joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009ff0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
push rbx
push rdi
push r12
push r14
sub rsp, 0x78
xor edi, edi
mov ebx, r8d
mov r14, r9
mov dword [rax - 0x50], ecx
mov r12, rdx
mov qword [rax - 0x48], rdi
xor r8d, r8d
mov dword [rax - 0x40], edi
lea r9d, [rdi + 0x18]
mov qword [rax - 0x38], rdi
xor edx, edx
mov dword [rax - 0x30], edi
lea rcx, [rax - 0x60]
mov dword [rax - 0x78], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000a1f0
mov qword [rsp + 0xa8], rbp
lea ecx, [rdi + 0x40]
lea ebp, [rbx + 0xc]
mov qword [rsp + 0xb0], rsi
mov edx, ebp
mov qword [rsp + 0x70], r15
mov r15, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000a1ce
mov r8d, ebx
mov dword [rax], 0x208
lea rcx, [rax + 0xc]
mov dword [rax + 4], 0x6602
mov rdx, r12
mov dword [rax + 8], ebx
call fcn.1400351a0
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov rdx, rsi
mov dword [rsp + 0x20], 0x100
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14000a1ce
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000a1c3
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
xor r9d, r9d
lea edx, [rdi + 5]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x14000a1b8
mov r8d, dword [rsp + 0xc0]
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000a1b8
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0xa0]
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea edx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000a1b8
mov edx, dword [rsp + 0xa0]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000a1b8
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0xa0]
mov r8, rax
mov dword [rsp + 0x20], edi
lea edx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [rsp + 0xd0]
mov edi, eax
cmp dword [rsp + 0xa0], edx
mov rcx, qword [rsp + 0xc8]
cmovb edx, dword [rsp + 0xa0]
mov r8d, edx
mov rdx, rbx
call fcn.1400351a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov eax, edi
add rsp, 0x78
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x14000a490
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x60
xor ebp, ebp
mov rdi, r9
mov ebx, r8d
mov r15, rdx
mov r14, rcx
cmp r8d, 0x10
jbe 0x14000a681
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x14000a673
xor r9d, r9d
lea edx, [rbp + 1]
mov r8, rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000a668
mov qword [rsp + 0x90], rsi
lea esi, [rbx + 0xf]
shr esi, 4
and ebx, 0xf
mov qword [rsp + 0xa8], r13
mov r13d, 0x10
mov edi, esi
cmovne r13d, ebx
shl edi, 4
cmp esi, 2
jbe 0x14000a548
lea eax, [rdi - 0x20]
xor r9d, r9d
mov dword [rsp + 0xa0], eax
xor r8d, r8d
lea rax, [rsp + 0xa0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000a658
lea eax, [r13 + 0x10]
mov qword [rsp + 0x98], r12
add esi, 0xfffffffe
mov r8d, eax
shl esi, 4
lea rcx, [rsp + 0x40]
add rsi, r15
mov ebx, eax
mov rdx, rsi
call fcn.1400351a0
mov r12d, 0x10
lea rax, [rsp + 0x40]
add rax, rbx
sub r12d, r13d
mov rcx, rax
mov qword [rsp + 0x38], rax
mov r8d, r12d
xor edx, edx
call fcn.1400342d0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0xa0], Ordinal_26
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000a650
movdqu xmm1, xmmword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
movdqu xmm0, xmmword [rsp + 0x50]
mov ebx, r13d
mov r8d, r12d
add rdx, rbx
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.1400351a0
lea rax, [rsp + 0xa0]
mov dword [rsp + 0xa0], Ordinal_26
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ebp, eax
test eax, eax
je 0x14000a650
movups xmm0, xmmword [rsp + 0x50]
lea ecx, [rdi - 0x10]
mov r8d, ebx
add rcx, r15
lea rdx, [rsp + 0x40]
movups xmmword [rsi], xmm0
call fcn.1400351a0
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r13, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, ebp
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
jne 0x14000a673
lea rax, [rsp + 0xa0]
mov dword [rsp + 0xa0], Ordinal_26
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x14000a6c0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push r12
push r14
sub rsp, 0x68
mov rax, r9
mov ebx, r8d
mov r12, rdx
mov r14, rcx
cmp r8d, 0x10
jbe 0x14000a82a
xor r9d, r9d
mov r8, rax
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000a81d
mov qword [rsp + 0x90], rsi
mov ebp, 0x10
mov qword [rsp + 0x60], r15
lea esi, [rbx + 0xf]
shr esi, 4
mov r15d, ebp
and ebx, 0xf
mov qword [rsp + 0x98], rdi
mov edi, esi
cmovne r15d, ebx
shl edi, 4
cmp esi, 2
jbe 0x14000a782
lea ecx, [rdi - 0x20]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
xor r8d, r8d
mov dword [rsp + 0xa0], ecx
xor edx, edx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x14000a782
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x60]
add rsp, 0x68
pop r14
pop r12
pop rbp
pop rbx
ret
lea eax, [r15 + 0x10]
add esi, 0xfffffffe
shl esi, 4
lea rcx, [rsp + 0x40]
add rsi, r12
mov r8d, eax
mov rdx, rsi
mov ebx, eax
call fcn.1400351a0
lea rcx, [rsp + 0x40]
sub ebp, r15d
add rcx, rbx
mov r8d, ebp
xor edx, edx
call fcn.1400342d0
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], Ordinal_36
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0xa0], Ordinal_36
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebx, eax
test eax, eax
je 0x14000a762
movups xmm0, xmmword [rsp + 0x50]
lea ecx, [rdi - 0x10]
mov r8d, r15d
add rcx, r12
lea rdx, [rsp + 0x40]
movups xmmword [rsi], xmm0
call fcn.1400351a0
mov eax, ebx
jmp 0x14000a762
xor eax, eax
add rsp, 0x68
pop r14
pop r12
pop rbp
pop rbx
ret
jne 0x14000a81d
mov ebp, 0x10
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
mov dword [rsp + 0xa0], ebp
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
add rsp, 0x68
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x14000a870
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
mov qword [rsp + 0x20], rbp
mov dword [rsp + 8], ecx
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov dword [rsp + 0x60], 1
mov ebp, r8d
mov dword [rsp + 0x20], 0xf0000000
mov r14, rdx
lea rcx, [rsp + 0x38]
xor edi, edi
xor r8d, r8d
xor edx, edx
lea r9d, [rdi + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000a992
mov qword [rsp + 0x68], rbx
lea edx, [rdi + 0x1c]
mov rbx, qword [rsp + 0x38]
lea ecx, [rdi + 0x40]
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000a97b
mov dword [rax], 0x208
lea r8d, [rdi + 0x1c]
mov dword [rax + 4], 0x660e
xor r9d, r9d
mov dword [rax + 8], 0x10
mov rdx, rsi
movups xmm0, xmmword [r15]
mov rcx, rbx
movups xmmword [rax + 0xc], xmm0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14000a97b
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x60]
xor r9d, r9d
lea edx, [rdi + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000a970
mov r8d, ebp
mov r9, qword [rsp + 0x88]
mov rdx, r14
mov rcx, qword [rsp + 0x30]
cmp dword [rsp + 0x90], edi
je 0x14000a969
call fcn.14000a6c0
jmp 0x14000a96e
call fcn.14000a490
mov edi, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000aac0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor r13d, r13d
mov r15d, r9d
mov r12, r8
mov dword [rsp + 0x30], 1
mov rbp, rdx
mov dword [rsp + 0x20], 0xf0000000
mov r14, rcx
xor r8d, r8d
lea r9d, [r13 + 0x18]
xor edx, edx
lea rcx, [rsp + 0x40]
mov edi, r13d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000ac5b
lea edx, [r13 + 0x1c]
mov qword [rsp + 0x80], rbx
mov rbx, qword [rsp + 0x40]
lea ecx, [rdx + 0x24]
mov qword [rsp + 0x88], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000ac3e
mov dword [rax], 0x208
lea r8d, [r13 + 0x1c]
mov dword [rax + 4], 0x660e
xor r9d, r9d
mov dword [rax + 8], 0x10
mov rdx, rsi
movups xmm0, xmmword [r14]
mov rcx, rbx
movups xmmword [rax + 0xc], xmm0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14000ac3e
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
xor r9d, r9d
lea edx, [r13 + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000ac33
mov rcx, qword [rsp + 0x38]
lea edx, [r13 + 1]
xor r9d, r9d
mov r8, rbp
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000ac33
mov edx, r15d
lea ecx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, qword [rsp + 0xa0]
mov rsi, rax
mov qword [rbx], rax
test rax, rax
je 0x14000ac33
mov r14, qword [rsp + 0xa8]
mov r8d, r15d
mov rdx, r12
mov rcx, rax
mov dword [r14], r15d
call fcn.1400351a0
mov rcx, qword [rsp + 0x38]
lea r8d, [r13 + 1]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov edi, eax
test eax, eax
jne 0x14000ac33
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov dword [r14], r13d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000b0f0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rsp + 0x60]
mov rdi, r9
mov esi, r8d
mov rbp, rdx
xor ebx, ebx
xor r8d, r8d
mov qword [r9], rbx
xor edx, edx
lea r9, [rsp + 0x60]
mov dword [r14], esi
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x14000b193
mov edx, esi
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x14000b188
mov r8d, esi
mov rdx, rbp
mov rcx, rax
call fcn.1400351a0
mov rax, qword [rdi]
lea r8d, [rbx + 1]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ebx, eax
test eax, eax
jne 0x14000b188
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140017cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x68
movups xmm0, xmmword [str.ControlSet000]
mov eax, dword [0x14006a288]
mov r15, r8
mov dword [rsp + 0x58], eax
lea r8, str.Select
movups xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x38]
mov rbp, rdx
movsd xmm0, qword [0x14006a280]
mov r14, rcx
mov qword [rsp + 0x28], rax
xor ebx, ebx
movsd qword [rsp + 0x50], xmm0
mov dword [rsp + 0x20], 0x20019
call fcn.140021a90
test eax, eax
je 0x140017ea8
mov qword [rsp + 0x90], rsi
xor esi, esi
mov qword [rsp + 0x60], r12
lea r12, str.Current
mov qword [rsp + 0x98], rdi
nop
cmp esi, 2
jae 0x140017e65
mov ecx, dword [r14]
xor ebx, ebx
mov rdx, qword [r12 + rsi*8]
mov dword [rsp + 0xa8], 4
test ecx, ecx
je 0x140017de3
cmp ecx, 1
jne 0x140017e1c
mov r8, rdx
mov rcx, r14
mov rdx, qword [rsp + 0x38]
call fcn.140021da0
test rax, rax
setne bl
test rax, rax
je 0x140017e1c
mov r8d, dword [rax + 8]
xor ebx, ebx
mov edi, r8d
btr edi, 0x1f
cmp dword [rsp + 0xa8], edi
setae bl
jb 0x140017dda
lea rdx, [rax + 0xc]
test r8d, r8d
js 0x140017dcd
mov rax, qword [r14 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, edi
lea rcx, [rsp + 0x30]
call fcn.1400351a0
mov dword [rsp + 0xa8], edi
jmp 0x140017e1c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
je 0x140017e1c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
inc esi
test ebx, ebx
je 0x140017d50
mov r9d, dword [rsp + 0x30]
lea r8, str._03u
xor ebx, ebx
lea rcx, [rsp + 0x54]
lea edx, [rbx + 4]
call fcn.140004860
cmp eax, 0xffffffff
je 0x140017e65
mov qword [rsp + 0x28], r15
lea r8, [rsp + 0x40]
mov rdx, rbp
mov dword [rsp + 0x20], 0x20019
mov rcx, r14
call fcn.140021a90
mov ebx, eax
mov eax, dword [r14]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
test eax, eax
je 0x140017e91
cmp eax, 1
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140017ea8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x140018830
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov dword [rsp + 0x20], r9d
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xd0
mov eax, dword [rcx]
xor ebx, ebx
mov dword [rbp - 0x79], 0x10
mov r15, rcx
mov dword [rbp - 0x75], 0x10
lea rcx, [rbp - 1]
mov qword [rbp - 0x71], rcx
mov r12, r8
mov qword [rsp + 0x30], rbx
lea r14, [rdx + rax]
mov qword [rsp + 0x38], rbx
mov esi, ebx
mov edi, ebx
test eax, eax
je 0x140018a4e
mov edx, dword [r15 + 4]
test edx, edx
je 0x140018a4e
movzx ecx, word [r14 + 2]
sub ecx, 1
je 0x140018925
cmp ecx, 1
jne 0x140018a40
cmp dword [r14 + 4], 0x10
jb 0x140018a40
lea rax, [rbp + 0x57]
mov rcx, r12
mov qword [rsp + 0x28], rax
lea r9d, [rdx - 0x18]
lea rax, [rbp + 0x5f]
lea r8, [r14 + 0x18]
mov qword [rsp + 0x20], rax
lea rdx, [r14 + 8]
call fcn.14000aac0
test eax, eax
je 0x140018a3b
mov eax, dword [rbp + 0x57]
lea ecx, [rbx + 0x40]
mov edx, eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, qword [rbp + 0x5f]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140018917
mov r8d, dword [rbp + 0x57]
mov rdx, rdi
mov rcx, rax
call fcn.1400351a0
lea esi, [rbx + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140018a02
cmp edx, 6
jb 0x140018a40
lea rcx, [rbp - 0x59]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, 0x10
lea rcx, [rbp - 0x59]
mov rdx, r12
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 4
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov ecx, 0x12
mov eax, dword [rbp + 0x7f]
lea r8d, [rcx - 7]
cmp dword [rbp + 0x77], ebx
je 0x140018986
test eax, eax
lea rdx, str.NTPASSWORD
cmovne r8d, ecx
lea rcx, str.NTPASSWORDHISTORY
jmp 0x14001899a
test eax, eax
lea rdx, str.LMPASSWORD
cmovne r8, rcx
lea rcx, str.LMPASSWORDHISTORY
cmovne rdx, rcx
lea rcx, [rbp - 0x59]
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x59]
call qword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [r15 + 4]
mov ecx, 0x40
add eax, 0xfffffffc
mov edx, eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
mov rdi, rax
test rax, rax
je 0x140018a40
mov r8d, dword [rsp + 0x30]
lea rdx, [r14 + 4]
mov rcx, rax
call fcn.1400351a0
lea rdx, [rbp - 0x79]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
mov esi, eax
not esi
shr esi, 0x1f
test esi, esi
je 0x140018a3b
mov r14d, dword [rsp + 0x30]
mov eax, dword [rbp + 0x6f]
mov rdi, qword [rsp + 0x38]
mov dword [rbp + 0x5f], eax
test r14d, r14d
je 0x140018a40
nop dword [rax + rax]
mov ecx, ebx
lea r8, [rbp - 0x69]
add rcx, rdi
lea rdx, [rbp + 0x5f]
call qword [sym.imp.ADVAPI32.dll_SystemFunction027]
add ebx, 0x10
cmp ebx, r14d
jb 0x140018a20
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140018a4e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140018a70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x30
xor ebx, ebx
mov rsi, rcx
mov ecx, dword [rcx]
mov r15, r8
mov dword [rsp + 0x60], ebx
mov rbp, rdx
test ecx, ecx
je 0x140018ac3
cmp ecx, 1
jne 0x140018c7a
lea r8, str.SupplementalCredentials
mov rcx, rsi
call fcn.140021da0
test rax, rax
mov edi, ebx
setne dil
test rax, rax
je 0x140018afc
mov eax, dword [rax + 8]
btr eax, 0x1f
mov dword [rsp + 0x60], eax
jmp 0x140018b00
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.SupplementalCredentials
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov edi, ebx
sete dil
test eax, eax
je 0x140018afc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x60]
test edi, edi
je 0x140018c7a
cmp eax, 0x90
jbe 0x140018c7a
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140018c7a
mov edx, dword [rsi]
mov qword [rsp + 0x68], r14
test edx, edx
je 0x140018ba5
cmp edx, 1
jne 0x140018c6c
lea r8, str.SupplementalCredentials
mov rdx, rbp
mov rcx, rsi
call fcn.140021da0
test rax, rax
mov r14d, ebx
mov rdx, rax
setne r14b
test rax, rax
je 0x140018bdf
mov ecx, dword [rax + 8]
mov r14d, ebx
mov ebp, ecx
btr ebp, 0x1f
cmp dword [rsp + 0x60], ebp
setae r14b
jb 0x140018b9f
add rdx, 0xc
test ecx, ecx
js 0x140018b94
mov rax, qword [rsi + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, ebp
mov rcx, rdi
call fcn.1400351a0
mov dword [rsp + 0x60], ebp
jmp 0x140018bdf
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.SupplementalCredentials
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov r14d, ebx
sete r14b
test eax, eax
je 0x140018bdf
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14d, r14d
je 0x140018c6c
mov edx, dword [rdi + 0xc]
mov ecx, 0x40
add edx, 0xc
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140018c6c
mov r9d, dword [rsp + 0x60]
lea r14, [rax + 4]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], r14
add r9d, 0xffffffe0
mov qword [rsp + 0x20], rax
lea r8, [rdi + 0x20]
mov rcx, r15
lea rdx, [rdi + 0x10]
call fcn.14000aac0
test eax, eax
je 0x140018c63
mov eax, dword [r14]
mov rbp, qword [rsp + 0x78]
cmp eax, dword [rdi + 0xc]
jne 0x140018c5a
mov r8d, eax
lea rcx, [rsi + 0xc]
mov rdx, rbp
mov ebx, 1
call fcn.1400351a0
mov rcx, rsi
call fcn.1400245b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x68]
mov eax, ebx
add rsp, 0x30
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001b820
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r14
sub rsp, 0x60
mov r14d, edx
mov rbp, rcx
xor esi, esi
lea rdx, str.ServicesActive
xor ecx, ecx
lea r8d, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14001b902
lea r8d, [rsi + 4]
mov qword [rsp + 0x80], rdi
lea rdx, str.SamSs
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14001b8a4
lea rax, [rsp + 0x90]
xor edx, edx
lea r9d, [rsi + 0x24]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x14001b8fe
mov r8d, dword [rsp + 0x4c]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001b8fe
mov r8, rbp
mov rdx, rax
call fcn.140013de0
mov ebx, eax
test eax, eax
jne 0x14001b8e5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x14001b8e5
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret