joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e040
Capabilities:
Terminate process

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x70
mov rax, qword [0x1400213f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, word [rdx]
xor edi, edi
mov r8d, edi
mov rbx, rdx
mov r13, rcx
cmp ax, 0x20
jne 0x14000e07e
nop dword [rax]
movzx eax, word [rdx + 2]
add rdx, 2
cmp ax, 0x20
je 0x14000e070
test ax, ax
je 0x14000e0ae
inc r8d
movzx ecx, ax
nop dword [rax]
movzx eax, cx
cmp cx, 0x20
je 0x14000e0a9
movzx eax, word [rdx + 2]
add rdx, 2
movzx ecx, ax
test ax, ax
jne 0x14000e090
test ax, ax
jne 0x14000e066
test r8d, r8d
je 0x14000e26d
movsxd rcx, r8d
mov qword [rsp + 0xa0], rbp
shl rcx, 3
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx ecx, word [rbx]
mov r15d, edi
mov r12, rax
mov r8, rdi
mov rdx, r8
cmp cx, 0x20
jne 0x14000e0fe
nop dword [rax + rax]
movzx ecx, word [rbx + 2]
add rbx, 2
cmp cx, 0x20
je 0x14000e0f0
test cx, cx
je 0x14000e178
inc r15d
inc r8
cmp cx, 0x22
jne 0x14000e138
add rbx, 2
mov qword [r12 + rdx*8], rbx
movzx eax, word [rbx]
test ax, ax
je 0x14000e133
nop
cmp ax, 0x22
je 0x14000e133
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x14000e120
movzx eax, word [rbx]
jmp 0x14000e160
mov qword [r12 + rdx*8], rbx
movzx eax, word [rbx]
test ax, ax
je 0x14000e178
movzx ecx, ax
movzx eax, cx
cmp cx, 0x20
je 0x14000e160
movzx eax, word [rbx + 2]
add rbx, 2
movzx ecx, ax
test ax, ax
jne 0x14000e147
test ax, ax
je 0x14000e178
mov word [rbx], di
add rbx, 2
movzx ecx, word [rbx]
test cx, cx
jne 0x14000e0e2
mov ebp, 1
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x58], r14
cmp r15d, ebp
jle 0x14000e243
xor eax, eax
lea rdx, [0x14001b364]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rax
movsxd rax, ebp
mov r8d, 2
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
lea r14, [rax*8]
mov rcx, qword [r14 + r12]
mov qword [rsp + 0x20], rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x14000e283
add qword [rsp + 0x20], 4
lea ebx, [rax + 1]
lea rax, [rsp + 0x28]
sub r14, rax
lea edi, [rbp + 1]
add r14, r12
nop word [rax + rax]
cmp edi, r15d
jge 0x14000e21d
lea rax, [r14 + rbx*8]
mov r8d, 2
mov rsi, qword [rsp + rax + 0x28]
lea rdx, [0x14001b364]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x14000e228
mov qword [rsp + rbx*8 + 0x20], rsi
inc edi
inc rbx
cmp rbx, 5
jl 0x14000e1f0
lea r8, [rsp + 0x20]
mov edx, ebp
mov rcx, r13
call fcn.14000e2a0
lea ebp, [rax + 1]
cmp ebp, r15d
jl 0x14000e190
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.14000dda0
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140016590
add rsp, 0x70
pop r13
pop rdi
pop rbx
ret
mov rdx, qword [rsp + 0x20]
mov ecx, 0x57b
call fcn.140003f10
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000fc20
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rcx
xor esi, esi
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
lea r9d, [rsi + 3]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14000fc67
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14000fd3b
mov eax, esi
cmp rbx, 0x40
jb 0x14000fd15
movdqa xmm2, xmmword [0x14001b5d0]
mov r8, rbx
movdqa xmm3, xmmword [str.________________________________h]
and r8, 0xffffffffffffffc0
mov r9d, 0x20
nop dword [rax + rax]
movdqu xmm0, xmmword [rsi + rdi]
lea ecx, [r9 - 0x10]
add eax, 0x40
movdqa xmm1, xmm2
pand xmm0, xmm2
paddb xmm0, xmm3
movdqu xmmword [rsi + rdi], xmm0
mov esi, eax
movdqu xmm0, xmmword [rcx + rdi]
pand xmm1, xmm0
paddb xmm1, xmm3
movdqu xmmword [rcx + rdi], xmm1
mov ecx, r9d
movdqu xmm0, xmmword [rcx + rdi]
pand xmm0, xmm2
paddb xmm0, xmm3
movdqu xmmword [rcx + rdi], xmm0
lea ecx, [r9 + 0x10]
add r9d, 0x40
movdqu xmm0, xmmword [rcx + rdi]
pand xmm0, xmm2
paddb xmm0, xmm3
movdqu xmmword [rcx + rdi], xmm0
cmp rsi, r8
jb 0x14000fcb0
mov edx, eax
cmp rdx, rbx
jae 0x14000fd36
nop dword [rax]
movzx ecx, byte [rdx + rdi]
inc eax
and cl, 0x5d
add cl, 0x21
mov byte [rdx + rdi], cl
mov edx, eax
cmp rdx, rbx
jb 0x14000fd20
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140010000
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x14000f130]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14001003e
mov ecx, 0x5dd
call fcn.140003f10
add rsp, 0x38
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x140010e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rcx + 0x8b8], edx
mov r8, rcx
lea rdx, [0x140010750]
mov ecx, 0xfa
jmp fcn.140003d40

Function at 0x140011070
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.140011850
test eax, eax
jne 0x140011090
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
lea rdx, str.key_data
mov rbx, rcx
call 0x140011070
lea rdx, str.auth_data
mov rcx, rbx
call 0x140011070
lea rdx, str.entropy
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140011070
Function at 0x1400110c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov rbx, r8
mov rdi, rdx
xor r8d, r8d
lea rdx, [rsp + 0x38]
call fcn.140011850
test eax, eax
je 0x14001112b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14001112b
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1400115b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
call fcn.140011140
test eax, eax
jne 0x1400115c2
add rsp, 0x58
ret
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rbp
lea rdx, str.SoftwareOpenVPN_GUI
mov qword [rsp + 0x40], rsi
mov r9d, keybd_event
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbx, [0x140021260]
xor ebp, ebp
mov esi, eax
lea r14, [0x1400212c0]
test esi, esi
jne 0x140011674
mov ecx, dword [rbx]
lea rax, [rsp + 0x60]
mov rdi, qword [rbx - 8]
lea r9, [rsp + 0x68]
mov rdx, qword [rbx - 0x10]
add ecx, ecx
mov dword [rsp + 0x60], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011674
cmp dword [rsp + 0x68], 1
jne 0x140011674
mov eax, dword [rsp + 0x60]
shr eax, 1
mov dword [rsp + 0x60], eax
je 0x14001166d
dec eax
mov word [rdi + rax*2], bp
mov eax, dword [rsp + 0x60]
jmp 0x140011670
mov word [rdi], bp
test eax, eax
jne 0x140011691
movsxd r8, dword [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movsxd rcx, dword [rbx]
mov rax, qword [rbx - 8]
mov word [rax + rcx*2 - 2], bp
add rbx, 0x20
cmp rbx, r14
jl 0x140011614
mov r14, qword [rsp + 0x30]
lea rbx, [0x1400212b8]
mov rbp, qword [rsp + 0x48]
lea rdi, [0x1400213f0]
test esi, esi
jne 0x1400116f6
mov rax, qword [rbx]
lea rcx, [rsp + 0x60]
mov rdx, qword [rbx - 8]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x68], 4
jne 0x1400116f6
test eax, eax
je 0x1400116fe
mov rcx, qword [rbx]
mov eax, dword [rbx + 8]
mov dword [rcx], eax
add rbx, 0x18
cmp rbx, rdi
jl 0x1400116b6
mov rdi, qword [rsp + 0x38]
test esi, esi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
jne 0x140011725
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1400234d8], 0
jne 0x140011742
mov ecx, 0x70f
call fcn.140003f10
mov dword [0x1400234d8], 0xa
cmp dword [0x1400234dc], 0
jne 0x14001175f
mov ecx, 0x710
call fcn.140003f10
mov dword [0x1400234dc], 0xa
mov ecx, dword [0x1400234ec]
mov edx, 0x62fc
lea eax, [rcx - 1]
cmp eax, 0xee47
cmova ecx, edx
mov dword [0x1400234ec], ecx
call fcn.14000dda0
mov eax, 1
add rsp, 0x58
ret
Function at 0x140011790
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
lea eax, [r9 + r9]
mov rbx, r8
mov dword [rsp + 0x68], eax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400117f2
cmp dword [rsp + 0x30], 1
jne 0x1400117f2
mov eax, dword [rsp + 0x68]
shr eax, 1
mov dword [rsp + 0x68], eax
je 0x1400117e7
dec eax
xor edx, edx
mov word [rbx + rax*2], dx
mov eax, dword [rsp + 0x68]
add rsp, 0x40
pop rbx
ret
xor edx, edx
mov word [rbx], dx
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x140011800
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x30], 4
jne 0x14001183e
test eax, eax
jne 0x14001183e
mov eax, 1
add rsp, 0x48
ret
xor eax, eax
add rsp, 0x48
ret
Function at 0x140011990
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
xor edi, edi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rdi
lea rdx, str.SoftwareOpenVPN_GUI
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400119ef
lea rdx, str.SoftwareOpenVPN_GUI
mov ecx, 0x647
call fcn.140003f10
mov eax, edi
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x80], rbx
lea rbx, [0x140021258]
mov qword [rsp + 0x58], rbp
lea rbp, [0x1400212b8]
mov qword [rsp + 0x50], rsi
nop
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx]
call fcn.14000dae0
test eax, eax
jne 0x140011a43
mov rdx, qword [rbx - 8]
xor r9d, r9d
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011a8b
mov rdx, qword [rbx]
mov rax, 0xffffffffffffffff
mov rsi, qword [rbx - 8]
cmp word [rdx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x140011a51
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140011b1d
add rbx, 0x20
cmp rbx, rbp
jl 0x140011a10
lea rbx, [0x1400212b8]
lea rbp, [0x1400213f0]
mov rcx, qword [rbx]
mov eax, dword [rbx + 8]
cmp dword [rcx], eax
jne 0x140011ad3
mov rdx, qword [rbx - 8]
xor r9d, r9d
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011b0d
mov rax, qword [rbx]
mov r9d, 4
mov rsi, qword [rbx - 8]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov rdx, rsi
mov ecx, dword [rax]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140011b1d
add rbx, 0x18
cmp rbx, rbp
jl 0x140011aa6
mov edi, 1
jmp 0x140011b31
mov r8, rsi
lea rdx, str.SoftwareOpenVPN_GUI
mov ecx, 0x714
call fcn.140003f10
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x60
pop rdi
ret

Function at 0x140011b60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov r8d, 1
lea rdx, [rsp + 0x30]
mov ebx, r9d
call fcn.140011850
test eax, eax
jne 0x140011b9c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
mov r9d, 3
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
xor eax, eax
test ebx, ebx
mov rbx, qword [rsp + 0x50]
sete al
add rsp, 0x40
pop rdi
ret
Function at 0x140011be0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r10, rcx
mov rax, 0xffffffffffffffff
cmp word [r8 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140011bf3
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140011c42
mov r8, rbx
lea rdx, str.SoftwareOpenVPN_GUI
mov ecx, 0x714
call fcn.140003f10
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x140011c50
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rbx, rdx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140011c8d
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov r8, rbx
lea rdx, str.SoftwareOpenVPN_GUI
mov ecx, 0x714
call fcn.140003f10
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140011f90
Capabilities:
Delete registry value

Disassembly:
lea rdx, str.auth_data
jmp 0x140011070

Function at 0x140011fa0
Capabilities:
Delete registry value

Disassembly:
lea rdx, str.key_data
jmp 0x140011070

Function at 0x140011fb0
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.140011850
test eax, eax
jne 0x140011090
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
lea rdx, str.key_data
mov rbx, rcx
call 0x140011070
lea rdx, str.auth_data
mov rcx, rbx
call 0x140011070
lea rdx, str.entropy
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140011070

Function at 0x140012050
Capabilities:
Encrypt data using dpapi

Disassembly:
lea r9, str.auth_data
mov r8d, 0x80
jmp 0x140012130

Function at 0x140012070
Capabilities:
Encrypt data using dpapi

Disassembly:
lea r9, str.key_data
mov r8d, 0x80
jmp 0x140012130
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x8a8
mov rax, qword [0x1400213f8]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov rbp, r9
mov r15d, r8d
mov rdi, rdx
lea r8, [rsp + 0x70]
xor ebx, ebx
lea rdx, str.entropy
mov rsi, rcx
lea r9d, [rbx + 0x11]
call fcn.1400110c0
test eax, eax
jle 0x140012184
dec eax
movsxd rcx, eax
mov byte [rsp + rcx + 0x70], bl
jmp 0x140012188
mov byte [rsp + 0x70], bl
mov r8, r15
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x800
lea r8, [rsp + 0x90]
mov rdx, rbp
mov rcx, rsi
call fcn.1400110c0
test eax, eax
je 0x140012272
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x90]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
inc rax
cmp byte [rcx + rax], bl
jne 0x1400121e6
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rbx
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x140012267
mov eax, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
test eax, eax
je 0x140012272
mov ebp, eax
lea rax, [r15 + r15]
cmp rbp, rax
ja 0x140012250
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea edx, [r15 - 1]
mov word [rdi + rdx*2], bx
mov ebx, 1
xor eax, eax
mov rdi, rsi
mov rcx, rbp
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
jmp 0x140012274
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.140016590
add rsp, 0x8a8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400120d0
Capabilities:
Encrypt data using dpapi

Disassembly:
lea r8, str.auth_data
jmp 0x1400122a0
Function at 0x1400120e0
Capabilities:
Encrypt data using dpapi

Disassembly:
lea r8, str.key_data
jmp 0x1400122a0
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1400213f8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, 0xffffffffffffffff
mov r14, r8
mov rax, rbx
mov rdi, rdx
mov rsi, rcx
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400122d3
mov r9d, send
lea r8, [rsp + 0x70]
lea rdx, str.entropy
lea ebp, [rax*2 + 2]
call fcn.1400110c0
test eax, eax
jle 0x14001230d
dec eax
movsxd rcx, eax
mov byte [rsp + rcx + 0x70], 0
jmp 0x14001234b
mov edx, send
lea rcx, [rsp + 0x70]
call fcn.14000fc20
test eax, eax
je 0x140012346
mov r9d, send
mov byte [rsp + 0x80], 0
lea r8, [rsp + 0x70]
mov rcx, rsi
lea rdx, str.entropy
call fcn.140011b60
test eax, eax
jne 0x14001234b
mov byte [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x50], ebp
inc rbx
cmp byte [rax + rbx], 0
jne 0x140012363
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
xor eax, eax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call sub.CRYPT32.dll_CryptProtectData
test eax, eax
je 0x1400123ca
mov r9d, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
test r9d, r9d
je 0x1400123ca
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.140011b60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1400123cc
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140016590
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140012130
Capabilities:
Encrypt data using dpapi

Disassembly:
lea r9, str.key_data
mov r8d, 0x80
jmp 0x140012130
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x8a8
mov rax, qword [0x1400213f8]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov rbp, r9
mov r15d, r8d
mov rdi, rdx
lea r8, [rsp + 0x70]
xor ebx, ebx
lea rdx, str.entropy
mov rsi, rcx
lea r9d, [rbx + 0x11]
call fcn.1400110c0
test eax, eax
jle 0x140012184
dec eax
movsxd rcx, eax
mov byte [rsp + rcx + 0x70], bl
jmp 0x140012188
mov byte [rsp + 0x70], bl
mov r8, r15
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x800
lea r8, [rsp + 0x90]
mov rdx, rbp
mov rcx, rsi
call fcn.1400110c0
test eax, eax
je 0x140012272
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x90]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
inc rax
cmp byte [rcx + rax], bl
jne 0x1400121e6
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rbx
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x140012267
mov eax, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
test eax, eax
je 0x140012272
mov ebp, eax
lea rax, [r15 + r15]
cmp rbp, rax
ja 0x140012250
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea edx, [r15 - 1]
mov word [rdi + rdx*2], bx
mov ebx, 1
xor eax, eax
mov rdi, rsi
mov rcx, rbp
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
jmp 0x140012274
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.140016590
add rsp, 0x8a8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400122a0
Capabilities:
Encrypt data using dpapi

Disassembly:
lea r8, str.key_data
jmp 0x1400122a0
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1400213f8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, 0xffffffffffffffff
mov r14, r8
mov rax, rbx
mov rdi, rdx
mov rsi, rcx
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400122d3
mov r9d, send
lea r8, [rsp + 0x70]
lea rdx, str.entropy
lea ebp, [rax*2 + 2]
call fcn.1400110c0
test eax, eax
jle 0x14001230d
dec eax
movsxd rcx, eax
mov byte [rsp + rcx + 0x70], 0
jmp 0x14001234b
mov edx, send
lea rcx, [rsp + 0x70]
call fcn.14000fc20
test eax, eax
je 0x140012346
mov r9d, send
mov byte [rsp + 0x80], 0
lea r8, [rsp + 0x70]
mov rcx, rsi
lea rdx, str.entropy
call fcn.140011b60
test eax, eax
jne 0x14001234b
mov byte [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x50], ebp
inc rbx
cmp byte [rax + rbx], 0
jne 0x140012363
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
xor eax, eax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call sub.CRYPT32.dll_CryptProtectData
test eax, eax
je 0x1400123ca
mov r9d, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
test r9d, r9d
je 0x1400123ca
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.140011b60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1400123cc
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140016590
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret