joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180021650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov ebx, edx
mov r10, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x20]
mov esi, dword [r8 + 0x1c]
add rdi, rcx
mov ebp, dword [r8 + 0x24]
add rsi, rcx
mov r11d, dword [r8 + 0x18]
add rbp, rcx
test r11, r11
je 0x1800216dd
nop dword [rax]
mov r8d, dword [rdi + r9*4]
xor edx, edx
add r8, r10
movzx eax, byte [r8]
test al, al
je 0x1800216d1
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x1800216bb
add al, 0x20
movsx ecx, al
inc r8
xor edx, ecx
rol edx, 0x13
add edx, 3
movzx eax, byte [r8]
test al, al
jne 0x1800216b1
cmp edx, ebx
je 0x1800216f4
inc r9
cmp r9, r11
jb 0x1800216a0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r10
jmp 0x1800216df
Function at 0x1800247e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x40
xor r14d, r14d
mov rax, rdx
mov rsi, rcx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov edx, 0x120089
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
mov rcx, rax
mov ebx, r14d
call qword [rsi + 0x120]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1800248b6
mov edx, 0x186a0
mov qword [rsp + 0x68], rdi
lea ecx, [r14 + 0x40]
mov dword [rsp + 0x60], r14d
call qword [rsi + 0x20]
mov rdi, rax
nop word [rax + rax]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], r14
mov r8d, 0x186a0
mov rdx, rdi
mov rcx, rbp
call qword [rsi + 0x128]
mov r8d, dword [rsp + 0x60]
test r8d, r8d
je 0x180024894
mov rcx, rdi
mov edx, r8d
nop dword [rax]
movsx eax, byte [rcx]
lea rcx, [rcx + 1]
xor ebx, eax
rol ebx, 0xd
inc ebx
sub rdx, 1
jne 0x180024880
cmp r8d, 0x186a0
jae 0x180024850
test rdi, rdi
je 0x1800248a8
mov rcx, rdi
call qword [rsi + 0x38]
mov rcx, rbp
call qword [rsi + 0xc8]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
Function at 0x180024aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov edx, 0x64
mov rax, rcx
lea ecx, [rdx - 0x24]
call qword [rax + 0x20]
mov rbx, rax
mov r8, rax
mov dword [rax], 0xe0438724
mov dword [rax + 4], 0xe0438724
mov dword [rax + 8], 0xe0438724
mov dword [rax + 0xc], 0xe0438724
mov dword [rax + 0x10], 0xe0438724
mov dword [rax + 0x14], 0xe0438724
mov dword [rax + 0x18], 0xe0438724
mov dword [rax + 0x1c], 0xe0438724
mov dword [rax + 0x20], 0xe0438724
mov dword [rax + 0x24], 0xe0438724
mov dword [rax + 0x28], 0xe0438724
mov dword [rax + 0x2c], 0xe0438724
mov dword [rax + 0x30], 0xe0438724
mov dword [rax + 0x34], 0xe0438724
mov dword [rax + 0x38], 0xe0438724
mov dword [rax + 0x3c], 0xe0438724
mov byte [rax + 0x40], 0xff
cmp byte [rax], 0xff
je 0x180024b67
movzx ecx, byte [r8]
call fcn.1800047e0
mov byte [r8], al
inc r8
cmp byte [r8], 0xff
jne 0x180024b52
mov r9, qword [rsp + 0xd8]
mov byte [r8], 0
mov r8, qword [rsp + 0xd8]
movzx eax, byte [r9 + 0xf]
movzx ecx, byte [r9 + 0xe]
movzx edx, byte [r9 + 0xd]
movzx edi, byte [r9 + 0xa]
movzx r10d, byte [r9 + 0xc]
movzx r11d, byte [r9 + 0xb]
movzx esi, byte [r9 + 9]
movzx ebp, byte [r9 + 8]
movzx r14d, byte [r9 + 7]
movzx r15d, byte [r9 + 6]
movzx r12d, byte [r9 + 5]
movzx r13d, byte [r9 + 4]
movzx r9d, byte [r9 + 1]
movzx r8d, byte [r8]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x80], ecx
mov rcx, qword [rsp + 0xd8]
mov dword [rsp + 0x78], edx
mov rdx, rbx
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
movzx eax, byte [rcx + 3]
mov dword [rsp + 0x60], edi
mov rdi, qword [rsp + 0xd0]
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
movzx eax, byte [rcx + 2]
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x20], eax
call qword [rdi + 0x4b8]
mov rcx, rbx
mov rax, qword [rdi + 0x38]
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp rax
Function at 0x18008f6e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x18008f70d
xor al, al
jmp 0x18008f86f
mov rax, qword [0x1800b06c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1800b06c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1800b06d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1800b06d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1800b06e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1800b06e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1800b06f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1800b06f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1800b0700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x18008f861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x18008f7b9
mov r11d, 2
jmp 0x18008f7dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x18008f7d3
mov r11d, 1
jmp 0x18008f7dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x18008f885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x18008f822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x18008f83a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x18008f84a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x18008f858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x18008f7a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x18008f86a
Function at 0x1803afd52
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edx
jmp 0x18042f282
push r11
movzx r11, sp
mov r11b, cl
push rdi
movzx r11d, r14w
movsx r11w, sil
xchg r11, r11
push rsi
push r13
xchg di, di
pushfq
add r11b, 0x32
shr dil, 0x21
push rcx
push r9
xadd r11d, r11d
push r10
shl r11, cl
shrd r11d, ecx, 0x9f
or r11d, r15d
push r14
push rbx
sal dil, cl
push r12
movzx r10d, r14w
push rdx
shl r11b, cl
shr di, cl
cwd
push r8
cmp r11, 0x609c2f9c
movzx rbx, r9w
shl r8, 0x6d
push r15
sub r8d, r14d
bts dx, r15w
push rbp
push rax
and eax, ecx
btc bp, r12w
movabs rbp, 0
sbb r11d, 0x63e61cfe
rdtsc
ror r10b, 0xb7
push rbp
lahf
mov r11, qword [rsp + 0x90]
movsx eax, r13w
sub r11d, 0x20993ccd
rol r11d, 2
bswap r11d
rdtsc
not r11d
sal r10b, 0x12
lea r11, [r11 + rbp]
rcr r8b, cl
movsx r8d, bx
movzx r8d, bx
movabs rax, 0x100000000
lea r11, [r11 + rax]
cmp r15b, 0
mov r8, rsp
add dil, bl
sub rsp, 0x180
sal r10, 0x5e
sbb bx, 0x3d1f
and rsp, 0xfffffffffffffff0
movsxd r10, eax
stc
movzx rdi, r10w
mov r10, r11
sal di, 0x4e
movsx rdi, dx
movabs rdi, 0
cmp spl, 0x44
sub r10, rdi
cdq
shr rbx, cl
lea rbx, [0x1803afe66]
movsx rdx, sp
mov edx, dword [r11]
add r11, 4
stc
clc
xor edx, r10d
bswap edx
add edx, 0x699c1ece
bswap edx
cmp r11w, bp
cmc
jmp 0x1803a4899
inc edx
push r10
xor dword [rsp], edx
pop r10
cmp di, r13w
stc
movsxd rdx, edx
cmp dl, 0x6e
test r9d, r15d
stc
add rbx, rdx
jmp rbx

Function at 0x180a9013b
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc edx
push r10
xor dword [rsp], edx
pop r10
cmp di, r13w
stc
movsxd rdx, edx
cmp dl, 0x6e
test r9d, r15d
stc
add rbx, rdx
jmp rbx
neg edx
jmp 0x1809b0aa4
push r11
movzx r11, sp
mov r11b, cl
push rdi
movzx r11d, r14w
movsx r11w, sil
xchg r11, r11
push rsi
push r13
xchg di, di
pushfq
add r11b, 0x32
shr dil, 0x21
push rcx
push r9
xadd r11d, r11d
push r10
shl r11, cl
shrd r11d, ecx, 0x9f
or r11d, r15d
push r14
push rbx
sal dil, cl
push r12
movzx r10d, r14w
push rdx
shl r11b, cl
shr di, cl
cwd
push r8
cmp r11, 0x609c2f9c
movzx rbx, r9w
shl r8, 0x6d
push r15
sub r8d, r14d
bts dx, r15w
push rbp
push rax
and eax, ecx
btc bp, r12w
movabs rbp, 0
sbb r11d, 0x63e61cfe
rdtsc
ror r10b, 0xb7
push rbp
lahf
mov r11, qword [rsp + 0x90]
movsx eax, r13w
sub r11d, 0x20993ccd
rol r11d, 2
bswap r11d
rdtsc
not r11d
sal r10b, 0x12
lea r11, [r11 + rbp]
rcr r8b, cl
movsx r8d, bx
movzx r8d, bx
movabs rax, 0x100000000
lea r11, [r11 + rax]
cmp r15b, 0
mov r8, rsp
add dil, bl
sub rsp, 0x180
sal r10, 0x5e
sbb bx, 0x3d1f
and rsp, 0xfffffffffffffff0
movsxd r10, eax
stc
movzx rdi, r10w
mov r10, r11
sal di, 0x4e
movsx rdi, dx
movabs rdi, 0
cmp spl, 0x44
sub r10, rdi
cdq
shr rbx, cl
lea rbx, [0x180a9024f]
movsx rdx, sp
mov edx, dword [r11]
add r11, 4
stc
clc
xor edx, r10d
bswap edx
add edx, 0x699c1ece
bswap edx
cmp r11w, bp
cmc
jmp 0x180a507b3
Function at 0x265030
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
je 0x265040
jne 0x265040
sub rsp, 0x28
mov rax, qword [rdx]
cmp dword [rax + 0x8c], 0
je 0x2650eb
mov rsi, qword [rdx + 8]
mov edi, dword [rax + 0x88]
cmp dword [rdi + rsi + 0x18], 0
je 0x265088
jne 0x265088
je 0x491a51b6
add r12, rsi
add rbx, rsi
je 0x2650eb
cmp dword [rsi + rdi + 0x14], 0
je 0x2650eb
mov r15, r8
mov r13, rcx
mov ebx, dword [rsi + rdi + 0x20]
mov r12d, dword [rsi + rdi + 0x24]
je 0x265069
jne 0x265069
je 0x74e9afeb
and eax, 0x44e92375
mov esi, dword [rcx + rax]
Function at 0x272790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x2727c0
mov eax, dword [rax + 0x20]
mov dword [rdi + 0x38], eax
mov rcx, rbx
mov rdx, rsi
call r15
mov rcx, rdi
jmp 0x272870
xor r14d, r14d
xor edx, edx
jmp 0x2728ff
mov rax, qword [rcx]
jmp 0x27280b
push r15
je 0x2728f6
jne 0x2728f6
add byte [rax], al
add byte [rax], al
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
jmp 0x2728de
mov rcx, rbp
jmp 0x2728b1
mov r15, qword [sym.imp.itmkl_beo_UteNpt2HgazewrUmZvtjloS]
je 0x2727d2
jne 0x2727d2
jmp 0xffffffffff28b34d
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x272796
call qword [rax + 8]
je 0x272914
jne 0x272914
jmp 0x27d508
jmp 0x2728cc
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
je 0x27287d
jne 0x27287d
por mm3, qword [rdx - 0x17]
je 0x2727ed
jne 0x2727ed
je 0xffffffff8436d62d
jmp 0x272821
sub rsp, 0x28
mov rdi, rcx
je 0x27290b
jmp 0x272932
push rdi
push rbp
push rbx
jmp 0x272845
je 0x272920
mov rax, qword [rcx]
jmp 0x2727ad
call fcn.00273060
jmp 0x27295e
jmp 0xdfac90
je 0x27293b
je 0x27294f
jne 0x27294f
je 0xffffffff8dab3819
je 0x272925
add byte [rax], al
add byte [rax - 0x75], cl
outsd dx, dword [rsi]
adc byte [rdi], cl
test ch, cl
add byte [rax], al
add byte [rdi], cl
test edi, eax
add byte [rax], al
add byte [rax - 0x7b], cl
leave
mov rbp, qword [rdi + 0x10]
je 0x27296f
jne 0x27296f
test rcx, rcx
jmp 0x27285e
call qword [rax + 0x18]
lea edx, [rax + 1]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
jmp 0x2727bb
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [rax + 0x30]
test rax, rax
je 0x27293b
mov rcx, qword [rdi + 0x10]
je 0x272801
jne 0x272801
push r14
push rsi
jmp 0x272857
je 0x272842
jne 0x272842
mov rcx, qword [rcx + 0x10]
je 0x2728a8
jne 0x2728a8
jmp 0x112e99d
test eax, eax
jmp 0x272918
jne 0x2727e0
jmp 0x27293b
xor r14d, r14d
jmp 0x27293b
je 0x272935
jne 0x272935
jmp 0x27287c
jne 0x27290b
jmp 0x28e77a
mov r14d, 1
mov eax, r14d
jmp 0x272942
je 0x27281b
jne 0x27281b
jmp 0x3886b69b
lea rbx, [rdi + 0x38]
lea rsi, [rdi + 0x3c]
jmp 0x2727f5
cmp eax, 1
je 0x272892
jne 0x272892
je 0x6cb4bb
mov rax, qword [rbp]
jmp 0x272838
invalid
add al, ah
dec dword [rbp + 0x29]
imul r9, rbx, 0xa2c13
Function at 0x288de0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x0029fbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret
Function at 0x28ee90
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x28ef1b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
mov eax, 1
ret
Function at 0x28f940
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0028f6b0
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0028c300
mov rcx, rdi
mov rdx, rbx
call fcn.0028c280
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x28f9a0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x28], rcx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rsp + rax + 0x30], cl
add rax, 1
cmp rax, 0x20
jne 0x28f9c0
and byte [rsp + 0x30], 0xf8
mov al, byte [rsp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x4f], al
lea rbp, [rsp + 0x140]
mov rcx, rbp
call fcn.00289700
lea rbx, [rsp + 0x170]
mov rcx, rbx
call fcn.00289390
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.002893b0
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0028b630
mov rcx, rbx
mov rdx, rbx
call fcn.00289990
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.0028a130
lea rcx, [rsp + 0x80]
call fcn.00289390
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.00289370
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.002896e0
lea r14, [rsp + 0xe0]
mov rcx, r14
call fcn.00289390
mov r13d, 0xfe
xor r15d, r15d
nop word cs:[rax + rax]
nop
mov ebp, r15d
mov eax, r13d
shr rax, 3
movzx r15d, byte [rsp + rax + 0x30]
mov ecx, r13d
and cl, 7
shr r15d, cl
and r15d, 1
xor ebp, r15d
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea r12, [rsp + 0x50]
mov rdx, r12
mov r8d, ebp
call fcn.00289540
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.00289540
lea rbp, [rsp + 0xb0]
mov rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.0028b630
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.0028b630
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.002893b0
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.002893b0
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.0028a130
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
call fcn.0028a130
mov rcx, rbp
mov rdx, rbx
call fcn.00289c20
mov rcx, rbx
mov rdx, rsi
call fcn.00289c20
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.002893b0
mov rcx, rdi
mov rdx, r14
mov r8, rdi
call fcn.0028b630
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
call fcn.0028a130
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0028b630
mov rcx, rdi
mov rdx, rdi
call fcn.00289c20
mov rcx, r14
mov rdx, rbx
call fcn.0028ac70
mov rcx, r12
mov rdx, r12
call fcn.00289c20
mov rcx, rbp
mov rdx, rbp
mov r8, r14
call fcn.002893b0
mov rcx, r14
lea rdx, [rsp + 0x140]
mov r8, rdi
call fcn.0028a130
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.0028a130
add r13d, 0xffffffff
cmp r13d, 0xffffffff
jne 0x28fa90
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, r15d
call fcn.00289540
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
mov r8d, r15d
call fcn.00289540
mov rcx, rdi
mov rdx, rdi
call fcn.00289990
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.0028a130
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.0028a9a0
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400010d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [r11 - 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov dword [rsp + 0x78], 1
xor edi, edi
mov dword [rsp + 0x60], edi
lea rax, [r11 + 8]
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rdi
lea r9, [r11 + 0x20]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000118d
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000118d
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1400011c0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
test eax, eax
jne 0x140001176
mov rdx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1498]
mov edi, 1
jmp 0x14000117d
call qword [sym.imp.mfc120u.dll_Ordinal_4138]
nop
test rbx, rbx
je 0x140001196
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_266]
jmp 0x140001196
mov rcx, rsi
call qword [sym.imp.mfc120u.dll_Ordinal_4138]
mov eax, edi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140001660
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
movsxd rdi, r8d
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x28], rcx
xor r14d, r14d
mov dword [rbp - 0x38], r14d
movzx edx, byte [rdx]
mov ecx, 1
mov eax, ecx
cmp rcx, rdi
jge 0x1400016cd
nop word [rax + rax]
cmp byte [rax + rbx], dl
jne 0x1400016c1
inc ecx
inc rax
cmp rax, rdi
jl 0x1400016b0
jmp 0x1400016cd
movsxd rcx, ecx
movzx eax, byte [rcx + rbx]
mov byte [rbx], al
mov byte [rcx + rbx], dl
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14000174a
mov dword [rsp + 0x20], 8
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Nitro5Container
lea rcx, [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14000174a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x8009000f
jne 0x140001769
mov dword [rsp + 0x20], r14d
mov r9d, 1
xor r8d, r8d
lea rdx, str.Nitro5Container
lea rcx, [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001769
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
nop
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov byte [rbp - 0x20], 0
xor eax, eax
mov qword [rbp - 0x1f], rax
mov dword [rbp - 0x17], eax
mov word [rbp - 0x13], ax
mov byte [rbp - 0x11], al
mov dword [rbp - 0x50], 0x10
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x20]
lea edx, [rax + 2]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edi, dword [rbp - 0x50]
or ecx, 0xffffffff
test eax, eax
cmove edi, ecx
mov rcx, rsi
call qword [sym.imp.mfc120u.dll_Ordinal_296]
mov dword [rbp - 0x38], 1
test edi, edi
je 0x140001810
lea rbx, [rbp - 0x20]
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rbx]
lea r8, [0x14001096c]
mov edx, 3
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCR120.dll_swprintf_s]
lea rdx, [rbp - 0x10]
mov rcx, rsi
call qword [sym.imp.mfc120u.dll_Ordinal_2373]
lea rbx, [rbx + 1]
dec rdi
jne 0x1400017e0
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140001823
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rbp - 0x40], r14
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140001834
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000cf10
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400018c0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r14, rcx
xor eax, eax
mov dword [rsp + 0x40], eax
mov dword [r11 + 0x10], eax
mov ebp, 0x20
mov dword [r11 + 0x18], eax
mov ebx, ebp
mov dword [r11 + 0x20], 0x100
mov ecx, 0x200
call qword [sym.imp.MSVCR120.dll_malloc]
mov r15, rax
test rax, rax
jne 0x140001922
lea rdx, [0x140010974]
mov rcx, r14
call qword [sym.imp.mfc120u.dll_Ordinal_286]
jmp 0x140001abf
lea rdx, [rsp + 0xa8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, rbp
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14000190d
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
lea ecx, [rax + 0x40]
call qword [sym.imp.MSVCR120.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000190d
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rax
nop word [rax + rax]
mov dword [rsp + 0x98], ebp
mov dword [rsp + 0xa0], ebx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x98]
mov r8, rdi
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1400019e5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x140001a74
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140001a74
cmp dword [rsp + 0x98], ebp
jbe 0x140001a2f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_265]
mov rdi, rax
mov r8d, dword [rsp + 0x98]
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov ebp, dword [rsp + 0x98]
cmp dword [rsp + 0xa0], ebx
jbe 0x140001990
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_free]
mov ebx, dword [rsp + 0xa0]
add rbx, rbx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rsi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov ebx, dword [rsp + 0xa0]
jmp 0x140001990
mov r8d, dword [rsp + 0x98]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140001660
nop
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, r15
call qword [sym.imp.MSVCR120.dll_free]
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.mfc120u.dll_Ordinal_280]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
mov rax, r14
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret