joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003dff0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14003dd09
call fcn.140030cf4
mov dword [rax], 0x16
call fcn.1400303d4
jmp 0x14003de65
mov eax, dword [rcx + 0x14]
shr eax, 0xd
mov ebp, 1
test bpl, al
je 0x14003de65
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test bpl, al
jne 0x14003de65
mov eax, dword [rcx + 0x14]
shr eax, 1
test bpl, al
je 0x14003dd40
lock or dword [rcx + 0x14], 0x10
jmp 0x14003de65
lock or dword [rcx + 0x14], ebp
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14003dd53
call fcn.14003dff8
mov r14d, dword [rbx + 0x10]
cmp r14d, ebp
jne 0x14003dd64
mov rax, qword [rbx]
mov r15b, byte [rax]
jmp 0x14003dd67
xor r15b, r15b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.1400360c0
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14003f0e4
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14003de53
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14003ddfa
mov rcx, rbx
call fcn.1400360c0
cmp eax, 0xffffffff
je 0x14003dde5
mov rcx, rbx
call fcn.1400360c0
cmp eax, 0xfffffffe
je 0x14003dde5
mov rcx, rbx
call fcn.1400360c0
movsxd rdi, eax
lea rsi, [0x14005c6a0]
mov rcx, rbx
sar rdi, 6
call fcn.1400360c0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14003ddec
lea rdx, [0x14005a480]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14003ddfa
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14003de20
mov eax, dword [rbx + 0x14]
shr eax, 6
test bpl, al
je 0x14003de20
mov eax, dword [rbx + 0x14]
shr eax, 8
test bpl, al
jne 0x14003de20
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp r14d, ebp
jne 0x14003de3b
movzx ecx, byte [rdx]
shl cx, 8
movzx eax, r15b
or cx, ax
dec dword [rbx + 0x10]
jmp 0x14003de47
movzx ecx, word [rdx]
mov ebp, 2
add dword [rbx + 0x10], 0xfffffffe
lea rax, [rdx + rbp]
mov qword [rbx], rax
movzx eax, cx
jmp 0x14003de6a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
jmp 0x14003dcd4
Function at 0x14003ec38
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14005c6a0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14003ec96
cmp word [rdx], r12w
jne 0x14003ec96
or byte [rax + r8*8 + 0x38], cl
jmp 0x14003ec9c
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14003edf7
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14003edd2
lea r9, [rcx + 2]
cmp ax, r13w
je 0x14003ecd5
mov rcx, r9
jmp 0x14003ecf8
cmp r9, rdx
jae 0x14003ed0f
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14003ecb9
jmp 0x14003edf7
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003edcc
cmp dword [rsp + 0x80], edi
je 0x14003edcc
mov rdx, r14
lea r11, [0x14005c6a0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x14003eda5
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14003ed78
mov word [rbx], r12w
jmp 0x14003edf3
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x14003ed81
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14003edf3
cmp word [rsp + 0x70], r12w
jne 0x14003edb2
cmp rbx, rsi
je 0x14003ed72
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.14003eb58
cmp word [rsp + 0x70], r12w
je 0x14003edf7
mov word [rbx], r13w
jmp 0x14003edf3
lea r11, [0x14005c6a0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14003edef
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14003edf7
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004006c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14003eb58
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14003eb58
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400401bc
cmp rax, 0xffffffffffffffff
je 0x1400401bc
xor edi, edi
test rbp, rbp
jle 0x140040167
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140034118
mov rbx, rax
test rax, rax
jne 0x1400400f4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14004015d
mov edx, 0x8000
mov ecx, r14d
call fcn.140033d44
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14003b300
cmp eax, 0xffffffff
je 0x14004013d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140040104
mov edx, r15d
mov ecx, r14d
call fcn.140033d44
jmp 0x14004015d
cmp byte [rsi + 0x38], dil
je 0x140040154
cmp dword [rsi + 0x34], 5
jne 0x140040154
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14004015d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400340dc
jmp 0x1400401d0
jns 0x1400401d0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14003eb58
cmp rax, 0xffffffffffffffff
jne 0x140040188
cmp byte [rsi + 0x30], dil
je 0x1400401d0
mov edi, dword [rsi + 0x2c]
jmp 0x1400401d0
mov ecx, r14d
call fcn.140039e2c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400401d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400401d0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400401c9
mov eax, dword [rsi + 0x2c]
jmp 0x1400401ce
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14003eb58
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800012b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x1aaf8fda
xor ebx, dword [rbp - 0x28]
xor eax, 0x141a84ae
xor esi, dword [rbp - 0x10]
sub esi, 0xb97919
ror ecx, 0x1c
add ebx, eax
add ebx, edi
and ebx, 0x800
je 0x180006572
xor eax, 0x3f5484ff
rol ebx, 0xe
rol edx, 0x10
sub esi, 0xf4010cb4
xor ecx, dword [rbp - 0x10]
add ebx, eax
add ebx, ecx
and ebx, 0x80000
je 0x1800026f8
sub ecx, 0x3d103292
sub eax, 0x50ecab20
add edx, 0x58c554c
add esi, 0x96b47a6d
add ebx, eax
add ebx, edi
and ebx, 0x800000
je fcn.180001a39
xor ebx, 0x88b50ad2
ror edi, 3
rol edx, 0x19
add edi, 0x1695db2a
jmp 0x18000aac1
mov edx, 0xf8d59f44
mov edi, 0xebea2c42
jmp 0x18000274b
mov esp, ebp
sub rsp, 0x30
inc dword [rbp - 0x10]
mov dword [rbp - 0x28], 0x38caefc8
mov ebx, 0x92e8d182
mov eax, dword [rbp - 0x10]
mov ecx, 0x10e74163
mov esi, 0xa88d2a18
jmp fcn.180007343
and ebx, 0x4000000
je 0x180003329
sub edx, 0x5b7efe86
sub edi, 0xdce948fd
rol edx, 0xb
ror ebx, 0xe
jmp 0x180005a37
add dword [rbp - 0x28], 0xf1a77df8
xor ebx, dword [rbp - 0x28]
add edi, 0xba45f64e
xor eax, edi
rol eax, 5
add ebx, edx
add ebx, esi
and ebx, 0x4000000
je 0x180007c21
xor edx, 0x3bda5494
ror edx, 8
rol edi, 7
add edx, 0x8eb045ab
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x400000
je 0x18000129b
rol ecx, 5
rol edx, 0xd
rol eax, 2
add ebx, edx
add ebx, ecx
and ebx, 0x40000000
je 0x18000a2e7
ror esi, 0x1d
xor eax, dword [rbp - 0x10]
xor edx, dword [rbp - 0x10]
rol ebx, 0x1e
sub edi, 0x141b7458
jmp 0x180009eb2
Function at 0x1800012f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x1aaf8fda
xor ebx, dword [rbp - 0x28]
xor eax, 0x141a84ae
xor esi, dword [rbp - 0x10]
sub esi, 0xb97919
ror ecx, 0x1c
add ebx, eax
add ebx, edi
and ebx, 0x800
je 0x180006572
xor eax, 0x3f5484ff
rol ebx, 0xe
rol edx, 0x10
sub esi, 0xf4010cb4
xor ecx, dword [rbp - 0x10]
add ebx, eax
add ebx, ecx
and ebx, 0x80000
je 0x1800026f8
sub ecx, 0x3d103292
sub eax, 0x50ecab20
add edx, 0x58c554c
add esi, 0x96b47a6d
add ebx, eax
add ebx, edi
and ebx, 0x800000
je fcn.180001a39
xor ebx, 0x88b50ad2
ror edi, 3
rol edx, 0x19
add edi, 0x1695db2a
jmp 0x18000aac1
mov edx, 0xf8d59f44
mov edi, 0xebea2c42
jmp 0x18000274b
mov esp, ebp
sub rsp, 0x30
inc dword [rbp - 0x10]
mov dword [rbp - 0x28], 0x38caefc8
mov ebx, 0x92e8d182
mov eax, dword [rbp - 0x10]
mov ecx, 0x10e74163
mov esi, 0xa88d2a18
jmp fcn.180007343
and ebx, 0x4000000
je 0x180003329
sub edx, 0x5b7efe86
sub edi, 0xdce948fd
rol edx, 0xb
ror ebx, 0xe
jmp 0x180005a37
add dword [rbp - 0x28], 0xf1a77df8
xor ebx, dword [rbp - 0x28]
add edi, 0xba45f64e
xor eax, edi
rol eax, 5
add ebx, edx
add ebx, esi
and ebx, 0x4000000
je 0x180007c21
xor edx, 0x3bda5494
ror edx, 8
rol edi, 7
add edx, 0x8eb045ab
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x400000
je 0x18000129b
rol ecx, 5
rol edx, 0xd
rol eax, 2
add ebx, edx
add ebx, ecx
and ebx, 0x40000000
je 0x18000a2e7
ror esi, 0x1d
xor eax, dword [rbp - 0x10]
xor edx, dword [rbp - 0x10]
rol ebx, 0x1e
sub edi, 0x141b7458
jmp 0x180009eb2
Function at 0x180001a40
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x76596959
xor ebx, dword [rbp - 0x28]
add ecx, 0x31624f79
rol ecx, 8
sub edi, 0xa7881a9
sub esi, 0x890b6ec9
add ebx, edx
add ebx, eax
and ebx, 0x8000
je fcn.180008e27
rol eax, 0x10
ror edx, 0x1a
rol ebx, 0x16
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x20000000
je 0x180004819
xor edi, dword [rbp - 0x10]
xor ecx, 0x4b11edef
ror edx, 0x12
sub ebx, 0x61b6468a
sub eax, 0x9f45a6b7
add ebx, edi
add ebx, eax
add ebx, edx
and ebx, 0x1000000
je 0x1800018a4
add ebx, 0xaea9f5a3
add eax, 0x6b23901a
add edx, 0x997b6daf
sub esi, 0x7c53987
jmp 0x1800069b3
add dword [rbp - 0x28], 0x69e5c7d6
xor ebx, dword [rbp - 0x28]
add eax, 0xad098506
ror esi, 9
ror edx, 5
add edi, 0x24d043ac
sub esi, 0x8f15b196
add ebx, eax
add ebx, edx
and ebx, 0x80000
je fcn.18000524a
sub ecx, 0x63ad17b4
ror esi, 2
sub edx, 0xca3dedbb
xor ecx, dword [rbp - 0x10]
add ebx, eax
add ebx, ecx
and ebx, 0x10
je 0x180008aee
add eax, 0x8e3a730a
ror edi, 0x10
xor edx, 0x10413714
add ebx, edx
add ebx, edi
add ebx, eax
and ebx, 0x80
je 0x180001c09
ror esi, 0xd
xor edx, ecx
sub ebx, 0x12325f7e
add edi, 0xa4de6669
add ecx, 0x71ef95b0
jmp 0x180009f3a
Function at 0x180001bd0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x6880fcbf
xor ebx, dword [rbp - 0x28]
xor eax, 0x976f50f5
sub edi, 0xf4c7a1a
rol eax, 0x16
ror ebx, 0x10
xor ebx, edx
add ebx, edi
add ebx, edx
add ebx, esi
and ebx, 0x400000
je fcn.180002b3a
sub eax, 0xaf4f2dc1
xor edi, dword [rbp - 0x28]
ror ebx, 6
sub esi, 0x21df9255
ror esi, 0xd
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x20000
je 0x180007ec7
sub ebx, 0xa2f27d1
rol ebx, 0x1c
xor esi, 0x6a085690
ror ecx, 0x1e
sub ecx, 0x3775e512
add ebx, edx
add ebx, edi
and ebx, 0x400
je 0x180006572
ror eax, 0x13
sub ebx, 0x417a28ec
rol ecx, 0x1b
add eax, 0xfe1aee59
add edi, 0x3ed16788
jmp 0x18000a717
and ebx, 0x20000
je 0x180007c21
xor edi, dword [rbp - 0x10]
invalid
Function at 0x180001d00
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rcx - 0x298fe118], al
mov edx, 0x5b36e9
add byte [rcx + 0x7eacd845], al
ret

Function at 0x180001f00
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0xf8d59f44
mov eax, dword [rbp - 0x10]
jmp fcn.180007343

Function at 0x180002520
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ecx, 0x6008ec60
ror edi, 0x1f
sub edx, 0xe2240750
add ebx, ecx
add ebx, esi
and ebx, 0x4000
je fcn.180002b3a
rol ebx, 0x12
ror edx, 0xb
xor edi, 0xfce2a099
jmp 0x180008a5d
add dword [rbp - 0x28], 0x9c1e07c8
xor ebx, dword [rbp - 0x28]
add eax, 0xabe7d251
add ecx, 0x34e32cc
add ecx, 0x5ebd58f4
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x10000
je 0x1800030af
add eax, 0x76eb78c2
ror ebx, 3
sub edi, 0xa9877ae9
add edx, 0x6ede23aa
add ebx, edi
add ebx, ecx
and ebx, 0x400000
je fcn.180004a57
sub esi, 0x5ff8bcc2
ror ecx, 0xc
rol esi, 0x10
add ebx, 0x8877764a
add ebx, edi
add ebx, esi
add ebx, edx
and ebx, 0x800
je 0x180006572
sub eax, 0x5be3712f
ror eax, 4
add edx, 0xdbef1ca1
sub ecx, 0xf027c54
jmp 0x180004609

Function at 0x1800025c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
je 0x180004fe2
rol ecx, 0x1c
add ebx, 0x945850b7
xor ecx, esi
ror ecx, 0xe
jmp 0x180004091
Function at 0x180002700
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0x1aaf8fda
xor ebx, dword [rbp - 0x28]
xor eax, 0x141a84ae
xor esi, dword [rbp - 0x10]
sub esi, 0xb97919
ror ecx, 0x1c
add ebx, eax
add ebx, edi
and ebx, 0x800
je 0x180006572
xor eax, 0x3f5484ff
rol ebx, 0xe
rol edx, 0x10
sub esi, 0xf4010cb4
xor ecx, dword [rbp - 0x10]
add ebx, eax
add ebx, ecx
and ebx, 0x80000
je 0x1800026f8
sub ecx, 0x3d103292
sub eax, 0x50ecab20
add edx, 0x58c554c
add esi, 0x96b47a6d
add ebx, eax
add ebx, edi
and ebx, 0x800000
je fcn.180001a39
xor ebx, 0x88b50ad2
ror edi, 3
rol edx, 0x19
add edi, 0x1695db2a
jmp 0x18000aac1
mov edx, 0xf8d59f44
mov edi, 0xebea2c42
jmp 0x18000274b
mov esp, ebp
sub rsp, 0x30
inc dword [rbp - 0x10]
mov dword [rbp - 0x28], 0x38caefc8
mov ebx, 0x92e8d182
mov eax, dword [rbp - 0x10]
mov ecx, 0x10e74163
mov esi, 0xa88d2a18
jmp fcn.180007343
and ebx, 0x4000000
je 0x180003329
sub edx, 0x5b7efe86
sub edi, 0xdce948fd
rol edx, 0xb
ror ebx, 0xe
jmp 0x180005a37
add dword [rbp - 0x28], 0xf1a77df8
xor ebx, dword [rbp - 0x28]
add edi, 0xba45f64e
xor eax, edi
rol eax, 5
add ebx, edx
add ebx, esi
and ebx, 0x4000000
je 0x180007c21
xor edx, 0x3bda5494
ror edx, 8
rol edi, 7
add edx, 0x8eb045ab
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x400000
je 0x18000129b
rol ecx, 5
rol edx, 0xd
rol eax, 2
add ebx, edx
add ebx, ecx
and ebx, 0x40000000
je 0x18000a2e7
ror esi, 0x1d
xor eax, dword [rbp - 0x10]
xor edx, dword [rbp - 0x10]
rol ebx, 0x1e
sub edi, 0x141b7458
jmp 0x180009eb2

Function at 0x180002b90
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub edi, 0x24a2400f
ror ebx, 0x15
add ebx, edx
add ebx, esi
and ebx, 0x8000
je fcn.180005b35
sub edx, 0xbbb310d8
ror edi, 0x1d
ror edx, 0x18
jmp 0x18000aea9
Function at 0x180003330
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
xor ebx, dword [rbp - 0x28]
sub ecx, 0x379a3d07
sub esi, 0x1b12d772
add ecx, 0x101c9e3d
xor edx, 0x559873c5
ror ebx, 0xd
add ebx, edi
add ebx, eax
add ebx, esi
and ebx, 0x100000
je 0x180001d0c
add ecx, 0xc3f4b96f
xor edx, 0xa676a4f7
xor ebx, 0xe76c3611
ror edi, 0xc
ror ebx, 0x1a
add ebx, ecx
add ebx, edx
add ebx, esi
and ebx, 0x1000000
je fcn.180003226
ror eax, 0x13
add esi, 0x3cb6cc02
ror edi, 7
add ebx, eax
add ebx, edx
add ebx, esi
and ebx, 0x8000000
je 0x1800059aa
add eax, 0x26a47a03
xor edx, ecx
sub ebx, 0x2a30e036
sub ecx, 0xc88f79e0
add esi, 0xef42bfcf
jmp 0x180002171

Function at 0x180003480
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
and ebx, 0x4000000
je 0x180003f0f
rol edi, 0x19
xor ebx, dword [rbp - 0x28]
rol ebx, 7
add ebx, edx
add ebx, edi
add ebx, esi
and ebx, 0x20
je 0x180002d4f
add esi, 0xef12fd30
xor edx, ebx
ror esi, 0x12
xor ebx, 0xcd63c882
add ebx, ecx
add ebx, esi
add ebx, edi
and ebx, 0x200000
je 0x18000272d
add ebx, 0x3622d88e
ror ecx, 4
xor ebx, dword [rbp - 0x28]
xor eax, 0x664db60f
rol ebx, 7
jmp 0x1800034e1
Function at 0x1800038c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0xe0fff142
xor ebx, dword [rbp - 0x28]
add ebx, 0x113d1de1
sub ecx, 0x7d293cd9
fnstcw word [rcx + rbp]
jge 0x1800038f8
jne 0x1800038b7
add edi, 0x9a7c46fd
add ebx, edi
add ebx, ecx
and ebx, 0x40
je fcn.180003226
rol eax, 0x1d
ror esi, 0x17
sub edx, 0x3cb7c4f9
add ebx, ecx
add ebx, edx
and ebx, 0x40000
je 0x1800030af
sub edi, 0xee5a4dd4
xor edx, dword [rbp - 0x10]
add esi, 0x1c53cc92
xor edx, dword [rbp - 0x28]
xor edx, 0xbe849040
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x2000
je 0x180009586
ror esi, 5
rol eax, 0x13
ror edx, 0xd
add edi, 0x401d081f
jmp fcn.180001a39
add dword [rbp - 0x28], 0x59b82220
xor ebx, dword [rbp - 0x28]
ror ebx, 0x1f
xor edx, dword [rbp - 0x28]
xor edi, 0xcfc55a21
ror ebx, 0x16
add ebx, eax
add ebx, edx
and ebx, 0x200
je 0x1800038ae
sub edi, 0x58205
sub eax, 0x5a18209e
sub eax, 0x9dc38a06
add ebx, edx
add ebx, ecx
add ebx, eax
and ebx, 0x20000000
je fcn.180001e0f
xor ebx, dword [rbp - 0x28]
sub eax, 0xafdfe746
rol ebx, 3
rol ecx, 6
add ebx, ecx
add ebx, edi
and ebx, 0x40000000
je 0x1800069b3
xor edx, dword [rbp - 0x28]
sub esi, 0x5f64f698
ror esi, 0x1e
xor eax, 0x558daac3
jmp 0x180004193

Function at 0x180003980
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
ror ebx, 0xd
add esi, 0x50e7c147
ror eax, 2
add ebx, eax
add ebx, ecx
and ebx, 0x40000000
je 0x180007d10
ror ecx, 8
sub ebx, 0x811988dd
xor eax, 0x8633dfbb
rol ecx, 0x15
jmp 0x180005ab0

Function at 0x180003af0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
inc dword [rbp - 0x10]
mov eax, dword [rbp - 0x10]
jmp fcn.180007343

Function at 0x180003d90
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sti
sbb dword [rbx], esi
fadd dword [r9 - 0x635bee3d]
push rsp
sub esi, 0x6792851f
jmp 0x1800018a4
Function at 0x180003e70
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ecx, 0x60258642
add ecx, 0x6a210b63
jmp 0x180005f47
invalid
add dword [rbp - 0x28], 0xe17b3f53
xor ebx, dword [rbp - 0x28]
rol eax, 0x13
rol edi, 0xe
rol ecx, 0x1a
add ebx, edi
add ebx, eax
and ebx, 0x2000000
je 0x1800027e8
rol edi, 0xf
xor eax, dword [rbp - 0x28]
ror ecx, 0x1b
add ebx, ecx
add ebx, esi
add ebx, edi
and ebx, 0x80000
je 0x180007190
rol esi, 0x16
sub edx, 0x33f3bab6
rol edx, 3
add ecx, 0x46e56727
add eax, 0x1e000a4f
add ebx, ecx
add ebx, edx
and ebx, 0x20000000
je fcn.180005918
sub edx, 0xc6285791
xor edi, edx
add ecx, 0xc8d1d2f1
jmp 0x180004d00
add dword [rbp - 0x28], 0x1b6bc194
xor ebx, dword [rbp - 0x28]
ror eax, 0x17
ror ebx, 0xa
ror esi, 3
add edx, 0xe4cf1443
add ebx, edi
add ebx, eax
and ebx, 0x2000
je 0x180001c7e
rol edx, 0xb
ror ebx, 0x12
ror ebx, 0xd
add ebx, eax
add ebx, edi
and ebx, 0x20
je 0x180009bab
ror edi, 4
add edi, 0x45f5f95c
xor ebx, edi
rol edx, 0x1e
add ebx, eax
add ebx, edx
and ebx, 0x20000000
je 0x18000a2e7
sub ebx, 0x927d78ce
rol edi, 4
rol edi, 3
jmp 0x180004d00
add dword [rbp - 0x28], 0x4c969aa4
xor ebx, dword [rbp - 0x28]

Function at 0x180003e90
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x28], 0xd7ad0bd1
xor ebx, dword [rbp - 0x28]
add edi, 0x9c8d3335
pushfq
ror esi, 0x17
xor ecx, eax
add edx, 0xe8953e71
add ebx, 0x884ff1e1
add ebx, edx
add ebx, eax
add ebx, ecx
and ebx, 0x2000
je 0x18000535b
rol ebx, 0xb
sub edi, 0xdf06cfa7
xor edi, 0xc2b7f5de
add ebx, edi
add ebx, edx
and ebx, 0x100
je 0x1800059aa
rol esi, 0xb
ror esi, 7
sub esi, 0xa03a7c87
rol ecx, 2
add ebx, edx
add ebx, esi
and ebx, 0x10000000
je fcn.180005918
xor ecx, 0x6cc5d223
ror edi, 0x14
xor eax, 0x9dd0afcd
sub edi, 0x404fbb65
ror edi, 9
jmp 0x1800030af

Function at 0x180004000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
je 0x18000653d
ror edi, 8
rol eax, 0xa
ror ebx, 0x1b
invalid

Function at 0x180004150
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov edx, 0xf8d59f44
mov edi, 0xebea2c42
mov ecx, 0x10e74163
mov esi, 0xa88d2a18
mov ebx, 0x92e8d182
mov rsp, rbp
sub rsp, 0x30
mov dword [rbp - 0x28], 0x38caefc8
retf 0xff38
invalid
invalid
mov eax, dword [rbp - 0x10]
jmp fcn.180007343
and ebx, 0x20000
je 0x18000942e
add esi, 0xc29df6c1
ror eax, 5
xor edx, 0x22678377
xor eax, dword [rbp - 0x10]
ror esi, 0xe
add ebx, edi
add ebx, eax
and ebx, 0x20000
invalid
test byte [rax], ch
insd dword [rdi], dx
invalid

Function at 0x180004180
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add byte [rcx], dh
rol ecx, cl
rcl byte [rsi], 0x31
ret 0xf381