joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7418c818
Capabilities:
Create thread
Encrypt data using chaskey
Get keyboard layout
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
retf 0x3108
invalid
loopne 0x7ff741862ad
mov es, word [rcx + 0x5b8cef]
wait
jmp 0x7ff741811d3
sub rdx, 0xffffffffc52ac36a
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbp, qword [rsp + 0x110]
xor edi, edi
mov ebx, r8d
mov r12, rcx
mov r13, rdx
lea r8d, [rdi + 0x50]
lea rcx, [rsp + 0x48]
xor edx, edx
mov rsi, r9
mov qword [rsp + 0x40], rdi
call sub.ntdll.dll_memset
mov r14d, ebx
and r14d, 1
jne 0x7ff7419fc68
test bl, 2
jne 0x7ff74181f55
test bl, 8
je 0x7ff7418c88c
bt ebx, 0xc
jb 0x7ff741a2cd7
test bl, 4
jne 0x7ff741862f4
bt ebx, 0xd
jb 0x7ff7418c8ae
lea r8, [rsp + 0x78]
mov rdx, r12
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
xor ecx, ecx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x50], rax
cmp rax, rdi
je 0x7ff741a2d00
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x40]
lea r8, [0x7ff7418c658]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
cmp rax, rdi
je 0x7ff741a2cde
cmp qword [rsp + 0x48], rdi
jne 0x7ff741888a9
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [rsp + 0x80]
cmp ebx, edi
jl 0x7ff7418c94c
cmp rbp, rdi
jne 0x7ff741862b4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x7ff7418c957
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x7ff7418c964
cmp ebx, edi
jl 0x7ff741a2d22
setge dil
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff741947a0
add rsp, 0xb0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp rsi, rdi
je 0x7ff7418c874
jmp 0x7ff741a2cd7
mov ebx, 0x80070057
jmp 0x7ff741a2d22
call fcn.7ff7418a670
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, edi
cmovge ebx, eax
jmp 0x7ff7418c957
call fcn.7ff7418a670
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, edi
cmovge ebx, eax
jmp 0x7ff7418c964
cmp r14d, edi
je 0x7ff741a2d2f
mov rcx, r13
call r12
mov ebx, edi
mov rcx, qword [rsp + 0x68]
cmp rcx, rdi
je 0x7ff741a2d3f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
cmp rcx, rdi
je 0x7ff741a2d4f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
cmp rcx, rdi
je 0x7ff741a2d5e
call fcn.7ff7418bd4c
cmp ebx, edi
jge 0x7ff7418c96c
mov r8d, ebx
movzx edx, bx
mov ecx, ebx
and r8d, 0x1fff0000
cmp r8d, 0x70000
cmove ecx, edx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, edi
jmp 0x7ff7418c96c
Function at 0x7ff7418c9d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x191ee72
xor ebx, dword [rbp - 0x10]
sub ebx, 0x2bbea000
ror edx, 0x16
rol ecx, 0xb
add ebx, ecx
add ebx, eax
and ebx, 0x80000000
je fcn.7ff74185b03
rol eax, 0x1d
sub edx, 0x281ecabc
xor ebx, edi
rol eax, 8
add eax, 0x7954f4df
add ebx, esi
add ebx, edx
and ebx, 0x400
je 0x7ff7418839b
xor edx, dword [rbp - 8]
ror edi, 4
add ecx, 0xf6240ebd
rol edi, 0x1f
add ebx, edx
add ebx, esi
and ebx, 0x40000
je fcn.7ff7418384b
sub ecx, 0x8db1c399
ror eax, 0x1a
sub esi, 0x3f8f5d6f
xor edx, 0xb113fe89
jmp 0x7ff741822c9
add dword [rbp - 0x10], 0x68dc144f
xor ebx, dword [rbp - 0x10]
add edi, 0xb1061a88
xor ebx, edi
sub ecx, 0xd290aff1
add esi, 0xdcf55c1
ror edi, 0xd
add ebx, esi
add ebx, eax
add ebx, edx
and ebx, 2
add cl, byte [rdi]
test byte [rcx], ah
leave
invalid
invalid
xor ecx, dword [rbp - 8]
sub ebx, 0xd8af0a84
ror esi, 0x16
add ebx, ecx
add ebx, edx
and ebx, 4
je fcn.7ff74183a40
sub edi, 0xd176b683
rol ebx, 0xd
xor ebx, dword [rbp - 8]
add ebx, edi
add ebx, eax
and ebx, 0x10000000
je fcn.7ff74183185
ror ebx, 0x12
sub esi, 0x3e7d5652
ror ebx, 9
rol ebx, 6
add edx, 0x207a2a0d
jmp 0x7ff7418841a
add dword [rbp - 0x10], 0x89f515f4
xor ebx, dword [rbp - 0x10]
add edx, 0xe5c6c71b
rol ecx, 6
rol ecx, 0x12
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x2000000
je 0x7ff74184255
xor eax, dword [rbp - 0x10]
add ebx, 0x288e36b6
sub edx, 0xde32d11
add ebx, 0x6039864e
xor edi, ebx
add ebx, ecx
add ebx, esi
add ebx, eax
and ebx, 0x40
je fcn.7ff74183f54
xor ebx, dword [rbp - 0x10]
ror ecx, 0xe
rol ebx, 0x16
ror edi, 0x1f
sub ecx, 0x48ff2966
add ebx, eax
add ebx, ecx
add ebx, edi
and ebx, 0x80000000
je fcn.7ff74182947
sub edi, 0xb810ae8d
sub esi, 0x1f2778a7
add edi, 0xfac50404
rol esi, 4
sub ecx, 0xff48885c
jmp 0x7ff7418a55b
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74187977
Function at 0x7ff7418ceb0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
fidiv dword [rdi + 0x48]
sub esp, 0x20
mov qword [rsp + 8], rbx
movzx eax, word [rcx]
xor ebx, ebx
mov r11, rdx
mov dword [rdx], ebx
mov r9d, ebx
mov r10, rcx
cmp ax, bx
je 0x7ff7418cf2f
cmp ax, 0x3a
je 0x7ff7418d245
cmp r8d, ebx
jne 0x7ff741a327a
mov edx, 0xff80
test dx, ax
jne 0x7ff7418975d
cmp ax, bx
je 0x7ff7418975d
movsx edx, al
lea eax, [rdx - 0x20]
cmp ax, 0x5f
ja 0x7ff7418975d
movzx eax, dx
lea rdx, [0x7ff741cfe90]
test byte [rdx + rax*2 - 0x40], 5
mov eax, 1
je 0x7ff7418975d
cmp eax, ebx
je 0x7ff7418cf2f
add r10, 2
inc r9d
mov ax, word [r10]
jmp 0x7ff7418cec5
xor eax, eax
mov rbx, qword [rsp + 8]
ret
cmp word [rcx], 0x75
je 0x7ff7419a47d
cmp word [rcx], 0x55
je 0x7ff7419a47d
cmp r9d, 1
jbe 0x7ff7418cf2f
mov dword [r11], r9d
mov rax, rcx
jmp 0x7ff7418cf31
cmp word [rcx + 2], 0x72
jne 0x7ff741a3289
cmp word [rcx + 4], 0x6c
je 0x7ff741a3299
cmp word [rcx + 4], 0x4c
jne 0x7ff7418d259
jmp 0x7ff741a3299
cmp ax, 0x3b
jne 0x7ff7418cedd
jmp 0x7ff7418d245
cmp word [rcx + 2], 0x52
je 0x7ff7419a488
jmp 0x7ff7418d259
lea eax, [r9 + 1]
lea rcx, [r10 + 2]
or r9d, 0xffffffff
mov dword [r11], eax
jmp 0x7ff7418cf22
Function at 0x7ff7418d070
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x7b3e3b4b
xor ebx, dword [rbp - 0x10]
sub ebx, 0xfcde9abf
add esi, 0x9150e898
ror edi, 0x11
add ebx, ecx
add ebx, eax
add ebx, edx
and ebx, 0x800000
je 0x7ff74186260
add esi, 0x382c1da0
ror edi, 0x17
ror ecx, 5
xor esi, 0xd010eb70
xor edi, 0xe5cb3d92
add ebx, edi
add ebx, edx
and ebx, 0x200
je 0x7ff7418906e
sub ecx, 0x4a023224
xor eax, 0x2b025e55
add ebx, 0x549b2d43
add ebx, edi
add ebx, eax
add ebx, edx
and ebx, 0x100000
je 0x7ff741894ae
add ebx, 0x8ed9839f
rol edi, 0x1d
ror esi, 0x13
ror edx, 0x17
xor edi, 0x6231c5cd
jmp 0x7ff74189637
add dword [rbp - 0x10], 0x89eff28d
xor ebx, dword [rbp - 0x10]
rol edx, 6
rol eax, 0x1a
sub esi, 0xb592d0dd
rol ebx, 6
sub esi, 0xd05db1a8
add ebx, edi
add ebx, ecx
add ebx, eax
and ebx, 0x1000
je 0x7ff741822c9
sub ebx, 0x182377ce
sub eax, 0x204aef35
xor esi, 0x2f9ea6f3
ror esi, 0x13
xor ebx, dword [rbp - 8]
add ebx, edi
add ebx, eax
and ebx, 8
je 0x7ff741811d3
ror esi, 0x12
sub ebx, 0x44b1a247
add esi, 0xcb9447b2
xor edi, eax
add ebx, edi
add ebx, edx
and ebx, 0x400000
je 0x7ff741843f5
xor ebx, dword [rbp - 8]
ror esi, 0xf
ror edi, 0xf
jmp fcn.7ff741845f3
add dword [rbp - 0x10], 0x812a440a
xor ebx, dword [rbp - 0x10]
ror eax, 8
add ecx, 0xc74bcff0
ror esi, 0x1f
ror edx, 0x1a
add ebx, esi
add ebx, edx
add ebx, edi
and ebx, 0x1000000
je 0x7ff74185e59
ror esi, 6
add edx, 0x272f691c
ror edx, 0x17
xor esi, 0x3d8cdc84
sub ecx, 0x8a793f71
add ebx, eax
add ebx, ecx
add ebx, edi
and ebx, 0x400000
je fcn.7ff741845f3
ror eax, 0x1f
add esi, 0x109eec23
xor ecx, ebx
rol edi, 7
xor ecx, 0x7b77b91f
add ebx, eax
add ebx, edx
and ebx, 0x20
je fcn.7ff74185b03
add edi, 0xac2b0a9a
add esi, 0xba2a1eda
rol ebx, 0xb
sub esi, 0xd690837c
add edi, 0xbd56f835
jmp 0x7ff7418a2ec
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff7418a36a

Function at 0x7ff7418d580
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
ret 0x2ed
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x90]
xor ebx, ebx
mov rsi, rcx
mov edi, eax
cmp edx, eax
ja 0x7ff74184c07
cmp edi, eax
jne 0x7ff74184c14
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x7ff7418d5dc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor edx, ebx
sub edi, 0xbad186b2
add edx, 0xa01fbda1
add ecx, 0x478697fc
xchg byte [rdi + 1], al
add ebx, ecx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov rcx, qword [rcx + 0x88]
xor ebx, ebx
mov rbp, r8
mov rsi, rdx
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r12d, eax
cmp dword [rbp], eax
jbe 0x7ff74182e66
cmp rsi, rbx
je 0x7ff74182e66
mov edx, dword [rbp]
mov r8, qword [r13 + 0x88]
mov rcx, rsi
call fcn.7ff741933b0
jmp 0x7ff7418d637
mov rsi, qword [rsp + 0x50]
cmp edi, ebx
mov eax, edi
setl bl
add ebx, r12d
mov dword [rbp], ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x7ff7418d79c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sbb eax, 0xf05d3300
push rbx
sub rsp, 0x20
test byte [rdx], 1
mov rbx, rcx
jne 0x7ff7418d7e7
xor r9d, r9d
mov r10d, 0x2f
cmp r8d, r9d
je 0x7ff7418d7d3
mov rax, qword [rcx]
jmp 0x7ff7418d7bd
cmp word [rax], r9w
je 0x7ff7418d7d3
cmp word [rax], 0x5c
je 0x7ff74184728
add rax, 2
jmp 0x7ff7418d7bd
mov ecx, dword [rdx + 0x10]
sub ecx, 9
jne 0x7ff7418828b
mov rcx, rbx
call fcn.7ff7418df68
add rsp, 0x20
pop rbx
ret
Function at 0x7ff7418d9c4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add al, 0x33
pop rbp
invalid
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x50
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, dword [rcx + 0x28]
xor esi, esi
xor edi, edi
mov rbp, r8
mov rbx, rcx
mov dword [rsp + 0x38], edi
lea r14d, [rsi + 0x2f]
test edx, edx
je 0x7ff7418da2b
mov r9d, dword [rcx]
mov rcx, qword [rcx + 0x20]
lea rax, [rsp + 0x38]
and r9d, 0x100
mov qword [rsp + 0x20], rax
call fcn.7ff7418de34
mov edi, dword [rsp + 0x38]
mov esi, eax
test edi, edi
jne 0x7ff741a3617
test esi, esi
js 0x7ff7418da36
mov edx, dword [rbx + 0x38]
test edx, edx
jne 0x7ff741a3634
test edi, edi
jne 0x7ff7418da75
bt dword [rbx], 0xc
jb 0x7ff74184eaa
mov rax, qword [rbx + 0x20]
and dword [rsp + 0x38], edi
mov r8d, dword [rbx + 0x28]
test rax, rax
je 0x7ff74182e5f
test r8d, r8d
je 0x7ff74182e5f
cmp word [rax], 8
je 0x7ff741a3685
test rax, rax
je 0x7ff74184e7f
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8d, [r14 - 0x2e]
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov word [rsp + 0x30], r14w
call fcn.7ff7418daa0
nop
jmp 0x7ff7418da27
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
lea rax, [rsp + 0x38]
test edi, edi
mov r8, rbp
mov r12d, edi
sete r9b
mov qword [rsp + 0x20], rax
call fcn.7ff7418de34
mov edi, dword [rsp + 0x38]
mov esi, eax
test edi, edi
je 0x7ff741a3679
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, rbp
mov word [rsp + 0x30], r14w
call fcn.7ff7418daa0
cmp esi, 1
cmove edi, r12d
jmp 0x7ff7418da36
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.7ff7418ddb4
jmp 0x7ff7418da6c
Function at 0x7ff7418dcf4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
or byte [rdi], cl
test byte [rdi], al
add eax, 0xe8810000
pop r11
invalid
invalid
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
xor ebp, ebp
mov rbx, rdx
mov rsi, rcx
cmp word [rdi], bp
je 0x7ff7418dd96
movzx ecx, word [rdi]
call sub.ntdll.dll_iswalpha
cmp eax, ebp
je 0x7ff74188466
cmp word [rdi + 2], 0x3a
jne 0x7ff74188466
bts dword [rbx], 9
mov rax, qword [rsi]
mov r8d, 1
mov qword [rbx + 0x20], rax
mov dword [rbx + 0x28], r8d
test byte [rbx], r8b
jne 0x7ff7418dd96
mov rcx, rax
cmp rax, rbp
je 0x7ff7418dd83
movzx edx, word [rax]
jmp 0x7ff7418dd5a
cmp dx, bp
je 0x7ff7418dd6e
cmp dx, 0x2f
je 0x7ff7418dd71
add rcx, 2
mov dx, word [rcx]
jmp 0x7ff7418dd5a
mov rcx, rbp
cmp rcx, rbp
je 0x7ff7418dd83
add dword [rbx + 0x28], r8d
lea rax, [rcx + 2]
mov word [rcx], bp
jmp 0x7ff7418dd4d
cmp word [rax], bp
je 0x7ff74184e69
cmp word [rax], 0x2e
je 0x7ff7419a533
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp word [rax + 2], bp
je 0x7ff74184e76
cmp word [rax + 2], 0x2e
jne 0x7ff7418dd96
cmp word [rax + 4], bp
je 0x7ff74184e76
jmp 0x7ff7418dd96
Function at 0x7ff7418df68
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rdi], cl
test byte [rdi + 0x3f], al
add byte [rax], al
add dword [rbp - 0x10], 0x35521e32
xor ebx, dword [rbp - 0x10]
add eax, 0xe6c500a9
ror esi, 5
add esi, 0x3807fad0
add ebx, edx
add ebx, eax
and ebx, 0x800000
je 0x7ff74184ec9
xor edi, dword [rbp - 0x10]
add ebx, 0xc6bef9b8
rol ebx, 2
ror edi, 0x1b
add ebx, ecx
add ebx, edx
add ebx, edi
and ebx, 0x40000000
je fcn.7ff74184b42
invalid
rol ecx, 0x15
rol ecx, 0x1a
add ebx, 0xa37f7625
ror ebx, 9
xor eax, 0x4291e6a8
add ebx, edi
add ebx, edx
and ebx, 0x10
je 0x7ff7418929b
ror ebx, 0x1c
ror eax, 3
ror edi, 0xa
sub eax, 0xc0c7c2f6
jmp 0x7ff74187cc4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx]
xor r12d, r12d
mov rsi, rdx
mov edi, r12d
mov rbx, rcx
cmp word [rax], 0x2f
jne 0x7ff7418dfa1
mov qword [rcx], rax
add rax, 2
inc edi
jmp 0x7ff7418df90
cmp word [rax], 0x5c
je 0x7ff7418df96
cmp edi, r12d
je 0x7ff741847df
bts dword [rsi], 8
mov eax, dword [rsi]
cmp edi, r12d
je 0x7ff7418dfe7
cmp edi, 2
je 0x7ff7419a9fb
cmp edi, 4
je 0x7ff741a3387
ja 0x7ff741a3379
mov rax, qword [rbx]
mov word [rax], r12w
mov rax, qword [rbx]
mov qword [rsi + 0x18], rax
add qword [rbx], 2
jmp 0x7ff7418dfe7
mov rcx, qword [rsi + 0x18]
cmp rcx, r12
je 0x7ff7418e005
lea rdx, str.localhost
call sym.SHLWAPI.dll_StrCmpICW
cmp eax, r12d
je 0x7ff741a33a7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov rdi, qword [rbx]
movzx ecx, word [rdi + 2]
call sub.ntdll.dll_iswalpha
cmp eax, r12d
je 0x7ff7419aa48
cmp word [rdi + 4], 0x3a
jne 0x7ff7419aa48
mov rax, qword [rbx]
mov word [rax], r12w
mov rax, qword [rbx]
mov qword [rsi + 0x18], rax
add qword [rbx], 2
bts dword [rsi], 0x1c
jmp 0x7ff7418dfe7
cmp word [rdi + 2], r12w
je 0x7ff7419aa56
cmp word [rdi + 4], 0x7c
je 0x7ff7419aa13
add qword [rbx], 2
mov rax, qword [rbx]
mov qword [rsi + 0x18], rax
mov rdi, qword [rbx]
cmp word [rdi], r12w
je 0x7ff741a3392
cmp word [rdi], 0x2f
je 0x7ff7419aa84
cmp word [rdi], 0x5c
je 0x7ff7419aa84
add rdi, 2
cmp word [rdi], r12w
jne 0x7ff7419aa6e
cmp word [rdi], r12w
je 0x7ff741a3392
mov word [rdi], r12w
lea rax, [rdi + 2]
jmp 0x7ff7419aa98
mov qword [rbx], rax
jmp 0x7ff7418dfe7
cmp edi, 6
ja 0x7ff7418dfd3
jmp 0x7ff7419aa56
bts eax, 0x1c
mov dword [rsi], eax
jmp 0x7ff7419a9fb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rdi + rcx*2]
jmp 0x7ff7419aa98
mov qword [rsi + 0x18], r12
jmp 0x7ff7418e005
Function at 0x7ff7418e93c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
sub eax, 0x31d1a348
invalid
or byte [rdi], ah
add dword [rbp - 0x10], 0x3d44abd9
xor ebx, dword [rbp - 0x10]
xor edx, ebx
add edi, 0x71d89acc
ror edx, 7
ror ebx, 0x19
sub ecx, 0x2c459bcc
add ebx, ecx
add ebx, eax
and ebx, 0x1000000
je 0x7ff74183e29
rol edi, 0xc
ror eax, 0x14
add edx, 0xf539288a
sub esi, 0x9f64b652
xor ebx, dword [rbp - 8]
add ebx, esi
add ebx, ecx
and ebx, 0x8000
je 0x7ff7418456f
sub eax, 0xbd7aa896
rol ebx, 8
rol esi, 0x15
rol ebx, 0xb
xor eax, dword [rbp - 8]
add ebx, eax
add ebx, ecx
and ebx, 0x800000
je fcn.7ff7418384b
xor ecx, edi
sub edi, 0x49d0ddbc
add ebx, 0xccfd4673
rol edi, 4
sub eax, 0x628dff92
jmp 0x7ff74184ab2
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov r14d, r8d
mov r12, rdx
mov r13, rcx
mov r15d, 9
mov rdi, rbx
cmp word [rdi], r15w
je 0x7ff741a42a2
cmp word [rdi], 0xd
je 0x7ff741a42a2
cmp word [rdi], 0xa
je 0x7ff741a42a2
cmp word [rbx], r15w
je 0x7ff741a42ab
cmp word [rbx], 0xd
je 0x7ff741a42ab
cmp word [rbx], 0xa
je 0x7ff741a42ab
mov rdx, rbx
call fcn.7ff7418ea60
xor ebp, ebp
mov esi, eax
cmp eax, ebp
je 0x7ff74184f18
mov r9w, 0xa
mov r8w, 0xd
cmp esi, ebp
je 0x7ff7418500f
mov dword [r13 + 0x10], r15d
cmp r14d, ebp
jne 0x7ff741a42b4
lea rbx, str.file
mov edi, 0x66
movzx edx, di
mov rcx, r12
call fcn.7ff7418eb74
add rbx, 2
mov di, word [rbx]
cmp di, bp
jne 0x7ff7418e9e9
mov edx, 0x3a
mov rcx, r12
call fcn.7ff7418eb74
mov eax, dword [r13 + 0x10]
mov dword [r13 + 0x14], 8
or dword [r12 + 0x24], 0x20001000
mov dword [r12], eax
mov dword [r12 + 0x1c], 8
mov dword [r12 + 0x2c], 8
jmp 0x7ff7418ea3a
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
add rdi, 2
jmp 0x7ff7418e96e
add rbx, 2
jmp 0x7ff7418e98c
cmp dword [r12], r15d
je 0x7ff7418ea3a
lea rax, [0x7ff741d0364]
mov qword [r13 + 8], rax
jmp 0x7ff7418ea3a

Function at 0x7ff7418ea60
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push 0xffffffffd301cb01
add byte [rax], al
cmp word [rdx], 9
je 0x7ff741a427e
cmp word [rdx], 0xd
je 0x7ff741a427e
cmp word [rdx], 0xa
je 0x7ff741a427e
movzx eax, word [rdx]
cmp ax, 0x61
jae 0x7ff7418ec7e
sub ax, 0x41
cmp ax, 0x19
ja 0x7ff74184f15
lea rax, [rdx + 2]
mov rcx, rax
cmp word [rcx], 9
je 0x7ff741a4287
cmp word [rcx], 0xd
je 0x7ff741a4287
cmp word [rcx], 0xa
je 0x7ff741a4287
cmp word [rcx], 0x3a
jne 0x7ff74184eed
mov eax, 1
ret
cmp ax, 0x7a
jbe 0x7ff7418ea99
jmp 0x7ff7418ea8b
add rdx, 2
jmp fcn.7ff7418ea60
add rcx, 2
jmp 0x7ff7418eaa0
Function at 0x7ff7418edd0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
stosd dword [rdi], eax
invalid
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0xb0]
xor r12d, r12d
xor r15d, r15d
and dword [rsp + 0x30], r12d
xor r13d, r13d
mov rsi, r9
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], r8d
mov edi, edx
mov rbx, rcx
mov rbp, rcx
test rcx, rcx
je 0x7ff741a37fd
test edx, edx
je 0x7ff741a37fd
cmp word [rcx], 8
je 0x7ff741a37e8
test rbp, rbp
je 0x7ff7418ee90
mov esi, dword [rsp + 0x20]
mov r14d, 1
cmp word [rbp], 8
je 0x7ff7418ee86
lea r8, [rsp + 0x34]
mov edx, esi
mov rcx, rbp
call fcn.7ff7418eee0
lea rdx, [rsp + 0x30]
mov r8d, edi
test eax, eax
mov rcx, rbp
cmovne r13d, r14d
add r15d, dword [rsp + 0x34]
call fcn.7ff7418ddb4
mov rbp, rax
test rax, rax
jne 0x7ff7418ee4d
mov rsi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x38]
neg r13d
sbb edx, edx
and edx, r15d
jne 0x7ff7418446b
mov dword [rsi + 0x28], edi
mov qword [rsi + 0x20], rbx
mov eax, r12d
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, edx
lea rdx, [rsp + 0x30]
call fcn.7ff7418ddb4
mov rbp, rax
jmp 0x7ff7418ee3e
xor ebp, ebp
jmp 0x7ff7418ee3e

Function at 0x7ff7418efc4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xor eax, eax
test byte [rcx + 0x1c], 1
mov dword [rcx + 0x28], eax
jne 0x7ff741a4265
cmp dword [rcx + 0x10], eax
jne 0x7ff7419b97e
cmp dword [rcx + 0x14], eax
jne 0x7ff7419b97e
bt dword [rcx + 0x24], 0x1c
jb 0x7ff7419badd
bt dword [rcx + 0x24], 0x1d
jae 0x7ff741851f3
mov dword [rcx + 0x28], 2
ret
test dword [rcx + 0x24], 0x22000000
je 0x7ff7418efe5
jmp 0x7ff74185201
mov dword [rcx + 0x28], 1
ret
bt dword [rcx + 0x24], 0x1a
jae 0x7ff7418efd3
jmp 0x7ff74185201

Function at 0x7ff7418f00c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add byte [rax], al
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r8d, dword [rcx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x7ff741a44bf
sub r8d, 1
je 0x7ff74183eb0
sub r8d, 7
jne 0x7ff74183e9c
call fcn.7ff7418f43c
jmp 0x7ff7418f04a
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.7ff741b93f4
nop
jmp 0x7ff7418f04a