joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013e60
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rsi, qword [rcx + 8]
lea rax, [rbp + 0x1f]
xor r14d, r14d
mov qword [rbp - 0x51], rax
cmp qword [0x1401b22b0], r14
mov rbx, rcx
lea edi, [r14 + 0x10]
mov dword [rbp - 0x59], edi
mov dword [rbp - 0x55], edi
je 0x140013fcd
cmp dword [0x1401b22a8], r14d
je 0x140013fcd
cmp dword [rcx], 0x14
jb 0x140013fc4
test rsi, rsi
je 0x140013fc4
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, dword [0x1401b22a8]
lea rcx, [rbp - 0x39]
mov rdx, qword [0x1401b22b0]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, edi
lea rcx, [rbp - 0x39]
mov rdx, rsi
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [rbx]
lea r15, [rsi + 0x10]
sub eax, edi
mov qword [rbp - 0x41], r15
lea rdx, [rbp - 0x59]
mov dword [rbp - 0x45], eax
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], eax
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
test eax, eax
js 0x140013fbb
mov edi, dword [rbx]
lea r12, [rsi + 0x14]
sub edi, 0x14
mov dword [rsp + 0x20], 4
mov r8d, edi
lea r9, [rbp + 0x6f]
mov rdx, r12
mov ecx, 0x8000
call fcn.140004468
test eax, eax
je 0x140013fb2
mov edx, dword [rbp + 0x6f]
cmp edx, dword [r15]
jne 0x140013fa1
mov rsi, qword [rbx + 8]
lea ecx, [r14 + 0x40]
mov edx, edi
mov r15d, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx + 8], rax
test rax, rax
je 0x140013fd9
mov r8d, r15d
mov rdx, r12
mov rcx, rax
call fcn.1400cac20
mov dword [rbx], edi
mov r14d, 1
test rsi, rsi
je 0x140013fd9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140013fd9
mov r8d, dword [r15]
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Checksums_dont_match__C:0x_08x___R:0x_08x__n
call fcn.14000d9f0
jmp 0x140013fd9
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Unable_to_calculate_CRC32_n
jmp 0x140013fd4
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___RtlDecryptData2_n
jmp 0x140013fd4
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_valid_data_n
jmp 0x140013fd4
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_Session_Key_n
call fcn.14000d9f0
lea r11, [rsp + 0xc0]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140013ff8
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
xor ebx, ebx
lea r14, [0x1401b22a8]
test rdx, rdx
mov rdi, rcx
mov r12d, ebx
cmovne r14, rdx
lea eax, [rbx + 0x10]
mov dword [rbp - 0x59], eax
mov dword [rbp - 0x55], eax
lea rax, [rbp + 0x1f]
mov qword [rbp - 0x51], rax
mov eax, dword [rcx]
lea r13d, [rax + 0x14]
cmp qword [r14 + 8], rbx
je 0x140014165
cmp dword [r14], ebx
je 0x140014165
test eax, eax
je 0x14001415c
cmp qword [rcx + 8], rbx
je 0x14001415c
mov edx, r13d
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140014171
mov r8d, dword [rdi]
lea rcx, [rax + 0x14]
mov rdx, qword [rdi + 8]
mov r15, rax
call fcn.1400cac20
mov r8d, dword [rdi]
lea r9, [r15 + 0x10]
lea rdx, [r15 + 0x14]
mov dword [rsp + 0x20], 4
mov ecx, 0x8000
call fcn.140004468
test eax, eax
je 0x140014140
mov ebx, 0x10
mov rcx, r15
mov edx, ebx
call qword [sym.imp.cryptdll.dll_CDGenerateRandomBits]
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, dword [r14]
lea rcx, [rbp - 0x39]
mov rdx, qword [r14 + 8]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, ebx
lea rcx, [rbp - 0x39]
mov rdx, r15
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Final]
lea eax, [r13 - 0x10]
mov dword [rbp - 0x45], eax
lea rdx, [rbp - 0x59]
mov dword [rbp - 0x49], eax
lea rcx, [rbp - 0x49]
lea rax, [r15 + 0x10]
mov qword [rbp - 0x41], rax
call qword [sym.imp.ADVAPI32.dll_SystemFunction032]
test eax, eax
js 0x140014137
mov r15, qword [rdi + 8]
lea r12d, [rbx - 0xf]
mov qword [rdi + 8], rsi
mov dword [rdi], r13d
jmp 0x14001414c
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___RtlEncryptData2_n
jmp 0x140014147
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___Unable_to_calculate_CRC32_n
call fcn.14000d9f0
test r15, r15
je 0x140014171
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140014171
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_valid_data_n
jmp 0x14001416c
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_Session_Key_n
call fcn.14000d9f0
lea r11, [rsp + 0xc0]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400148ac
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov r8, rdx
xor ebx, ebx
and qword [rsp + 0x60], rbx
mov rdx, rcx
and qword [rsp + 0x68], rbx
lea rcx, [0x1401374f4]
call fcn.140014790
mov rdi, rax
test rax, rax
je 0x140014a73
xor r9d, r9d
lea edx, [rbx + 0xa]
xor r8d, r8d
lea rcx, str.ncacn_ip_tcp
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov ebx, eax
test eax, eax
jne 0x140014a5c
xor r9d, r9d
lea edx, [rax + 9]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov ebx, eax
test eax, eax
jne 0x140014a53
and qword [rsp + 0x30], 0
lea r9d, [rax + 8]
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1401374f0]
xor r8d, r8d
mov dword [rsp + 0x20], 0x4d2
xor edx, edx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIf2]
mov ebx, eax
test eax, eax
jne 0x140014a4a
lea rcx, [rsp + 0x60]
call qword [sym.imp.RPCRT4.dll_RpcServerInqBindings]
mov ebx, eax
test eax, eax
jne 0x140014a41
mov rax, qword [rsp + 0x60]
cmp dword [rax], ebx
jbe 0x1400149ba
mov rcx, qword [rax + rbx*8 + 8]
lea rdx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_RpcBindingToStringBindingW]
test eax, eax
jne 0x1400149a1
mov r8, qword [rsp + 0x68]
lea rcx, str.___BindString__u_:__s_n
mov edx, ebx
call fcn.14000d9f0
lea rcx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x1400149af
mov edx, eax
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcBindingToStringBinding:__08x_n
call fcn.14000d9f0
mov rax, qword [rsp + 0x60]
inc ebx
cmp ebx, dword [rax]
jb 0x14001496d
lea r9, str.momokatz_Ho__hey__Im_a_DC_:_
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1401374f0]
call qword [sym.imp.RPCRT4.dll_RpcEpRegisterW]
lea rcx, [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
test ebx, ebx
jne 0x140014a36
lea rcx, str.___RPC_bind_registered_n
call fcn.14000d9f0
lea ecx, [rbx + 1]
mov edx, 0x4d2
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
test eax, eax
jne 0x140014a16
lea rcx, str.___RPC_Server_is_waiting__n
call fcn.14000d9f0
jmp 0x140014a6a
cmp eax, 0x6b1
jne 0x140014a2d
lea rcx, str.___RPC_Server_already_waiting__n
call fcn.14000d9f0
xor ebx, ebx
jmp 0x140014a6a
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerListen:__08x_n
jmp 0x140014a63
mov edx, ebx
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcEpRegister:__08x_n
jmp 0x140014a65
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerInqBindings:__08x_n
jmp 0x140014a63
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerRegisterIf2:__08x_n
jmp 0x140014a63
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerRegisterAuthInfo:__08x_n
jmp 0x140014a63
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerUseProtseqEp:__08x_n
mov edx, eax
call fcn.14000d9f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400159d4
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbp, rdx
mov rdx, rcx
xor ebx, ebx
mov rcx, rdi
lea r8d, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140015a2f
lea rax, [rsp + 0x58]
mov r8, rbp
lea r9d, [rbx + 0x24]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140015acc
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, str.ServicesActive
xor ebx, ebx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140015b32
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140015b29
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140015d90
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov r15, r8
mov r12, rdx
mov rbx, rcx
lea rdx, str.ServicesActive
xor esi, esi
xor ecx, ecx
mov r14d, r9d
lea r8d, [rsi + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x140015f39
lea r8d, [rsi + 0x10]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140015e06
lea rcx, str.____s_service_already_registered_n
mov rdx, rbx
call fcn.14000d9f0
jmp 0x140015ed1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x140015ebd
mov rdx, rbx
lea rcx, str.____s_service_not_present_n
call fcn.14000d9f0
and qword [rsp + 0x60], rsi
mov r9d, 0x60010
and qword [rsp + 0x58], rsi
mov r8, r12
and qword [rsp + 0x50], rsi
mov rdx, rbx
and qword [rsp + 0x48], rsi
mov rcx, rbp
and qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x140015eae
mov rdx, rbx
lea rcx, str.____s_service_successfully_registered_n
call fcn.14000d9f0
mov rcx, rdi
call fcn.140015c2c
mov esi, eax
test eax, eax
je 0x140015e9f
lea rcx, str.____s_service_ACL_to_everyone_n
jmp 0x140015df9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___kull_m_service_addWorldToSD__0x_08x__n
jmp 0x140015eca
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___CreateService__0x_08x__n
jmp 0x140015eca
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___OpenService__0x_08x__n
mov edx, eax
call fcn.14000d9f0
test rdi, rdi
je 0x140015f2e
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, eax
test eax, eax
je 0x140015ef3
lea rcx, str.____s_service_started_n
jmp 0x140015f07
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x140015f11
lea rcx, str.____s_service_already_started_n
mov rdx, rbx
call fcn.14000d9f0
jmp 0x140015f25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_service_install___StartService__0x_08x__n
call fcn.14000d9f0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140015f4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_service_install___OpenSCManager_create___0x_08x__n
call fcn.14000d9f0
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140016dd0
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, r8
and qword [rax - 0x18], rdi
mov rbx, rdx
and qword [rdx], rdi
xor r9d, r9d
and qword [rax - 0x20], rdi
xor edx, edx
and dword [r8], edi
mov rbp, rcx
mov qword [rax - 0x28], r8
lea r8d, [rdi + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x140016e5a
mov edx, dword [rsi]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x140016e5a
and qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
and qword [rsp + 0x28], rdi
mov r9, rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov edi, eax
test eax, eax
jne 0x140016e5a
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140016e74
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, r8
and qword [rax - 0x18], rdi
mov rbx, rdx
and qword [rax - 0x20], rdi
xor r9d, r9d
and qword [rdx], rdi
mov rbp, rcx
and dword [r8], edi
xor edx, edx
mov qword [rax - 0x28], r8
lea r8d, [rdi + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x140016efe
mov edx, dword [rsi]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x140016efe
and qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
and qword [rsp + 0x28], rdi
mov r9, rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov edi, eax
test eax, eax
jne 0x140016efe
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400170ac
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [rax + 0x20]
mov rbx, r8
xor edi, edi
mov qword [rsp + 0x20], rax
and dword [rax], edi
xor r9d, r9d
mov r8d, 0x40000001
mov esi, edx
mov rbp, rcx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x14001712d
mov edx, dword [rsp + 0x58]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x14001712d
lea rcx, [rsp + 0x58]
mov r9, rax
mov qword [rsp + 0x20], rcx
mov r8d, 0x40000001
mov rcx, rbp
mov edx, esi
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov edi, eax
test eax, eax
jne 0x14001712d
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400171a0
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rsp + 0x70]
mov r12, rdx
mov rsi, rcx
xor ebx, ebx
mov r14, r9
mov r15d, r8d
mov edx, dword [rbp]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140017227
mov r9, rax
mov qword [rsp + 0x20], rbp
mov r8d, 0x80000001
mov edx, r15d
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x14001721e
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8, rsi
lea rdx, str._____BEGIN__s______n_s_____END__s______n
mov rcx, r14
call fcn.140017308
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x14001771c
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
lea rax, [r11 - 0x28]
mov rbp, r8
mov qword [r11 - 0x38], rax
mov r14, rdx
lea r8, [r11 + 0x20]
mov rsi, rcx
xor edi, edi
lea r9d, [rbx + 4]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400177f1
mov eax, dword [rsp + 0x78]
cmp eax, 1
jne 0x1400177ab
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 1]
lea edx, [rbx + 8]
mov dword [rsp + 0x20], 2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
test eax, eax
jne 0x1400177b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___DuplicateTokenEx__0x_08x__n
call fcn.14000d9f0
mov eax, dword [rsp + 0x78]
jmp 0x1400177b0
mov qword [rsp + 0x38], rsi
cmp eax, 1
je 0x140017805
mov rcx, qword [rsp + 0x38]
mov r8, rbp
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ebx, eax
test eax, eax
jne 0x1400177e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___CheckTokenMembership__0x_08x__n
call fcn.14000d9f0
test edi, edi
je 0x140017805
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140017805
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___GetTokenInformation__0x_08x__n
call fcn.14000d9f0
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140017944
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor esi, esi
lea rbp, [r11 - 0x24]
test r9, r9
lea rax, [r11 + 0x20]
mov rbx, rdx
mov rdi, r8
cmovne rbp, r9
mov r14, rcx
and dword [rsp + 0x40], esi
lea r9, [r11 - 0x28]
and dword [r11 + 0x20], esi
mov rdx, rcx
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov qword [r11 - 0x38], rbp
mov qword [r11 - 0x40], rax
and qword [r11 - 0x48], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140017a35
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140017a35
mov edx, dword [rsp + 0x40]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x140017a35
mov edx, dword [rsp + 0x88]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x140017a29
mov r8, qword [rbx]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rdx, r14
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
test eax, eax
jne 0x140017a35
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x70]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14001d814
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
movsxd rbx, r8d
xor r15d, r15d
xor r12d, r12d
mov sil, r9b
mov r13, rdx
mov r10, rcx
mov r14, rcx
lea r11d, [rdi + 1]
lea ebp, [rdi + 3]
cmp r9b, r11b
jne 0x14001d858
mov r9d, r11d
jmp 0x14001d896
movzx eax, sil
mov edx, ebp
sub edx, eax
mov rcx, rbp
sub rcx, rax
mov r9d, 2
jmp 0x14001d87a
cmp byte [rcx + r10], dil
jne 0x14001d87f
add edx, r9d
add rcx, r9
cmp rcx, rbx
jl 0x14001d86e
cmp edx, r8d
movzx eax, sil
movsxd rbx, edx
setl r12b
and rax, r11
add r10, rax
xor rbx, r11
lea rdx, [r14 + rbx]
lea r8, [0x14013a480]
cmp r10, rdx
jae 0x14001d8d7
mov ecx, r9d
movzx eax, byte [r10]
test byte [rax + r8], r11b
je 0x14001d8be
mov ecx, r9d
add r10, rcx
cmp r10, rdx
jb 0x14001d8a9
cmp r10, rdx
jae 0x14001d8d7
cmp byte [r10], 0x2d
jne 0x14001d8ce
mov r15d, r11d
jmp 0x14001d8d4
cmp byte [r10], 0x2b
jne 0x14001d8d7
add r10, rcx
mov rsi, r10
jmp 0x14001d8e8
cmp byte [r10], 0x30
jne 0x14001d8ed
mov eax, r9d
add r10, rax
cmp r10, rdx
jb 0x14001d8dc
xor r8d, r8d
mov r14d, r9d
cmp r10, rdx
jae 0x14001d93b
mov rbx, r10
mov al, byte [rbx]
sub al, 0x30
cmp al, 9
ja 0x14001d924
movsx rax, byte [rbx]
lea rcx, [rdi - 6]
lea rcx, [rdi + rcx*4]
add r8d, r9d
add rbx, r14
lea rdi, [rax + rcx*2]
movsxd rcx, r8d
add rcx, r10
cmp rcx, rdx
jb 0x14001d8fb
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jbe 0x14001d93b
mov edi, r15d
add rdi, rax
jmp 0x14001d943
test r15d, r15d
je 0x14001d943
neg rdi
xor ebx, ebx
mov qword [r13], rdi
test r8d, r8d
jne 0x14001d958
cmp rsi, r10
jne 0x14001d958
or ebx, 0xffffffff
jmp 0x14001d991
test r12d, r12d
jne 0x14001d98e
movsxd rcx, r8d
add rcx, r10
cmp rcx, rdx
jae 0x14001d991
mov edi, r8d
lea rsi, [0x14013a480]
movzx eax, byte [rcx]
test byte [rax + rsi], r11b
je 0x14001d98e
add edi, r9d
add rcx, r14
movsxd rax, edi
add rax, r10
cmp rax, rdx
jae 0x14001d991
jmp 0x14001d972
mov ebx, r11d
imul eax, r9d, 0x13
cmp r8d, eax
jl 0x14001d9d8
jg 0x14001d9ae
mov edx, r9d
mov rcx, r10
call fcn.14001d7c8
mov r11d, eax
test eax, eax
js 0x14001d9d8
mov ecx, r15d
movabs rdx, 0x7fffffffffffffff
add rcx, rdx
mov qword [r13], rcx
test r11d, r11d
jle 0x14001d9ce
mov eax, 2
jmp 0x14001d9da
test r15d, r15d
cmovne ebp, ebx
mov eax, ebp
jmp 0x14001d9da
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002178c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd r10, dword [rcx + 0xc]
mov r9, rcx
movsxd r11, r8d
test r8d, r8d
jle 0x1400217e3
mov rsi, qword [rcx]
mov rbx, r10
movsxd rbp, dword [rcx + 8]
xor edi, edi
mov al, byte [rdi + rdx]
lea rcx, [rbx + 1]
xor byte [rbx + rsi], al
lea eax, [r10 + 1]
xor r10d, r10d
cmp rcx, rbp
cmovl r10d, eax
xor ebx, ebx
inc rdi
cmp rcx, rbp
cmovl rbx, rcx
cmp rdi, r11
jl 0x1400217ba
add dword [r9 + 0x10], r8d
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r9 + 0xc], r10d
ret