joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001374c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
sub rsp, 0x88
mov qword [rsp + 0x68], 0xfffffffffffffffe
and qword [rax + 0x20], 0
and dword [rax + 8], 0
lea rax, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOfficeOutlookAddins
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsxd rbx, eax
test eax, eax
jne 0x180013895
and qword [rsp + 0x50], 0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1800078b0
cmp qword [rsp + 0x50], 0
jne 0x1800137c0
lea rcx, [rsp + 0x50]
call fcn.180008c68
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rdx, str.OutlookMC.COMAddin
lea rcx, [rsp + 0x60]
call fcn.1800051c4
mov rbx, rax
lea rdx, [0x180041458]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
cmovne rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.1800051c4
nop
mov dword [rsp + 0x20], 0xa
mov r9d, 5
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180012f90
lea r11, [rsp + 0xa0]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movsxd rbx, eax
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x180013885
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180013895
call qword [sym.imp.KERNEL32.dll_LocalFree]
and dword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 3
test rbx, rbx
jne 0x18001399e
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
xor r8d, r8d
lea rdx, str.CommandLineSafe
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rbx, eax
test eax, eax
jne 0x18001399e
lea rbp, str.Microsoft_Outlook_COM_Add_in
mov rcx, rbp
call fcn.1800257a0
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rbx, eax
test eax, eax
jne 0x18001399e
mov rcx, rbp
call fcn.1800257a0
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
lea rdx, str.FriendlyName
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rbx, eax
test eax, eax
jne 0x18001399e
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.LoadBehavior
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rbx, eax
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x1800139b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x88
pop rbp
pop rbx
ret
Function at 0x180013a04
Capabilities:
Delete registry key

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
and qword [rsp + 0x60], 0
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1800078b0
cmp qword [rsp + 0x60], 0
jne 0x180013a39
lea rcx, [rsp + 0x60]
call fcn.180008c68
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
lea rdx, str.OutlookMC.COMAddin
lea rcx, [rsp + 0x78]
call fcn.1800051c4
mov rbx, rax
lea rdx, [0x180041458]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
cmovne rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.1800051c4
nop
mov dword [rsp + 0x20], 0xa
mov r9d, 5
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180012f90
nop
lea rcx, [0x18005a780]
mov rax, qword [0x18005a780]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x70]
lea rdx, str.SoftwareMicrosoftOfficeOutlookAddins_s
lea rcx, [rsp + 0x68]
call fcn.18000ea48
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x180013afa
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x180013b1a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180013b2a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x18001c664
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x18005a960]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.180026a20
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x180000000]
mov esi, SysAllocStringByteLen
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.180026a20
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x18001c6f7
cmp dword [rsp + 0x24], 5
jb 0x18001c711
jmp 0x18001c70d
cmp dword [rsp + 0x30], esi
jne 0x18001c711
cmp dword [rsp + 0x24], 4
ja 0x18001c70d
jne 0x18001c711
cmp dword [rsp + 0x28], 0
jbe 0x18001c711
mov byte [rbx + 0x18], sil
lea rax, [0x180045840]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1800076ac
movzx ecx, byte [0x18005c2c0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x18005c2c0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180026960
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001d110
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rcx
mov esi, dword [rcx]
add esi, esi
cmp qword [rcx + 0x10], 0
jne 0x18001d157
test esi, esi
je 0x18001d157
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x10], rax
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x18001d1cd
mov word [rax], 0
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18001d1c9
lea rcx, [rdi + 0x18]
call fcn.18001ce60
nop
mov r8, rsi
mov rdx, rbx
mov rcx, qword [rdi + 0x10]
call fcn.1800280c0
nop
jmp 0x18001d1b1
lea rcx, [rdi + 0x18]
call fcn.18001cec0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rdi + 0x10]
jmp 0x18001d1cd
mov rax, qword [rdi + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18001d2b0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
mov dword [rcx + 0x1c], eax
mov dword [rcx + 0x20], eax
mov word [rcx + 0x24], ax
mov qword [rcx + 0x68], rax
mov qword [rcx + 0x70], rax
mov dword [rcx + 0x78], eax
mov qword [rcx + 0x7c], rax
mov qword [rcx + 0x84], rax
mov qword [rcx + 0x8c], rax
mov qword [rcx + 0x94], rax
mov qword [rcx + 0x9c], rax
mov byte [rcx + 0xa4], al
ret

Function at 0x18001d920
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, word [rcx + 0x24]
mov rbx, rcx
cmp ax, 0x37
movzx eax, ax
mov byte [rax + rcx + 0x26], 0x80
jbe 0x18001d997
add word [rcx + 0x24], 1
movzx eax, word [rcx + 0x24]
cmp ax, 0x40
jae 0x18001d967
nop
nop
movzx eax, ax
mov byte [rax + rcx + 0x26], 0
add word [rcx + 0x24], 1
mov ax, word [rcx + 0x24]
cmp ax, 0x40
jb 0x18001d950
call fcn.18001d410
cmp word [rbx + 0x24], 0x38
jae 0x18001d9c7
nop
nop
nop
nop
movzx eax, word [rbx + 0x24]
mov byte [rax + rbx + 0x26], 0
add word [rbx + 0x24], 1
cmp word [rbx + 0x24], 0x38
jb 0x18001d980
jmp 0x18001d9c7
add word [rcx + 0x24], 1
movzx eax, word [rcx + 0x24]
cmp ax, 0x38
jae 0x18001d9c7
nop
nop
nop
movzx eax, ax
mov byte [rax + rcx + 0x26], 0
add word [rcx + 0x24], 1
mov ax, word [rcx + 0x24]
cmp ax, 0x38
jb 0x18001d9b0
mov ecx, dword [rbx + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x5e], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x60], cl
mov ecx, dword [rbx + 0x1c]
mov byte [rbx + 0x5f], al
movzx eax, byte [rbx + 0x20]
mov byte [rbx + 0x61], al
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x62], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x64], cl
mov rcx, rbx
mov byte [rbx + 0x63], al
movzx eax, byte [rbx + 0x1c]
mov byte [rbx + 0x65], al
add rsp, 0x20
pop rbx
jmp fcn.18001d410
Function at 0x18001dd30
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xb0
mov rax, qword [0x18005a960]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, qword [rcx + 8]
xor eax, eax
mov byte [rsp + 0x50], 0
xor r13d, r13d
test rbx, rbx
mov rdi, rcx
mov qword [r11 - 0x77], rax
mov qword [r11 - 0x6f], rax
mov qword [r11 - 0x67], rax
mov qword [r11 - 0x5f], rax
mov qword [r11 - 0x57], rax
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
mov qword [r11 - 0x3f], rax
mov word [r11 - 0x37], ax
mov byte [r11 - 0x35], al
mov dword [rsp + 0x44], 0x44
mov dword [rsp + 0x40], r13d
je 0x18001ddc1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x18001ddd4
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi + 0x10], r13
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x18001dde7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x18], r13
mov esi, 2
nop
mov rdx, qword [rdi]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 8]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ecx, dword [rsp + 0x40]
test ecx, ecx
mov r12d, eax
je 0x18001de54
cmp qword [rdi + 8], r13
jne 0x18001de54
mov rbx, rcx
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 8], rax
sub rsi, 1
jne 0x18001ddf0
test r12d, r12d
je 0x18001dee9
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x50]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x18001de83
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x18001dee9
mov rbx, qword [rdi]
test rbx, rbx
je 0x18001dea2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], r13
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x18001dec3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x18001ded6
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi + 0x10], r13
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x18001dee9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x18], r13
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180026960
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18001df30
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
test rdx, rdx
mov r13d, r9d
mov r15, r8
mov r12, rdx
je 0x18001df59
test r8, r8
je 0x18001df59
xor edi, edi
jmp 0x18001df5e
mov edi, 0x80070057
lea eax, [r9 + 8]
mov r14d, 0x10000
cmp eax, r14d
cmovb r14d, eax
test edi, edi
js 0x18001e0dd
cmp qword [rcx + 8], 0
jne 0x18001df91
mov eax, 0x80070005
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r14d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x18001dfc4
mov edi, 0x8007000e
jmp 0x18001e0a7
mov qword [rsp + 0x40], rsi
xor esi, esi
nop
nop
cmp esi, r13d
jae 0x18001e0a2
mov eax, r13d
lea ebx, [r14 - 8]
mov edx, esi
sub eax, esi
mov rcx, rbp
cmp eax, ebx
cmovb ebx, eax
add rdx, r15
mov r8d, ebx
mov dword [rsp + 0x98], ebx
call fcn.1800280c0
xor r8d, r8d
lea rax, [rsp + 0x98]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 8]
add ebx, esi
mov qword [rsp + 0x20], rbp
cmp ebx, r13d
sete r8b
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x18001e053
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, eax
jle 0x18001e093
movzx edi, ax
or edi, 0x80070000
jmp 0x18001e093
mov rax, qword [r12]
mov r8d, dword [rsp + 0x98]
lea r9, [rsp + 0x88]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x88], 0
call qword [rax + 0x20]
test eax, eax
mov edi, eax
js 0x18001e0a2
mov ecx, dword [rsp + 0x98]
cmp dword [rsp + 0x88], ecx
jne 0x18001e09d
mov esi, ebx
test edi, edi
jns 0x18001dfd0
jmp 0x18001e0a2
mov edi, 0x8000ffff
mov rsi, qword [rsp + 0x40]
test rbp, rbp
mov rbx, qword [rsp + 0x90]
je 0x18001e0c8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18001e420
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov ebx, 0x80070005
mov rbp, rdx
cmp qword [rcx], r12
mov rdi, rcx
mov qword [rsp + 0x60], r12
cmovne ebx, r12d
test ebx, ebx
js 0x18001e45b
mov eax, 0x80070057
test rdx, rdx
cmove ebx, eax
lea rsi, [rcx + 8]
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18001e471
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsi], r12
test ebx, ebx
js 0x18001e566
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x18001e4b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e4b0
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001e566
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
lea rdx, [rsp + 0x50]
lea r8d, [r9 + 4]
mov dword [rsp + 0x50], 0x420042
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x18001e4f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e4f0
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001e566
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
lea r8d, [rax + rax]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x18001e52b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e52b
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001e566
mov r8, qword [rsp + 0x60]
mov rcx, qword [rdi]
mov r9d, 0xc00000
mov edx, 0x6603
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x18001e566
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e566
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18001e576
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x18001f210
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
call fcn.18001ce20
lea r8, str.Microsoft_Strong_Cryptographic_Provider
mov r9d, 1
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18001f25f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x18001f25d
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x18001f2cf
test rbx, rbx
je 0x18001f279
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.18001e420
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x50], 0
call fcn.1800078b0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x18001f2b3
lea rcx, [rsp + 0x50]
call fcn.180008c68
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x18001f2b3
lea rdx, [0x180041458]
mov rcx, rdi
call fcn.18001e420
mov rcx, qword [rsp + 0x50]
test rcx, rcx
mov ebx, eax
je 0x18001f2cf
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18001f2e0
Capabilities:
Delete file

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov r13d, r9d
mov rbp, r8
mov rdi, rdx
mov r12, rcx
test rdx, rdx
je 0x18001f31c
test r8, r8
je 0x18001f31c
xor ebx, ebx
jmp 0x18001f321
mov ebx, 0x80070057
xor ecx, ecx
mov qword [rsp + 0x58], rcx
xor sil, sil
test ebx, ebx
js 0x18001f3a4
cmp qword [r12 + 8], 0
jne 0x18001f33e
mov ebx, 0x80070005
jmp 0x18001f3a4
lea r8, [rsp + 0x58]
mov edx, 0x1011
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileW]
mov ebx, eax
test eax, eax
js 0x18001f36f
mov sil, 1
mov r9d, r13d
mov r8, rbp
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call fcn.18001df30
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18001f38d
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x58]
test ebx, ebx
jns 0x18001f3a4
test sil, sil
je 0x18001f3a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18001f3b3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, ebx
jmp 0x18001f3b5
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x18001f810
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
test rcx, rcx
mov rax, rdx
mov rdi, rcx
je 0x18001f833
test rdx, rdx
mov ebx, esi
jne 0x18001f838
mov ebx, 0x80070057
test ebx, ebx
mov qword [rsp + 0x60], rsi
js 0x18001f8eb
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x18001f889
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001f889
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001f8db
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
mov ebx, eax
js 0x18001f8db
mov r8d, dword [rdi + 0x18]
mov rdx, qword [rsp + 0x60]
lea r9, [rsp + 0x50]
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001f8db
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001f8db
movzx ebx, ax
or ebx, 0x80070000
cmp qword [rsp + 0x60], rsi
je 0x18001f8eb
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18001f900
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x120
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x18005a960]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, rdx
test rdx, rdx
je 0x18001f946
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
jmp 0x18001f948
xor ebp, ebp
lea r12d, [rbp + rbp]
xor edi, edi
lea ebx, [r12 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18001faae
mov r8d, r12d
mov rdx, rsi
mov rcx, rax
call fcn.1800280c0
movsxd r11, ebp
mov word [rbx + r11*2], di
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharLowerW]
lea rcx, [rsp + 0x30]
call fcn.18001eae0
nop
lea rcx, [rsp + 0x30]
call fcn.18001d2b0
mov r8d, r12d
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.18001eb30
lea rcx, [rsp + 0x30]
call fcn.18001ebb0
lea rcx, [rsp + 0x30]
call fcn.18001d320
mov rsi, rax
test rax, rax
je 0x18001fa8a
cmp byte [rax], dil
je 0x18001fa8a
movabs rax, 0x5c6c61626f6c47
mov qword [rsp + 0xe0], rax
xor eax, eax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, 0x30
sub r8d, eax
cdqe
lea rcx, [rsp + rax + 0xe0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [rsp + 0x10f], dil
lea r8, [rsp + 0xe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
test rax, rax
je 0x18001fa8a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18001fa8a
cmp eax, 0x80
je 0x18001fa8a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rcx, [rsp + 0x30]
call fcn.18001d2a0
mov rax, rdi
jmp 0x18001fab1
mov rax, rdi
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.180026960
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x18001fd50
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
test r9b, r9b
mov rbp, rdx
lea rsi, [rcx + 0x6a6]
jne 0x18001fd7a
lea rsi, [rcx + 0x8c]
mov edi, r8d
add rdi, rdi
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.180026a20
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
call fcn.18001f6f0
mov ecx, 1
lock xadd dword [0x18005cb6c], ecx
add ecx, 1
mov qword [rsp + 0x30], rax
lea rdx, str._s_u__u__u_s
mov dword [rsp + 0x28], ecx
mov r9d, ebx
mov r8, rsi
mov rcx, rbp
mov dword [rsp + 0x20], r11d
call fcn.180028400
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18001fd80
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret