joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007c2e
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov esi, ecx
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x20], 0xf0000000
xor edi, edi
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x140007cbf
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, esi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x140007cae
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov edx, 2
xor r8d, r8d
call qword [sym.imp.advapi32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov edi, dword [rsp + 0x34]
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140007cc8
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov esi, ecx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x20], 0xf0000000
xor edi, edi
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x140007d5e
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x38]
mov edx, esi
xor r8d, r8d
call qword [sym.imp.advapi32.dll_CryptGenKey]
test eax, eax
je 0x140007d4a
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov edx, 8
call qword [sym.imp.advapi32.dll_CryptGetKeyParam]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov edi, dword [rsp + 0x30]
shr edi, 3
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140007d67
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov esi, ecx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x20], 0xf0000000
xor edi, edi
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x140007dfd
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x38]
mov edx, esi
xor r8d, r8d
call qword [sym.imp.advapi32.dll_CryptGenKey]
test eax, eax
je 0x140007de9
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov edx, 9
call qword [sym.imp.advapi32.dll_CryptGetKeyParam]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov edi, dword [rsp + 0x30]
shr edi, 3
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140007f0c
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x20], 0xf0000000
xor esi, esi
lea rcx, [rsp + 0x50]
xor edx, edx
xor r8d, r8d
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x140008062
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
mov edx, 0x660e
mov r8, rbx
mov r9d, 0x10
call fcn.140006d05
test eax, eax
je 0x140008078
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x4c]
xor esi, esi
mov edx, 4
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSetKeyParam]
test eax, eax
je 0x140008090
mov rcx, qword [rsp + 0x40]
xor esi, esi
mov edx, 1
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000809f
mov rbx, qword [rsp + 0xb0]
mov edi, ebp
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400080b3
mov r15, qword [rsp + 0xb8]
mov dword [r15], ebp
mov rcx, qword [rbx]
mov rdx, r14
mov r8, rdi
call fcn.1400eeb30
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
mov esi, eax
test eax, eax
jne 0x1400080b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14013cf40]
mov edx, eax
call fcn.140016430
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov dword [r15], 0
xor esi, esi
jmp 0x1400080b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14013d090]
mov edx, eax
call fcn.140016430
jmp 0x1400080cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14013d040]
mov edx, eax
call fcn.140016430
xor esi, esi
jmp 0x1400080be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14013cfe0]
jmp 0x1400080ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14013cf80]
mov edx, eax
call fcn.140016430
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov eax, esi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140008199
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov ebp, r9d
mov rsi, r8
mov r14d, edx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rax, [0x14013d150]
mov qword [rsp + 0x48], rax
mov eax, 1
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x68], eax
call fcn.140023fc0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140008263
mov dword [rsp + 0x20], 8
lea r8, [0x14013d150]
lea rcx, [rsp + 0x30]
mov rdx, rax
mov r9d, 1
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x140008267
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
xor ebx, ebx
mov rdx, rsi
mov r8d, ebp
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptImportKey]
test eax, eax
je 0x14000827f
mov r9, qword [rsp + 0xc8]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov edx, r14d
call fcn.1400082b5
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
jmp 0x140008293
xor ebx, ebx
jmp 0x1400082a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14013d090]
mov edx, eax
call fcn.140016430
xor ebx, ebx
jmp 0x14000829d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14013d1b0]
mov edx, eax
call fcn.140016430
mov rcx, qword [rsp + 0x30]
call fcn.14000723a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140008a4d
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rdi, qword [rsp + 0xa0]
mov dword [rsp + 0x4c], r8d
mov qword [r9], 0
mov dword [rdi], r8d
xor ebx, ebx
lea r9, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.advapi32.dll_CryptDuplicateKey]
test eax, eax
je 0x140008b33
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
xor ebx, ebx
xor edx, edx
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptEncrypt]
test eax, eax
je 0x140008b28
mov edx, dword [rdi]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140008b28
mov r8d, ebp
mov rcx, rax
mov rdx, r14
call fcn.1400eeb30
mov eax, dword [rdi]
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptEncrypt]
mov ebx, eax
test eax, eax
jne 0x140008b28
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], rax
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140008b40
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov ebp, r8d
mov rdi, rdx
mov r14, qword [rsp + 0x90]
mov qword [r9], 0
mov dword [r14], r8d
xor ebx, ebx
lea r9, [rsp + 0x38]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.advapi32.dll_CryptDuplicateKey]
test eax, eax
je 0x140008be3
mov ebx, ebp
mov ecx, 0x40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140008bd6
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call fcn.1400eeb30
mov rax, qword [rsi]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
mov ebx, eax
test eax, eax
jne 0x140008bd8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], rax
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov eax, ebx
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14000f342
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rdi, r8
movaps xmm0, xmmword [0x14011b180]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [0x14011b740]
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
test edx, edx
je 0x14000f3cb
mov bl, byte [rcx]
mov eax, ebx
xor al, 0x36
mov byte [rsp + 0x70], al
xor bl, 0x5c
mov byte [rsp + 0x30], bl
cmp edx, 1
je 0x14000f3cb
mov eax, edx
mov edx, 1
mov bl, byte [rcx + rdx]
xor byte [rsp + rdx + 0x70], bl
xor byte [rsp + rdx + 0x30], bl
inc rdx
cmp rax, rdx
jne 0x14000f3b8
mov ebp, r9d
lea rbx, [rbp + 0x40]
mov ecx, 0x40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x14000f541
mov rsi, rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmm3, xmmword [rsp + 0xa0]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov rcx, rax
add rcx, 0x40
mov rdx, rdi
mov r8, rbp
call fcn.1400eeb30
mov dword [rsp + 0x20], Ordinal_26
lea r9, [rsp + 0xb0]
mov ecx, 0x8004
mov rdx, rsi
mov r8d, ebx
call fcn.140006b54
xor ebp, ebp
test eax, eax
je 0x14000f536
mov r13d, dword [rsp + 0x148]
mov r12d, dword [rsp + 0x138]
mov edi, r12d
mov r14d, r13d
lea r15, [rdi + r14]
add r15, 0x54
mov ecx, 0x40
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x14000f536
mov rbx, rax
mov rbp, qword [rsp + 0x140]
mov rdx, qword [rsp + reloc.WLDAP32.dll_Ordinal_304]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movaps xmm3, xmmword [rsp + 0x60]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [rsp + 0xc0]
mov dword [rbx + 0x50], eax
test rdx, rdx
je 0x14000f4eb
test r12d, r12d
je 0x14000f4eb
lea rcx, [rbx + 0x54]
mov r8, rdi
call fcn.1400eeb30
mov r12, qword [rsp + 0x150]
test rbp, rbp
je 0x14000f510
test r13d, r13d
je 0x14000f510
lea rcx, [rbx + rdi]
add rcx, 0x54
mov rdx, rbp
mov r8, r14
call fcn.1400eeb30
mov dword [rsp + 0x20], Ordinal_26
mov ecx, 0x8004
mov rdx, rbx
mov r8d, r15d
mov r9, r12
call fcn.140006b54
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000f543
xor ebp, ebp
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000f988
Capabilities:
Encrypt data using dpapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r14, r8
mov rsi, qword [rsp + 0x108]
mov r15, qword [rsp + 0x100]
mov r12, qword [rsp + 0xf8]
mov ebp, dword [rsp + 0xe0]
mov dword [rsp + 0x68], edx
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x60], r9
test rsi, rsi
je 0x14000fa6d
mov r13d, dword [rsp + 0x110]
test r13d, r13d
je 0x14000fa6d
mov rdi, r9
call fcn.14000e25c
test rax, rax
je 0x14000fae6
mov rbx, rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov rcx, rbx
mov rdx, rsi
mov r8d, r13d
mov r9, rdi
call fcn.14000f6e6
mov edi, eax
test r14, r14
je 0x14000fa63
test edi, edi
je 0x14000fa63
cmp qword [rbx + 0x30], 0
je 0x14000fa63
mov edx, dword [rbx + 0x2c]
test rdx, rdx
je 0x14000fa63
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r14], rax
test rax, rax
je 0x14000fa63
mov rdx, qword [rbx + 0x30]
mov r8d, dword [rbx + 0x2c]
mov rcx, rax
call fcn.1400eeb30
mov rcx, rbx
call fcn.14000e394
jmp 0x14000fae8
mov eax, dword [rsp + 0xf0]
mov rcx, qword [rsp + 0xe8]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
xor edi, edi
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x58]
mov rdx, r14
xor r9d, r9d
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x14000fae8
mov esi, eax
mov edx, dword [rsp + 0x48]
mov dword [r15], edx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r12], rax
test rax, rax
je 0x14000fad7
mov rdx, qword [rsp + 0x50]
mov r8d, dword [r15]
mov rcx, rax
call fcn.1400eeb30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, esi
jmp 0x14000fae8
xor edi, edi
mov eax, edi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140010407
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, r9
mov r15d, r8d
mov r13, rdx
mov rdi, rcx
mov eax, dword [rcx + 0x1c]
cmp eax, 0x8009
mov ebx, 0x8004
cmovne ebx, eax
mov ecx, ebx
call fcn.140007c2e
mov ecx, dword [rdi + 0x28]
call fcn.140007d67
mov ebp, eax
mov ecx, dword [rdi + 0x28]
call fcn.140007cc8
mov esi, eax
add esi, ebp
mov ecx, 0x40
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x140010600
mov r12, rax
mov eax, dword [rdi + 0x20]
lea r9, [rdi + 0x34]
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 0x10
mov ecx, ebx
mov rdx, r13
mov r8d, r15d
call fcn.140007578
test eax, eax
je 0x140010618
mov ecx, dword [rdi + 0x28]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor esi, esi
mov rdx, r12
mov r8d, ebp
xor r9d, r9d
call fcn.140006dde
test eax, eax
je 0x140010604
mov eax, ebp
mov r8, r12
add r8, rax
mov rcx, qword [rsp + 0x50]
mov edx, 1
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400105d1
mov ebx, dword [rdi + 0x54]
mov dword [rsp + 0x5c], ebx
mov ecx, 0x40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x1400105d1
mov r15, rax
mov rdx, qword [rdi + 0x4c]
mov rcx, rax
mov r8, rbx
call fcn.1400eeb30
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor esi, esi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
test eax, eax
je 0x1400105c8
mov rcx, qword [rsp + 0xd0]
mov eax, dword [rdi + 0x2c]
cmp eax, 0x14
mov r8d, 0x14
cmovb r8d, eax
mov rdx, r15
call fcn.1400eeb30
mov edx, dword [rdi + 0x2c]
mov eax, dword [rdi + 0x30]
add rdx, r15
cmp eax, 0x10
mov r8d, 0x10
cmovb r8d, eax
mov rcx, r14
call fcn.1400eeb30
mov eax, dword [rdi + 0x30]
mov esi, 1
cmp eax, 0x10
je 0x1400105c8
add eax, 0xfffffff0
je 0x1400105c8
mov edx, dword [rdi + 0x2c]
mov eax, eax
mov rcx, r15
add rcx, rdx
mov edx, 0x10
mov bl, byte [rcx + rdx]
test bl, bl
jne 0x1400105c0
lea rbp, [rdx - 0xf]
inc rdx
cmp rbp, rax
jb 0x1400105ad
xor esi, esi
test bl, bl
sete sil
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x60]
call fcn.14000723a
test eax, eax
jne 0x14001061a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__2_2___2__________v_
mov edx, eax
call fcn.140016430
jmp 0x14001061a
xor esi, esi
jmp 0x140010623
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140141870]
mov edx, eax
call fcn.140016430
xor esi, esi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400124fc
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor edi, edi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
mov edx, eax
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140012554
test ebx, ebx
je 0x140012549
mov ecx, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec ebx
mov edi, 1
cmp eax, ebx
je 0x140012554
mov rax, qword [rsi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140012639
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov dword [rsp + 0x44], 0
cmp dword [0x140177a60], 0
je 0x140012719
lea r12, [rsp + 0x44]
mov qword [rsp + 0x20], r12
xor r15d, r15d
mov rcx, rbx
mov edx, edi
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x140012794
mov edx, dword [rsp + 0x44]
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x140012794
mov rsi, rax
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov edx, edi
mov r8d, 1
mov r9, rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov r15d, eax
test eax, eax
je 0x14001270e
lea rcx, [0x140141b20]
mov rdx, r14
call fcn.140016430
cmp dword [rsp + 0x44], 0
je 0x140012702
xor ebx, ebx
lea rdi, [0x140141ba0]
movzx edx, word [rsi + rbx*2]
mov rcx, rdi
call fcn.140016430
inc rbx
mov eax, dword [rsp + 0x44]
cmp rbx, rax
jb 0x1400126ea
lea rcx, str._f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_f1_111
call fcn.140016430
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140012794
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r15d, r15d
mov rcx, r14
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
inc rax
cmp rax, 2
jb 0x140012794
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r15d, r15d
test eax, eax
je 0x14001278b
cmp dword [rsp + 0x44], edi
jne 0x14001278b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov r15d, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400127a5
Capabilities:
Get file size
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, r8
mov rsi, rdx
cmp dword [0x140177a64], 0
je 0x1400127ed
mov rdx, rsi
mov r8, rdi
call fcn.1400244b1
mov ebx, eax
test eax, eax
jne 0x14001289e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._d6d6dd6dDdDd_dDd
mov edx, eax
call fcn.140016430
xor ebx, ebx
jmp 0x14001289e
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor ebx, ebx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
inc rax
cmp rax, 2
jb 0x14001289e
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor ebx, ebx
test eax, eax
je 0x140012895
cmp dword [rsp + 0x44], 0
jne 0x140012895
mov edx, dword [rsp + 0x40]
mov dword [rdi], edx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140012895
mov r8d, dword [rdi]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, r14
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001288a
mov eax, dword [rdi]
mov ebx, 1
cmp eax, dword [rsp + 0x3c]
je 0x140012895
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400128ed
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001294b
mov rdi, rcx
xor esi, esi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14001294d
mov ebx, eax
mov edx, eax
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x14001294b
mov rsi, rax
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp ebx, eax
je 0x14001294d
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret