joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000af90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
add byte [rax], al
add byte [rbp + 0x48], ah
mov edi, dword [0x60]
push qword [rdi + 0x18]
pop rdi
push qword [rdi + 0x20]
pop rdi
xor rsi, rsi
push 0x18
pop rax
mov rbx, qword [rdi + 0x50]
xor rcx, rcx
mov cl, byte [rbx]
cmp ecx, 0x61
jb 0x18000afbe
sub ecx, 0x20
sub esi, ecx
add esi, 0x81ec5000
ror esi, 7
xor esi, ecx
add esi, 0x27003000
rol esi, 6
xor esi, ecx
ror esi, 0x13
sub esi, ecx
sub esi, 0x5434f000
rol esi, 0x12
xor esi, ecx
ror esi, 0x10
dec rax
inc rbx
cmp rax, 0
ja 0x18000afb1
push qword [rdi + 0x20]
pop rcx
push qword [rdi]
pop rdi
cmp esi, 0x61b7717d
jne 0x18000afa4
mov qword [rbp - 0x18], rcx
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov rcx, rax
mov ecx, dword [rax + 0x3c]
add rcx, rax
mov ecx, dword [rcx + 0x88]
add rcx, rax
mov esi, dword [rcx + 0x1c]
add rsi, rax
mov qword [rbp - 8], rsi
mov esi, dword [rcx + 0x20]
add rsi, rax
mov qword [rbp - 0x10], rsi
mov esi, dword [rcx + 0x24]
add rsi, rax
mov qword [rbp - 0x30], rsi
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
push 0xf
add rax, qword [rbp - 0x38]
pop rcx
xor rsi, rsi
xor rbx, rbx
mov bl, byte [rax]
add esi, ebx
xor esi, 0xc6939000
rol esi, 0x14
sub esi, ebx
ror esi, 6
sub esi, ebx
rol esi, 6
add esi, ebx
rol esi, 0xe
add esi, ebx
rol esi, 0x1e
xor esi, ebx
xor esi, 0xbd115000
rol esi, 9
add rax, 1
sub rcx, 1
cmp rcx, 0
ja 0x18000b053
mov rax, qword [rbp - 0x30]
mov eax, dword [rax]
and rax, 0xffff
add qword [rbp - 0x10], 4
add qword [rbp - 0x30], 2
cmp esi, 0x123f29cf
jne 0x18000b040
imul rax, rax, 4
add rax, qword [rbp - 8]
mov eax, dword [rax]
add rax, qword [rbp - 0x38]
mov qword [rbp - 0x28], rax
call fcn.18000b0de
cmc
sti
cmp ah, byte [0x120e4c82e]
invalid

Function at 0x18000b0de
Capabilities:
Encode data using xor

Disassembly:
add byte [rax], al
pop rcx
sub rcx, 0xb0d2
mov qword [rbp], rcx
sub rsp, 0x40
mov rax, qword [rbp - 0x28]
lea r9, [rbp - 0x38]
mov r8, 0x40
mov rcx, qword [rbp]
mov rdx, 0xc000
add rcx, 0x1951a0
call rax
add rsp, 0x40
mov rbx, qword [rbp]
mov rax, 0xffffffff946d4d63
mov rdi, 0xc000
add rbx, 0x1951a0
mov esi, dword [rbx]
add esi, edi
sub esi, edi
sub esi, edi
add esi, eax
xor esi, eax
mov dword [rbx], esi
add rbx, 4
sub rdi, 4
cmp edi, 0
ja 0x18000b134
mov rax, qword [rbp]
add rax, 0x1951a0
call rax
jne 0x18003b4fb
mov eax, dword [rsp + 0x30]
imul eax, r15d
sub ebp, eax
sub esi, dword [rsp + 0x34]
jmp 0x18000b0a1
mov eax, dword [rsp + 0x38]
neg r15d
imul eax, r15d
xor edx, edx
add ebp, eax
cmp edi, 2
sete dl
jmp 0x18000b173
Function at 0x180019464
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
lea rdx, [rbp - 0x41]
mov ecx, 0x2000000
mov esi, ebx
call qword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
test eax, eax
js 0x18001957e
lea rdx, str.Control_PanelInput_MethodHot_Keys
lea rcx, [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp - 0x41]
lea r8, [rbp - 0x21]
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 0x49]
lea rax, [rbp - 0x31]
mov dword [rbp - 0x21], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x11], rax
mov edx, 0x20019
mov dword [rbp - 9], 0x40
movdqu xmmword [rbp - 1], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x18001954d
mov edi, ebx
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xf]
xor r8d, r8d
mov dword [rsp + 0x20], 0x38
mov edx, edi
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
js 0x18001953a
mov rdx, qword [rbp - 0x49]
lea rcx, [rbp + 0xf]
call fcn.1800195f0
test eax, eax
je 0x180019536
mov esi, 1
inc edi
jmp 0x1800194f8
cmp eax, 0x8000001a
jne 0x180019536
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ntdll.dll_NtClose]
mov ebx, esi
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180033470
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xor eax, eax
jmp 0x180019559

Function at 0x1800196d8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x20], 0x20
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x180019767
cmp dword [rsp + 0x50], 3
jbe 0x180019767
movzx ecx, byte [rsp + 0x56]
movzx eax, byte [rsp + 0x57]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0x55]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0x54]
shl eax, 8
or eax, ecx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180033470
add rsp, 0x70
pop rbx
ret
xor eax, eax
jmp 0x180019754
Function at 0x180019c94
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
and dword [rbp - 9], 0
mov rbx, rdx
mov rdx, rcx
mov edi, r9d
lea rcx, [rbp + 7]
mov rsi, r8
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rdx, rbx
lea rcx, [rbp + 0x17]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rbp + 0x2f], 0
lea rax, [rbp + 7]
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
lea r8, [rbp + 0x27]
mov dword [rbp + 0x27], 0x30
mov edx, 0x20019
mov dword [rbp + 0x3f], 0x40
lea rcx, [rbp - 1]
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test eax, eax
js 0x18003fe38
lea rcx, [rbp - 9]
mov r9, rsi
mov qword [rsp + 0x28], rcx
lea eax, [rdi + 0xc]
mov rcx, qword [rbp - 1]
lea rdx, [rbp + 0x17]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rbp - 1]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x18003fe38
mov eax, dword [rbp - 9]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop
jmp 0x180019d51
Function at 0x18001b804
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
and qword [rbp - 0x31], 0
lea rdx, str.RegistryMachineSystemCurrentControlSetControlError_Message_Instrument_
lea rcx, [rbp - 0x19]
xor ebx, ebx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rbp + 0xf], rbx
lea rax, [rbp - 0x19]
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
lea r8, [rbp + 7]
mov dword [rbp + 7], 0x30
mov edx, 0x20019
mov dword [rbp + 0x1f], 0x40
lea rcx, [rbp - 0x31]
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jns 0x18004099a
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180033470
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret
lea rdx, str.EnableLogging
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x37]
mov r8d, 2
mov dword [rsp + 0x20], 0x18
lea rdx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x180040a33
mov ebx, dword [rbp + 0x43]
lea rdx, str.LogSeverity
lea rcx, [rbp - 9]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x37]
mov r8d, 2
mov dword [rsp + 0x20], 0x18
lea rdx, [rbp - 9]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x180040a28
mov eax, dword [rbp + 0x43]
cmp eax, 5
jbe 0x180040a2d
mov eax, 5
jmp 0x180040a2d
mov eax, 4
mov dword [0x1800aa5e8], eax
lea rdx, str.EnableDefaultReply
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x37]
mov r8d, 2
mov dword [rsp + 0x20], 0x18
lea rdx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ecx, dword [0x1800aa940]
test eax, eax
cmovns ecx, dword [rbp + 0x43]
mov dword [0x1800aa940], ecx
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
je 0x18001b879
call fcn.1800705c4
test eax, eax
js 0x18001b879
mov eax, 1
jmp 0x18001b87b
Function at 0x18001c390
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, 0x104
mov rdi, rcx
mov edx, ebx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x180040aef
mov edx, ebx
mov rax, rdi
nop dword [rax]
cmp word [rax], 0
je 0x18001c3d5
add rax, 2
sub rdx, 1
jne 0x18001c3c0
jmp 0x180040ae1
test rdx, rdx
je 0x180040ae1
mov rax, rbx
mov r8d, 0x7ffffffe
sub rax, rdx
lea rcx, [rdi + rax*2]
test rdx, rdx
je 0x180040ad8
lea r10, [0x18008cdbc]
mov r9d, r8d
sub r10, rcx
test r9, r9
je 0x18001c413
movzx eax, word [r10 + rcx]
test ax, ax
jne 0x18001c485
test rdx, rdx
je 0x180040ad8
xor r10d, r10d
mov word [rcx], r10w
mov rcx, rbx
mov rax, rdi
nop dword [rax]
cmp word [rax], 0
je 0x18001c442
add rax, 2
sub rcx, 1
jne 0x18001c430
jmp 0x18001c4a7
test rcx, rcx
je 0x18001c4a7
sub rbx, rcx
lea rax, [rdi + rbx*2]
test rcx, rcx
je 0x18001c47f
lea r9, str.IMM32.DLL
sub r9, rax
nop dword [rax]
test r8, r8
je 0x18001c49e
movzx edx, word [r9 + rax]
test dx, dx
je 0x18001c49e
mov word [rax], dx
dec r8
add rax, 2
sub rcx, 1
jne 0x18001c460
sub rax, 2
jmp 0x18001c4a3
mov word [rcx], ax
dec r9
add rcx, 2
sub rdx, 1
jne 0x18001c404
jmp 0x180040ad8
test rcx, rcx
je 0x18001c47f
mov word [rax], r10w
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rcx, 2
jmp 0x18001c41c
xor r10d, r10d
mov r8d, 0x7ffffffe
jmp 0x18001c423
lea r9, str.IMM32.DLL
sub r9, rdi
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x180040b1c
movzx eax, word [r9 + rdi]
test ax, ax
je 0x180040b1c
mov word [rdi], ax
add rdi, 2
sub rbx, 1
jne 0x180040af9
test rbx, rbx
lea rax, [rdi - 2]
cmovne rax, rdi
xor r10d, r10d
jmp 0x18001c4a3
Function at 0x18001d764
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov ebx, 1
mov r9d, ebx
lea r8, [0x18008d618]
mov edx, 4
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_swprintf_s]
lea rax, str.keyboardlayout.ini
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea r8, [0x18008c818]
mov dword [rsp + 0x20], 9
lea rdx, [rsp + 0x48]
lea rcx, str.Preload
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x50], 0
je 0x18001d81e
cmp eax, 0xffffffff
je 0x18001d81e
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r8, [rsp + 0x30]
mov edx, 0x10
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
movzx ecx, word [rsp + 0x30]
mov rdx, rdi
call fcn.18001da8c
inc ebx
cmp ebx, 0x3e8
jb 0x18001d785
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180033470
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x18001dcc0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNELBASE.dll_WTSGetServiceSessionId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
je 0x18001dd0c
call qword [sym.imp.ntdll.dll_RtlGetActiveConsoleId]
mov rcx, qword gs:[0x60]
mov ebx, 1
cmp dword [rcx + 0x2c0], eax
jne 0x18001dd11
mov ebx, 2
xor edi, edi
mov r9d, ebx
lea r8, [0x18008d618]
mov edx, 4
lea rcx, [rsp + 0x30]
call fcn.18001b9d8
lea rax, str.keyboardlayout.ini
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea r8, [0x18008c818]
mov dword [rsp + 0x20], 9
lea rdx, [rsp + 0x30]
lea rcx, str.Preload
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x38], di
jne 0x18001dd7d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180033470
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
cmp eax, 0xffffffff
je 0x18001dd65
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov r9d, 0x92
lea rdx, [rsp + 0x38]
xor ecx, ecx
call fcn.18001d840
inc ebx
cmp ebx, 0x3e8
jb 0x18001dd13
jmp 0x18001dd65
Function at 0x18001def0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x1800a98a0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNELBASE.dll_WTSGetServiceSessionId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
je 0x18001df46
call qword [sym.imp.ntdll.dll_RtlGetActiveConsoleId]
mov rcx, qword gs:[0x60]
cmp dword [rcx + 0x2c0], eax
jne 0x18001df67
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180033470
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.RegistryMachineSystemCurrentControlSetControlKeyboard_Layout_
lea rcx, [rbp - 0x71]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rbp - 0x59], 0
lea rax, [rbp - 0x71]
xorps xmm0, xmm0
mov qword [rbp - 0x51], rax
lea r8, [rbp - 0x61]
mov dword [rbp - 0x61], 0x30
mov edx, 0x20019
mov dword [rbp - 0x49], 0x40
lea rcx, [rsp + 0x38]
movdqu xmmword [rbp - 0x41], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x18001e003
lea rdx, str.IgnoreRemoteKeyboardLayout
lea rcx, [rbp - 0x71]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x31]
mov r8d, 2
mov dword [rsp + 0x20], 0x14
lea rdx, [rbp - 0x71]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x18004186a
call fcn.180033310
lea rdx, [rbp - 0x19]
mov rcx, rdi
mov ebx, eax
call fcn.1800331cc
mov rcx, qword [0x1800aa168]
mov edi, eax
test byte [rcx], 4
je 0x18001e084
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov ecx, 0x2000000
call qword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
test eax, eax
js 0x18001df46
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
mov rax, qword [sym.USER32.dll_DwmGetDxRgn]
call qword [case.0x18001f7d3.0]
test edi, edi
je 0x180041879
mov ecx, 0xf000
mov eax, ebx
shr eax, 0x10
and ax, cx
mov ecx, 0xe000
cmp ax, cx
je 0x18004188a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
je 0x18001df46
jmp 0x1800418d7
cmp dword [rbp - 0x25], 0
jne 0x18001df46
jmp 0x18001e003
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x18001df46
lea rcx, [rbp - 0x19]
call fcn.18007d078
test eax, eax
je 0x18004189e
mov ebx, eax
jmp 0x18001e079
mov eax, ebx
and eax, 0xff0000
cmp eax, 0x200000
jae 0x18001e079
mov rdx, qword [rsp + 0x30]
mov ecx, ebx
mov rax, qword [sym.USER32.dll_DwmGetDxRgn]
call qword [case.0x18001f7d3.0]
test eax, eax
je 0x1800418d0
movzx ebx, bx
jmp 0x18001e079
xor ebx, ebx
jmp 0x18001e079
mov r9d, ebx
lea r8, str._8.8lx
mov edx, 9
mov rcx, rsi
call fcn.18001b9d8
mov eax, 1
jmp 0x18001df48
Function at 0x180022f90
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0xfbc1dc1e
xor ebx, dword [rbp - 8]
sub eax, 0xb245d949
ror esi, 6
xor edi, ebx
add ebx, edi
add ebx, edx
add ebx, esi
and ebx, 0x800
je 0x18000828a
rol edx, 0x1c
sub ebx, 0xa10b2944
rol ebx, 0x15
add edx, 0x7741b9eb
ror ebx, 0x14
add ebx, esi
add ebx, eax
add ebx, edi
and ebx, 0x10000
je 0x180007d9e
rol ebx, 0xd
rol edi, 7
xor eax, dword [rbp - 0x18]
xor eax, 0xcaa1b1fa
add ebx, esi
add ebx, edi
and ebx, 0x100
je 0x180007857
xor ecx, 0x11eae235
ror edi, 6
add ebx, 0x929c28d3
jmp 0x180004f34
add dword [rbp - 8], 0x326c6d4b
xor ebx, dword [rbp - 8]
xor ecx, esi
xor esi, edi
rol eax, 0x14
xor eax, edi
add ebx, esi
add ebx, eax
add ebx, edx
and ebx, 0x20000000
je 0x1800085b5
add edx, 0xb1483182
sub eax, 0xfaa16a0f
rol edi, 0xd
add ebx, esi
add ebx, eax
add ebx, edi
and ebx, 0x4000000
je 0x180008daa
xor edi, dword [rbp - 0x18]
mov esi, 0x1c0cb413
mov edx, 0xedf33532
mov ecx, 0x1cefa332
mov edi, 0x994a22ef
mov ebx, 0xa9de66f7
mov rsp, rbp
sub rsp, 0x20
mov dword [rbp - 8], 0x267438dd
add dword [rbp - 0x18], 1
add byte [rax], al
add byte [rbx + 0x27e9e845], cl
mov bh, bh
invalid
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x18], 0x1964387
jmp 0x1800062f3

Function at 0x180027850
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 8], 0xd8a5bcfe
xor ebx, dword [rbp - 8]
ror edx, 0x1f
add eax, 0xb047de7d
sub ecx, 0xc356a4f0
xor ecx, dword [rbp - 8]
xor edi, dword [rbp - 8]
add ebx, edx
add ebx, edi
add ebx, esi
and ebx, 0x400
je 0x180002db9
ror esi, 0x1f
rol ecx, 9
add edi, 0x67af8a33
add edi, 0x9b5e3ae7
add ebx, eax
add ebx, edx
and ebx, 4
je 0x1800050c9
add ecx, 0xe7897a68
sub eax, 0xb2b9ba86
add edx, 0x619518ba
sub ebx, 0x67c99dba
add ebx, ecx
add ebx, eax
add ebx, edx
and ebx, 0x10000000
je 0x18000a990
xor eax, 0x7d2cbb59
rol edi, 0x18
rol edi, 0xd
add eax, 0xa01108f4
jmp 0x18000419b
mov esi, 0x1c0cb413
mov ebx, 0xa9de66f7
mov edx, 0xedf33532
mov ecx, 0x1cefa332
mov edi, 0x994a22ef
mov rsp, rbp
mov dword [rbp - 8], 0x267438dd
sub rsp, 0x20
add dword [rbp - 0x18], 1
mov eax, dword [rbp - 0x18]
jmp 0x18000160a
add dword [rbp - 8], 0x9228fa60
xor ebx, dword [rbp - 8]
xor eax, 0xb4369f07
xor edi, 0x961b0257
sub ebx, 0x4e3ce0c4
rol ecx, 7
add ebx, eax
add ebx, esi
and ebx, 0x100000
je 0x180002b5c
ror ecx, 0x1f
rol ecx, 0x1b
add ebx, 0x6fb602b9
rol esi, 0x16
sub eax, 0x36afd0d4
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x20
je 0x180004449
add edx, 0x753f636a
sub esi, 0xde0b3261
add edi, 0x3eea882d
rol esi, 0x1e
sub esi, 0x908cd9af
add ebx, esi
add ebx, edi
and ebx, 0x4000000
je 0x180003d13
add eax, 0x573fd688
add eax, 0x625a465c
sub esi, 0x51022c14
jmp 0x1800070bc
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x18], 0x1964387
jmp 0x180001195
Function at 0x18002c944
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov edi, edx
mov ebx, ecx
call fcn.18000ec78
test rax, rax
je 0x18002c99c
mov ecx, 0x14
call qword [sym.imp.win32u.dll_NtUserCallNoParam]
test rax, rax
je 0x18002c99c
lea rdx, [rbp + 0x28]
mov ecx, ebx
call fcn.18002c9a8
test eax, eax
js 0x1800459c2
mov eax, dword [rbp + 0x28]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
xor eax, eax
jmp 0x18002c98a
cmp eax, 0xc00000d8
jne 0x180045a84
test edi, edi
jne 0x180045a84
lea rax, [rbp - 0x40]
mov dword [rbp + 0x28], ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
and dword [rsp + 0x20], edi
lea r8, [0x180053ed0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x18002c99c
lea ebx, [rdi + 1]
and dword [rsp + 0x20], 0
lea rdx, [rbp - 0x38]
mov r9d, 0x1cff
or r8d, 0xffffffff
mov ecx, ebx
call sym.USER32.dll_MsgWaitForMultipleObjectsEx
test eax, eax
jne 0x180045a5e
mov rcx, qword [rbp - 0x38]
lea rdx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeThread]
mov ecx, dword [rbp + 0x20]
mov edx, 0xe
test eax, eax
cmove ecx, edx
mov dword [rbp + 0x20], ecx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [rbp + 0x20]
test ecx, ecx
jne 0x180045a8e
mov eax, ebx
jmp 0x18002c98a
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp - 0x30]
xor edx, edx
call sym.USER32.dll_PeekMessageW
test eax, eax
je 0x180045a0a
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.18000c3d0
jmp 0x180045a5e
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop
jmp 0x18002c99c

Function at 0x18002e9d8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x128]
mov rdi, rdx
mov rsi, qword [rax + 8]
mov rax, qword [rdx + 0x30]
test rax, rax
je 0x180046580
sub rax, qword [rdx + 8]
add rax, rdx
mov rbx, qword [rax + 0x38]
test rbx, rbx
je 0x18002ea41
sub rbx, qword [rax + 8]
add rbx, rax
je 0x18002ea41
cmp qword [rbx + 0x40], 0
jne 0x18002ea32
mov rax, qword [rbx + 0x98]
cmp rax, qword [rdi + 0x98]
ja 0x18002ea6a
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x18002ea41
sub rax, qword [rbx + 8]
jmp 0x18002ea16
mov ecx, dword [rsi + 0x20]
xor r9d, r9d
mov r8d, dword [rsi]
dec ecx
add r8d, ecx
mov rcx, qword [rdi]
lea edx, [r9 - 0xc]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800083f0
mov rcx, qword [rbx]
lea r8d, [rax - 1]
xor r9d, r9d
lea edx, [r9 - 0xc]
call fcn.1800083f0
jmp 0x18002ea32
jmp 0x18002ea09
Function at 0x18002f3e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1800aa1c0]
mov rbp, r8
mov rsi, r9
mov r8, rdx
or rbx, 0xffffffffffffffff
xor r9d, r9d
mov rdi, rcx
lea edx, [rbx + 6]
call qword [case.0x18001f7d3.0]
test rax, rax
je 0x1800469b0
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov rdx, rax
test rax, rax
je 0x1800469b0
mov rax, qword [rsp + 0x60]
mov r9, rsi
and dword [rsp + 0x28], 0
mov r8, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rax
call sym.USER32.dll_DialogBoxIndirectParamAorW
mov rbx, rax
jmp 0x1800469b0
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret