joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f230
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
jmp 0x14000f230
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14000f2fc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14000f2fc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14000f315
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14000f2ec
cmp byte [rax], 0x5c
jne 0x14000f2e6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14000f2e6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14000f2d2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14000f2e3
test r8b, 0x10
jne 0x14000f2e6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14000f2e6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140001177
test edi, edi
jne 0x14000f250
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.1400015a5
int3

Function at 0x14001e1e0
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001e1e0
sub rsp, 0x28
xor ecx, ecx
call qword [0x140030178]
test rax, rax
je 0x14001e22a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001e22a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001e22a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001e22a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001e22a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001e22c
xor al, al
add rsp, 0x28
ret
Function at 0x14003c6e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14003c70d
xor al, al
jmp 0x14003c86f
mov rax, qword [0x14005d6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14005d6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14005d6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14005d6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14005d6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14005d6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14005d6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14005d6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14005d700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14003c861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14003c7b9
mov r11d, 2
jmp 0x14003c7dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14003c7d3
mov r11d, 1
jmp 0x14003c7dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14003c885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14003c822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14003c83a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14003c84a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14003c858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14003c7a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14003c86a
Function at 0x140001bbc
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [0x1401b2330]
test rdi, rdi
je 0x140001c6a
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x140001bfe
cmp rcx, 0xffffffffffffffff
je 0x140001bf3
xor edx, edx
mov rcx, rdi
call fcn.140002170
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rdi + 0x78], 0
and dword [rdi + 0x80], 0
mov rcx, qword [rdi + 0x88]
test rcx, rcx
je 0x140001c21
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rdi + 0x88], 0
and dword [rdi + 0x90], 0
mov rcx, qword [rdi + 0x98]
test rcx, rcx
je 0x140001c44
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rdi + 0x98], 0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140001c52
call fcn.1400f0950
mov rbx, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, rbx
test rbx, rbx
jne 0x140001bd6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001dc4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x140001e31
mov rcx, qword [rcx + 0x78]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001e31
movzx r9d, word [rbx + 0x2a]
cmp r8d, r9d
ja 0x140001e20
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x140001e40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__WriteFile__0x_08x__n
mov r8d, eax
call fcn.14000d9f0
jmp 0x140001e40
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.14000d9f0
jmp 0x140001e40
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000d9f0
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140001e50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor esi, esi
mov r14, r8
mov r15, rdx
mov rbx, rcx
test rcx, rcx
je 0x140001efd
mov rax, qword [rcx + 0x78]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140001efd
movzx edi, word [rcx + 0x28]
lea ecx, [rsi + 0x40]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r15], rax
test rax, rax
je 0x140001f0c
mov rcx, qword [rbx + 0x78]
mov r9, r14
and qword [rsp + 0x20], rsi
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
je 0x140001ece
mov edx, dword [r14]
cmp edx, edi
je 0x140001f0c
lea rbp, str.ERROR_kull_m_busylight_device_read_raw____device__u___u_byte_s__readed___u_wanted_n
jmp 0x140001ee0
lea rbp, str.ERROR_kull_m_busylight_device_read_raw____device__u__ReadFile__0x_08x__n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbx + 8]
mov edi, eax
mov r8d, edi
mov rcx, rbp
call fcn.14000d9f0
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_LocalFree]
and dword [r14], 0
mov qword [r15], rax
jmp 0x140001f0c
mov edx, dword [rcx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_read_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000d9f0
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140002170
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 8], 0
mov esi, edx
mov dword [rax + 0xc], 0x80000000
mov rdi, rcx
mov rbx, rcx
test rcx, rcx
je 0x1400021cb
and dword [rbx + 0x90], 0
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x1400021bb
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rbx + 0x98], 0
test esi, esi
je 0x1400021c4
mov rbx, qword [rbx]
jmp 0x1400021c6
xor ebx, ebx
test rbx, rbx
jne 0x140002198
mov r9d, esi
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, rdi
call fcn.140002098
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400029b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rbp, rcx
mov edx, 0x338
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140002b07
and dword [rbx + 0x1c], 0
lea rsi, [rax + 8]
and dword [rbx + 0x20], 0
mov eax, 0x4000000
mov dword [rsi], eax
mov r8, rbp
mov dword [rbx + 0xc], eax
xor edx, edx
mov eax, SQLGetData
mov rcx, rsi
mov word [rbx + 0x28], ax
call fcn.140002834
test eax, eax
je 0x140002ae9
lea rdi, [rbx + 0x22a]
mov ecx, 0x100
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140002af5
mov rcx, rdi
call fcn.140002368
test eax, eax
js 0x140002af5
mov qword [rsp + 0x60], rbp
lea rax, [0x140002750]
mov qword [rsp + 0x58], rsi
lea rdi, [rbx + 0x32c]
mov qword [rsp + 0x50], rax
lea r9, [0x1400025b4]
lea rax, [0x14000271c]
mov rcx, rdi
mov qword [rsp + 0x48], rax
lea r8, [0x1400025a4]
lea rax, [0x1400026e4]
mov qword [rsp + 0x40], rax
lea rdx, [0x1400025a0]
lea rax, [fcn.1400026b0]
mov qword [rsp + 0x38], rax
lea rax, [0x140002678]
mov qword [rsp + 0x30], rax
lea rax, [0x140002640]
mov qword [rsp + 0x28], rax
lea rax, [fcn.1400025bc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FCICreate]
mov qword [rbx], rax
test rax, rax
jne 0x140002af5
mov ecx, dword [rdi]
call fcn.140002934
mov edx, dword [rdi]
lea rcx, str.ERROR_kull_m_cabinet_create___FCICreate_failed_with_error_code__d:__S_n
mov r8, rax
call fcn.14000d9f0
jmp 0x140002af5
lea rcx, str.ERROR_kull_m_cabinet_create___Failed_to_initialize_the_cabinet_information_structure._n
call fcn.14000d9f0
cmp qword [rbx], 0
jne 0x140002b07
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140004468
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov r15, r9
mov esi, r8d
mov r14, rdx
mov edi, ecx
cmp ecx, 0x8000
jne 0x140004501
cmp dword [rbp + 0x40], 4
jne 0x1400045e3
lea rdx, [rbp - 0x20]
mov ecx, 0xffffff7c
call qword [sym.imp.cryptdll.dll_CDLocateCheckSum]
test eax, eax
js 0x1400045e3
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [rax + 0x10]
test eax, eax
js 0x1400045e3
mov rax, qword [rbp - 0x20]
mov r8, r14
mov rcx, qword [rbp - 0x10]
mov edx, esi
call qword [rax + reloc.ODBC32.dll_SQLAllocHandle]
mov rax, qword [rbp - 0x20]
mov rdx, r15
mov rcx, qword [rbp - 0x10]
call qword [rax + 0x20]
test eax, eax
lea rcx, [rbp - 0x10]
mov rax, qword [rbp - 0x20]
setns bl
call qword [rax + Ordinal_41]
jmp 0x1400045e3
mov r9d, reloc.ODBC32.dll_SQLAllocHandle
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rbp - 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400045e3
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400045d7
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400045cd
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea esi, [r8 + 2]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400045cd
mov edx, dword [rbp + 0x20]
lea ecx, [rsi + 0x3e]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400045cd
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x20]
mov r8, rax
mov dword [rsp + 0x20], ebx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rbp + 0x40]
mov rdx, rdi
cmp dword [rbp + 0x20], ecx
mov ebx, eax
cmovb ecx, dword [rbp + 0x20]
mov r8d, ecx
mov rcx, r15
call fcn.1400cac20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140004600
Capabilities:
Encrypt data using des via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov esi, r9d
mov r12, rcx
xor ebx, ebx
mov ecx, 0x6603
mov r14, r8
mov r15d, edx
lea ebp, [rsi + 0xc]
cmp edx, ecx
je 0x140004697
mov edx, ebp
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400046c5
mov r8d, esi
mov dword [rax], 0x208
lea rcx, [rax + 0xc]
mov dword [rax + 4], r15d
mov rdx, r14
mov dword [rax + 8], esi
call fcn.1400cac20
mov rax, qword [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov eax, dword [rsp + 0x70]
mov rdx, rdi
mov rcx, r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400046c5
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x1400046c5
mov r9d, dword [rsp + 0x70]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call fcn.140005300
mov ebx, eax
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x1400046e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push r12
push r14
push r15
sub rsp, 0x150
xor esi, esi
mov ebx, r8d
cmp r8d, dword [rsp + 0x190]
mov rbp, r9
mov r14, rdx
mov r15d, ecx
setae sil
jb 0x14000472d
mov r8d, dword [rsp + 0x190]
jmp 0x1400047e5
mov r12d, Ordinal_69
lea rcx, [rsp + 0x30]
mov r8d, r12d
lea edx, [r12 - 0xa]
call fcn.1400cb080
mov r8d, r12d
lea edx, [r12 + 0x1c]
lea rcx, [rsp + 0x70]
call fcn.1400cb080
test ebx, ebx
je 0x140004783
lea rax, [rsp + 0x30]
mov r8, rbx
sub r14, rax
xor edx, edx
lea rax, [rsp + 0x30]
add rax, rdx
mov cl, byte [r14 + rax]
xor byte [rsp + rdx + 0x70], cl
inc rdx
xor byte [rax], cl
sub r8, 1
jne 0x140004768
lea r9, [rsp + 0xb0]
mov dword [rsp + 0x20], ebx
mov r8d, r12d
lea rdx, [rsp + 0x30]
mov ecx, r15d
call fcn.140004468
test eax, eax
je 0x1400047ed
lea r9, [rsp + 0xb0]
mov dword [rsp + 0x20], ebx
add r9, rbx
lea rdx, [rsp + 0x70]
mov r8d, r12d
mov ecx, r15d
call fcn.140004468
mov esi, eax
test eax, eax
je 0x1400047ed
lea ecx, [rbx + rbx]
cmp dword [rsp + 0x190], ecx
lea rdx, [rsp + 0xb0]
cmovb ecx, dword [rsp + 0x190]
mov r8d, ecx
mov rcx, rbp
call fcn.1400cac20
lea r11, [rsp + 0x150]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400048d8
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
mov dword [rbp - 0x28], ecx
mov r14, r9
mov qword [rbp - 0x20], rbx
mov edi, r8d
mov dword [rbp - 0x18], ebx
mov rsi, rdx
mov qword [rbp - 0x10], rbx
lea r9d, [rbx + 0x18]
mov dword [rbp - 8], ebx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140004a49
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rbx
mov r9d, edi
mov qword [rsp + 0x28], rax
mov r8, rsi
mov edx, 0x6602
mov dword [rsp + 0x20], 0x100
call fcn.140004600
test eax, eax
je 0x140004a3d
mov r8, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140004a33
mov rcx, qword [rbp - 0x40]
lea r8, [rbp - 0x28]
xor r9d, r9d
lea edx, [rbx + 5]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x140004a29
mov r8d, dword [rbp + 0x40]
xor r9d, r9d
mov rcx, qword [rbp - 0x40]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140004a29
mov rcx, qword [rbp - 0x40]
lea esi, [rbx + 2]
mov edx, esi
mov dword [rsp + 0x20], ebx
lea r9, [rbp + 0x20]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140004a29
mov edx, dword [rbp + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140004a29
mov rcx, qword [rbp - 0x40]
lea r9, [rbp + 0x20]
mov r8, rax
mov dword [rsp + 0x20], ebx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rbp + 0x50]
mov rdx, rdi
cmp dword [rbp + 0x20], ecx
mov ebx, eax
cmovb ecx, dword [rbp + 0x20]
mov r8d, ecx
mov rcx, qword [rbp + 0x48]
call fcn.1400cac20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140004e8c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r14d, r14d
mov rdi, r9
mov ebx, r8d
mov r15, rdx
mov rsi, rcx
cmp r8d, 0x10
jbe 0x14000503d
lea r9, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x140005065
xor r9d, r9d
lea edx, [r14 + 1]
mov r8, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140005031
lea edi, [rbx + 0xf]
shr edi, 4
lea r13d, [r14 + 0x10]
and ebx, 0xf
mov eax, edi
cmovne r13d, ebx
shl eax, 4
lea ebx, [rax - 0x20]
cmp edi, 2
jbe 0x140004f3e
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140005031
lea eax, [r13 + 0x10]
mov r12d, ebx
add r12, r15
mov r8d, eax
mov rdx, r12
mov ebx, eax
lea rcx, [rbp - 0x28]
call fcn.1400cac20
mov eax, 0x10
lea rcx, [rbp - 0x28]
sub eax, r13d
add rcx, rbx
mov r8d, eax
mov qword [rbp - 0x38], rax
xor edx, edx
mov qword [rbp - 0x30], rcx
call fcn.1400cb080
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x28]
mov dword [rbp + 0x40], 0x10
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140005031
movdqu xmm1, xmmword [rbp - 0x28]
mov r8, qword [rbp - 0x38]
lea rdx, [rbp - 0x28]
movdqu xmm0, xmmword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
mov ebx, r13d
pxor xmm1, xmm0
add rdx, rbx
movdqu xmmword [rbp - 0x28], xmm1
call fcn.1400cac20
lea rax, [rbp + 0x40]
mov r13d, 0x10
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x18]
mov dword [rbp + 0x40], r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r14d, eax
test eax, eax
je 0x140005031
mov r8d, r13d
lea rdx, [rbp - 0x18]
mov rcx, r12
call fcn.1400cac20
shl edi, 4
lea rdx, [rbp - 0x28]
sub edi, r13d
mov r8d, ebx
mov ecx, edi
add rcx, r15
call fcn.1400cac20
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x140005065
jne 0x140005065
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], 0x10
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r14d, eax
lea r11, [rsp + 0x70]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140005088
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor ebp, ebp
mov rax, r9
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
lea r13d, [rbp + 0x10]
cmp r8d, r13d
jbe 0x1400051c2
xor r9d, r9d
lea edx, [rbp + 1]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400051f3
lea edi, [rbx + 0xf]
mov r15d, r13d
shr edi, 4
and ebx, 0xf
mov eax, edi
cmovne r15d, ebx
shl eax, 4
lea ebx, [rax - 0x20]
cmp edi, 2
jbe 0x140005129
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
mov dword [rsp + 0xa0], ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400051f3
lea eax, [r15 + 0x10]
mov r12d, ebx
add r12, r14
mov r8d, eax
mov rdx, r12
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.1400cac20
mov r8d, r13d
lea rcx, [rsp + 0x40]
sub r8d, r15d
add rcx, rbx
xor edx, edx
call fcn.1400cb080
mov eax, Ordinal_36
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
mov dword [rsp + 0xa0], eax
xor edx, edx
lea rax, [rsp + 0xa0]
mov rcx, rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebp, eax
test eax, eax
je 0x1400051f3
mov r8, r13
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.1400cac20
shl edi, 4
lea rdx, [rsp + 0x40]
sub edi, r13d
mov r8d, r15d
mov ecx, edi
add rcx, r14
call fcn.1400cac20
jmp 0x1400051f3
jne 0x1400051f3
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
mov dword [rsp + 0xa0], r13d
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebp, eax
lea r11, [rsp + 0x60]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140005214
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x50
mov rbp, r9
mov dword [rax + 8], 1
mov edi, r8d
mov dword [rax - 0x38], 0xf0000000
mov rsi, rdx
lea rcx, [rax - 0x10]
xor ebx, ebx
xor r8d, r8d
xor edx, edx
lea r9d, [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400052e8
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
lea r9d, [rbx + 0x10]
mov qword [rsp + 0x28], rax
mov r8, rbp
mov edx, 0x660e
mov dword [rsp + 0x20], ebx
call fcn.140004600
test eax, eax
je 0x1400052db
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x60]
xor r9d, r9d
lea edx, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400052d0
mov r8d, edi
mov r9, qword [rsp + 0x88]
mov rdx, rsi
mov rcx, qword [rsp + 0x40]
cmp dword [rsp + 0x90], ebx
je 0x1400052c9
call fcn.140005088
jmp 0x1400052ce
call fcn.140004e8c
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret