joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b880
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14002b8b0
xor eax, eax
jmp 0x14002b973
mov rbp, rbx
cmp word [rax], si
je 0x14002b8d5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14002b8bc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14002b8b8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140025c94
movsxd r14, eax
test eax, eax
jne 0x14002b913
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14002b8a9
mov rcx, r14
call fcn.140020c04
mov rdi, rax
test rax, rax
jne 0x14002b92c
xor ecx, ecx
call fcn.14001ffec
jmp 0x14002b908
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140025c94
test eax, eax
jne 0x14002b95d
mov rcx, rdi
call fcn.14001ffec
jmp 0x14002b967
xor ecx, ecx
call fcn.14001ffec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14002b990
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002ba17
mov rsi, rbx
cmp word [rax], bp
je 0x14002b9d6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002b9c0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14002b9bc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140020c04
mov rdi, rax
test rax, rax
je 0x14002ba04
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140033c50
mov rbp, rdi
xor ecx, ecx
call fcn.14001ffec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140030d20
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140025a9c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140025a9c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140030e70
cmp rax, 0xffffffffffffffff
je 0x140030e70
xor edi, edi
test rbp, rbp
jle 0x140030e1b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140022ae4
mov rbx, rax
test rax, rax
jne 0x140030da8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140030e11
mov edx, 0x8000
mov ecx, r14d
call fcn.14001e308
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140023658
cmp eax, 0xffffffff
je 0x140030df1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140030db8
mov edx, r15d
mov ecx, r14d
call fcn.14001e308
jmp 0x140030e11
cmp byte [rsi + 0x38], dil
je 0x140030e08
cmp dword [rsi + 0x34], 5
jne 0x140030e08
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140030e11
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ffec
jmp 0x140030e84
jns 0x140030e84
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140025a9c
cmp rax, 0xffffffffffffffff
jne 0x140030e3c
cmp byte [rsi + 0x30], dil
je 0x140030e84
mov edi, dword [rsi + 0x2c]
jmp 0x140030e84
mov ecx, r14d
call fcn.140028230
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140030e84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140030e84
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140030e7d
mov eax, dword [rsi + 0x2c]
jmp 0x140030e82
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140025a9c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140031d1c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400174c8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140031da6
cmp byte [rbp - 0x21], r15b
je 0x140031da1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140031ddc
call fcn.140023f54
test eax, eax
jne 0x140031dc8
cmp byte [rbp - 0x21], r15b
je 0x140031dc0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140031ddc
cmp byte [rbp - 0x21], r15b
je 0x140031dd9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140017714
test eax, eax
jne 0x140031e7c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400174c8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140031e1b
cmp byte [rbp - 0x21], r15b
je 0x140031e50
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140031e50
call fcn.140023f54
test eax, eax
jne 0x140031e3c
cmp byte [rbp - 0x21], r15b
je 0x140031e35
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140031e50
cmp byte [rbp - 0x21], r15b
je 0x140031e4d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140017714
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140031e7c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140031e7f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140031e8d
mov rcx, rdi
call fcn.14001ffec
cmp byte [rbp + 0x3f], r15b
je 0x140031e9c
mov rcx, qword [rbp + 0x27]
call fcn.14001ffec
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140033800
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140033828
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140033828
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001a10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r13, rdx
mov rbx, rcx
lea edx, [r15 + 0x41]
mov r14d, r9d
mov r12d, r8d
lea ecx, [rdx - 1]
mov esi, r15d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
cmp rax, r15
je 0x140001b33
lea ebp, [r15 + 7]
cmp r12d, ebp
jb 0x140001a72
lea rcx, str.PA7LB_kull_m_busylight_request_create___count_u__max_is_7__n
mov edx, r12d
call fcn.14000c030
cmp r12d, ebp
cmovb ebp, r12d
mov esi, 1
cmp ebp, r15d
jbe 0x140001ade
mov r8, rdi
lea r9, [rdi + 3]
lea rdx, [r13 + 1]
sub r8, r13
mov r10d, ebp
mov al, byte [rdx - 1]
movzx ecx, al
test al, 0xf0
jne 0x140001a9e
or ecx, 0x10
mov byte [r8 + rdx], cl
mov al, byte [rdx]
add rdx, 8
mov byte [r9 - 1], al
mov al, byte [rdx - 7]
mov byte [r9], al
mov al, byte [rdx - 6]
add r9, 8
sub r10, rsi
mov byte [r9 - 7], al
mov al, byte [rdx - 5]
mov byte [r9 - 6], al
mov al, byte [rdx - 4]
mov byte [r9 - 5], al
mov al, byte [rdx - 3]
mov byte [r9 - 4], al
mov al, byte [rdx - 2]
mov byte [r9 - 3], al
jne 0x140001a91
mov r9d, 0xff
mov byte [rdi + 0x39], 4
mov byte [rdi + 0x3a], 4
mov byte [rdi + 0x3b], 0x55
movzx ecx, r15w
lea rdx, [rdi + 1]
mov byte [rdi + 0x3e], r9b
mov byte [rdi + 0x3d], r9b
mov byte [rdi + 0x3c], r9b
mov r8d, 0x3e
movzx eax, byte [rdx]
add rdx, rsi
add cx, ax
sub r8, rsi
jne 0x140001b0a
movzx eax, cx
shr ax, 8
mov byte [rdi + 0x3f], al
movzx eax, cx
cdq
and edx, r9d
add eax, edx
and eax, r9d
sub eax, edx
mov byte [rdi + 0x40], al
cmp esi, r15d
je 0x140001bdd
jmp 0x140001bcb
mov ebp, r15d
cmp rbx, r15
je 0x140001bad
mov rcx, qword [rbx + 0x78]
cmp rcx, r15
je 0x140001bad
cmp rcx, 0xffffffffffffffff
je 0x140001bad
movzx r9d, word [rbx + 0x2a]
mov r8d, 0x41
cmp r9d, r8d
jb 0x140001b9c
lea r9, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
cmp eax, r15d
jne 0x140001bbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbx + 8]
lea rcx, str.PA7LB_kull_m_busylight_device_send_raw____device__u__WriteFile__0x_08x__n
mov r8d, eax
call fcn.14000c030
jmp 0x140001bbc
mov edx, dword [rbx + 8]
lea rcx, str.PA7LB_kull_m_busylight_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.14000c030
jmp 0x140001bbc
mov edx, dword [rbx + 8]
lea rcx, str.PA7LB_kull_m_busylight_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000c030
and esi, ebp
cmp r14d, r15d
je 0x140001bc8
mov rbx, qword [rbx]
jmp 0x140001bcb
mov rbx, r15
cmp rbx, r15
jne 0x140001b41
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001c00
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
mov byte [rax + 8], 0
mov byte [rax + 9], 0
mov byte [rax + 0xa], 0
mov byte [rax + 0xb], 0
mov byte [rax + 0xc], 0
mov byte [rax + 0xd], 0
mov byte [rax + 0xe], 0
mov byte [rax + 0xf], 0x80
mov rbx, rcx
test rcx, rcx
je 0x140001c70
mov rcx, qword [rbx + 0x98]
and dword [rbx + 0x90], 0
test rcx, rcx
je 0x140001c60
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rbx + 0x98], 0
test esi, esi
je 0x140001c69
mov rbx, qword [rbx]
jmp 0x140001c6b
xor ebx, ebx
test rbx, rbx
jne 0x140001c3d
lea rdx, [rsp + 0x30]
mov r9d, esi
mov r8d, 1
mov rcx, rdi
call fcn.140001a10
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140002104
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
mov r12, rcx
mov edx, 0x338
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400022d5
and dword [rbx + 0x1c], 0
and dword [rbx + 0x20], 0
lea rbp, [rax + 8]
mov eax, 0x4000000
mov r8, r12
xor edx, edx
mov dword [rbp], eax
mov dword [rbx + 0xc], eax
mov eax, 0x2a
mov rcx, rbp
mov word [rbx + 0x28], ax
call fcn.140001f8c
test eax, eax
je 0x1400022b7
mov edi, 0x100
lea rdx, [rbx + 0x22a]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1400022c3
mov rax, rdi
lea rcx, [rbx + 0x22a]
cmp byte [rcx], 0
je 0x1400021a5
inc rcx
sub rax, 1
jne 0x140002197
test rax, rax
je 0x1400022c3
mov rcx, rdi
mov r9d, 0
sub rcx, rax
sub rdi, rcx
lea rax, [rcx + rbx + 0x22a]
je 0x1400021f9
lea r8, [0x1400e1388]
lea rcx, [rdi + rcx + 0x7ffffeff]
sub r8, rax
test rcx, rcx
je 0x1400021f4
mov dl, byte [r8 + rax]
test dl, dl
je 0x1400021f4
mov byte [rax], dl
dec rcx
inc rax
sub rdi, 1
jne 0x1400021d9
test rdi, rdi
jne 0x140002202
dec rax
mov r9d, 0x8007007a
mov byte [rax], 0
test r9d, r9d
js 0x1400022c3
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], rbp
lea rax, [0x140001eb0]
mov qword [rsp + 0x50], rax
lea rax, [0x140001e7c]
lea r9, [0x140001d10]
mov qword [rsp + 0x48], rax
lea rax, [0x140001e44]
lea r8, [0x140001d00]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140001e10]
lea rdx, [fcn.140016720]
mov qword [rsp + 0x38], rax
lea rax, [0x140001dd8]
lea rcx, [rbx + 0x32c]
mov qword [rsp + 0x30], rax
lea rax, [0x140001da0]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140001d18]
mov qword [rsp + 0x20], rax
call sub.Cabinet.dll_FCICreate
mov qword [rbx], rax
test rax, rax
jne 0x1400022d5
mov ecx, dword [rbx + 0x32c]
call fcn.140002088
mov edx, dword [rbx + 0x32c]
lea rcx, str.PA7LB_kull_m_cabinet_create___FCICreate_failed_with_error_code__d:__S_n
mov r8, rax
call fcn.14000c030
jmp 0x1400022c3
lea rcx, str.PA7LB_kull_m_cabinet_create___Failed_to_initialize_the_cabinet_information_structure._n
call fcn.14000c030
cmp qword [rbx], 0
jne 0x1400022d5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140003970
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
xor ebx, ebx
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov edi, ecx
cmp ecx, 0x8000
jne 0x140003a0c
cmp dword [rsp + 0x90], 4
jne 0x140003aff
lea rdx, [rsp + 0x30]
mov ecx, 0xffffff7c
call sub.cryptdll.dll_CDLocateCheckSum
cmp eax, ebx
jl 0x140003aff
mov rax, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [rax + 0x10]
cmp eax, ebx
jl 0x140003aff
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov r8, rbp
mov edx, esi
call qword [rax + 0x18]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, r12
call qword [rax + 0x20]
lea rcx, [rsp + 0x40]
cmp eax, ebx
mov rax, qword [rsp + 0x30]
setge bl
call qword [rax + 0x28]
jmp 0x140003aff
lea rcx, [rsp + 0x48]
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, ebx
je 0x140003aff
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, ebx
je 0x140003af2
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, ebx
je 0x140003ae7
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
lea r9, [rsp + 0x70]
lea esi, [r8 + 2]
mov dword [rsp + 0x20], ebx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, ebx
je 0x140003ae7
mov edx, dword [rsp + 0x70]
lea ecx, [rsi + 0x3e]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
cmp rax, rbx
je 0x140003ae7
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x70]
mov r8, rax
mov edx, esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rsp + 0x90]
mov rdx, rdi
cmp dword [rsp + 0x70], ecx
mov ebx, eax
cmovb ecx, dword [rsp + 0x70]
mov r8d, ecx
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140003b18
Capabilities:
Encrypt data using des via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r14, rcx
mov esi, r9d
mov ecx, 0x6603
xor ebx, ebx
mov r12, r8
mov r13d, edx
lea ebp, [rsi + 0xc]
cmp edx, ecx
je 0x140003bb8
lea ecx, [rbx + 0x40]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
cmp rax, rbx
je 0x140003be6
lea rcx, [rax + 0xc]
mov r8, rsi
mov rdx, r12
mov byte [rax], 8
mov byte [rax + 1], 2
mov word [rax + 2], bx
mov dword [rax + 4], r13d
mov dword [rax + 8], esi
call sub.msvcrt.dll_memcpy
mov r11, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], r11
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140003be6
mov rax, qword [rsp + 0x80]
cmp rax, rbx
je 0x140003be6
mov r9d, dword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov r8d, esi
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.140004704
mov ebx, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop r13
pop r12
ret

Function at 0x140003c08
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x150
xor edi, edi
cmp r8d, dword [rsp + 0x190]
mov r12, r9
setae dil
mov ebx, r8d
mov rsi, rdx
mov r13d, ecx
test edi, edi
je 0x140003c52
mov r8d, dword [rsp + 0x190]
mov rcx, r9
jmp 0x140003d04
mov r14d, 0x40
lea rcx, [rsp + 0x70]
lea edx, [r14 - 0xa]
mov r8, r14
call sub.msvcrt.dll_memset
lea edx, [r14 + 0x1c]
lea rcx, [rsp + 0x30]
mov r8, r14
call sub.msvcrt.dll_memset
test ebx, ebx
je 0x140003ca2
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov r8, rbx
sub rcx, rsi
sub rdx, rsi
mov al, byte [rsi]
xor byte [rcx + rsi], al
xor byte [rdx + rsi], al
inc rsi
sub r8, 1
jne 0x140003c91
lea r9, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
mov r8d, r14d
mov ecx, r13d
mov dword [rsp + 0x20], ebx
call fcn.140003970
test eax, eax
je 0x140003d09
lea r9, [rsp + rbx + 0xb0]
lea rdx, [rsp + 0x30]
mov r8d, r14d
mov ecx, r13d
mov dword [rsp + 0x20], ebx
call fcn.140003970
mov edi, eax
test eax, eax
je 0x140003d09
lea ecx, [rbx + rbx]
lea rdx, [rsp + 0xb0]
cmp dword [rsp + 0x190], ecx
cmovb ecx, dword [rsp + 0x190]
mov r8d, ecx
mov rcx, r12
call sub.msvcrt.dll_memcpy
lea r11, [rsp + 0x150]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140003e0c
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x80
xor ebx, ebx
mov rbp, r9
mov dword [rax - 0x30], ecx
mov edi, r8d
mov rsi, rdx
lea rcx, [rax - 0x40]
lea r9d, [rbx + 0x18]
xor r8d, r8d
xor edx, edx
mov qword [rax - 0x28], rbx
mov dword [rax - 0x20], ebx
mov qword [rax - 0x18], rbx
mov dword [rax - 0x10], ebx
mov dword [rax - 0x68], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, ebx
je 0x140003fac
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov r9d, edi
mov r8, rsi
mov edx, 0x6602
mov dword [rsp + 0x20], 0x100
call fcn.140003b18
cmp eax, ebx
je 0x140003f9f
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, ebx
je 0x140003f94
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x58]
lea edx, [rbx + 5]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
cmp eax, ebx
je 0x140003f89
mov r8d, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, ebx
je 0x140003f89
mov rcx, qword [rsp + 0x40]
lea esi, [rbx + 2]
lea r9, [rsp + 0x90]
mov edx, esi
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, ebx
je 0x140003f89
mov edx, dword [rsp + 0x90]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
cmp rax, rbx
je 0x140003f89
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x90]
mov r8, rax
mov edx, esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [rsp + 0xc0]
mov rdx, rdi
cmp dword [rsp + 0x90], ecx
mov ebx, eax
cmovb ecx, dword [rsp + 0x90]
mov r8d, ecx
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140004270
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor ebp, ebp
mov rdi, r9
mov ebx, r8d
lea r15d, [rbp + 0x10]
mov r12, rdx
mov rsi, rcx
cmp r8d, r15d
jbe 0x140004436
lea r9, [rax - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x140004465
lea edx, [rbp + 1]
xor r9d, r9d
mov r8, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140004429
lea edi, [rbx + 0xf]
mov r13d, r15d
shr edi, 4
and ebx, 0xf
cmovne r13d, ebx
cmp edi, 2
jbe 0x140004325
lea eax, [rdi - 2]
xor r9d, r9d
xor r8d, r8d
shl eax, 4
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0xa0], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140004429
lea eax, [r13 + 0x10]
lea r14d, [rdi - 2]
lea rcx, [rsp + 0x40]
shl r14d, 4
mov r8d, eax
mov ebx, eax
add r14, r12
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov r11d, r15d
lea rax, [rsp + rbx + 0x40]
sub r11d, r13d
xor edx, edx
mov rcx, rax
mov r8d, r11d
mov r15d, r11d
mov qword [rsp + 0x38], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov ebx, 0x10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xa0], ebx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140004429
lea rdx, [rsp + 0x40]
mov r9, rbx
mov al, byte [rdx + 0x10]
xor byte [rdx], al
inc rdx
sub r9, 1
jne 0x1400043ac
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + r13 + 0x40]
mov r8, r15
mov ebx, r13d
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xa0], 0x10
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ebp, eax
test eax, eax
je 0x140004429
movdqu xmm0, xmmword [rsp + 0x50]
shl edi, 4
lea rdx, [rsp + 0x40]
lea ecx, [rdi - 0x10]
mov r8, rbx
add rcx, r12
movdqu xmmword [r14], xmm0
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x140004465
cmp ebx, r15d
jne 0x140004465
lea rax, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0xa0], r15d
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ebp, eax
lea r11, [rsp + 0x60]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret