joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005738
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov dword [rax + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, qword [rsp + 0x80]
xor esi, esi
mov rbp, rcx
and dword [rax - 0x28], esi
mov rcx, qword [rdi]
mov qword [rax - 0x30], r9
and qword [rax - 0x38], rsi
mov rbx, r8
mov r14, r9
lea r8d, [rsi + 1]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400057e3
mov edx, dword [r14]
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400057e3
mov r8d, dword [rsp + 0x68]
mov rdx, rbp
mov rcx, rax
call fcn.1400c3ee0
mov eax, dword [r14]
mov rcx, qword [rdi]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x68]
lea r8d, [rsi + 1]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov esi, eax
test eax, eax
jne 0x1400057e3
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov eax, esi
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140005804
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, rcx
mov ebp, edx
xor edi, edi
lea ecx, [rdi + 0x40]
mov edx, edx
mov r14, r9
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, qword [rsp + 0x70]
mov qword [rbx], rax
test rax, rax
je 0x140005880
mov r8d, ebp
mov rdx, r15
mov rcx, rax
call fcn.1400c3ee0
mov rax, qword [rbx]
mov rcx, qword [rsi]
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov edi, eax
test eax, eax
jne 0x140005880
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140005e54
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r15d, r9d
mov r12, r8
mov esi, edx
mov r14, rcx
xor ebx, ebx
mov dword [rax - 0x38], ebx
lea r9d, [rbx + 8]
lea r8, str.Microsoft_Primitive_Provider
lea rdx, str.SHA256
lea rcx, [rax - 0x28]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x140005fa9
and dword [rsp + 0x28], ebx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
lea r8, [rsp + 0xa8]
lea rdx, str.ObjectLength
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
test eax, eax
js 0x140005f8c
mov edx, dword [rsp + 0xa8]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140005f9a
and dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9d, dword [rsp + 0xa8]
mov r8, rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
js 0x140005f73
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
xor r9d, r9d
lea r8d, [rbx + 0x20]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
setns bl
mov dword [rsp + 0x40], ebx
test ebx, ebx
jne 0x140005f66
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_ngc_signature_derived___BCryptFinishHash:_0x_08x_n
call fcn.14000bce4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
jmp 0x140005f81
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_ngc_signature_derived___BCryptCreateHash:_0x_08x_n
call fcn.14000bce4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140005f9a
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_ngc_signature_derived___BCryptGetProperty:_0x_08x_n
call fcn.14000bce4
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
jmp 0x140005fb7
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_ngc_signature_derived___BCryptOpenAlgorithmProvider:_0x_08x_n
call fcn.14000bce4
jmp 0x140005fc9
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140007f1c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x37]
sub rsp, 0xd0
xor ebx, ebx
mov esi, edx
mov rdi, rcx
mov r15, r8
lea r12d, [rbx + 0x40]
lea rcx, [rbp - 0x71]
lea edx, [rbx + 0x36]
mov r8d, r12d
mov r14d, r9d
call fcn.1400c6610
lea edx, [rbx + 0x5c]
lea rcx, [rbp - 0x31]
mov r8d, r12d
call fcn.1400c6610
test esi, esi
je 0x140007f93
lea rcx, [rbp - 0x71]
lea rdx, [rbp - 0x31]
mov r8d, esi
sub rcx, rdi
sub rdx, rdi
mov al, byte [rdi]
xor byte [rcx + rdi], al
xor byte [rdx + rdi], al
inc rdi
dec r8
jne 0x140007f83
lea rdx, [r14 + 0x40]
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400080be
movaps xmm0, xmmword [rbp - 0x71]
movaps xmm1, xmmword [rbp - 0x61]
lea rcx, [rax + 0x40]
mov r8, r14
mov rdx, r15
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [rbp - 0x51]
movaps xmm1, xmmword [rbp - 0x41]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm1
call fcn.1400c3ee0
lea r8d, [r14 + 0x40]
lea r9, [rsp + 0x30]
mov rdx, rsi
mov ecx, 0x8004
mov dword [rsp + 0x20], SQLAllocHandle
call fcn.140003884
test eax, eax
je 0x1400080b5
mov r15d, dword [rbp + 0x77]
mov r14d, dword [rbp + 0x67]
mov ecx, r12d
lea rdx, [r15 + 0x54]
add rdx, r14
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400080b5
movaps xmm0, xmmword [rbp - 0x31]
movaps xmm1, xmmword [rbp - 0x21]
mov rdx, qword [rbp + 0x5f]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [rbp - 0x11]
movaps xmm1, xmmword [rbp - 1]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0x50], eax
test rdx, rdx
je 0x14000806d
test r14d, r14d
je 0x14000806d
lea rcx, [rdi + 0x54]
mov r8d, r14d
call fcn.1400c3ee0
mov rdx, qword [rbp + 0x6f]
test rdx, rdx
je 0x14000808a
test r15d, r15d
je 0x14000808a
lea rcx, [r14 + 0x54]
mov r8, r15
add rcx, rdi
call fcn.1400c3ee0
mov r9, qword [rbp + 0x7f]
lea r8d, [r15 + 0x54]
mov rdx, rdi
mov ecx, 0x8004
add r8d, r14d
mov dword [rsp + 0x20], SQLAllocHandle
call fcn.140003884
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0xd0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140008540
Capabilities:
Encrypt data using dpapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov r15d, dword [rsp + 0xa0]
xor edi, edi
mov r14, r9
mov rsi, r8
mov dword [rax - 0x18], edx
mov qword [rax - 0x10], rcx
mov dword [rax - 0x28], r15d
mov qword [rax - 0x20], r9
cmp qword [rsp + 0xc8], rdi
je 0x140008636
cmp dword [rsp + 0xd0], edi
je 0x140008636
call fcn.140006c18
mov rbx, rax
test rax, rax
je 0x1400086ba
mov rax, qword [rsp + 0xc0]
mov r8d, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb8]
mov r9, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xd8]
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
call fcn.140008298
mov edi, eax
test eax, eax
je 0x140008629
test rsi, rsi
je 0x140008629
cmp qword [rbx + 0x30], 0
je 0x140008629
cmp dword [rbx + 0x2c], 0
je 0x140008629
mov edx, dword [rbx + 0x2c]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140008629
mov r8d, dword [rbx + 0x2c]
mov rdx, qword [rbx + 0x30]
mov rcx, rax
call fcn.1400c3ee0
mov rcx, rbx
call fcn.140006d6c
jmp 0x1400086ba
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xb0]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa8]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov edi, eax
test eax, eax
je 0x1400086ba
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0xc0]
mov ecx, 0x40
mov edx, eax
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0xb8]
mov qword [rcx], rax
test rax, rax
je 0x1400086af
mov r8d, dword [rbx]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1400c3ee0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x140009600
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r14d, dword [rcx + 0x1c]
mov eax, 0x8004
mov rbx, rcx
xor esi, esi
cmp r14d, 0x8009
mov r13, rdx
cmove r14d, eax
mov ecx, r14d
call fcn.1400047f4
mov ecx, dword [rbx + 0x28]
call fcn.140004918
mov ecx, dword [rbx + 0x28]
mov edi, eax
call fcn.140004884
lea ecx, [rsi + 0x40]
lea r15d, [rax + rdi]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x14000981b
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0x20]
lea r15d, [rsi + 0x14]
lea r12d, [rsi + 0x10]
mov dword [rsp + 0x28], eax
lea r9, [rbx + 0x34]
mov r8d, r15d
mov rdx, r13
mov ecx, r14d
mov dword [rsp + 0x20], r12d
call fcn.140003e80
test eax, eax
je 0x140009812
mov ecx, dword [rbx + 0x28]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov r8d, edi
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.140004544
test eax, eax
je 0x1400097fe
mov rcx, qword [rsp + 0xa0]
lea r13d, [rsi + 1]
lea r8, [rdi + rbp]
mov edx, r13d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400097d3
mov eax, dword [rbx + 0x54]
lea ecx, [rsi + 0x40]
mov edx, eax
mov dword [rsp + 0xb0], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400097d3
mov r8d, dword [rsp + 0xb0]
mov rdx, qword [rbx + 0x4c]
mov rcx, rax
call fcn.1400c3ee0
mov rcx, qword [rsp + 0xa0]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400097ca
mov r14d, dword [rbx + 0x2c]
mov rcx, qword [rsp + 0xc0]
mov rdx, rdi
cmp r14d, r15d
cmovb r15d, r14d
mov r8d, r15d
call fcn.1400c3ee0
mov ebx, dword [rbx + 0x30]
mov rcx, qword [rsp + 0xb8]
cmp ebx, r12d
lea rdx, [r14 + rdi]
cmovb r12d, ebx
mov r8d, r12d
call fcn.1400c3ee0
mov esi, r13d
add ebx, 0xfffffff0
je 0x1400097ca
xor edx, edx
test ebx, ebx
je 0x1400097ca
test esi, esi
je 0x1400097ca
xor ecx, ecx
mov eax, edx
add rax, r14
cmp byte [rax + rdi + 0x10], cl
sete cl
add edx, r13d
and esi, ecx
cmp edx, ebx
jb 0x1400097af
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
call fcn.140003c2c
test eax, eax
jne 0x140009812
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_close_hprov_delete_container__0x_08x__n
jmp 0x14000980b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_hkey_session__0x_08x__n
mov edx, eax
call fcn.14000bce4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009888
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x1400098e6
test edi, edi
je 0x1400098dd
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
lea eax, [rdi - 1]
cmp ecx, eax
jne 0x1400098dd
mov ebx, 1
jmp 0x1400098e6
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400099d8
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov ebp, r8d
cmp dword [0x1401518a8], ebx
mov r14, rdx
mov r15, rcx
mov esi, ebx
mov dword [rax + 0x20], ebx
je 0x140009ab3
lea rax, [rax + 0x20]
lea r8d, [rbx + 1]
mov edx, ebp
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x140009b16
mov edx, dword [rsp + 0x78]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140009b16
lea rax, [rsp + 0x78]
lea r8d, [rbx + 1]
mov r9, rdi
mov edx, ebp
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov esi, eax
test eax, eax
je 0x140009aa8
lea rcx, str._n_nBase64_of_file_:__s_n_n
mov rdx, r15
call fcn.14000bce4
cmp dword [rsp + 0x78], ebx
jbe 0x140009a9c
mov ecx, ebx
movzx edx, word [rdi + rcx*2]
lea rcx, [0x1400f7e00]
call fcn.14000bce4
inc ebx
cmp ebx, dword [rsp + 0x78]
jb 0x140009a82
lea rcx, str._n
call fcn.14000bce4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140009b16
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
mov rdi, rax
cmp rcx, 0xfffffffffffffffd
ja 0x140009b16
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, r14
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140009b0d
cmp ebp, dword [rsp + 0x78]
jne 0x140009b0d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140009b34
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
xor ebx, ebx
mov rdi, r8
mov r14, rdx
cmp dword [0x1401518ac], ebx
je 0x140009b81
call fcn.140013044
mov ebx, eax
test eax, eax
jne 0x140009c23
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_file_readGeneric___kull_m_string_quick_base64_to_Binary__0x_08x__n
mov edx, eax
call fcn.14000bce4
jmp 0x140009c23
and qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r9d
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140009c23
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140009c1a
cmp dword [rsp + 0x4c], ebx
jne 0x140009c1a
mov rax, qword [rsp + 0x48]
mov ecx, 0x40
mov edx, eax
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r14], rax
test rax, rax
je 0x140009c1a
mov r8d, dword [rdi]
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140009c11
mov eax, dword [rsp + 0x40]
cmp dword [rdi], eax
jne 0x140009c11
mov ebx, 1
jmp 0x140009c1a
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop r14
ret
Function at 0x14000b0d0
Capabilities:
Get domain controller name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
or edx, 0x40020000
lea rax, [r11 + 0x20]
mov rsi, r8
mov qword [r11 - 0x10], rax
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ebx, ebx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov qword [r11 + 0x20], rbx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x14000b16d
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2 + 4], bx
jne 0x14000b11c
lea eax, [rax*2 + 2]
mov ecx, 0x40
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsi], rax
test rax, rax
je 0x14000b160
mov rax, qword [rsp + 0x58]
mov r8d, edi
mov ebx, 1
mov rdx, qword [rax]
add rdx, 4
call fcn.1400c3ee0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
jmp 0x14000b17b
lea rcx, str.ERROR_kull_m_net_getDC___DsGetDcName:__u_n
mov edx, eax
call fcn.14000bce4
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b190
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
neg ecx
mov rsi, rdx
sbb edi, edi
and dword [rax + 8], ebx
lea r8, [rax + 8]
and edi, 3
xor edx, edx
lea ecx, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14000b21d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14000b21d
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14000b231
lea r8, [rsp + 0x30]
lea ecx, [rdi + 4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ebx, eax
test eax, eax
jne 0x14000b231
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_data___0x_08x__n
mov edx, eax
call fcn.14000bce4
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000b231
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_init___0x_08x__n
mov edx, eax
call fcn.14000bce4
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b394
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
mov rdx, qword [rcx + 8]
lea rax, [0x1401518b0]
mov rsi, rcx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x20], rax
mov ecx, dword [rdx]
mov rbp, r8
test ecx, ecx
je 0x14000b4e0
dec ecx
je 0x14000b469
sub ecx, 2
je 0x14000b43a
cmp ecx, 3
jne 0x14000b5b7
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x14000b48e
cmp qword [rsi], rbx
je 0x14000b412
mov rcx, qword [rdx + 8]
mov edx, dword [rsi]
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x14000b5b7
mov rax, qword [rsi + 8]
mov rdx, qword [rdi]
lea r9, [rsp + 0x70]
mov rcx, qword [rax + 8]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
jmp 0x14000b5b7
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x14000b48e
mov rcx, qword [rdx + 8]
mov dword [rsp + 0x30], ebx
mov r9d, r8d
mov qword [rsp + 0x28], rbx
mov edx, 0x22c187
mov r8, qword [rdi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rsi
call fcn.14000a138
jmp 0x14000b433
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x14000b48e
mov rcx, qword [rdx + 8]
mov rdx, qword [rsi]
mov r9, r8
mov r8, qword [rdi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14000b433
mov rdx, r8
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000b5b7
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, rdi
call fcn.14000b394
test eax, eax
je 0x14000b4d0
lea rdx, [rsp + 0x40]
mov r8, rbp
mov rcx, rsi
call fcn.14000b394
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000b5b7
mov rdx, qword [rdi + 8]
mov ecx, dword [rdx]
test ecx, ecx
je 0x14000b5a7
dec ecx
je 0x14000b587
dec ecx
je 0x14000b56d
dec ecx
je 0x14000b54b
cmp ecx, 3
jne 0x14000b5b7
mov rcx, qword [rdx + 8]
mov edx, dword [rdi]
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14000b5b7
mov rax, qword [rdi + 8]
mov rdx, qword [rsi]
lea r9, [rsp + 0x70]
mov rcx, qword [rax + 8]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x14000b433
mov rcx, qword [rdx + 8]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x22c183
jmp 0x14000b457
mov rcx, qword [rdx + 8]
mov rdx, qword [rsi]
mov r9, r8
mov rcx, qword [rcx]
mov r8, qword [rdi]
call fcn.14000bae4
jmp 0x14000b433
mov rcx, qword [rdx + 8]
mov rdx, qword [rdi]
mov r9, r8
mov r8, qword [rsi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14000b433
mov rdx, qword [rdi]
mov rcx, qword [rsi]
call fcn.1400c3ee0
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret