joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005e00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005ed3
cmp byte [rcx + 0x71], 0
je 0x140005ed3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140005ecf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005e94
sub eax, 1
je 0x140005e98
cmp eax, 2
jne 0x140005ecf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000fd60
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005ec6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140005ecf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140005e7c
xor al, al
jmp 0x140005e7c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000fd60
add rsp, 0x60
pop rbx
ret

Function at 0x14000a2d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x14000a363
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a363
cmp dword [rsp + 0x38], edi
je 0x14000a35f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a345
jmp 0x14000a363
mov esi, dword [rsp + 0x50]
cmp rbx, 0xffffffffffffffff
je 0x14000a372
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000fd60
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000a3a0
Capabilities:
Get explorer pid

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.14000a2d0
cmp eax, dword [rsp + 0x20]
jne 0x14000a42d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Pausing_to_allow_for_debugging
call fcn.140006120
lea rdx, [0x140006300]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Press_enter_to_close
call fcn.140006120
lea rdx, [0x140006300]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000fd60
add rsp, 0x38
ret
Function at 0x14000d5a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000d6c1
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000d6c1
test rax, rax
je 0x14000d6c1
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x14000d623
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14000d6cc
lea rbx, [rdx + rcx]
mov ebp, dword [rax + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x14000d6af
nop word [rax + rax]
mov edx, dword [rbx + 4]
test edx, edx
je 0x14000d6af
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14000d688
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14000d6a4
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14000dda0
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14000d640
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14000d6cc
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000fd60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000eff0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
lea r9, [rsp + 0x20]
xor r14d, r14d
mov ecx, 0xb
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov ebx, r14d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000f082
test rbx, rbx
je 0x14000f048
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000f032
test eax, eax
jns 0x14000f0a3
test rbx, rbx
je 0x14000f0a8
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14000f1a7
test rbx, rbx
jne 0x14000f0af
xor eax, eax
jmp 0x14000f1a7
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x14000f187
nop dword [rax + rax]
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x14000f105
lea rcx, [rsp + 0x28]
call fcn.140008750
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14000f125
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000f1bd
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14000f17d
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f178
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f206
call fcn.14000fd80
inc edi
cmp edi, dword [rbx]
jb 0x14000f0d0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000fd60
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14000f212
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f20d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f20d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fd80
mov rax, rdi
jmp 0x14000f19a
Function at 0x14000f640
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14000f67a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000f67f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14000f6c8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400126a0]
cmp byte [rcx + rax], 0
je 0x14000f6c8
dec r8
sub rdx, 1
jne 0x14000f6ae
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140010c74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010cbe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010cbe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010cbe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010cbe
cmp dword [rcx + 0x84], 0xe
jbe 0x140010cbe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010cc0
xor al, al
add rsp, 0x28
ret

Function at 0x140001c40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c8a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c8c
xor al, al
add rsp, 0x28
ret
Function at 0x180001010
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0xbeb658ac
xor ebx, dword [rbp - 8]
rol ebx, 3
add ebx, 0x72ecd83f
fsubr st(4)
jb 0x180000fd5
retf
adc eax, 0xd301fb01
and ebx, 0x200
je 0x1800050c9
rol eax, 0xf
sub edx, 0xef0a7cff
ror eax, 0x1e
xor eax, 0x9f31687e
add ebx, eax
add ebx, esi
and ebx, 0x80000
je 0x18000369d
xor eax, dword [rbp - 8]
sub eax, 0xca35639f
xor eax, dword [rbp - 0x18]
sub esi, 0xb0de2906
sub eax, 0x9a030c01
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 4
je 0x180004224
add eax, 0xdb3618af
xor edx, 0x2ae87551
xor edx, ecx
jmp 0x180005bb6
add dword [rbp - 8], 0xa5c80d51
xor ebx, dword [rbp - 8]
rol ecx, 0xd
sub edi, 0x5e8b215e
sub eax, 0x7863f26f
add edi, 0xbdd9f54
add eax, 0x45513c9d
add ebx, ecx
add ebx, edx
and ebx, 0x80000
add byte [rax], al
or byte [rax], al
je 0x18000aabe
rol edx, 0x10
rol eax, 0x17
add eax, 0x231de177
sub ebx, 0xc9eb792
add ebx, esi
add ebx, eax
and ebx, 2
je 0x180005ab8
xor edx, 0xe0c09617
xor ebx, edi
xor esi, dword [rbp - 0x18]
add ebx, 0xcce2bdd0
xor ebx, 0x393b8d1d
add ebx, eax
add ebx, edi
and ebx, 0x80
je 0x1800012eb
rol esi, 0x1a
rol eax, 0x1a
sub eax, 0xe5b6b109
jmp 0x18000282a
rol ebx, 0xb
sub ebx, 0xd3b775ea
add ebx, eax
add ebx, ecx
add ebx, edi
and ebx, 0x40000000
je section..text
sub ebx, 0x34d24974
sub esi, 0x25a1f1e8
xor eax, 0x94a94034
sub ebx, 0xe0393e3d
add ebx, esi
add ebx, edx
and ebx, 0x40000000
je 0x180005bb6
rol edx, 0x12
rol ebx, 0xf
sub ebx, 0x683d4218
rol edi, 5
sub edx, 0xd0f24a84
add ebx, ecx
add ebx, edx
and ebx, 0x800
je 0x1800022e0
add eax, 0x955e59ec
xor ecx, dword [rbp - 8]
ror ecx, 0x13
rol eax, 5
xor eax, 0xe028ef68
jmp 0x180003ef9
mov esi, 0x1c0cb413
mov ebx, 0xa9de66f7
mov ecx, 0x1cefa332
mov edx, 0xedf33532
mov rsp, rbp
mov dword [rbp - 8], 0x267438dd
sub rsp, 0x20
mov edi, 0x994a22ef
inc dword [rbp - 0x18]
mov eax, dword [rbp - 0x18]
jmp 0x18000160a

Function at 0x180001130
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
je 0x180003e4a
add ecx, 0x5e21b6d5
xor ecx, 0x21e74687
sub edx, 0x6c23eca6
ror edi, 0x19
add edx, 0x3fed49c9
add ebx, esi
add ebx, ecx
and ebx, 0x4000
invalid
test bh, dl
invalid
invalid

Function at 0x180001160
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rcx + 0x62a6cec3], al
ffree st(1)
invalid
Function at 0x1800015c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and eax, dword [rax]
add byte [rcx + 0x7560f845], al
mov ebx, 0xf85d3355
add edx, 0x5d65d58a
xor eax, 0x2eb39f6c
rol edi, 0x10
sub ecx, 0xc7793310
add ebx, edx
add ebx, ecx
and ebx, 0x20000
je 0x18000a6af
rol eax, 8
sub edi, 0xb698d8bf
add ecx, 0x4e8757b6
ror ebx, 0x17
ror eax, 0xe
add ebx, edx
add ebx, edi
add ebx, ecx
and ebx, 0x100
je 0x180003481
sub esi, 0x56a27b43
ror edi, 6
add eax, 0xe40d55c
add ebx, eax
add ebx, ecx
and ebx, 0x2000
je 0x180009da9
xor edi, 0xec337294
add edi, 0xb9cfc17e
mov edi, 0x994a22ef
mov edx, 0xedf33532
mov ebx, 0xa9de66f7
mov rsp, rbp
mov ecx, 0x1cefa332
mov esi, 0x1c0cb413
sub rsp, 0x20
inc dword [rbp - 0x18]
mov eax, dword [rbp - 0x18]
mov dword [rbp - 8], 0x267438dd
jmp 0x18000160a
xchg esi, eax
leave
invalid
invalid
add dword [rbp - 8], 0x9fd6dacb
xor ebx, dword [rbp - 8]
xor ebx, esi
ror eax, 0x1a
rol ebx, 3
xor ecx, 0x4eb6070a
add ebx, esi
add ebx, edi
and ebx, 2
je 0x180004e0d
add ebx, 0xe4032b89
xor edx, dword [rbp - 0x18]
ror eax, 0x1a
ror edx, 0x1c
add ebx, esi
add ebx, eax
and ebx, 0x10
je 0x180004541
xor edx, 0x1db4e26a
ror edx, 0x17
add edx, 0x85684037
xor edi, eax
add ebx, eax
add ebx, esi
and ebx, 0x80000
je 0x18000613c
xor eax, 0x229320d8
rol esi, 0x16
rol ecx, 0xa
xor edx, edi
jmp 0x180004c3f

Function at 0x1800015fc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
ror ebx, 0x1c
xor ebx, 0x6a14742c
jmp 0x180007d9e

Function at 0x180001670
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rax], al
add byte [rdi], cl
test byte [rdi - 0x72], ah
add byte [rax], al

Function at 0x180001680
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor eax, ecx
ror ecx, 0x10
xor esi, ecx
add edi, 0xaea622c2
jmp 0x180005bb6
Function at 0x1800018e0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor dh, byte [0x16fc006d9]
and cl, byte [rdx - 0x67]
mov ecx, 0x1cefa332
mov esi, 0x1c0cb413
mov rsp, rbp
mov dword [rbp - 8], 0x267438dd
sub rsp, 0x20
add dword [rbp - 0x18], 1
mov eax, dword [rbp - 0x18]
jmp 0x18000160a

Function at 0x180001988
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0x43f28dee
xor ebx, dword [rbp - 8]
xor ebx, edx
rol ecx, cl
enter 0xffffffffffffc113, 0xffffffffffffffc9
adc al, byte [rcx]
rol dword [rcx], cl
retf
add ebx, eax
and ebx, 0x100000
je 0x180003f79
add edi, 0xedc2e21c
add esi, 0x11fad3ff
add ebx, 0x6a40a8
add ebx, edx
add ebx, ecx
and ebx, 0x100
je 0x180004224
ror eax, 0x16
xor esi, dword [rbp - 0x18]
rol eax, 0x16
add ecx, 0x6abe10f5
add ebx, ecx
add ebx, eax
add ebx, edx
and ebx, 0x80
je 0x180004116
ror ebx, 0x13
add edi, 0x1b2d06cb
sub edx, 0x1a47d67b
rol edx, 0x1f
jmp 0x1800037c0
je 0x180001755
rol edx, 3
sub eax, 0x617c2ee5
xor eax, 0x522abbc5
rol edx, 0x16
jmp 0x180003ef9
add dword [rbp - 8], 0xbc12b37
xor ebx, dword [rbp - 8]
xor edx, dword [rbp - 0x18]
add ebx, 0x1ee0cbdc
sub edx, 0x1759577b
add ebx, 0xc13ce711
ror edi, 0x1d
add ebx, edi
add ebx, ecx
add ebx, esi
and ebx, 0x800
je 0x180004796
add ebx, 0xd8261bec
add eax, 0x133d6766
xor edx, 0x9dd11b4f
add ebx, edi
add ebx, edx
add ebx, esi
and ebx, 0x400000
je 0x1800037c0
ror edi, 9
rol ecx, 2
sub edx, 0x1cf190c9
ror esi, 0x1f
xor eax, 0x36c7884a
add ebx, ecx
add ebx, edx
add ebx, edi
and ebx, 0x80000
je 0x18000828a
sub ebx, 0x70a69392
rol ecx, 0x1b
rol eax, 0x12
add edi, 0x1d6c5917
jmp 0x180009083
add dword [rbp - 8], 0xb736c87
xor ebx, dword [rbp - 8]
sub eax, 0xd95f40e7
ror ecx, 0x10
sub ecx, 0x73250693
add ebx, eax
add ebx, edi
and ebx, 4
je 0x18000a4e1
sub edx, 0x90ac6430
sub ecx, 0xfa1931b8
xor ebx, 0xf6ba2e8a
add ecx, 0x2727f888
rol edx, 3
add ebx, edi
add ebx, eax
and ebx, 0x20
je 0x180004ab6
rol esi, 0x18
xor ecx, 0x57b97a4f
ror ecx, 0x12
add eax, 0x3c620845
xor edi, ecx
add ebx, esi
add ebx, ecx
and ebx, 0x10000
je 0x1800085b5
xor esi, eax
xor edx, ecx
rol eax, 0x17
xor eax, 0xd21bb3fc
jmp 0x180009083
mov rsp, rbp
mov ebx, 0xa9de66f7
mov edi, 0x994a22ef
mov esi, 0x1c0cb413
mov dword [rbp - 8], 0x267438dd
mov ecx, 0x1cefa332
mov edx, 0xedf33532
sub rsp, 0x20
add dword [rbp - 0x18], 1
mov eax, dword [rbp - 0x18]
jmp 0x18000160a
Function at 0x1800019d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0x4fd56174
xor ebx, dword [rbp - 8]
sub edx, 0x4fb7e275
xor edx, dword [rbp - 8]
add ebx, 0x6dc1ee39
add ebx, esi
add ebx, eax
and ebx, 0x20
je 0x180005040
sub ecx, 0xc22a6b43
xor edx, 0xf0d01b2e
rol edx, 5
add ebx, edi
add ebx, ecx
and ebx, 0x4000
je 0x18000a8d2
sub eax, 0x6229a82c
ror edi, 0x1d
add ebx, 0x65f34cef
add edi, 0x9b2407c6
add ebx, eax
add ebx, edi
and ebx, 4
je 0x180001502
rol ecx, 8
xor ecx, 0x3c6b265a
ror edi, 8
jmp 0x180009c95
add dword [rbp - 8], 0x99cfd25c
xor ebx, dword [rbp - 8]
rol ebx, 0x19
rol ebx, 0x11
add edx, 0x4b8871a9
ror edx, 0x11
add ebx, edx
add ebx, ecx
add ebx, esi
and ebx, 0x40
je 0x1800054f8
ror edx, 0x12
xor ecx, dword [rbp - 8]
ror edi, 0x18
sub eax, 0xecad49e5
add ebx, esi
add ebx, eax
add ebx, ecx
and ebx, 0x800000
je 0x18000282a
add edi, 0x7e118030
sub edi, 0x9cfd7c6d
ror edx, 8
add ebx, edx
add ebx, ecx
and ebx, 1
je 0x180003617
add eax, 0xab2e5cca
add ecx, 0x18dd682
ror eax, 0x16
jmp 0x180004e0d
add dword [rbp - 8], 0xcab9fc72
xor ebx, dword [rbp - 8]
ror ecx, 0xe
ror edi, 2
rol ecx, 0x19
xor esi, 0xee5eff77
invalid

Function at 0x180001cf0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0xf2e8c995
ror esi, 0x18
add esi, 0x8d0c0d23
ror edi, 0xa
add ebx, esi
add ebx, edx
add ebx, ecx
and ebx, 0x1000
je 0x180001502
ror ecx, 0xb
add ebx, 0xcc79304f
xor edx, eax
rol edi, 0x1b
ror eax, 0x14
jmp 0x180001e78
Function at 0x1800020f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
rol ebx, 0x1c
add ebx, edx
add ebx, eax
and ebx, 0x800
je 0x180003c8b
add eax, 0xfdb765d2
sub edi, 0x69c2288
xor edx, ecx
retf 0xf781
add edi, esp
sbb al, 0xe
sub eax, 0xac61cdd3
add ebx, ecx
add ebx, esi
add ebx, edi

Function at 0x180002140
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, edi
and ebx, 0x20000000
je 0x180004a28
add ecx, 0xf8481c11
ror ebx, 0x1f
add edx, 0xb026a535
xor esi, edi
jmp 0x180001e78

Function at 0x180002594
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rax], al
add dword [rbp - 8], 0xc5689457
xor ebx, dword [rbp - 8]
ror ecx, 0x19
ror eax, 0x15
rol ecx, 0x18
rol edx, 0x1c
add ebx, eax
add ebx, edx
and ebx, 0x2000000
je 0x1800094ca
sub ebx, 0xaa11603
sub ecx, 0x4f0f75e1
add eax, 0x7fc201e8
xor edi, 0x5830fc40
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x800000
je fcn.180006268
sub ecx, 0xecc3b4aa
sub ecx, 0x385fa994
rol edx, 0x12
rol ecx, 0x13
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x100000
je fcn.1800030f2
add edx, 0x24ac56d2
sub ecx, 0xd1ea0669
xor eax, dword [rbp - 0x18]
xor edx, 0xce1f1001
jmp 0x180003481
add dword [rbp - 8], 0x720719b2
xor ebx, dword [rbp - 8]
sub edi, 0x14fd30b2
add ebx, 0x3bb6131f
add eax, 0x192cef99
xor ebx, dword [rbp - 0x18]
xor ecx, dword [rbp - 8]
add ebx, esi
add ebx, edi
add ebx, ecx
and ebx, 0x10000000
je 0x180002c07
ror edi, 0x12
xor esi, 0x146d862d
add esi, 0x41353a96
add ebx, edi
add ebx, esi
and ebx, 0x800
je 0x18000260e
add edx, 0xdf110c63
xor ecx, 0x7f47ef30
add ecx, 0xa6ab69ad
add ebx, ecx
add ebx, edi
add ebx, esi
and ebx, 0x100
je 0x180004e9a
invalid
ror ecx, 0x15
xor edx, 0xb72deebf
sub eax, 0x66efc6c1
add edi, 0xdc63f94d
jmp 0x180003e4a

Function at 0x180002690
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
jmp 0x18000689e
add dword [rbp - 8], 0xc329a0c5
xor ebx, dword [rbp - 8]
xor esi, ecx
sub edx, 0xcb0a93ed
sub eax, 0x30fb4cf8
add ebx, edx
add ebx, edi
and ebx, 8
je 0x180004541
ror ecx, 3
sub esi, 0x70c5ecff
sub ecx, 0xe7c99a9d
rol ebx, 4
add edx, 0x682c8d7c
add ebx, edi
add ebx, edx
and ebx, 0x200000
je 0x180001f0c
ror edi, 0x16
add eax, 0x7efae1bd
sub edx, 0xf8c1c4bf
add edx, 0x21e9fcd3
add ebx, edi
add ebx, eax
and ebx, 0x40000
je 0x180004e0d
rol edx, 4
sub esi, 0x12bd0e7
sub edi, 0x375cf6f6
add ecx, 0x8ad77177
add ebx, 0x4c490fce
jmp 0x180007a67