joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b71a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004b6f0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x14004b7b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14004b80a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004b800
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x14004e000
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x14004e120
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004e120
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x14004e1c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14004e260
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004e260
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret
Function at 0x14004e2e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14004e320
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004e320
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x14004e720
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x14004e820
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004e820
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x14004e8c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14004e960
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004e960
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x14004e9e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x14004ea20
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004ea20
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x14004f490
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.14004f500
shl edx, 4
test eax, eax
jne 0x14004f4f6
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14004f4bb
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x1400505c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1400506e0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140050620
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140050620
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140050620
Function at 0x140076200
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140076235
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140076210
and r10, 0xf
je 0x140076265
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140076240
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140076259
mov rax, r8
repz ret

Function at 0x140076270
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400762ad
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140076280
pxor xmm1, xmm1
and r10, 0xf
je 0x1400762e3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x1400762bb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x1400762d7
mov rax, r8
repz ret
Function at 0x14007be90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007bf08
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14007bf08
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14007bef5
nop
cmp rbx, rcx
jae 0x14007bf08
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14007bee0
cmp rbx, rcx
jae 0x14007bf08
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x14007bf0a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14007c340
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp qword [rcx + 8], 0
mov rbx, rcx
mov qword [r11 + 0x18], rbp
mov rbp, rdx
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r14
mov dword [rcx + 0x20], 1
jne 0x14007c3a1
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
add rcx, 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov dword [rbx + 0x20], eax
xor edi, edi
cmp dword [rbx + 0x20], edi
je 0x14007c499
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14007c3c2
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [rbx + 0x20], eax
mov qword [rbx + 0x10], rdi
cmp dword [rbx + 0x20], edi
je 0x14007c499
cmp qword [rbx + 0x10], rdi
lea rax, [rbx + 0x10]
jne 0x14007c3f2
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov dword [rbx + 0x20], eax
cmp dword [rbx + 0x20], edi
je 0x14007c499
mov qword [rsp + 0xe8], rsi
mov rsi, 0xffffffffffffffff
test rbp, rbp
jne 0x14007c472
mov r8, qword [rbx + 0x30]
lea edx, [rsi + 0x65]
lea rcx, [rsp + 0x30]
call fcn.1402a9190
lea rcx, [rsp + 0x30]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x14007c430
dec eax
movsxd r8, eax
test eax, eax
jle 0x14007c46d
lea rdx, [rsp + 0x30]
add rdx, r8
nop word [rax + rax]
movzx eax, byte [rsp + rdi + 0x30]
movzx ecx, byte [rdx]
lea rdx, [rdx - 1]
add al, 5
mov byte [rdx + 1], al
mov byte [rsp + rdi + 0x30], cl
inc rdi
cmp rdi, r8
jl 0x14007c450
lea rbp, [rsp + 0x34]
inc rsi
cmp byte [rsi + rbp], 0
jne 0x14007c472
mov rcx, qword [rbx + 0x10]
mov r8, rsi
xor r9d, r9d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rsi, qword [rsp + 0xe8]
mov dword [rbx + 0x20], eax
cmp dword [rbx + 0x20], 0
mov rdi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xe0]
je 0x14007c4d4
mov r8, qword [rbx + 0x10]
lea rax, [rbx + 0x18]
mov rcx, qword [rbx + 8]
mov r9d, 1
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov dword [rbx + 0x20], eax
cmp dword [rbx + 0x20], 0
mov r14, qword [rsp + 0xb0]
jne 0x14007c4fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x24], eax
lea rdx, str.Error_creating_encryption_key
call fcn.14007cb00
mov eax, dword [rbx + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400adbc0
add rsp, 0xc0
pop rbx
ret
Function at 0x14007c520
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, r9
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x40], 0
mov dword [rcx + 0x20], 1
xor eax, eax
mov qword [rdx], rax
call fcn.14007bff0
mov rcx, rax
test rax, rax
je 0x14007c6f2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rdx, [0x140395336]
mov rcx, rdi
cmp rdx, 0x10000
jae 0x14007c59c
movzx edx, dx
call fcn.14007ccd0
jmp 0x14007c5a2
call fcn.14007cb00
nop
mov dword [rsp + 0x40], 1
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp byte [rax + rbp], 0
jne 0x14007c5b4
mov dword [rsp + 0x58], eax
lea r14, [rbx + 0x18]
test r15, r15
jne 0x14007c5cf
cmp qword [r14], r15
jne 0x14007c5e1
mov rdx, r15
mov rcx, rbx
call fcn.14007c340
mov dword [rbx + 0x20], eax
mov eax, dword [rsp + 0x58]
cmp dword [rbx + 0x20], 0
je 0x14007c6d5
lea ecx, [rax + 1]
call fcn.1400ae0d0
mov r15, rax
mov ecx, dword [rsp + 0x58]
inc ecx
mov edx, ecx
mov r9d, ecx
mov r8, rbp
mov rcx, rax
call fcn.1402a8c84
mov edx, dword [rsp + 0x58]
mov dword [rsp + 0x30], edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov dword [rbx + 0x20], eax
test eax, eax
je 0x14007c6c8
mov r9d, dword [rsp + 0x58]
mov r8, r15
lea rdx, [rsp + 0x48]
call fcn.14007c900
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rdi]
sub rbx, 0x18
cmp rcx, rbx
je 0x14007c6ab
cmp dword [rbx + 0x10], 0
jl 0x14007c69e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007c69e
call fcn.14007ce50
mov rbp, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14007c695
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.WS2_32.dll_htonl + 8]
lea rax, [rbp + 0x18]
mov qword [rdi], rax
jmp 0x14007c6ab
mov r8d, dword [rdx - 0x10]
mov rcx, rdi
call fcn.14007cf00
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14007c6c8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov edx, 1
mov rcx, r15
call fcn.1400ae0c8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400adbc0
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.14007be50
int3
Function at 0x14007c700
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, r9
mov r14, r8
mov r12, rdx
mov qword [rsp + 0x40], rdx
mov r13, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov dword [rcx + 0x20], 1
xor eax, eax
mov qword [rdx], rax
call fcn.14007bff0
mov rcx, rax
test rax, rax
je 0x14007c8e8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r12], rax
lea rdx, [0x140395336]
mov rcx, r12
cmp rdx, 0x10000
jae 0x14007c78b
movzx edx, dx
call fcn.14007ccd0
jmp 0x14007c791
call fcn.14007cb00
nop
mov dword [rsp + 0x30], 1
mov rsi, 0xffffffffffffffff
mov rbx, rsi
inc rbx
cmp byte [r14 + rbx], 0
jne 0x14007c7a3
test rdi, rdi
jne 0x14007c7b8
cmp qword [r13 + 0x18], rdi
jne 0x14007c7c7
mov rdx, rdi
mov rcx, r13
call fcn.14007c340
mov dword [r13 + 0x20], eax
cmp dword [r13 + 0x20], 0
je 0x14007c8c7
shr ebx, 1
mov dword [rsp + 0x60], ebx
lea ecx, [rbx + 1]
call fcn.1400ae0d0
mov rbx, rax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x60]
nop dword [rax]
inc rsi
cmp byte [r14 + rsi], 0
jne 0x14007c7f0
mov byte [rbx], 0
mov ebp, r15d
test esi, esi
jle 0x14007c885
mov r12, rbx
mov r13d, eax
nop
movsx ecx, byte [r14]
call fcn.1402a8c58
mov edi, eax
lea ebx, [rax - 0x30]
movsx ecx, byte [r14 + 1]
lea r14, [r14 + 2]
call fcn.1402a8c58
lea edx, [rax - 0x30]
mov ecx, reloc.WS2_32.dll_getservbyname
cmp bl, 9
mov r8d, gethostbyaddr
cmovbe ecx, r8d
sub dil, cl
shl dil, 4
mov ecx, reloc.WS2_32.dll_getservbyname
cmp dl, 9
cmovbe ecx, r8d
sub al, cl
or dil, al
mov byte [r12], dil
lea r12, [r12 + 1]
mov byte [r12], 0
cmp r15d, r13d
jge 0x14007c876
inc r15d
add ebp, 2
cmp ebp, esi
jl 0x14007c810
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov dword [r13 + 0x20], eax
test eax, eax
je 0x14007c8ba
mov rdx, rbx
mov rcx, r12
call fcn.14007cb00
mov edx, 1
mov rcx, rbx
call fcn.1400ae0c8
mov rax, r12
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400adbc0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.14007be50
int3
Function at 0x1400844f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140084512
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14008458c
mov rdi, r14
mov rcx, rbx
call fcn.140088810
test rax, rax
jle 0x140084564
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14029ddb0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14008457c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_getservbyport]
cmp eax, 0xffffffff
je 0x140084584
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140084526
sub r14, rdi
jmp 0x14008466f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400845a3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400845a5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400845d7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14029ddb0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14008466c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140084612
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14008464d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1402af310
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14008466c
cmp rbp, rax
ja 0x140084620
test rbp, rbp
je 0x14008466c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1402af310
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret