joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029734
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140029764
xor eax, eax
jmp 0x140029827
mov rbp, rbx
cmp word [rax], si
je 0x140029789
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140029770
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14002976c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140021508
movsxd r14, eax
test eax, eax
jne 0x1400297c7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14002975d
mov rcx, r14
call fcn.14002144c
mov rdi, rax
test rax, rax
jne 0x1400297e0
xor ecx, ecx
call fcn.140021410
jmp 0x1400297bc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140021508
test eax, eax
jne 0x140029811
mov rcx, rdi
call fcn.140021410
jmp 0x14002981b
xor ecx, ecx
call fcn.140021410
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14002af68
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14002af9a
call fcn.14001aa74
mov dword [rax], 0x16
call fcn.14001b2d8
jmp 0x14002b0b9
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14002b0b9
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14002b0b9
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14002afc9
lock or dword [rcx + 0x14], 0x10
jmp 0x14002b0b9
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14002afdd
call fcn.14002c934
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.140025878
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.14002b338
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14002b0a7
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14002b072
mov rcx, rsi
call fcn.140025878
cmp eax, edi
je 0x14002b05d
mov rcx, rsi
call fcn.140025878
cmp eax, 0xfffffffe
je 0x14002b05d
mov rcx, rsi
call fcn.140025878
movsxd rbx, eax
lea r14, [0x14004be60]
mov rcx, rsi
sar rbx, 6
call fcn.140025878
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14002b064
lea rdx, [0x1400495d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14002b072
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14002b096
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14002b096
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14002b096
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14002b0bc
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x14002bb74
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14004be60]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14002bbd2
cmp word [rdx], r12w
jne 0x14002bbd2
or byte [rax + r8*8 + 0x38], cl
jmp 0x14002bbd8
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14002bd33
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14002bd0e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x14002bc11
mov rcx, r9
jmp 0x14002bc34
cmp r9, rdx
jae 0x14002bc4b
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14002bbf5
jmp 0x14002bd33
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002bd08
cmp dword [rsp + 0x80], edi
je 0x14002bd08
mov rdx, r14
lea r11, [0x14004be60]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x14002bce1
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14002bcb4
mov word [rbx], r12w
jmp 0x14002bd2f
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x14002bcbd
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14002bd2f
cmp word [rsp + 0x70], r12w
jne 0x14002bcee
cmp rbx, rsi
je 0x14002bcae
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140028ed8
cmp word [rsp + 0x70], r12w
je 0x14002bd33
mov word [rbx], r13w
jmp 0x14002bd2f
lea r11, [0x14004be60]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14002bd2b
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14002bd33
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140030e7c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400124b0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140030f06
cmp byte [rbp - 0x21], r15b
je 0x140030f01
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140030f3c
call fcn.140021fe8
test eax, eax
jne 0x140030f28
cmp byte [rbp - 0x21], r15b
je 0x140030f20
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140030f3c
cmp byte [rbp - 0x21], r15b
je 0x140030f39
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001254c
test eax, eax
jne 0x140030fdc
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400124b0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140030f7b
cmp byte [rbp - 0x21], r15b
je 0x140030fb0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140030fb0
call fcn.140021fe8
test eax, eax
jne 0x140030f9c
cmp byte [rbp - 0x21], r15b
je 0x140030f95
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140030fb0
cmp byte [rbp - 0x21], r15b
je 0x140030fad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001254c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140030fdc
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140030fdf
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140030fed
mov rcx, rdi
call fcn.140021410
cmp byte [rbp + 0x3f], r15b
je 0x140030ffc
mov rcx, qword [rbp + 0x27]
call fcn.140021410
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180001d60
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
lahf
xor ebx, dword [rbp - 8]
xor esi, dword [rbp - 0x10]
rol ebx, 0x12
xor ebx, eax
xor eax, edi
rol esi, 0xf
add ebx, edx
add ebx, edi
and ebx, 0x200000
je 0x180009551
sub edx, 0xc05e7aa5
xor ebx, 0xa740b456
rol eax, 0xd
ror eax, 0x19
add ebx, edx
add ebx, ecx
and ebx, 0x2000
je 0x1800057f8
sub edi, 0x3abf061e
xor edx, 0x354a8fd6
ror ecx, 0xb
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x8000000
je 0x180007b7c
add ebx, 0x95ec12fc
rol edx, 0x14
rol edi, 0xd
add ecx, 0xff0986
rol edi, 0x13
jmp 0x180001384
mov ebx, 0x44930c65
mov esi, 0x21d39701
mov rsp, rbp
mov edi, 0xe6bd2129
sub rsp, 0x20
mov dword [rbp - 8], 0x1515a8c0
mov ecx, 0x210e4c2d
mov edx, 0xf78cc2fe
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp 0x180006430
add dword [rbp - 8], 0x37d309cc
xor ebx, dword [rbp - 8]
sub esi, 0x88793b83
rol esi, 0x15
rol esi, 0xd
xor esi, dword [rbp - 8]
add esi, 0x65f0cb0f
add ebx, ecx
add ebx, edx
and ebx, 4
je 0x180007483
rol ecx, 5
ror eax, 2
sub ecx, 0xa903d458
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x1000
je 0x180007a6b
xor edi, 0x68cfd193
xor edi, ebx
rol ecx, 0x12
add ebx, edi
add ebx, eax
and ebx, 0x100000
je 0x18000413c
rol eax, 3
add eax, 0x110d2a32
ror ecx, 0xf
add esi, 0x255a75b3
jmp 0x180003e2c
add dword [rbp - 8], 0xd1d4ede9
xor ebx, dword [rbp - 8]
sub ecx, 0xa0ccd0a4
add esi, 0x4915f18f
sub ebx, 0x5aca52b2
ror edx, 0xf
ror edi, 6
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x200000
je 0x1800036be
ror edx, 0x19
ror edi, 6
rol eax, 0x16
rol esi, 0x12
add ebx, edx
add ebx, esi
and ebx, 0x40
je 0x180002413
add edx, 0x3c2495d6
ror edi, 0xb
add ecx, 0xca943ec5
xor esi, dword [rbp - 8]
add ebx, edi
add ebx, edx
and ebx, 0x10
je 0x180003d23
xor ebx, eax
sub ecx, 0x1829d9fc
sub eax, 0x31d0b48e
rol ecx, 0x17
xor edi, 0xa3347f35
jmp 0x180007f1d
add dword [rbp - 8], 0x193785c4
xor ebx, dword [rbp - 8]
sub ecx, 0xa831e2ff
rol ecx, 0x1c
add ebx, 0xb0b78772
sub eax, 0x847c2ca0
add ebx, edx
add ebx, eax
add ebx, esi
and ebx, 0x400000
je 0x18000a23f
add esi, 0x2e4f7b32
rol ecx, 0x19
add ecx, 0x1c79e8f9
xor ecx, 0xfb40e1ce
add ebx, esi
add ebx, edi
and ebx, 0x2000000
je 0x1800036be
xor edx, ecx
xor ecx, 0x2071323
add ebx, 0x7ff890e5
add eax, 0x83d99afe
ror eax, 9
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 0x800
je 0x180009b76
xor ebx, 0x30eedf6a
rol ecx, 0x1c
ror ebx, 0xf
sub ecx, 0x15e2e10
rol esi, 0x16
jmp 0x180004714
Function at 0x180002314
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0xbe74eaa7
xor ebx, dword [rbp - 8]
rol ebx, 8
xor ecx, ebx
xor eax, dword [rbp - 8]
sub ecx, 0x7ec0a985
sub edi, 0x64a96c8d
add ebx, ecx
add ebx, edx
and ebx, 0x40000
je 0x1800093c4
rol eax, 9
rol ecx, 0xf
add ecx, 0xded93fe4
ror ebx, 0x1f
ror ebx, 0x19
add ebx, ecx
add ebx, esi
and ebx, 0x8000
je 0x180003db3
add esi, 0xe1938378
sub edi, 0xc0d5abbb
sub eax, 0x6d819e38
rol esi, 5
add ebx, eax
add ebx, esi
and ebx, 0x20000
je 0x180002413
sub ecx, 0xb887a5b5
ror eax, 0x16
xor ecx, ebx
ror esi, 0x12
sub edx, 0x5a6ec888
jmp 0x1800051c7
sub eax, 0x29f7e74
add edx, 0xb45d14a3
add ebx, 0xa450c025
add ebx, eax
add ebx, ecx
and ebx, 0x400
je 0x1800041c8
sub edx, 0xa178bd2b
sub esi, 0x9b0bd8f7
ror eax, 0xa
xor edi, 0xf312ac9e
jmp 0x180008ab4
add dword [rbp - 8], 0xe735638a
xor ebx, dword [rbp - 8]
xor eax, 0xd21534bc
ror ebx, 0x1f
xor ebx, dword [rbp - 8]
add ebx, esi
add ebx, eax
and ebx, 0x4000
je 0x1800025e3
xor ecx, eax
add ecx, 0x107dae97
add edx, 0x5dec2e84
ror ebx, 2
xor eax, edi
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 8
je 0x180002b9c
ror eax, 4
xor ebx, 0x69ba2b63
ror ecx, 0x13
xor esi, 0xa4f7042
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 0x20
je 0x180001bc0
sub edi, 0xb7313a4
sub esi, 0x5bf2f090
sub ecx, 0x950c9e22
add edi, 0xb48a7dd4
jmp 0x18000a1bf
Function at 0x180002614
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub eax, 0x80d744d1
rol eax, 5
ror esi, 0x11
add ebx, eax
add ebx, edx
add ebx, ecx
and ebx, 0x20
je 0x180007d0e
rol edx, 5
rol esi, 0xe
add esi, 0xe1a2dc39
sub edx, 0xff7fc2ff
add ebx, esi
add ebx, eax
and ebx, 0x10000000
je 0x18000151e
ror ecx, 0x17
xor edi, 0xa5201f23
ror ebx, 0x1d
add esi, 0xd49729d8
ror ebx, 6
jmp 0x180005c29

Function at 0x18000274c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add dword [rbp - 8], 0x5d5d095
xor ebx, dword [rbp - 8]
ror ebx, 8
sub edi, 0x7ee69a00
xor edi, 0x8df44d81
xor ebx, 0x2fbd333a
add edx, 0x23ed5566
add ebx, eax
add ebx, esi
and ebx, 0x40000000
je 0x180005c29
sub eax, 0x820f5e8
xor ebx, dword [rbp - 0x10]
add ecx, 0xe1c7104a
rol edx, 0x11
ror esi, 0x1d
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x20
je 0x18000a0bf
rol esi, 0x1f
rol esi, 0x1f
add edi, 0x4b1b63a6
add ebx, ecx
add ebx, edi
add ebx, eax
and ebx, 0x20
je 0x1800099de
rol eax, 6
ror edx, 0x19
sub edx, 0x90b587a1
rol ecx, 0xd
ror ecx, 0x16
jmp 0x180009551
add dword [rbp - 8], 0xa453ef65
xor ebx, dword [rbp - 8]
add eax, 0xc30f99b1
add eax, 0xb6c3e0d
xor ecx, 0x9fcb8b67
add ebx, esi
add ebx, edx
and ebx, 0x400
add al, 0
add byte [rdi], cl
test byte [rdi - 0x61], dl
invalid
invalid
ror ebx, 0x1a
ror ebx, 2
add edi, 0xc0f37d5f
rol eax, 0x17
rol ebx, 6
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x80000000
je 0x1800072e3
rol edi, 0x1b
add edi, 0xedbae5ce
rol ebx, 0x1c
add ebx, esi
add ebx, edx
add ebx, eax
and ebx, 0x1000
je 0x180002731
ror ebx, 5
ror edi, 0x18
add eax, 0xa75a8c79
ror ecx, 9
jmp 0x180002078
xor esi, edi
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x40000
je 0x180002413
rol ecx, 5
add ecx, 0xc1a1c2a4
add edx, 0xff896406
rol ecx, 0x11
add ebx, edi
add ebx, edx
add ebx, ecx
and ebx, 0x20000
je 0x180007401
sub esi, 0x54959b1b
add edi, 0xfd2ec22d
add ebx, 0xb9f8cc14
rol edx, 0x19
add ebx, ecx
add ebx, edx
and ebx, 0x200
je 0x180002243
rol edi, 0x14
rol edi, 8
ror edx, 0x18
xor eax, esi
sub edi, 0xe1f30265
jmp 0x180005375
Function at 0x180003290
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
ja 0x180003258
rol dword [rcx], cl
and ebx, 8
mov ebp, dword [rsi]
jrcxz 0x180003255
ret 0xc10e

Function at 0x1800032d8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
mov ecx, 0x210e4c2d
mov rsp, rbp
sub rsp, 0x20
mov edx, 0xf78cc2fe
mov esi, 0x21d39701
mov edi, 0xe6bd2129
mov ebx, 0x44930c65
add dword [rbp - 0x10], 1
mov eax, dword [rbp - 0x10]
mov dword [rbp - 8], 0x1515a8c0
jmp 0x180006430
sub esi, 0x8f09f1d1
add ebx, eax
add ebx, ecx
add ebx, edx
and ebx, 0x400
je 0x1800036be
add ebx, 0x104d4daf
rol edi, 0xf
sub ecx, 0x76a3727f
xor eax, edi
add ebx, ecx
add ebx, esi
and ebx, 0x400000
je 0x18000751f
add eax, 0x2c044362
add esi, 0xc6c398ae
ror eax, 0x1d
sub eax, 0x1d56d668
sub ebx, 0xa01f8122
jmp 0x180001f2b
Function at 0x180003ac0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and ebx, 0x4000000
je 0x180009b76
ror esi, 0x1a
sub edx, 0x1779a0ea
add esi, 0x472251d6
add edi, 0xfac3636d
rol ecx, 2
add ebx, edi
add ebx, eax
and ebx, 0x800
je 0x18000374c
add edx, 0xf623fef4
rol edi, 0x1c
sub edi, 0x5ef8d0b
rol ecx, 0xd
ror ebx, 0x1e
jmp 0x180005874
add dword [rbp - 8], 0xc7dbcc4e
xor ebx, dword [rbp - 8]
add edx, 0x40151197
rol eax, 0x19
add esi, 0xc7f07816
add ebx, esi
add ebx, ecx
and ebx, 0x80
je 0x180009a5f
add ebx, 0xe7c5a2d6
add esi, 0x29030c0
rol eax, 6
add eax, 0x6496a722
add ebx, edi
add ebx, esi
and ebx, 0x8000000
je 0x18000308c
xor eax, 0xcf5998e9
xor eax, 0x23e1068b
sub edi, 0x3027350d
ror esi, 0x1f
add ebx, edx
add ebx, esi
and ebx, 0x80
je 0x1800072e3
invalid
invalid

Function at 0x180003cc0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add dword [rbp - 8], 0x6ced3767
xor ebx, dword [rbp - 8]
add edi, 0x200014e3
ror ecx, 0x18
ror ebx, 4
add ebx, ecx
add ebx, edx
and ebx, 0x20000
je 0x18000a23f
rol ecx, 3
add ebx, 0x3e1ce194
rol esi, 0x1f
ror ecx, 0xf
add ebx, edx
add ebx, eax
and ebx, 0x1000000
je 0x180007483
sub eax, 0x6f17cf60
sub esi, 0xa4d3b032
add edi, 0x7d45ceb9
sub edi, 0xa993dea9
xor esi, 0xebf7f11e
ror edi, 0x15
add ebx, edx
add ebx, esi
add ebx, ecx
and ebx, 0x400
je 0x18000308c
sub ecx, 0x3dcce08f
ror edi, 0x1a
xor ecx, 0x836e2aa0
ror eax, 0x1c
add edi, 0xaba920a6
add ebx, ecx
add ebx, edx
and ebx, 0x40
je 0x180002187
xor ebx, 0xced5204a
rol esi, 2
rol ecx, 0xf
jmp 0x1800022c9

Function at 0x180003ea4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xor esi, dword [rbp - 8]
rol edi, 4
ror ebx, 0x1e
jmp 0x180006c6b
Function at 0x18000430c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov dword [rbx], 0xe909cac1
sbb al, 0
add byte [rcx - 0x762607bb], al
xor dword [rax], 0xc1f85d33
invalid
Function at 0x1800046a8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
ror esi, 0x15
add eax, 0xc9955031
ror ebx, 0x1c
add ebx, esi
add ebx, edx
and ebx, 0x10000
je 0x18000751f
xor esi, 0xcf87ee0
rol ecx, 0x1d
rol ecx, 2
sub ebx, 0x889f6303
jmp 0x180001384
Function at 0x180004bac
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
rol edx, 0x12
sub edi, 0x246e2828
ror esi, 0x1c
add ebx, ecx
add ebx, edx
add ebx, edi
and ebx, 8
je 0x180005dc5
add edx, 0xd916cecf
sub esi, 0xf156fb5b
ror eax, 0x14
add ebx, edx
add ebx, esi
add ebx, ecx
and ebx, 0x400
je 0x18000308c
add edx, 0x27707df
ror eax, 6
add edx, 0x60bdf11c
xor edi, 0xe1ff5c62
rol ebx, 0x1c
add ebx, edx
add ebx, eax
add ebx, esi
and ebx, 0x100000
je 0x180006f34
add edi, 0xde6e695e
sub eax, 0x3f608169
add edx, 0xf5c7911c
jmp 0x1800063b6

Function at 0x180004ee0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
invalid

Function at 0x180004ffc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0x126f4f3
xor ebx, dword [rbp - 8]
add ebx, 0x5f7bbf54
rol esi, 0x17
ror ebx, 7
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x200000
je 0x1800075b8
sub ebx, 0x40f9b609
ror esi, 0xa
ror ecx, 0x16
ror eax, 0x1e
xor eax, 0x968902fb
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 1
je 0x180001499
ror edx, 0x1c
ror edi, 0xe
add edx, 0x2a07d683
sub eax, 0xb37fd9f6
add ebx, eax
add ebx, esi
add ebx, ecx
and ebx, 8
je 0x180009a5f
xor edx, dword [rbp - 8]
rol edx, 9
sub ecx, 0xeb7dca9f
sub esi, 0xe522075
add ebx, 0x17fdde45
jmp 0x18000413c
add dword [rbp - 8], 0xe4e9affc
xor ebx, dword [rbp - 8]
add ebx, 0xbc34be27
sub ebx, 0x593aab02
ror ebx, 0xe
rol eax, 4
add ebx, edx
add ebx, eax
add ebx, edi
and ebx, 0x200000
je 0x180002c2c
ror ecx, 0x15
add ecx, 0x9016b03f
rol edi, 0xe
add ebx, edx
add ebx, eax
add ebx, edi
and ebx, 0x400000
je 0x180005375
xor eax, 0xc64da5cd
sub eax, 0x4db0d307
sub esi, 0xf87ef4a3
rol esi, 7
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 0x400
je 0x18000a23f
rol edi, 5
add ebx, 0xe372a76
sub ecx, 0xd125764b
add edi, 0x4d14488e
jmp 0x1800025e3
and ebx, 0x10000
je 0x18000385a
add eax, 0x19895316
xor ebx, dword [rbp - 8]
ror eax, 0x14
ror edi, 0x11
ror eax, 0xd
invalid
Function at 0x180005188
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add cl, byte [rdi]
test byte [rdi - 0x3e00003d], cl
rcr dword [rdx], 0x81
int1
test byte [rbx + rbx*4], bh
ret 0xcfc1

Function at 0x18000527c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add byte [rax], cl
add byte [rdi], cl
test bl, dh
int 0xff
inc ecx
ret 0x8105

Function at 0x1800053e0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor esi, dword [rbp - 8]
xor esi, ecx
xor ecx, 0xdca6f443
sub edx, 0xc8c21c04
jmp 0x180002078

Function at 0x180005450
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0x4e3f78c3
xor ebx, dword [rbp - 8]
ror eax, 8
rol ebx, 9
add edi, 0x85a5cdae
add ebx, esi
add ebx, ecx
add ebx, edx
and ebx, 0x100000
je 0x180007483
add edi, 0xcd736fe1
xor edi, 0xe3f6daa4
rol esi, 2
sub ebx, 0xbc6e6697
add ebx, esi
add ebx, edx
add ebx, edi
and ebx, 0x8000000
je 0x180002f8c
sub edx, 0x823a76fc
rol eax, 0x1f
rol ebx, 0x19
add edx, 0x212280b
ror ebx, 9
add ebx, edx
add ebx, ecx
and ebx, 2
je 0x180009cc7
add edi, 0x49446e54
rol ebx, 0x14
rol ebx, 0xa
jmp 0x180007f1d
add byte [rdi], cl
test ah, ch
int 0xff
inc dword [rcx + 0x3bb77cc1]
pop rsi
sub ecx, 0xb220b72e
xor eax, dword [rbp - 0x10]
add ebx, edx
add ebx, edi
add ebx, ecx
and ebx, 0x2000
je 0x180008d60
ror ebx, 6
xor edi, 0xf24a775e
xor ecx, 0xdad09a05
rol esi, 0xd
ror eax, 0x14
add ebx, eax
add ebx, esi
and ebx, 0x8000000
je 0x18000310d
rol eax, 7
sub eax, 0xc2c06d84
ror edx, 0x1a
rol ebx, 0x1a
ror ecx, 0x14
jmp 0x1800025e3

Function at 0x1800055f4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and byte [rdi + 0x5a], bl
rol ecx, 0x19
ror edi, 0x1e
sub ecx, 0xe87ba57c
add ebx, edx
add ebx, edi
and ebx, 0x10000
je 0x1800072e3
xor esi, dword [rbp - 0x10]
xor ecx, 0xd06247e3
add ecx, 0xa25d48fd
jmp 0x1800053f6