joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x130
mov rax, qword gs:[0x60]
mov esi, ecx
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx + 0x20]
test ecx, ecx
jne 0x140001039
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rsi
ret
mov qword [rsp + 0x140], rbp
mov qword [rsp + 0x148], rdi
test rbx, rbx
je 0x1400010fd
mov ebp, 0x104
nop word [rax + rax]
mov rdi, qword [rbx + 0x50]
test rdi, rdi
je 0x1400010f1
cmp word [rbx + 0x48], bp
jae 0x1400010f1
mov r8, rbp
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1400016b0
xor r9d, r9d
cmp word [rdi], r9w
je 0x1400010d1
xor r10d, r10d
mov r11, rdi
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rax + r11]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r9d
mov byte [rsp + r10 + 0x20], cl
mov rdi, qword [rbx + 0x50]
mov r10d, r9d
lea rax, [r9 + r9]
cmp word [rax + rdi], 0
jne 0x1400010a0
mov rcx, rdi
mov byte [rsp + r9 + 0x20], 0
call fcn.1400012b0
cmp eax, esi
je 0x140001120
lea rcx, [rsp + 0x20]
call fcn.1400012b0
cmp eax, esi
je 0x140001120
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001060
xor eax, eax
mov rbp, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rsi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400010ff

Function at 0x1400012b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffefff
movzx ecx, byte [rcx]
test cl, cl
je 0x14000135c
movsx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x1400012c3
not eax
ret

Function at 0x140001430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, rcx
test rcx, rcx
je 0x1400014bc
test rdx, rdx
je 0x1400014bc
test r8d, r8d
je 0x1400014bc
mov dword [rcx + 8], r8d
mov qword [rcx], rdx
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
mov qword [rcx + 0x10], r8
cmp dword [r8], 0x4550
jne 0x1400014bc
movzx eax, word [r8 + 0x16]
shr eax, 0xd
and eax, 1
mov dword [rcx + 0x48], eax
lea rax, [r8 + 0x90]
movzx ecx, word [r8 + 0x14]
mov qword [r9 + 0x20], rax
add rcx, 0x18
lea rax, [r8 + 0xb0]
add rcx, r8
mov qword [r9 + 0x28], rax
lea rax, [r8 + 0xd0]
mov qword [r9 + 0x30], rax
lea rax, [r8 + 0xa0]
mov qword [r9 + 0x38], rax
lea rax, [r8 + 0x88]
mov qword [r9 + 0x40], rax
mov eax, 1
mov qword [r9 + 0x18], rcx
ret
xor eax, eax
ret
Function at 0x180030370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov r9, qword [rax + 0xc0]
mov r10, rcx
test byte [r9 + 0x60], 1
je 0x1800303ce
mov rdx, qword [rdx + 8]
lea rax, [rsi + r8]
cmp rax, rdx
jbe 0x1800303b9
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
add qword [rbx + 0x20], r8
add qword [rbx + 0x28], r8
sub rdx, r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
jmp 0x1800303d4
cmp rsi, qword [rdx + 8]
ja 0x1800303ac
mov rcx, qword [rbx + 0x20]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x38], rdi
movzx edi, byte [rcx + rax - 1]
mov rcx, qword [r10 + 0x438]
call fcn.18006c150
mov rcx, rax
call fcn.180056780
bt eax, 0x15
jae 0x180030420
or rax, 0xffffffffffffffff
sub rax, rdi
mov rdi, qword [rsp + 0x38]
add qword [rbx + 8], rax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov r11, qword [rbx + 8]
lea rcx, [rdi + rsi]
mov esi, pe_nt_image_headers64
mov r9, r11
mov rax, r11
sub r9, rcx
xor rax, rcx
xor r9, rcx
or r9, rax
xor r9, r11
shr r9, 0x3f
dec r9
cmp r11, rsi
cmovb rsi, r11
xor r8d, r8d
test rsi, rsi
je 0x1800304aa
mov rax, qword [rbx + 0x20]
mov rdx, rdi
lea r10, [r11 + rax - 1]
shr rdx, 0x3f
nop dword [rax + rax]
mov rax, r8
mov rcx, rdi
dec r10
sub rcx, r8
shr rax, 0x3f
inc r8
shr rcx, 0x3f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [r10 + 1]
xor cl, dl
xor rax, rdi
dec cl
movzx ecx, cl
and rcx, rax
not rcx
and r9, rcx
cmp r8, rsi
jb 0x180030470
not r9
movzx eax, r9b
lea rcx, [rax - 1]
not rax
shr rax, 0x3f
shr rcx, 0x3f
and rcx, rax
lea rax, [rdi + 1]
mov rdi, qword [rsp + 0x38]
neg rcx
and rax, rcx
sub r11, rax
mov qword [rbx + 8], r11
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x30], ecx
not ecx
mov dword [rsp + 0x48], ecx
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x48]
and eax, 1
or eax, ecx
add rsp, 0x20
pop rsi
ret
Function at 0x180030500
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xc8
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, qword [rdx + 8]
mov r13, qword [rdx + 0x10]
xor esi, esi
sub rax, r8
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0x20], rcx
mov r12d, esi
mov qword [rsp + 0x28], rax
cmp r13, r8
jb 0x1800306b6
cmp r8, 0x40
ja 0x1800306b6
lea rax, [rsp + 0x30]
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0xc0], rbp
neg rax
and eax, 0x3f
lea rbp, [rsp + rax + 0x30]
lea rax, [r8 + 0x100]
cmp r13, rax
jbe 0x180030599
mov r12, r13
sub r12, r8
sub r12, 0x100
xor edx, edx
mov rcx, rbp
mov rbx, rsi
call fcn.18017e8a0
mov r11, rsi
cmp r12, r13
jae 0x18003064e
mov r8, qword [r14 + 8]
mov r10, qword [rsp + 0x28]
mov r14, qword [r14 + 0x20]
mov r9, r8
mov r15, rsi
neg r9
nop dword [rax + rax]
mov rax, r12
lea rcx, [r9 + r12]
xor rcx, r8
xor rax, r10
lea rdx, [rax - 1]
not rax
shr rax, 0x3f
shr rdx, 0x3f
and rdx, rax
mov rax, r12
xor rax, r8
neg rdx
or rcx, rax
or r15, rdx
and rdx, r11
xor rcx, r12
inc r11
inc r12
shr rcx, 0x3f
or rbx, rdx
neg rcx
and r15, rcx
mov rcx, r11
sub rcx, rdi
movzx eax, r15b
and al, byte [r14 + r12 - 1]
xor rcx, rdi
or byte [r11 + rbp - 1], al
mov rax, rdi
xor rax, r11
or rcx, rax
xor rcx, r11
shr rcx, 0x3f
neg rcx
and r11, rcx
cmp r12, r13
jb 0x1800305d0
mov r15, qword [rsp + 0x20]
test rdi, rdi
je 0x18003069f
nop word [rax + rax]
mov rax, rbx
inc rbx
inc rsi
xor rax, 0x20
mov rcx, rbx
movzx eax, byte [rax + rbp]
movzx eax, byte [rbx + rbp - 1]
sub rcx, rdi
xor rcx, rdi
mov byte [r15 + rsi - 1], al
mov rax, rdi
xor rax, rbx
or rcx, rax
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x180030660
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x108]
mov eax, 1
jmp 0x1800306b8
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180179370
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180042830
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x180042888
movzx eax, byte [rcx]
test al, al
je 0x180042888
mov r10d, pe_nt_image_headers64
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x180042850
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret

Function at 0x180042890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x180042902
movzx eax, byte [rcx]
test al, al
je 0x180042902
mov qword [rsp + 0x30], rsi
mov esi, pe_nt_image_headers64
nop
movsx ecx, al
call fcn.18007d6f0
inc rdi
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol ebx, cl
imul eax, eax
xor ebx, eax
movzx eax, byte [rdi]
test al, al
jne 0x1800428c0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18004c3b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x40
call fcn.18017e6d0
sub rsp, rax
mov rdi, qword [rcx + 0x70]
movsxd rcx, dword [rdi + 0x70]
mov rsi, r9
lea r12, [rdi + 0x70]
mov rbx, r8
mov rbp, rdx
mov qword [rsp + 0x30], r12
test ecx, ecx
je 0x18004c431
mov rdx, rcx
test r9, r9
je 0x18004c40f
nop word [rax + rax]
cmp ecx, 0x40
jae 0x18004c40f
movzx eax, byte [rdx + rdi + 0x30]
inc rbp
inc ecx
xor al, byte [rbx]
inc rdx
inc rbx
dec rsi
mov byte [rbp - 1], al
jne 0x18004c3f0
mov dword [r12], ecx
test rsi, rsi
je 0x18004c555
cmp ecx, 0x40
jne 0x18004c431
inc dword [rdi + 0x20]
mov dword [r12], 0
jne 0x18004c431
inc dword [rdi + 0x24]
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r14
mov r14d, dword [rdi + 0x20]
mov qword [rsp + 0x88], r15
mov r15d, esi
lea rax, [rdi + 0x20]
and r15d, 0x3f
mov r13d, r15d
mov dword [rsp + 0x70], r15d
sub rsi, r13
cmp rsi, 0x40
jb 0x18004c4d5
mov r15d, 0x10000000
lea r13, [rdi + 0x20]
mov r12, rsi
shr r12, 6
cmp r12, r15
cmova r12, r15
add r14d, r12d
mov eax, r14d
cmp rax, r12
jae 0x18004c48f
sub r12, rax
xor r14d, r14d
shl r12, 6
mov r9, rdi
mov rdx, rbx
mov rcx, rbp
mov r8, r12
mov qword [rsp + 0x20], r13
call fcn.180095ca0
sub rsi, r12
add rbx, r12
add rbp, r12
mov dword [r13], r14d
test r14d, r14d
jne 0x18004c4be
inc dword [rdi + 0x24]
cmp rsi, 0x40
jae 0x18004c470
mov r15d, dword [rsp + 0x70]
mov r12, qword [rsp + 0x30]
lea rax, [rdi + 0x20]
mov r13d, r15d
mov r14, qword [rsp + 0x80]
test r15d, r15d
je 0x18004c548
xor edx, edx
lea rcx, [rdi + 0x30]
mov r9, rdi
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rdx
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x28], rdx
mov qword [rcx + 0x30], rdx
lea r8d, [rdx + 0x40]
mov qword [rcx + 0x38], rdx
mov rdx, rcx
mov qword [rsp + 0x20], rax
call fcn.180095ca0
test r15d, r15d
je 0x18004c544
sub rdi, rbx
sub rbp, rbx
nop word [rax + rax]
movzx eax, byte [rdi + rbx + 0x30]
inc rbx
xor al, byte [rbx - 1]
dec r13
mov byte [rbx + rbp - 1], al
jne 0x18004c530
mov dword [r12], r15d
mov r15, qword [rsp + 0x88]
mov r13, qword [rsp + 0x78]
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800545f0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [rbx], eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x180054660
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18017e6d0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x180057e50
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18017e6d0
sub rsp, rax
lea rcx, [0x18026c700]
add rsp, 0x28
jmp fcn.180054620
Function at 0x18006e260
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x18006e285
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
inc rcx
xor dl, al
or r9b, dl
dec r8
jne 0x18006e270
movzx eax, r9b
ret

Function at 0x18006eb60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xc8
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14, qword [rsp + 0x130]
xor r12d, r12d
mov rsi, r9
movsxd rbx, r8d
mov rbp, rdx
mov rdi, rcx
lea r15d, [r12 + 1]
mov r13d, r12d
test r9, r9
je 0x18006ebc7
cmp r9, qword [rcx]
je 0x18006ebbf
test rdx, rdx
je 0x18006ec38
test r8d, r8d
js 0x18006ec38
mov r13d, r15d
mov qword [rcx], r9
jmp 0x18006ebcf
mov rsi, qword [rcx]
test rsi, rsi
je 0x18006ec38
mov rcx, rsi
call fcn.180056980
test al, 2
jne 0x18006ec38
test rbp, rbp
je 0x18006ec9e
mov rcx, rsi
mov r13d, r15d
call fcn.180056850
cmp eax, 0x90
jg 0x18006ec38
cmp eax, ebx
jge 0x18006ec5e
mov rcx, qword [rdi + 8]
mov r8, r14
mov rdx, rsi
call fcn.18005d380
test eax, eax
je 0x18006ec38
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, rbp
call fcn.18005d5f0
test eax, eax
je 0x18006ec38
mov rcx, qword [rdi + 8]
lea rbp, [rdi + 0x20]
lea rdx, [rdi + 0x24]
mov r8, rbp
call fcn.18005d620
test eax, eax
jne 0x18006ec7c
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180179370
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp ebx, 0x90
ja 0x18006ec38
lea rcx, [rdi + 0x24]
mov r8, rbx
mov rdx, rbp
call fcn.18017dd20
lea rbp, [rdi + 0x20]
mov dword [rbp], ebx
mov ecx, dword [rbp]
cmp ecx, 0x90
je 0x18006eca7
mov r8d, 0x90
xor edx, edx
sub r8d, ecx
lea rcx, [rcx + rdi + 0x24]
call fcn.18017e8a0
jmp 0x18006eca7
test r13d, r13d
je 0x18006ed75
lea rax, [rsp + 0x20]
mov rbx, rdi
mov rdx, r12
sub rbx, rax
nop word [rax + rax]
lea rcx, [rsp + rdx + 0x20]
add rdx, 2
movzx eax, byte [rbx + rcx + 0x24]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rbx + rcx + 0x25]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x18006ecc0
mov rcx, qword [rdi + 0x10]
mov r8, r14
mov rdx, rsi
call fcn.18005d380
test eax, eax
je 0x18006ed88
mov rcx, rsi
call fcn.180056850
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.18005d5f0
test eax, eax
je 0x18006ed88
mov rdx, r12
nop dword [rax]
lea rcx, [rsp + rdx + 0x20]
add rdx, 2
movzx eax, byte [rbx + rcx + 0x24]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rbx + rcx + 0x25]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x18006ed20
mov rcx, qword [rdi + 0x18]
mov r8, r14
mov rdx, rsi
call fcn.18005d380
test eax, eax
je 0x18006ed88
mov rcx, rsi
call fcn.180056850
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.18005d5f0
test eax, eax
je 0x18006ed88
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call fcn.18005d780
test eax, eax
cmovne r12d, r15d
test r13d, r13d
je 0x18006ed9c
lea rcx, [rsp + 0x20]
mov edx, 0x90
call fcn.18006b6b0
mov eax, r12d
jmp 0x18006ec3a
Function at 0x18006f9c0
Capabilities:
Encode data using xor

Disassembly:
push rdi
movsxd rdi, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x18006fa74
movsxd rdx, dword [rdx + 8]
mov qword [rsp + 0x10], rbx
lea rbx, [rcx - 1]
not rcx
shr rbx, 0x3f
xor r9d, r9d
shr rcx, 0x3f
and rbx, rcx
movsxd rcx, dword [r8 + 8]
xor rcx, rdx
dec rbx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 8], edx
xor dword [r8 + 8], ecx
movsxd rdx, dword [r11 + 0x10]
movsxd rcx, dword [r8 + 0x10]
xor rcx, rdx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 0x10], edx
xor dword [r8 + 0x10], ecx
mov ecx, dword [r11 + 0x14]
mov eax, dword [r8 + 0x14]
xor rax, rcx
and eax, 4
and rax, rbx
xor ecx, eax
mov dword [r11 + 0x14], ecx
xor dword [r8 + 0x14], eax
test rdi, rdi
jle 0x18006fa6f
mov rax, qword [r10]
mov r8, qword [r11]
inc r9
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r10]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rdi
jl 0x18006fa41
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x180079bd0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
mov eax, 0x110
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0x100], rax
test r8, r8
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x18026c890]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x28], rax
movabs rax, 0x3c6ef372fe94f82b
mov r8, rdx
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov rdx, rcx
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov dword [rsp + 0xf4], 0x40
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call fcn.180079a80
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180079240
lea rcx, [rsp + 0x20]
mov edx, 0xd8
call fcn.18006b6b0
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180179370
add rsp, 0x110
pop rbx
ret

Function at 0x180079ce0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.18017e8a0
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], 0x1c
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180079d50
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.18017e8a0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18007c010
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call fcn.18017e8a0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180081030
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.18017e6d0
sub rsp, rax
mov r14, rdx
mov r13, r8
mov rbp, rcx
mov r15d, 0x20
lea rdx, str.enginese_capi.c
mov r8d, 0x5cb
mov ecx, r15d
mov r12d, r9d
call fcn.180054d90
mov rsi, rax
test rax, rax
jne 0x18008108d
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov qword [rsp + 0x68], rdi
cmp r12d, 1
jne 0x1800810d3
cmp dword [0x18026c998], 0
je 0x1800810d3
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov rax, r13
sub r8, r13
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1800810c4
add rax, 2
test ecx, ecx
jne 0x1800810b0
test edx, edx
jne 0x1800810d3
lea r13, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea r12d, [rdx + 0x18]
mov qword [rsp + 0x60], rbx
test rbp, rbp
je 0x180081144
cmp dword [rbp], 2
jl 0x180081144
cmp qword [rbp + 8], 0
je 0x180081144
mov rcx, r14
call fcn.18007fb90
mov rcx, r13
mov rdi, rax
call fcn.18007fb90
lea rdx, str.capi_get_key__contname_s__provname_s__type_d_n
mov r8, rdi
mov rcx, rbp
mov r9, rax
mov rbx, rax
mov dword [rsp + 0x20], r12d
call fcn.18007faf0
lea rdx, str.enginese_capi.c
mov r8d, 0x5df
mov rcx, rbx
call fcn.180054e60
lea rdx, str.enginese_capi.c
mov r8d, 0x5e0
mov rcx, rdi
call fcn.180054e60
test dword [rbp + 0x38], 0x20000
mov eax, 0
lea rcx, [rsi + 8]
cmovne eax, r15d
mov r9d, r12d
mov r8, r13
mov rdx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1800811aa
mov eax, dword [0x18026c980]
test eax, eax
jne 0x180081184
call fcn.180048fc0
mov dword [0x18026c980], eax
mov edx, 0x67
lea r9, str.enginese_capi.c
mov ecx, eax
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], 0x5e6
call fcn.1800493f0
call fcn.1800805d0
jmp 0x18008120a
mov ebx, dword [rsp + 0x80]
mov rcx, qword [rsi + 8]
lea r8, [rsi + 0x10]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x180081223
mov eax, dword [0x18026c980]
test eax, eax
jne 0x1800811da
call fcn.180048fc0
mov dword [0x18026c980], eax
mov edx, 0x67
lea r9, str.enginese_capi.c
mov ecx, eax
lea r8d, [rdx + 0xe]
mov dword [rsp + 0x20], 0x5eb
call fcn.1800493f0
call fcn.1800805d0
mov rcx, qword [rsi + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, str.enginese_capi.c
mov r8d, 0x5f5
mov rcx, rsi
call fcn.180054e60
xor eax, eax
jmp 0x180081230
mov dword [rsi + 0x18], ebx
mov qword [rsi], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x180088540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
mov rdi, r9
mov r9d, r8d
xor r10d, r10d
xor r8b, r8b
mov r11, rdx
test rcx, rcx
je 0x1800885c8
test rdx, rdx
je 0x1800885c8
movzx eax, byte [rcx]
test r9d, r9d
jne 0x180088577
cmp rax, 0x7f
jbe 0x1800885c0
mov r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x1800885d0
mov r8b, 0xff
cmp rax, 0x80
jbe 0x180088590
mov r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x1800885d0
jne 0x1800885c0
mov edx, 1
cmp rdx, r11
jae 0x1800885af
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rdx
or r10d, eax
cmp rdx, r11
jb 0x1800885a0
neg r10d
sbb r8b, r8b
movzx r8d, r8b
mov r10d, r8d
and r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x1800885d0
mov edx, 1
mov r11, r10
mov qword [rsp + 0x18], rsi
test rdi, rdi
je 0x180088633
mov rsi, qword [rdi]
test rsi, rsi
je 0x180088633
mov qword [rsp + 0x10], rbx
movzx ebx, r8b
mov byte [rsi], r8b
mov eax, ebx
mov r10d, r10d
lea r9, [rcx + r11]
and eax, 1
test r11, r11
je 0x18008862b
mov r8, r9
sub r8, rcx
add r10, rsi
nop dword [rax + rax]
movzx ecx, byte [r9 - 1]
dec r9
dec r8
xor ecx, ebx
add eax, ecx
mov byte [r10 + r8], al
shr eax, 8
test r8, r8
jne 0x180088610
add qword [rdi], rdx
mov rbx, qword [rsp + 0x10]
mov rax, rdx
mov rsi, qword [rsp + 0x18]
pop rdi
ret

Function at 0x180088640
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.18017e6d0
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x18008867f
mov edx, 0xe2
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
mov dword [rsp + 0x20], 0x9a
call fcn.1800493f0
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x180088692
mov dword [rdx], r8d
cmp r9, 1
jne 0x1800886b6
test rcx, rcx
je 0x1800886ac
movzx eax, byte [r10]
test r8d, r8d
je 0x1800886aa
not al
inc al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx eax, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
test al, al
jne 0x1800886cc
mov ebx, 1
jmp 0x1800886f8
cmp al, 0xff
jne 0x180088735
mov ecx, 1
mov edx, ebx
cmp rcx, r9
jae 0x1800886ef
nop dword [rax]
movzx eax, byte [rcx + r10]
inc rcx
or edx, eax
cmp rcx, r9
jb 0x1800886e0
test edx, edx
setne bl
test ebx, ebx
je 0x180088735
movzx eax, byte [r10 + 1]
and eax, 0x80
cmp r8d, eax
jne 0x180088735
mov edx, 0xe2
lea r9, str.crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 5]
mov dword [rsp + 0x20], 0xbb
call fcn.1800493f0
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rdi
movsxd rdi, ebx
sub r9, rdi
test r11, r11
je 0x18008878b
neg r8d
lea r8, [rdi + r10]
sbb al, al
add r8, r9
movzx eax, al
mov ecx, eax
mov ebx, eax
and ecx, 1
test r9, r9
je 0x18008878b
mov rdx, r8
sub rdx, rdi
sub rdx, r10
nop dword [rax]
movzx eax, byte [r8 - 1]
dec r8
dec rdx
xor eax, ebx
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x180088770
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret