joyce8/EMBER2024-capa huggingface dataset:
Function at 0x581880
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x581954
jb 0x5819b3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_256a
jmp 0x581a21
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x80
call sym._expand_key_192b
jmp 0x581a21
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x40
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x80
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x1b
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x36
call sym._expand_key_128
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x581a2e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x581b60
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x0063e020]
movdqu xmm14, xmmword [0x0063e030]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x581c4b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x581c4b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x581cb0
ret
Function at 0x1400022d7
Capabilities:
Terminate thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x14000239f
mov ebp, edx
mov rdi, rcx
mov r14, qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [sym.imp.KERNEL32.dll_TerminateThread]
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x140002332
test ebp, ebp
je 0x140002327
cmp rcx, 0xffffffffffffffff
je 0x140002327
mov rcx, rdi
xor edx, edx
call fcn.1400023ac
mov rcx, qword [rdi + 0x78]
call r15
mov qword [rdi + 0x78], 0
mov dword [rdi + 0x80], 0
mov rcx, qword [rdi + 0x88]
test rcx, rcx
je 0x140002357
xor edx, edx
call rbx
mov qword [rdi + 0x88], 0
mov dword [rdi + 0x90], 0
mov rcx, qword [rdi + 0x98]
test rcx, rcx
je 0x14000237c
xor edx, edx
call rbx
mov qword [rdi + 0x98], 0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14000238a
call fcn.1401062bc
mov rsi, qword [rdi]
mov rcx, rdi
call r14
mov rdi, rsi
test rsi, rsi
jne 0x140002306
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400023ac
Capabilities:
Terminate thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, edx
mov r14, rcx
movabs rax, 0x8000000000000000
mov qword [rsp + 0x20], rax
test rcx, rcx
je 0x140002409
mov rbx, qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rdi, r14
mov dword [rdi + 0x90], 0
mov rcx, qword [rdi + 0x98]
test rcx, rcx
je 0x1400023fd
xor edx, edx
call rbx
mov qword [rdi + 0x98], 0
test esi, esi
je 0x140002409
mov rdi, qword [rdi]
test rdi, rdi
jne 0x1400023d8
lea rdx, [rsp + 0x20]
mov rcx, r14
mov r8d, 1
mov r9d, esi
call fcn.14000278e
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140002569
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
test rcx, rcx
je 0x140002584
mov rcx, qword [rsi + 0x78]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x14000259b
mov edx, dword [rsi + 8]
lea rcx, [0x14013b8c0]
call fcn.140016430
xor eax, eax
add rsp, 0x30
pop rsi
ret
movzx r9d, word [rsi + 0x2a]
cmp r9d, r8d
jae 0x1400025b6
mov edx, dword [rsi + 8]
lea rcx, [0x14013b840]
call fcn.140016430
jmp 0x140002593
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002595
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsi + 8]
lea rcx, str.0uuu:uuUuUuNuUu.u
mov r8d, eax
call fcn.140016430
jmp 0x140002593
Function at 0x1400025e8
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
test rcx, rcx
je 0x140002608
mov rax, qword [rsi + 0x78]
inc rax
cmp rax, 2
jae 0x140002627
mov edx, dword [rsi + 8]
lea rcx, [0x14013b8c0]
call fcn.140016430
xor ebx, ebx
mov eax, ebx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r14, r8
mov rdi, rdx
movzx r15d, word [rsi + 0x28]
mov ecx, 0x40
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x140002617
mov rcx, qword [rsi + 0x78]
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8d, r15d
mov r9, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
je 0x14000267e
mov edx, dword [r14]
cmp edx, r15d
je 0x140002619
lea rcx, [0x14013b980]
mov r8d, r15d
jmp 0x140002691
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsi + 8]
lea rcx, [0x14013b930]
mov r8d, eax
call fcn.140016430
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov dword [r14], 0
jmp 0x140002619

Function at 0x1400033c9
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, rcx
mov edx, 0x338
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x140003468
mov rsi, rax
movabs rax, 0x400000004000000
mov qword [rsi + 8], rax
mov word [rsi + 0x28], 0x2a
mov qword [rsi + 0x1c], 0
lea rcx, [rsi + 0x12a]
mov dword [rsp + 0x20], 0
lea r8, str._yU_:8n_ikh_n
mov edx, 0x100
mov r9, r14
call fcn.140003289
test eax, eax
js 0x14000346f
lea rbx, [rsi + 0x22a]
mov ecx, 0x100
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x14000355f
lea r8, [rsi + 8]
mov ecx, 0x100
cmp byte [rbx], 0
je 0x140003480
inc rbx
dec rcx
jne 0x140003456
jmp 0x14000355f
xor esi, esi
jmp 0x140003565
lea rcx, [0x14013bc30]
call fcn.140016430
jmp 0x14000355f
xor edx, edx
lea rdi, [0x14013bbb7]
mov al, byte [rdx + rdi]
test al, al
je 0x1400034a5
mov byte [rbx + rdx], al
inc rdx
cmp rcx, rdx
jne 0x140003489
mov byte [rbx + rdx - 1], 0
jmp 0x14000355f
mov byte [rbx + rdx], 0
mov rbx, rsi
add rbx, 0x32c
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r8
lea rax, [0x14000319d]
mov qword [rsp + 0x50], rax
lea rax, [0x140003174]
mov qword [rsp + 0x48], rax
lea rax, [0x140003147]
mov qword [rsp + 0x40], rax
lea rax, [0x14000311e]
mov qword [rsp + 0x38], rax
lea rax, [0x1400030e4]
mov qword [rsp + 0x30], rax
lea rax, [0x1400030aa]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140003038]
mov qword [rsp + 0x20], rax
lea rdx, [0x140003020]
lea r8, [0x140003023]
lea r9, [0x140003031]
mov rcx, rbx
call sub.Cabinet.dll_FCICreate
mov qword [rsi], rax
test rax, rax
jne 0x14000355f
movsxd rdx, dword [rbx]
cmp rdx, 8
ja 0x14000354c
lea rax, [0x14011b3d0]
mov r8, qword [rax + rdx*8]
jmp 0x140003553
lea r8, [0x14013bba9]
lea rcx, [0x14013bbc0]
call fcn.140016430
cmp qword [rsi], 0
je 0x140003572
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_LocalFree]
Function at 0x140006b54
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r14, r9
mov r15d, r8d
mov rsi, rdx
mov ebx, dword [rsp + 0xa0]
cmp ecx, 0x8000
jne 0x140006bee
xor edi, edi
cmp ebx, 4
jne 0x140006cf6
lea rdx, [rsp + 0x30]
mov ecx, 0xffffff7c
call sub.cryptdll.dll_CDLocateCheckSum
test eax, eax
js 0x140006cf6
mov rax, qword [rsp + 0x30]
xor edi, edi
lea rdx, [rsp + 0x38]
xor ecx, ecx
call qword [rax + 0x10]
test eax, eax
js 0x140006cf6
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x38]
mov rcx, qword [rbx]
mov edx, r15d
mov r8, rsi
call qword [rax + Ordinal_26]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rbx]
mov rdx, r14
call qword [rax + 0x20]
mov edi, eax
not edi
shr edi, 0x1f
mov rax, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + Ordinal_41]
jmp 0x140006cf6
mov ebp, ecx
mov dword [rsp + 0x20], 0xf0000000
xor edi, edi
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x140006cf6
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edi, edi
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x140006ce9
mov rcx, qword [rsp + 0x38]
xor edi, edi
mov rdx, rsi
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptHashData]
test eax, eax
je 0x140006cde
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
xor edi, edi
lea r9, [rsp + 0x44]
mov edx, 2
xor r8d, r8d
call qword [sym.imp.advapi32.dll_CryptGetHashParam]
test eax, eax
je 0x140006cde
mov edx, dword [rsp + 0x44]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x140006cde
mov rsi, rax
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea rbp, [rsp + 0x44]
mov edx, 2
mov r8, rax
mov r9, rbp
call qword [sym.imp.advapi32.dll_CryptGetHashParam]
mov edi, eax
mov eax, dword [rbp]
cmp eax, ebx
cmovb ebx, eax
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call fcn.1400eeb30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140006d05
Capabilities:
Encrypt data using des via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, r9d
mov rdi, r8
mov r13, qword [rsp + 0xa8]
mov r14d, dword [rsp + 0xa0]
cmp edx, 0x6603
jne 0x140006d63
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x140006dcb
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov ecx, 0x6603
mov rdx, rdi
mov r8d, ebx
mov r9d, r14d
call fcn.140006dde
jmp 0x140006dcd
mov ebp, edx
mov r15, rcx
lea r12d, [rbx + 0xc]
mov edx, r12d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x140006dcb
mov rsi, rax
mov r8d, ebx
mov dword [rax], 0x208
mov dword [rax + 4], ebp
mov dword [rax + 8], ebx
mov rcx, rax
add rcx, 0xc
mov rdx, rdi
call fcn.1400eeb30
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r14d
mov rcx, r15
mov rdx, rsi
mov r8d, r12d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptImportKey]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x140006dcd
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140007102
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x150
mov r12, r9
mov r14d, dword [rsp + 0x1b0]
xor ebx, ebx
cmp r8d, r14d
setae r15b
jb 0x14000713e
mov r8d, r14d
mov rcx, r12
call fcn.1400eeb30
mov ebx, 1
jmp 0x140007226
mov edi, r8d
mov ebp, ecx
movaps xmm0, xmmword [0x14011b180]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x14011b740]
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov esi, r8d
test r8d, r8d
je 0x1400071b8
mov al, byte [rdx]
mov ecx, eax
xor cl, 0x36
mov byte [rsp + 0x70], cl
xor al, 0x5c
mov byte [rsp + 0x30], al
cmp edi, 1
je 0x1400071b8
mov eax, 1
mov cl, byte [rdx + rax]
xor byte [rsp + rax + 0x70], cl
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rsi, rax
jne 0x1400071a5
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x70]
lea r9, [rsp + 0xb0]
mov ecx, ebp
mov r8d, Ordinal_69
call fcn.140006b54
test eax, eax
je 0x14000721f
lea r9, [rsp + rsi]
add r9, 0xb0
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x30]
mov ecx, ebp
mov r8d, Ordinal_69
call fcn.140006b54
test eax, eax
je 0x140007224
mov ebx, eax
add edi, edi
cmp edi, r14d
cmova edi, r14d
lea rdx, [rsp + 0xb0]
mov rcx, r12
mov r8, rdi
call fcn.1400eeb30
jmp 0x140007226
mov bl, r15b
jmp 0x140007226
xor ebx, ebx
mov eax, ebx
add rsp, 0x150
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400073ab
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov r14, r9
mov ebx, r8d
mov rdi, rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x20], 0xf0000000
xor esi, esi
lea rcx, [rsp + 0x50]
xor edx, edx
xor r8d, r8d
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x140007567
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0x100
mov edx, 0x6602
mov r8, rdi
mov r9d, ebx
call fcn.140006d05
test eax, eax
je 0x140007558
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor esi, esi
mov edx, 0x8009
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x14000754b
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x60]
xor esi, esi
mov edx, 5
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSetHashParam]
test eax, eax
je 0x140007540
mov r8d, dword [rsp + 0xe0]
mov rcx, qword [rsp + 0x40]
xor esi, esi
mov rdx, r14
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptHashData]
test eax, eax
je 0x140007540
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
xor esi, esi
lea r9, [rsp + 0x4c]
mov edx, 2
xor r8d, r8d
call qword [sym.imp.advapi32.dll_CryptGetHashParam]
test eax, eax
je 0x140007540
mov edx, dword [rsp + 0x4c]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x140007540
mov rdi, rax
mov ebx, dword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
lea r15, [rsp + 0x4c]
mov edx, 2
mov r8, rax
mov r9, r15
call qword [sym.imp.advapi32.dll_CryptGetHashParam]
mov esi, eax
mov eax, dword [r15]
cmp eax, ebx
cmovb ebx, eax
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call fcn.1400eeb30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
jmp 0x14000755a
xor esi, esi
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov eax, esi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400077fe
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov edi, r8d
mov r14, rdx
mov rbx, rcx
cmp r8d, 0x11
jb 0x1400079a1
mov rbp, r9
xor esi, esi
lea r9, [rsp + 0x48]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.advapi32.dll_CryptDuplicateKey]
test eax, eax
je 0x1400079d0
xor esi, esi
mov rcx, rbx
mov edx, 1
mov r8, rbp
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSetKeyParam]
test eax, eax
je 0x140007994
lea eax, [rdi + 0xf]
mov ecx, edi
and ecx, 0xf
mov r15d, 0x10
cmovne r15d, ecx
lea ebp, [rdi - 0x11]
and ebp, 0xfffffff0
cmp eax, 0x2f
jbe 0x1400078a8
lea rax, [rsp + 0x50]
mov dword [rax], ebp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor esi, esi
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
test eax, eax
je 0x140007994
mov r12d, ebp
add r12, r14
mov esi, r15d
lea r8, [rsi + 0x10]
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.1400eeb30
mov qword [rsp + 0x40], rsi
lea rbp, [rsp + rsi]
add rbp, 0x60
mov r13d, 0x10
sub r13d, r15d
xor esi, esi
mov rcx, rbp
xor edx, edx
mov r8, r13
call fcn.1400ef1e0
mov rcx, qword [rsp + 0x48]
lea r15, [rsp + 0x3c]
mov dword [r15], 0x10
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
test eax, eax
je 0x140007994
lea rsi, [rsp + 0x60]
movaps xmm0, xmmword [rsi - 0x10]
xorps xmm0, xmmword [rsi]
movaps xmmword [rsi - 0x10], xmm0
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + rax]
add rdx, 0x50
mov rcx, rbp
mov r8, r13
call fcn.1400eeb30
mov dword [rsp + 0x3c], 0x10
mov qword [rsp + 0x28], r15
mov rbp, rsi
mov qword [rsp + 0x20], rsi
xor esi, esi
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
test eax, eax
je 0x140007994
mov ebx, eax
movups xmm0, xmmword [rbp]
movups xmmword [r12], xmm0
dec edi
and edi, 0xfffffff0
add r14, rdi
lea rdx, [rsp + 0x50]
mov rcx, r14
mov r8, qword [rsp + 0x40]
call fcn.1400eeb30
mov esi, ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
jmp 0x1400079d0
xor esi, esi
cmp edi, 0x10
jne 0x1400079d0
lea rax, [rsp + 0x50]
mov dword [rax], 0x10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
mov esi, eax
mov eax, esi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400079e3
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r8d
mov r14, rdx
mov r13, rcx
xor esi, esi
cmp r8d, 0x11
jb 0x140007afc
mov rcx, r13
mov edx, 1
mov r8, r9
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSetKeyParam]
test eax, eax
je 0x140007b2e
lea eax, [rdi + 0xf]
mov ecx, edi
and ecx, 0xf
mov ebp, 0x10
cmovne ebp, ecx
lea ebx, [rdi - 0x11]
and ebx, 0xfffffff0
cmp eax, 0x2f
jbe 0x140007a6f
lea rax, [rsp + 0x40]
mov dword [rax], ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor esi, esi
mov rcx, r13
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptEncrypt]
test eax, eax
je 0x140007b2e
mov r12d, ebx
add r12, r14
mov r15d, ebp
lea r8, [r15 + 0x10]
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov rdx, r12
call fcn.1400eeb30
lea rcx, [rsp + r15]
add rcx, 0x50
mov r8d, 0x10
sub r8d, ebp
xor esi, esi
xor edx, edx
call fcn.1400ef1e0
mov eax, Ordinal_36
lea rcx, [rsp + 0x3c]
mov dword [rcx], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
mov rcx, r13
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptEncrypt]
test eax, eax
je 0x140007b2e
mov ebx, eax
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rdx + 0x10]
movups xmmword [r12], xmm0
dec edi
and edi, 0xfffffff0
add r14, rdi
mov rcx, r14
mov r8, r15
call fcn.1400eeb30
mov esi, ebx
jmp 0x140007b2e
cmp edi, 0x10
jne 0x140007b2e
mov eax, 0x10
lea rcx, [rsp + 0x40]
mov dword [rcx], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
mov rcx, r13
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptEncrypt]
mov esi, eax
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140007b41
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, r9
mov r14d, r8d
mov rdi, rdx
mov ebp, ecx
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x20], 0xf0000000
xor ebx, ebx
lea rcx, [rsp + 0x48]
xor edx, edx
xor r8d, r8d
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x140007c21
mov r9d, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
mov edx, ebp
mov r8, rsi
call fcn.140006d05
test eax, eax
je 0x140007bfe
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x44]
xor ebx, ebx
mov edx, 4
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSetKeyParam]
test eax, eax
je 0x140007c09
mov r9, qword [rsp + 0xa8]
cmp dword [rsp + 0xb0], 0
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8d, r14d
je 0x140007c02
call fcn.1400079e3
jmp 0x140007c07
xor ebx, ebx
jmp 0x140007c14
call fcn.1400077fe
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret