joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c8c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14004c921
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14004c8e0
mov ecx, dword [r9]
jmp 0x14004ca08
cmp ecx, 0x4e0
jb 0x14004ca08
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14004c940
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14004c990
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14004ca78
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, [0x14004f930]
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14004cab2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14004cab7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14004cb00
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14004f830]
cmp byte [rcx + rax], 0
je 0x14004cb00
dec r8
sub rdx, 1
jne 0x14004cae6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14004d738
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004d782
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004d782
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004d782
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004d782
cmp dword [rcx + 0x84], 0xe
jbe 0x14004d782
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004d784
xor al, al
add rsp, 0x28
ret
Function at 0x140001bdc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c26
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c28
xor al, al
add rsp, 0x28
ret
Function at 0x140003ac0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003af4
cmp word [rcx], 0x5a4d
jne 0x140003af4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003af4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003af4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003a00
test eax, eax
jne 0x140003b10
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003a70
test rax, rax
je 0x140003b05
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400042bf
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400041c0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004160
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004614
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1405601b8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1405601b4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004662
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000465a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004749
inc ebx
add rax, 0x28
jmp 0x14000463a
mov rcx, r12
call fcn.140004e41
mov rbp, rax
test rax, rax
jne 0x140004681
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400045b0
movsxd rbx, ebx
mov rax, qword [0x1405601b8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004eef
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1405601b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400046e3
mov rax, qword [0x1405601b8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400045b0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004743
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004743
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1405601b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004743
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400045b0
inc dword [0x1405601b4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004b70
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140560220]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140560200]
test rbx, rbx
je 0x140004bbc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004bb6
test eax, eax
jne 0x140004bb6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004b8e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004d70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004d93
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004d93
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004d94
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004dce
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004dc5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004dd0
inc r8d
add rax, 0x28
jmp 0x140004dac
xor eax, eax
ret

Function at 0x140004e41
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055c350]
mov r8, rcx
mov rcx, r9
call fcn.140004d70
test eax, eax
je 0x140004e6d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004d94
xor eax, eax
add rsp, 0x28
ret
Function at 0x14118a478
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14118a5ff
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14118a4a9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14118a48f
add dl, dl
jne 0x14118a4b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14118a516
xor eax, eax
add dl, dl
jne 0x14118a4c5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14118a5cd
add dl, dl
jne 0x14118a4d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14118a4e3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14118a4f0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14118a4fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14118a50a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14118a49e
mov eax, 1
add dl, dl
jne 0x14118a526
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14118a533
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14118a51b
sub eax, ebx
mov ebx, 1
jne 0x14118a56c
mov ecx, 1
add dl, dl
jne 0x14118a54e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14118a55b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14118a543
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14118a49e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14118a588
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14118a595
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14118a57d
cmp eax, 0x7d00
jae 0x14118a5bb
cmp eax, 0x500
jb 0x14118a5b6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14118a49e
cmp eax, 0x7f
ja 0x14118a5be
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14118a49e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14118a5f2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14118a49e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140e43210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140e43397
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e43241
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e43227
add dl, dl
jne 0x140e4324e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e432ae
xor eax, eax
add dl, dl
jne 0x140e4325d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e43365
add dl, dl
jne 0x140e4326e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e4327b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e43288
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e43295
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e432a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e43236
mov eax, 1
add dl, dl
jne 0x140e432be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e432cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e432b3
sub eax, ebx
mov ebx, 1
jne 0x140e43304
mov ecx, 1
add dl, dl
jne 0x140e432e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e432f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e432db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e43236
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e43320
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e4332d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e43315
cmp eax, 0x7d00
jae 0x140e43353
cmp eax, 0x500
jb 0x140e4334e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e43236
cmp eax, 0x7f
ja 0x140e43356
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e43236
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e4338a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e43236
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001720
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov dword [rsp + 0x70], 0
lea rax, [rsp + 0x68]
mov word [rsp + 0x74], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x1800017b9
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
movzx eax, byte [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18000d990
add rsp, 0x80
pop rbx
ret
Function at 0x180003d50
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
shr eax, 4
and eax, 1
add rsp, 0x28
ret

Function at 0x180005b20
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r14, r8
mov ecx, 0x8000
mov rsi, rdx
call qword [sym.imp.msvcrt.dll_malloc]
mov r9, rbp
lea r8, str._s
mov rcx, rax
mov edx, 0x8000
mov rbx, rax
call fcn.180001090
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rbx
mov r15, rax
call qword [sym.imp.msvcrt.dll_free]
cmp r15, 0xffffffffffffffff
je 0x180005c5a
mov qword [rsp + 0x40], rdi
nop dword [rax + rax]
test byte [rsi], 0x10
je 0x180005c2b
movzx eax, byte [rsi + 0x2c]
cmp al, byte [0x180010588]
jne 0x180005bb5
movzx eax, byte [rsi + 0x2d]
cmp al, byte [0x180010589]
je 0x180005c38
movzx eax, byte [rsi + 0x2c]
cmp al, byte [0x18001058c]
jne 0x180005bd9
movzx eax, byte [rsi + 0x2d]
cmp al, byte [0x18001058d]
jne 0x180005bd9
movzx eax, byte [rsi + 0x2e]
cmp al, byte [0x18001058e]
je 0x180005c38
mov ecx, 0x8000
call qword [sym.imp.msvcrt.dll_malloc]
lea r9, [rsi + 0x2c]
mov edx, 0x8000
mov rcx, rax
lea r8, [0x180010538]
mov rdi, rax
call fcn.180001090
mov r9, r14
lea rdx, [rsi + 0x2c]
mov r8, rsi
mov rcx, rbp
call fcn.180005a90
mov r8d, 1
mov rdx, rdi
mov rcx, rbp
call r14
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
jmp 0x180005c38
xor r8d, r8d
lea rdx, [rsi + 0x2c]
mov rcx, rbp
call r14
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180005b90
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x180006a20
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
jne 0x180006a88
mov eax, dword [rcx + 4]
xor r8d, r8d
mov r9d, dword [rcx]
xor edx, edx
add rcx, 8
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180006a84
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x180006a7e
mov r9d, dword [rdi]
lea rcx, [rdi + 8]
xor r8d, r8d
mov dword [rsp + 0x20], 8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180006a84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180006b00
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
mov edx, 0x18
lea rcx, [rsp + 0x30]
mov r8d, 0xf0000000
call fcn.1800069d0
lea rcx, [rsp + 0x30]
call fcn.180006a20
test rax, rax
je 0x180006bb6
lea rcx, [rsp + 0x30]
call fcn.180006a20
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180006bb0
mov rcx, qword [rdi]
xor r9d, r9d
mov rdx, rbx
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180006bb0
mov r8, qword [rsp + 0x70]
lea r9, [rsp + 0x68]
xor eax, eax
mov dword [rsp + 0x68], 0x20
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [r8], rax
mov qword [r8 + 8], rax
lea edx, [rax + 2]
mov qword [r8 + 0x10], rax
mov qword [r8 + 0x18], rax
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x180006bb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ebx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.1800069f0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180006c00
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov edi, r9d
mov rcx, rdx
mov rbp, r8
mov rbx, rdx
call fcn.180006a20
test rax, rax
je 0x180006cb6
xor eax, eax
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x3c]
mov qword [rsp + 0x38], rax
mov r8d, edi
mov rdx, rbp
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x34], 0x660e
xor r14d, r14d
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call fcn.180006a20
mov rcx, rax
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov dword [rsp + 0x20], r14d
lea r8d, [r14 + 0x2c]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14, qword [rsp + 0x70]
test eax, eax
jne 0x180006cbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
jmp 0x180006cbd
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000d990
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180006da0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x70
mov rbx, rdx
mov rdi, rcx
mov edx, 0x18
lea rcx, [rsp + 0x38]
mov r8d, 0xf0000000
mov rsi, r9
call fcn.1800069d0
lea rcx, [rsp + 0x38]
call fcn.180006a20
test rax, rax
jne 0x180006de9
or ebx, 0xffffffff
jmp 0x180006f16
lea rcx, [rsp + 0x30]
call fcn.180006aa0
mov r9d, 0x10
lea rdx, [rsp + 0x38]
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.180006c00
test eax, eax
je 0x180006e17
or ebx, 0xffffffff
jmp 0x180006f0c
lea rcx, [rsp + 0x30]
call fcn.180001d90
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.180006a20
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
mov edx, 0x8009
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180006f04
mov rcx, qword [rdi]
lea r8, [rsp + 0x48]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea edx, [rax + 5]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x48], 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x180006f04
mov r8d, dword [rsp + 0xa0]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180006f04
mov rcx, qword [rdi]
lea r9, [rsp + 0x90]
xor ebx, ebx
xor r8d, r8d
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x20], ebx
lea edx, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180006f04
mov r9, qword [rsp + 0xb8]
mov eax, dword [r9]
cmp dword [rsp + 0x90], eax
je 0x180006ee6
or ebx, 0xffffffff
jmp 0x180006f0c
mov r8, qword [rsp + 0xb0]
mov edx, 2
mov rcx, qword [rdi]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x180006f0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.180006bd0
lea rcx, [rsp + 0x38]
call fcn.1800069f0
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180007020
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbp, r8
mov rbx, rdx
xor r8d, r8d
mov rdi, rcx
lea rcx, [rsp + 0x50]
mov rsi, r9
lea edx, [r8 + 1]
call fcn.1800069d0
lea rcx, [rsp + 0x50]
call fcn.180006a20
test rax, rax
jne 0x18000706d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x18000712a
lea rcx, [rsp + 0x48]
call fcn.180006aa0
mov r9d, dword [rdi + 8]
lea rdx, [rsp + 0x50]
mov r8, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.180006f40
lea rcx, [rsp + 0x48]
call fcn.180001d90
test rax, rax
je 0x1800070c9
xor r9d, r9d
mov dword [rsp + 0x30], ebp
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1800070d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x180007120
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
dec eax
movsxd r8, eax
test eax, eax
jle 0x18000711e
mov r9, rbx
mov rax, rbx
neg r9
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8 + rbx]
movzx edx, byte [rax]
mov byte [rax], cl
lea rax, [rax + 1]
mov byte [r8 + rbx], dl
lea rcx, [r9 + rax]
dec r8
cmp rcx, r8
jl 0x180007100
mov bl, 1
lea rcx, [rsp + 0x48]
call fcn.180006bd0
lea rcx, [rsp + 0x50]
call fcn.1800069f0
mov rbp, qword [rsp + 0x78]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x180007170
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
mov edx, 0x18
mov r8d, 0xf0000000
lea rcx, [rsp + 0x50]
mov rdi, r9
call fcn.1800069d0
lea rcx, [rsp + 0x50]
call fcn.180006a20
test rax, rax
jne 0x1800071c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18000725d
lea rcx, [rsp + 0x48]
call fcn.180006aa0
mov r9d, dword [rbx + 8]
lea rdx, [rsp + 0x50]
mov r8, qword [rbx]
lea rcx, [rsp + 0x48]
call fcn.180006c00
test eax, eax
jne 0x18000724b
lea rcx, [rsp + 0x48]
call fcn.180006ce0
test eax, eax
jne 0x18000724b
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.180006d10
test eax, eax
jne 0x18000724b
lea rcx, [rsp + 0x48]
call fcn.180001d90
test rax, rax
je 0x18000724b
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x40], edi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x40]
mov qword [rax], rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x48]
mov ebx, eax
call fcn.180006bd0
lea rcx, [rsp + 0x50]
call fcn.1800069f0
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret