joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b103c
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, reloc.certcli.dll_Ordinal_256
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
cmp dword [rcx], esi
jne 0x1000b1088
mov ebx, 0x80070057
mov edx, 0x75f019a
mov r8d, ebx
jmp 0x1000b11fb
lea r8, [0x10001e3a0]
lea rcx, [rsp + 0x40]
mov r9d, 1
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, esi
jne 0x1000b10c6
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x76e019a
mov ebx, eax
jmp 0x1000b11f8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, esi
jne 0x1000b1102
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x776019a
mov ebx, eax
jmp 0x1000b11f8
mov r8d, dword [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, esi
jne 0x1000b1133
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x77e019a
mov ebx, eax
jmp 0x1000b11f8
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov edx, 2
mov dword [rsp + 0x30], reloc.Cabinet.dll_FDICreate
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, esi
jne 0x1000b1175
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x785019a
mov ebx, eax
jmp 0x1000b11f8
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
mov ecx, 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], Ordinal_127
call fcn.1000b8150
mov ebx, eax
cmp eax, esi
je 0x1000b11ac
mov edx, 0x78f019a
jmp 0x1000b11f8
lea rcx, [rsp + 0x70]
lea rax, [rsp + 0x70]
cmp si, word [rsp + 0x70]
je 0x1000b11dd
movzx r8d, word [rax]
mov edx, Ordinal_36
cmp dx, r8w
je 0x1000b11d4
mov word [rcx], r8w
add rcx, 2
add rax, 2
cmp si, word [rax]
jne 0x1000b11bd
mov word [rcx], si
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.1000b80c8
mov ebx, eax
cmp eax, esi
je 0x1000b1205
mov edx, 0x7a7019a
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rsp + 0x38]
cmp rcx, rsi
je 0x1000b1215
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
cmp rcx, rsi
je 0x1000b1227
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + reloc.certcli.dll_Ordinal_256]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1000b1a94
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov edx, reloc.certcli.dll_Ordinal_260
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor ebx, ebx
cmp eax, ebx
jne 0x1000b1ae7
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa0e019a
mov rcx, rdi
jmp 0x1000b1b51
lea r9, [rsp + 0x240]
lea rdx, [0x10000c848]
lea rcx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, ebx
jne 0x1000b1b26
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov r9d, 0x80070005
mov edx, 0xa2d019a
lea rcx, [rsp + 0x30]
jmp 0x1000b1b54
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, ebx
jne 0x1000b1b5e
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa33019a
lea rcx, [rsp + 0x240]
xor r9d, r9d
mov r8d, eax
mov ebx, eax
call fcn.1000b51b8
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1000ef870
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret

Function at 0x1000b1b88
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and qword [rdx], 0
and dword [rax + 0x10], 0
mov rsi, rdx
xor edx, edx
lea r8, [rax + 0x10]
lea ecx, [rdx + 2]
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
jne 0x1000b1bde
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
cmp eax, 0x8007007a
je 0x1000b1bde
xor r9d, r9d
mov r8d, eax
mov edx, 0xa4d019a
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b1c51
mov edx, dword [rsp + 0x38]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1000b1c04
mov ebx, 0x8007000e
mov edx, 0xa55019a
mov r8d, ebx
jmp 0x1000b1c30
lea r8, [rsp + 0x38]
mov rdx, rax
mov ecx, 2
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
jne 0x1000b1c3c
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa5b019a
mov ebx, eax
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b1c43
mov qword [rsi], rdi
xor edi, edi
xor ebx, ebx
test rdi, rdi
je 0x1000b1c51
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000b1c6c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
and qword [rdx], 0
and qword [rcx], 0
mov rsi, rdx
mov rbx, rcx
mov edx, Ordinal_36
xor ecx, ecx
mov dword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_16
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1000b1cbf
mov ebx, 0x8007000e
xor r9d, r9d
mov edx, 0xa7c019a
mov r8d, ebx
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b1d1b
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1000b1ce6
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa81019a
mov ebx, eax
jmp 0x1000b1cf9
mov rcx, rbx
call fcn.1000db468
mov ebx, eax
test eax, eax
je 0x1000b1d08
mov edx, 0xa85019a
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b1d0d
mov qword [rsi], rdi
xor edi, edi
test rdi, rdi
je 0x1000b1d1b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1000b1d34
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and qword [rdx], 0
and dword [rax + 0x10], 0
mov rsi, rdx
xor edx, edx
lea r8, [rax + 0x10]
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1000b1d8b
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
cmp eax, 0x800700ea
je 0x1000b1d8b
xor r9d, r9d
mov r8d, eax
mov edx, 0xaa3019a
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b1dff
mov edx, dword [rsp + 0x38]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1000b1db1
mov ebx, 0x8007000e
mov edx, 0xaaa019a
mov r8d, ebx
jmp 0x1000b1dde
lea r8, [rsp + 0x38]
mov rdx, rax
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1000b1dea
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xaaf019a
mov ebx, eax
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b1df1
mov qword [rsi], rdi
xor edi, edi
xor ebx, ebx
test rdi, rdi
je 0x1000b1dff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000b3378
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rcx
mov edi, reloc.certcli.dll_Ordinal_260
lea rdx, [rsp + 0x20]
lea rcx, [0x100026758]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ebx, ebx
cmp eax, ebx
jne 0x1000b33e4
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov r9d, 0x800700cb
mov edx, 0x1171019a
mov ebx, eax
mov r8d, eax
lea rcx, [0x100026758]
jmp 0x1000b342f
cmp eax, edi
jb 0x1000b33f4
mov ebx, 0x8007006f
mov edx, 0x1176019a
jmp 0x1000b3427
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx + rcx]
lea rdi, [rcx - 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
cmp rax, rbx
jne 0x1000b3436
mov ebx, 0x8007000e
mov edx, 0x117d019a
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b3447
lea r8, [rsp + 0x20]
lea rdx, [rdi + 1]
mov rcx, rax
call fcn.100038b1c
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1000b47b0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [0x10011be90], 0
jne 0x1000b4841
lea rcx, [rsp + 0x20]
mov dword [0x10011be90], 1
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000b4809
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1612019a
mov r8d, eax
jmp 0x1000b481b
cmp dword [rsp + 0x30], 2
je 0x1000b4827
mov edx, 0x1617019a
mov r8d, 0x4c7
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b4841
cmp dword [rsp + 0x24], 5
ja 0x1000b4837
jb 0x1000b4841
cmp dword [rsp + 0x28], 0
jbe 0x1000b4841
mov dword [0x10011be94], 1
mov eax, dword [0x10011be94]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x158
ret

Function at 0x1000b4868
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [0x10011be98], 0
jne 0x1000b48f7
lea rcx, [rsp + 0x20]
mov ebx, 1
mov dword [rsp + 0x20], 0x114
mov byte [0x10011be98], bl
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000b48c4
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x165e019a
mov r8d, eax
jmp 0x1000b48d6
cmp dword [rsp + 0x30], 2
je 0x1000b48e2
mov edx, 0x1663019a
mov r8d, 0x4c7
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b48f7
movzx eax, byte [0x10011be99]
cmp dword [rsp + 0x24], 6
cmovae eax, ebx
mov byte [0x10011be99], al
mov al, byte [0x10011be99]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x150
pop rbx
ret
Function at 0x1000b5914
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
xor edx, edx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
test eax, eax
jne 0x1000b5966
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x1d9f019a
mov r8d, eax
xor ecx, ecx
mov edi, eax
call fcn.1000b51b8
jmp 0x1000b5a5f
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
lea eax, [rbp + 1]
not rcx
lea r12, [rcx + rax]
xor ecx, ecx
lea rdx, [r12 + r12]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x1000b599f
mov edi, 0x8007000e
mov edx, 0x1da8019a
jmp 0x1000b5a3f
mov edx, ebp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebp
ja 0x1000b5a22
test eax, eax
je 0x1000b5a22
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
mov eax, 0x5c
not rcx
cmp ax, word [rbx + rcx*2 - 4]
je 0x1000b59df
lea r8, [0x100014f4c]
mov rdx, r12
mov rcx, rbx
call fcn.100038a50
mov r8, r13
mov rdx, r12
mov rcx, rbx
call fcn.100038a50
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1000b5a1e
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1dbf019a
mov rcx, rbx
mov edi, eax
mov r8d, eax
jmp 0x1000b5a44
xor edi, edi
jmp 0x1000b5a4c
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1db2019a
mov edi, eax
mov eax, 0x8007006f
test edi, edi
cmove edi, eax
mov r8d, edi
xor ecx, ecx
xor r9d, r9d
call fcn.1000b51b8
test rbx, rbx
je 0x1000b5a5a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
jne 0x1000b5a67
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1000b5b6c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, rdx
mov edi, 1
mov r12, rcx
lea edx, [rdi + 0x5b]
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x1000b5bab
mov edx, 0x1fbb019a
mov r8d, edi
jmp 0x1000b5cd0
lea rcx, [0x100027948]
xor bpl, bpl
call qword [sym.imp.msvcrt.dll__wgetenv]
mov rsi, rax
test rax, rax
jne 0x1000b5bd7
xor r9d, r9d
mov edx, 0x1fa1019a
mov r8d, edi
lea rcx, [0x100027948]
jmp 0x1000b5bf6
xor edx, edx
mov rcx, rax
call fcn.1000b1a94
test eax, eax
je 0x1000b5bfd
mov r9d, 0x80070005
mov r8d, eax
mov edx, 0x1fa4019a
mov rcx, rsi
call fcn.1000b51b8
jmp 0x1000b5c00
mov bpl, dil
lea rax, [0x100027958]
lea rcx, [0x100027960]
test bpl, bpl
cmovne rcx, rax
call qword [sym.imp.msvcrt.dll_getenv]
mov r11, rax
test rax, rax
jne 0x1000b5c2d
mov edx, 0x1fc1019a
jmp 0x1000b5ba3
mov esi, reloc.certcli.dll_Ordinal_260
xor edi, edi
mov rcx, rbx
mov rdx, rsi
sub r11, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1000b5c5c
mov al, byte [r11 + rcx]
test al, al
je 0x1000b5c5c
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1000b5c3d
test rdx, rdx
jne 0x1000b5c69
dec rcx
mov edi, 0x8007007a
mov byte [rcx], 0
test edi, edi
je 0x1000b5c7a
mov r8d, edi
mov edx, 0x1fc4019a
jmp 0x1000b5cd0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x1000b5cb4
cmp byte [rcx + rbx - 1], 0x5c
je 0x1000b5cb4
lea r8, [0x10002796c]
mov rdx, rsi
mov rcx, rbx
call fcn.10005f408
mov edi, eax
test eax, eax
je 0x1000b5cb4
mov edx, 0x1fca019a
jmp 0x1000b5ccd
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call fcn.10005f408
mov edi, eax
test eax, eax
je 0x1000b5cda
mov edx, 0x1fcd019a
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x1000b5d00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x258
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x240], rax
test cl, cl
mov qword [rsp + 0x28], r8
lea rdx, [0x100027970]
lea rax, [0x100027978]
lea r9, [0x10002b530]
lea r8, [0x100027988]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov edx, 0x208
mov qword [rsp + 0x20], rax
call fcn.1000b6348
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x258
ret
Function at 0x1000b5d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x40
and qword [r8], 0
cmp byte [0x10011c8f0], 0
mov rdi, r8
mov rbx, rcx
lea rbp, [0x10011c7f0]
jne 0x1000b5e97
mov edx, 1
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x1000b5dd9
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x201d019a
mov ebx, eax
mov r8d, eax
jmp 0x1000b5e33
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1000b5e02
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x2025019a
mov ebx, eax
mov r8d, eax
jmp 0x1000b5e33
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x1000b5e3f
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x2031019a
mov ebx, eax
mov eax, 0x8007000d
test ebx, ebx
cmove ebx, eax
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b5e9c
lea rcx, [rax + 6]
lea rdx, [0x1000279a0]
call fcn.1000b5684
test eax, eax
je 0x1000b5e5a
mov ebx, 0x8007000d
jmp 0x1000b5e9c
movzx ecx, word [rbx + 0x36]
movzx edx, word [rbx + 0x30]
movzx eax, word [rbx + 0x34]
movzx r9d, word [rbx + 0x32]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, [0x1000279c0]
mov rcx, rbp
mov edx, Ordinal_65
call fcn.100038358
lock or dword [rsp], 0
mov byte [0x10011c8f0], 1
mov qword [rdi], rbp
xor ebx, ebx
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1000beaa0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r12, r9
mov r13, rdx
mov r14, rcx
xor esi, esi
mov ebp, 0x80
jmp 0x1000beb49
mov r8d, Ordinal_65
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_memcpy
xor r9d, r9d
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1000bebb3
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edi, eax
test esi, esi
jne 0x1000beba9
cmp eax, 0x800700ea
jne 0x1000beba9
xor eax, eax
mov ecx, ebp
mov rdi, rbx
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebp, dword [rsp + 0x80]
mov esi, 1
mov rdx, rbp
xor ecx, ecx
mov dword [rsp + 0x80], Ordinal_65
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x1000beacd
mov edi, 0x8007000e
mov edx, 0x6fa01a3
mov r8d, edi
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
test rbx, rbx
je 0x1000beb90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov r8d, eax
mov edx, 0x71601a3
jmp 0x1000beb78
mov rcx, qword [rsp + 0x90]
mov eax, dword [rsp + 0x80]
mov qword [r12], rbx
xor ebx, ebx
xor edi, edi
mov dword [rcx], eax
jmp 0x1000beb82

Function at 0x1000bebd4
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rsi, qword [rsp + 0x70]
and qword [r9], 0
mov r12, rdx
and dword [rsi], 0
mov r13, rcx
mov edx, r8d
xor ecx, ecx
mov rbx, r9
mov dword [rax + 0x18], r8d
mov ebp, r8d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1000bec34
mov ebx, 0x8007000e
xor r9d, r9d
mov edx, 0x73f01a3
mov r8d, ebx
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000beca4
mov r8, rbp
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
xor r9d, r9d
lea r11, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea r8d, [r9 + 1]
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1000bec89
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x74c01a3
mov r8d, eax
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
jmp 0x1000bec96
mov eax, dword [rsp + 0x60]
mov qword [rbx], rdi
xor edi, edi
mov dword [rsi], eax
xor ebx, ebx
test rdi, rdi
je 0x1000beca4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x1000c0344
Capabilities:
Hash data via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov rbp, r9
mov rbx, r8
mov r12d, edx
mov dil, cl
test r8, r8
je 0x1000c04be
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x20], reloc.Cabinet.dll_FDICreate
call fcn.1000bf748
mov rsi, rax
lea rax, [0x100029e1c]
test dil, dil
je 0x1000c03b8
test r12d, r12d
lea r8, [0x10001d580]
lea rdx, [0x100029e28]
cmovne r8, rax
or ecx, 0xffffffff
mov r9, rsi
call sub.certcli.dll_Ordinal_203
jmp 0x1000c03d5
test r12d, r12d
lea rdx, [0x10001d580]
lea rcx, [0x100029e40]
cmovne rdx, rax
mov r8, rsi
call fcn.1000b99b0
mov r8, qword [rbx + 0x18]
lea rdx, [0x100029e68]
mov cl, dil
add r8, 0x20
call fcn.1000bfb9c
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov edx, 3
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CertGetCRLContextProperty]
test eax, eax
jne 0x1000c041b
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xec501a3
jmp 0x1000c0458
test dil, dil
je 0x1000c0431
lea rdx, [0x10002740c]
or ecx, 0xffffffff
call sub.certcli.dll_Ordinal_203
jmp 0x1000c043d
lea rcx, [0x1000187cc]
call fcn.1000b99b0
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov cl, dil
call fcn.1000bfcd0
test eax, eax
je 0x1000c0465
mov edx, 0xecb01a3
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
test rbp, rbp
je 0x1000c04a4
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1000c04a4
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0xdb801a3
mov r8d, eax
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
jmp 0x1000c04a6
xor ebx, ebx
test ebx, ebx
je 0x1000c04be
xor r9d, r9d
mov r8d, ebx
mov edx, 0xece01a3
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000c04c0
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret