joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c978
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x47]
sub rsp, 0xc0
mov esi, edx
mov r14, r9
mov rdi, rcx
cmp edx, 3
jb 0x14008cab5
movzx eax, word [rcx]
cmp ax, word [0x1400fe8f8]
jne 0x14008cab5
mov al, byte [rcx + 2]
cmp al, byte [0x1400fe8fa]
jne 0x14008cab5
test r8, r8
je 0x14008caa7
test r9, r9
je 0x14008caa7
lea rcx, str.__using_BCrypt_with_AES_256_GCM_n
call fcn.14000b9e4
xor edx, edx
lea rcx, [rbp - 0x21]
lea r8d, [rdx + 0x58]
call fcn.1400e8100
lea eax, [rsi - 0x1f]
mov dword [rbp - 0x21], reloc.WLDAP32.dll_Ordinal_88
lea rcx, [rdi + 3]
mov edx, eax
mov qword [rbp - 0x19], rcx
add rcx, 0xffffffffffffffed
add rcx, rsi
mov dword [rbp - 0x1d], 1
mov qword [rbp + 7], rcx
mov ecx, 0x40
mov dword [rbp - 0x11], reloc.WLDAP32.dll_Ordinal_12
mov dword [rbp + 0xf], 0x10
mov dword [rbp + 0x57], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14008cb15
and dword [rsp + 0x48], 0
lea rax, [rbp + 0x57]
mov r8d, dword [rbp + 0x57]
lea r9, [rbp - 0x21]
mov edx, dword [rbp - 0x11]
mov rcx, r14
add rdx, qword [rbp - 0x19]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
mov qword [rsp + 0x30], rdi
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
js 0x14008ca96
mov r8d, dword [rbp + 0x57]
lea rcx, str._s:__.S_n
mov rdx, qword [rbp + 0x7f]
mov r9, rdi
call fcn.14000b9e4
jmp 0x14008caa2
lea rcx, str.BigBad_:_kuhl_m_dPApi_chrome_decrypt___ERROR
call fcn.14000b9e4
mov rcx, rdi
jmp 0x14008cb0f
lea rcx, str.BigBad_:_kuhl_m_dPApi_chrome_decrypt___ERROR
call fcn.14000b9e4
jmp 0x14008cb15
and qword [rsp + 0x48], 0
lea rax, [rbp + 0x57]
mov r9d, dword [rbp + 0x6f]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov edx, esi
lea rax, [rbp - 0x31]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x77]
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.14008acd4
test eax, eax
je 0x14008cb15
mov r9, qword [rbp - 0x31]
lea rcx, str._s:__.S_n
mov r8d, dword [rbp + 0x57]
mov rdx, qword [rbp + 0x7f]
call fcn.14000b9e4
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0xc0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14009ac2c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
lea rdx, [rsp + 0x58]
mov ebx, r15d
mov rsi, rcx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
mov ebp, r15d
test rax, rax
je 0x14009acfc
cmp dword [rsp + 0x58], r15d
jle 0x14009acfc
movzx edi, r15w
lea r12, [0x1400ff050]
mov ebx, r15d
cmp di, 0x13
jae 0x14009acd5
mov rcx, qword [r14]
movzx ebx, di
shl rbx, 5
mov rdx, qword [rbx + r12 + 0x10]
call fcn.1400cc960
test eax, eax
mov ebp, r15d
sete bpl
test eax, eax
je 0x14009acaa
inc di
jmp 0x14009ac7b
mov rax, qword [rbx + r12]
test rax, rax
je 0x14009acc3
mov ecx, dword [rsp + 0x58]
lea rdx, [r14 + 8]
dec ecx
call rax
mov ebx, eax
jmp 0x14009acd5
mov ecx, dword [rbx + r12 + 8]
xor r8d, r8d
xor edx, edx
call fcn.140009fd8
mov ebx, r15d
test ebp, ebp
jne 0x14009acfc
or r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], r15w
jne 0x14009acdd
lea r8d, [r8*2 + 2]
mov rdx, rsi
mov ecx, 0x22c003
call fcn.140009fd8
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14009c378
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov eax, dword [rcx]
xor ebx, ebx
and dword [rbp - 0x69], ebx
mov r15, r8
and dword [rbp - 0x65], ebx
mov r14, rcx
and qword [rbp - 0x61], rbx
lea rcx, [rbp + 0xf]
mov qword [rbp - 0x51], rcx
lea r8d, [rbx + 0x10]
mov dword [rbp - 0x59], r8d
lea rdi, [rdx + rax]
mov dword [rbp - 0x55], r8d
test eax, eax
je 0x14009c4c6
mov edx, dword [r14 + 4]
test edx, edx
je 0x14009c4c6
movzx ecx, word [rdi + 2]
mov esi, dword [rbp + 0x7f]
sub ecx, 1
je 0x14009c4df
cmp ecx, 1
je 0x14009c3fb
lea rcx, str.BigBad_:_kuhl_m_lsADumP_getHash___ERROR
call fcn.14000b9e4
jmp 0x14009c4b7
cmp dword [rdi + 4], r8d
jb 0x14009c4b7
lea rax, [rbp + 0x57]
mov rcx, r15
mov qword [rsp + 0x28], rax
lea r9d, [rdx - 0x18]
lea rax, [rbp + 0x5f]
lea r8, [rdi + 0x18]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 8]
call fcn.1400048d0
test eax, eax
je 0x14009c4b7
mov eax, dword [rbp + 0x57]
mov ecx, 0x40
mov edx, eax
mov dword [rbp - 0x65], eax
mov dword [rbp - 0x69], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x61], rax
test rax, rax
je 0x14009c467
mov r8d, dword [rbp + 0x57]
mov rcx, rax
mov rdx, qword [rbp + 0x5f]
call fcn.1400e84c0
mov ebx, 1
mov rcx, qword [rbp + 0x5f]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14009c4b7
mov r8d, dword [rbp + 0x6f]
lea rcx, str.ntlm
mov edx, dword [rbp - 0x69]
lea rax, str.NTLM
test esi, esi
mov dword [rsp + 0x20], esi
lea r9, str.LM
cmovne rax, rcx
lea rcx, str.lm
cmovne r9, rcx
cmp dword [rbp + 0x77], 0
mov rcx, qword [rbp - 0x61]
cmovne r9, rax
call fcn.1400b1160
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x14009c4c6
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp edx, 6
jb 0x14009c4b7
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, 0x10
lea rcx, [rbp - 0x49]
mov rdx, r15
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 4
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov eax, esi
lea rcx, str.NTPASSWORDHISTORY
neg eax
lea rdx, str.LMPASSWORD
lea rax, str.NTPASSWORD
sbb r8d, r8d
and r8d, 7
add r8d, 0xb
test esi, esi
cmovne rax, rcx
lea rcx, str.LMPASSWORDHISTORY
cmovne rdx, rcx
cmp dword [rbp + 0x77], ebx
lea rcx, [rbp - 0x49]
cmovne rdx, rax
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [r14 + 4]
mov ecx, 0x40
add eax, 0xfffffffc
mov edx, eax
mov dword [rbp - 0x65], eax
mov dword [rbp - 0x69], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x61], rax
test rax, rax
je 0x14009c4b7
mov r8d, dword [rbp - 0x69]
lea rdx, [rdi + 4]
mov rcx, rax
call fcn.1400e84c0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
mov ebx, eax
not ebx
shr ebx, 0x1f
test ebx, ebx
jne 0x14009c475
jmp 0x14009c3ea
Function at 0x14009c730
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rdi, rcx
mov qword [rbp - 0x49], r9
lea rax, [rbp + 0x1f]
xor esi, esi
lea rcx, str._nSAMKey_:
mov qword [rbp - 0x59], rax
mov r14, r9
mov r15, r8
mov rbx, rdx
lea r12d, [rsi + 0x10]
mov dword [rbp - 0x61], r12d
mov dword [rbp - 0x5d], r12d
mov dword [rbp - 0x51], r12d
mov dword [rbp - 0x4d], r12d
call fcn.14000b9e4
and qword [rsp + 0x30], rsi
lea rax, [rbp - 0x69]
lea r9, [0x14011e508]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.14000e8c8
test eax, eax
je 0x14009c8dc
mov rbx, qword [rbp - 0x69]
movzx ecx, word [rbx]
sub ecx, 2
je 0x14009c7c8
cmp ecx, 1
jne 0x14009c8b3
mov ecx, dword [rbx + 0x68]
sub ecx, 1
je 0x14009c82b
cmp ecx, 1
jne 0x14009c8b3
mov r9d, dword [rbx + 0x74]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea r8, [rbx + 0x88]
lea rax, [rbp - 0x69]
mov rcx, r15
lea rdx, [rbx + 0x78]
mov qword [rsp + 0x20], rax
call fcn.1400048d0
test eax, eax
je 0x14009c8bf
cmp dword [rbp + 0x7f], r12d
mov rcx, qword [rbp - 0x69]
sete sil
jne 0x14009c820
movups xmm0, xmmword [rcx]
movdqu xmmword [r14], xmm0
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14009c8bf
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Init]
lea rdx, [rbx + 0x70]
mov r8d, r12d
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 0x2f
lea rdx, str.______qwertyUIOPAzxcvbnmQQQQQQQQQQQQ____
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, r12d
lea rcx, [rbp - 0x39]
mov rdx, r15
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.0123456789012345678901234567890123456789
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Final]
movups xmm0, xmmword [rbx + 0x80]
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x51]
movdqu xmmword [r14], xmm0
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
mov esi, eax
not esi
shr esi, 0x1f
test esi, esi
jne 0x14009c8bf
lea rcx, str.BigBad_:_kuhl_m_lsADumP_getSamKey___ERROR
call fcn.14000b9e4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x14009c8e8
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.140012120
jmp 0x14009c8e8
lea rcx, str.BigBad_:_kuhl_m_lsADumP_getSamKey___ERROR
call fcn.14000b9e4
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b9e4
lea r11, [rsp + 0xe0]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400a84ac
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1010]
mov eax, 0x1110
call fcn.1400e7a10
sub rsp, rax
xor esi, esi
mov dword [rbp - 0x80], reloc.ODBC32.dll_SQLAllocHandle
and qword [rbp - 0x78], rsi
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x70], 1
xor edx, edx
lea rcx, [rbp - 0x60]
lea r8d, [rsi + 0x68]
call fcn.1400e8100
xor eax, eax
xorps xmm0, xmm0
and qword [rbp + 0x1048], rax
mov rcx, rbx
and qword [rsp + 0x60], rax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
call fcn.1400cc7ec
mov r14, rax
test rax, rax
je 0x1400a86bc
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x1048]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400a86b4
mov rcx, qword [rbp + 0x1048]
lea edx, [rsi + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
bts dword [rbp - 0x24], 8
mov rax, qword [rbp - 8]
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
test rdi, rdi
je 0x1400a8599
xor r8d, r8d
lea rcx, [rsp + 0x60]
mov rdx, rdi
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x1400a8599
lea rcx, str.BigBad_:_kull_m_ProCeSs_run_data___ERROR
call fcn.14000b9e4
jmp 0x1400a8698
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, r14
lea rax, [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rcx, rdi
and qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8000400
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
test eax, eax
je 0x1400a867c
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbp], 0
mov edi, 0x1000
and qword [rbp - 8], 0
jmp 0x1400a8631
mov eax, dword [rbp + 0x1040]
test eax, eax
je 0x1400a8656
xor ebx, ebx
test eax, eax
je 0x1400a8631
movzx edx, byte [rbp + rbx + 0x10]
lea rcx, [0x140108d20]
call fcn.14000b9e4
inc ebx
cmp ebx, dword [rbp + 0x1040]
jb 0x1400a8616
mov rcx, qword [rbp + 0x1048]
lea r9, [rbp + 0x1040]
and qword [rsp + 0x20], 0
lea rdx, [rbp + 0x10]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a8606
mov rcx, qword [rsp + 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a8688
lea rcx, str.BigBad_:_kull_m_ProCeSs_run_data___ERROR
call fcn.14000b9e4
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400a8698
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rbp + 0x1048]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400a86b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.1400cc870
lea r11, [rsp + 0x1110]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400a9af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8w
mov r11, r9
movzx r10d, dl
xor r9b, r9b
shl r10d, 0x10
mov rsi, rcx
or r10d, eax
movabs rax, 0x2004000000
lea edi, [r10 + r10]
xor r10b, r10b
or rdi, rax
xor r8b, r8b
movzx edx, r8b
mov rax, rdi
inc r8b
lea ecx, [rdx + 0xd]
shr rax, cl
lea ecx, [rdx + 1]
and al, 1
xor r10b, al
mov rax, rdi
shr rax, cl
and al, 1
xor r9b, al
cmp r8b, 0xc
jb 0x1400a9b2e
xor eax, eax
movzx ecx, r10b
and ecx, 1
shl rcx, 0x19
test r9b, r9b
sete al
or rcx, rax
or rdi, rcx
test r11, r11
je 0x1400a9b78
mov qword [r11], rdi
mov rcx, rdi
mov dword [rsi], 0x90625062
shr rcx, 0x28
call fcn.1400a9ab8
movzx ebx, al
mov rcx, rdi
or ebx, 0x1d00
shr rcx, 0x24
shl ebx, 8
call fcn.1400a9ab8
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x20
shl ebx, 8
call fcn.1400a9ab8
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x1c
mov dword [rsi + 4], ebx
call fcn.1400a9ab8
movzx ebx, al
mov rcx, rdi
shr rcx, 0x18
shl ebx, 8
call fcn.1400a9ab8
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x14
shl ebx, 8
call fcn.1400a9ab8
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x10
shl ebx, 8
call fcn.1400a9ab8
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0xc
mov dword [rsi + 8], ebx
call fcn.1400a9ab8
movzx ebx, al
mov rcx, rdi
shr rcx, 8
shl ebx, 8
call fcn.1400a9ab8
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 4
shl ebx, 8
call fcn.1400a9ab8
movzx eax, al
mov cl, dil
or ebx, eax
shl ebx, 8
call fcn.1400a9ab8
movzx eax, al
or ebx, eax
mov dword [rsi + 0xc], ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a9c68
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
and dword [rax + 8], 0
mov rdi, rdx
xor r10b, r10b
mov r11, rcx
movabs r8, 0xff80000000000000
movzx esi, r10b
lea rdx, [rsp + 8]
mov ecx, 9
mov r9, rdi
sub ecx, esi
shl ecx, 2
shr r9, cl
xor cl, cl
and r9b, 0xf
xor bl, bl
mov al, r9b
shr al, cl
inc cl
and al, 1
xor byte [rdx], al
xor bl, al
inc rdx
cmp cl, 4
jb 0x1400a9caf
imul eax, esi, 0xfffffffb
inc r10b
movzx edx, bl
lea ecx, [rax + 0x32]
shl rdx, cl
lea ecx, [rax + 0x33]
movzx eax, r9b
shl rax, cl
or rdx, rax
or r8, rdx
cmp r10b, 0xa
jb 0x1400a9c8e
movzx eax, byte [rsp + 0xa]
movzx ecx, byte [rsp + 0xb]
mov rbx, qword [rsp + 0x10]
add ecx, ecx
mov rsi, qword [rsp + 0x18]
or ecx, eax
movzx eax, byte [rsp + 9]
add ecx, ecx
mov rdi, qword [rsp + 0x20]
or ecx, eax
movzx eax, byte [rsp + 8]
add ecx, ecx
or ecx, eax
mov dword [r11], 0x148040
lea eax, [rcx + rcx]
or r8, rax
mov rax, r8
mov dword [r11 + 8], r8d
shr rax, 0x20
mov dword [r11 + 4], eax
ret
Function at 0x1400afe38
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
lea rdx, str.Microsoft_WinInet_
mov rcx, qword [rcx + 8]
call fcn.1400c33c4
test rax, rax
je 0x1400afee7
mov edx, dword [rbx + 0x20]
cmp edx, 0x14
jb 0x1400b004a
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx + 4]
cmp rax, qword [0x1400f4c90]
jne 0x1400b004a
mov rax, qword [rcx + 0xc]
cmp rax, qword [0x1400f4c98]
jne 0x1400b004a
lea rax, [0x1400f3d90]
mov dword [rbp - 0x20], edx
mov qword [rbp - 8], rax
lea r8, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x18], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x20]
and dword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rbp - 0x10], Ordinal_77
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1400b003e
lea rcx, str.___CredentialBlob:
jmp 0x1400b0015
mov rcx, qword [rbx + 8]
lea rdx, str.AppSense_DataNow_
call fcn.1400c33c4
test rax, rax
je 0x1400b004a
lea rcx, str._Ivanti_FileDirector_crEdential_blob__n
call fcn.14000b9e4
cmp dword [rbx + 0x20], 0x14
jb 0x1400b004a
mov rbx, qword [rbx + 0x28]
lea rcx, str.AppN_DN_Win
mov rdx, rbx
call fcn.1400e8020
test eax, eax
jne 0x1400b004a
cmp dword [rbx + 0xc], eax
je 0x1400affba
lea rcx, str.Decrypting_additional_blob_n
call fcn.14000b9e4
mov eax, dword [rbx + 0xc]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], eax
xor r9d, r9d
lea rax, [rbx + 0x14]
xor r8d, r8d
mov qword [rbp - 0x18], rax
xor edx, edx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1400affae
lea rcx, str.___CredentialBlob:
call fcn.14000b9e4
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.140011e44
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b9e4
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400affba
lea rcx, str.BigBad_:_kuhl_m_vAULt_crEd_tryEncrypted___ERROR
call fcn.14000b9e4
cmp dword [rbx + 0x10], 0
je 0x1400b004a
lea rcx, str.Decrypting_additional_blob_n
call fcn.14000b9e4
mov eax, dword [rbx + 0x10]
xor r9d, r9d
mov dword [rbp - 0x20], eax
xor r8d, r8d
mov ecx, dword [rbx + 0xc]
lea rax, [rbp - 0x30]
add rcx, 0x14
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
add rcx, rbx
and qword [rsp + 0x20], 0
xor edx, edx
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1400b003e
lea rcx, str.___UnkBlob_______:
call fcn.14000b9e4
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.140011e44
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b9e4
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400b004a
lea rcx, str.BigBad_:_kuhl_m_vAULt_crEd_tryEncrypted___ERROR
call fcn.14000b9e4
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1400b5da8
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
xor edi, edi
mov r15, r9
mov rsi, r8
lea r13d, [rdi + 0x10]
test ecx, ecx
je 0x1400b5e42
test byte [r8], 0xf
jne 0x1400b5f58
xor ebx, ebx
lea edi, [r13 - 0xf]
cmp dword [r8], ebx
jbe 0x1400b5e3a
test edi, edi
je 0x1400b5f97
mov rcx, qword [rsi + 8]
lea r8, [rbp - 0x59]
mov r14d, ebx
lea rdx, [rbp + 0x6f]
add rcx, r14
call qword [sym.imp.ADVAPI32.dll_SystemFunction026]
mov edi, eax
not edi
shr edi, 0x1f
test edi, edi
je 0x1400b5e27
mov rax, qword [rsi + 8]
movups xmm0, xmmword [rbp - 0x59]
movdqu xmmword [rbx + rax], xmm0
jmp 0x1400b5e33
lea rcx, str.BigBad_:_kuhl_m_lsADumP_dCShAdoW_encode_sensitive_value___ERROR
call fcn.14000b9e4
add ebx, r13d
cmp ebx, dword [rsi]
jb 0x1400b5ded
test edi, edi
je 0x1400b5f97
xor edi, edi
mov dword [rbp - 0x79], r13d
test r15, r15
mov dword [rbp - 0x75], r13d
lea rax, [rbp + 0xf]
lea r12, [0x140145c78]
mov qword [rbp - 0x71], rax
mov eax, dword [rsi]
cmovne r12, r15
lea r13d, [rax + 0x14]
cmp qword [r12 + 8], rdi
je 0x1400b5f8b
cmp dword [r12], edi
je 0x1400b5f8b
test eax, eax
je 0x1400b5f8b
cmp qword [rsi + 8], rdi
je 0x1400b5f8b
mov edx, r13d
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x1400b5f97
mov r8d, dword [rsi]
lea rcx, [rax + 0x14]
mov rdx, qword [rsi + 8]
mov r14, rax
call fcn.1400e84c0
mov r8d, dword [rsi]
lea r9, [r14 + 0x10]
lea rdx, [r14 + 0x14]
mov dword [rsp + 0x20], 4
mov ecx, 0x8000
call fcn.1400036a8
test eax, eax
je 0x1400b5f74
lea ebx, [rdi + 0x10]
mov rcx, r14
mov edx, ebx
call qword [sym.imp.cryptdll.dll_CDGenerateRandomBits]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, dword [r12]
lea rcx, [rbp - 0x49]
mov rdx, qword [r12 + 8]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, ebx
lea rcx, [rbp - 0x49]
mov rdx, r14
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Final]
lea eax, [r13 - 0x10]
mov dword [rbp - 0x65], eax
lea rdx, [rbp - 0x79]
mov dword [rbp - 0x69], eax
lea rcx, [rbp - 0x69]
lea rax, [r14 + 0x10]
mov qword [rbp - 0x61], rax
call qword [sym.imp.ADVAPI32.dll_SystemFunction032]
test eax, eax
js 0x1400b5f61
mov r14, qword [rsi + 8]
lea edi, [rbx - 0xf]
mov qword [rsi + 8], r15
mov dword [rsi], r13d
jmp 0x1400b5f6d
lea rcx, str.BigBad_:_kuhl_m_lsADumP_dCShAdoW_encode_sensitive_value___ERROR
jmp 0x1400b5f92
lea rcx, str.BigBad_:_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___ERROR
call fcn.14000b9e4
test r14, r14
je 0x1400b5f97
jmp 0x1400b5f80
lea rcx, str.BigBad_:_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___ERROR
call fcn.14000b9e4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400b5f97
lea rcx, str.BigBad_:_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___ERROR
call fcn.14000b9e4
mov rbx, qword [rsp + 0x120]
mov eax, edi
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b8020
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, rdx
mov rbp, rcx
lea rdx, [r11 + 0x10]
mov rcx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x1400b80cf
mov eax, dword [rsp + 0x38]
test eax, eax
jle 0x1400b80b8
xor ebx, ebx
test eax, eax
jle 0x1400b80af
mov rsi, rdi
mov rcx, qword [rsi]
lea rdx, str._HTC:
mov r8d, 5
call fcn.1400d8038
test eax, eax
je 0x1400b8088
inc ebx
add rsi, 8
cmp ebx, dword [rsp + 0x38]
jl 0x1400b8061
jmp 0x1400b80af
movsxd rax, ebx
xor edx, edx
mov rcx, qword [rdi + rax*8]
lea r8d, [rdx + 0xa]
add rcx, 0xa
call fcn.1400cf050
mov edx, eax
mov rcx, rbp
mov ebx, eax
call fcn.1400b80f0
test rbx, rbx
jne 0x1400b80c4
lea rcx, str.__No_shared_memory__no_SSO_enabled___n
jmp 0x1400b80bf
lea rcx, str.BigBad_:_Citrix_SSO_Program_args___ERROR
call fcn.14000b9e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400b80db
lea rcx, str.BigBad_:_Citrix_SSO_Program_args___ERROR
call fcn.14000b9e4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret