joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c680
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x769e6799
xor ebx, dword [rbp - 0x28]
ror esi, 0xc
sub edx, 0x3a908a0a
add esi, 0x978a0bfb
add ebx, 0xda68cc17
sub ebx, 0xc5dd8dc1
add ebx, edx
add ebx, ecx
add ebx, edi
and ebx, 0x2000000
je 0x18000301b
xor edx, ecx
add edx, 0xb491649
add eax, 0xd73c0a67
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x400000
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
mov dh, 1
jmp 0x1800083df

Function at 0x18000d170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x60]
xor ebx, ebx
mov r10, qword [rsp + 0x78]
mov r13, r8
mov rax, qword [rsp + 0x68]
mov qword [r14], r8
mov qword [r10], rax
mov r11, qword [r14]
cmp r11, r9
je 0x18000d34b
mov rsi, r11
lea ebp, [rbx + 1]
mov r15, qword [r10]
mov r9d, 0x3ff
mov r11, rsi
cmp r15, qword [rsp + 0x70]
je 0x18000d34b
mov r12b, bl
movzx eax, word [rsi]
cmp bp, word [rdx]
jae 0x18000d205
mov r8d, 0x2400
add ax, r8w
cmp ax, r9w
ja 0x18000d344
movzx r8d, word [rdx]
movzx eax, word [rsi]
shl r8d, 0xa
sub eax, 0xdc00
or r8d, eax
jmp 0x18000d225
movzx r8d, word [rsi]
mov edx, 0x2800
add ax, dx
cmp ax, r9w
ja 0x18000d225
shl r8d, 0xa
mov r12b, bpl
sub r8d, 0x35f0000
cmp r8d, 0x80
jae 0x18000d235
mov dl, r8b
mov edi, ebx
jmp 0x18000d26c
mov edx, r8d
cmp r8d, 0x800
jae 0x18000d24b
shr edx, 6
mov edi, ebp
or dl, 0xc0
jmp 0x18000d26c
cmp r8d, 0x10000
jae 0x18000d261
shr edx, 0xc
mov edi, 2
or dl, 0xe0
jmp 0x18000d26c
shr edx, 0x12
mov edi, 3
or dl, 0xf0
movzx eax, r12b
xor eax, ebp
mov rbp, qword [rsp + 0x70]
cmp edi, 3
lea r9d, [rax + rax]
cmovb r9d, edi
sub rbp, r15
inc r9d
mov eax, r9d
cmp rbp, rax
jl 0x18000d34b
mov rax, qword [rsp + 0x48]
cmp word [rax], bx
jne 0x18000d2d1
test byte [rcx + 0x14], 2
je 0x18000d2d1
lea ecx, [r9 + 3]
cmp rbp, rcx
jl 0x18000d34b
mov byte [r15], 0xef
mov ebp, 1
add qword [r10], rbp
mov rax, qword [r10]
mov byte [rax], 0xbb
add qword [r10], rbp
mov rax, qword [r10]
mov byte [rax], 0xbf
add qword [r10], rbp
jmp 0x18000d2d6
mov ebp, 1
add qword [r14], 2
test r12b, r12b
jne 0x18000d2e4
cmp edi, 3
jae 0x18000d2ef
mov rax, qword [r10]
mov byte [rax], dl
add qword [r10], rbp
sub r9d, ebp
test r9d, r9d
jle 0x18000d317
lea ecx, [rdi + rdi*2]
add ecx, ecx
mov rax, qword [r10]
sub ecx, 6
mov edx, r8d
sub r9d, ebp
shr edx, cl
and dl, 0x3f
or dl, 0x80
mov byte [rax], dl
add qword [r10], rbp
test r9d, r9d
jg 0x18000d2f9
mov rdx, qword [rsp + 0x48]
mov eax, ebp
shr r8d, 0xa
test r12b, r12b
cmovne ax, r8w
mov word [rdx], ax
mov r11, qword [r14]
mov rsi, r11
cmp r11, qword [rsp + 0x58]
je 0x18000d34b
mov rcx, qword [rsp + 0x40]
jmp 0x18000d1ba
mov eax, 2
jmp 0x18000d353
cmp r13, r11
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000d610
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
movzx eax, dl
lea rdx, [rcx + 0x10]
mov ecx, eax
jmp sym.msvcp110_win.dll__Tolower

Function at 0x18000dab0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180006a37

Function at 0x18000dc80
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0xad900738
xor ebx, dword [rbp - 0x28]
sub eax, 0x33b0d472
ror edi, 0x17
ror edi, 0x1d
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 2
je 0x180004d00
rol edi, 0x1b
add edi, 0x1f24fa40
ror ebx, 0x11
sub ebx, 0x49e15c11
ror esi, 0x18
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 0x400000
je 0x180003c84
add eax, 0x2b778a1a
ror eax, 0x13
add edx, 0xaa6b1623
xor edi, 0xa6dc97e9
xor edx, dword [rbp - 0x28]
add ebx, esi
add ebx, eax
and ebx, 0x8000
je 0x18000266d
rol edi, 0x11
xor esi, 0xcd860fd7
rol edi, 0x15
jmp 0x180007c21
add dword [rbp - 0x28], 0xd603616c
xor ebx, dword [rbp - 0x28]
add ecx, 0xebc9cdde
xor edi, 0xb39555f2
ror edi, 0x1b
add ebx, eax
add ebx, ecx
add ebx, esi
and ebx, 0x400
je 0x180002235
rol eax, 7
rol ebx, 0x16
add eax, 0x9969f8f0
add ebx, 0xc2144258
add ebx, eax
add ebx, ecx
and ebx, 2
je 0x180002d4f
rol edi, 9
sub edi, 0x97bbfcfb
ror ecx, 0xf
add ebx, ecx
add ebx, esi
and ebx, 0x40
je 0x1800064c4
rol ebx, 9
xor eax, dword [rbp - 0x28]
ror esi, 0xa
sub esi, 0xccb5bdb5
add eax, 0x2d1913c2
jmp 0x180002550
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180006c92

Function at 0x18000e710
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180005d2c

Function at 0x18000ea10
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp sym.msvcp110_win.dll___0facet_locale_std__IEAA__K_Z

Function at 0x18000ebd0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180003afb
Function at 0x1800109b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edi, 0xebea2c42
mov rsp, rbp
sub rsp, 0x30
add dword [rbp - 0x10], 1
mov dword [rbp - 0x28], 0x38caefc8
mov esi, 0xa88d2a18
mov eax, dword [rbp - 0x10]
mov ecx, 0x10e74163
mov ebx, 0x92e8d182
mov edx, 0xf8d59f44
jmp fcn.180007343
add dword [rbp - 0x28], 0x927151e8
xor ebx, dword [rbp - 0x28]
add edx, 0x31141570
add esi, 0x682706eb
sub ebx, 0x1d0cb4c8
add ebx, ecx
add ebx, esi
and ebx, 0x800000
je fcn.180004a57
ror esi, 0xa
ror edi, 0x10
sub ebx, 0x6d7e4166
xor ecx, edi
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x40000000
je 0x1800059aa
sub eax, 0xfb3eb39a
add ebx, 0x6407ccc6
ror edi, 0xb
xor esi, dword [rbp - 0x10]
add ebx, eax
add ebx, ecx
and ebx, 0x20000
je 0x180005120
ror ecx, 5
rol ebx, 0x1b
sub edi, 0x9de77279
rol edi, 0xc
jmp fcn.180001a39
add dword [rbp - 0x28], 0x97b10bcc
xor ebx, dword [rbp - 0x28]
sub ebx, 0xfdcfbd64
sub esi, 0xd9c31034
xor eax, 0x1a5e5a63
rol esi, 0xe
ror ecx, 0x19
add ebx, ecx
add ebx, edi
and ebx, 0x400
je fcn.180006e5e
rol ebx, 0x11
add eax, 0x41d9c755
rol esi, 0x1d
sub ecx, 0x7da8b09
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 0x800000
je 0x180001b8a
rol edi, 0x12
add ecx, 0xde4f72a6
xor ecx, edx
xor esi, edx
sub edi, 0xebef60c4
add ebx, ecx
add ebx, edi
and ebx, 0x400000
je 0x180007c21
ror ebx, 5
sub esi, 0x3583a577
ror esi, 0x16
ror ebx, 7
ror edx, 0x19
jmp 0x1800017e0
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180003a44

Function at 0x1800117d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180002bba
Function at 0x1800125b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x858fd5a0
xor ebx, dword [rbp - 0x28]
add ecx, 0x7326a8be
ror ebx, 0x1e
ror eax, 0xd
or eax, 0xd301cb01
add ebx, eax
and ebx, 0x200000
je 0x180001d0c
sub edx, 0xfd8e91fc
xor esi, 0xbd027315
sub ecx, 0x81c243ff
sub ebx, 0xed29b24
xor ebx, dword [rbp - 0x10]
add ebx, esi
add ebx, edx
and ebx, 0x20
je 0x18000aea9
xor eax, esi
add ebx, 0xe8778eaa
rol edi, 2
ror eax, 0xb
add ebx, edi
add ebx, edx
and ebx, 0x20000
je 0x18000af35
ror esi, 0x10
xor ecx, 0x85b07a50
sub eax, 0xc989054b
add eax, 0xf2055496
jmp 0x180004193
mov ebx, 0x92e8d182
mov edx, 0xf8d59f44
mov rsp, rbp
mov ecx, 0x10e74163
sub rsp, 0x30
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
mov edi, 0xebea2c42
mov dword [rbp - 0x28], 0x38caefc8
mov esi, 0xa88d2a18
jmp fcn.180007343
add dword [rbp - 0x28], 0xecd2693
xor ebx, dword [rbp - 0x28]
add esi, 0x1d1de8ce
xor esi, 0x85ac89a4
xor ecx, 0xa263fe39
add edi, 0x81c0a7a5
add ebx, eax
add ebx, ecx
and ebx, 0x80
add byte [rdi], cl
invalid
invalid
sar bh, 1
invalid
ror edx, 0xe
ror eax, 0x14
xor esi, eax
add ebx, esi
add ebx, ecx
and ebx, 0x20
je fcn.180003e81
sub ebx, 0x4b94ae4b
xor edx, dword [rbp - 0x10]
sub edx, 0x8bd28063
xor ecx, 0x728d6144
add ebx, eax
add ebx, edi
add ebx, ecx
and ebx, 0x800
je 0x1800030af
add edi, 0x80f5fba
xor edi, eax
rol esi, 0xb
jmp fcn.180004a57
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x1800072bb

Function at 0x1800133c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x10e74163
mov esi, 0xa88d2a18
mov edi, 0xebea2c42
mov ebx, 0x92e8d182
mov rsp, rbp
mov dword [rbp - 0x28], 0x38caefc8
sub rsp, 0x30
add dword [rbp - 0x10], 1
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180001ed4

Function at 0x180013510
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0xaaaf0309
xor ebx, dword [rbp - 0x28]
xor esi, ebx
xor ecx, 0x3cec8ca
add esi, 0x186064e5
sub eax, 0xfac76417
sub ecx, 0x3a1828ef
add ebx, ecx
add ebx, edi
add ebx, edx
and ebx, 0x20000
je fcn.180003226
xor ebx, 0x41fc4beb
xor ebx, ecx
rol ebx, 7
sub edx, 0x1d218bb
xor esi, dword [rbp - 0x10]
add ebx, eax
add ebx, ecx
and ebx, 0x8000
je 0x180007c21
sub ebx, 0x623dc2
sub edx, 0x5ea23f2b
rol ecx, 0xd
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 0x80000000
je 0x1800044f6
xor edi, 0x2bf6a623
rol ebx, 0x1b
sub ebx, 0xb333c30e
jmp 0x18000a2e7
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180003669

Function at 0x180015370
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
invalid
invalid
invalid
invalid
invalid
Function at 0x180015ed0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x1800039b3

Function at 0x18001dd70
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
movsxd rax, dword [rcx - 4]
sub rcx, rax
sub rcx, 8
jmp sym.msvcp110_win.dll___1_Container_base12_std__QEAA_XZ

Function at 0x18001dd90
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
movsxd rax, dword [rcx - 4]
sub rcx, rax
jmp sym.msvcp110_win.dll___1_Container_base12_std__QEAA_XZ

Function at 0x18002e780
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x13a416bb
xor ebx, dword [rbp - 0x28]
add eax, 0xaa66359b
ror edx, 9
sub esi, 0x1155a0c7
xor esi, dword [rbp - 0x28]
jne 0x180005c9a
add ebx, ecx
add ebx, edx
and ebx, 4
je 0x180002d4f
rol eax, 0x18
sub ecx, 0xa21fd585
add edx, 0xc804dc5f
add ebx, edx
add ebx, esi
and ebx, 0x800000
je 0x18000a698
xor ecx, 0xaf287542
sub edi, 0xa99e2b2d
rol ecx, 0x19
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x20000000
je 0x180005ab0
ror esi, 0xf
add ecx, 0x8d7c2ba0
sub ebx, 0xf9d1b39
rol ecx, 0x16
add eax, 0xa2feb825
jmp 0x1800018a4
add dword [rbp - 0x28], 0xe4f54b60
xor ebx, dword [rbp - 0x28]
xor edx, 0x7e5f6a14
sub ebx, 0xb73b7088
xor eax, dword [rbp - 0x28]
add ebx, edi
add ebx, ecx
add ebx, esi
and ebx, 8
je 0x1800034e1
rol edi, 0x1a
rol edx, 0x10
add edx, 0xeb0e43da
ror edx, 0xe
add ebx, edx
rol dword [rcx], cl
sti
add ebx, esi
and ebx, 1
je fcn.18000312f
add ecx, 0xc0ec2ce7
ror edx, 0xd
rol eax, 3
add edi, 0xe07099ef
add edx, 0x75599943
add ebx, ecx
add ebx, edi
and ebx, 4
je 0x180003f0f
add eax, 0xe08d2c1
rol eax, 0x12
sub ebx, 0x9c24b327
jmp fcn.18000524a
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180005ca6

Function at 0x180031c80
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov esi, 0xa88d2a18
mov edi, 0xebea2c42
jmp 0x180007a8b
mov esp, ebp
mov ecx, 0x10e74163
mov dword [rbp - 0x28], 0x38caefc8
cmp byte [rax - 0x7f], cl
in al, dx
xor byte [rax], al
add byte [rax], al
inc dword [rbp - 0x10]
mov edx, 0xf8d59f44
mov eax, dword [rbp - 0x10]
mov ebx, 0x92e8d182
jmp fcn.180007343
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180007a38

Function at 0x180034fa0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x1800017e0
Function at 0x1800357f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x1800032a9

Function at 0x1800359a0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x6dc66b02
xor ebx, dword [rbp - 0x28]
sub ecx, 0x36846273
add edx, 0x47e23e52
xor ebx, dword [rbp - 0x28]
add ebx, eax
add ebx, ecx
and ebx, 0x20
je 0x180007d10
xor ecx, 0x4e5a3745
rol esi, 0x1f
rol esi, 0x17
xor edx, edi
sub ebx, 0xbae2c7b9
add ebx, esi
add ebx, ecx
and ebx, 0x40000
je fcn.180004a57
add edx, 0x1dcbea78
xor esi, edx
ror edx, 0x1c
rol ecx, 0x15
sub edx, 0x6341e9a8
add ebx, eax
add ebx, ecx
add ebx, edi
and ebx, 0x400000
je 0x18000846e
add ecx, 0x9538d29c
add ebx, 0xd027d9d1
rol edi, 4
jmp 0x180009eb2
add dword [rbp - 0x28], 0xf344504b
xor ebx, dword [rbp - 0x28]
rol ebx, 0x1b
xor edx, 0xc0f372e0
add ecx, 0xf4d6ee99
sub esi, 0x7dd224c0
add ebx, edi
add ebx, ecx
add ebx, esi
and ebx, 2
je 0x180003329
add edi, 0xb6adaba5
ror edi, 0x1d
add edx, 0x44c27330
add ebx, ecx
add ebx, edx
and ebx, 0x100
je fcn.180008e27
ror esi, 0xe
add esi, 0x3e3c7163
rol edi, 0x1e
add edi, 0xf354f8c2
add ebx, edi
add ebx, esi
add ebx, edx
and ebx, 0x40
je fcn.180006e5e
ror edi, 0xf
xor esi, dword [rbp - 0x10]
jne 0x1800084d2
add edx, 0xf1a485da
jmp 0x1800043f0
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x18000707d

Function at 0x180037070
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x1800094ee

Function at 0x1800370a0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x44554c73
xor ebx, dword [rbp - 0x28]
add ebx, 0xf5522c8e
ror ebx, 6
ror esi, 0x1d
add esi, 0x9cf00d18
sub esi, 0x28493158
add ebx, ecx
add ebx, esi
add ebx, edi
and ebx, 0x100
je 0x180006d0f
ror eax, 5
add edx, 0xa2b6aecd
add esi, 0x7cb3030e
xor ebx, dword [rbp - 0x10]
ror eax, 0x11
add ebx, esi
add ebx, eax
ret
add ebx, ecx
and ebx, 0x1000
je fcn.180002b3a
add edi, 0x2e1472b1
rol ebx, 0x16
sub esi, 0x23d6ca5c
add ebx, edi
add ebx, eax
and ebx, 0x400000
je 0x180005ab0
sub ebx, 0x1fd56d36
sub ebx, 0x3b1c325c
ror edi, 0x1c
sbb al, 0x31
xlatb
sub edi, 0x7fc4d1fc
jmp 0x1800073c6
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180009d14

Function at 0x180037220
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
mov dh, 1
Function at 0x18003e3b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rcx, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x18003e3e9
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x18003e3cb
mov rax, rcx
shr rax, 0x20
xor eax, ecx
ret

Function at 0x1800427d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rcx, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180042803
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x1800427e5
mov rax, rcx
shr rax, 0x20
xor eax, ecx
ret

Function at 0x180042fb0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
lea rcx, [0x180082b30]
jmp sym.msvcp110_win.dll__Mtxlock

Function at 0x180042fd0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
test edx, edx
jne 0x180042fdc
lea ecx, [rdx + 0xc]
jmp sub.msvcrt.dll__lock
and edx, 3
mov eax, edx
mov dword [rcx], eax
lea rcx, [0x180082b30]
lea rax, [rdx + rdx*4]
lea rcx, [rcx + rax*8]
jmp sym.msvcp110_win.dll__Mtxlock

Function at 0x180043000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
jne 0x18004300e
mov ecx, 0xc
jmp sub.msvcrt.dll__lock
mov eax, ecx
lea rcx, [0x180082b30]
and eax, 3
lea rax, [rax + rax*4]
lea rcx, [rcx + rax*8]
jmp sym.msvcp110_win.dll__Mtxlock

Function at 0x180043520
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0xf8d59f44
mov ebx, 0x92e8d182
mov ecx, 0x10e74163
mov edi, 0xebea2c42
mov rsp, rbp
mov dword [rbp - 0x28], 0x38caefc8
mov esi, 0xa88d2a18
sub rsp, 0x30
add dword [rbp - 0x10], 1
mov eax, dword [rbp - 0x10]
jmp fcn.180007343
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180006bdd

Function at 0x1800435b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x1800030af
Function at 0x1800435e0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x669259f8
xor ebx, dword [rbp - 0x28]
ror edi, 0x1f
sub esi, 0xff3775cc
xor ecx, esi
add ebx, edi
add ebx, ecx
add ebx, eax
and ebx, 0x4000
je 0x180001c09
add ecx, 0x863d9935
rol ebx, 0xe
rol edi, 4
add eax, 0x5fd7b774
add ebx, ecx
add ebx, edi
add dword [rbp - 0x28], 0xee16f1c8
xor ebx, dword [rbp - 0x28]
rol edi, 3
rol eax, 0x1d
add edi, 0xb3c0b250
rol eax, 0xf
add ebx, ecx
add ebx, esi
and ebx, 0x200
je 0x18000a717
ror esi, 4
rol edi, 0xd
rol eax, 6
add ecx, 0x1dd1351f
rol ecx, 0x10
add ebx, edi
add ebx, esi
and ebx, 2
je 0x180004113
sub edx, 0x274f8e1a
add edx, 0xb5ad3082
rol edi, 0x1e
xor ebx, dword [rbp - 0x10]
add ebx, edi
add ebx, eax
and ebx, 0x800
je 0x18000aac1
sub edx, 0x258d24e1
ror esi, 4
xor ecx, dword [rbp - 0x10]
add esi, 0x9763ca6d
invalid
insd dword [rdi], dx
retf 0x9763
jmp 0x180008aee
add dword [rbp - 0x28], 0x5be182e5
xor ebx, dword [rbp - 0x28]
sub edi, 0x1b6740bf
ror edi, 0xc
ror ebx, 2
sub edx, 0x6b0cff32
ror edx, 0x15
add ebx, edx
add ebx, ecx
add ebx, eax
and ebx, 0x400000
je 0x180002550
sub ebx, 0x43d265f1
add ecx, 0x53c075ab
xor esi, 0xa0424683
sub ebx, 0x5aac9e44
add edx, 0x5985c2da
add ebx, edx
add ebx, esi
and ebx, 0x20000
je fcn.180004a57
sub ecx, 0xd44cd353
ror ecx, 0x1c
sub ecx, 0x724e2d02
ror edi, 0x1c
sub esi, 0x457709e4
add ebx, ecx
add ebx, esi
add ebx, eax
and ebx, 2
je 0x180005469
add ebx, 0x6cf2aac3
xor ecx, 0x3cb67182
ror eax, 0x1a
jmp fcn.180003226
add dword [rbp - 0x28], 0x67204162
xor ebx, dword [rbp - 0x28]
rol eax, 0x18
sub ebx, 0xad274cad
add eax, 0x43bb02a9
add ebx, eax
add ebx, esi
add ebx, edi
and ebx, 0x100
je 0x180006572
rol edx, 0x19
add dword [rbp - 0x28], 0x61303c43
xor ebx, dword [rbp - 0x28]
add edi, 0x5a90f17c
ror eax, 7
add edi, 0x1ef5710d
ror esi, 0x17
add ebx, eax
add ebx, ecx
add ebx, esi
and ebx, 0x80000000
je 0x180006b5c
sub eax, 0xe958eb1c
ror edx, 0x10
sub edi, 0xcb49ad19
sbb dword [rbp - 0x3e7e34b7], ebp
adc dword [rdx - 0x33], esi
mov eax, 0xd301c301
add ebx, esi
and ebx, 0x4000000
je 0x180009122
ror edx, 0xd
add esi, 0x578b2826
ror ecx, 0x15
add ebx, edx
add ebx, esi
add ebx, edi
and ebx, 0x80
je fcn.180005b35
rol esi, 7
sub edx, 0x60f4031e
xor ebx, 0x895ddd76
rol ecx, 0x19
sub eax, 0xd69de
jmp fcn.180003e81
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0x10], 0x1b635a9
jmp 0x180008139

Function at 0x1800437f0
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov dword [rsp + 0x30], eax
lea ecx, [rax + 5]
call fcn.1800436bc
mov ebx, 2
lea r8, [rsp + 0x30]
mov rcx, rax
mov r9d, ebx
lea edx, [rbx + 0x20]
call sub.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW
mov eax, dword [rsp + 0x30]
cmp ax, 0x30
je 0x18004383f
cmp ax, 0x31
jne 0x180043833
mov ebx, 1
jmp 0x18004383f
xor ebx, ebx
cmp ax, 0x32
lea ecx, [rbx + 3]
cmove ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180043ad8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800826e0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x78], rbx
je 0x180043c3b
cmp byte [rcx + 0x82], bl
je 0x180043c3b
mov rax, qword [rcx]
mov esi, 0xffff
mov edx, esi
mov rax, qword [rax + 0x18]
call qword [0x18004d668]
cmp si, ax
jne 0x180043b44
xor al, al
jmp 0x180043c40
mov edx, 0xf
mov qword [rbp - 0x18], rdx
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], 8
lea rax, [rbp - 0x30]
mov byte [rax + 8], bl
lea esi, [rdx - 0xe]
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r9, qword [rbp - 0x30]
lea r8, [rbp - 0x30]
cmovae r8, qword [rbp - 0x30]
mov rcx, qword [rdi + 0x78]
mov rdx, qword [rcx]
add r9, qword [rbp - 0x20]
mov rax, qword [rdx + 0x40]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
lea rdx, [rdi + 0x84]
call qword [0x18004d668]
mov ecx, eax
test eax, eax
je 0x180043bb2
sub ecx, esi
je 0x180043bb8
cmp ecx, 2
jne 0x180043c27
jmp 0x180043c24
mov byte [rdi + 0x82], bl
lea rax, [rbp - 0x30]
mov rdx, qword [rbp - 0x30]
mov r10, qword [rbp - 0x18]
cmp r10, 0x10
cmovae rax, rdx
mov r14, qword [rbp - 0x40]
sub r14, rax
je 0x180043bf8
lea rcx, [rbp - 0x30]
cmp r10, 0x10
cmovae rcx, rdx
mov r9, qword [rdi + 0x90]
mov r8, r14
mov rdx, rsi
call sub.msvcrt.dll_fwrite
cmp r14, rax
jne 0x180043c21
cmp byte [rdi + 0x82], bl
je 0x180043c1e
test r14, r14
jne 0x180043b65
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.180026414
jmp 0x180043b65
mov bl, sil
mov sil, bl
mov bl, sil
cmp qword [rbp - 0x18], 0x10
jb 0x180043c37
mov rcx, qword [rbp - 0x30]
call fcn.180045898
mov al, bl
jmp 0x180043c40
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180045e80
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret