joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013aa54
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
rdtsc
shl rdx, 0x20
or rax, rdx
cdqe
mov qword [0x1004c43a0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ebx, ebx
and eax, 0x80000000
lea rbp, [0x100000000]
mov dword [0x1004c4dd0], eax
cmp dword [0x1004c3558], ebx
jne 0x10013aab2
lea rcx, [0x1004c63c0]
call fcn.100075ab8
cmp eax, ebx
jl 0x10013aca1
mov dword [0x1004c3558], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rsp + 0x28]
mov r8d, 0x80000000
lea rcx, [0x100000000]
movsxd rdx, dword [0x10000003c]
mov edx, dword [rdx + rbp + 0x50]
add rdx, rcx
lea rax, [rdi + r8]
cmp rdx, rax
jb 0x10013aaed
lea rdi, [rdx - 0x80000000]
lea rdx, [rdi + 0xffff]
and rdx, 0xffffffffffff0000
mov rdi, qword [rsp + 0x30]
lea rax, [rdi - 0x80000000]
mov qword [0x1004c4308], rdx
cmp rcx, rax
jbe 0x10013ab1c
mov qword [0x1004c6150], rdi
jmp 0x10013ab26
add rcx, r8
mov qword [0x1004c6150], rcx
mov word [0x1004c6150], bx
mov rax, qword [0x1004c6150]
sub rax, rdx
shr rax, 0x10
mov qword [0x1004c4380], rax
mov eax, ebx
cmp eax, ebx
jl 0x10013aca1
mov rax, qword [0x1004c4328]
cmp rax, 1
jae 0x10013ab92
lea rax, [rax + rax*4]
lea rcx, [rbp + rax*8 + 0x4c3568]
call fcn.100075ab8
cmp eax, ebx
mov edx, eax
jl 0x10013ab8b
mov rax, qword [0x1004c4328]
inc rax
cmp rax, 1
mov qword [0x1004c4328], rax
jb 0x10013ab59
cmp edx, ebx
jge 0x10013ab92
mov eax, edx
jmp 0x10013aca1
mov eax, dword [0x1002a02b4]
cmp eax, ebx
je 0x10013ac2c
lea rsi, section..data
mov eax, dword [0x1002a02b4]
lea r9, [rsp + 0x78]
mov edx, dword [0x1002f8888]
mov r8d, 0x40
imul edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, ebx
jne 0x10013abee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov ecx, 0x54f
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
jmp 0x10013ac2e
mov eax, dword [0x1002a02b4]
mov r8, rbx
cmp eax, ebx
jbe 0x10013ac2c
mov edi, dword [0x1002f8888]
mov ecx, dword [0x1002f8888]
mov dword [rbp + r8*4 + 0x4c5a60], 0x3bd7
xor eax, eax
imul rdi, r8
add rdi, rsi
rep stosb byte [rdi], al
inc r8
mov eax, dword [0x1002a02b4]
cmp r8, rax
jb 0x10013abfb
mov ecx, ebx
cmp ecx, ebx
jge 0x10013ac36
mov eax, ecx
jmp 0x10013aca1
mov ecx, dword [0x1004c5db0]
cmp ecx, ebx
je 0x10013ac88
mov edx, dword [0x1004c5da8]
lea rdi, [0x1004c5dd8]
lea rax, [rdx + rbp + 0x4c5dd8]
mov qword [0x1004c5db8], rdi
mov qword [0x1004c5dc0], rax
mov eax, dword [0x1004c5dac]
add rdx, rax
lea rax, [rdx + rbp + 0x4c5dd8]
mov qword [0x1004c5dc8], rax
add rcx, rdx
add rcx, rdi
mov qword [0x1004c5dd0], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov eax, 0x2705d437
cmp dword [rsp + 0x70], ebx
cmovl ebx, dword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x10013cf34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10013cf81
cmp rcx, 0xffffffffffffffff
je 0x10013cf81
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10013cf79
cmp dword [rcx + 0x3c], edx
jl 0x10013cf79
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10013cf79
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10013cf81
mov rax, rdx
add rsp, 0x18
ret
Function at 0x10027280c
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x24], eax
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x10027d5f4
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1004c4740]
jne 0x10027d60f
rol rcx, 0x10
test cx, 0xffff
jne 0x10027d60b
ret 0
ror rcx, 0x10
jmp 0x1002a5b00
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1004c3950]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov r11, qword [0x1004c3a48]
mov qword [rsp + 0x58], r11
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1002a5b85
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], 0
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1004c3950]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x1002a5ba7
