joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011abc
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor esi, esi
test r9, r9
lea rbp, [r11 - 0x24]
cmovne rbp, r9
and dword [rsp + 0x40], esi
and dword [r11 + 0x20], esi
mov qword [r11 - 0x38], rbp
mov rbx, rdx
mov r14, rcx
lea rax, [r11 + 0x20]
mov rdx, rcx
mov rcx, qword [rsp + 0x90]
mov rdi, r8
mov qword [r11 - 0x40], rax
and qword [r11 - 0x48], rsi
lea r9, [r11 - 0x28]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x180011bad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180011bad
mov edx, dword [rsp + 0x40]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180011bad
mov edx, dword [rsp + 0x88]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x180011ba1
mov r8, qword [rbx]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x40]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
test eax, eax
jne 0x180011bad
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov eax, esi
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1800126d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
dec edx
je 0x180012799
cmp edx, 3
jne 0x1800127b7
cmp byte [reloc.WLDAP32.dll_Ordinal_88], 0
jle 0x18001276e
lea r8d, [rdx + 0x2d]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18001276e
cmp dword [rsp + 0x48], 0x20000
jne 0x18001275b
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + 0x10], 0xffeeffee
jne 0x180012731
cmp qword [rcx + 0x30], rcx
jne 0x18001276e
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x18001276e
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x18001276e
mov rcx, qword [rsp + 0x28]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x18001276e
cmp dword [rsp + 0x48], 0x40000
jne 0x18001276e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call fcn.1800123a4
mov eax, dword [str.ZZZZZZZXXXXWYYYY]
cmp eax, 0xa2a1de0
je 0x180012790
cmp eax, 0x56a2b5f0
jne 0x1800127b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
mov rax, qword [r8]
mov qword [0x1800c2d88], rax
mov eax, dword [r8 + 8]
mov dword [0x1800c2d84], eax
mov eax, dword [r8 + 0xc]
mov dword [0x1800c2d80], eax
mov eax, 1
add rsp, 0x50
pop rbx
ret

Function at 0x1800129d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov edi, 0xc0000001
test rcx, rcx
je 0x180012a62
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
je 0x180012a62
mov edx, ebp
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180012a62
mov r8d, ebp
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp ebp, eax
je 0x180012a39
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
test rbx, rbx
je 0x180012a62
movzx eax, word [rbx]
cmp eax, 0x21
je 0x180012a4e
mov rcx, rbx
cmp eax, 0x2a
jne 0x180012a52
lea rcx, [rbx + 2]
call fcn.180012a7c
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x180012db0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x20
and dword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
test rax, rax
je 0x180012e12
and qword [0x1800c2d20], 0
mov edx, 0x1fe
mov ecx, 0x40
mov qword [0x1800c2d08], 0xff
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x1800c2d10], rax
test rax, rax
je 0x180012e09
mov ecx, dword [rsp + 0x38]
mov rdx, rbx
call fcn.180012834
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [0x1800c2d10]
add rsp, 0x20
pop rbx
ret
Function at 0x18001d75c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
lea rax, [rsp + 0x78]
mov r13, r9
lea r8, str.SafenetSafeNetKSPSlots
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov rdi, rcx
mov dword [rsp + 0x20], 0x20119
call fcn.18000cb68
test eax, eax
je 0x18001d99a
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x74]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], rax
call fcn.18000cdf0
test eax, eax
je 0x18001d979
mov eax, dword [rsp + 0x70]
mov ecx, 0x40
inc eax
mov dword [rsp + 0x70], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18001d98d
xor esi, esi
cmp dword [rsp + 0x74], esi
jbe 0x18001d96e
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea rax, [rbp - 0x80]
mov dword [rbp - 0x80], ecx
mov r9, rbx
mov r8d, esi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18000d2a8
test eax, eax
je 0x18001d962
lea rcx, str._n_____s_
mov rdx, rbx
call fcn.18000af2c
mov rcx, rbx
call fcn.180010724
mov r14, rax
test rax, rax
je 0x18001d962
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rbp - 0x60]
mov r12d, eax
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r15d, 0x5b6
lea rcx, [rbp - 0x60]
mov r8d, r12d
mov rdx, r14
call qword [sym.imp.cryptdll.dll_MD5Update]
dec r15
jne 0x18001d890
lea rcx, [rbp - 0x60]
call qword [sym.imp.cryptdll.dll_MD5Final]
xor ecx, ecx
lea edx, [rcx + 0x10]
lea rax, [0x18006ecb8]
mov al, byte [rcx + rax]
inc rcx
xor al, byte [rbp + rcx - 9]
mov byte [rbp + rcx - 0x71], al
dec rdx
jne 0x18001d8b4
xor r8d, r8d
lea rcx, [rbp - 0x70]
lea edx, [r8 + 0x10]
call fcn.1800108cc
lea rcx, [0x18008898c]
call fcn.18000af2c
mov rdx, qword [rsp + 0x78]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
mov dword [rsp + 0x20], 0x20019
call fcn.18000cb68
test eax, eax
je 0x18001d945
lea rcx, [0x18006a3b8]
call fcn.18000af2c
mov r9d, dword [rbp + 0x50]
mov rdx, qword [rbp - 0x78]
lea r8, [rbp - 0x70]
mov rcx, rdi
mov qword [rsp + 0x20], r13
call fcn.18001d9bc
mov rdx, qword [rbp - 0x78]
mov rcx, rdi
call fcn.18000d67c
jmp 0x18001d959
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x180088990]
mov edx, eax
call fcn.18000af2c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc esi
cmp esi, dword [rsp + 0x74]
jb 0x18001d826
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18001d98d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_dpapi_safenet_ksp_registryparser___kull_m_registry_RegQueryInfoKey__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.18000d67c
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180027388
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
lea rax, [rbp + 0x30]
mov r14, rdx
mov dword [rsp + 0x38], ebx
mov qword [r11 - 0x38], rax
lea r8, str.PKCS8_PRIVATEKEY
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], ebx
mov qword [r11 - 0x48], rbx
mov rsi, rcx
call qword [sym.imp.ncrypt.dll_NCryptExportKey]
test eax, eax
jne 0x1800274dc
mov edx, dword [rbp + 0x30]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1800274ea
lea rax, [rbp + 0x30]
mov dword [rsp + 0x38], ebx
lea r8, str.PKCS8_PRIVATEKEY
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ncrypt.dll_NCryptExportKey]
test eax, eax
jne 0x1800274c3
mov esi, dword [rbp + 0x30]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov r8d, 0x80000001
mov rcx, rdi
mov edx, esi
mov dword [rbp + 0x38], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x18002746a
lea rax, [rbp + 0x38]
lea r9, [rbp - 0x10]
lea rcx, str.PRIVATE_KEY
mov r8d, esi
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.18001139c
jmp 0x18002746c
mov eax, ebx
test eax, eax
je 0x1800274b4
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rdx, qword [rbp - 0x10]
mov rcx, r14
mov r8d, eax
call fcn.180008e0c
test eax, eax
je 0x180027494
mov ebx, 1
jmp 0x1800274a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_crypto_keyutil_export_pkcs8_file___kull_m_file_writeData__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800274d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_crypto_keyutil_export_pkcs8_file___kull_m_string_EncodeB64_headers__0x_08x__n
jmp 0x1800274ca
lea rcx, str.ERROR_kuhl_m_crypto_keyutil_export_pkcs8_file___NCryptExportKey_data_:_0x_08x_n
mov edx, eax
call fcn.18000af2c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800274ea
lea rcx, str.ERROR_kuhl_m_crypto_keyutil_export_pkcs8_file___NCryptExportKey_init_:_0x_08x_n
mov edx, eax
call fcn.18000af2c
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x180029ad8
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebx, ebx
lea rax, [r11 + 0x20]
mov r14, r8
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x40], rbx
lea r8, str.SupplementalCredentials
mov qword [r11 - 0x48], rbx
mov rdi, rdx
mov rbp, rcx
mov dword [r11 + 0x20], ebx
call fcn.18000d0cc
test eax, eax
je 0x180029c6a
cmp dword [rsp + 0x88], 0x90
jbe 0x180029c6a
mov edx, dword [rsp + 0x88]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x180029c6a
lea rax, [rsp + 0x88]
lea r8, str.SupplementalCredentials
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov rcx, rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
call fcn.18000d0cc
test eax, eax
je 0x180029c55
lea rcx, str._nSupplemental_Credentials:_n
call fcn.18000af2c
mov edx, dword [rsi + 0xc]
lea ecx, [rbx + 0x40]
add edx, 0xc
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180029c61
mov ebp, dword [rsp + 0x88]
lea r9d, [rbx + 0x18]
lea rcx, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
add ebp, 0xffffffe0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180029bff
lea rcx, [rsp + 0x48]
lea rax, [rdi + 4]
lea r8, [rsi + 0x20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [rsi + 0x10]
mov r9d, ebp
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.180004180
jmp 0x180029c15
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptAcquireContext__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov eax, ebx
test eax, eax
je 0x180029c4a
mov eax, dword [rdi + 4]
cmp eax, dword [rsi + 0xc]
jne 0x180029c3f
mov rdx, qword [rsp + 0x40]
lea rcx, [rdi + 0xc]
mov r8d, eax
mov ebx, 1
call fcn.18005bdd0
mov rcx, rdi
call fcn.18003dae8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180029c61
lea rcx, str.ERROR_kuhl_m_lsadump_getSupplementalCreds___kull_m_registry_RegQueryValueEx_data__n
call fcn.18000af2c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x18003bb48
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
mov rcx, qword [rcx + 8]
lea rdx, str.Microsoft_WinInet_
call fcn.18004efac
test rax, rax
je 0x18003bbf7
mov edx, dword [rbx + 0x20]
cmp edx, 0x14
jb 0x18003bd6a
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx + 4]
cmp rax, qword [0x18006b4c8]
jne 0x18003bd6a
mov rax, qword [rcx + 0xc]
cmp rax, qword [0x18006b4d0]
jne 0x18003bd6a
lea rax, [0x18006a610]
mov qword [rbp - 0x18], rcx
mov dword [rbp - 0x20], edx
mov qword [rbp - 8], rax
lea rax, [rbp - 0x30]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea rcx, [rbp - 0x20]
xor r9d, r9d
xor edx, edx
mov dword [rbp - 0x10], Ordinal_79
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x18003bd56
lea rcx, str.___CredentialBlob:
jmp 0x18003bd2d
mov rcx, qword [rbx + 8]
lea rdx, str.AppSense_DataNow_
call fcn.18004efac
test rax, rax
je 0x18003bd6a
lea rcx, str._Ivanti_FileDirector_credential_blob__n
call fcn.18000af2c
cmp dword [rbx + 0x20], 0x14
jb 0x18003bd6a
mov rbx, qword [rbx + 0x28]
lea rcx, str.AppN_DN_Win
mov rdx, rbx
call fcn.18005fe20
test eax, eax
jne 0x18003bd6a
cmp dword [rbx + 0xc], eax
je 0x18003bcd2
lea rcx, str.Decrypting_additional_blob_n
call fcn.18000af2c
mov eax, dword [rbx + 0xc]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], eax
lea rax, [rbx + 0x14]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x18003bcbe
lea rcx, str.___CredentialBlob:
call fcn.18000af2c
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.180010600
lea rcx, [0x18006a3b8]
call fcn.18000af2c
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18003bcd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
mov edx, eax
call fcn.18000af2c
cmp dword [rbx + 0x10], 0
je 0x18003bd6a
lea rcx, str.Decrypting_additional_blob_n
call fcn.18000af2c
mov eax, dword [rbx + 0x10]
lea rcx, [rbx + 0x14]
mov dword [rbp - 0x20], eax
mov eax, dword [rbx + 0xc]
xor r9d, r9d
add rcx, rax
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x18003bd56
lea rcx, str.___UnkBlob_______:
call fcn.18000af2c
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.180010600
lea rcx, [0x18006a3b8]
call fcn.18000af2c
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18003bd6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800441a4
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, rdx
mov rbp, rcx
lea rdx, [r11 + 0x10]
mov rcx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x180044253
mov eax, dword [rsp + 0x38]
test eax, eax
jle 0x18004423c
xor ebx, ebx
test eax, eax
jle 0x180044233
mov rsi, rdi
mov rcx, qword [rsi]
lea rdx, str._HTC:
mov r8d, 5
call fcn.18004f448
test eax, eax
je 0x18004420c
inc ebx
add rsi, 8
cmp ebx, dword [rsp + 0x38]
jl 0x1800441e5
jmp 0x180044233
movsxd rax, ebx
xor edx, edx
mov rcx, qword [rdi + rax*8]
lea r8d, [rdx + 0xa]
add rcx, 0xa
call fcn.18004fcec
mov rcx, rbp
mov edx, eax
mov ebx, eax
call fcn.18004427c
test rbx, rbx
jne 0x180044248
lea rcx, str.__No_shared_memory__no_SSO_enabled___n
jmp 0x180044243
lea rcx, str.ERROR_Citrix_SSO_Program_args___No_command_module_
call fcn.18000af2c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180044267
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_Citrix_SSO_Program_args___CommandLineToArgvW__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18004427c
Capabilities:
Encode data using xor
Encrypt data using dpapi
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
lea r9, [rsp + 0x60]
mov rdx, rbx
mov dword [rsp + 0x30], esi
mov r8, rax
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x180044444
mov rcx, qword [rsp + 0x60]
lea edx, [rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x61c
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180044423
lea ecx, [rsi + 0x40]
mov edx, 0x610
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180044418
lea rdx, [rdi + 0xc]
mov r8, rax
mov rcx, rdx
or rcx, rax
and ecx, 0xf
jne 0x18004437a
lea eax, [rsi + 0xc]
lea ecx, [rax + 0x74]
movaps xmm0, xmmword [rdx]
movaps xmmword [r8], xmm0
movaps xmm1, xmmword [rdx + 0x10]
movaps xmmword [r8 + 0x10], xmm1
movaps xmm0, xmmword [rdx + 0x20]
movaps xmmword [r8 + 0x20], xmm0
movaps xmm1, xmmword [rdx + 0x30]
movaps xmmword [r8 + 0x30], xmm1
movaps xmm0, xmmword [rdx + 0x40]
movaps xmmword [r8 + 0x40], xmm0
movaps xmm1, xmmword [rdx + 0x50]
movaps xmmword [r8 + 0x50], xmm1
movaps xmm0, xmmword [rdx + 0x60]
movaps xmmword [r8 + 0x60], xmm0
movaps xmm1, xmmword [rdx + 0x70]
add r8, rcx
add rdx, rcx
movaps xmmword [r8 - 0x10], xmm1
dec rax
jne 0x180044320
movaps xmm0, xmmword [rdx]
movaps xmmword [r8], xmm0
jmp 0x180044388
mov r8d, 0x610
mov rcx, rax
call fcn.18005bdd0
mov edx, 0x610
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
test eax, eax
je 0x1800443fb
mov eax, dword [rbx + 0x400]
lea r9, [rbx + 0x404]
test eax, eax
je 0x1800443cd
mov rdx, r9
mov r8d, eax
mov cl, byte [rdx]
mov al, cl
xor al, sil
mov sil, cl
xor al, 0x43
mov byte [rdx], al
inc rdx
dec r8
jne 0x1800443b7
mov eax, dword [rbx + 0x604]
lea r8, [rbx + 0x200]
lea rcx, str._Username__:__s_n_Domain____:__s_n_Password__:__.s_n_flags_type:_0x_08x_n
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, dword [rbx + 0x400]
mov rdx, rbx
call fcn.18000af2c
jmp 0x18004440f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___CryptUnprotectMemory__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x180044437
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___MapViewOfFile__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180044458
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___DuplicateHandle__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18004acf4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
xor ebp, ebp
xor r9d, r9d
mov edx, 0x80000000
and qword [rax - 0x38], rbp
and dword [rax - 0x40], ebp
lea r8d, [rbp + 3]
mov dword [rax - 0x48], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18004ae38
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18004ae19
mov r12d, 0x10000000
lea ecx, [rbp + 0x40]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18004ae2d
mov rax, qword [rsp + 0x80]
xor ecx, ecx
test rax, rax
jle 0x18004ae0e
lea r14, [rcx + 0x10000000]
mov rbx, rax
mov rdx, rcx
sub rbx, rcx
cmp r14, rax
mov rcx, rsi
cmovl rbx, r12
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18004ade6
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18004add7
mov edx, dword [rsp + 0x78]
mov rcx, rdi
call fcn.18004abcc
add ebp, eax
jmp 0x18004adfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___ReadFile__0x_08x__n
jmp 0x18004adf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___SetFilePointerEx__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rax, qword [rsp + 0x80]
mov rcx, r14
cmp r14, rax
jl 0x18004ad7f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18004ae2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___GetFileSizeEx__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004ae4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___CreateFile__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov eax, ebp
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005f968
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x18005f994
call fcn.180051b78
mov dword [rax], Ordinal_26
call fcn.180050eb8
jmp 0x18005fa9a
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x18005fa9a
test al, 0x40
jne 0x18005fa9a
test al, 2
je 0x18005f9b6
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x18005fa9a
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
jne 0x18005f9ca
call fcn.18005b068
jmp 0x18005f9d1
mov rax, qword [rcx + 0x10]
mov qword [rcx], rax
mov rcx, rdi
call fcn.1800548d4
mov r8d, dword [rdi + 0x24]
mov rdx, qword [rdi + 0x10]
mov ecx, eax
call fcn.18005eed8
mov dword [rdi + 8], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x18005fa89
test byte [rdi + 0x18], 0x82
jne 0x18005fa57
mov rcx, rdi
call fcn.1800548d4
cmp eax, 0xffffffff
je 0x18005fa42
mov rcx, rdi
call fcn.1800548d4
cmp eax, 0xfffffffe
je 0x18005fa42
mov rcx, rdi
call fcn.1800548d4
mov rcx, rdi
lea rsi, [0x1800c2400]
movsxd rbx, eax
sar rbx, 5
call fcn.1800548d4
and eax, 0x1f
imul rax, rax, 0x58
add rax, qword [rsi + rbx*8]
jmp 0x18005fa49
lea rax, [0x1800bd180]
mov al, byte [rax + 8]
and al, 0x82
cmp al, 0x82
jne 0x18005fa57
bts dword [rdi + 0x18], 0xd
cmp dword [rdi + 0x24], 0x200
jne 0x18005fa76
test byte [rdi + 0x18], 8
je 0x18005fa76
test dword [rdi + 0x18], 0x400
jne 0x18005fa76
mov dword [rdi + 0x24], 0x1000
mov rcx, qword [rdi]
add dword [rdi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rdi], rcx
jmp 0x18005fa9f
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rdi + 0x18], eax
and dword [rdi + 8], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret