joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fad0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x65
mov dword [rbp - 0x20], 0x200006
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2c003f
mov dword [rbp - 0x18], 0x3e0020
mov dword [rbp - 0x14], 0x480031
mov dword [rbp - 0x10], 0x2d0027
call fcn.140005e60
mov rcx, rax
call 0x14000fad0
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x74
mov dword [rbp - 0x20], 0x200006
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2c003f
mov dword [rbp - 0x18], 0x3e0020
mov dword [rbp - 0x14], 0x3b0040
call fcn.140002590
mov rcx, rax
call 0x14000fad0
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x110023
mov dword [rbp - 0x1c], 0xe0009
mov dword [rbp - 0x18], 0x720009
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000fad0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000fb32
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000bdb0
test al, al
jne 0x14000fb44
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000fb00
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140a69813
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp r10
bswap edx
jmp 0x140a9b331
push r8
push r13
movsx r8d, r12w
push rax
movzx ax, bh
push rbx
lahf
push r14
bswap eax
cbw
push r11
push rcx
push r9
movsxd r11, esp
push r15
mov ax, 0x634d
movzx ecx, bp
cwde
push r10
cmovno r8d, eax
push rsi
movsx r10, r14w
pushfq
or si, ax
push rbp
cmp esp, edx
xchg al, r8b
shl r9b, 0xf
push rdx
bsr r11w, dx
shld r10d, r15d, 0x1e
sar r10b, cl
push r12
sub sil, 0x4b
rol r10b, cl
push rdi
movabs rcx, 0
sub r8w, r10w
push rcx
mov r11, qword [rsp + 0x90]
setle r10b
rdtsc
xor r11d, 0x711c3b24
mov r9, 0x2bab2d18
not r11d
movsxd r10, edi
dec r11d
ror r11d, 3
shl sil, cl
btc si, r15w
xor r9b, sil
sub r11d, 0x6bf559e9
dec sil
bswap r11d
movzx rsi, bp
inc r11d
not r9d
or al, 0x99
rdtsc
lea r11, [r11 + rcx]
ror r8b, cl
movabs rax, 0x100000000
add r11, rax
btc r10w, sp
mov r8, rsp
and rsi, 0x1415229
sub rsp, 0x180
rol rsi, cl
bsr dx, r8w
and rsp, 0xfffffffffffffff0
shld r9, r11, 0xf
mov r9, r11
bsr si, r12w
movabs rsi, 0
neg dh
sub r9, rsi
btc dx, cx
shr dx, 0x1b
lea r10, [0x140a69926]
sub r11, 4
btr dx, 0xd8
add dx, 0xad
test r8b, r10b
mov edx, dword [r11]
clc
cmc
jmp 0x140acd38c
ror edx, 1
test r14b, 0x47
stc
not edx
cmp r12b, dl
sub edx, 0x30855db0
jmp 0x140a5f655
sub edx, 0x614e2e8e
push r9
dec r9w
xor dword [rsp], edx
pop r9
test r14b, 0x45
movsxd rdx, edx
cmp r10w, 0xfa0
add r10, rdx
jmp 0x1409f9661
xor edx, r9d
jmp 0x140a8ff67
Function at 0x140104947
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
sub rsp, 0x30
cmp edx, 1
invalid

Function at 0x140104cc7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x230
movsxd rax, dword [rcx + 0x3c]
mov r13, r8
mov r15d, edx
mov rbp, rcx
mov r9d, dword [rax + rcx + 0x88]
mov esi, dword [r9 + rcx + 0x20]
mov r14d, dword [r9 + rcx + 0x1c]
add rsi, rcx
mov edi, dword [r9 + rcx + 0x24]
add r14, rcx
add rdi, rcx
nop
mov ebx, dword [rsi]
lea rcx, [rsp + 0x20]
mov edx, 0x208
add rbx, rbp
call fcn.1401058f7
mov rcx, rbx
call fcn.140105877
test eax, eax
je 0x140104d5b
mov ecx, eax
lea r8, [rsp + 0x20]
lea rdx, [rcx + rbx]
lea r8, [r8 + rcx*2]
nop
movsx ecx, byte [rdx]
lea rdx, [rdx - 1]
mov word [r8], cx
lea r8, [r8 - 2]
add eax, 0xffffffff
jne 0x140104d47
mov ecx, eax
movsx eax, byte [rcx + rbx]
mov word [rsp + rcx*2 + 0x20], ax
lea rcx, [rsp + 0x20]
call fcn.1401058b7
xor edx, edx
test eax, eax
je 0x140104d9e
mov r10d, dword [r13 + 0xb0]
lea r8, [rsp + 0x20]
mov r9d, eax
nop
mov ecx, r10d
lea r8, [r8 + 2]
imul ecx, edx
movzx edx, word [r8 - 2]
add edx, ecx
sub r9, 1
jne 0x140104d87
movzx eax, word [rdi]
mov eax, dword [r14 + rax*4]
add rax, rbp
cmp r15d, edx
je 0x140104dba
add rsi, 4
add rdi, 2
jmp 0x140104d17
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x140105417
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x20], rbx
xor r15d, r15d
mov rbx, qword [rsp + 0xa0]
mov qword [rax - 0x28], rbp
mov rbp, rcx
mov qword [rax - 0x38], rdi
lea rcx, [rax - 0x50]
lea r8d, [r15 + 4]
mov qword [rax - 0x40], r12
lea rdx, [rbx + 0x12c]
call fcn.140104c57
lea rdx, [rbx + 0xc8]
lea r8d, [r15 + 4]
lea rcx, [rsp + 0x2c]
call fcn.140104c57
xor r14d, r14d
mov qword [rsp + 0x48], rsi
xor r12d, r12d
mov rdi, rbp
xor r13d, r13d
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x88]
lea rbx, [rdi + 1]
mov eax, ebp
xor r9d, r9d
sub eax, edi
lea r11d, [rcx - 0x10]
add r11d, eax
je 0x1401055bf
lea r8, [rsp + 0x28]
mov r10, rbx
sub r8, rbx
nop word [rax + rax]
xor edx, edx
mov rax, r10
movzx ecx, byte [r8 + rax]
cmp byte [rax], cl
je 0x1401054de
cmp cl, 0x3f
jne 0x14010556c
inc edx
inc rax
cmp edx, 8
jb 0x1401054cc
mov edi, r9d
add rdi, rbx
je 0x1401055bf
mov ecx, dword [rdi]
mov dword [rsp + 0x20], ecx
movzx eax, byte [rsp + 0x21]
movzx ebx, byte [rsp + 0x22]
shl eax, 0x10
shl ebx, 8
add ebx, eax
movzx eax, cl
shl eax, 0x18
add ebx, eax
shr ecx, 0x18
mov rax, qword [rsp + 0xa0]
add ebx, ecx
mov eax, dword [rax + 0x144]
cmp dword [rdi + 8], eax
jne 0x140105580
test r14, r14
jne 0x140105589
mov r12d, dword [rdi + 0x10]
lea ecx, [r14 + 0x40]
mov rax, qword [rsp + 0x98]
lea r13, [rdi + 8]
add r12d, 0x10
mov edx, r12d
call qword [rax + 0xc8]
mov r8d, ebx
lea rdx, [rdi + 8]
mov rcx, rax
mov r14, rax
call fcn.140104c57
add r15d, ebx
jmp 0x140105497
inc r9d
inc r10
dec r8
cmp r9d, r11d
jb 0x1401054c7
jmp 0x1401055bf
test r14, r14
je 0x140105497
mov ecx, r15d
lea ebp, [rbx + r15]
add rcx, r14
lea rdx, [rdi + 8]
cmp ebp, r12d
ja 0x1401055b4
mov r8d, ebx
call fcn.140104c57
mov r15d, ebp
mov rbp, qword [rsp + 0x80]
jmp 0x140105497
sub r12d, r15d
mov r8d, r12d
call fcn.140104c57
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test r14, r14
jne 0x1401055ea
xor al, al
add rsp, 0x60
pop r15
pop r14
pop r13
ret
mov eax, dword [r13 + 8]
lea rcx, [r14 + 0x10]
mov r8d, dword [r13 + 4]
test al, 3
je 0x140105600
dec eax
test al, 3
jne 0x1401055fa
test eax, eax
je 0x140105624
lea edx, [rax - 1]
shr edx, 2
inc edx
nop word [rax + rax]
xor dword [rcx], r8d
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140105617
mov rax, qword [rsp + 0x90]
test r15d, r15d
mov qword [rax], r14
setne al
add rsp, 0x60
pop r15
pop r14
pop r13
ret
Function at 0x140105600
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x20], rbx
xor r15d, r15d
mov rbx, qword [rsp + 0xa0]
mov qword [rax - 0x28], rbp
mov rbp, rcx
mov qword [rax - 0x38], rdi
lea rcx, [rax - 0x50]
lea r8d, [r15 + 4]
mov qword [rax - 0x40], r12
lea rdx, [rbx + 0x12c]
call fcn.140104c57
lea rdx, [rbx + 0xc8]
lea r8d, [r15 + 4]
lea rcx, [rsp + 0x2c]
call fcn.140104c57
xor r14d, r14d
mov qword [rsp + 0x48], rsi
xor r12d, r12d
mov rdi, rbp
xor r13d, r13d
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x88]
lea rbx, [rdi + 1]
mov eax, ebp
xor r9d, r9d
sub eax, edi
lea r11d, [rcx - 0x10]
add r11d, eax
je 0x1401055bf
lea r8, [rsp + 0x28]
mov r10, rbx
sub r8, rbx
nop word [rax + rax]
xor edx, edx
mov rax, r10
movzx ecx, byte [r8 + rax]
cmp byte [rax], cl
je 0x1401054de
cmp cl, 0x3f
jne 0x14010556c
inc edx
inc rax
cmp edx, 8
jb 0x1401054cc
mov edi, r9d
add rdi, rbx
je 0x1401055bf
mov ecx, dword [rdi]
mov dword [rsp + 0x20], ecx
movzx eax, byte [rsp + 0x21]
movzx ebx, byte [rsp + 0x22]
shl eax, 0x10
shl ebx, 8
add ebx, eax
movzx eax, cl
shl eax, 0x18
add ebx, eax
shr ecx, 0x18
mov rax, qword [rsp + 0xa0]
add ebx, ecx
mov eax, dword [rax + 0x144]
cmp dword [rdi + 8], eax
jne 0x140105580
test r14, r14
jne 0x140105589
mov r12d, dword [rdi + 0x10]
lea ecx, [r14 + 0x40]
mov rax, qword [rsp + 0x98]
lea r13, [rdi + 8]
add r12d, 0x10
mov edx, r12d
call qword [rax + 0xc8]
mov r8d, ebx
lea rdx, [rdi + 8]
mov rcx, rax
mov r14, rax
call fcn.140104c57
add r15d, ebx
jmp 0x140105497
inc r9d
inc r10
dec r8
cmp r9d, r11d
jb 0x1401054c7
jmp 0x1401055bf
test r14, r14
je 0x140105497
mov ecx, r15d
lea ebp, [rbx + r15]
add rcx, r14
lea rdx, [rdi + 8]
cmp ebp, r12d
ja 0x1401055b4
mov r8d, ebx
call fcn.140104c57
mov r15d, ebp
mov rbp, qword [rsp + 0x80]
jmp 0x140105497
sub r12d, r15d
mov r8d, r12d
call fcn.140104c57
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test r14, r14
jne 0x1401055ea
xor al, al
add rsp, 0x60
pop r15
pop r14
pop r13
ret
mov eax, dword [r13 + 8]
lea rcx, [r14 + 0x10]
mov r8d, dword [r13 + 4]
test al, 3
je 0x140105600
dec eax
test al, 3
jne 0x1401055fa
test eax, eax
je 0x140105624
lea edx, [rax - 1]
shr edx, 2
inc edx
nop word [rax + rax]
xor dword [rcx], r8d
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140105617
mov rax, qword [rsp + 0x90]
test r15d, r15d
mov qword [rax], r14
setne al
add rsp, 0x60
pop r15
pop r14
pop r13
ret
Function at 0x140105647
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov esi, ecx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
nop dword [rax]
nop word [rax + rax]
mov rdi, qword [rdi]
mov rbx, qword [rdi + 0x60]
mov rcx, rbx
call fcn.1401058b7
xor r8d, r8d
test eax, eax
je 0x1401056be
mov r9d, eax
nop dword [rax]
movzx ecx, word [rbx]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x1401056a7
add cx, 0x20
imul r8d, r8d, 0x1003f
add rbx, 2
movzx edx, cx
add r8d, edx
sub r9, 1
jne 0x140105697
cmp esi, r8d
jne 0x140105677
mov rax, qword [rdi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1401056d7
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword gs:[0x60]
mov ebx, ecx
mov r11, qword [rax + 0x18]
add r11, 0x10
nop dword [rax + rax]
mov r11, qword [r11]
mov r10, qword [r11 + 0x60]
test r10, r10
je 0x1401056f7
test ebx, ebx
je 0x14010573c
xor r9d, r9d
xor r8d, r8d
cmp word [r10], r8w
je 0x140105737
movzx ecx, word [r10]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x140105724
add cx, 0x20
inc r8
movzx edx, cx
add r9d, edx
movzx ecx, word [r10 + r8*2]
test cx, cx
jne 0x140105717
cmp ebx, r9d
jne 0x1401056f7
mov rax, qword [r11 + 0x30]
mov rbx, qword [rsp + 8]
ret
Function at 0x180002200
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x60
xor ebx, ebx
mov dword [rax + 0x10], 0
mov word [rax + 0x14], 0x500
lea rax, [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x70], eax
test eax, eax
je 0x180002290
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x70]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
movzx eax, byte [rsp + 0x70]
add rsp, 0x60
pop rbx
ret

Function at 0x180004880
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
jne 0x1800048e8
mov eax, dword [rcx + 4]
xor r8d, r8d
mov r9d, dword [rcx]
xor edx, edx
add rcx, 8
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1800048e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1800048de
mov r9d, dword [rdi]
lea rcx, [rdi + 8]
xor r8d, r8d
mov dword [rsp + 0x20], 8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1800048e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1800049d0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov edx, 0x18
mov r8d, 0xf0000000
lea rcx, [rsp + 0x38]
mov ebp, r9d
call fcn.180004830
lea rcx, [rsp + 0x38]
call fcn.180004880
test rax, rax
je 0x180004a93
lea rcx, [rsp + 0x38]
call fcn.180004880
mov rcx, rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180004a8d
mov rcx, qword [rsi]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180004a8d
mov r8, qword [rsp + 0x88]
xor edx, edx
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x30], r8d
call sub.msvcrt.dll_memset
mov r8, qword [rsp + 0x80]
lea r9, [rsp + 0x30]
mov rcx, qword [rsi]
xor edi, edi
mov dword [rsp + 0x20], edi
lea edx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x180004a98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xffffffff
lea rcx, [rsp + 0x38]
call fcn.180004850
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180004af0
Capabilities:
Encrypt data using aes via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rbp, rcx
mov rdi, r9
mov rcx, rdx
mov rsi, r8
mov rbx, rdx
call fcn.180004880
test rax, rax
je 0x180004b91
xorps xmm0, xmm0
mov qword [rsp + 0x70], r14
xorps xmm1, xmm1
mov dword [rsp + 0x30], 0x208
mov r8, rdi
mov dword [rsp + 0x34], 0x660e
mov rdx, rsi
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x3c]
xor r14d, r14d
movdqu xmmword [rsp + 0x3c], xmm0
movdqu xmmword [rsp + 0x4c], xmm1
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call fcn.180004880
mov rcx, rax
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov dword [rsp + 0x20], r14d
lea r8d, [r14 + 0x2c]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14, qword [rsp + 0x70]
test eax, eax
jne 0x180004b98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xffffffff
jmp 0x180004b9a
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180004c70
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, 0x18
mov r8d, 0xf0000000
lea rcx, [rsp + 0x38]
mov rbp, r9
call fcn.180004830
lea rcx, [rsp + 0x38]
call fcn.180004880
test rax, rax
jne 0x180004cbc
lea ebx, [rax - 1]
jmp 0x180004de3
lea rcx, [rsp + 0x30]
call fcn.180004900
mov r9, rbx
lea rdx, [rsp + 0x38]
mov r8, rsi
lea rcx, [rsp + 0x30]
call fcn.180004af0
test eax, eax
je 0x180004ce9
mov ebx, 0xffffffff
jmp 0x180004dd9
lea rcx, [rsp + 0x30]
call fcn.180004180
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.180004880
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
mov edx, 0x8009
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180004dd1
mov rcx, qword [rdi]
lea r8, [rsp + 0x48]
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor r9d, r9d
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x58], xmm0
lea edx, [rax + 5]
mov dword [rsp + 0x48], 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x180004dd1
mov r8d, dword [rsp + 0xa0]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180004dd1
mov rcx, qword [rdi]
lea r9, [rsp + 0xa8]
xor ebx, ebx
xor r8d, r8d
mov dword [rsp + 0xa8], ebx
mov dword [rsp + 0x20], ebx
lea edx, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180004dd1
mov r9, qword [rsp + 0xb8]
mov eax, dword [r9]
cmp dword [rsp + 0xa8], eax
je 0x180004db3
mov ebx, 0xffffffff
jmp 0x180004dd9
mov r8, qword [rsp + 0xb0]
mov edx, 2
mov rcx, qword [rdi]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x180004dd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.180004ac0
lea rcx, [rsp + 0x38]
call fcn.180004850
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180004ef0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbp, r8
mov rbx, rdx
xor r8d, r8d
mov rdi, rcx
lea rcx, [rsp + 0x50]
mov rsi, r9
lea edx, [r8 + 1]
call fcn.180004830
lea rcx, [rsp + 0x50]
call fcn.180004880
test rax, rax
jne 0x180004f3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x180004ff5
lea rcx, [rsp + 0x48]
call fcn.180004900
mov r9d, dword [rdi + 8]
lea rdx, [rsp + 0x50]
mov r8, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.180004e10
lea rcx, [rsp + 0x48]
call fcn.180004180
test rax, rax
je 0x180004fe3
xor r9d, r9d
mov dword [rsp + 0x30], ebp
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x180004fe3
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x90]
lea r8, [rcx - 1]
mov qword [rax], rcx
test r8, r8
je 0x180004fdf
mov rax, rbx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8 + rbx]
movzx edx, byte [rax]
mov byte [rax], cl
inc rax
mov rcx, rax
mov byte [r8 + rbx], dl
sub rcx, rbx
dec r8
cmp rcx, r8
jb 0x180004fc0
mov bl, 1
jmp 0x180004feb
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
lea rcx, [rsp + 0x48]
call fcn.180004ac0
lea rcx, [rsp + 0x50]
call fcn.180004850
mov rbp, qword [rsp + 0x78]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x180005060
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
mov edx, 0x18
mov r8d, 0xf0000000
lea rcx, [rsp + 0x50]
mov rdi, r9
call fcn.180004830
lea rcx, [rsp + 0x50]
call fcn.180004880
test rax, rax
jne 0x1800050b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18000514d
lea rcx, [rsp + 0x48]
call fcn.180004900
mov r9d, dword [rbx + 8]
lea rdx, [rsp + 0x50]
mov r8, qword [rbx]
lea rcx, [rsp + 0x48]
call fcn.180004af0
test eax, eax
jne 0x18000513b
lea rcx, [rsp + 0x48]
call fcn.180004bb0
test eax, eax
jne 0x18000513b
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.180004be0
test eax, eax
jne 0x18000513b
lea rcx, [rsp + 0x48]
call fcn.180004180
test rax, rax
je 0x18000513b
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x40], edi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x40]
mov qword [rax], rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x48]
mov ebx, eax
call fcn.180004ac0
lea rcx, [rsp + 0x50]
call fcn.180004850
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x180005180
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov edx, 0x18
lea rcx, [rsp + 0x30]
mov r8d, 0xf0000000
mov rdi, r9
call fcn.180004830
lea rcx, [rsp + 0x30]
call fcn.180004880
test rax, rax
jne 0x1800051ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180005257
lea rcx, [rsp + 0x70]
call fcn.180004900
mov r9d, dword [rbx + 8]
lea rdx, [rsp + 0x30]
mov r8, qword [rbx]
lea rcx, [rsp + 0x70]
call fcn.180004af0
test eax, eax
jne 0x180005245
lea rcx, [rsp + 0x70]
call fcn.180004bb0
test eax, eax
jne 0x180005245
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x70]
call fcn.180004be0
test eax, eax
jne 0x180005245
lea rcx, [rsp + 0x70]
call fcn.180004180
test rax, rax
je 0x180005245
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x70]
mov ebx, eax
call fcn.180004ac0
lea rcx, [rsp + 0x30]
call fcn.180004850
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180005300
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, r8d
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov rdi, rdx
lea edx, [r8 + 1]
call fcn.180004830
lea rcx, [rsp + 0x20]
call fcn.180004880
test rax, rax
je 0x180005346
mov r8, rdi
mov edx, ebx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x180005346
xor ebx, ebx
jmp 0x18000534b
mov ebx, 0xffffffff
lea rcx, [rsp + 0x20]
call fcn.180004850
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret