joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401433a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401433ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401433ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401433ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401433ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1401433ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401433f0
xor al, al
add rsp, 0x28
ret

Function at 0x140143e50
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140143eb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140143eb2
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140143eb2
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140143eb2
cmp dword [rdx + 0x84], 0xe
jbe 0x140143eb2
cmp dword [rdx + 0xf8], 0
je 0x140143eb2
mov ecx, ebx
call fcn.140143d10
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x14014a348]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140143b90
cmp dword [rsp + 0x60], 0
jne 0x140143ef5
mov ecx, ebx
call fcn.140143cc0
int3
add rsp, 0x40
pop rbx
ret

Function at 0x140143f40
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140143f9c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140143f9c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140143f9c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140143f9c
cmp dword [rcx + 0x84], 0xe
jbe 0x140143f9c
cmp dword [rcx + 0xf8], 0
je 0x140143f9c
mov ecx, ebx
call fcn.140143d10
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x14014a348]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140143b90
cmp dword [rsp + 0x60], 0
jne 0x140143fdf
mov ecx, ebx
call fcn.140143cc0
int3
add rsp, 0x40
pop rbx
ret
Function at 0x140144740
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140149080]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14014477c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.14014324c
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140144838
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14014489e
test ebx, ebx
jne 0x14014489e
lea ecx, [rax + 2]
call fcn.14014324c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140144f10
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
invalid
invalid
call r14
mov eax, 0xb8d6ff41
call r14
mov eax, 0xb8d6ff41
call r14
invalid
mov eax, 0xb8d6ff41
call r14
mov bh, 0x40
call rdi
mov ebx, 0xabc5ff42
invalid
stosd dword [rdi], eax
call qword [r8 - 0x7300d58b]
invalid
jne 0x14003f6c1
invalid
invalid
invalid
dec dword [rbp - 0x7200d28b]
jne 0x14003f6c8
dec dword [rbp - 0x7200d28b]
jne 0x14003f6d0
dec dword [rbp - 0x7200d28b]
jne 0x14003f6d8
sub eax, 0x2d758dff
dec dword [rbp - 0x7200d28b]
jne 0x14003f6e0
invalid
sub eax, 0x2d758dff
dec dword [rbp - 0x7200d28b]
jne 0x14003f6ec
dec dword [rbp - 0x7200d28b]
jne 0x14003f6e8
dec dword [rbp - 0x7200d28b]
dec dword [rbp - 0x7200d28b]
jne 0x14003f6f4
jne 0x14003f6f0
dec dword [rbp - 0x7200d28b]
jne 0x14003f6f8
dec dword [rbp - 0x7200d28b]
jne 0x14003f6fc
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f700
dec dword [rbp - 0x7200d28b]
jne 0x14003f704
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f708
dec dword [rbp - 0x7200d28b]
jne 0x14003f70c
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f710
dec dword [rbp - 0x7200d28b]
jne 0x14003f714
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f718
dec dword [rbp - 0x7200d28b]
jne 0x14003f71c
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f720
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f724
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f728
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f72c
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f730
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f734
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f738
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jne 0x14003f73c
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7200d28b]
jbe 0x14003f740
lea esi, [rbp + 0x2d]
dec dword [rbp - 0x7300d28a]
je 0x14003f744
lea esi, [rsi + 0x2d]
dec dword [rsp + rsi*2 + 0x798dff2d]
sub edi, edi
invalid
dec dword [rbp - 0x2400d487]
shl dword [rbp - 1], cl
lea edi, [rcx + 0x2b]
invalid
fcmovnbe st(0), st(3)
invalid
invalid
out 0xe4, eax
imul edi, edi, 0xffffffe8
in eax, 0x6b
invalid
call 0x129036312
in eax, 0x6b
invalid
call 0x129036316
in eax, 0x6b
invalid
call 0x12903631a
in eax, 0x6b
invalid
call 0x12903631e
in eax, 0x6b
invalid
call 0x129036322
in eax, 0x6b
invalid
call 0x129036326
in eax, 0x6b
invalid
call 0x12903632a
in eax, 0x6b
invalid
call 0x12903632e
in eax, 0x6b
invalid
Function at 0x1400011e0
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov edi, ecx
mov rbx, rdx
lea rcx, [0x140004630]
call fcn.14001b110
call fcn.1400042b0
call fcn.140001110
lea rcx, [0x14005cad0]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x140001308
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x1400013df
mov qword [rsp + 0x50], rsi
xor esi, esi
cmp edi, 2
jne 0x140001384
mov rcx, qword [rbx + 8]
lea r8d, [rsi + 4]
lea rdx, str._ddd
call fcn.14001be24
lea rdi, str.ssh_agent
test eax, eax
jne 0x140001266
mov dword [0x14005ccf4], 7
jmp 0x1400012b0
mov rcx, qword [rbx + 8]
lea rdx, [0x1400395a8]
mov r8d, 3
call fcn.14001be24
test eax, eax
jne 0x14000128c
mov dword [0x14005ccf4], 6
jmp 0x1400012b0
mov rcx, qword [rbx + 8]
lea rdx, [0x1400395b0]
mov r8d, 2
call fcn.14001be24
test eax, eax
jne 0x1400012cf
mov dword [0x14005ccf4], 5
mov qword [0x14006eb50], rdi
mov qword [0x14006eb60], rsi
mov qword [0x14006eb58], rsi
mov dword [0x14005cb8c], 1
mov rcx, qword [rbx + 8]
lea rdx, [0x1400395b0]
mov r8d, 2
call fcn.14001be24
test eax, eax
jne 0x140001315
lea edx, [rax + 1]
lea rcx, [0x1400010f0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov ecx, 1
call fcn.140001d20
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rbx + 8]
call fcn.14001bbd0
movsxd rbx, eax
test eax, eax
je 0x140001384
mov qword [0x14006eb50], rdi
mov dword [0x14005ccf4], 3
mov qword [0x14006eb60], rsi
mov qword [0x14006eb58], rsi
mov dword [0x14005cb8c], esi
mov dword [0x14005ccf0], 8
mov qword [0x14006e230], rdi
mov dword [0x14006e228], 8
call fcn.140018680
mov rcx, rbx
call fcn.1400022d0
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x14000142d
mov r8d, 0x10
lea rdx, [0x140039570]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14000142d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x140001303
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x140001303
jmp 0x1400013ed
or eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov r8d, 0xa4
lea rdx, str.wmain
lea rax, str.unable_to_start_ssh_agent_service__error_:_d
mov qword [rsp + 0x30], rax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent_main.c
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
lea rax, str.unable_to_open_service_handle
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.wmain
mov qword [rsp + 0x28], rsi
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent_main.c
mov r8d, 0x9f
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
Function at 0x140002550
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x50
mov eax, dword [rcx + 0x40044]
xor r9d, r9d
mov dword [rsp + 0x48], eax
mov rdi, r8
mov dword [rsp + 0x40], edx
lea rax, str.connection_io__p_bytes:_d_state:_d
mov qword [rsp + 0x38], rcx
lea rdx, str.agent_connection_on_io
mov qword [rsp + 0x30], rax
lea r8d, [r9 + 0x36]
mov rbx, rcx
mov qword [rsp + 0x28], 0
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentconnection.c
mov dword [rsp + 0x20], 7
call fcn.140008ef0
mov edx, dword [rsp + 0x68]
test edx, edx
jne 0x1400025d3
mov rcx, qword [rbx + 0x20]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x140002638
mov edx, dword [rsp + 0x68]
mov ecx, dword [rbx + 0x40044]
test ecx, ecx
je 0x1400025f0
sub ecx, 1
je 0x1400026a5
sub ecx, 1
je 0x140002655
cmp ecx, 1
jne 0x14000264a
lea rcx, [rbx + 0x38]
mov dword [rbx + 0x40044], 1
xor edx, edx
mov r8d, 0x4000c
call fcn.14001a770
lea rdx, [rbx + 0x40]
mov r8d, 4
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000264a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14000264a
mov rcx, rbx
mov dword [rbx + 0x40044], 4
call fcn.140001c80
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
add dword [rbx + 0x3c], edx
mov eax, dword [rbx + 0x3c]
mov ecx, dword [rbx + 0x38]
cmp eax, ecx
jne 0x140002694
mov rcx, rbx
call fcn.140002710
test eax, eax
jne 0x140002638
mov r8d, dword [rbx + 0x38]
lea rdx, [rbx + 0x40]
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
mov dword [rbx + 0x40044], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140002627
sub ecx, eax
lea rdx, [rbx + 0x40]
add rdx, rax
mov r8d, ecx
jmp 0x140002615
add dword [rbx + 0x3c], edx
lea rdx, [rbx + 0x40]
cmp dword [rbx + 0x3c], 4
jne 0x1400026f8
movzx eax, byte [rbx + 0x41]
movzx ecx, byte [rdx]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x42]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x43]
shl ecx, 8
or ecx, eax
mov dword [rbx + 0x3c], 0
mov dword [rbx + 0x38], ecx
cmp ecx, 0x40000
ja 0x140002638
mov dword [rbx + 0x40044], 2
mov r8d, ecx
jmp 0x140002615
mov eax, dword [rbx + 0x38]
mov r8d, 4
sub r8d, eax
add rdx, rax
jmp 0x140002615
Function at 0x140002bc0
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
xor ebx, ebx
mov r14, r9
cmp dword [rcx + 0x40048], 2
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
jg 0x140002c07
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140002c07
or eax, 0xffffffff
jmp 0x140002d36
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
cmp dword [rsp + 0x98], ebx
je 0x140002c86
call qword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x140002c9f
lea rax, str.cannot_encrypt_data
mov r8d, 0x58
mov qword [rsp + 0x30], rax
lea rdx, str.convert_blob
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
xor r9d, r9d
mov dword [rsp + 0x20], 5
call fcn.140008ef0
jmp 0x140002d14
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x140002c9f
lea rax, str.cannot_decrypt_data
mov r8d, 0x5d
jmp 0x140002c59
mov ecx, dword [rsp + 0x40]
call fcn.140020374
mov qword [r14], rax
test rax, rax
je 0x140002d14
mov edx, dword [rsp + 0x40]
mov rcx, rax
mov r8, qword [rsp + 0x48]
mov r9d, edx
call fcn.140002a70
test eax, eax
je 0x140002d01
mov dword [rsp + 0x38], eax
lea rdx, str.convert_blob
xor r9d, r9d
lea rax, str.memcpy_s_failed_with_error:__d.
mov qword [rsp + 0x30], rax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 5
lea r8d, [r9 + 0x67]
call fcn.140008ef0
jmp 0x140002d14
mov rcx, qword [rsp + 0x90]
mov ebx, 1
mov eax, dword [rsp + 0x40]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140002d24
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rdi + 0x40048], 2
jg 0x140002d33
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [rbx - 1]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140003780
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbx
push r14
sub rsp, 0x88
mov qword [rax + 8], rbp
lea r8, [rax - 0x48]
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
xor edi, edi
mov qword [rax - 0x28], r12
mov r14d, edi
mov qword [rax - 0x30], r13
mov esi, edi
mov qword [rax - 0x38], r15
mov r13d, edi
mov r15, rdx
mov qword [rax - 0x60], rdi
lea rdx, [rax - 0x50]
mov qword [rax - 0x58], rdi
mov ebp, edi
mov qword [rax - 0x68], rdi
call fcn.1400099c0
test eax, eax
jne 0x1400038c7
mov r12, qword [rsp + 0x48]
test r12, r12
je 0x1400038c7
mov rbx, qword [rsp + 0x50]
cmp rbx, 0x8000000
ja 0x1400038c7
lea edx, [rdi + 1]
lea ecx, [rdi + 0x48]
call fcn.1400227ec
mov rsi, rax
test rax, rax
je 0x1400038c5
lea r8d, [rdi + 1]
mov qword [rax + 0x20], rbx
lea rdx, [rsp + 0x30]
mov qword [rax + 0x18], rbx
mov rcx, rax
mov qword [rax + 0x28], rbx
mov dword [rax + 0x30], 1
mov dword [rax + 0x38], 1
mov qword [rax + 0x40], rdi
mov qword [rax + 8], r12
mov qword [rax], rdi
call fcn.14000c860
mov rcx, rsi
mov ebx, eax
call fcn.1400092d0
mov rbp, qword [rsp + 0x30]
test ebx, ebx
jne 0x1400038c5
mov rcx, rbp
call fcn.14000b260
mov r14, rax
test rax, rax
je 0x1400038bf
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x38]
call fcn.140002b20
test eax, eax
jne 0x1400038bf
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov r9d, 0x10109
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400038bf
mov rcx, qword [rsp + 0x40]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
test eax, eax
jne 0x1400038bf
lea esi, [rdi + 1]
jmp 0x1400038cd
mov ebx, edi
mov esi, edi
jmp 0x1400038d4
mov esi, edi
mov r13d, 1
mov ebx, edi
test r13d, r13d
jne 0x14000390f
mov edx, 1
mov rcx, r15
call fcn.140009490
test eax, eax
jne 0x140003902
mov rcx, qword [r15 + 0x18]
mov rdi, qword [r15]
add rdi, rcx
test esi, esi
lea rax, [rcx + 1]
mov qword [r15 + 0x18], rax
setne al
add al, 5
mov byte [rdi], al
jmp 0x140003912
js 0x14000390f
test esi, esi
setne al
add al, 5
mov byte [rdi], al
jmp 0x140003912
or ebx, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
test rbp, rbp
je 0x14000393b
mov rcx, rbp
call fcn.14000a920
mov rcx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0xa0]
test rcx, rcx
je 0x140003953
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003963
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x140003970
mov rcx, r14
call fcn.140020360
mov eax, ebx
add rsp, 0x88
pop r14
pop rbx
ret
Function at 0x140003980
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
xor edi, edi
mov qword [rsp + 0x60], 0
cmp dword [r8 + 0x40048], 2
mov rcx, 0xffffffff80000002
mov rbx, rdx
mov qword [rsp + 0x50], rcx
jg 0x140003a27
mov rcx, qword [r8 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140003a5d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x140003a18
mov dword [rsp + 0x38], eax
lea r8d, [rdi + 0x3e]
lea rax, str.unable_to_open_users_registry_hive__ERROR____d
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.get_user_root
mov qword [rsp + 0x28], rdi
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
mov dword [rsp + 0x20], 5
call fcn.140008ef0
or edi, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test edi, edi
jne 0x140003a5d
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov r9d, 0x10109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgent
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003a5d
mov rcx, qword [rsp + 0x60]
lea rdx, str.Keys
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor edi, edi
mov rcx, rbx
lea edx, [rdi + 1]
call fcn.140009490
test eax, eax
jne 0x140003a82
mov rcx, qword [rbx + 0x18]
mov rdi, qword [rbx]
add rdi, rcx
lea rax, [rcx + 1]
mov qword [rbx + 0x18], rax
jmp 0x140003a84
js 0x140003a89
mov byte [rdi], 6
xor eax, eax
mov rcx, qword [rsp + 0x50]
neg eax
sbb ebx, ebx
test rcx, rcx
je 0x140003a9d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003aad
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400042b0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
call fcn.1400040b0
call fcn.140003f10
test eax, eax
jne 0x1400042f9
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x198
call fcn.14001a770
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x100010
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [0x140070a68], rax
test rax, rax
je 0x14000433c
call fcn.140005be0
test eax, eax
jne 0x14000433c
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140018df0
add rsp, 0x1f8
ret
lea rax, str.failed_to_initialize_w32posix_wrapper
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.w32posix_initialize
mov qword [rsp + 0x28], 0
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compatw32fd.c
mov r8d, 0xeb
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
Function at 0x140004380
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov r11, rsp
push rbx
push r14
sub rsp, 0x58
lea rax, [r11 + 0x18]
mov dword [rsp + 0x78], 0
mov qword [r11 - 0x38], rax
xor r9d, r9d
lea rax, [r11 + 0x20]
xor edx, edx
mov qword [r11 - 0x40], rax
mov r8d, 0x20000001
lea rax, [r11 + 0x10]
mov rbx, rcx
mov qword [r11 - 0x48], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov ecx, dword [rsp + 0x78]
call fcn.140020374
mov r14, rax
test rax, rax
je 0x140004559
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rax
mov r9, r14
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x78]
mov r8d, 0x20000001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
movsx ecx, byte [r14 + 4]
mov rax, qword [0x14006e2f0]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x14000443d
mov rax, qword [0x14006e2f0]
mov dword [rax + 0xb0], 3
movsx ecx, byte [r14 + 5]
mov rax, qword [0x14006e2f8]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x140004465
mov rax, qword [0x14006e2f8]
mov dword [rax + 0xb0], 3
movsx ecx, byte [r14 + 6]
mov rax, qword [0x14006e300]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x14000448d
mov rax, qword [0x14006e300]
mov dword [rax + 0xb0], 3
mov esi, dword [r14]
lea rdi, [r14 + 8]
mov qword [rsp + 0x50], rbp
test esi, esi
je 0x14000453a
lea rbp, [0x14006e2d0]
nop dword [rax + rax]
mov ecx, 0xc0
dec esi
call fcn.140020374
mov rbx, rax
test rax, rax
je 0x140004593
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.14001a770
movsxd rcx, dword [rdi]
mov qword [rbx + 0x90], rcx
movsx ecx, byte [rdi + 6]
mov dword [rbx + 0x84], ecx
cmp ecx, 1
jne 0x1400044fb
mov dword [rbx + 0xb0], 3
movsx rax, word [rdi + 4]
mov r8, rax
sar r8, 3
mov qword [rbp + rax*8 + 0x20], rbx
mov dword [rbx + 0x80], eax
and eax, 0x80000007
jge 0x140004520
dec eax
or eax, 0xfffffff8
inc eax
mov edx, 0x80
movzx ecx, al
sar edx, cl
add rdi, 8
or byte [r8 + rbp], dl
test esi, esi
jne 0x1400044b0
mov rcx, r14
call fcn.140020360
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
add rsp, 0x58
pop r14
pop rbx
ret
lea rax, str.out_of_memory
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.fd_decode_state
mov qword [rsp + 0x28], 0
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compatw32fd.c
mov r8d, 0x4b0
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
lea rax, str.out_of_memory
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.fd_decode_state
mov qword [rsp + 0x28], 0
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compatw32fd.c
mov r8d, 0x4c4
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3