joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff74185c54
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add dword [rbp - 0x10], 0xc38ad32c
xor ebx, dword [rbp - 0x10]
ror esi, 0x16
xor esi, eax
add edx, 0x3a79d95f
rol eax, 0xd
ror edx, 0x15
add ebx, edx
add ebx, ecx
add ebx, eax
and ebx, 0x40000000
add dword [rbp - 0x10], 0xf6e6f3d1
xor ebx, dword [rbp - 0x10]
rol ecx, 0xd
ror ecx, 0x16
add ebx, 0xfc05b942
mov ecx, 0xc181fc05
cmp dword [rax], ebp
and ah, cl
ror edx, 0x11
add ebx, edi
add ebx, edx
and ebx, 0x20000
je 0x7ff74184ab2
sub ecx, 0xdc1f160c
xor eax, 0x64a8e06d
add esi, 0x1af917ab
sub ebx, 0x251190ee
add ebx, 0xfb82f8d3
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x10000000
je fcn.7ff741851db
xor eax, 0x5c115258
xor edx, esi
sub esi, 0x1c47859
xor eax, ecx
add ebx, eax
add ebx, edx
and ebx, 0x4000000
je 0x7ff74183d99
ror edi, 0x18
rol ecx, 0x18
xor esi, dword [rbp - 8]
xor ebx, eax
rol edi, 0x14
jmp fcn.7ff74184b42
add edi, 0x9e0241df
add eax, 0x609afaa2
add ebx, edx
add ebx, esi
and ebx, 0x10000
je 0x7ff7418442e
xor ebx, 0xce2030a2
xor eax, 0x1699345d
ror ebx, 9
add ebx, 0x40a32ce0
jmp fcn.7ff74185619
Function at 0x7ff741861cc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x4c5afff5
jmp 0x7ff741896bc

Function at 0x7ff741862c4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
rol eax, 8
xor eax, edx
ror eax, 4
add esi, 0xb78d5550
rol edi, 0x15
add ebx, ecx
add ebx, esi
and ebx, 0x8000000
je 0x7ff74188ac5
sub ecx, 0x841799ac
rol ebx, 0xd
rol ebx, 0x12
sub esi, 0x8eb7e07d
sub edi, 0x9b005b8c
Function at 0x7ff7418675c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x13076834
xor ebx, dword [rbp - 0x10]
sub edi, 0xdc88d290
rol ebx, 0x13
xor edi, eax
add esi, 0xc4d76b76
ror eax, 0x1e
add ebx, ecx
add ebx, edi
and ebx, 0x8000000
add dword [rbp - 0x10], 0x50e6b8d3
xor ebx, dword [rbp - 0x10]
sub esi, 0xfe35474c
inc cl
invalid
sbb dword [rcx + 0x57f510c0], eax
invalid
sub ecx, 0x91c0e887
add ebx, esi
add ebx, ecx
and ebx, 0x80000000
je fcn.7ff741877e7
sub edx, 0x352da6ea
ror edx, 4
ror esi, 0x10
ror ebx, 8
add ebx, eax
add ebx, edi
and ebx, 0x400
je fcn.7ff74186fb9
add edx, 0x93356459
rol edx, 0x1a
rol ebx, 0x10
add ebx, edx
add ebx, eax
and ebx, 0x4000000
je 0x7ff74182028
xor ecx, esi
rol ecx, 0x14
sub edx, 0x8506fd0f
xor ebx, 0x91ef9b79
jmp 0x7ff74184ab2
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74185b81

Function at 0x7ff74186990
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor ebx, dword [rbp - 0x10]
sub ebx, 0x368e9d38
xor ecx, 0x3651c4a1
sub esi, 0x1daedd4c
add edx, 0x5ba09ad2
ror edx, 0x10
add ebx, eax
add ebx, edi
add ebx, esi
and ebx, 0x8000
je 0x7ff74187665
rol ecx, 6
ror eax, 0xb
ror edi, 8
ror edi, 0xf
add ebx, esi
add ebx, edx
add ebx, edi
and ebx, 0x8000000
add dword [rbp - 0x10], 0x40294708
xor ebx, dword [rbp - 0x10]
rol ebx, 0x14
sub eax, 0x4212d9ce
sub esi, 0x217619de
sub eax, 0x2c1476c
xor eax, dword [rbp - 0x10]
add ebx, eax
add ebx, ecx
and ebx, 1
je 0x7ff74189f52
ror esi, 0xf
xor eax, 0x1a8083b2
xor ecx, 0x920bf2f1
sub edi, 0x41683aad
add ebx, ecx
add ebx, edi
add ebx, esi
and ebx, 0x2000000
je 0x7ff74182dcc
ror edx, 0xb
sub edx, 0x67983665
xor ebx, dword [rbp - 8]
add ebx, eax
add ebx, edi
add ebx, esi
and ebx, 0x1000000
je 0x7ff74184ab2
sub ecx, 0xb2bf0f4a
rol ebx, 9
add edi, 0x12bd33c0
jmp fcn.7ff74188306
add dword [rbp - 0x10], 0x94c99fa2
xor ebx, dword [rbp - 0x10]
ror ebx, 0xe
sub eax, 0xdd81f320
ror ebx, 0x1b
add edi, 0xfa14bc2b
add ebx, edi
add ebx, ecx
and ebx, 0x20000
je 0x7ff74184ab2
rol ecx, 7
sub ebx, 0x7e155d64
rol ebx, 0x1c
add ebx, esi
add ebx, ecx
add ebx, edx
and ebx, 1
je 0x7ff74188f41
ror eax, 0xa
xor esi, 0xbddde897
add eax, 0x7408ca0b

Function at 0x7ff741869d8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
je fcn.7ff74186bca
xor ecx, edx
ror edx, 9
rol edi, 0x14
add ebx, edi
add ebx, ecx
and ebx, 0x4000000
je 0x7ff74186260
sub edx, 0x1bbe9e50
xor edx, dword [rbp - 0x10]
add edi, 0x3261e389
rol edi, 4
jmp 0x7ff741857a3
Function at 0x7ff74187278
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
and eax, 0x1703c281
sbb cl, al
rcr dword [0x7ffb3aa5e08], 0x6c
add rbx, rsi
add ebx, edx
and ebx, 0x8000
je 0x7ff741895a9
rol ecx, 0xb
sub esi, 0x3890be58
xor edx, 0x7f2f8378
add eax, 0xb95f58e8
ror ecx, 0x15
add ebx, eax
add ebx, ecx
and ebx, 0x8000
je fcn.7ff74186fb9
xor ecx, 0xbc4be1d0
sub ecx, 0xfdde9e5c
add edi, 0xd0b2dc6d
mov dl, 0xd0

Function at 0x7ff741872d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov dl, 0xd0
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 0x20000
je 0x7ff7418aa5f
ror ebx, 0xf
add eax, 0xa77eefb7
sub edi, 0x716cc701
sub ebx, 0x94e829f9
jmp 0x7ff74184145

Function at 0x7ff741877c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
rol ebx, 0xf
add ebx, esi
add ebx, ecx
and ebx, 0x80000000
je 0x7ff741894ae
ror ecx, 8
sub edx, 0x94ff8e70
sub edi, 0x39890a71
jmp 0x7ff7418442e
Function at 0x7ff74187b34
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x2880a7b6
xor ebx, dword [rbp - 0x10]
xor ebx, dword [rbp - 0x10]
sub eax, 0xf6cbedd4
rol edx, 0xf
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x100000
je fcn.7ff74184cec
sub edx, 0x8859d634
rol esi, 0xc
rol edx, 0x1c
add ebx, edi
add ebx, ecx
and ebx, 0x4000
je 0x7ff74188684
xor edi, dword [rbp - 0x10]
rol edx, 6
xor esi, 0x6857db46
ror eax, 0x1e
rol edx, 0xe
add ebx, ecx
add ebx, edx
add ebx, esi
and ebx, 0x80
je 0x7ff74188ac5
add ecx, 0x449b8f0a
ror esi, 8
ror esi, 0x13
xor edi, esi
rol ebx, 0xc
jmp fcn.7ff74183f54
add dword [rbp - 0x10], 0x94c979bd
xor ebx, dword [rbp - 0x10]
rol edx, 0xf
add ecx, 0x7117676f
ror ecx, 0x17
ror edx, 0xd
rol edi, 0xc
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 8
je fcn.7ff741851db
sub edi, 0x460ccd51
ror edi, 0x18
sub edx, 0x1bd7599a
add ebx, ecx
add ebx, edx
add ebx, esi
and ebx, 0x40
je 0x7ff7418aa5f
ror esi, 0x1b
rol ebx, 0x1f
rol ecx, 0x18
rol eax, 0x14
add ebx, ecx
add ebx, edi
add ebx, esi
and ebx, 0x100
je 0x7ff74181bf2
invalid
sub edx, 0x6d6a7df2
je 0x7ff74189e61
add esi, 0x18079e2d
sub ecx, 0x377754c2
xor edx, 0x87496bd3
add ebx, ecx
add ebx, esi
add dword [rbp - 0x10], 0x7445bbf9
xor ebx, dword [rbp - 0x10]
sub ecx, 0x708b400a
sub esi, 0x1f59cb49
rol ebx, 0x16
add ebx, edi
add ebx, edx
and ebx, 0x100000
je 0x7ff74184819
add eax, 0x2ae5d031
xor eax, 0xb6c3234f
xor edi, dword [rbp - 0x10]
add ebx, edx
add ebx, eax
and ebx, 0x400
je fcn.7ff74188bca
rol esi, 0xc
sub edi, 0xacd85ca1
rol esi, 0x1b
add dword [rbp - 0x10], 0x4d0afca
xor ebx, dword [rbp - 0x10]
rol eax, 9
ror eax, 0xd
rol edi, 0x1e
sub edi, 0xe44b04c2
rol ebx, 3
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x80
je 0x7ff7418307a
rol esi, 0x1b
sub edi, 0x81d2997b
xor ebx, ecx
add ebx, edx
add ebx, edi
and ebx, 0x1000
je 0x7ff74185ff6
xor esi, 0xe0689842
xor eax, 0xe8018bbd
sub ebx, 0x79879cc8
sub ecx, 0x59920fb8
add ebx, eax
add ebx, edx
and ebx, 0x4000000
je 0x7ff741822c9
add ecx, 0xab0b8cf6
sub ebx, 0x5757fe45
xor edx, esi
sub esi, 0xdacda20b
jmp fcn.7ff74183a40
Function at 0x7ff741880d8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
movabs byte [0x172de1f081f05d33], al
invalid

Function at 0x7ff741882c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add ebx, edx
and ebx, 0x10000
je 0x7ff7418470c
sub ebx, 0x65c1aab1
sub edx, 0x7b95015d
xor edi, dword [rbp - 0x10]
add ebx, edx
add ebx, edi
add ebx, eax
and ebx, 0x200000
je 0x7ff741894ae
rol ecx, 6
add ebx, 0x7557a005
ror esi, 0x18
ror eax, 0x1b
rol ecx, 0x14
jmp 0x7ff74188ac5

Function at 0x7ff741884bc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add dword [rbp - 0x10], 0xdfb888f3
xor ebx, dword [rbp - 0x10]
rol ecx, 0x1b
sub edi, 0xe0c8fe0e
ror edi, 0x1c
add esi, 0x7cf5b0a2
add ebx, eax
add ebx, edx
and ebx, 0x10000
je fcn.7ff74189d13
xor ecx, esi
sub eax, 0xa16a56f8
rol ebx, 0xf
add edx, 0x2668a545
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 0x20
je 0x7ff741887b2
add esi, 0x558127ec
rol edi, 0xb
sub esi, 0x9d0ffbbb
add ebx, esi
add ebx, edx
and ebx, 0x20
je fcn.7ff74184cec
xor ecx, eax
rol ebx, 0x11
xor edi, 0x88f14b1b
jmp fcn.7ff74188306
add edx, 0xb0d08f25
ror esi, 0x16
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 0x40000000
je 0x7ff741858b9
sub ecx, 0xf2bc386c
ror ecx, 0x16
xor ebx, edi
ror eax, 6
rol edi, 0x19
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 4
je 0x7ff741811d3
add edx, 0x68e904b5
rol ecx, 0x1a
add ecx, 0xcb2027f1
xor eax, 0x6b6ccee
add ebx, ecx
add ebx, edi
and ebx, 0x40000000
je 0x7ff74186260
add edi, 0xfd13afcc
ror ebx, 2
ror ecx, 0xa
jmp fcn.7ff74185b03
mov rsp, rbp
mov dword [rbp - 0x10], 0x77da0913
sub rsp, 0x20
inc dword [rbp - 8]
mov ebx, 0x37d420d1
mov esi, 0xc246133a
mov edi, 0xe7344c97
mov edx, 0xb60c4ed7
mov ecx, 0xeb44d5a2
mov eax, dword [rbp - 8]
jmp fcn.7ff7418a400
add dword [rbp - 0x10], 0xbe7ddad6
xor ebx, dword [rbp - 0x10]
xor ecx, 0xbb5b526d
add ecx, 0xc80eb2f7
ror esi, 0x1f
rol edx, 0xb
sub esi, 0xcd930fb
add ebx, esi
add ebx, edx
and ebx, 0x10
je 0x7ff74184018
ror edi, 0x1c
rol edx, 0x1d
ror ebx, 9
add ebx, ecx
add ebx, edx
and ebx, 0x80000000
je 0x7ff7418aa5f
ror eax, 5
rol edx, 0x10
xor ecx, 0x47a929f1
add eax, 0xf3cd68b3
xor edi, 0x566f486c
add ebx, edx
add ebx, edi
and ebx, 4
je 0x7ff741886f8
rol eax, 0x15
sub esi, 0x90aff402
xor esi, dword [rbp - 8]
add ecx, 0x11aac124
jmp 0x7ff74186b1a

Function at 0x7ff741885a0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff741818f0
Function at 0x7ff741885f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x2ddf4cae
xor ebx, dword [rbp - 0x10]
ror edi, 0x11
ror esi, 8
sub esi, 0x22af0937
rol ecx, 4
rol esi, 0x1a
add ebx, eax
add ebx, ecx
add ebx, edi
and ebx, 0x200000
je section..text
ror edx, 0xb
add ebx, 0x5d5669b5
rol esi, 0x1e
rol ebx, 3
xor edi, eax
add ebx, eax
add ebx, esi
add ebx, edx
and ebx, 0x1000
jrcxz 0x7ff74185762
adc byte [rax], al
add byte [rdi], cl
test dl, ah
invalid
invalid
invalid
add eax, 0xcd95116b
add ecx, 0x27a5021e
ror eax, 0x1d
ror edx, 4
add ebx, eax
add ebx, edx
add ebx, ecx
and ebx, 0x4000000
je 0x7ff7418929b
rol esi, 0x16
xor edx, dword [rbp - 8]
xor ecx, dword [rbp - 0x10]
ror edi, 0xb
ror edi, 0x1b
jmp fcn.7ff74186bca
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff7418a154
add dword [rbp - 0x10], 0xf456c21a
xor ebx, dword [rbp - 0x10]
rol ecx, 0x1f
xor esi, 0x2996bae
sub ebx, 0x3f7d2c1
add ebx, 0xe4a9ca89
add ebx, eax
add ebx, ecx
and ebx, 0x20
je 0x7ff7418a55b
xor edx, dword [rbp - 8]
rol ecx, 0x1f
rol esi, 0x1a
add ebx, edi
add ebx, ecx
add ebx, eax
and ebx, 0x8000000
je 0x7ff74184018
rol ebx, 6
ror ecx, 9
sub edi, 0xac3613c0
ror ebx, 0xb
add ebx, esi
add ebx, edx
add ebx, edi
and ebx, 0x100000
je 0x7ff7418571a
sub edx, 0x4c77f1fe
xor eax, dword [rbp - 8]
ror ecx, 0x14
ror edx, 0xf
sub edi, 0x64dec725
jmp fcn.7ff74182947

Function at 0x7ff741886d8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0xb60c4ed7
mov esi, 0xc246133a
mov ebx, 0x37d420d1
mov ecx, 0xeb44d5a2
mov rsp, rbp
mov dword [rbp - 0x10], 0x77da0913
mov edi, 0xe7344c97
sub rsp, 0x20
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
jmp fcn.7ff7418a400
add ebx, eax
add ebx, ecx
and ebx, 0x40000
je 0x7ff74189435
ror ebx, 0x11
xor edi, eax
add edi, 0xa6eb8ada
jmp 0x7ff74181eed

Function at 0x7ff7418891c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add ebx, edi
and ebx, 4
je 0x7ff74182dcc
ror edx, 0x17
xor esi, dword [rbp - 0x10]
add edi, 0x3258fab6
ror eax, 0xd
add ebx, 0xce4679cf
add ebx, ecx
add ebx, edx
and ebx, 0x10000
je fcn.7ff74185b03
sub ecx, 0x1e81b75e
ror esi, 0x15
xor ecx, 0xc665991c
ror edx, 0x1a
add ebx, ecx
Function at 0x7ff74188960
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x57091f8f
xor ebx, dword [rbp - 0x10]
xor eax, edi
rol ebx, 0x17
sub esi, 0xed8757f5
sub edi, 0x5a5fc570
add ebx, edx
add ebx, eax
and ebx, 0x8000000
je 0x7ff74185377
sub eax, 0xeffe5b4d
ror edi, 2
ror ecx, 0x1e
ror edx, 4
add ebx, edi
add ebx, eax
and ebx, 0x40000000
je 0x7ff741811d3
add esi, 0x722cc7ab
sub edx, 0x16a71b72
rol eax, 0x17
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x8000
je fcn.7ff74186fb9
rol esi, 0xa
xor eax, 0xd9846020
xor eax, 0x6120635
xor ebx, dword [rbp - 0x10]
xor edx, ebx
jmp 0x7ff7418929b
add dword [rbp - 0x10], 0x803c1a8c
xor ebx, dword [rbp - 0x10]
ror edx, 8
sub edi, 0x9b46ec0c
rol edi, 0xa
add ebx, ecx
add ebx, edi
and ebx, 0x40000000
invalid
invalid
invalid
cmp byte [rax], al
add ebx, edi
and ebx, 0x100
je fcn.7ff74184b42
add ecx, 0xb91cf6ac
ror ecx, 0x17
rol edx, 8
ror esi, 0x13
add ecx, 0x6ba79421
jmp 0x7ff74184e45

Function at 0x7ff74188be0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
rol ebx, 0x19
rol ebx, 0x19
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x20
je fcn.7ff74187bcf
add ebx, 0xaf935100
sub esi, 0xcb1d71d5
xor esi, 0xb3cac03c
ror esi, 0x1c
add ebx, ecx
add ebx, edx
and ebx, 0x1000
je 0x7ff74189da1
invalid
invalid

Function at 0x7ff74188c94
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74185a7a

Function at 0x7ff741892fc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor esi, edi
sub edi, 0xf2ea5f1f
add ebx, eax
add ebx, edi
and ebx, 0x1000000
je 0x7ff74186260
add edx, 0xba5d77f1
xor edi, esi
xor eax, 0x89c08494
add ecx, 0x4a7f1ef1
xor esi, edi
jmp 0x7ff7418932f
add dword [rbp - 0x10], 0xae3d3bfc
xor ebx, dword [rbp - 0x10]
sub edi, 0xf9ce5022
sub eax, 0x9630679b
sub edi, 0xc256982
add edx, 0xc00d3965
add ebx, edx
add ebx, eax
add ebx, edi
and ebx, 1
je 0x7ff74184819
ror esi, 0x1d
ror ebx, 0x1d
rol eax, 0x14
add ebx, eax
add ebx, esi
add ebx, edi
and ebx, 0x80
je 0x7ff741837cc
xor esi, 0xa9f7cd17
sub ecx, 0x980f21c
add edi, 0x8d1c7e72
add ebx, edx
add ebx, edi
and ebx, 0x4000000
je 0x7ff741868fe
sub ecx, 0xeff8ffce
ror eax, 6
add eax, 0xf5b41510
rol edi, 0xb
rol eax, 0x1f
jmp 0x7ff74188ac5

Function at 0x7ff74189718
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jmp 0x7ff7418971b
rol dword [rcx], cl
ret
Function at 0x7ff74189fa8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov rsp, rbp
sub rsp, 0x20
mov edx, 0xb60c4ed7
mov edi, 0xe7344c97
mov ebx, 0x37d420d1
mov ecx, 0xeb44d5a2
mov dword [rbp - 0x10], 0x77da0913
mov esi, 0xc246133a
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
jmp fcn.7ff7418a400
ror ecx, 0xe
sub ecx, 0x63196a30
add ebx, eax
add ebx, edx
add ebx, ecx
and ebx, 1
je 0x7ff74187cc4
sub esi, 0x49a1a69c
sub edi, 0x8e37144e
ror edi, 0x11
xor edx, dword [rbp - 0x10]
jmp 0x7ff741876ed

Function at 0x7ff7418a440
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
cmp ebx, dword [rcx - 0x7f]
out dx, eax
loope 0x7ff7418a46b
or byte [rdi + 1], ah
rol dword [rcx], cl
ret

Function at 0x7ff7418a5a4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
inc ecx
rcl dword [0x7fef533676e], 0xc3
and eax, 0xc1a37f76
retf

Function at 0x7ff7418a68c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edi, 0xe7344c97
mov ecx, 0xeb44d5a2
mov rsp, rbp
mov esi, 0xc246133a
sub rsp, 0x20
inc dword [rbp - 8]
mov edx, 0xb60c4ed7
mov dword [rbp - 0x10], 0x77da0913
mov ebx, 0x37d420d1
mov eax, dword [rbp - 8]
jmp fcn.7ff7418a400
xor ebx, dword [rbp - 0x10]
sub ecx, 0x2d86d615
ror eax, 7
ror esi, 0x1c
add ebx, esi
add ebx, ecx
and ebx, 0x40000
add byte [rax + rax], al
je 0x7ff74186d6b
ror ecx, 0x12
rol eax, 0xa
rol edx, 0x1a
add ebx, ecx
add ebx, esi
and ebx, 0x100000
je fcn.7ff74181820
rol edi, 0x12
rol ecx, 0xe
ror edi, 0xd
add edx, 0xaab7ec9b
ror ebx, 0x1e
add ebx, esi
add ebx, edi
and ebx, 0x10
je fcn.7ff74186fb9
rol edx, 0x13
sub ecx, 0xb6fd2a0a
rol edi, 0x15
sub esi, 0x7245142b
add edi, 0x65151b6e
jmp 0x7ff74185ff6
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rbx, qword [rsp + 0x88]
mov rsi, r9
mov ebp, r8d
mov r12, rdx
mov r13, rcx
test rbx, rbx
je 0x7ff741a2a05
mov edi, dword [rbx]
jmp 0x7ff741904ce
mov r14, qword [rsp + 0x80]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r9
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000001
call sym.SHLWAPI.dll_SHRegGetValueW
cmp eax, 2
jne 0x7ff7418a676
test rbx, rbx
je 0x7ff7419050a
mov dword [rbx], edi
mov qword [rsp + 0x30], rbx
mov r9d, ebp
mov r8, r12
mov rdx, r13
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
call sym.SHLWAPI.dll_SHRegGetValueW
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
xor edi, edi
jmp 0x7ff741904ce
Function at 0x7ff7418aa48
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x7b1ddc81
xor ebx, dword [rbp - 0x10]
add edi, 0x7bd7a56f
xor edi, 0x4377aeb6
add esi, 0xe20664af
rol esi, 0xe
add ebx, ecx
add ebx, edx
add ebx, esi
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff7418775b

Function at 0x7ff7418ad9c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
cmp edx, dword [rcx]
fdivr qword [0x7ff659a9c07]
invalid
int1
sbb ecx, ebp
int3
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor r12d, r12d
mov ebp, r8d
mov rsi, rdx
mov ebx, 0x80070057
cmp rcx, r12
je 0x7ff7418ab35
cmp word [rcx], 0x40
jne 0x7ff74189416
call sym.SHLWAPI.dll_StrDupW
mov r13d, 0x80004005
mov rdi, rax
cmp rax, r12
je 0x7ff741a2165
lea rdx, [rax + 2]
mov rax, rdx
cmp rdx, r12
je 0x7ff7418ae12
movzx ecx, word [rdx]
jmp 0x7ff7418adfd
cmp cx, r12w
je 0x7ff7418ae12
cmp cx, 0x3f
je 0x7ff7418ae15
add rax, 2
mov cx, word [rax]
jmp 0x7ff7418adfd
mov rax, r12
cmp rax, r12
jne 0x7ff741a2153
mov rax, rdx
cmp rdx, r12
je 0x7ff7418aad0
movzx ecx, word [rdx]
jmp 0x7ff7418ae2f
cmp cx, r12w
je 0x7ff7418aad0
cmp cx, 0x40
je 0x7ff7418aad3
add rax, 2
mov cx, word [rax]
jmp 0x7ff7418ae2f
sub rax, rdi
sar rax, 1
mov eax, eax
mov word [rdi + rax*2], r12w
jmp 0x7ff7418aadc
mov ebx, 0x8007000e
jmp 0x7ff7418ab2c

Function at 0x7ff7418bfe8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
sub edx, 0x94d451e5
xor edi, 0x19da5a9a
jmp 0x7ff74184018
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
je 0x7ff741a6d80
cmp qword [rcx], rbx
je 0x7ff74182796
mov rcx, qword [rcx]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rcx, qword [rdi + 8]
cmp rcx, rbx
jne 0x7ff741a6d8a
mov rcx, qword [rdi + 0x10]
cmp rcx, rbx
je 0x7ff7418c02e
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
cmp rcx, rbx
jne 0x7ff74197972
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7ff7418c046
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp rcx, 0xffffffff80000002
je 0x7ff7418c03b
jmp 0x7ff741a6da3
mov ebx, 0x57
jmp 0x7ff7418c046
cmp rcx, 0xffffffff80000001
je 0x7ff7418c01f
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
jmp 0x7ff7418c01f
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
jmp 0x7ff7418c03b
Function at 0x7ff7418c384
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
mov dh, 0x23
add byte [rax], al
xor esi, 0x689385a0
xor eax, edx
xor edx, eax
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x270
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov eax, r9d
mov ebx, r9d
lea rsi, [0x7ff741cfd08]
neg eax
lea rax, [0x7ff741cfd10]
mov dword [rsp + 0x40], 1
sbb r9d, r9d
mov dword [rsp + 0x44], 0x208
and r9d, 2
add r9d, 6
test ebx, ebx
mov dword [rsp + 0x38], r9d
cmovne rax, rsi
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r8d
lea rax, [rsp + 0x44]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call sym.SHLWAPI.dll_SHRegGetUSValueW
test eax, eax
jne 0x7ff7418c48d
mov eax, dword [rsp + 0x40]
cmp eax, 3
je 0x7ff74182788
cmp eax, 4
je 0x7ff74182788
cmp eax, 1
jne 0x7ff741a6daf
lea rdx, [rsp + 0x50]
mov rcx, rsi
call sym.SHLWAPI.dll_StrCmpICW
test eax, eax
je 0x7ff741a6df4
lea rdx, [rsp + 0x50]
lea rcx, str.TRUE
call sym.SHLWAPI.dll_StrCmpICW
test eax, eax
je 0x7ff741a6df4
lea rdx, [rsp + 0x50]
lea rcx, [0x7ff741cfd24]
call sym.SHLWAPI.dll_StrCmpICW
test eax, eax
je 0x7ff741a6df4
lea rdx, [rsp + 0x50]
lea rcx, [0x7ff741cfd10]
call sym.SHLWAPI.dll_StrCmpICW
test eax, eax
jne 0x7ff741a6dbd
xor ebx, ebx
jmp 0x7ff7418c48d
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rsi
ret
cmp eax, 2
je 0x7ff7418c429
jmp 0x7ff7418c48d
lea rdx, [rsp + 0x50]
lea rcx, str.FALSE
call sym.SHLWAPI.dll_StrCmpICW
test eax, eax
je 0x7ff7418c489
lea rdx, [rsp + 0x50]
lea rcx, [0x7ff741de524]
call sym.SHLWAPI.dll_StrCmpICW
test eax, eax
je 0x7ff7418c489
jmp 0x7ff7418c48d
mov ebx, 1
jmp 0x7ff7418c48d