joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180037450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x180039058]
test ecx, ecx
je 0x180037510
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x180037480
cmp qword [rax + 8], 0
je 0x180037480
add rax, 0x10
jmp 0x18003750a
mov ecx, dword [0x180039058]
test ecx, ecx
je 0x180037523
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x180037508
mov rsi, rax
test rax, rax
jne 0x1800374ee
mov rax, qword [0x18013aca8]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 8
call fcn.18002d440
test rax, rax
je 0x180037546
mov rsi, rax
lea rax, [0x180039040]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x180039058]
test ecx, ecx
je 0x180037536
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x18003750a
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x180039040]
call fcn.180030370
mov ecx, eax
jmp 0x180037465
lea rcx, [0x180039040]
call fcn.180030370
mov ecx, eax
jmp 0x180037490
lea rcx, [0x180039040]
call fcn.180030370
mov ecx, eax
jmp 0x1800374e6
mov ecx, 8
mov edx, 0x20
call fcn.180003e80
int3

Function at 0x180037560
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x180039098]
test ecx, ecx
je 0x18003764d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x18003758e
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x18003763c
mov ecx, dword [0x180039098]
test ecx, ecx
je 0x180037660
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x180037642
mov rsi, rax
test rax, rax
jne 0x180037600
mov rax, qword [0x18013aca8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call fcn.18002d440
test rax, rax
je 0x180037686
mov rsi, rax
lea rax, [0x180039080]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x180039098]
test ecx, ecx
je 0x180037673
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
test rcx, rcx
je 0x18003763c
test rax, rax
je 0x18003763c
lock dec qword [rax]
jne 0x18003763c
lea rcx, [rsp + 0x28]
call fcn.180018810
add rsi, 0x10
jmp 0x180037644
xor esi, esi
mov rax, rsi
add rsp, 0x30
pop rsi
ret
lea rcx, [0x180039080]
call fcn.180030370
mov ecx, eax
jmp 0x180037575
lea rcx, [0x180039080]
call fcn.180030370
mov ecx, eax
jmp 0x18003759e
lea rcx, [0x180039080]
call fcn.180030370
mov ecx, eax
jmp 0x1800375f8
mov ecx, 8
mov edx, 0x18
call fcn.180003e80
int3
Function at 0x180038230
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.180038df0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.180038df0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1800382a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1801400e4]
mov rbx, rcx
test esi, esi
jle 0x1800383d0
mov rax, qword [0x1801400e8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1800382eb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x180038375
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1800382d0
mov rcx, rbx
call fcn.180038b00
mov rdi, rax
test rax, rax
je 0x1800383f2
mov rax, qword [0x1801400e8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.180038c40
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1801400e8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800383d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x18003836e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x180038380
add dword [0x1801400e4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1801400e8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x18003836e
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.180038230
nop dword [rax]
xor esi, esi
jmp 0x1800382f8
mov rax, qword [0x1801400e8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.180038230
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.180038230
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x180038770
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x180140120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x180140100]
test rbx, rbx
je 0x1800387cc
mov rbp, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1800387c3
test eax, eax
jne 0x1800387c3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1800387a8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x180038b00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x18013ac20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x180038b20
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x180038b28
ret
cmp word [r8 + 0x18], 0x20b
jne 0x180038b20
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x180038b7d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x180038b74
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x180038b20
add rax, 0x28
cmp rax, r9
jne 0x180038b60
xor eax, eax
ret

Function at 0x180038b80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x18013ac20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x180038b9f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x180038ba8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x180038b9f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x180038c40
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x18013ac20]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x180038c5f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x180038c68
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0xc506c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
movzx r10, r11w
cbw
push rbp
movzx rax, si
push rdi
push r12
or di, r8w
cmp rcx, 0xffffffffa4968b04
push r13
and bpl, spl
btr r8w, 0xe
xchg r12b, dil
push r14
ror di, cl
cmp spl, spl
xor r10b, spl
push r15
sub rsp, 0x30
xchg r12b, r10b
cbw
rol r8w, cl
mov r15, qword [rcx + 0x10]
lahf
or r14d, 0x1aaf2b9c
mov rax, rcx
stc
bt r10w, bp
sub r10w, r9w
mov ecx, dword [rcx + 8]
cmc
adc r10w, r12w
bt edi, ecx
sub ebx, ebx
xchg r10w, r14w
jmp 0xc64fe6
mov r8, rdx
mov r12d, 1
bt bp, r8w
mov edx, 1
rcl bpl, 0x27
btr r10w, 0x8e
mov edi, 1
sbb bp, 0x9c98
bt r14d, edi
xor bpl, 0x3b
sub r11b, r11b
rcr rbp, cl
sal r10b, 0x30
inc bpl
shl edx, cl
xor r14b, r14b
shrd r14w, r10w, 0x2a
mov ecx, dword [rax + 4]
mov r14, rbx
cmp dil, r8b
ror ebp, cl
cmc
shl edi, cl
bswap cx
mov cl, bpl
mov rcx, qword [rsp + 0xa0]
dec edx
mov bpl, 0x37
dec edi
mov rbp, r15
neg bpl
movzx bp, r10b
mov ebp, ebx
bts r10w, ax
sub r10, rdx
mov r10d, r12d
clc
mov dword [rsp + 0xc], edi
jmp 0xc69451
mov edi, dword [rax]
jmp 0x18ef268
mov qword [rsp + 0x10], 0x7aa7d490
not r9w
ror byte [rsp + 0x23], 0x62
dec word [rsp + 0x1b]
shr qword [rsp + 0x11], 1
inc r9w
call fcn.018688e3
mov qword [rsp + 0x20], r9
movsx ax, sil
mov qword [rsp + 0x18], r8
rcr al, cl
sal al, 0x1b
mov qword [rsp + 0x10], rdx
btc rax, r11
btc ax, 0x92
jmp 0xc506c5
mov qword [r9], rbx
clc
stc
mov qword [rcx], rbx
rcr cl, 0x32
movzx ecx, ax
cmp r14w, 0xa32
mov eax, dword [rax + 4]
setle cl
btr ecx, r13d
mov dword [rsp + 0x10], edx
bswap rcx
sar ch, cl
lea ecx, [rdi + rax]
clc
cbw
mov eax, 0x300
mov dword [rsp + 8], edi
cmp r12b, r14b
test r15w, r10w
shl eax, cl
mov dword [rsp + 0x70], r12d
clc
test r10b, al
mov dword [rsp + 0x80], r12d
cmp r9b, 0x3a
jmp 0x18d7ea5

Function at 0xc50754
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.018cfb85
xor eax, 0x49d20345
cmp eax, 0x1a2ec116
xor bl, r9b
jmp 0xc5074f
Function at 0x140003640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov qword [rsp + 0x38], rdx
mov r13, rcx
xor edx, edx
mov dword [rsp + 0x40], 0x95414aa9
lea rcx, [rbp - 0x7f]
mov dword [rsp + 0x44], 0x2d4301e2
mov r8d, 0x1ff
mov dword [rsp + 0x48], 0x446cb9b
mov dword [rsp + 0x4c], 0x214ad805
call fcn.1400148a0
movups xmm0, xmmword [r13 + 4]
mov eax, dword [r13]
lea rbx, [r13 + 4]
lea r9, [rsp + 0x40]
mov dword [rbp - 0x80], eax
mov r8b, 4
mov qword [rsp + 0x20], rbx
movups xmmword [rbp - 0x7c], xmm0
call fcn.14000e850
mov rdx, rbx
call fcn.14000f3c0
call fcn.14000ea30
lea rcx, [r13 + 0x14]
lea rdx, [rbp - 0x6c]
call fcn.1400032b0
mov eax, eax
lea r14, [rbp - 0x6c]
add r14, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.140019450
lea r15, [rsp + 0x50]
mov r12, r14
lea rsi, [rbp - 0x80]
sub r15, r13
sub rsi, r13
mov edi, 0x10
sub r12, r13
nop dword [rax]
call fcn.140019424
and eax, 0x800000ff
jge 0x140003735
dec eax
or eax, 0xffffff00
inc eax
movzx ecx, byte [rsi + rbx]
xor cl, byte [rbx]
xor cl, al
mov byte [r15 + rbx - 4], al
mov byte [r12 + rbx - 4], cl
inc rbx
sub rdi, 1
jne 0x140003720
mov r15d, 0x10
lea r8, [r14 + 0x10]
mov ecx, r15d
lea rdx, [rsp + 0x50]
call fcn.14000f870
xor ebx, ebx
cmp byte [0x14004a7fe], bl
mov qword [rsp + 0x30], rbx
je 0x14000378e
lea rdx, [r13 + 0x14]
lea rcx, [rsp + 0x30]
call fcn.1400100e0
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x140003795
mov rax, qword [0x14004a830]
lea rcx, [rbp - 0x7c]
mov qword [r14 + 0x30], rax
mov r9, r13
lea rax, [rbp - 0x7c]
sub r9, rcx
lea r8, [r14 + 0x38]
sub r8, rax
nop
lea rcx, [rbp - 0x7c]
add rcx, rbx
movzx edx, byte [r9 + rcx + 4]
movzx eax, byte [rcx]
xor edx, eax
mov byte [r8 + rcx], dl
mov byte [rbp + rbx + 0x180], dl
inc rbx
cmp rbx, r15
jl 0x1400037b0
lea ebx, [r14 + 0x48]
lea rdi, [rbp - 0x6c]
sub ebx, edi
lea rdx, [rbp - 0x6c]
mov r8d, ebx
lea rcx, [rbp + 0x190]
call fcn.140012c70
lea rcx, [r13 + 0x68]
lea rdx, [0x140048a8c]
call fcn.14000f960
lea ecx, [rbx + 0x10]
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x180]
call fcn.14000f9e0
movups xmm0, xmmword [rsp + 0x70]
lea esi, [r14 + 0x58]
sub esi, edi
lea rcx, [r14 + 0x58]
movzx eax, sil
not al
inc al
and al, 0xf
movzx edi, al
cmove edi, r15d
movzx ebx, dil
mov edx, ebx
movzx r8d, dil
movups xmmword [r14 + 0x48], xmm0
call fcn.1400148a0
lea rax, [rbp - 0x7c]
movzx r8d, dil
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
add esi, ebx
call fcn.14000e850
lea rdx, [rbp - 0x6c]
mov ecx, esi
call fcn.14000f0f0
call fcn.14000ea30
mov rdi, qword [rsp + 0x38]
lea eax, [rsi + 0x14]
movsxd rcx, eax
mov dword [rdi], eax
call fcn.1400102c0
movsxd r8, dword [rdi]
lea rdx, [rbp - 0x80]
mov rcx, rax
mov rbx, rax
call fcn.140012c70
mov rax, rbx
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400102f0
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003ef0
Capabilities:
Access the windows event log

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edi, ecx
mov qword [rsp + 0x50], rdx
lea rdx, str.KmsRequests
xor ecx, ecx
movzx esi, r8w
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rbx, rax
test rax, rax
je 0x140003f68
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov edx, 1
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
mov r9d, edi
mov word [rsp + 0x28], dx
movzx edx, si
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400102f0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs rax, 0xcbf29ce484222325
test rdx, rdx
je 0x140001324
movabs r10, 0x100000001b3
nop dword [rax]
movzx r8d, byte [r9 + rcx]
inc r9
xor rax, r8
imul rax, r10
cmp r9, rdx
jb 0x140001310
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
lea rdx, [r8 + r8]
jmp 0x1400012f0
Function at 0x140007eb0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14000806b
nop dword [rax + rax]
cmp ecx, 0x7c
je 0x14000806b
cmp ecx, 0x29
jne 0x140007ef8
cmp dword [rbx + 0x1c], 0
jne 0x14000806b
test dword [rbx + 0x80], 0x10000000
je 0x140008076
cmp ecx, 0x2e
jne 0x140007f0b
lea rcx, [rbx + 0x40]
call fcn.1400094a0
jmp 0x14000804d
cmp ecx, 0x5c
jne 0x140007f79
mov rcx, rbx
call fcn.140007e70
mov eax, dword [rbx + 0x80]
and eax, 0x80
je 0x140007f42
cmp word [rbx + 0x78], 0x62
jne 0x140007f42
lea rcx, [rbx + 0x40]
call fcn.140009490
mov rcx, rbx
call fcn.140007e70
jmp 0x14000805d
test eax, eax
je 0x140007f6c
cmp word [rbx + 0x78], 0x42
jne 0x140007f6c
lea rcx, [rbx + 0x40]
call fcn.140009490
lea rcx, [rbx + 0x40]
call fcn.140009540
mov rcx, rbx
call fcn.140007e70
jmp 0x14000805d
mov rcx, rbx
call fcn.140009170
jmp 0x140008055
cmp ecx, 0x5b
jne 0x140007fa4
mov rcx, rbx
call fcn.140007e70
mov rcx, rbx
call fcn.140009100
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.1400090e0
jmp 0x140008055
cmp ecx, 0x28
jne 0x140007fd8
mov rcx, rbx
call fcn.140007e70
mov rcx, rbx
call fcn.140009260
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.1400090e0
test dil, dil
je 0x14000805d
jmp 0x140008055
cmp ecx, 0x5e
jne 0x140007ff0
lea rcx, [rbx + 0x40]
call fcn.140009470
mov rcx, rbx
call fcn.140007e70
jmp 0x14000805d
cmp ecx, 0x24
jne 0x140008008
lea rcx, [rbx + 0x40]
call fcn.140009480
mov rcx, rbx
call fcn.140007e70
jmp 0x14000805d
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140008097
cmp ecx, 0x3f
je 0x140008097
cmp ecx, 0x7b
je 0x140008097
cmp ecx, 0x7d
jne 0x14000802f
test dword [rbx + 0x80], 0x10000000
je 0x140008081
cmp ecx, 0x5d
jne 0x140008040
test dword [rbx + 0x80], 0x10000000
je 0x14000808c
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1400094b0
mov rcx, rbx
call fcn.140007e70
mov rcx, rbx
call fcn.140009340
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x140007ed0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 5
call fcn.140006c60
int3
mov edx, 6
call fcn.140006c60
int3
mov edx, 4
call fcn.140006c60
int3
mov edx, 0xa
call fcn.140006c60
int3
Function at 0x14000d7e0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, r8
mov qword [rsp + 0x48], 0
mov rdi, rdx
mov qword [rsp + 0x40], 0
mov rbx, rcx
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000d8c0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140041108]
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 0x1c]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x30], 0x1ec
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000d8ae
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000d8c0
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400102f0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000d8e0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r8
mov qword [rsp + 0x38], 0
mov rdi, rdx
mov qword [rsp + 0x30], 0
mov rbx, rcx
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000d9b8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140041108]
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 0x1c]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000d9a6
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000d9b8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400102f0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000daf0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx eax, cl
lea rcx, [0x1400411a0]
movzx eax, byte [rax + rcx]
ret

Function at 0x14000db00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx eax, cl
lea rcx, [0x1400412a0]
movzx eax, byte [rax + rcx]
ret
Function at 0x14000f170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, dword [0x14004a808]
xor ebx, ebx
mov dword [r9], ebx
mov r12, r9
mov rdi, r8
mov rbp, rcx
test eax, eax
je 0x14000f370
sub eax, 1
je 0x14000f2f8
sub eax, 1
je 0x14000f25b
cmp eax, 1
je 0x14000f1c9
lea eax, [rbx + 1]
jmp 0x14000f396
mov rsi, qword [0x14004a820]
lea r8, [rsp + 0x20]
mov edx, 0x10
mov rcx, rsi
test ebx, ebx
je 0x14000f1e6
lea rcx, [rsp + 0x20]
call fcn.14000eb00
test eax, eax
jne 0x14000f396
mov edx, ebx
lea r8, [rsp + 0x21]
shl edx, 4
lea r9d, [rax + 4]
inc edx
lea eax, [rdx - 1]
mov ecx, eax
lea r8, [r8 + 4]
movzx eax, byte [rax + rbp]
xor al, byte [r8 - 5]
mov byte [rcx + rdi], al
movzx eax, byte [rdx + rbp]
xor al, byte [r8 - 4]
mov byte [rdx + rdi], al
lea eax, [rdx + 1]
mov ecx, eax
movzx eax, byte [rax + rbp]
xor al, byte [r8 - 3]
mov byte [rcx + rdi], al
lea eax, [rdx + 2]
mov ecx, eax
lea edx, [rdx + 4]
movzx eax, byte [rax + rbp]
xor al, byte [r8 - 2]
mov byte [rcx + rdi], al
sub r9, 1
jne 0x14000f203
inc ebx
cmp ebx, 0x10
jb 0x14000f1d0
jmp 0x14000f38c
mov rsi, qword [0x14004a820]
lea r8, [rsp + 0x20]
mov edx, 0x10
test ebx, ebx
jne 0x14000f275
mov rcx, rsi
jmp 0x14000f280
mov ecx, ebx
shl ecx, 4
sub ecx, 0x10
add rcx, rbp
call fcn.14000eb00
test eax, eax
jne 0x14000f396
mov edx, ebx
lea r8, [rsp + 0x21]
shl edx, 4
lea r9d, [rax + 4]
inc edx
nop dword [rax]
lea eax, [rdx - 1]
mov ecx, eax
lea r8, [r8 + 4]
movzx eax, byte [rax + rbp]
xor al, byte [r8 - 5]
mov byte [rcx + rdi], al
movzx eax, byte [rdx + rbp]
xor al, byte [r8 - 4]
mov byte [rdx + rdi], al
lea eax, [rdx + 1]
mov ecx, eax
movzx eax, byte [rax + rbp]
xor al, byte [r8 - 3]
mov byte [rcx + rdi], al
lea eax, [rdx + 2]
mov ecx, eax
lea edx, [rdx + 4]
movzx eax, byte [rax + rbp]
xor al, byte [r8 - 2]
mov byte [rcx + rdi], al
sub r9, 1
jne 0x14000f2a0
inc ebx
cmp ebx, 0x10
jb 0x14000f262
jmp 0x14000f38c
mov r15, qword [0x14004a820]
mov esi, ebx
mov eax, esi
lea rdx, [rsp + 0x20]
shl eax, 4
mov r14d, eax
lea rcx, [rax + rbp]
call fcn.14000f160
test eax, eax
jne 0x14000f396
lea rcx, [rsp + 0x20]
mov r10, r15
sub r10, rcx
lea r9, [rsp + 0x20]
mov eax, ebx
test esi, esi
jne 0x14000f344
movzx edx, byte [r10 + r9]
xor dl, byte [r9]
mov ecx, eax
mov byte [rcx + rdi], dl
jmp 0x14000f35c
lea ecx, [rsi - 1]
shl ecx, 4
add ecx, eax
movzx r8d, byte [rcx + rbp]
lea ecx, [r14 + rax]
xor r8b, byte [r9]
mov byte [rcx + rdi], r8b
inc eax
inc r9
cmp eax, 0x10
jb 0x14000f331
inc esi
cmp esi, 0x10
jb 0x14000f301
jmp 0x14000f38c
lea rdx, [rbx + rdi]
lea rcx, [rbx + rbp]
call fcn.14000f160
test eax, eax
jne 0x14000f396
add ebx, 0x10
cmp ebx, 0x100
jb 0x14000f370
mov dword [r12], 0x100
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400102f0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000f540
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
mov r10, rcx
test r8d, r8d
je 0x14000f5e1
cmp r8d, 0x20
jb 0x14000f5b7
lea eax, [r8 - 1]
lea rcx, [rax + rdx]
add rax, r10
cmp rdx, rax
ja 0x14000f56a
cmp rcx, r10
jae 0x14000f5b7
mov r9d, r8d
and r9d, 0xffffffe0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r11 + rdx]
lea eax, [r11 + 0x10]
movdqu xmm1, xmmword [r11 + r10]
pxor xmm1, xmm0
movdqu xmmword [r11 + rdx], xmm1
add r11d, 0x20
movdqu xmm1, xmmword [rax + r10]
movdqu xmm0, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx], xmm1
cmp r11d, r9d
jb 0x14000f580
cmp r11d, r8d
jae 0x14000f5e1
sub r10, rdx
mov eax, r11d
add rax, rdx
sub r8d, r11d
mov edx, r8d
nop dword [rax + rax]
movzx ecx, byte [r10 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14000f5d0
ret

Function at 0x14000f5f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea rax, [rcx + 1]
mov edx, 4
lea r8, str.cw
movzx ecx, byte [rax - 1]
lea rax, [rax + 4]
movzx ecx, byte [rcx + r8]
mov byte [rax - 5], cl
movzx ecx, byte [rax - 4]
movzx ecx, byte [rcx + r8]
mov byte [rax - 4], cl
movzx ecx, byte [rax - 3]
movzx ecx, byte [rcx + r8]
mov byte [rax - 3], cl
movzx ecx, byte [rax - 2]
movzx ecx, byte [rcx + r8]
mov byte [rax - 2], cl
sub rdx, 1
jne 0x14000f600
ret

Function at 0x14000f690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, rcx
mov rbp, rcx
neg r15
mov r14, rcx
mov r12d, 4
nop dword [rax + rax]
mov esi, dword [r14]
mov edx, esi
shr edx, 8
mov r11d, esi
movzx ecx, dl
shr r11d, 0x18
xor cl, sil
mov dword [rsp + 0x58], esi
movzx ebx, cl
mov r9d, esi
xor bl, r11b
shr r9d, 0x10
xor bl, r9b
call fcn.14000d9d0
xor al, bl
lea r10, [r15 + r14]
movzx ecx, r9b
mov byte [r14], al
xor cl, dl
call fcn.14000d9d0
xor al, bl
mov rdx, r10
or rdx, 1
movzx ecx, r11b
xor cl, r9b
mov byte [rdx + rbp], al
call fcn.14000d9d0
xor al, bl
mov rdx, r10
or rdx, 2
xor r11b, sil
movzx ecx, r11b
mov byte [rdx + rbp], al
call fcn.14000d9d0
or r10, 3
lea r14, [r14 + 4]
xor al, bl
mov byte [r10 + rbp], al
xor dword [r14 - 4], esi
sub r12, 1
jne 0x14000f6c0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret