joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000dd18
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbp, rcx
xor ebx, ebx
lea r8d, [rbx + 4]
lea rdx, str.SamSs
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x18000dd77
lea rax, [rsp + 0x50]
lea r9d, [rbx + 0x24]
mov r8, rbp
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18000dd98
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
lea rdx, str.ServicesActive
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x18000de05
lea r8d, [rbx + 0x20]
lea rdx, str.mimidrv
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x18000ddfc
lea r8, [rsp + 0x20]
lea edx, [rbx + 1]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18000df7c
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rbp, rcx
xor edi, edi
lea rdx, str.ServicesActive
lea r8d, [rdi + 3]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18000e099
lea r8d, [rdi + 0x10]
lea rdx, str.mimidrv
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x18000e057
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x18000e045
and qword [rsp + 0x60], rdi
and qword [rsp + 0x58], rdi
and qword [rsp + 0x50], rdi
and qword [rsp + 0x48], rdi
and qword [rsp + 0x40], rdi
lea eax, [rdi + 1]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], eax
lea r8, str.mimikatz_driver__mimidrv_
lea rdx, str.mimidrv
mov r9d, 0x60010
mov rcx, rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
je 0x18000e045
mov rcx, rax
call fcn.18000de18
mov edi, eax
test eax, eax
jne 0x18000e052
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180004a6c
test rbx, rbx
je 0x18000e08e
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, eax
test eax, eax
jne 0x18000e085
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x18000e085
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180004a6c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18000e0a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180004a6c
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18000ebe4
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rdx]
mov ebp, ecx
mov ebx, 0xc0000004
test rdx, rdx
je 0x18000ec1b
lea r9, [rax + 0x10]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
jmp 0x18000ec61
mov edi, 0x1000
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x18000ec61
lea r9, [rsp + 0x38]
mov r8d, edi
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x18000ec57
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
add edi, edi
cmp ebx, 0xc0000004
je 0x18000ec20
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000f70c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xd0
mov rsi, rcx
mov r12, r8
mov r13, rdx
xor ebp, ebp
lea rcx, [rsp + 0x60]
xor edx, edx
lea ebx, [rbp + 0x68]
mov rdi, r9
mov r8d, ebx
call fcn.1800212f0
mov dword [rsp + 0x60], ebx
test rdi, rdi
je 0x18000f755
mov rbx, rdi
jmp 0x18000f766
mov edx, Ordinal_27
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rbx, rbx
je 0x18000f7f7
mov rcx, rsi
call fcn.18002971c
mov rsi, rax
test rax, rax
je 0x18000f7f7
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
lea r8, [0x18003a2e8]
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], Ordinal_27
mov r9d, 2
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov ebp, eax
test eax, eax
je 0x18000f7e1
test rdi, rdi
jne 0x18000f7ef
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
jne 0x18000f7ef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call fcn.180021a08
lea r11, [rsp + 0xd0]
mov eax, ebp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000fabc
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [r9]
xor ebx, ebx
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov dword [rax], ecx
test ecx, ecx
je 0x18000fc07
dec ecx
jne 0x18000fbfc
lea edx, [rbx + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r11, rax
mov rax, qword [rdi]
mov qword [rax + 8], r11
mov rax, qword [rdi]
cmp qword [rax + 8], rbx
je 0x18000fbfc
mov eax, esi
mov rcx, rbp
mov qword [rsp + 0x28], rbx
neg eax
mov dword [rsp + 0x20], ebx
sbb r8d, r8d
xor r9d, r9d
xor edx, edx
and r8d, 2
add r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r11, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx], r11
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
cmp qword [rcx], rbx
je 0x18000fbfc
mov rcx, qword [rcx]
neg esi
mov qword [rsp + 0x20], rbx
sbb edx, edx
xor r9d, r9d
xor r8d, r8d
and edx, 0xfffffffe
add edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 8], r11
mov rax, qword [rdi]
mov rdx, qword [rax + 8]
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x18000fbfc
cmp dword [rcx], 0x66676572
jne 0x18000fbe2
cmp dword [rcx + 0x1c], ebx
jne 0x18000fbe2
add rcx, 0x1000
cmp dword [rcx], 0x6e696268
jne 0x18000fbe2
mov qword [rdx + 0x10], rcx
movsxd rax, dword [rcx + 4]
lea rdx, [rax + rcx + 0x20]
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 0x18], rdx
mov rax, qword [rdi]
mov ecx, 0x6b6e
mov rdx, qword [rax + 8]
mov rax, qword [rdx + 0x18]
cmp word [rax + 4], cx
jne 0x18000fbe2
test byte [rax + 6], 0xc
jne 0x18000fc07
mov rcx, qword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov r11, qword [rdi]
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000fc0c
mov ebx, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800101f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov r10d, dword [rcx]
xor edi, edi
mov r12, r9
mov r11, r8
mov rbx, rdx
mov rbp, rcx
test r10d, r10d
je 0x180010295
dec r10d
jne 0x1800102c8
call fcn.1800100ac
test rax, rax
setne dil
test edi, edi
je 0x1800102c8
mov ebx, dword [rax + 8]
mov rsi, qword [rsp + 0x60]
btr ebx, 0x1f
test rsi, rsi
je 0x1800102c8
test r12, r12
je 0x180010291
xor edi, edi
cmp dword [rsi], ebx
setae dil
test edi, edi
je 0x180010291
test dword [rax + 8], 0x80000000
je 0x180010275
lea rdx, [rax + 0xc]
jmp 0x180010286
movsxd rdx, dword [rax + 0xc]
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x10]
lea rdx, [rdx + rcx + 4]
mov r8d, ebx
mov rcx, r12
call fcn.180026930
mov dword [rsi], ebx
jmp 0x1800102c8
mov rax, qword [rsp + 0x60]
xor r8d, r8d
mov rdx, r11
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
test edi, edi
jne 0x1800102c8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x1800102e8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10d, dword [rcx]
xor ebx, ebx
mov ebp, r9d
mov r11, r8
mov rsi, rdx
mov rdi, rcx
test r10d, r10d
je 0x18001037f
dec r10d
jne 0x1800103b1
call fcn.1800100ac
test rax, rax
je 0x1800103b1
mov ecx, dword [rax + 8]
mov r8d, ecx
btr r8d, 0x1f
cmp r8d, dword [rsp + 0x68]
setae bl
test ebx, ebx
je 0x180010378
mov edx, 0x80000000
mov dword [rax + 0x10], ebp
and ecx, edx
or ecx, dword [rsp + 0x68]
mov dword [rax + 8], ecx
test edx, ecx
je 0x18001035b
lea rcx, [rax + 0xc]
jmp 0x18001036c
movsxd rdx, dword [rax + 0xc]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x10]
lea rcx, [rdx + rcx + 4]
mov rdx, qword [rsp + 0x60]
call fcn.180026930
jmp 0x1800103b1
mov ecx, Ordinal_54
jmp 0x1800103ab
mov eax, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, r11
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x1800103b1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800103c8
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r10d, dword [rcx]
xor r14d, r14d
mov r12, r9
mov r11d, r8d
mov rbp, rdx
mov edi, r14d
test r10d, r10d
je 0x180010500
dec r10d
jne 0x18001053d
cmp dword [rdx + 0x18], r14d
je 0x18001053d
cmp r11d, dword [rdx + 0x18]
jae 0x18001053d
cmp dword [rdx + 0x20], 0xffffffff
je 0x18001053d
mov rax, qword [rcx + 8]
movsxd rcx, dword [rdx + 0x20]
mov r8, qword [rax + 0x10]
add rcx, r8
movzx eax, word [rcx + 4]
cmp eax, 0x666c
je 0x18001044c
cmp eax, 0x686c
jne 0x18001053d
cmp word [rcx + 6], r14w
je 0x18001053d
movzx eax, word [rcx + 6]
cmp r11d, eax
jae 0x18001053d
movsxd rdx, dword [rcx + r11*8 + 8]
mov eax, 0x6b6e
add rdx, r8
cmp word [rdx + 4], ax
jne 0x18001053d
test r9, r9
je 0x18001053d
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x18001053d
test byte [rdx + 6], 0x20
je 0x1800104d6
movzx ebx, word [rdx + 0x4c]
cmp dword [rsi], ebx
seta dil
test edi, edi
je 0x1800104fc
lea rcx, [rdx + 0x50]
mov edx, ebx
call fcn.18000e398
mov rbp, rax
test rax, rax
je 0x1800104f7
lea r8, [rbx + rbx]
mov rdx, rax
mov rcx, r12
call fcn.180026930
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800104f7
movzx ebx, word [rdx + 0x4c]
shr ebx, 1
cmp dword [rsi], ebx
seta dil
test edi, edi
je 0x1800104fc
movzx r8d, word [rbp + 0x4c]
add rdx, 0x50
mov rcx, r9
call fcn.180026930
mov word [r12 + rbx*2], r14w
mov dword [rsi], ebx
jmp 0x18001053d
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov r8, r12
mov edx, r11d
mov rcx, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete dil
test edi, edi
jne 0x18001053d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x180010560
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r10, rdx
mov edx, dword [rcx]
mov r14, r9
mov r11d, r8d
mov r13, rcx
mov edi, r15d
test edx, edx
je 0x18001072e
dec edx
jne 0x180010783
test r10, r10
jne 0x1800105ad
mov rax, qword [rcx + 8]
mov r10, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [r10 + 4], ax
jne 0x180010783
cmp dword [r10 + 0x28], r15d
je 0x180010783
cmp r11d, dword [r10 + 0x28]
jae 0x180010783
cmp dword [r10 + 0x2c], 0xffffffff
je 0x180010783
mov rax, qword [rcx + 8]
mov r8, qword [rax + 0x10]
movsxd rax, dword [r10 + 0x2c]
lea rcx, [r8 + rax]
mov eax, 0x6b76
movsxd rbx, dword [rcx + r11*4 + 4]
add rbx, r8
cmp word [rbx + 4], ax
jne 0x180010783
test r9, r9
je 0x180010783
mov rsi, qword [rsp + 0x90]
test rsi, rsi
je 0x180010783
cmp word [rbx + 6], r15w
je 0x1800106b1
test byte [rbx + 0x14], 1
movzx edx, word [rbx + 6]
je 0x180010644
lea rcx, [rbx + 0x18]
lea r12d, [rdx + 1]
call fcn.18000e398
mov rbp, rax
jmp 0x180010679
mov r12d, edx
mov ecx, 0x40
add rdx, 2
shr r12d, 1
inc r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x180010783
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.180026930
test rbp, rbp
je 0x180010783
cmp dword [rsi], r12d
setae dil
test edi, edi
je 0x1800106a6
mov r8d, r12d
mov rdx, rbp
mov rcx, r14
add r8, r8
call fcn.180026930
lea r11d, [r12 - 1]
mov dword [rsi], r11d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800106b4
mov dword [rsi], r15d
test edi, edi
je 0x180010783
mov esi, dword [rbx + 8]
mov rcx, qword [rsp + 0x98]
btr esi, 0x1f
test rcx, rcx
je 0x1800106d5
mov eax, dword [rbx + 0x10]
mov dword [rcx], eax
mov rbp, qword [rsp + 0xa8]
test rbp, rbp
je 0x180010783
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x180010729
cmp dword [rbp], esi
mov edi, r15d
setae dil
test edi, edi
je 0x180010729
test dword [rbx + 8], 0x80000000
je 0x180010710
lea rdx, [rbx + 0xc]
jmp 0x180010721
mov rax, qword [r13 + 8]
movsxd r8, dword [rbx + 0xc]
mov rdx, qword [rax + 0x10]
lea rdx, [r8 + rdx + 4]
mov r8d, esi
call fcn.180026930
mov dword [rbp], esi
jmp 0x180010783
mov rax, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x90]
mov r8, r14
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov edx, r11d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov rcx, r10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
sete dil
test edi, edi
jne 0x180010783
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18001097c
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov r13, r9
mov esi, r8d
mov r12, rdx
mov edi, ecx
cmp ecx, 0x8000
jne 0x180010a15
cmp dword [rbp + 0x40], 4
jne 0x180010af7
lea rdx, [rbp - 0x20]
mov ecx, 0xffffff7c
call qword [sym.imp.cryptdll.dll_CDLocateCheckSum]
test eax, eax
js 0x180010af7
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [rax + 0x10]
test eax, eax
js 0x180010af7
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x10]
mov r8, r12
mov edx, esi
call qword [rax + 0x18]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x10]
mov rdx, r13
call qword [rax + 0x20]
lea rcx, [rbp - 0x10]
test eax, eax
mov rax, qword [rbp - 0x20]
setns bl
call qword [rax + Ordinal_41]
jmp 0x180010af7
lea rcx, [rbp - 8]
mov r9d, Ordinal_27
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180010af7
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180010aeb
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8d, esi
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180010ae1
mov rcx, qword [rbp - 0x18]
xor r8d, r8d
lea r9, [rbp + 0x20]
lea esi, [r8 + 2]
mov dword [rsp + 0x20], ebx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180010ae1
mov edx, dword [rbp + 0x20]
lea ecx, [rsi + 0x3e]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180010ae1
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x20]
mov r8, rax
mov edx, esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rbp + 0x40]
mov rdx, rdi
cmp dword [rbp + 0x20], ecx
mov ebx, eax
cmovb ecx, dword [rbp + 0x20]
mov r8d, ecx
mov rcx, r13
call fcn.180026930
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x180010bc4
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
mov r12, r9
mov dword [rbp - 0x28], ecx
mov edi, r8d
mov rsi, rdx
lea rcx, [rbp - 0x38]
lea r9d, [rbx + 0x18]
xor r8d, r8d
xor edx, edx
mov qword [rbp - 0x20], rbx
mov dword [rbp - 0x18], ebx
mov qword [rbp - 0x10], rbx
mov dword [rbp - 8], ebx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180010d2d
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov r9d, edi
mov qword [rsp + 0x28], rax
mov r8, rsi
mov edx, 0x6602
mov dword [rsp + 0x20], 0x100
call fcn.180010b14
test eax, eax
je 0x180010d21
mov r8, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180010d17
mov rcx, qword [rbp - 0x40]
lea r8, [rbp - 0x28]
lea edx, [rbx + 5]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x180010d0d
mov r8d, dword [rbp + 0x40]
mov rcx, qword [rbp - 0x40]
xor r9d, r9d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180010d0d
mov rcx, qword [rbp - 0x40]
lea esi, [rbx + 2]
lea r9, [rbp + 0x20]
mov edx, esi
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180010d0d
mov edx, dword [rbp + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180010d0d
mov rcx, qword [rbp - 0x40]
lea r9, [rbp + 0x20]
mov r8, rax
mov edx, esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rbp + 0x50]
mov rdx, rdi
cmp dword [rbp + 0x20], ecx
mov ebx, eax
cmovb ecx, dword [rbp + 0x20]
mov r8d, ecx
mov rcx, qword [rbp + 0x48]
call fcn.180026930
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x180010f74
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
mov rdi, r9
mov ebx, r8d
mov r13, rdx
mov rsi, rcx
cmp r8d, 0x10
jbe 0x18001111d
lea r9, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x180011144
lea edx, [r12 + 1]
xor r9d, r9d
mov r8, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x180011111
lea edi, [rbx + 0xf]
lea r14d, [r12 + 0x10]
shr edi, 4
and ebx, 0xf
cmovne r14d, ebx
cmp edi, 2
jbe 0x180011026
lea eax, [rdi - 2]
xor r9d, r9d
xor r8d, r8d
shl eax, 4
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x40], eax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x180011111
lea eax, [r14 + 0x10]
lea r15d, [rdi - 2]
lea rcx, [rbp - 0x28]
shl r15d, 4
mov r8d, eax
mov ebx, eax
add r15, r13
mov rdx, r15
call fcn.180026930
mov r11d, 0x10
lea rcx, [rbp + rbx - 0x28]
sub r11d, r14d
xor edx, edx
mov qword [rbp - 0x30], rcx
mov eax, r11d
mov r8d, r11d
mov qword [rbp - 0x38], rax
call fcn.1800212f0
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x40]
mov ebx, 0x10
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
mov dword [rbp + 0x40], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x180011111
lea rdx, [rbp - 0x28]
mov r9d, ebx
mov al, byte [rdx + 0x10]
xor byte [rdx], al
inc rdx
dec r9
jne 0x1800110a0
mov r8, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + r14 - 0x28]
mov ebx, r14d
call fcn.180026930
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x40], 0x10
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r12d, eax
test eax, eax
je 0x180011111
movups xmm0, xmmword [rbp - 0x18]
shl edi, 4
lea rdx, [rbp - 0x28]
lea ecx, [rdi - 0x10]
mov r8d, ebx
add rcx, r13
movdqu xmmword [r15], xmm0
call fcn.180026930
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x180011144
cmp ebx, 0x10
jne 0x180011144
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rbp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r12d, eax
lea r11, [rsp + 0x70]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret