joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000178c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xchg esi, eax
jo 0x1800017f8
add ebx, 0x6187b3c4
add ebx, eax
add ebx, esi
add ebx, ecx
and ebx, 0x100000
je 0x180004560
xor edx, ebx
xor esi, 0x5183743f
sub eax, 0x2f41e197
xor esi, 0x2454d868
rol edx, 8
jmp 0x1800017f8
mov edx, 0x332863b2
mov esi, 0x220f7aab
mov edi, 0xab53180d
mov ebx, 0xe0d57cd2
mov rsp, rbp
sub rsp, 0x10
mov ecx, 0xd31763ad
add dword [rbp - 0x10], 1
mov eax, dword [rbp - 0x10]
mov dword [rbp - 8], 0x536c5d6f
jmp fcn.180004622
Function at 0x1800023f4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rdi], ecx
test byte [rdx + 0x51], dh
add byte [rax], al
ror eax, 0x17
xor edx, 0xeea8880
add edi, 0x7fcb8323
jmp 0x180003559
mov rsp, rbp
mov dword [rbp - 8], 0x536c5d6f
mov ecx, 0xd31763ad
mov esi, 0x220f7aab
mov ebx, 0xe0d57cd2
mov edi, 0xab53180d
mov edx, 0x332863b2
sub rsp, 0x10
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp fcn.180004622

Function at 0x1800026dc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0xfca62218
xor ebx, dword [rbp - 8]
rol ecx, 6
ror eax, 0x1b
ror esi, 0x17
ror eax, 0x1c
add ecx, 0xb37bf173
add ebx, ecx
add ebx, eax
and ebx, 0x4000000
je 0x180002894
rol edx, 0xe
add esi, 0x29da26f1
ror ecx, 2
add ebx, ecx
add ebx, edi
add ebx, esi
and ebx, 0x80000
je 0x180008c38
rol ecx, 0x19
xor edx, ecx
xor ebx, dword [rbp - 0x10]
rol edi, 0x17
add ebx, edi
add ebx, eax
add ebx, edx
and ebx, 0x4000000
je 0x180003b23
xor ebx, esi
sub edi, 0x5be3ee
xor eax, 0x94946d19
jmp fcn.1800043b3
add dword [rbp - 8], 0xae92e734
xor ebx, dword [rbp - 8]
add esi, 0x20b0607b
rol edx, 0xe
add ebx, 0xbbe5e14b
sub edx, 0xd59c6967
rol ebx, 0x13
add ebx, ecx
add ebx, eax
and ebx, 0x20000
je 0x180001417
add ebx, 0xa8e6e10
sub edi, 0xae0e716e
xor esi, 0x4d982da5
add eax, 0x73d2ae3e
xor esi, dword [rbp - 8]
add ebx, edi
add ebx, esi
add ebx, edx
and ebx, 0x4000
je fcn.1800090d9
ror eax, 0x1a
xor ebx, dword [rbp - 0x10]
ror eax, 2
xor ebx, dword [rbp - 0x10]
add ebx, eax
add ebx, edx
add ebx, esi
and ebx, 4
je 0x180009ce3
rol eax, 0x11
xor ebx, 0x2b24ec8b
ror eax, 0x1b
jmp 0x180005440
add dword [rbp - 8], 0x3367f48e
xor ebx, dword [rbp - 8]
ror eax, 2
ror esi, 9
rol eax, 0xb
ror esi, 0xa
add ebx, edx
add ebx, ecx
and ebx, 0x800
je 0x180001417
add ecx, 0x2f845e64
ror ecx, 0x10
sub eax, 0xd74bd354
ror eax, 3
xor ecx, 0xb7bcab45
add ebx, edx
add ebx, eax
add ebx, edi
and ebx, 0x8000000
je 0x1800059ba
rol eax, 0x19
rol eax, 0xb
add edx, 0x63fe52eb
ror edx, 0x18
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x2000
je 0x1800072b9
add eax, 0x3dbfd736
sub ebx, 0xd4e19436
sub esi, 0xd3d19a5b
add eax, 0xf398c274
jmp 0x180003efd
Function at 0x180002b30
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 0x10], 0x1af6443
jmp 0x18000226f
Function at 0x180003700
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
ror ecx, 0x15
ror esi, 6
add ecx, 0x50a4896
rol ebx, 0xc
sub edi, 0x1f33ac35
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 1
je 0x1800059ba
add edi, 0x33501115
xor edx, eax
ror ebx, 0x18
add esi, 0x19a3b615
sub esi, 0x8022aac0
add ebx, esi
add ebx, ecx
invalid

Function at 0x1800044c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add edx, 0x20149399
sub esi, 0x5d4750eb
jmp 0x180003ded
Function at 0x180005eb0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
test byte [rbp + rdx], cl
add byte [rbx], dh
jge fcn.180005e80
ror eax, 7
sub edi, 0x279204a3
ror eax, 0x19
add ebx, edi
add ebx, ecx
and ebx, 0x80000000
je 0x18000579a
ror eax, 0x15
sub ecx, 0xe20fae43
rol ebx, 0x17
rol edi, 0x1b
xor edx, 0x40525d1f
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 1
je 0x18000a1e7
add esi, 0xf8d279fc
add edi, 0x6c00e264
add ebx, 0xdad041c0
sub eax, 0x80b079b2
jmp 0x180003efd

Function at 0x180005ee0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
test byte [rbp + rdx], cl
add byte [rbx], dh
jge fcn.180005e80
ror eax, 7
sub edi, 0x279204a3
ror eax, 0x19
add ebx, edi
add ebx, ecx
and ebx, 0x80000000
je 0x18000579a
ror eax, 0x15
sub ecx, 0xe20fae43
rol ebx, 0x17
rol edi, 0x1b
xor edx, 0x40525d1f
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 1
je 0x18000a1e7
add esi, 0xf8d279fc
add edi, 0x6c00e264
add ebx, 0xdad041c0
sub eax, 0x80b079b2
jmp 0x180003efd
Function at 0x1800064b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rcx - 0x362bdd11], al
rol edi, 0xc
rol eax, 0xf
add ebx, edx
add ebx, ecx
and ebx, 0x10
je 0x1800060f0
rol edi, 8
add ecx, 0x74b809e0
rol edi, 0xc
jmp 0x18000390a
add dword [rbp - 8], 0x58fe0a08
xor ebx, dword [rbp - 8]
add ecx, 0x26dfecf2
ror ebx, 0xb
sub edx, 0x992b2cc9
ror ebx, 4
ror edi, 3
add ebx, edi
add ebx, edx
add ebx, esi
and ebx, 0x40000000
je 0x180001110
sub ebx, 0x97995e04
add ecx, 0x6dcdf542
ror esi, 0x12
add ebx, 0x3302c20d
rol edi, 0xd
add ebx, edi
add ebx, esi
add ebx, eax
and ebx, 0x80
je 0x180006447
sub edi, 0x19acda1c
add edi, 0xddbda3d2
rol ebx, 0x19
rol eax, 0xd
add ebx, edi
add ebx, eax
add ebx, esi
and ebx, 0x20
je 0x180002894
ror eax, 4
ror edi, 6
ror ecx, 4
sub esi, 0x5dac828d
jmp 0x180003ded
add dword [rbp - 8], 0xdec2f324
xor ebx, dword [rbp - 8]
rol ebx, 7
sub ecx, 0x251d96ea
sub edx, 0x11a5462b
add ebx, ecx
add ebx, esi
and ebx, 0x80000
je 0x18000756d
sub ebx, 0xc5b4f65a
add eax, 0xa3c675ea
sub edi, 0x57e092a6
ror eax, 0x18
add ebx, eax
add ebx, ecx
and ebx, 0x20000
je 0x18000847b
add ebx, 0x7ecc69b2
ror ebx, 4
sub ecx, 0x2cf1b289
sub edi, 0x3b8d50c0
add ebx, eax
add ebx, edx
add ebx, ecx
and ebx, 0x10000
je 0x18000579a
add eax, 0xb83d02a9
sub ecx, 0xeb86c0b7
rol ebx, 0xf
sub eax, 0xd8ae1504
xor edi, eax
jmp 0x18000a822
add dword [rbp - 8], 0x54c5b45a
xor ebx, dword [rbp - 8]
add ecx, 0xb440923a
add edi, 0xd3c73d6b
xor ecx, dword [rbp - 0x10]
rol ecx, 0x14
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 0x4000000
je 0x180009b61
ror eax, 8
xor edi, ecx
add edi, 0x8c3603d0
xor ecx, 0x1aab057e
sub ecx, 0xa6b11cd2
add ebx, ecx
add ebx, edi
and ebx, 8
je 0x18000579a
ror ecx, 0xf
ror esi, 0xe
sub eax, 0xcbae7970
add ebx, edx
add ebx, eax
add ebx, edi
and ebx, 0x80000
je 0x1800073d1
add ebx, 0x5d20effd
add ebx, 0xc4776241
rol ebx, 0x1c
jmp 0x180001417
mov ecx, 0xd31763ad
mov edx, 0x332863b2
mov rsp, rbp
mov edi, 0xab53180d
sub rsp, 0x10
mov esi, 0x220f7aab
mov ebx, 0xe0d57cd2
add dword [rbp - 0x10], 1
mov dword [rbp - 8], 0x536c5d6f
mov eax, dword [rbp - 0x10]
jmp fcn.180004622
Function at 0x180008470
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add eax, 0x88112ece
jmp 0x180007b72

Function at 0x180008494
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rcx - 0x362bdd11], al
rol edi, 0xc
rol eax, 0xf
add ebx, edx
add ebx, ecx
and ebx, 0x10
je 0x1800060f0
rol edi, 8
add ecx, 0x74b809e0
rol edi, 0xc
jmp 0x18000390a
add dword [rbp - 8], 0x58fe0a08
xor ebx, dword [rbp - 8]
add ecx, 0x26dfecf2
ror ebx, 0xb
sub edx, 0x992b2cc9
ror ebx, 4
ror edi, 3
add ebx, edi
add ebx, edx
add ebx, esi
and ebx, 0x40000000
je 0x180001110
sub ebx, 0x97995e04
add ecx, 0x6dcdf542
ror esi, 0x12
add ebx, 0x3302c20d
rol edi, 0xd
add ebx, edi
add ebx, esi
add ebx, eax
and ebx, 0x80
je 0x180006447
sub edi, 0x19acda1c
add edi, 0xddbda3d2
rol ebx, 0x19
rol eax, 0xd
add ebx, edi
add ebx, eax
add ebx, esi
and ebx, 0x20
je 0x180002894
ror eax, 4
ror edi, 6
ror ecx, 4
sub esi, 0x5dac828d
jmp 0x180003ded
add dword [rbp - 8], 0xdec2f324
xor ebx, dword [rbp - 8]
rol ebx, 7
sub ecx, 0x251d96ea
sub edx, 0x11a5462b
add ebx, ecx
add ebx, esi
and ebx, 0x80000
je 0x18000756d
sub ebx, 0xc5b4f65a
add eax, 0xa3c675ea
sub edi, 0x57e092a6
ror eax, 0x18
add ebx, eax
add ebx, ecx
and ebx, 0x20000
je 0x18000847b
add ebx, 0x7ecc69b2
ror ebx, 4
sub ecx, 0x2cf1b289
sub edi, 0x3b8d50c0
add ebx, eax
add ebx, edx
add ebx, ecx
and ebx, 0x10000
je 0x18000579a
add eax, 0xb83d02a9
sub ecx, 0xeb86c0b7
rol ebx, 0xf
sub eax, 0xd8ae1504
xor edi, eax
jmp 0x18000a822
add dword [rbp - 8], 0x54c5b45a
xor ebx, dword [rbp - 8]
add ecx, 0xb440923a
add edi, 0xd3c73d6b
xor ecx, dword [rbp - 0x10]
rol ecx, 0x14
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 0x4000000
je 0x180009b61
ror eax, 8
xor edi, ecx
add edi, 0x8c3603d0
xor ecx, 0x1aab057e
sub ecx, 0xa6b11cd2
add ebx, ecx
add ebx, edi
and ebx, 8
je 0x18000579a
ror ecx, 0xf
ror esi, 0xe
sub eax, 0xcbae7970
add ebx, edx
add ebx, eax
add ebx, edi
and ebx, 0x80000
je 0x1800073d1
add ebx, 0x5d20effd
add ebx, 0xc4776241
rol ebx, 0x1c
jmp 0x180001417
mov ecx, 0xd31763ad
mov edx, 0x332863b2
mov rsp, rbp
mov edi, 0xab53180d
sub rsp, 0x10
mov esi, 0x220f7aab
mov ebx, 0xe0d57cd2
add dword [rbp - 0x10], 1
mov dword [rbp - 8], 0x536c5d6f
mov eax, dword [rbp - 0x10]
jmp fcn.180004622

Function at 0x1800088a4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rax], eax
add byte [rax], al
mov eax, dword [rbp - 0x10]
jmp fcn.180004622
Function at 0x180008d80
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x332863b2
mov ebx, 0xe0d57cd2
mov ecx, 0xd31763ad
mov edi, 0xab53180d
mov esi, 0x220f7aab
mov rsp, rbp
mov dword [rbp - 8], 0x536c5d6f
sub rsp, 0x10
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp fcn.180004622
ror ebx, 0xb
sub ecx, 0x62a57a2d
xor ebx, eax
add ebx, edx
add ebx, esi
and ebx, 0x40
je 0x18000a822
sub esi, 0x66ff4e4
sub ecx, 0x8998aac1
xor esi, 0x338b8611
xor esi, 0x3b451f3
jmp 0x1800080c9
add dword [rbp - 8], 0x3f6fd39f
xor ebx, dword [rbp - 8]
xor eax, 0xbfd79b79
sub ebx, 0x236e4670
rol edx, 9
xor edx, 0xdb130dc8
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x800
je 0x180003efd
ror esi, 0x16
sub ebx, 0xab9fbf0e
ror eax, 5
ror ebx, 5
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 0x1000000
je 0x180008044
ror eax, 0x1c
rol eax, 0x11
rol ebx, 2
ror eax, 0x14
sub esi, 0xdaa9467
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 8
je 0x180005d44
ror esi, 0xb
ror ebx, 0xe
sub esi, 0xea587dbf
jmp fcn.1800043b3
add dword [rbp - 8], 0x67f1d1a
xor ebx, dword [rbp - 8]
sub esi, 0xc580f26f
add eax, 0x5b11e1c8
rol eax, 0xf
xor esi, edx
add ebx, 0xad2ac25
add ebx, esi
add ebx, edi
add ebx, eax
and ebx, 0x80000
je 0x180009ce3
sub ecx, 0xa4597fa2
rol ebx, 0x15
ror ecx, 0xf
add ebx, edx
add ebx, eax
and ebx, 0x40000
je 0x180008fc8
rol ebx, 0xf
sub esi, 0x94054e4c
add ecx, 0x52fead16
add ebx, edx
add ebx, edi
and ebx, 0x200
je 0x1800015a1
add edi, 0x706903b6
sub edx, 0x1f06e04b
ror esi, 0x11
jmp fcn.1800026a4
Function at 0x18000935c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sar dword [rdx + 0x332863b2], cl
mov ebx, 0xe0d57cd2
mov rsp, rbp
mov dword [rbp - 8], 0x536c5d6f
mov esi, 0x220f7aab
mov edi, 0xab53180d
sub rsp, 0x10
add dword [rbp - 0x10], 1
mov eax, dword [rbp - 0x10]
jmp fcn.180004622
mov byte [rdx + 0x35c381e9], cl
jge 0x18000932e
hlt
Function at 0x1800098b6
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0xd62e197d
xor ebx, dword [rbp - 8]
xor ecx, dword [rbp - 0x10]
rol ebx, 0x12
sub esi, 0xe0c4f1e9
rol ecx, 0x11
xor edi, 0xb81d3af
add ebx, eax
add ebx, edi
add ebx, ecx
and ebx, 0x40000
je 0x18000a967
sub ecx, 0xd1dbc3a4
xor esi, 0x5f670d53
rol ecx, 0x1a
add ebx, edx
add ebx, edi
add ebx, esi
and ebx, 0x8000
je 0x1800075de
ror ecx, 0xe
sub edx, 0x740166fb
add edx, 0x40b1e3bc
ror esi, 0x1a
rol esi, 0x18
add ebx, edi
add ebx, esi
and ebx, 0x2000
je 0x180002f90
xor eax, dword [rbp - 8]
add edx, 0x2ca0cae9
xor ebx, dword [rbp - 8]
jmp 0x180006802
add dword [rbp - 8], 0xc82d847b
xor ebx, dword [rbp - 8]
xor esi, 0x114bf2bb
add ecx, 0x15a49e7e
sub eax, 0x635401bd
add ebx, eax
add ebx, esi
and ebx, 0x400
je 0x180001417
xor esi, 0xf218b650
sub ecx, 0x48f9032a
add esi, 0x5a24505e
add ebx, ecx
add ebx, esi
add ebx, eax
and ebx, 8
je 0x18000399a
add esi, 0x2ba5b86f
rol ecx, 5
ror edi, 0x11
add ebx, esi
add ebx, eax
add ebx, edx
and ebx, 0x20000
je 0x18000999f
sub edx, 0x76634c9e
add esi, 0xa0d6f548
sub edx, 0x2dad6f85
ror ecx, 8
ror eax, 9
jmp 0x1800036f6
add dword [rbp - 8], 0xba82569
xor ebx, dword [rbp - 8]
xor esi, edi
add esi, 0xc72236f2
ror ecx, 5
add ebx, eax
add ebx, ecx
add ebx, edx
and ebx, 0x8000
je 0x1800022fb
sub esi, 0xfd1237fd
ror ecx, 0x1c
rol ebx, 0x16
ret
invalid
ror ecx, 8
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x40000000
je fcn.1800090d9
rol eax, 0x11
add eax, 0x3bad1e0f
xor eax, 0xe47581c6
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 0x40000000
je 0x18000666c
sub ecx, 0x3178482b
xor edx, esi
rol ecx, 7
ror eax, 0xc
xor edi, edx
lea ecx, [rsi + rcx + 0x6b]
add eax, 0xe820d3a2
add ebx, edi
add ebx, ecx
and ebx, 8
je 0x180007977
sub edx, 0xf7ee4404
add edi, 0xcf37a885
add edx, 0x768039c8
add ebx, eax
add ebx, ecx
and ebx, 0x8000000
je 0x180005ee5
xor ebx, eax
rol edi, 2
ror ecx, 3
add ebx, 0xf238ad30
add ebx, edx
add ebx, ecx
add ebx, eax
and ebx, 0x20000000
je 0x180003e75
xor ecx, 0x4c8e8c3b
rol edi, 0xa
xor edi, eax
jmp 0x180004735
Function at 0x180009d00
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x332863b2
mov ebx, 0xe0d57cd2
mov ecx, 0xd31763ad
mov edi, 0xab53180d
mov esi, 0x220f7aab
mov rsp, rbp
mov dword [rbp - 8], 0x536c5d6f
sub rsp, 0x10
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp fcn.180004622
ror ebx, 0xb
sub ecx, 0x62a57a2d
xor ebx, eax
add ebx, edx
add ebx, esi
and ebx, 0x40
je 0x18000a822
sub esi, 0x66ff4e4
sub ecx, 0x8998aac1
xor esi, 0x338b8611
xor esi, 0x3b451f3
jmp 0x1800080c9
add dword [rbp - 8], 0x3f6fd39f
xor ebx, dword [rbp - 8]
xor eax, 0xbfd79b79
sub ebx, 0x236e4670
rol edx, 9
xor edx, 0xdb130dc8
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x800
je 0x180003efd
ror esi, 0x16
sub ebx, 0xab9fbf0e
ror eax, 5
ror ebx, 5
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 0x1000000
je 0x180008044
ror eax, 0x1c
rol eax, 0x11
rol ebx, 2
ror eax, 0x14
sub esi, 0xdaa9467
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 8
je 0x180005d44
ror esi, 0xb
ror ebx, 0xe
sub esi, 0xea587dbf
jmp fcn.1800043b3
add dword [rbp - 8], 0x67f1d1a
xor ebx, dword [rbp - 8]
sub esi, 0xc580f26f
add eax, 0x5b11e1c8
rol eax, 0xf
xor esi, edx
add ebx, 0xad2ac25
add ebx, esi
add ebx, edi
add ebx, eax
and ebx, 0x80000
je 0x180009ce3
sub ecx, 0xa4597fa2
rol ebx, 0x15
ror ecx, 0xf
add ebx, edx
add ebx, eax
and ebx, 0x40000
je 0x180008fc8
rol ebx, 0xf
sub esi, 0x94054e4c
add ecx, 0x52fead16
add ebx, edx
add ebx, edi
and ebx, 0x200
je 0x1800015a1
add edi, 0x706903b6
sub edx, 0x1f06e04b
ror esi, 0x11
jmp fcn.1800026a4

Function at 0x180009f08
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rsp
mov eax, 0xcb01fb01
and ebx, 0x200000
je fcn.1800043b3
ror ebx, 0xf
ror edx, 7
ror esi, 6
rol edi, 6
xor ecx, dword [rbp - 0x10]
jmp 0x1800098a4
Function at 0x18000a200
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and ebx, 0x20
je 0x1800073d1
ror edx, 0x1c
rol ecx, 9
sub edx, 0x776fd052
add ebx, ecx
add ebx, eax
and ebx, 0x10
je 0x180002f00
rol esi, 0x1e
xor ecx, dword [rbp - 8]
rol edx, 0x18
ror eax, 0x1e
add ebx, ecx
add ebx, edx
add ebx, esi
and ebx, 0x1000000
je 0x1800098a4
sub edx, 0x882bfd5e
rol esi, 0x10
rol ebx, 0x10
xor ebx, 0x46fc90be
add ebx, 0xf6f8daea
imul cl
fidivr dword [rcx - 1]
invalid
Function at 0x18000cb88
Capabilities:
Encrypt data using chaskey
Get number of processors
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0xb8
call fcn.18000e148
lea rcx, [rbx + 0xa8]
call fcn.18000e148
lea rax, [0x180012090]
lea rcx, [rbx + 8]
mov qword [rbx], rax
add rsp, 0x20
pop rbx
jmp fcn.1800098b6

Function at 0x18000ec04
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and qword [rdx], 0
mov eax, 2
mov r8, rdx
mul rcx
test rdx, rdx
je 0x18000ec1f
mov eax, 0x80070216
ret
mov rdx, r8
mov rcx, rax
jmp fcn.1800088a4

Function at 0x18000f350
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
or rax, 0xffffffffffffffff
mov r10, r8
xor esi, esi
mov rdi, rcx
inc rax
cmp word [r9 + rax*2], si
jne 0x18000f370
cmp rax, 0x7fffffff
jae 0x18000f3c9
lea eax, [rax*2 + 2]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], r9
mov rdx, r10
mov r9d, 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp rcx, rdi
je 0x18000f3ce
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x18000f3ce
mov ebx, 0x216
test ebx, ebx
jle 0x18000f3db
movzx ebx, bx
or ebx, 0x80070000
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180010610
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x180019120]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
and qword [rsp + 0x28], 0
mov rdi, rdx
mov edx, dword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx]
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
cmp eax, 0x103
jne 0x18001067f
mov eax, 1
jmp 0x1800106d9
test eax, eax
je 0x1800106a1
mov rcx, qword [rsp + 0x278]
lea r8, str.minioprofapi_appcontainer.cpp
mov r9d, eax
mov edx, 0x125
call fcn.18000f32c
jmp 0x1800106d9
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSidToSidW]
nop dword [rax + rax]
test eax, eax
jne 0x1800106d4
mov rcx, qword [rsp + 0x278]
lea r8, str.minioprofapi_appcontainer.cpp
mov edx, 0x127
call fcn.18000d814
jmp 0x1800106d9
inc dword [rbx + 8]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180008d80
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x1800108ec
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x180019120]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
mov rdi, rcx
call fcn.18000ed74
xor ebx, ebx
test eax, eax
je 0x1800109ec
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x18001093f
mov eax, ebx
jmp 0x1800109e2
call fcn.1800068a4
cmp eax, 0x80070003
jne 0x1800109e2
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], bx
jne 0x180010953
mov ebp, 0x5c
lea rcx, [rsp + 0x20]
mov edx, 0x104
cmp word [rdi + rax*2 - 2], bp
jne 0x18001097c
mov r8, rdi
call fcn.18000178c
jmp 0x18001098b
mov r9, rdi
lea r8, [0x180015498]
call fcn.1800079f0
test eax, eax
js 0x1800109dd
movzx ecx, word [rsp + 0x26]
lea rdi, [rsp + 0x26]
jmp 0x1800109d6
cmp cx, bp
jne 0x1800109cf
cmp word [rdi + 2], bx
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov word [rdi], bx
cmovne rdx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x1800109c7
mov eax, ebx
jmp 0x1800109cc
call fcn.1800068a4
mov word [rdi], bp
add rdi, 2
movzx ecx, word [rdi]
test cx, cx
jne 0x18001099b
jmp 0x1800109e2
mov eax, 0x800700ce
cmp eax, 0x800700b7
cmovne ebx, eax
jmp 0x1800109f1
mov ebx, 0x800700a1
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180008d80
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret

Function at 0x180010bf0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
or rax, 0xffffffffffffffff
mov r10, r8
xor esi, esi
mov rdi, rcx
inc rax
cmp word [r9 + rax*2], si
jne 0x180010c10
cmp rax, 0x7fffffff
jae 0x180010c69
lea eax, [rax*2 + 2]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], r9
mov rdx, r10
mov r9d, 2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp rcx, rdi
je 0x180010c6e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x180010c6e
mov ebx, 0x216
test ebx, ebx
jle 0x180010c7b
movzx ebx, bx
or ebx, 0x80070000
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret