joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400106b4
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov dword [rax - 0x18], r15d
call qword [sym.imp.MSVCR110.dll___crtGetShowWindowMode]
movzx r14d, ax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 8]
mov esi, r15d
xor eax, eax
lock cmpxchg qword [0x14034e328], rdx
je 0x14001070b
cmp rax, rdx
jne 0x140010709
mov ebx, 1
mov esi, ebx
jmp 0x140010710
jmp 0x1400106ee
mov ebx, 1
mov eax, dword [0x14034e330]
cmp eax, ebx
jne 0x140010728
mov edi, 0x1f
mov ecx, edi
call sub.MSVCR110.dll__amsg_exit
jmp 0x140010764
mov eax, dword [0x14034e330]
test eax, eax
jne 0x140010759
mov dword [0x14034e330], ebx
lea rdx, [0x1400123d8]
lea rcx, [0x1400123b8]
call sub.MSVCR110.dll__initterm_e
test eax, eax
je 0x14001075f
mov eax, 0xff
jmp 0x14001088f
mov dword [0x14034dd74], ebx
mov edi, 0x1f
mov eax, dword [0x14034e330]
cmp eax, ebx
jne 0x14001078b
lea rdx, [0x1400123b0]
lea rcx, [0x140012358]
call sub.MSVCR110.dll__initterm
mov dword [0x14034e330], 2
test esi, esi
jne 0x140010799
mov rax, r15
xchg qword [0x14034e328], rax
cmp qword [0x14034e338], r15
je 0x1400107c4
lea rcx, [0x14034e338]
call fcn.140010bb0
test eax, eax
je 0x1400107c4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14034e338]
call rax
mov rax, qword [sym.imp.MSVCR110.dll__wcmdln]
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x140010840
cmp word [rcx], r15w
je 0x1400107e7
test edx, edx
jne 0x140010840
movzx eax, word [rcx]
sub ax, bx
cmp ax, di
ja 0x1400107fd
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400107e7
movzx r9d, r14w
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14000fd00
mov dword [0x14034dd70], eax
cmp dword [0x14034dd90], r15d
jne 0x140010829
mov ecx, eax
call qword [sym.imp.MSVCR110.dll_exit]
cmp dword [0x14034dd74], r15d
jne 0x14001083e
call qword [sym.imp.MSVCR110.dll__cexit]
mov eax, dword [0x14034dd70]
jmp 0x14001088f
cmp word [rcx], 0x22
jne 0x140010854
mov eax, r15d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400107d7
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140010c30
add rsp, 0x28
jmp 0x1400106b4
Function at 0x100035e8c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
lea edx, [rax + 0xa]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
cmp dx, word [rbx]
jne 0x100035eba
add rbx, 2
jmp 0x100035ec8
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x100035ecb
dec rdi
lea rcx, [0x100004ae0]
mov r8, rbx
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1000b99b0

Function at 0x100039360
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
and dword [r11 + 8], 0
mov dword [rsp + 0x40], edx
lea rax, [r11 - 0x48]
mov qword [r11 - 0x28], rax
xor eax, eax
mov edi, edx
mov esi, edx
mov qword [r11 - 0x30], r8
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
shr edi, 1
lea rax, [0x1000391d4]
mov ebp, ecx
lea r8, [0x100039190]
and esi, 1
and edi, 1
test ecx, ecx
cmovne r8, rax
lea rax, [r11 + 0x10]
lea r9, [r11 - 0x38]
mov qword [r11 - 0x50], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x100039400
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x1c0012f
mov r8d, eax
xor ecx, ecx
mov dword [rsp + 0x80], eax
call fcn.1000b51b8
jmp 0x1000394ab
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov ecx, ebp
call fcn.10003922c
jmp 0x10003941a
cmp r8d, reloc.certcli.dll_Ordinal_258
jne 0x10003947f
mov edx, 0x1f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r9, [rsp + 0x30]
mov r8d, edi
mov edx, esi
mov ecx, ebp
mov dword [rsp + 0x80], eax
call fcn.10003922c
mov r8d, dword [rsp + 0x80]
test r8d, r8d
jne 0x100039411
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x100039486
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1d6012f
mov dword [rsp + 0x80], eax
mov r8d, eax
jmp 0x100039498
mov edx, 0x1e2012f
jmp 0x100039498
mov r8d, dword [rsp + 0x80]
test r8d, r8d
je 0x1000394a2
mov edx, 0x1d9012f
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x10003af98
Capabilities:
Create http request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov eax, dword [0x10011bd00]
mov rsi, rcx
mov rbp, rdx
neg eax
sbb ecx, ecx
add ecx, 0x8b9
call fcn.1000ba420
lea rcx, [0x10000dc20]
mov rdx, rax
call fcn.1000b99b0
mov r11d, dword [0x10011bd00]
lea rcx, [0x10000dc48]
neg r11d
sbb eax, eax
xor r9d, r9d
xor r8d, r8d
not eax
xor edx, edx
and eax, 0x1000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
test rax, rax
jne 0x10003b034
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x34c0140
mov r8d, eax
xor ecx, ecx
mov edi, eax
call fcn.1000b51b8
jmp 0x10003b1c9
mov eax, dword [0x10011bd00]
lea r8, [0x10000dc70]
mov rdx, rsi
neg eax
sbb ecx, ecx
and qword [rsp + 0x28], 0
or r9d, 0xffffffff
and ecx, 0x80000000
bts ecx, 0xc
mov dword [rsp + 0x20], ecx
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
jne 0x10003b099
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edi, eax
test eax, eax
je 0x10003b099
mov r9d, 0x80072ee6
mov r8d, eax
mov edx, 0x35f0140
mov rcx, rsi
jmp 0x10003b15b
cmp dword [0x10011bd00], 0
je 0x10003b0c6
cmp dword [0x10011bd04], 0
je 0x10003b0ec
mov rcx, rsi
call fcn.10003a3f8
mov edi, eax
test eax, eax
je 0x10003b0ec
mov r8d, eax
mov edx, 0x3670140
jmp 0x10003b156
cmp dword [0x10011bd04], 0
je 0x10003b0ec
test rbx, rbx
je 0x10003b0ec
mov rcx, rbx
call fcn.10003a1d0
mov edi, eax
test eax, eax
je 0x10003b0ec
mov r8d, eax
mov edx, 0x36f0140
jmp 0x10003b156
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.10003a644
mov edi, eax
test eax, eax
je 0x10003b112
xor r9d, r9d
mov r8d, eax
mov edx, 0x3730140
xor ecx, ecx
call fcn.1000b51b8
cmp dword [0x10011bd00], 0
jne 0x10003b14a
cmp dword [0x10011bd04], 0
je 0x10003b14a
mov rcx, rsi
call fcn.10003a3f8
mov esi, eax
test eax, eax
je 0x10003b144
xor r9d, r9d
mov r8d, eax
mov edx, 0x3780140
xor ecx, ecx
call fcn.1000b51b8
test edi, edi
jne 0x10003b14e
mov edi, esi
test edi, edi
je 0x10003b160
mov r8d, edi
mov edx, 0x37e0140
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
test rbx, rbx
je 0x10003b197
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
jne 0x10003b197
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x3860140
mov r8d, eax
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
test edi, edi
cmove edi, ebx
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
jne 0x10003b1c9
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x3920140
mov r8d, eax
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
test edi, edi
cmove edi, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x10003e374
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, word [rdx]
xor r10d, r10d
lea r11, [0x10011acf0]
mov al, r10b
and al, 1
neg al
movzx eax, r10w
sbb cx, cx
shr ax, 1
and cx, r9w
xor cx, ax
mov al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
and dx, r9w
xor dx, cx
mov al, dl
and al, 1
neg al
sbb cx, cx
shr dx, 1
and cx, r9w
xor cx, dx
mov al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
and dx, r9w
xor dx, cx
mov al, dl
and al, 1
neg al
sbb cx, cx
shr dx, 1
and cx, r9w
xor cx, dx
mov al, cl
and al, 1
neg al
sbb dx, dx
shr cx, 1
and dx, r9w
xor dx, cx
mov al, dl
and al, 1
neg al
sbb r8w, r8w
shr dx, 1
and r8w, r9w
xor r8w, dx
mov al, r8b
and al, 1
neg al
sbb cx, cx
shr r8w, 1
inc r10d
and cx, r9w
xor cx, r8w
mov word [r11], cx
add r11, 2
cmp r10d, reloc.certcli.dll_Ordinal_256
jl 0x10003e382
repz ret
Function at 0x1000472d8
Capabilities:
Get domain controller name
List groups for user account

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rsi
sub rsp, 0x60
and qword [rax - 0x28], 0
and qword [rax + 0x20], 0
and qword [rax - 0x18], 0
and qword [rax - 0x20], 0
lea r8, [rax + 0x20]
lea rdx, [rax - 0x28]
call fcn.1000d3384
mov ebx, eax
test eax, eax
je 0x100047318
mov r8d, eax
mov edx, 0x1b920133
jmp 0x100047445
cmp qword [rsp + 0x88], 0
je 0x10004741a
mov rcx, qword [rsp + 0x88]
mov edx, reloc.WLDAP32.dll_Ordinal_36
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x10004741a
mov rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
je 0x100047382
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1ba50133
mov ebx, eax
mov r8d, eax
jmp 0x100047445
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
lea r9, [rsp + 0x48]
xor r8d, r8d
call sub.NETAPI32.dll_NetUserGetGroups
test eax, eax
je 0x1000473d2
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1bb30133
mov ebx, eax
mov r8d, eax
jmp 0x100047445
mov ecx, 0x81b
call fcn.1000ba420
lea rcx, [0x10000f628]
mov rdx, rax
call fcn.1000b99b0
xor esi, esi
cmp dword [rsp + 0x78], esi
jbe 0x100047416
xor ebx, ebx
mov rdx, qword [rsp + 0x48]
lea rcx, [0x100004a90]
mov rdx, qword [rbx + rdx]
call fcn.1000b99b0
inc esi
add rbx, 8
cmp esi, dword [rsp + 0x78]
jb 0x1000473f5
xor ebx, ebx
jmp 0x10004744f
mov ecx, 0x85c
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ebx, 0x80070057
mov edx, 0x1b990133
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
cmp qword [rsp + 0x40], 0
je 0x100047462
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x88], 0
je 0x10004747b
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10004748a
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rsi
ret
Function at 0x10004e724
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, 0x205
call fcn.1000ba420
mov edx, ebx
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
add rsp, 0x20
pop rbx
jmp fcn.1000b99b0

Function at 0x100051bc0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x80
lea rdx, [rax + 0x20]
mov rbp, rcx
mov dword [rax + 0x18], 0x409
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
jne 0x100051c05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test eax, eax
jne 0x100051d67
mov r12d, 0x714
jmp 0x100051d67
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x100051c2c
mov r9, rax
mov r8d, edi
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x100051c41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [rsp + 0xb8]
mov r12d, eax
jmp 0x100051cc5
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x30]
lea rdx, [0x100014f18]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x100051c7b
lea rax, [rsp + 0xc0]
mov dword [rsp + 0xb8], 4
mov qword [rsp + 0x30], rax
jmp 0x100051c80
mov rax, qword [rsp + 0x30]
mov esi, dword [rax]
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x38]
lea rdx, [0x100014f4c]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x100051cad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100051cc5
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov r8d, 0x34
call sub.msvcrt.dll_memcpy
xor r12d, r12d
test rbx, rbx
je 0x100051cd3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12d, r12d
jne 0x100051d67
mov edi, esi
mov ecx, 0x232
movzx ebx, si
shr edi, 0x10
call fcn.1000ba420
mov r9d, edi
mov r8d, esi
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x20], ebx
call fcn.1000b99b0
mov ebp, dword [rsp + 0x4c]
mov esi, dword [rsp + 0x48]
mov ecx, 0x233
movzx edi, bp
movzx ebx, si
shr ebp, 0x10
shr esi, 0x10
call fcn.1000ba420
mov r9d, ebp
mov r8d, ebx
mov edx, esi
mov rcx, rax
mov dword [rsp + 0x20], edi
call fcn.1000b99b0
mov ebp, dword [rsp + 0x54]
mov esi, dword [rsp + 0x50]
mov ecx, 0x234
movzx edi, bp
movzx ebx, si
shr ebp, 0x10
shr esi, 0x10
call fcn.1000ba420
mov r9d, ebp
mov r8d, ebx
mov edx, esi
mov rcx, rax
mov dword [rsp + 0x20], edi
call fcn.1000b99b0
mov eax, r12d
add rsp, 0x80
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1000562cc
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov ebp, dword [rsp + 0x70]
and qword [rax - 0x18], 0
xor edi, edi
cmp ecx, 0x10
mov rsi, r9
mov r12, rdx
mov dword [rax + 0x28], ebp
mov ebx, 1
setne dil
lea rax, [rsp + 0x30]
lea edx, [rdi + 0x8003]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1000563ad
mov r8d, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10005639a
mov rcx, qword [rsp + 0x30]
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8, rsi
mov edx, 2
mov dword [rsp + 0x70], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x100056387
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
and qword [rsp + 0x30], 0
inc ebx
cmp ebx, 0x64
jl 0x100056305
xor ebx, ebx
jmp 0x1000563dd
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa6013e
jmp 0x1000563be
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x85013e
jmp 0x1000563be
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x7d013e
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1000563dd
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x100056b28
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xd0], rax
and qword [rsp + 0x48], 0
cmp dword [rcx], 0x20
mov ebx, 8
mov dword [rsp + 0x40], ebx
mov rdi, rdx
mov rax, rcx
jne 0x100056c2f
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x100056b95
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1fe013e
mov ebx, eax
jmp 0x100056c7f
mov rcx, qword [rsp + 0x48]
xor eax, eax
mov dword [rsp + 0x30], ebx
mov dword [rdi], eax
mov dword [rdi + 4], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x100056bde
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x208013e
mov ebx, eax
jmp 0x100056c7f
mov rcx, qword [rsp + 0x48]
mov eax, 0x8080808
mov dword [rsp + 0x30], ebx
mov dword [rdi], eax
mov dword [rdi + 4], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x100056ca3
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x212013e
mov ebx, eax
jmp 0x100056c7f
lea rcx, [rsp + 0x50]
lea rdx, [rax + 0x10]
mov r8d, 0x80
call sub.msvcrt.dll_memcpy
xor r11d, r11d
lea rcx, [rsp + 0x50]
mov dword [rdi], r11d
mov r8d, ebx
mov rdx, rdi
mov dword [rdi + 4], r11d
call fcn.1000f0180
mov ebx, eax
test eax, eax
je 0x100056c6a
mov edx, 0x224013e
jmp 0x100056c7f
lea rcx, [rsp + 0x50]
call fcn.1000f2650
mov ebx, eax
test eax, eax
je 0x100056c8e
mov edx, 0x227013e
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100056ca5
mov rax, qword [rsp + 0xc8]
lea rcx, [rsp + 0x50]
mov qword [rdi], rax
call fcn.1000f0160
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x100056cb5
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1000ef870
mov rbx, qword [rsp + reloc.certcli.dll_Ordinal_256]
add rsp, 0xe0
pop rdi
ret
Function at 0x100056e00
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xd0
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x38], 0
cmp dword [rcx], 0x10
mov rsi, qword [rsp + 0x120]
mov rdi, r9
mov ebx, r8d
mov r12, rdx
mov rbp, rcx
je 0x100056e74
cmp dword [rcx], 0x20
je 0x100056e74
cmp dword [rcx], 0x40
jne 0x100056e62
mov r8d, ebx
mov ecx, 0x804
call fcn.1000afa70
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ebx, 0x8000ffff
mov edx, 0x27e013e
mov r8d, ebx
jmp 0x100056f81
cmp ebx, 0xa0000
jbe 0x100056e8e
mov ebx, 0x80070216
mov edx, 0x286013e
mov r8d, ebx
jmp 0x100056f81
lea edx, [rbx + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
jne 0x100056eb3
mov ebx, 0x8007000e
mov edx, 0x28c013e
mov r8d, ebx
jmp 0x100056f81
mov dword [rsi], ebx
mov rcx, qword [rdi]
mov r8, rbx
mov rdx, r12
call sub.msvcrt.dll_memcpy
cmp dword [rbp], 0x20
jne 0x100056f33
mov rcx, qword [rbp + 8]
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x100056ef9
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x299013e
mov ebx, eax
jmp 0x100056f7e
mov rax, qword [rdi]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
lea r8d, [r9 + 1]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x100056f9d
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x2a7013e
mov ebx, eax
jmp 0x100056f7e
lea rcx, [rsp + 0x40]
lea rdx, [rbp + 0x10]
mov r8d, 0x80
call sub.msvcrt.dll_memcpy
mov r8, qword [rdi]
lea rcx, [rsp + 0x40]
mov r9, rsi
mov rdx, r12
call fcn.1000f0b60
mov edx, dword [rsi]
and dword [rsp + 0x30], 0
add rdx, qword [rdi]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1000f0b10
mov ebx, eax
test eax, eax
je 0x100056f8d
mov edx, 0x2c9013e
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100056f9f
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
add dword [rsi], eax
call fcn.1000f0160
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x100056faf
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test ebx, ebx
je 0x100056fc5
mov rcx, qword [rdi]
test rcx, rcx
je 0x100056fc5
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rdi], 0
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0xd0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100056fec
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xe8
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xd0], rax
and qword [r9], 0
mov rdi, qword [rsp + 0x130]
and qword [rsp + 0x48], 0
mov ebx, r8d
mov rsi, r9
mov rbp, rdx
mov dword [rdi], ebx
cmp dword [rcx], 0x10
mov rax, rcx
mov dword [rsp + 0x44], ebx
je 0x10005704a
cmp dword [rcx], 0x20
je 0x100057053
mov ebx, 0x8000ffff
mov edx, 0x2f7013e
mov r8d, ebx
jmp 0x1000571dd
cmp dword [rcx], 0x20
jne 0x100057148
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x100057083
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x2fe013e
mov ebx, eax
jmp 0x1000571da
and dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea ebx, [r9 + 1]
xor edx, edx
mov qword [rsp + 0x28], rdi
and qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1000570c6
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x30e013e
mov ebx, eax
jmp 0x1000571da
mov edx, dword [rdi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
jne 0x1000570eb
mov r8d, 0x8007000e
mov edx, 0x315013e
mov ebx, r8d
jmp 0x1000571dd
mov r8d, dword [rsp + 0x44]
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r11d, dword [rdi]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x30], r11d
lea rax, [rsp + 0x44]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1000571f9
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x326013e
mov ebx, eax
jmp 0x1000571da
lea rcx, [rsp + 0x50]
lea rdx, [rax + 0x10]
mov r8d, 0x80
call sub.msvcrt.dll_memcpy
cmp ebx, 0xa0000
jbe 0x100057173
mov ebx, 0x80070216
mov edx, 0x339013e
mov r8d, ebx
jmp 0x1000571dd
lea edx, [rbx + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
jne 0x100057196
mov r8d, 0x8007000e
mov edx, 0x33f013e
mov ebx, r8d
jmp 0x1000571dd
lea rcx, [rsp + 0x50]
mov r9, rdi
mov r8, rax
mov rdx, rbp
call fcn.1000f10d0
mov ebx, eax
test eax, eax
je 0x1000571b6
mov edx, 0x349013e
jmp 0x1000571da
mov edx, dword [rdi]
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
add rdx, qword [rsi]
lea rcx, [rsp + 0x50]
call fcn.1000f2690
mov ebx, eax
test eax, eax
je 0x1000571e9
mov edx, 0x354013e
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000571fb
mov eax, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
add dword [rdi], eax
call fcn.1000f0160
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10005720b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test ebx, ebx
je 0x100057221
mov rcx, qword [rsi]
test rcx, rcx
je 0x100057221
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsi], 0
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0xe8
pop rdi
pop rsi
pop rbp
pop rbx
ret