joyce8/EMBER2024-capa huggingface dataset:
Function at 0x171b3da3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov dword [rax + 0x10], 0x2b
lea rcx, [rax - 0x18]
mov dword [rax + 0x18], 4
mov edx, 0x20019
xor ebx, ebx
call fcn.171b088b4
mov rax, qword [0x171b934f8]
lea r9d, [rbx + 0x10]
mov rcx, qword [rsp + 0x40]
lea r8, str.ColorSet_Version3
test rax, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
cmovne rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x171b3daca
mov ecx, dword [rsp + 0x68]
cmp ecx, 0x32
jae 0x171b3daca
call fcn.171b3e53c
mov qword [rdi], rax
jmp 0x171b3dacf
mov ebx, 0x80070490
lea rcx, [rsp + 0x40]
call fcn.171b08884
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x171b3e2cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
and dword [rsp + 0x44], 0
lea rax, [r11 - 0x10]
mov qword [r11 - 0x28], rax
mov rbx, r9
lea rax, [r11 - 0x18]
mov dword [rsp + 0x48], 4
mov qword [r11 - 0x30], rax
mov r9d, 0x10000012
lea rax, [r11 - 0x14]
mov qword [r11 - 0x38], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ecx, 0xd
test eax, eax
jne 0x171b3e35a
cmp dword [rsp + 0x44], 4
jne 0x171b3e334
lea edx, [rcx - 0xc]
cmp dword [rsp + 0x40], edx
ja 0x171b3e368
cmp dword [rsp + 0x40], edx
sete al
xor ecx, ecx
mov dword [rbx], eax
jmp 0x171b3e371
cmp dword [rsp + 0x48], 4
jne 0x171b3e368
movzx eax, word [rsp + 0x40]
mov edx, 1
sub ax, 0x30
cmp ax, dx
ja 0x171b3e368
lea ecx, [rdx + 0x30]
xor eax, eax
cmp cx, word [rsp + 0x40]
jmp 0x171b3e32b
cmp eax, 0xea
cmove eax, ecx
mov ecx, eax
test eax, eax
jle 0x171b3e371
movzx ecx, cx
or ecx, 0x80070000
mov eax, ecx
add rsp, 0x50
pop rbx
ret
Function at 0x171b4c42c
Capabilities:
Log keystrokes via application hook
Set application hook

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, edx
mov rcx, qword [rcx + 0x58]
test rcx, rcx
jne 0x171b4c477
cmp edx, 1
jne 0x171b4c496
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [0x171b4c390]
mov r9d, eax
lea ecx, [rdi + 2]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
nop dword [rax + rax]
mov qword [rbx + 0x58], rax
jmp 0x171b4c496
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop dword [rax + rax]
and qword [rbx + 0x58], 0
cmp edi, 2
jne 0x171b4c496
mov rcx, qword [rbx + 0x18]
call fcn.171b4c4a8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x171b4c4a8
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, rcx
test rcx, rcx
je 0x171b4c514
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
nop dword [rax + rax]
mov r9, rdi
xor r8d, r8d
mov edx, 0x4f2
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
cdqe
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x171b53254
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
and qword [r9], 0
mov r14, r9
mov r15, qword [rsp + 0x50]
xor r9d, r9d
mov rdi, rcx
and dword [r15], 0
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x171b5329e
call fcn.171b53970
jmp 0x171b532e9
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x171b53297
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
je 0x171b53297
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
nop dword [rax + rax]
test rax, rax
je 0x171b53297
mov qword [r14], rax
xor eax, eax
mov dword [r15], ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x171b54138
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
and qword [rsp + 0x68], 0
lea rdx, [rsp + 0x68]
mov rdi, rcx
mov ecx, 0x20006
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov qword [rsp + 0x38], rax
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x171b541cf
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jle 0x171b541dc
movzx ebx, bx
or ebx, 0x80070000
lea rcx, [rsp + 0x68]
call fcn.171b08884
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x171b541fc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x30], 0
mov rsi, rdx
lea rdx, [rbp + 0x30]
mov ecx, 0x2001f
mov rdi, r9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
test rdi, rdi
je 0x171b543a8
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x48]
mov r14d, 1
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x171b54385
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov dword [rbp + 0x40], 0x208
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov esi, 0x104
test eax, eax
jne 0x171b542b5
mov eax, dword [rbp + 0x50]
jmp 0x171b542d6
lea r8, [0x171b680f8]
mov edx, esi
mov rcx, rdi
call fcn.171b251d4
mov ebx, eax
mov eax, r14d
mov dword [rbp + 0x50], eax
test ebx, ebx
js 0x171b54373
cmp eax, 2
je 0x171b542f1
mov edx, 0x25
mov rcx, rdi
call fcn.171b2913c
test rax, rax
je 0x171b54373
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
nop dword [rax + rax]
mov rcx, qword [0x171b92ce0]
xor edx, edx
add eax, r14d
movsxd r15, eax
lea r8, [r15 + r15]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x171b5436e
mov r8, rdi
mov rdx, r15
mov rcx, rax
call fcn.171b07b08
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov ecx, 0x8007007a
mov r8, r14
cmp eax, esi
cmovbe ebx, ecx
mov rcx, qword [0x171b92ce0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
jmp 0x171b54373
mov ebx, 0x8007000e
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x171b543ad
lea r8, [0x171b680f8]
mov edx, 0x104
mov rcx, rdi
call fcn.171b251d4
test ebx, ebx
jle 0x171b543ad
movzx ebx, bx
or ebx, 0x80070000
jmp 0x171b543ad
mov ebx, 0x80070057
lea rcx, [rbp + 0x30]
call fcn.171b08884
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x171b543d0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
and qword [rax - 0x18], 0
mov edi, edx
mov rsi, rcx
lea rdx, [rax - 0x18]
mov ecx, 0x2001f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x88]
mov rcx, qword [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
and qword [rsp + 0x88], 0
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x171b544ae
mov rcx, qword [rsp + 0x88]
lea r9d, [rax + 4]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov dword [rsp + 0x80], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x171b54498
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x171b544b9
jle 0x171b544b9
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [rsp + 0x50]
call fcn.171b08884
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x171b5df70
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x40
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
mov r9d, 0x20019
mov qword [r11 - 0x28], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWispTouch
mov rcx, 0xffffffff80000001
mov ebx, 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x171b5e043
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 0xf]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea r8, str.Bouncing
xor edi, edi
xor edx, edx
and qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x171b5e016
cmp dword [rsp + 0x50], ebx
jbe 0x171b5e025
mov dword [rsp + 0x50], ebx
mov edi, ebx
jmp 0x171b5e025
jg 0x171b5e01c
mov edi, eax
jmp 0x171b5e025
movzx edi, ax
or edi, 0x80070000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
cmp dword [rsp + 0x50], 0
jne 0x171b5e043
test edi, edi
js 0x171b5e043
xor bl, bl
mov al, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14000bdf0
Capabilities:
Get disk information
Get disk size
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x14026b8a0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov dword [rsp + 0x60], 0x40
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x68]
test rax, rax
jl 0x14000be37
cvtsi2sd xmm0, rax
jmp 0x14000be50
mov rcx, rax
shr rcx, 1
and rax, 1
or rcx, rax
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movaps xmm0, xmm1
divsd xmm0, qword [0x14024e3c0]
movsd qword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x2d0]
movsd xmm0, qword [rsp + 0x30]
movsd qword [rax], xmm0
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x14000bf44
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
test eax, eax
je 0x14000bf44
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 3
jne 0x14000bf26
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14000bf26
mov rax, qword [rsp + 0x38]
test rax, rax
jl 0x14000beed
cvtsi2sd xmm0, rax
jmp 0x14000bf06
mov rcx, rax
shr rcx, 1
and rax, 1
or rcx, rax
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movaps xmm0, xmm1
divsd xmm0, qword [0x14024e3c0]
movsd qword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d8]
call fcn.14000bf60
mov rcx, qword [rsp + 0x20]
call fcn.1400ee5cc
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x20], rax
jmp 0x14000be98
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400d6d00
add rsp, 0x2c8
ret
Function at 0x14000d030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
mov rax, qword [0x14026b8a0]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0xd8]
call fcn.140017610
nop
mov byte [rsp + 0xf8], 0x77
mov byte [rsp + 0xf9], WSAGetLastError
mov byte [rsp + 0xfa], WSAGetLastError
mov byte [rsp + 0xfb], 0x63
mov byte [rsp + 0xfc], 0x20
mov byte [rsp + 0xfd], 0x63
mov byte [rsp + 0xfe], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xff], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x100], WSAStartup
mov byte [rsp + 0x101], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x102], 0x64
mov byte [rsp + 0x103], 0x75
mov byte [rsp + 0x104], 0x63
mov byte [rsp + 0x105], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x106], 0x20
mov byte [rsp + 0x107], 0x67
mov byte [rsp + 0x108], 0x65
mov byte [rsp + 0x109], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x10a], 0x20
mov byte [rsp + 0x10b], 0x75
mov byte [rsp + 0x10c], 0x75
mov byte [rsp + 0x10d], WSAGetLastError
mov byte [rsp + 0x10e], 0x64
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x98]
call fcn.14000c0b0
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0xd8]
call fcn.1400173f0
lea rcx, [rsp + 0x98]
call fcn.1400172f0
lea rcx, [rsp + 0x20]
call fcn.1400023d0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xd8]
call fcn.140016f60
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xd8]
call fcn.140016fd0
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dl, 0xa
lea rcx, [rsp + 0xd8]
call fcn.140016cd0
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
call fcn.140011190
mov qword [rsp + 0x48], rax
mov r8d, 1
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
call fcn.140011190
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xb8]
call fcn.140024160
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xd8]
call fcn.1400173f0
lea rcx, [rsp + 0xb8]
call fcn.1400172f0
mov r8, 0xffffffffffffffff
lea rdx, str.__n_r_t
lea rcx, [rsp + 0xd8]
call fcn.140016b70
inc rax
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140017130
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0x138]
call fcn.140017450
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0xd8]
call fcn.1400172f0
mov rax, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400d6d00
add rsp, 0x128
ret
Function at 0x14000e440
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x14026b8a0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x40], 0
mov edx, 0x110
lea rcx, [rsp + 0x160]
call fcn.1400045f0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, qword [rsp + 0x2a0]
lea rcx, [rsp + 0x160]
call fcn.140015920
nop
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.1400133a0
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x20], 0
mov r9b, 1
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x110]
call fcn.1400243f0
nop
lea rdx, str.os_crypt
lea rcx, [rsp + 0x110]
call fcn.140024570
mov qword [rsp + 0x58], rax
lea rdx, str.encrypted_key
mov rcx, qword [rsp + 0x58]
call fcn.140024570
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.1400245b0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x120]
call fcn.140111910
nop
lea rcx, [rsp + 0x70]
call fcn.1400172f0
mov r9, 0xffffffffffffffff
mov r8d, 5
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x120]
call fcn.140016b00
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x120]
call fcn.1400173f0
lea rcx, [rsp + 0x90]
call fcn.1400172f0
lea rcx, [rsp + 0x120]
call fcn.140016320
mov dword [rsp + 0xf0], eax
lea rcx, [rsp + 0x120]
call fcn.140016f10
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov eax, dword [rsp + 0x100]
mov r8d, eax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x140]
call fcn.140017570
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x298]
call fcn.140017450
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x140]
call fcn.1400172f0
nop
lea rcx, [rsp + 0x120]
call fcn.1400172f0
nop
lea rcx, [rsp + 0x110]
call fcn.1400133f0
nop
lea rcx, [rsp + 0x160]
call fcn.140007840
nop
mov rcx, qword [rsp + 0x2a0]
call fcn.1400172f0
mov rax, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400d6d00
add rsp, 0x288
ret
Function at 0x140010d90
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x101e8
call fcn.1400d7990
sub rsp, rax
mov rax, qword [0x14026b8a0]
xor rax, rsp
mov qword [rsp + 0x101d0], rax
mov dword [rsp + 0x188], 0x7fff
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x140010ea9
mov eax, 2
imul rax, rax, 0
lea rax, [rsp + rax + 0x1d0]
mov rdx, rax
lea rcx, [rsp + 0x190]
call fcn.1400168d0
nop
lea rcx, [rsp + 0x20]
call fcn.1400023d0
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x190]
call fcn.1400164a0
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x190]
call fcn.140016550
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0xc8]
call fcn.140024e70
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [0x140275fa0]
call fcn.1400173f0
lea rcx, [rsp + 0xc8]
call fcn.1400172f0
nop
lea rcx, [rsp + 0x190]
call fcn.1400167c0
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140010f99
mov eax, 2
imul rax, rax, 0
lea rax, [rsp + rax + 0x1d0]
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.1400168d0
nop
lea rcx, [rsp + 0x21]
call fcn.1400023d0
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x1b0]
call fcn.1400164a0
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x1b0]
call fcn.140016550
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0xe8]
call fcn.140024e70
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [0x140275f80]
call fcn.1400173f0
lea rcx, [rsp + 0xe8]
call fcn.1400172f0
nop
lea rcx, [rsp + 0x1b0]
call fcn.1400167c0
lea rdx, str.appdata
lea rcx, [rsp + 0x108]
call fcn.14000baf0
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [0x140275fe0]
call fcn.1400173f0
lea rcx, [rsp + 0x108]
call fcn.1400172f0
lea rdx, str.localappdata
lea rcx, [rsp + 0x128]
call fcn.14000baf0
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x90]
lea rcx, [0x140275f20]
call fcn.1400173f0
lea rcx, [rsp + 0x128]
call fcn.1400172f0
lea r8, str.MicrosoftWindowsStart_MenuProgramsStartup_
lea rdx, [0x140275fe0]
lea rcx, [rsp + 0x148]
call fcn.140022490
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0x98]
lea rcx, [0x140276010]
call fcn.1400173f0
lea rcx, [rsp + 0x148]
call fcn.1400172f0
mov edx, 0x3e8
lea rcx, [rsp + 0x168]
call fcn.14000bb40
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xa0]
lea rcx, [0x140275fc0]
call fcn.1400173f0
lea rcx, [rsp + 0x168]
call fcn.1400172f0
mov rax, qword [rsp + 0x101f0]
mov rcx, qword [rsp + 0x101d0]
xor rcx, rsp
call fcn.1400d6d00
add rsp, 0x101e8
ret
Function at 0x140012250
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14001a1a0
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x1400146e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14026b8a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140014714
xor eax, eax
jmp 0x14001490a
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140014745
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140015490
jmp 0x14001490a
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call fcn.14001b0d0
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x1400147f3
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140007f80
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call fcn.14001b2f0
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.1400080d0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call fcn.14001b250
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x1400148fa
mov rcx, qword [rsp + 0x80]
call fcn.14001a9b0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x1400148a8
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.1400eeba0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x1400148a3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14001490a
jmp 0x14001481f
cmp qword [rsp + 0x50], 0
jbe 0x1400148fa
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.1400eeba0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d6d00
add rsp, 0x78
ret