mov rax, qword [rsp + 0x88]
mov qword [0x1004c3a48], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1004c39e8], rax
xor ecx, ecx
mov rax, qword [0x1004c3a48]
mov qword [0x1004c5040], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1004c39d0], rax
mov dword [0x1004c5030], 0xc0000409
mov dword [0x1004c5034], 1
mov rax, qword [0x1004c4740]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1004a9508]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1002de468]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10032d054
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
and qword [rax + 0x10], 0
and qword [rax + 0x18], 0
mov rbp, rdx
mov r12, rcx
test rdx, rdx
jne 0x10032d086
mov ebx, 0x80070057
jmp 0x10032d175
call fcn.10032ceb4
mov ebx, eax
test eax, eax
jne 0x10032d153
lea r9d, [rax + 0x18]
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10032d122
lea rdi, [0x1000173b0]
lea ecx, [rbx + 0x27]
mov rsi, rbp
repe cmpsw word [rsi], word [rdi]
jne 0x10032d0ce
mov edx, 0x8004
jmp 0x10032d103
mov eax, 0x28
lea rdi, [0x100017360]
mov rsi, rbp
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032d0ec
mov edx, 0x800c
jmp 0x10032d103
lea rdi, [0x100017310]
mov rsi, rbp
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032d14e
mov edx, 0x800e
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x10032d138
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10032d153
mov rax, qword [rsp + 0x58]
mov qword [r12 + 0x10], rax
mov rax, qword [rsp + 0x60]
mov qword [r12 + 0x18], rax
jmp 0x10032d175
mov ebx, 0x80049e5b
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x10032d163
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x10032d175
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x10032d8b4
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r15, r9
mov r12, rcx
mov dword [rax + 0x10], ebx
mov rbp, rbx
cmp rdx, rbx
je 0x10032dac9
cmp r9, rbx
je 0x10032dac9
mov r13, qword [rsp + 0xb0]
cmp r13, rbx
je 0x10032dac9
cmp qword [rcx + 0x30], rbx
jne 0x10032d90f
mov ebx, 0x80049e51
jmp 0x10032dace
mov eax, dword [r13]
lea rdi, [0x100017210]
mov rsi, rdx
mov dword [rsp + 0x40], eax
mov eax, 0x2c
mov dword [r13], ebx
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032d93d
cmp dword [r12 + 0xc], 1
lea edi, [rax - 0x1c]
jmp 0x10032d97d
lea rdi, [0x1000171b0]
mov rsi, rdx
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032d95c
cmp dword [r12 + 0xc], 2
mov edi, 0x18
jmp 0x10032d97d
lea rdi, [0x100017150]
mov rsi, rdx
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032dac2
cmp dword [r12 + 0xc], 3
mov edi, 0x20
je 0x10032d989
mov ebx, 0x80049e2e
jmp 0x10032dace
mov rcx, qword [r12 + 0x30]
lea r14d, [rdi + r8]
xor r9d, r9d
lea rax, [rsp + 0x98]
mov dword [rsp + 0x30], r14d
lea r8d, [r9 + 1]
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x98], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
cmp eax, ebx
je 0x10032da8f
mov esi, dword [rsp + 0x98]
mov dword [r13], esi
cmp qword [rsp + 0xb8], rbx
je 0x10032dace
cmp dword [rsp + 0x40], esi
jae 0x10032d9f1
mov ebx, 0x80049e19
jmp 0x10032dace
mov rcx, rsi
mov dword [rsp + 0x98], r14d
call fcn.100058294
mov rbp, rax
cmp rax, rbx
jne 0x10032da13
mov ebx, 0x8007000e
jmp 0x10032dace
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0xa0]
mov r13d, edi
lea rcx, [r13 + rbp]
mov rdx, r15
call sub.msvcrt.dll_memcpy
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_time]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_srand]
cmp edi, ebx
jbe 0x10032da61
mov rdi, rbp
call qword [sym.imp.msvcrt.dll_rand]
mov byte [rdi], al
inc rdi
sub r13, 1
jne 0x10032da50
mov rcx, qword [r12 + 0x30]
xor r9d, r9d
lea rax, [rsp + 0x98]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
cmp eax, ebx
jne 0x10032daa8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
movzx eax, ax
or eax, 0x80070000
cmp edx, ebx
cmovle eax, edx
mov ebx, eax
jmp 0x10032dace
mov r8d, dword [rsp + 0x98]
mov rcx, qword [rsp + 0xb8]
mov rdx, rbp
call sub.msvcrt.dll_memcpy
jmp 0x10032dace
mov ebx, 0x80049e5b
jmp 0x10032dace
mov ebx, 0x80070057
mov rcx, rbp
call fcn.1000582b8
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10032daf0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r14, r9
mov r12, rcx
mov dword [rax + 0x10], ebx
mov rbp, rbx
cmp rdx, rbx
je 0x10032dc5e
cmp r9, rbx
je 0x10032dc5e
mov r13, qword [rsp + 0x80]
cmp r13, rbx
je 0x10032dc5e
cmp qword [rcx + 0x30], rbx
jne 0x10032db4d
mov ebx, 0x80049e51
jmp 0x10032dc63
mov r15d, dword [r13]
mov eax, 0x2c
lea rdi, [0x100017210]
mov rcx, rax
mov rsi, rdx
mov dword [r13], ebx
repe cmpsw word [rsi], word [rdi]
jne 0x10032db74
cmp dword [r12 + 0xc], 1
jmp 0x10032dbaa
lea rdi, [0x1000171b0]
mov rsi, rdx
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032db8e
cmp dword [r12 + 0xc], 2
jmp 0x10032dbaa
lea rdi, [0x100017150]
mov rsi, rdx
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032dc57
cmp dword [r12 + 0xc], 3
je 0x10032dbb6
mov ebx, 0x80049e2e
jmp 0x10032dc63
mov ecx, r8d
mov dword [rsp + 0x68], r8d
call fcn.100058294
mov rbp, rax
cmp rax, rbx
jne 0x10032dbd5
mov ebx, 0x8007000e
jmp 0x10032dc63
mov r8d, dword [rsp + 0x68]
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [r12 + 0x30]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
cmp eax, ebx
jne 0x10032dc25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
movzx eax, ax
or eax, 0x80070000
cmp edx, ebx
cmovle eax, edx
mov ebx, eax
jmp 0x10032dc63
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
add eax, 0xfffffff0
mov dword [r13], eax
cmp rcx, rbx
je 0x10032dc63
cmp r15d, eax
jae 0x10032dc49
mov ebx, 0x80049e19
jmp 0x10032dc63
lea rdx, [rbp + 0x10]
mov r8d, eax
call sub.msvcrt.dll_memcpy
jmp 0x10032dc63
mov ebx, 0x80049e5b
jmp 0x10032dc63
mov ebx, 0x80070057
mov rcx, rbp
call fcn.1000582b8
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10032e320
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r12, r8
mov r13d, edx
mov rdi, rcx
test r8, r8
je 0x10032e487
cmp edx, 0x14
jbe 0x10032e487
mov rcx, qword [rcx + 0x20]
call fcn.1000582b8
mov rcx, qword [rdi + 0x10]
and qword [rdi + 0x20], 0
call fcn.1000582b8
and qword [rdi + 0x10], 0
and dword [rdi + 0x18], 0
lea rbp, [rdi + 0x30]
mov rcx, qword [rbp]
test rcx, rcx
je 0x10032e38b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and qword [rbp], 0
mov ecx, dword [r12 + 0xc]
shr ecx, 3
mov dword [rdi + 0x28], ecx
mov eax, dword [r12 + 0x10]
mov dword [rdi + 0x2c], eax
mov eax, ecx
shr eax, 1
lea eax, [rax + rax*4 + 0x14]
lea ecx, [rax + rcx*2]
cmp r13d, ecx
jne 0x10032e487
mov rcx, qword [rdi + 0x20]
call fcn.1000582b8
mov ecx, dword [rdi + 0x28]
and qword [rdi + 0x20], 0
call fcn.100058294
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x10032e3db
mov ebx, 0x8007000e
jmp 0x10032e48c
mov r8d, dword [rdi + 0x28]
lea rdx, [r12 + 0x14]
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rdx, [rdi + 0x2c]
mov r8d, 4
mov rcx, rdi
call fcn.10032d5b8
mov ebx, eax
test eax, eax
jne 0x10032e48c
mov r8d, dword [rdi + 0x28]
mov rdx, qword [rdi + 0x20]
mov rcx, rdi
call fcn.10032d5b8
mov ebx, eax
test eax, eax
jne 0x10032e48c
cmp qword [rdi + 0x38], 0
jne 0x10032e444
lea r9d, [rax + 0x18]
lea rcx, [rdi + 0x38]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10032e468
mov rcx, qword [rdi + 0x38]
xor r9d, r9d
mov r8d, r13d
mov rdx, r12
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x10032e47e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10032e48c
mov dword [rdi + 0xc], 4
jmp 0x10032e48c
mov ebx, 0x80070057
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x10032f2e8
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov r13d, r9d
mov r14, r8
mov rsi, rdx
mov r12, rcx
mov ebx, r15d
mov rbp, r15
cmp rdx, r15
je 0x10032f519
cmp qword [rsp + 0x80], r15
je 0x10032f519
mov rcx, qword [rcx + 0x20]
call fcn.1000582b8
mov rcx, qword [r12 + 0x10]
mov qword [r12 + 0x20], r15
call fcn.1000582b8
lea rdi, [r12 + 0x30]
mov qword [r12 + 0x10], r15
mov rcx, qword [rdi]
mov dword [r12 + 0x18], r15d
mov qword [rsp + 0x68], rdi
cmp rcx, r15
je 0x10032f36d
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rdi], r15
xor edi, edi
cmp qword [r12 + 0x38], rdi
jne 0x10032f3ac
lea r9d, [rdi + 0x18]
lea rcx, [r12 + 0x38]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, edi
jne 0x10032f3ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
jmp 0x10032f50d
cmp r14, rdi
je 0x10032f417
mov rcx, qword [r12 + 0x10]
call fcn.1000582b8
or r8, 0xffffffffffffffff
xor eax, eax
mov qword [r12 + 0x10], rdi
mov rcx, r8
mov rdi, r14
repne scasw ax, word [rdi]
lea eax, [r8 + 3]
not rcx
dec rcx
mov dword [r12 + 0x18], ecx
inc ecx
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.100058294
xor edi, edi
mov rcx, rax
mov qword [r12 + 0x10], rax
cmp rax, rdi
je 0x10032f42b
mov edx, dword [r12 + 0x18]
mov r8, r14
inc edx
call fcn.100085754
mov ebx, eax
cmp eax, edi
jne 0x10032f51e
lea r14d, [r13 + 0xc]
mov ecx, r14d
call fcn.100058294
mov rbp, rax
cmp rax, rdi
jne 0x10032f435
mov ebx, 0x8007000e
jmp 0x10032f51e
mov byte [rax], 8
mov byte [rax + 1], 2
mov word [rax + 2], di
cmp r13d, 0x10
jne 0x10032f468
lea rdi, [0x100017210]
lea ecx, [r13 + 0x1c]
repe cmpsw word [rsi], word [rdi]
jne 0x10032f4a6
mov dword [rax + 4], 0x660e
mov dword [r12 + 0xc], 1
jmp 0x10032f4bd
cmp r13d, 0x18
jne 0x10032f490
lea rdi, [0x1000171b0]
lea ecx, [r13 + 0x14]
repe cmpsw word [rsi], word [rdi]
jne 0x10032f4a6
mov dword [rax + 4], 0x660f
mov dword [r12 + 0xc], 2
jmp 0x10032f4bd
cmp r13d, 0x20
jne 0x10032f512
lea rdi, [0x100017150]
lea ecx, [r13 + 0xc]
repe cmpsw word [rsi], word [rdi]
je 0x10032f4ad
mov ebx, 0x80049e2f
jmp 0x10032f51e
mov dword [rax + 4], 0x6610
mov dword [r12 + 0xc], 3
mov rdx, qword [rsp + 0x80]
lea rcx, [rax + 0xc]
mov r8, r13
mov dword [rax + 8], r13d
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x38]
mov qword [rsp + 0x28], rdx
and dword [rsp + 0x20], r15d
mov rdx, rbp
xor r9d, r9d
mov r8d, r14d
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x10032f51e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10032f51e
mov ebx, 0x80049e2e
jmp 0x10032f51e
mov ebx, 0x80070057
mov rcx, rbp
call fcn.1000582b8
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10032f548
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rsi, r8
mov r12, rdx
mov rbx, rcx
test rdx, rdx
je 0x10032f6de
test r8, r8
je 0x10032f6de
mov rcx, qword [rcx + 0x20]
call fcn.1000582b8
mov rcx, qword [rbx + 0x10]
and qword [rbx + 0x20], 0
call fcn.1000582b8
mov rcx, qword [rbx + 0x30]
and qword [rbx + 0x10], 0
and dword [rbx + 0x18], 0
test rcx, rcx
je 0x10032f5b4
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and qword [rbx + 0x30], 0
cmp qword [rbx + 0x38], 0
jne 0x10032f5e0
lea rcx, [rbx + 0x38]
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10032f6c1
mov rcx, qword [rbx + 0x10]
call fcn.1000582b8
and qword [rbx + 0x10], 0
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
mov rdi, rsi
repne scasw ax, word [rdi]
lea eax, [r8 + 3]
not rcx
dec rcx
mov dword [rbx + 0x18], ecx
inc ecx
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.100058294
mov rcx, rax
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x10032f631
mov ebp, 0x8007000e
jmp 0x10032f6e7
mov edx, dword [rbx + 0x18]
mov r8, rsi
inc edx
call fcn.100085754
mov ebp, eax
test eax, eax
jne 0x10032f6e3
lea eax, [rbp + 0x2c]
lea rdi, [0x100017210]
mov rsi, r12
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032f66b
mov edx, 0x660e
mov dword [rbx + 0xc], 1
jmp 0x10032f6a9
lea rdi, [0x1000171b0]
mov rsi, r12
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032f68b
mov edx, 0x660f
mov dword [rbx + 0xc], 2
jmp 0x10032f6a9
lea rdi, [0x100017150]
mov rsi, r12
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x10032f6d7
mov edx, 0x6610
mov dword [rbx + 0xc], 3
mov rcx, qword [rbx + 0x38]
lea r9, [rbx + 0x30]
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x10032f6e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
jmp 0x10032f6e3
mov ebp, 0x80049e2e
jmp 0x10032f6e7
mov ebp, 0x80070057
test ebp, ebp
jns 0x10032f707
mov rcx, qword [rbx + 0x20]
call fcn.1000582b8
mov rcx, qword [rbx + 0x10]
and qword [rbx + 0x20], 0
call fcn.1000582b8
and qword [rbx + 0x10], 0
and dword [rbx + 0x18], 0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x100375d1c
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1004c4740]
xor rax, rsp
mov qword [rsp + 0xb8], rax
lea r12, [rcx + 0x18]
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x90], rcx
mov r14, qword [r12]
lea rax, [0x100000000]
mov ecx, 0xfffffff
mov ebp, dword [r14 + 5]
lea r11, [0x100000000]
mov edx, dword [r14 + 1]
mov qword [rsp + 0x88], r12
and rdx, rcx
and rbp, rcx
add rbp, rax
mov eax, dword [0x1002f8888]
mov rcx, rax
mov qword [rsp + 0xa0], rbp
lea rsi, [rax + rdx - 1]
xor edx, edx
mov rax, rsi
div rcx
mov eax, dword [0x1002f8888]
sub rsi, rdx
xor r15d, r15d

Function at 0x1003f03c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, r8
mov r10d, edx
movzx eax, dl
mov r8, rcx
test dl, dl
je 0x1003f042f
mov r11, rax
mov r9d, dword [rbx]
mov ecx, r10d
mov eax, r10d
shl eax, 3
xor r9d, r10d
shr ecx, 3
mov r10d, ecx
movzx edx, r9b
add rbx, 4
xor r10d, eax
mov eax, r9d
shr eax, 8
add r10d, r9d
movzx ecx, al
mov rax, qword [r8 + rdx*8]
mov qword [r8 + rcx*8], rax
mov eax, r9d
shr r9d, 0x18
shr eax, 0x10
sub r11, 1
movzx ecx, r9b
movzx eax, al
mov rax, qword [r8 + rax*8]
mov qword [r8 + rcx*8], rax
jne 0x1003f03dc
mov rbx, qword [rsp + 8]
ret
Function at 0x100441d44
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
jne 0x100441d55
mov ebx, 0x80070057
jmp 0x100441d97
test rdx, rdx
je 0x100441d4e
test r8, r8
je 0x100441d4e
test r9d, r9d
je 0x100441d4e
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100441d85
xor ebx, ebx
jmp 0x100441dc8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x100441dc8
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x100441dc8
test byte [rcx + 0x1c], 2
je 0x100441dc8
mov rcx, qword [rcx + 0x10]
lea r8, [0x100039ca8]
mov edx, 0x13
mov r9d, ebx
call fcn.10005c358
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140003880
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov ebx, r9d
mov dword [rsp + 0x20], 0xf0000000
mov rdi, r8
lea rcx, [rsp + 0x30]
mov ebp, 1
xor r8d, r8d
mov r9d, ebp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400038d0
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x140031af0]
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov r8d, __WSAFDIsSet
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1400038be
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400038be
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400038be
mov r9, qword [rsp + 0x38]
xor bl, bl
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
mov rcx, qword [rsp + 0x50]
test eax, eax
movzx ebx, bl
cmovne ebx, ebp
test rcx, rcx
je 0x140003982
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140003994
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbp, qword [rsp + 0x60]
movzx eax, bl
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret