joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006190
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub rsp, 0x78
call qword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
movsx eax, al
test eax, eax
jne 0x1400061af
rdtsc
shl rdx, 0x20
or rax, rdx
jmp 0x140006381
mov rax, qword gs:[0x188]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0
cmp dword [0x1400100d0], 0x1db1
ja 0x1400061e2
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x1f8]
mov dword [rsp + 0x28], eax
jmp 0x1400061f1
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x28], eax
mov rax, qword gs:[0x1a8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x140006223
mov rax, qword [rsp + 0x20]
sub rax, 8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x20], rax
jbe 0x140006378
lfence
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x140006257
jmp 0x140006378
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x501802
je 0x140006266
jmp 0x140006215
mov rax, qword [rsp + 0x20]
sub rax, 8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x140006295
jmp 0x140006378
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
cmp eax, 0xf33
je 0x1400062a9
jmp 0x140006215
jmp 0x1400062b9
mov rax, qword [rsp + 0x20]
add rax, 8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x20], rax
jae 0x140006371
lfence
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x1400062ed
jmp 0x140006371
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
and rax, 0xfffffffffffff000
cmp rax, qword [0x1400100e8]
jb 0x140006325
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
and rax, 0xfffffffffffff000
mov rcx, qword [0x1400100e8]
add rcx, 0x2000
cmp rax, rcx
jb 0x140006327
jmp 0x1400062ab
mov eax, 8
imul rax, rax, 9
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
cmp qword [0x1400100c8], 0
je 0x14000636a
mov rax, qword [0x1400100c8]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x28]
mov rax, qword [rsp + 0x68]
call qword [0x140008210]
jmp 0x140006371
jmp 0x140006378
rdtsc
shl rdx, 0x20
or rax, rdx
add rsp, 0x78
ret
Function at 0x100be0db0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100be0dbd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100be0dcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100be0db5
lea eax, [rcx + 1]
jmp 0x100be0ddb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100be0dee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100be0dd4
sub eax, 3
jb 0x100be0e0e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100be0e5d
sar eax, 1
movsxd rbp, eax
jb 0x100be0e44
jmp 0x100be0e1c
add ebx, ebx
jne 0x100be0e1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100be0e44
inc ecx
add ebx, ebx
jne 0x100be0e2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100be0e44
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100be0e3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100be0e2c
add ecx, 2
jmp 0x100be0e49
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100be0d72
jmp 0x100be0dbd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x24a000
mov dl, 0x3b
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x100be0ea9
cmp rsi, rcx
jae 0x100be0eb1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x100be0e90
cmp al, 0x8f
ja 0x100be0e90
cmp byte [rsi - 2], 0xf
je 0x100be0e96
sub al, 0xe8
cmp al, 1
ja 0x100be0e7a
cmp rsi, rcx
jae 0x100be0eb1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x100be0e80
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x100be0eb1
lodsb al, byte [rsi]
jmp 0x100be0e90
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x7de000]
mov eax, dword [rdi]
or eax, eax
je 0x100be0f0e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7e04ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100be0ebe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100be0f08
mov qword [rbx], rax
add rbx, 8
jmp 0x100be0ede
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100be0f66
sub rsp, 0xffffffffffffff80
jmp section.sect_0
Function at 0x14001135c
Capabilities:
Terminate process

Disassembly:
jmp 0x140017800
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001144c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018b50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018b70
xor al, al
jmp 0x140018bf1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018b83
xor al, al
jmp 0x140018bf1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140018bad
xor al, al
jmp 0x140018bf1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018bc1
xor al, al
jmp 0x140018bf1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018bd3
xor al, al
jmp 0x140018bf1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140018bef
xor al, al
jmp 0x140018bf1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ee0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001128a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014230
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014250
xor al, al
jmp 0x1400142d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014263
xor al, al
jmp 0x1400142d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001428d
xor al, al
jmp 0x1400142d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400142a1
xor al, al
jmp 0x1400142d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400142b3
xor al, al
jmp 0x1400142d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142cf
xor al, al
jmp 0x1400142d1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400019e8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
mov edx, Ordinal_69
mov r15d, r9d
mov edi, r8d
lea ecx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor r12d, r12d
mov rbx, rax
test rax, rax
je 0x140001ba9
lea ebp, [r12 + 7]
cmp edi, ebp
jb 0x140001a47
mov edx, edi
lea rcx, str.ERROR_kull_m_busylight_request_create___count_u__max_is_7__n
call fcn.14000bdb8
cmp edi, ebp
cmovb ebp, edi
mov r10d, r12d
mov edi, 1
test ebp, ebp
je 0x140001ad5
lea r9, [r14 + 2]
movzx edx, byte [r9 - 2]
lea r8d, [r10*8]
mov cl, dl
mov al, dl
or al, 0x10
and cl, 0xf0
movzx eax, al
lea ecx, [r8 + 2]
cmove edx, eax
lea eax, [r8 + 1]
add r10d, edi
mov byte [rax + rbx], dl
mov al, byte [r9 - 1]
mov byte [rcx + rbx], al
lea ecx, [r8 + 3]
mov al, byte [r9]
lea r9, [r9 + 8]
mov byte [rcx + rbx], al
lea ecx, [r8 + 4]
mov al, byte [r9 - 7]
mov byte [rcx + rbx], al
lea ecx, [r8 + 5]
mov al, byte [r9 - 6]
mov byte [rcx + rbx], al
lea ecx, [r8 + 6]
mov al, byte [r9 - 5]
mov byte [rcx + rbx], al
lea ecx, [r8 + 7]
mov al, byte [r9 - 4]
mov byte [rcx + rbx], al
lea ecx, [r8 + 8]
mov al, byte [r9 - 3]
mov byte [rcx + rbx], al
cmp r10d, ebp
jb 0x140001a5a
or word [rbx + 0x3d], 0xffff
lea rdx, [rbx + 1]
mov dword [rbx + 0x39], 0xff550404
movzx ecx, r12w
mov r8d, 0x3e
movzx eax, byte [rdx]
add rdx, rdi
add cx, ax
sub r8, rdi
jne 0x140001af0
movzx eax, cx
mov byte [rbx + 0x40], cl
shr ax, 8
mov byte [rbx + 0x3f], al
test rsi, rsi
je 0x140001b9e
mov rcx, qword [rsi + 0x78]
mov ebp, r12d
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001b79
movzx r9d, word [rsi + 0x2a]
mov r8d, Ordinal_69
cmp r9d, r8d
jb 0x140001b68
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
test eax, eax
jne 0x140001b88
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsi + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__WriteFile__0x_08x__n
mov r8d, eax
call fcn.14000bdb8
jmp 0x140001b88
mov edx, dword [rsi + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.14000bdb8
jmp 0x140001b88
mov edx, dword [rsi + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000bdb8
and edi, ebp
test r15d, r15d
je 0x140001b9e
mov rax, qword [rsi]
mov rsi, rax
test rax, rax
jne 0x140001b14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001bac
mov edi, r12d
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x140001bd0
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 8], 0
mov esi, edx
mov dword [rax + 0xc], 0x80000000
mov rdi, rcx
mov rbx, rcx
test rcx, rcx
je 0x140001c2a
and dword [rbx + 0x90], 0
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x140001c1b
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rbx + 0x98], 0
test esi, esi
je 0x140001c2a
mov rax, qword [rbx]
mov rbx, rax
test rax, rax
jne 0x140001bf8
mov r9d, esi
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, rdi
call fcn.1400019e8
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400020ec
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x70
mov rbp, rcx
mov edx, 0x338
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400022a4
and dword [rbx + 0x1c], 0
lea r14, [rax + 8]
and dword [rbx + 0x20], 0
mov eax, 0x4000000
mov dword [r14], eax
mov r8, rbp
mov dword [rbx + 0xc], eax
xor edx, edx
mov eax, SQLGetData
mov rcx, r14
mov word [rbx + 0x28], ax
call fcn.140001f74
test eax, eax
je 0x140002286
lea rsi, [rbx + 0x22a]
mov edi, 0x100
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140002292
mov rax, rsi
cmp byte [rax], 0
je 0x140002189
inc rax
sub rdi, 1
jne 0x14000217b
test rdi, rdi
je 0x140002292
sub rsi, rdi
lea rcx, [rsi + 0x100]
test rdi, rdi
je 0x1400021cd
lea rdx, [0x1400fe3c8]
mov eax, 0x7ffffffe
sub rdx, rcx
test rax, rax
je 0x1400021cd
mov r8b, byte [rdx + rcx]
test r8b, r8b
je 0x1400021cd
mov byte [rcx], r8b
dec rax
inc rcx
sub rdi, 1
jne 0x1400021b0
test rdi, rdi
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
je 0x140002292
mov qword [rsp + 0x60], rbp
lea rax, [0x140001e94]
mov qword [rsp + 0x58], r14
lea rdi, [rbx + 0x32c]
mov qword [rsp + 0x50], rax
lea r9, [0x140001cf8]
lea rax, [0x140001e60]
mov rcx, rdi
mov qword [rsp + 0x48], rax
lea r8, [0x140001ce8]
lea rax, [0x140001e28]
mov qword [rsp + 0x40], rax
lea rdx, [fcn.140001ce4]
lea rax, [fcn.140001df4]
mov qword [rsp + 0x38], rax
lea rax, [0x140001dbc]
mov qword [rsp + 0x30], rax
lea rax, [0x140001d84]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140001d00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FCICreate]
mov qword [rbx], rax
test rax, rax
jne 0x140002292
mov ecx, dword [rdi]
call fcn.140002070
mov edx, dword [rdi]
lea rcx, str.ERROR_kull_m_cabinet_create___FCICreate_failed_with_error_code__d:__S_n
mov r8, rax
call fcn.14000bdb8
jmp 0x140002292
lea rcx, str.ERROR_kull_m_cabinet_create___Failed_to_initialize_the_cabinet_information_structure._n
call fcn.14000bdb8
cmp qword [rbx], 0
jne 0x1400022a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140003858
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov r15, r9
mov esi, r8d
mov r14, rdx
mov edi, ecx
cmp ecx, 0x8000
jne 0x1400038f1
cmp dword [rbp + 0x40], 4
jne 0x1400039d3
lea rdx, [rbp - 0x20]
mov ecx, 0xffffff7c
call qword [sym.imp.cryptdll.dll_CDLocateCheckSum]
test eax, eax
js 0x1400039d3
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [rax + 0x10]
test eax, eax
js 0x1400039d3
mov rax, qword [rbp - 0x20]
mov r8, r14
mov rcx, qword [rbp - 0x10]
mov edx, esi
call qword [rax + reloc.ODBC32.dll_SQLAllocHandle]
mov rax, qword [rbp - 0x20]
mov rdx, r15
mov rcx, qword [rbp - 0x10]
call qword [rax + 0x20]
test eax, eax
lea rcx, [rbp - 0x10]
mov rax, qword [rbp - 0x20]
setns bl
call qword [rax + Ordinal_41]
jmp 0x1400039d3
mov r9d, reloc.ODBC32.dll_SQLAllocHandle
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rbp - 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400039d3
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400039c7
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400039bd
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea esi, [r8 + 2]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400039bd
mov edx, dword [rbp + 0x20]
lea ecx, [rsi + 0x3e]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400039bd
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x20]
mov r8, rax
mov dword [rsp + 0x20], ebx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rbp + 0x40]
mov rdx, rdi
cmp dword [rbp + 0x20], ecx
mov ebx, eax
cmovb ecx, dword [rbp + 0x20]
mov r8d, ecx
mov rcx, r15
call fcn.1400c5890
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400039f0
Capabilities:
Encrypt data using des via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov esi, r9d
mov r12, rcx
xor ebx, ebx
mov ecx, 0x6603
mov r14, r8
mov r15d, edx
lea ebp, [rsi + 0xc]
cmp edx, ecx
je 0x140003a87
mov edx, ebp
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140003ab5
mov r8d, esi
mov dword [rax], 0x208
lea rcx, [rax + 0xc]
mov dword [rax + 4], r15d
mov rdx, r14
mov dword [rax + 8], esi
call fcn.1400c5890
mov rax, qword [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov eax, dword [rsp + 0x70]
mov rdx, rdi
mov rcx, r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140003ab5
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x140003ab5
mov r9d, dword [rsp + 0x70]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call fcn.1400044fc
mov ebx, eax
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x140003ad8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push r12
push r14
push r15
sub rsp, 0x150
xor esi, esi
mov ebx, r8d
cmp r8d, dword [rsp + 0x190]
mov rbp, r9
mov r14, rdx
mov r15d, ecx
setae sil
jb 0x140003b1d
mov r8d, dword [rsp + 0x190]
jmp 0x140003bd5
mov r12d, Ordinal_69
lea rcx, [rsp + 0x30]
mov r8d, r12d
lea edx, [r12 - 0xa]
call fcn.1400c51a0
mov r8d, r12d
lea edx, [r12 + 0x1c]
lea rcx, [rsp + 0x70]
call fcn.1400c51a0
test ebx, ebx
je 0x140003b73
lea rax, [rsp + 0x30]
mov r8, rbx
sub r14, rax
xor edx, edx
lea rax, [rsp + 0x30]
add rax, rdx
mov cl, byte [r14 + rax]
xor byte [rsp + rdx + 0x70], cl
inc rdx
xor byte [rax], cl
sub r8, 1
jne 0x140003b58
lea r9, [rsp + 0xb0]
mov dword [rsp + 0x20], ebx
mov r8d, r12d
lea rdx, [rsp + 0x30]
mov ecx, r15d
call fcn.140003858
test eax, eax
je 0x140003bdd
lea r9, [rsp + 0xb0]
mov dword [rsp + 0x20], ebx
add r9, rbx
lea rdx, [rsp + 0x70]
mov r8d, r12d
mov ecx, r15d
call fcn.140003858
mov esi, eax
test eax, eax
je 0x140003bdd
lea ecx, [rbx + rbx]
cmp dword [rsp + 0x190], ecx
lea rdx, [rsp + 0xb0]
cmovb ecx, dword [rsp + 0x190]
mov r8d, ecx
mov rcx, rbp
call fcn.1400c5890
lea r11, [rsp + 0x150]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140003cc8
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
mov dword [rbp - 0x28], ecx
mov r14, r9
mov qword [rbp - 0x20], rbx
mov edi, r8d
mov dword [rbp - 0x18], ebx
mov rsi, rdx
mov qword [rbp - 0x10], rbx
lea r9d, [rbx + 0x18]
mov dword [rbp - 8], ebx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140003e39
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rbx
mov r9d, edi
mov qword [rsp + 0x28], rax
mov r8, rsi
mov edx, 0x6602
mov dword [rsp + 0x20], 0x100
call fcn.1400039f0
test eax, eax
je 0x140003e2d
mov r8, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140003e23
mov rcx, qword [rbp - 0x40]
lea r8, [rbp - 0x28]
xor r9d, r9d
lea edx, [rbx + 5]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x140003e19
mov r8d, dword [rbp + 0x40]
xor r9d, r9d
mov rcx, qword [rbp - 0x40]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140003e19
mov rcx, qword [rbp - 0x40]
lea esi, [rbx + 2]
mov edx, esi
mov dword [rsp + 0x20], ebx
lea r9, [rbp + 0x20]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140003e19
mov edx, dword [rbp + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140003e19
mov rcx, qword [rbp - 0x40]
lea r9, [rbp + 0x20]
mov r8, rax
mov dword [rsp + 0x20], ebx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rbp + 0x50]
mov rdx, rdi
cmp dword [rbp + 0x20], ecx
mov ebx, eax
cmovb ecx, dword [rbp + 0x20]
mov r8d, ecx
mov rcx, qword [rbp + 0x48]
call fcn.1400c5890
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret