joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f62c
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov ebp, r8d
mov rsi, rdx
mov ebx, 0x80004005
test rdx, rdx
je 0x14001f6ff
test r9, r9
je 0x14001f6ff
mov rcx, qword [rcx]
and qword [r11 - 0x18], 0
lea rax, [r11 - 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14001f6eb
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14001f6ca
mov rcx, qword [rsp + 0x30]
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x58], 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14001f6ca
xor ebx, ebx
jmp 0x14001f6de
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x14001f6ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001f71c
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], r8d
push rbp
push rsi
push r14
sub rsp, 0x40
and qword [rax + 8], 0
and dword [rax + 0x18], 0
mov r14, rcx
mov rcx, qword [rcx]
mov rbp, r9
mov rsi, rdx
mov ebx, 0x80004005
test rcx, rcx
je 0x14001f884
test rdx, rdx
je 0x14001f884
test r9, r9
je 0x14001f884
cmp qword [rsp + 0x88], 0
je 0x14001f884
lea rax, [rax + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14001f86c
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov r8, rsi
lea edx, [r9 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x14001f84b
mov r8d, dword [rsp + 0x80]
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.14001fd24
test eax, eax
js 0x14001f834
mov r9, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
je 0x14001f813
mov ebx, dword [rsp + 0x70]
jmp 0x14001f827
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x14001f85f
mov edx, 1
mov ecx, 0x1e1
mov ebx, 0x80092004
call qword [sym.imp.urlmon.dll_Ordinal_414]
jmp 0x14001f85f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x14001f880
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14001f894
mov edx, 1
mov ecx, reloc.SHELL32.dll_SHFlushSFCache
call qword [sym.imp.urlmon.dll_Ordinal_414]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
Function at 0x1400247f8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rdx], 0
mov rbx, rdx
mov rdi, rcx
call fcn.140023d40
mov r8d, eax
test eax, eax
js 0x140024894
and dword [rsp + 0x50], 0
and dword [rsp + 0x48], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140024866
cmp dword [rsp + 0x48], 4
je 0x14002485c
mov eax, 0x80070570
mov dword [0x14002eccc], 0x5ce
jmp 0x1400248b7
mov eax, dword [rsp + 0x50]
mov dword [rbx], eax
xor eax, eax
jmp 0x1400248b7
call fcn.14001215c
mov ecx, eax
mov eax, 0x80070570
cmp ecx, eax
je 0x140024888
mov eax, ecx
test ecx, ecx
jns 0x1400248b7
mov dword [0x14002ecc8], 0x5d8
jmp 0x1400248b7
mov dword [0x14002eccc], 0x5d8
jmp 0x1400248b7
mov eax, 0x80070570
cmp r8d, eax
je 0x1400248ad
mov eax, r8d
mov dword [0x14002ecc8], 0x5dd
jmp 0x1400248b7
mov dword [0x14002eccc], 0x5dd
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400248c8
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
lea rdx, [rax + 0x20]
mov rcx, qword [rcx + 0x420]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140024924
call fcn.14001215c
mov edi, eax
mov eax, 0x80070570
cmp edi, eax
je 0x140024915
test edi, edi
jns 0x140024b2d
mov dword [0x14002ecc8], 0x60c
jmp 0x140024b2d
mov dword [0x14002eccc], 0x60c
jmp 0x140024b2b
cmp dword [rsp + 0x8c], 0
jle 0x140024942
mov edi, 0x80070570
mov dword [0x14002eccc], 0x612
jmp 0x140024b2d
cmp dword [rsp + 0x88], 0x600000
jbe 0x140024963
mov edi, 0x80070570
mov dword [0x14002eccc], 0x616
jmp 0x140024b2d
and dword [rsp + 0x78], 0
lea rdx, [rsp + 0x78]
mov rcx, qword [rsi + 0x420]
call fcn.1400247f8
mov edi, eax
mov dword [rsp + 0x80], eax
test eax, eax
js 0x1400249b0
mov eax, dword [rsp + 0x78]
and eax, 0xffff0000
cmp eax, 0x4020000
je 0x1400249a7
mov edi, 0xc00ee064
mov dword [0x14002ecc8], 0x5fb
jmp 0x1400249a9
xor edi, edi
mov dword [rsp + 0x80], edi
test edi, edi
js 0x140024b2d
mov rbx, qword [rsp + 0x88]
lea rax, [rsi + 0x208]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, qword [rsi + 0x420]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsi + 0x428], rax
test rax, rax
jne 0x140024a28
call fcn.14001215c
mov edi, eax
mov eax, 0x80070570
cmp edi, eax
je 0x140024a19
test edi, edi
jns 0x140024b2d
mov dword [0x14002ecc8], 0x627
jmp 0x140024b2d
mov dword [0x14002eccc], 0x627
jmp 0x140024b2b
mov rcx, rax
call fcn.140023cd4
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140024b2d
mov eax, ebx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, qword [rsi + 0x428]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov qword [rsi + 0x430], rax
test rax, rax
je 0x140024b01
mov ecx, dword [rax + 0x5c]
mov dword [rsi + 0x438], ecx
mov ecx, dword [rax + 8]
mov dword [rsi + 0x43c], ecx
mov eax, dword [rax + 0xc]
mov dword [rsi + 0x440], eax
mov ecx, dword [rdx + 0x24]
mov dword [rsi + 0x444], ecx
mov eax, dword [rdx + 0x28]
mov dword [rsi + 0x448], eax
lea edx, [rcx + rax]
cmp edx, ecx
jb 0x140024aad
mov dword [rsi + 0x44c], edx
xor edi, edi
jmp 0x140024ab9
or dword [rsi + 0x44c], 0xffffffff
mov edi, 0x80070216
mov dword [rsp + 0x30], edi
test edi, edi
js 0x140024ad4
mov edx, 3
mov rcx, rsi
call fcn.140025a88
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x140024aee
mov eax, 0x80070570
cmp edi, eax
jne 0x140024b2d
mov rcx, rsi
call fcn.1400269e4
jmp 0x140024b2d
call fcn.14001215c
mov edi, eax
mov eax, 0x80070570
cmp edi, eax
je 0x140024b21
test edi, edi
jns 0x140024b2d
mov dword [0x14002ecc8], 0x64e
jmp 0x140024b2d
mov dword [0x14002eccc], 0x64e
mov edi, eax
mov eax, edi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140026d14
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
sub rsp, 0x460
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbp, rcx
mov ecx, 0x20000003
mov ebx, 0x80004005
call qword [sym.imp.iertutil.dll_Ordinal_791]
test al, al
je 0x140026da3
mov rcx, qword [0x140004d88]
mov edx, 2
call qword [sym.imp.iertutil.dll_Ordinal_660]
test eax, eax
je 0x140026e5d
mov rcx, qword [0x140004d88]
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov edx, 2
call fcn.140010238
mov ebx, eax
test eax, eax
js 0x140026e5d
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rbp
call fcn.140009608
mov ebx, eax
jmp 0x140026e5d
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x20]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test eax, eax
jne 0x140026e5d
lea r8, [0x140008eb0]
lea rcx, [rsp + 0x30]
call fcn.1400114e0
mov ebx, eax
test eax, eax
js 0x140026e5d
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rbp
call fcn.140009608
mov ebx, eax
test eax, eax
js 0x140026e5d
mov rcx, qword [0x140004d88]
mov edx, 2
call qword [sym.imp.iertutil.dll_Ordinal_660]
test eax, eax
je 0x140026e4c
mov rcx, qword [0x140004d88]
lea r8, [rsp + 0x240]
mov r9d, 0x104
mov edx, 2
call fcn.140010238
test eax, eax
js 0x140026e4c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call sub.SHLWAPI.dll_StrCmpIW
test eax, eax
setne al
test al, al
je 0x140026e5d
mov rcx, qword [0x140004d88]
lea r8, [rsp + 0x30]
call fcn.1400102f8
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14002ad70
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rbp
ret

Function at 0x1400270f0
Capabilities:
Encrypt or decrypt via wincrypt
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x38]
lea r8, [rsp + 0x48]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400271c2
lea r9, [rdi + 0x50]
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov rcx, rdi
call fcn.140027340
mov ebx, eax
test eax, eax
js 0x1400271c9
lea r9, [rdi + 0x58]
lea rdx, [rsp + 0x48]
mov r8b, 1
mov rcx, rdi
call fcn.140027340
mov ebx, eax
test eax, eax
js 0x1400271c9
mov ecx, dword [rdi + 0x48]
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rdi + 0x60], rax
test rax, rax
je 0x1400271e6
mov edx, dword [rdi + 0x48]
lea r8, [rsp + 0x48]
mov r9d, 0x10
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov eax, dword [rdi + 0x48]
mov rcx, qword [rdi + 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 0x60]
lea r8d, [r9 + 1]
xor edx, edx
mov dword [rsp + 0x40], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1400271c9
call fcn.14001215c
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002ad70
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov ebx, 0x8007000e
jmp 0x1400271c9
Function at 0x140027340
Capabilities:
Encrypt data using aes via winapi
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov al, r8b
mov rbp, rcx
xor ebx, ebx
lea rcx, [0x140008f50]
test al, al
mov rdi, rdx
mov rsi, r9
mov qword [r9], rbx
lea r8, [0x140008fa0]
cmovne r8, rcx
lea rcx, [rdx + 0x10]
lea edx, [rbx + 0x10]
mov r9d, edx
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov rcx, qword [rbp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400273fc
mov rcx, qword [rsp + 0x40]
lea r8d, [rbx + 0x20]
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400273e8
mov r8, qword [rsp + 0x40]
mov rcx, qword [rbp + 0x38]
mov r9d, 0x800000
mov edx, 0x660e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1400273ef
call fcn.14001215c
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140027403
call fcn.14001215c
mov ebx, eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400274bc
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
mov r11d, edx
mov eax, 0xaaaaaaab
mov rbx, r9
mov rsi, r8
mov rdi, rcx
mul edx
shr edx, 1
lea r10d, [rdx + rdx*2]
cmp r11d, r10d
mov r10d, 0
mov eax, r10d
setne al
add eax, edx
shl eax, 2
cmp dword [r9], eax
jb 0x1400275ca
mov rdx, r8
mov r8d, r10d
test r11d, r11d
je 0x1400275bf
lea ebp, [r11 + 1]
lea r15, [0x140008f60]
lea r14d, [r10 + 0x3d]
mov eax, r8d
inc r8d
movzx r9d, byte [rax + rdi]
shl r9d, 8
cmp r8d, r11d
jae 0x140027546
lfence
movzx ecx, byte [r8 + rdi]
add r9d, ecx
inc r8d
shl r9d, 8
cmp r8d, r11d
jae 0x14002755d
lfence
movzx ecx, byte [r8 + rdi]
add r9d, ecx
mov eax, r9d
mov ecx, r9d
inc r8d
shr rax, 0x12
and ecx, 0x3f
and eax, 0x3f
mov al, byte [rax + r15]
mov byte [rdx], al
mov eax, r9d
shr rax, 0xc
and eax, 0x3f
mov al, byte [rax + r15]
mov byte [rdx + 1], al
mov eax, r9d
shr rax, 6
and eax, 0x3f
cmp r8d, r11d
mov al, byte [rax + r15]
mov byte [rdx + 2], al
movzx eax, byte [rcx + r15]
mov ecx, eax
cmova ecx, r14d
mov byte [rdx + 3], cl
cmp r8d, ebp
jbe 0x1400275b2
mov byte [rdx + 2], r14b
add rdx, 4
cmp r8d, r11d
jb 0x140027527
mov byte [rdx], r10b
sub edx, esi
inc edx
mov dword [rbx], edx
jmp 0x1400275d3
mov dword [r9], r10d
mov r10d, 0x8007007a
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov eax, r10d
pop r15
pop r14
ret
Function at 0x1400275f8
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rcx
mov r13d, 0x10
mov ebx, r9d
mov ecx, r13d
mov r15b, dl
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov ecx, dword [rsp + 0xa0]
mov rbp, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
mov rsi, rax
test rbp, rbp
je 0x140027770
test rax, rax
je 0x140027770
test r15b, r15b
je 0x140027695
mov byte [rax], 1
mov edx, dword [r14 + 0x70]
mov r8, qword [r14 + 0x68]
lea rsi, [rax + 1]
mov r9d, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov eax, dword [r14 + 0x70]
mov edx, dword [r14 + 0x48]
mov r8, qword [r14 + 0x60]
add rsi, rax
mov r9d, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov eax, dword [r14 + 0x48]
add rsi, rax
mov rcx, qword [r14 + 0x38]
mov r8, rbp
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14002775e
mov r9, r13
mov r8, rbp
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov r8, qword [rsp + 0x80]
add rsi, r13
lea rax, [rsp + 0x30]
mov r13, rsi
add rsi, 0x20
mov qword [rsp + 0x28], rax
mov r9d, ebx
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rsi
call fcn.1400278b0
mov ebx, eax
test eax, eax
js 0x140027765
mov r8d, dword [rsp + 0x30]
mov eax, esi
sub eax, edi
add eax, r8d
cmp eax, dword [rsp + 0xa0]
jne 0x140027757
mov r9, r13
mov rdx, rsi
mov rcx, r14
call fcn.1400277b0
mov ebx, eax
test eax, eax
js 0x140027765
mov r8, qword [rsp + 0x90]
mov edx, dword [rsp + 0xa0]
neg r15b
sbb al, al
lea r9, [rsp + 0x30]
mov rcx, rdi
and al, 0xf6
add al, 0x70
mov byte [r8], al
mov eax, dword [rsp + 0x98]
dec eax
inc r8
mov dword [rsp + 0x30], eax
call fcn.1400274bc
jmp 0x140027763
mov ebx, 0x80004005
jmp 0x140027765
call fcn.14001215c
mov ebx, eax
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
jmp 0x140027788
mov ebx, 0x8007000e
test rbp, rbp
je 0x140027783
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
test rdi, rdi
je 0x140027791
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1400277b0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x60
mov esi, r8d
mov r8, qword [rcx + 0x58]
mov rcx, qword [rcx + 0x38]
lea rax, [r11 - 0x38]
mov rdi, r9
mov rbp, rdx
xor r9d, r9d
mov edx, 0x8009
mov ebx, 0x80004005
mov qword [r11 - 0x48], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14002788b
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
lea r8, [rsp + 0x38]
lea edx, [r9 + 5]
mov dword [rsp + 0x38], 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x140027877
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140027877
mov rcx, qword [rsp + 0x30]
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x70], 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140027877
cmp dword [rsp + 0x70], 0x20
jne 0x14002787e
xor ebx, ebx
jmp 0x14002787e
call fcn.14001215c
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140027892
call fcn.14001215c
mov ebx, eax
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400278b0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r15, rcx
lea rcx, [0x14002e500]
mov esi, r9d
mov r12, r8
mov rbx, rdx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [r15 + 0x50]
lea edx, [rdi + 1]
xor r9d, r9d
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140027a50
mov rbx, qword [rsp + 0xa0]
mov ebp, esi
and esi, 0xf
lea r13d, [rdi + 0x10]
shr ebp, 4
xor r14d, r14d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x80], esi
test ebp, ebp
je 0x1400279ce
mov r9, r13
mov r8, r12
mov rdx, r13
mov rcx, rbx
mov dword [rsp + 0x40], r13d
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov ecx, dword [rsp + 0x80]
test ecx, ecx
jne 0x14002795c
lea eax, [rbp - 1]
cmp r14d, eax
jne 0x14002795c
lea edx, [rcx + 0x20]
jmp 0x140027963
mov edx, r13d
test ecx, ecx
jne 0x140027973
lea eax, [rbp - 1]
cmp r14d, eax
jne 0x140027973
mov r8d, 1
jmp 0x140027976
xor r8d, r8d
mov rcx, qword [r15 + 0x50]
mov dword [rsp + 0x30], edx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400279b4
mov eax, dword [rsp + 0x40]
inc r14d
add r12, r13
add rbx, rax
cmp r14d, ebp
jb 0x14002792d
jmp 0x1400279c7
call fcn.14001215c
mov dword [r15 + 8], 3
mov edi, eax
test eax, eax
js 0x140027a43
mov esi, dword [rsp + 0x80]
test esi, esi
je 0x140027a2c
mov edx, esi
mov r9d, esi
mov r8, r12
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov rcx, qword [r15 + 0x50]
xor r9d, r9d
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], r13d
lea r8d, [r9 + 1]
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140027a1d
mov eax, dword [rsp + 0x80]
add rbx, rax
jmp 0x140027a2c
call fcn.14001215c
mov dword [r15 + 8], 3
mov edi, eax
test edi, edi
js 0x140027a43
mov rax, qword [rsp + 0xa8]
sub ebx, dword [rsp + 0xa0]
mov dword [rax], ebx
jmp 0x140027a57
mov rax, qword [rsp + 0xa8]
and dword [rax], 0
jmp 0x140027a57
call fcn.14001215c
mov edi, eax
lea rcx, [0x14002e500]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140027ed4
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
movsxd rdi, ecx
cmp dword [0x14002ecf8], ebx
jne 0x140027f9b
cmp edi, 0x17
jge 0x140027f9b
mov rdx, qword [0x14002ecf0]
test rdx, rdx
jne 0x140027f8e
mov rcx, qword [0x14002ece8]
test rcx, rcx
jne 0x140027f57
lea r9, [rsp + 0x48]
call fcn.140028410
test eax, eax
js 0x140027f3f
mov rcx, qword [rsp + 0x48]
xor eax, eax
lock cmpxchg qword [0x14002ece8], rcx
je 0x140027f3f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x14002ecf0]
test rdx, rdx
jne 0x140027f8e
mov rcx, qword [0x14002ece8]
test rcx, rcx
je 0x140027f8e
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
test rax, rax
je 0x140027f87
xor eax, eax
lock cmpxchg qword [0x14002ecf0], rcx
je 0x140027f87
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rdx, qword [0x14002ecf0]
lea rcx, [rdx + rdi*4]
neg rdx
sbb rbx, rbx
and rbx, rcx
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140027fb0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe0
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r15, r8
mov r14, rcx
mov rdx, rcx
lea r8, [rsp + 0x40]
mov ecx, 2
mov r12d, r9d
mov ebx, 0x80004005
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
xor r13d, r13d
mov esi, eax
test eax, eax
je 0x140028192
lea ecx, [r13 + 0x40]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140028192
mov r8d, dword [rsp + 0x40]
lea ecx, [r13 + 2]
mov r9d, esi
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
je 0x140028189
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
lea rdx, [0x140009040]
mov rcx, rdi
mov qword [rsp + 0x38], r13
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14002815a
mov rax, qword [rbp - 0x79]
lea rsi, [0x140008e98]
lea r14d, [r13 + 0x3c]
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ecx
lea r8, [0x140009078]
lea rcx, [rbp - 0x71]
mov edx, r14d
call fcn.140009684
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x71]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x14002815a
lea r8, [0x1400090b0]
lea rcx, [rbp - 0x71]
mov r9, rsi
mov edx, r14d
call fcn.140009684
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x71]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x14002815a
lea r8, [0x1400090e8]
lea rcx, [rbp - 0x71]
mov r9, rsi
mov edx, r14d
call fcn.140009684
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x71]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x14002815a
lea r8, [0x140009120]
lea rcx, [rbp - 0x71]
mov r9, rsi
mov edx, r14d
call fcn.140009684
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x71]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
neg eax
sbb rcx, rcx
and rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rcx
jmp 0x14002815f
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140028189
lea rdx, [0x140009034]
call qword [sym.imp.SHLWAPI.dll_StrTrimW]
mov r8, qword [rsp + 0x38]
cmp word [r8], r13w
je 0x140028189
mov rdx, r12
mov rcx, r15
call fcn.140009608
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14002ad70
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret