joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d7d7490
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d7d74a0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d7d74b0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d7d74f1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d7d74e8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d7d74f3
add rax, 0x28
cmp rax, r9
jne 0x6d7d74d4
xor eax, eax
ret

Function at 0x6d7d7590
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f41f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d7d75fd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d75fd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d75fd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d75f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d75ff
add rax, 0x28
cmp rax, r9
jne 0x6d7d75e0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d7d7700
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f41f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d7d7720
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d7718
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d777d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d7774
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d7784
add rax, 0x28
cmp rax, r9
jne 0x6d7d7760
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d7d77a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d7f41f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d7d780e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d780e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d7d780e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d7d780e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d7d7805
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d7d7815
add rcx, 0x28
cmp rcx, rax
jne 0x6d7d77f0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d7d7828
jmp 0x6d7d780e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d7d7836
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d7d780e
test r9d, r9d
jg 0x6d7d7820
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d7d7b70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push rdi
sub rsp, 0x80
mov rdi, rcx
test rcx, rcx
je 0x140001270
xor r8d, r8d
mov qword [rsp + 0x78], rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
je 0x14000125d
mov edx, ebx
mov qword [rsp + 0x50], r14
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x14000106b
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp ebx, eax
je 0x140001074
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, rax
test r14, r14
je 0x140001245
movzx eax, word [r14]
cmp ax, 0x21
je 0x14000109b
cmp ax, 0x2a
je 0x14000108b
xor ebx, ebx
jmp 0x140001227
lea rcx, [r14 + 2]
call fcn.140003280
mov ebx, eax
jmp 0x140001227
mov qword [rsp + 0x70], rbp
lea rdx, [rsp + 0x90]
xor ebx, ebx
mov qword [rsp + 0x60], r12
lea rcx, [r14 + 2]
mov qword [rsp + 0x58], r13
mov ebp, ebx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov r13d, ebx
test rax, rax
je 0x140001216
cmp dword [rsp + 0x90], ebx
jle 0x140001216
mov qword [rsp + 0x68], rsi
movzx edi, bx
mov qword [rsp + 0x48], r15
lea rcx, [0x14005f430]
mov ebp, ebx
cmp di, 0x13
jae 0x1400011a8
movzx esi, di
shl rsi, 5
mov rdx, qword [rsi + rcx + 0x10]
mov rcx, qword [rax]
call fcn.140035f94
test eax, eax
mov r13d, ebx
mov r15d, eax
sete r13b
test eax, eax
jne 0x14000116a
lea rdx, [0x14005f430]
mov rax, qword [rsi + rdx]
test rax, rax
jne 0x14000118f
mov edx, dword [rsi + rdx + 8]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xa0], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.140007010
test eax, eax
jne 0x14000117f
inc di
test r15d, r15d
je 0x1400011a8
mov rax, qword [rsp + 0xa8]
jmp 0x1400010ee
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400011a8
mov ecx, dword [rsp + 0x90]
mov rdx, qword [rsp + 0xa8]
add rdx, 8
dec ecx
call rax
mov ebp, eax
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x68]
test r13d, r13d
jne 0x140001216
mov r9, 0xffffffffffffffff
nop
cmp word [r14 + r9*2 + 4], bx
lea r9, [r9 + 1]
jne 0x1400011c0
lea rax, [rsp + 0x98]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x28], rax
lea r9d, [r9*2 + 2]
lea rax, [rsp + 0xa0]
mov edx, 0x22c003
lea r8, [r14 + 2]
mov qword [rsp + 0x20], rax
call fcn.140007010
test eax, eax
je 0x140001216
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r13, qword [rsp + 0x58]
mov ebx, ebp
mov rbp, qword [rsp + 0x70]
mov r12, qword [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x80
pop rdi
ret
mov r14, qword [rsp + 0x50]
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x78]
add rsp, 0x80
pop rdi
ret
mov rbx, qword [rsp + 0x78]
mov eax, 0xc0000001
add rsp, 0x80
pop rdi
ret
mov eax, 0xc0000001
add rsp, 0x80
pop rdi
ret
Function at 0x140001280
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, dword [0x140078eb0]
call fcn.140001320
xor edx, edx
lea rcx, [0x140001310]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov ecx, 1
call fcn.14003ca88
mov rcx, rax
call fcn.14003cd34
mov edx, dword [0x140078e58]
mov ecx, eax
call fcn.14003cb50
mov ecx, 2
call fcn.14003ca88
mov rcx, rax
call fcn.14003cd34
mov edx, dword [0x140078e50]
mov ecx, eax
call fcn.14003cb50
mov ecx, dword [0x140078e54]
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor ecx, ecx
cmp ebx, 0xc000004b
jne 0x1400012fb
call qword [sym.imp.KERNEL32.dll_ExitThread]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140003280
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x60
mov r14, rcx
xor ebx, ebx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax*2 + 2]
mov dword [rsp + 0x98], ebx
cmp qword [0x140078ea8], rbx
je 0x140003487
cmp qword [0x140078e68], rbx
je 0x140003487
mov dword [rsp + 0x90], edx
mov rax, qword [0x140078e60]
mov rcx, qword [rax + 0x20]
mov esi, ebx
mov edi, ebx
mov dword [rsp + 0x88], edx
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x1400033a1
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
lea r8d, [rbx + 1]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140003396
mov edx, dword [rsp + 0x88]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140003396
mov r8d, dword [rsp + 0x90]
mov rdx, r14
mov rcx, rax
call fcn.140033fa0
mov ecx, dword [rsp + 0x88]
mov dword [rsp + 0x30], ecx
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor edx, edx
lea r8d, [rbx + 1]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov esi, eax
test eax, eax
jne 0x140003396
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test esi, esi
je 0x140003487
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, dword [rsp + 0x88]
mov r8, qword [0x140078e68]
lea rdx, [0x140060b74]
lea rcx, [0x140060a50]
call qword [sym.imp.RPCRT4.dll_NdrClientCall2]
mov qword [rsp + 0x90], rax
mov r8d, dword [rsp + 0x98]
test r8d, r8d
je 0x140003469
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140003469
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
mov rcx, qword [0x140078e60]
mov rcx, qword [rcx + 0x20]
call fcn.14000b0f0
test eax, eax
je 0x140003459
mov dword [rsp + 0x44], ebx
mov ecx, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x90]
nop dword [rax]
mov eax, ecx
shr eax, 1
cmp ebx, eax
jae 0x140003459
mov eax, ebx
cmp word [rdx + rax*2], 0
je 0x140003459
inc ebx
mov dword [rsp + 0x44], ebx
jmp 0x140003440
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003469
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140003487
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
Function at 0x140006a40
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
cmp dword [0x140078ae8], ebx
mov esi, r8d
mov rbp, rdx
mov dword [rsp + 0x68], ebx
je 0x140006ad1
lea rax, [rsp + 0x68]
mov edx, esi
lea r8d, [rbx + 1]
mov qword [rsp + 0x20], rax
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x140006b34
mov edx, dword [rsp + 0x68]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140006b34
lea rax, [rsp + 0x68]
mov r9, rdi
lea r8d, [rbx + 1]
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140006b34
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140006b34
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140006b2b
cmp esi, dword [rsp + 0x68]
jne 0x140006b2b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140006b50
Capabilities:
Decode data using base64 via winapi
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
xor r9d, r9d
cmp dword [0x140078aec], ebx
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x30], rbx
mov rbp, rcx
je 0x140006bf6
mov qword [rdx], rbx
xor edx, edx
mov dword [r8], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r8
lea r8d, [rbx + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x140006c92
mov edx, dword [rsi]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x140006c92
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov qword [rsp + 0x28], rbx
mov r9, rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov ebx, eax
test eax, eax
jne 0x140006c92
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
jmp 0x140006c92
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140006c92
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140006c89
cmp dword [rsp + 0x44], ebx
jne 0x140006c89
mov rax, qword [rsp + 0x40]
mov ecx, 0x40
mov edx, eax
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x140006c89
mov r8d, dword [rsi]
lea r9, [rsp + 0x78]
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006c80
mov eax, dword [rsp + 0x78]
cmp dword [rsi], eax
jne 0x140006c80
mov ebx, 1
jmp 0x140006c89
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140006d30
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
xor ebx, ebx
lea rdx, str.ServicesActive
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140006da2
lea r8d, [rbx + 0x20]
mov qword [rsp + 0x50], rdi
lea rdx, str.mimidrv
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140006d94
lea r8, [rsp + 0x20]
mov rcx, rax
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x140009bf0
Capabilities:
Get domain controller name

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
or edx, 0x40020000
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rsi, r8
mov dword [rsp + 0x20], edx
xor ebx, ebx
mov rdx, rcx
mov qword [rsp + 0x58], rbx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x140009c96
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rdi
mov rcx, qword [rax]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 6], bx
lea rax, [rax + 1]
jne 0x140009c41
lea eax, [rax*2 + 2]
mov ecx, 0x40
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140009c86
mov rcx, qword [rsp + 0x58]
mov r8d, edi
mov ebx, 1
mov rdx, qword [rcx]
mov rcx, rax
add rdx, 4
call fcn.140033fa0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov rdi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
Function at 0x140009cb0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebx, ebx
mov r14, r9
mov esi, r8d
mov rbp, rdx
mov edi, ecx
cmp ecx, 0x8000
jne 0x140009d4f
cmp dword [rsp + 0x90], 4
jne 0x140009e45
lea rdx, [rsp + 0x30]
mov ecx, 0xffffff7c
call qword [sym.imp.cryptdll.dll_CDLocateCheckSum]
test eax, eax
js 0x140009e45
mov rax, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [rax + 0x10]
test eax, eax
js 0x140009e45
mov rax, qword [rsp + 0x30]
mov r8, rbp
mov rcx, qword [rsp + 0x40]
mov edx, esi
call qword [rax + Ordinal_26]
mov rax, qword [rsp + 0x30]
mov rdx, r14
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x20]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov ebx, eax
not ebx
shr ebx, 0x1f
call qword [rdx + Ordinal_41]
jmp 0x140009e45
mov r9d, Ordinal_26
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140009e45
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140009e38
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140009e2d
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140009e2d
mov edx, dword [rsp + 0x70]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140009e2d
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x70]
mov r8, rax
mov dword [rsp + 0x20], ebx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [rsp + 0x90]
mov rcx, r14
cmp dword [rsp + 0x70], edx
mov ebx, eax
cmovb edx, dword [rsp + 0x70]
mov r8d, edx
mov rdx, rdi
call fcn.140033fa0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbp, qword [rsp + 0x80]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140009ff0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
push rbx
push rdi
push r12
push r14
sub rsp, 0x78
xor edi, edi
mov ebx, r8d
mov r14, r9
mov dword [rax - 0x50], ecx
mov r12, rdx
mov qword [rax - 0x48], rdi
xor r8d, r8d
mov dword [rax - 0x40], edi
lea r9d, [rdi + 0x18]
mov qword [rax - 0x38], rdi
xor edx, edx
mov dword [rax - 0x30], edi
lea rcx, [rax - 0x60]
mov dword [rax - 0x78], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000a1f0
mov qword [rsp + 0xa8], rbp
lea ecx, [rdi + 0x40]
lea ebp, [rbx + 0xc]
mov qword [rsp + 0xb0], rsi
mov edx, ebp
mov qword [rsp + 0x70], r15
mov r15, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000a1ce
mov r8d, ebx
mov dword [rax], 0x208
lea rcx, [rax + 0xc]
mov dword [rax + 4], 0x6602
mov rdx, r12
mov dword [rax + 8], ebx
call fcn.140033fa0
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov rdx, rsi
mov dword [rsp + 0x20], 0x100
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14000a1ce
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000a1c3
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
xor r9d, r9d
lea edx, [rdi + 5]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x14000a1b8
mov r8d, dword [rsp + 0xc0]
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000a1b8
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0xa0]
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea edx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000a1b8
mov edx, dword [rsp + 0xa0]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000a1b8
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0xa0]
mov r8, rax
mov dword [rsp + 0x20], edi
lea edx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [rsp + 0xd0]
mov edi, eax
cmp dword [rsp + 0xa0], edx
mov rcx, qword [rsp + 0xc8]
cmovb edx, dword [rsp + 0xa0]
mov r8d, edx
mov rdx, rbx
call fcn.140033fa0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov eax, edi
add rsp, 0x78
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x14000a490
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x60
xor ebp, ebp
mov rdi, r9
mov ebx, r8d
mov r15, rdx
mov r14, rcx
cmp r8d, 0x10
jbe 0x14000a681
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x14000a673
xor r9d, r9d
lea edx, [rbp + 1]
mov r8, rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000a668
mov qword [rsp + 0x90], rsi
lea esi, [rbx + 0xf]
shr esi, 4
and ebx, 0xf
mov qword [rsp + 0xa8], r13
mov r13d, 0x10
mov edi, esi
cmovne r13d, ebx
shl edi, 4
cmp esi, 2
jbe 0x14000a548
lea eax, [rdi - 0x20]
xor r9d, r9d
mov dword [rsp + 0xa0], eax
xor r8d, r8d
lea rax, [rsp + 0xa0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000a658
lea eax, [r13 + 0x10]
mov qword [rsp + 0x98], r12
add esi, 0xfffffffe
mov r8d, eax
shl esi, 4
lea rcx, [rsp + 0x40]
add rsi, r15
mov ebx, eax
mov rdx, rsi
call fcn.140033fa0
mov r12d, 0x10
lea rax, [rsp + 0x40]
add rax, rbx
sub r12d, r13d
mov rcx, rax
mov qword [rsp + 0x38], rax
mov r8d, r12d
xor edx, edx
call fcn.1400330d0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0xa0], Ordinal_26
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000a650
movdqu xmm1, xmmword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
movdqu xmm0, xmmword [rsp + 0x50]
mov ebx, r13d
mov r8d, r12d
add rdx, rbx
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140033fa0
lea rax, [rsp + 0xa0]
mov dword [rsp + 0xa0], Ordinal_26
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ebp, eax
test eax, eax
je 0x14000a650
movups xmm0, xmmword [rsp + 0x50]
lea ecx, [rdi - 0x10]
mov r8d, ebx
add rcx, r15
lea rdx, [rsp + 0x40]
movups xmmword [rsi], xmm0
call fcn.140033fa0
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r13, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, ebp
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
jne 0x14000a673
lea rax, [rsp + 0xa0]
mov dword [rsp + 0xa0], Ordinal_26
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret