joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000335c
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
mov r12, r9
mov dword [rbp - 0x28], ecx
mov edi, r8d
mov rsi, rdx
lea rcx, [rbp - 0x38]
lea r9d, [rbx + 0x18]
xor r8d, r8d
xor edx, edx
mov qword [rbp - 0x20], rbx
mov dword [rbp - 0x18], ebx
mov qword [rbp - 0x10], rbx
mov dword [rbp - 8], ebx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800034cd
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov r9d, edi
mov r8, rsi
mov edx, 0x6602
mov dword [rsp + 0x20], 0x100
call fcn.18000300c
test eax, eax
je 0x1800034c1
mov r8, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800034b7
mov rcx, qword [rbp - 0x40]
lea r8, [rbp - 0x28]
lea edx, [rbx + 5]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x1800034ad
mov r8d, dword [rbp + 0x40]
mov rcx, qword [rbp - 0x40]
xor r9d, r9d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800034ad
mov rcx, qword [rbp - 0x40]
lea esi, [rbx + 2]
lea r9, [rbp + 0x20]
mov edx, esi
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1800034ad
mov edx, dword [rbp + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1800034ad
mov rcx, qword [rbp - 0x40]
lea r9, [rbp + 0x20]
mov r8, rax
mov edx, esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rbp + 0x50]
mov rdx, rdi
cmp dword [rbp + 0x20], ecx
mov ebx, eax
cmovb ecx, dword [rbp + 0x20]
mov r8d, ecx
mov rcx, qword [rbp + 0x48]
call fcn.180076230
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x18000373c
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
mov rdi, r9
mov ebx, r8d
mov r13, rdx
mov rsi, rcx
cmp r8d, 0x10
jbe 0x1800038e5
lea r9, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x18000390c
lea edx, [r12 + 1]
xor r9d, r9d
mov r8, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1800038d9
lea edi, [rbx + 0xf]
lea r14d, [r12 + 0x10]
shr edi, 4
and ebx, 0xf
cmovne r14d, ebx
cmp edi, 2
jbe 0x1800037ee
lea eax, [rdi - 2]
xor r9d, r9d
xor r8d, r8d
shl eax, 4
xor edx, edx
mov rcx, rsi
mov dword [rbp + 0x40], eax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1800038d9
lea eax, [r14 + 0x10]
lea r15d, [rdi - 2]
lea rcx, [rbp - 0x28]
shl r15d, 4
mov r8d, eax
mov ebx, eax
add r15, r13
mov rdx, r15
call fcn.180076230
mov r11d, reloc.WLDAP32.dll_Ordinal_16
lea rcx, [rbp + rbx - 0x28]
sub r11d, r14d
xor edx, edx
mov qword [rbp - 0x30], rcx
mov eax, r11d
mov r8d, r11d
mov qword [rbp - 0x38], rax
call fcn.180079090
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x40]
mov ebx, reloc.WLDAP32.dll_Ordinal_16
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
mov dword [rbp + 0x40], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1800038d9
lea rdx, [rbp - 0x28]
mov r9d, ebx
mov al, byte [rdx + 0x10]
xor byte [rdx], al
inc rdx
dec r9
jne 0x180003868
mov r8, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + r14 - 0x28]
mov ebx, r14d
call fcn.180076230
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x40], reloc.WLDAP32.dll_Ordinal_16
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r12d, eax
test eax, eax
je 0x1800038d9
movups xmm0, xmmword [rbp - 0x18]
shl edi, 4
lea rdx, [rbp - 0x28]
lea ecx, [rdi - 0x10]
mov r8d, ebx
add rcx, r13
movdqu xmmword [r15], xmm0
call fcn.180076230
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x18000390c
cmp ebx, 0x10
jne 0x18000390c
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rbp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r12d, eax
lea r11, [rsp + 0x70]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180003930
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r13d, r13d
mov rax, r9
mov ebx, r8d
lea r15d, [r13 + 0x10]
mov r12, rdx
mov rsi, rcx
cmp r8d, r15d
jbe 0x180003a68
lea edx, [r13 + 1]
xor r9d, r9d
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x180003a9d
lea edi, [rbx + 0xf]
mov ebp, r15d
shr edi, 4
and ebx, 0xf
cmovne ebp, ebx
cmp edi, 2
jbe 0x1800039d0
lea eax, [rdi - 2]
xor r9d, r9d
xor r8d, r8d
shl eax, 4
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x30], eax
mov dword [rsp + 0xa0], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x180003a9d
lea eax, [rbp + 0x10]
lea r14d, [rdi - 2]
lea rcx, [rsp + 0x40]
shl r14d, 4
mov r8d, eax
mov ebx, eax
add r14, r12
mov rdx, r14
call fcn.180076230
mov r8d, r15d
lea rcx, [rsp + rbx + 0x40]
sub r8d, ebp
xor edx, edx
call fcn.180079090
mov r11d, Ordinal_36
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], r11d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xa0], r11d
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov r13d, eax
test eax, eax
je 0x180003a9d
movups xmm0, xmmword [rsp + 0x50]
shl edi, 4
lea rdx, [rsp + 0x40]
sub edi, r15d
mov r8d, ebp
mov ecx, edi
add rcx, r12
movdqu xmmword [r14], xmm0
call fcn.180076230
jmp 0x180003a9d
cmp ebx, r15d
jne 0x180003a9d
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], r15d
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0xa0], r15d
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov r13d, eax
lea r11, [rsp + 0x60]
mov eax, r13d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180003ac0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
mov rdi, r9
mov rbp, rcx
mov r12, r8
mov esi, edx
xor ebx, ebx
lea rcx, [rax - 0x18]
lea r9d, [rbx + 0x18]
xor r8d, r8d
xor edx, edx
mov dword [rax - 0x28], 1
mov dword [rax - 0x48], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180003b93
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 0x10]
mov r8, r12
mov edx, 0x660e
mov dword [rsp + 0x20], ebx
call fcn.18000300c
test eax, eax
je 0x180003b86
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
lea edx, [rbx + 4]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x180003b7b
mov rcx, qword [rsp + 0x48]
mov r9, rdi
mov r8d, esi
mov rdx, rbp
cmp dword [rsp + 0x90], ebx
je 0x180003b74
call fcn.180003930
jmp 0x180003b79
call fcn.18000373c
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x180003e68
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x48], 0
mov ebx, ecx
lea rcx, [rsp + 0x58]
mov r9d, Ordinal_26
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180003eec
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180003edf
mov rcx, qword [rsp + 0x50]
and dword [rsp + 0x20], 0
xor r8d, r8d
lea edx, [r8 + 2]
lea r9, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x180003ef8
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x40
and dword [rax + 0x10], 0
mov ebx, ecx
lea rcx, [rax - 0x18]
mov r9d, Ordinal_26
xor r8d, r8d
xor edx, edx
mov dword [rax + 0x18], 4
mov dword [rax - 0x28], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180003f7d
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x180003f70
mov rcx, qword [rsp + 0x68]
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x58]
shr eax, 3
add rsp, 0x40
pop rbx
ret

Function at 0x180003f8c
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x40
and dword [rax + 0x10], 0
mov ebx, ecx
lea rcx, [rax - 0x18]
mov r9d, Ordinal_26
xor r8d, r8d
xor edx, edx
mov dword [rax + 0x18], 4
mov dword [rax - 0x28], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180004011
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x180004004
mov rcx, qword [rsp + 0x68]
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
mov edx, 9
call qword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x58]
shr eax, 3
add rsp, 0x40
pop rbx
ret
Function at 0x180004128
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, qword [rsp + 0xb0]
xor r12d, r12d
mov r15, r8
and qword [r11 - 0x48], r12
lea rax, [r11 - 0x30]
mov r8, rcx
mov rcx, qword [r14]
mov r13d, r9d
mov rbx, rdx
mov qword [r11 - 0x50], rax
and dword [r11 - 0x58], r12d
lea edi, [r12 + 1]
lea r9d, [r12 + 0x10]
mov edx, 0x660e
mov dword [rsp + 0x40], edi
call fcn.18000300c
test eax, eax
je 0x180004280
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
lea edx, [rdi + 3]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x18000425f
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x180004250
lea ecx, [rdi + 0x3f]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, qword [rsp + 0xa0]
mov qword [rbx], rax
mov rdi, rax
test rax, rax
je 0x180004273
mov rbp, qword [rsp + 0xa8]
mov r8d, r13d
mov rdx, r15
mov rcx, rax
mov dword [rbp], r13d
call fcn.180076230
mov rcx, qword [rsp + 0x48]
lea r8d, [r12 + 1]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r12d, eax
test eax, eax
jne 0x180004273
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptDecrypt__0x_08x__n
mov edx, eax
call fcn.180008f6c
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
and dword [rbp], r12d
mov qword [rbx], rax
jmp 0x180004273
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptSetKeyParam__IV___0x_08x__n
jmp 0x18000426c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptSetKeyParam__MODE___0x_08x__n
mov edx, eax
call fcn.180008f6c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x180004294
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___kull_m_crypto_hkey__0x_08x__n
mov edx, eax
call fcn.180008f6c
mov rcx, qword [r14]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x50]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180004384
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
lea rax, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov r12d, r9d
mov r13, r8
mov edi, edx
mov rsi, rcx
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], 1
mov dword [rbp - 0x18], ebx
mov qword [rbp - 0x10], rbx
mov dword [rbp - 8], 1
call fcn.18000e774
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1800044b0
mov r9d, dword [rbp - 0x20]
mov r8, qword [rbp - 0x28]
lea rcx, [rbp - 0x40]
mov rdx, rax
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180004492
mov rcx, qword [rbp - 0x40]
lea rax, [rbp - 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, r12d
mov rdx, r13
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x180004473
lea ecx, [rbx + 2]
mov r9d, 0x2000
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
test rax, rax
je 0x180004467
mov r9, qword [rbp + 0x40]
lea r8, [rbp - 0x30]
mov edx, edi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1800044cc
mov ebx, eax
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x180004487
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptImportKey__0x_08x__n
mov edx, eax
call fcn.180008f6c
mov rcx, qword [rbp - 0x40]
call fcn.180003214
jmp 0x1800044a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptAcquireContext__0x_08x__n
mov edx, eax
call fcn.180008f6c
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x1800049d4
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov dword [rax + 0x10], edx
push rsi
push rdi
push r12
sub rsp, 0x40
mov rdi, qword [rsp + 0x80]
xor esi, esi
mov r12, rcx
and dword [rax - 0x28], esi
mov rcx, qword [rdi]
mov qword [rax - 0x30], r9
and qword [rax - 0x38], rsi
mov rbx, r8
mov rbp, r9
lea r8d, [rsi + 1]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x180004a81
mov edx, dword [rbp]
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180004a81
mov r8d, dword [rsp + 0x68]
mov rdx, r12
mov rcx, rax
call fcn.180076230
mov r11d, dword [rbp]
mov rcx, qword [rdi]
mov dword [rsp + 0x30], r11d
lea rax, [rsp + 0x68]
lea r8d, [rsi + 1]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov esi, eax
test eax, eax
jne 0x180004a81
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov eax, esi
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x180004aa0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r13, rcx
mov ebp, edx
xor edi, edi
lea ecx, [rdi + 0x40]
mov edx, edx
mov r12, r9
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, qword [rsp + 0x70]
mov qword [rbx], rax
test rax, rax
je 0x180004b1c
mov r8d, ebp
mov rdx, r13
mov rcx, rax
call fcn.180076230
mov rax, qword [rbx]
mov rcx, qword [rsi]
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov edi, eax
test eax, eax
jne 0x180004b1c
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x180005b68
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
xor ebx, ebx
mov esi, edx
mov rdi, rcx
mov r12, r8
lea r15d, [rbx + 0x40]
lea rcx, [rsp + 0x50]
lea edx, [rbx + 0x36]
mov r8d, r15d
mov ebp, r9d
call fcn.180079090
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x90]
mov r8d, r15d
call fcn.180079090
test esi, esi
je 0x180005be5
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x90]
mov r8d, esi
sub rcx, rdi
sub rdx, rdi
mov al, byte [rdi]
xor byte [rcx + rdi], al
xor byte [rdx + rdi], al
inc rdi
dec r8
jne 0x180005bd5
lea rdx, [rbp + 0x40]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x180005d0a
lea rdx, [rsp + 0x50]
mov rcx, rax
mov r8, r15
call fcn.180076230
lea rcx, [rsi + 0x40]
mov r8, rbp
mov rdx, r12
call fcn.180076230
lea r8d, [rbp + 0x40]
lea r9, [rsp + 0x30]
mov rdx, rsi
mov ecx, 0x8004
mov dword [rsp + 0x20], Ordinal_26
call fcn.180002e74
test eax, eax
je 0x180005d01
mov ebp, dword [rsp + 0x128]
mov r12d, dword [rsp + 0x138]
mov ecx, r15d
lea rdx, [r12 + rbp + 0x54]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180005d01
lea rdx, [rsp + 0x90]
mov rcx, rax
mov r8, r15
call fcn.180076230
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x120]
mov qword [rdi + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x48], rax
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0x50], eax
test rdx, rdx
je 0x180005cb5
test ebp, ebp
je 0x180005cb5
lea rcx, [rdi + 0x54]
mov r8d, ebp
call fcn.180076230
mov rdx, qword [rsp + reloc.WLDAP32.dll_Ordinal_304]
test rdx, rdx
je 0x180005cd4
test r12d, r12d
je 0x180005cd4
lea rcx, [rbp + rdi + 0x54]
mov r8, r12
call fcn.180076230
mov r9, qword [rsp + 0x140]
lea r8d, [rbp + r12 + 0x54]
mov rdx, rdi
mov ecx, 0x8004
mov dword [rsp + 0x20], Ordinal_26
call fcn.180002e74
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0xd0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180006194
Capabilities:
Encrypt data using dpapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x70
mov r13d, dword [rsp + 0xa0]
xor edi, edi
mov r12, r9
mov rsi, r8
mov dword [rax - 0x18], edx
mov qword [rax - 0x10], rcx
mov dword [rax - 0x28], r13d
mov qword [rax - 0x20], r9
cmp qword [rsp + 0xc8], rdi
je 0x18000628a
cmp dword [rsp + 0xd0], edi
je 0x18000628a
call fcn.180004b40
mov rbx, rax
test rax, rax
je 0x18000630e
mov rax, qword [rsp + 0xc0]
mov r8d, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb8]
mov r9, r12
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xd8]
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call fcn.180005ee4
mov edi, eax
test eax, eax
je 0x18000627d
test rsi, rsi
je 0x18000627d
cmp qword [rbx + 0x30], 0
je 0x18000627d
cmp dword [rbx + 0x2c], 0
je 0x18000627d
mov edx, dword [rbx + 0x2c]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x18000627d
mov r8d, dword [rbx + 0x2c]
mov rdx, qword [rbx + 0x30]
mov rcx, rax
call fcn.180076230
mov rcx, rbx
call fcn.180004c7c
jmp 0x18000630e
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xb0]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa8]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov edi, eax
test eax, eax
je 0x18000630e
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0xc0]
mov ecx, 0x40
mov edx, eax
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0xb8]
mov qword [rcx], rax
test rax, rax
je 0x180006303
mov r8d, dword [rbx]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.180076230
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret