003318f
cmp dword [rcx + 8], 0
je 0x140033184
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov edx, select
call fcn.140079d84
nop
mov edi, 0xffffffff
test rbx, rbx
je 0x1400331d3
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400331ce
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400331ce
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400331d3
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140033206
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140033206
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140033206
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rdi], r13d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400350d0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400b44c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r9
mov rbx, r8
mov r15, rdx
mov r14, rcx
xor r12d, r12d
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmm0, xmmword [0x140085750]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [0x140085760]
movups xmmword [rbp - 0x28], xmm1
mov ecx, r12d
mov eax, edx
sub eax, r14d
add dword [rbp - 0x48], eax
mov edx, r12d
nop word [rax + rax]
add ecx, dword [rbp + rdx*4 - 0x48]
mov dword [rbp + rdx*4 - 0x48], ecx
cmp ecx, 0x10000
jb 0x140035172
shr ecx, 0x10
mov word [rbp + rdx*4 - 0x46], r12w
inc rdx
cmp rdx, 4
jb 0x140035150
mov rsi, qword [rbp - 0x58]
cmp r14, r15
je 0x1400351b4
nop dword [rax + rax]
cmp rsi, qword [rbp - 0x50]
je 0x140035199
movzx eax, byte [r14]
mov byte [rsi], al
mov rsi, qword [rbp - 0x58]
inc rsi
mov qword [rbp - 0x58], rsi
jmp 0x1400351ac
mov r8, r14
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.14000ee20
mov rsi, qword [rbp - 0x58]
inc r14
cmp r14, r15
jne 0x140035180
mov r15, r12
mov rax, rsi
mov r14, qword [rbp - 0x60]
sub rax, r14
cmp rax, 0x40
jb 0x1400351fc
nop word [rax + rax]
lea rdx, [r14 + r15]
lea r8, [rdx + 0x40]
lea rcx, [rbp - 0x38]
call fcn.140034800
add r15, 0x40
mov rsi, qword [rbp - 0x58]
mov rcx, rsi
mov r14, qword [rbp - 0x60]
sub rcx, r14
lea rax, [r15 + 0x40]
cmp rax, rcx
jbe 0x1400351d0
lea rdx, [r14 + r15]
cmp r14, rdx
je 0x14003521b
sub rsi, rdx
mov r8, rsi
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + r14]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x60]
call fcn.140035540
lea r9, [rbp - 0x38]
mov r8, r12
nop dword [rax + rax]
cmp rbx, rdi
je 0x140035256
mov ecx, 3
sub cl, r8b
shl cl, 3
mov edx, dword [r9]
shr edx, cl
mov rax, rbx
inc rbx
mov byte [rax], dl
inc r8
cmp r8, 4
jb 0x140035230
add r9, 4
lea rax, [rbp - 0x18]
cmp r9, rax
jne 0x140035228
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400352a0
mov rdx, qword [rbp - 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003529b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003529b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079d84
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14007a0e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400352d0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400b44c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor r12d, r12d
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmm0, xmmword [0x140085750]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [0x140085760]
movups xmmword [rbp - 0x28], xmm1
mov ecx, r12d
mov eax, edx
sub eax, r14d
add dword [rbp - 0x48], eax
mov edx, r12d
add ecx, dword [rbp + rdx*4 - 0x48]
mov dword [rbp + rdx*4 - 0x48], ecx
cmp ecx, 0x10000
jb 0x140035362
shr ecx, 0x10
mov word [rbp + rdx*4 - 0x46], r12w
inc rdx
cmp rdx, 4
jb 0x140035340
mov rsi, qword [rbp - 0x58]
cmp r14, rbx
je 0x1400353a4
nop dword [rax + rax]
cmp rsi, qword [rbp - 0x50]
je 0x140035389
movzx eax, byte [r14]
mov byte [rsi], al
mov rsi, qword [rbp - 0x58]
inc rsi
mov qword [rbp - 0x58], rsi
jmp 0x14003539c
mov r8, r14
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.14000ee20
mov rsi, qword [rbp - 0x58]
inc r14
cmp r14, rbx
jne 0x140035370
mov r14, r12
mov rax, rsi
mov rbx, qword [rbp - 0x60]
sub rax, rbx
cmp rax, 0x40
jb 0x1400353ec
nop word [rax + rax]
lea rdx, [rbx + r14]
lea r8, [rdx + 0x40]
lea rcx, [rbp - 0x38]
call fcn.140034800
add r14, 0x40
mov rsi, qword [rbp - 0x58]
mov rcx, rsi
mov rbx, qword [rbp - 0x60]
sub rcx, rbx
lea rax, [r14 + 0x40]
cmp rax, rcx
jbe 0x1400353c0
lea rdx, [rbx + r14]
cmp rbx, rdx
je 0x14003540b
sub rsi, rdx
mov r8, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rbx]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x60]
call fcn.140035540
lea r8, [rbp - 0x38]
mov rax, r12
nop dword [rax + rax]
cmp rdi, r15
je 0x140035442
mov ecx, 3
sub cl, al
shl cl, 3
mov edx, dword [r8]
shr edx, cl
mov byte [rdi], dl
inc rdi
inc rax
cmp rax, 4
jb 0x140035420
add r8, 4
lea rax, [rbp - 0x18]
cmp r8, rax
jne 0x140035418
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14003548c
mov rdx, qword [rbp - 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035487
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035487
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079d84
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14007a0e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14003f5a0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x18
mov rax, qword [0x1400b44c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x14003f5d4
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.14007a0e0
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x14003f674
cmp qword [rax + 8], rcx
je 0x14003f674
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x14003f663
test r10, r10
je 0x14003f67c
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.14007a0e0
add rsp, 0x18
ret

Function at 0x14003fde0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14003ff16
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov qword [rsp + 0x10], rbp
mov rdi, r8
lea rbp, str._.C
mov rsi, rdx
mov r11, rcx
xor ebx, ebx
nop dword [rax + rax]
movzx r8d, byte [rbx + rsi]
movzx r10d, byte [r11 + 0x40]
movzx eax, r8b
xor al, byte [r11 + r10]
lea r9, [r11 + r10]
mov byte [r9 + 0x20], al
mov ecx, r8d
mov byte [r9 + 0x10], r8b
movzx eax, byte [r11 + 0x41]
xor rcx, rax
movzx eax, byte [r9 + 0x30]
movzx edx, byte [rcx + rbp]
xor edx, eax
lea eax, [r10 + 1]
and eax, 0xf
mov byte [r9 + 0x30], dl
mov byte [r11 + 0x41], dl
mov byte [r11 + 0x40], al
test al, al
jne 0x14003fefa
xor dl, dl
xor r8b, r8b
nop dword [rax]
nop dword [rax + rax]
lea rax, [r11 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x14003fe80
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x14003fe70
inc rbx
cmp rbx, rdi
jb 0x14003fe10
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x14003ff20
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, byte [rcx + 0x40]
lea r11, str._.C
lea r8, [rcx + r9]
movzx eax, dl
mov byte [r8 + 0x10], dl
mov r10, rcx
xor al, byte [r8]
mov byte [r8 + 0x20], al
movzx eax, byte [rcx + 0x41]
movzx edx, dl
xor rdx, rax
movzx eax, byte [r8 + 0x30]
movzx ecx, byte [rdx + r11]
xor ecx, eax
lea eax, [r9 + 1]
and eax, 0xf
mov byte [r8 + 0x30], cl
mov byte [r10 + 0x41], cl
mov byte [r10 + 0x40], al
test al, al
jne 0x140040010
xor dl, dl
xor r8b, r8b
nop word [rax + rax]
lea rax, [r10 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x14003ff90
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x14003ff80
ret
Function at 0x140051050
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, eax
test eax, eax
jne 0x14005106e
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor edx, edx
cmp rcx, rbx
cmovb ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x14007aa14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007aa5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007aa5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007aa5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007aa5e
cmp dword [rcx + 0x84], 0xe
jbe 0x14007aa5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007aa60
xor al, al
add rsp, 0x28
ret
Function at 0x1800010d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
cwde
fsub dword [rbx]
add ebx, eax
add ebx, edi
add ebx, ecx
and ebx, 0x40000000
je 0x180004249
ror esi, 0x17
add edx, 0x3da424fc
add esi, 0x72a8eff7
rol eax, 6
add ecx, 0x67f2c3f1
add ebx, eax
add ebx, esi
and ebx, 1
je 0x1800012f4
rol eax, 9
xor esi, 0xa0311b37
add eax, 0x15294708
sub edx, 0xffce3076
add edx, 0xe7ea36c8
jmp 0x18000390a
mov ecx, 0xcdc7fca6
mov edi, 0xed8aacc7
mov rsp, rbp
mov edx, 0x8a1285d2
mov ebx, 0xec8a00c1
mov dword [rbp - 0x18], 0x627c036c
mov esi, 0x4483da95
sub rsp, 0x20
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
jmp 0x180003bbb

Function at 0x1800013d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor esi, 0x58a01471
add edx, 0x6b8a6e21
add ebx, edx
add ebx, ecx
add ebx, edi
and ebx, 0x1000000
je 0x18000834d
add edx, 0x3fc4ea20
add edx, 0xed6308f6
rol ecx, 0x11
xor eax, 0x38916558
add ebx, esi
add ebx, ecx
add ebx, edx
and ebx, 0x40000
je 0x180001ac3
add ebx, 0xd6138039
sub edx, 0xba5f6081
ror edi, 9
rol esi, 0x18
add ebx, ecx
add ebx, edx
and ebx, 0x8000
je 0x18000390a
xor edx, 0x6db0bbd5
xor ecx, 0x658c00f6
xor ebx, 0x2c21459a
add esi, 0x78148339
sub ecx, 0x75bc73e7
jmp 0x180009728
add dword [rbp - 0x18], 0x39ad4446
xor ebx, dword [rbp - 0x18]
add eax, 0xf6e5a9a
xor esi, 0x679a7470
sub ebx, 0xdc5e9bbb
rol edx, 2
add ebx, edi
add ebx, esi
add ebx, eax
and ebx, 8
je 0x180008b44
add esi, 0xfa3899
xor esi, edi
rol ebx, 0x1d
xor ecx, 0xe3be84a6
ror edx, 0x1c
add ebx, edi
add ebx, edx
and ebx, 0x80
je 0x180004249
xor edi, edx
xor ecx, dword [rbp - 8]
rol ebx, 6
add ebx, edi
add ebx, edx
add ebx, eax
and ebx, 0x200000
je 0x180009e11
sub eax, 0xf6e34d11
xor edi, 0x5050528a
add ecx, 0x480355ea
sub esi, 0x603082da
add edx, 0xbe5b6fa9
jmp 0x180003f9f

Function at 0x180001490
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, edi
add ebx, edx
and ebx, 0x10000
je 0x180008bc6
add eax, 0xae275504
add ecx, 0x6e6d0d41
add edi, 0x9c3c64cd
xor edi, dword [rbp - 8]
xor esi, dword [rbp - 8]
add ebx, ecx
add ebx, edi
add ebx, esi
and ebx, 0x80000
je 0x1800056d9
ror ecx, 3
ror edi, 6
sub ecx, 0x244cd7ab
sub esi, 0x4ab89d0c
jmp 0x1800040a8
add dword [rbp - 0x18], 0x78005120
xor ebx, dword [rbp - 0x18]
add edx, 0x2b3af5d8
rol edi, 0xe
sub ecx, 0x88cdb9a8
add ebx, ecx
add ebx, eax
and ebx, 0x10000000
je 0x18000331b
ror edi, 0xd
xor esi, dword [rbp - 8]
ror edi, 0x1b
ror ebx, 0xe
xor ecx, 0x83074230
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x4000000
je 0x180004249
rol ebx, 6
add ecx, 0xefb09c99
rol ecx, 0xf
add ebx, edi
add ebx, eax
add ebx, ecx
and ebx, 8
je 0x1800050fa
rol edx, 0x13
ror eax, 0x1e
sub ebx, 0xf75d094
jmp 0x180001f4f
Function at 0x180001910
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, edi
add ebx, edx
and ebx, 0x40000
je 0x180004249
sub esi, 0xec8a763d
rol ebx, 0x12
add edx, 0xe11898a4
ror edx, 0x12
rol ecx, 4
add ebx, esi
add ebx, edi
and ebx, 0x4000000
je 0x180005324
xor ecx, eax
rol ecx, 0x13
add ecx, 0xda2dd209
xor edi, esi
add ebx, eax
add ebx, ecx
add ebx, edi
and ebx, 0x400
je 0x180004797
sub edi, 0x4574a104
add ebx, 0x3e3b8693
xor edx, 0x3828b613
jmp 0x1800014e2

Function at 0x180001b50
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x8a1285d2
mov ecx, 0xcdc7fca6
mov esi, 0x4483da95
mov rsp, rbp
mov ebx, 0xec8a00c1
mov edi, 0xed8aacc7
sub rsp, 0x20
mov dword [rbp - 0x18], 0x627c036c
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
jmp 0x180003bbb
Function at 0x1800026d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esi, 0x4deb98c3
xor esi, dword [rbp - 0x18]
ror ebx, 3
add ebx, esi
add ebx, edi
add ebx, ecx
and ebx, 0x4000000
je 0x1800043d7
sub edi, 0x18cbb8c5
add esi, 0x3e7ff150
rol ebx, 0x16
xor edi, 0xfd4d7273
jmp 0x180008781

Function at 0x180002fe0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
invalid
pop rax
loop 0x180002fa2
jne 0x180003018
pop rbp
call 0x11c481a6c
push rbx
cdq
mov ecx, 0x81b25eaf
invalid

Function at 0x1800030b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x8a1285d2
mov edi, 0xed8aacc7
mov esi, 0x4483da95
mov rsp, rbp
mov ebx, 0xec8a00c1
sub rsp, 0x20
mov dword [rbp - 0x18], 0x627c036c
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
jmp 0x180003bbb

Function at 0x1800032cc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
rol ecx, 0x1e
rol ebx, 0x1b
add ebx, esi
add ebx, edx
and ebx, 0x800
je 0x1800037f9
ror esi, 2
rol ecx, 0xb
rol ecx, 0x1b
sub edi, 0xd00b5d42
add ebx, edi
add ebx, esi
and ebx, 0x100
je 0x18000760d
xor edx, 0x91ed02e4
rol eax, 0x1a
xor edi, 0x6052f1a6
rol edx, 0xf
rol edx, 6
jmp 0x1800064c4
mov edi, 0xed8aacc7
mov rsp, rbp
mov ebx, 0xec8a00c1
mov edx, 0x8a1285d2
mov dword [rbp - 0x18], 0x627c036c
sub rsp, 0x20
mov ecx, 0xcdc7fca6
mov esi, 0x4483da95
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
jmp 0x180003bbb
Function at 0x18000346c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x32605eb6
xor ebx, dword [rbp - 0x18]
xor ebx, 0xbed011a2
sub edx, 0xb1f85d4a
xor esi, 0xb80b91cc
add ebx, esi
add ebx, ecx
and ebx, 0x4000000
je 0x180008f9b
rol ecx, 0x11
sub ecx, 0xac746d9a
xor ecx, 0x24fd9175
add ebx, edi
add ebx, eax
and ebx, 0x20000
je 0x180002a3d
ror edx, 0x15
ror edx, 4
ror ecx, 2
sub esi, 0x1ee3299b
xor ebx, 0xf633c5d0
add ebx, edx
add ebx, edi
and ebx, 0x2000000
je 0x18000677c
rol ebx, 9
rol edi, 0x1a
add ecx, 0x14c6e555
ror ebx, 0x19
jmp 0x18000351c
and ebx, 0x8000
je 0x180009f04
ror esi, 0x1f
sub edi, 0x61a9f48a
rol edx, 9
add eax, 0x4bc6c5ba
add ebx, edx
add ebx, edi
add ebx, esi
and ebx, 0x10
je 0x180005c06
ror eax, 2
xor edi, dword [rbp - 0x18]
sub esi, 0xec2dfe8f
jmp 0x180001e46
add dword [rbp - 0x18], 0xc9ba5f61
xor ebx, dword [rbp - 0x18]
add esi, 0x2fce9266
sub ecx, 0x1f7a9994
add edi, 0xce7ae399
ror edi, 3
xor ecx, 0x7b7797ea
add ebx, edi
add ebx, eax
add ebx, ecx
and ebx, 0x2000
je 0x1800097b9
rol ebx, 0x12
xor ecx, 0xfb83a7df
rol eax, 0x1e
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 2
je 0x1800024f6
sub edx, 0xcb2a8a7f
xor ecx, 0x8a4fa607
xor edx, 0xcf7a882c
add ebx, edx
add ebx, edi
add ebx, esi
and ebx, 0x200000
je 0x1800056d9
sub esi, 0x112ae620
add esi, 0x1e224c7a
rol edi, 0xb
jmp 0x180001ac3
add dword [rbp - 0x18], 0x12a76f0d
xor ebx, dword [rbp - 0x18]
xor esi, 0x6c636344
sub ebx, 0x122b281f
xor edx, dword [rbp - 0x18]
xor eax, dword [rbp - 0x18]
ror ebx, 9
add ebx, edx
add ebx, ecx
add ebx, edi
and ebx, 0x8000000
je 0x180006209
ror esi, 0x14
add ecx, 0x4055cc1e
xor edx, esi
sub eax, 0xfede4c66
call 0x17ededc43
sub eax, 0x5f512d1
add ebx, edi
add ebx, esi
add ebx, eax
and ebx, 2
je 0x180005c06
add eax, 0x620a93d4
ror esi, 0xb
sub ebx, 0xe71eed26
add edi, 0x3d00a328
add ebx, edi
add ebx, edx
add ebx, esi
and ebx, 0x80
je 0x1800023b6
ror esi, 6
ror edx, 0x1f
ror edx, 4
rol ecx, 8
ror eax, 0xc
add dword [rbp - 0x18], 0xd2b5d5cc
xor ebx, dword [rbp - 0x18]
sub edx, 0x5a44e835
xor esi, eax
add edi, 0xa649aa5e
sub eax, 0xb16de1c2
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x1000000
je 0x180003f9f
add eax, 0xd0315d8
add edi, 0xa1c87856
rol esi, 0x17
ror ecx, 0x10
add ebx, edi
add ebx, edx
and ebx, 0x40000000
je 0x180006809
xor edx, dword [rbp - 8]
add edx, 0xe22491d6
xor eax, dword [rbp - 0x18]
ror edx, 3
rol ebx, 0x19
add ebx, ecx
add ebx, edx
add ebx, edi
and ebx, 0x4000
je 0x18000a015
xor edi, ecx
ror ebx, 0xf
add edi, 0xb80e9df2
sub esi, 0xa8eff6c5
xor edx, dword [rbp - 0x18]
jmp 0x180006ef5

Function at 0x1800034f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
adc cl, byte [rdx - 0x38035947]
int 0xbb
rol dword [rax], 0x8a
in al, dx
Function at 0x180003e10
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push 0xffffffff81775a5c
int1
xlatb
invalid
Function at 0x180007050
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x400000
je 0x180001f4f
xor edi, ecx
rol eax, 3
xor edx, 0x6837f59f
add ebx, edx
add ebx, eax
and ebx, 0x800000
je 0x180007aec
add esi, 0xc34138d3
rol esi, 0x1b
rol edx, 0x1f
add eax, 0x40cfa38a
add edi, 0x1f760143
add ebx, edx
add ebx, ecx
and ebx, 0x80
je 0x1800064c4
add edi, 0xab95c98f
rol esi, 0x14
ror ebx, 5
xor esi, 0x42116de3
jmp 0x1800056d9

Function at 0x180007120
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add eax, 0xa5142fac
ror esi, 0x1b
xor ebx, dword [rbp - 0x18]
xor esi, eax
add ebx, ecx
add ebx, edx
and ebx, 0x20000
je 0x1800014e2
ror ebx, 0x1c
xor eax, 0x49952dba
rol ecx, 0x18
rol esi, 0x1d
add ebx, edi
add ebx, esi
and ebx, 0x10
je 0x180004249
add eax, 0x9acdb64f
ror edi, 0x11
add edx, 0xf8415209
add ebx, 0x8418734e
jmp 0x180001f4f

Function at 0x1800074d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x1ccdf79
jmp 0x180005298
Function at 0x180007b50
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x59cdabe6
xor ebx, dword [rbp - 0x18]
add edi, 0xc82e79ef
sub esi, 0x73a1788e
add esi, 0xaf6ece60
add ebx, edx
add ebx, edi
add ebx, eax
and ebx, 0x2000
je 0x180004688
add ebx, 0x19b884ea
sub eax, 0x3645967d
add eax, 0x8503d6d8
add ebx, ecx
add ebx, edi
add ebx, esi
and ebx, 0x100
je 0x180004d55
xor ecx, dword [rbp - 8]
add ecx, 0x970acfa3
sub ebx, 0x10827893
xor edx, dword [rbp - 0x18]
add ecx, 0xad53090c
add ebx, ecx
add ebx, edx
and ebx, 0x2000
je 0x180003a1c
add esi, 0x77d20d3b
add ebx, 0x460bb74a
ror esi, 3
jmp 0x180009d05
add ebx, ecx
add ebx, eax
and ebx, 0x20
je 0x18000a5e5
sub esi, 0xd3734ece
rol edx, 0x19
sub edi, 0x9952e320
xor eax, 0xdfebfd82
rol ebx, 7
jmp 0x180001838