joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001c9f0
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rdi, rcx
lea rax, [rbp + 0x1f]
xor esi, esi
lea r12d, [rsi + 0x10]
lea rcx, str._nSAMKey_:
mov r14, r9
mov r15, r8
mov rbx, rdx
mov qword [rbp - 0x59], rax
mov dword [rbp - 0x61], r12d
mov dword [rbp - 0x5d], r12d
mov dword [rbp - 0x51], r12d
mov dword [rbp - 0x4d], r12d
mov qword [rbp - 0x49], r9
call fcn.18004d68c
and qword [rsp + 0x30], rsi
lea rax, [rbp - 0x69]
lea r9, [0x1800fd4e0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.180051444
test eax, eax
je 0x18001cba6
mov rcx, qword [rbp - 0x69]
movzx edx, word [rcx]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x18001cb8e
mov edx, dword [rcx + 0x68]
mov eax, edx
dec eax
je 0x18001caf8
dec eax
je 0x18001caa4
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_Struct_Key_revision___u_
jmp 0x18001cb95
mov r9d, dword [rcx + 0x74]
lea rax, [rbp + 0x7f]
lea r8, [rcx + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x41]
lea rdx, [rcx + 0x78]
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.180044d50
test eax, eax
je 0x18001cb9a
cmp dword [rbp + 0x7f], r12d
mov rcx, qword [rbp - 0x41]
sete sil
test esi, esi
je 0x18001caed
movups xmm0, xmmword [rcx]
movdqu xmmword [r14], xmm0
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18001cb9a
lea rcx, [rbp - 0x39]
call sub.cryptdll.dll_MD5Init
mov rdx, qword [rbp - 0x69]
lea rcx, [rbp - 0x39]
add rdx, 0x70
mov r8d, r12d
call sub.cryptdll.dll_MD5Update
lea rdx, str.______qwertyUIOPAzxcvbnmQQQQQQQQQQQQ____
lea rcx, [rbp - 0x39]
mov r8d, 0x2f
call sub.cryptdll.dll_MD5Update
lea rcx, [rbp - 0x39]
mov r8d, r12d
mov rdx, r15
call sub.cryptdll.dll_MD5Update
lea rdx, str.0123456789012345678901234567890123456789
lea rcx, [rbp - 0x39]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
call sub.cryptdll.dll_MD5Update
lea rcx, [rbp - 0x39]
call sub.cryptdll.dll_MD5Final
mov rax, qword [rbp - 0x69]
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x51]
movups xmm0, xmmword [rax + 0x80]
movdqu xmmword [r14], xmm0
call sub.ADVAPI32.dll_SystemFunction033
test eax, eax
setns sil
test esi, esi
jne 0x18001cb9a
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___RtlDecryptData2_KO
call fcn.18004d68c
jmp 0x18001cb9a
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_F_revision___hu_
call fcn.18004d68c
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18001cbb2
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___kull_m_registry_OpenAndQueryWithAlloc_KO
call fcn.18004d68c
test esi, esi
je 0x18001cbc4
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.180053168
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.18004d68c
lea r11, [rsp + 0xe0]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x18001cbf4
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov eax, dword [rcx]
xor edi, edi
mov r14, rcx
and dword [rbp - 0x69], edi
and dword [rbp - 0x65], edi
and qword [rbp - 0x61], rdi
lea r9d, [rdi + 0x10]
lea rcx, [rbp + 0xf]
mov r15, r8
lea rbx, [rdx + rax]
mov dword [rbp - 0x59], r9d
mov dword [rbp - 0x55], r9d
mov qword [rbp - 0x51], rcx
test eax, eax
je 0x18001ce28
mov r8d, dword [r14 + 4]
test r8d, r8d
je 0x18001ce28
movzx edx, word [rbx + 2]
mov esi, dword [rbp + 0x7f]
mov ecx, edx
dec ecx
je 0x18001ccf3
dec ecx
je 0x18001cc78
lea rcx, str.ERROR_kuhl_m_lsadump_getHash___Unknow_SAM_HASH_revision___hu__n
call fcn.18004d68c
jmp 0x18001ce19
cmp dword [rbx + 4], r9d
jb 0x18001ce28
lea rax, [rbp + 0x57]
lea r9d, [r8 - 0x18]
lea rdx, [rbx + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5f]
lea r8, [rbx + 0x18]
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.180044d50
test eax, eax
je 0x18001ce19
mov eax, dword [rbp + 0x57]
mov ecx, 0x40
mov edx, eax
mov dword [rbp - 0x65], eax
mov dword [rbp - 0x69], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x61], rax
test rax, rax
je 0x18001cce4
mov r8d, dword [rbp + 0x57]
mov rdx, qword [rbp + 0x5f]
mov rcx, rax
call fcn.1800ca790
mov edi, 1
mov rcx, qword [rbp + 0x5f]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18001cdd3
cmp r8d, 6
jb 0x18001ce28
lea rcx, [rbp - 0x49]
call sub.cryptdll.dll_MD5Init
lea rcx, [rbp - 0x49]
mov r8d, 0x10
mov rdx, r15
call sub.cryptdll.dll_MD5Update
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x49]
mov r8d, 4
call sub.cryptdll.dll_MD5Update
mov eax, esi
lea rcx, str.NTPASSWORDHISTORY
neg eax
lea rax, str.NTPASSWORD
lea rdx, str.LMPASSWORD
sbb r8d, r8d
and r8d, 7
add r8d, 0xb
test esi, esi
cmovne rax, rcx
lea rcx, str.LMPASSWORDHISTORY
cmovne rdx, rcx
cmp dword [rbp + 0x77], edi
lea rcx, [rbp - 0x49]
cmovne rdx, rax
call sub.cryptdll.dll_MD5Update
lea rcx, [rbp - 0x49]
call sub.cryptdll.dll_MD5Final
mov eax, dword [r14 + 4]
mov ecx, 0x40
sub eax, 4
mov edx, eax
mov dword [rbp - 0x65], eax
mov dword [rbp - 0x69], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x61], rax
test rax, rax
je 0x18001ce28
mov r8d, dword [rbp - 0x69]
lea rdx, [rbx + 4]
mov rcx, rax
call fcn.1800ca790
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call sub.ADVAPI32.dll_SystemFunction033
test eax, eax
setns dil
test edi, edi
jne 0x18001cdd7
lea rcx, str.ERROR_kuhl_m_lsadump_getHash___RtlDecryptData2_n
call fcn.18004d68c
test edi, edi
je 0x18001ce19
mov r8d, dword [rbp + 0x6f]
mov edx, dword [rbp - 0x69]
test esi, esi
lea rcx, str.ntlm
lea rax, str.NTLM
lea r9, str.LM
cmovne rax, rcx
lea rcx, str.lm
mov dword [rsp + 0x20], esi
cmovne r9, rcx
cmp dword [rbp + 0x77], 0
mov rcx, qword [rbp - 0x61]
cmovne r9, rax
call fcn.180030aa0
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x18001ce28
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002abd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8w
movzx r10d, dl
mov r11, r9
shl r10d, 0x10
xor r9b, r9b
mov rsi, rcx
or r10d, eax
movabs rax, 0x2004000000
add r10d, r10d
movsxd rdi, r10d
xor r10b, r10b
or rdi, rax
xor r8b, r8b
movzx edx, r8b
mov rax, rdi
inc r8b
lea ecx, [rdx + 0xd]
shr rax, cl
lea ecx, [rdx + 1]
and al, 1
xor r10b, al
mov rax, rdi
shr rax, cl
and al, 1
xor r9b, al
cmp r8b, 0xc
jb 0x18002ac10
movzx eax, r10b
and eax, 1
shl eax, 0x19
movsxd rcx, eax
xor eax, eax
test r9b, r9b
sete al
and eax, 1
or rcx, rax
or rdi, rcx
test r11, r11
je 0x18002ac5f
mov qword [r11], rdi
mov rcx, rdi
mov dword [rsi], 0x90625062
shr rcx, 0x28
call fcn.18002ab90
mov rcx, rdi
movzx ebx, al
shr rcx, 0x24
or ebx, 0x1d00
shl ebx, 8
call fcn.18002ab90
mov rcx, rdi
movzx eax, al
shr rcx, 0x20
or ebx, eax
shl ebx, 8
call fcn.18002ab90
mov rcx, rdi
movzx eax, al
shr rcx, 0x1c
or ebx, eax
mov dword [rsi + 4], ebx
call fcn.18002ab90
mov rcx, rdi
movzx ebx, al
shr rcx, 0x18
shl ebx, 8
call fcn.18002ab90
mov rcx, rdi
movzx eax, al
shr rcx, 0x14
or ebx, eax
shl ebx, 8
call fcn.18002ab90
mov rcx, rdi
movzx eax, al
shr rcx, 0x10
or ebx, eax
shl ebx, 8
call fcn.18002ab90
mov rcx, rdi
movzx eax, al
shr rcx, 0xc
or ebx, eax
mov dword [rsi + 8], ebx
call fcn.18002ab90
mov rcx, rdi
movzx ebx, al
shr rcx, 8
shl ebx, 8
call fcn.18002ab90
mov rcx, rdi
movzx eax, al
shr rcx, 4
or ebx, eax
shl ebx, 8
call fcn.18002ab90
mov cl, dil
movzx eax, al
or ebx, eax
shl ebx, 8
call fcn.18002ab90
movzx eax, al
or ebx, eax
mov dword [rsi + 0xc], ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18002ad54
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
mov byte [rax + 8], 0
xor eax, eax
mov rbp, rdx
mov r10, rcx
movabs r8, 0xff80000000000000
xor r11b, r11b
mov word [rsp + 0x11], ax
mov byte [rsp + 0x13], al
movzx esi, r11b
mov rdx, rbp
lea r9, [rsp + 0x10]
mov ebx, esi
neg ebx
lea ecx, [rbx*4 + 0x24]
shr rdx, cl
xor cl, cl
and dl, 0xf
xor dil, dil
mov al, dl
shr al, cl
inc cl
and al, 1
xor byte [r9], al
inc r9
xor dil, al
cmp cl, 4
jb 0x18002ada8
lea eax, [rsi + rsi*4]
movzx edx, dl
mov ecx, Ordinal_54
sub ecx, eax
lea eax, [rbx + 0xa]
inc r11b
shl rdx, cl
lea ecx, [rax + rax*4]
movzx eax, dil
shl rax, cl
or rdx, rax
or r8, rdx
cmp r11b, 0xa
jb 0x18002ad86
movzx eax, byte [rsp + 0x12]
movzx ecx, byte [rsp + 0x13]
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
add ecx, ecx
or ecx, eax
movzx eax, byte [rsp + 0x11]
mov dword [r10], 0x148040
add ecx, ecx
or ecx, eax
movzx eax, byte [rsp + 0x10]
add ecx, ecx
or ecx, eax
lea eax, [rcx + rcx]
cdqe
or r8, rax
mov rax, r8
mov dword [r10 + 8], r8d
shr rax, 0x20
mov dword [r10 + 4], eax
pop rdi
ret
Function at 0x18002ea64
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
mov rcx, qword [rcx + 8]
lea rdx, str.Microsoft_WinInet_
call fcn.1800ca0e8
test rax, rax
je 0x18002eb13
mov edx, dword [rbx + 0x20]
cmp edx, 0x14
jb 0x18002ec86
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx + 4]
cmp rax, qword [0x18012b250]
jne 0x18002ec86
mov rax, qword [rcx + 0xc]
cmp rax, qword [0x18012b258]
jne 0x18002ec86
lea rax, [0x180123070]
mov qword [rbp - 0x18], rcx
mov dword [rbp - 0x20], edx
mov qword [rbp - 8], rax
lea rax, [rbp - 0x30]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea rcx, [rbp - 0x20]
xor r9d, r9d
xor edx, edx
mov dword [rbp - 0x10], Ordinal_79
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x18002ec72
lea rcx, str.___CredentialBlob:
jmp 0x18002ec49
mov rcx, qword [rbx + 8]
lea rdx, str.AppSense_DataNow_
call fcn.1800ca0e8
test rax, rax
je 0x18002ec86
lea rcx, str._Ivanti_FileDirector_credential_blob__n
call fcn.18004d68c
cmp dword [rbx + 0x20], 0x14
jb 0x18002ec86
mov rbx, qword [rbx + 0x28]
lea rcx, str.AppN_DN_Win
mov rdx, rbx
call fcn.1800cb820
test eax, eax
jne 0x18002ec86
cmp dword [rbx + 0xc], eax
je 0x18002ebee
lea rcx, str.Decrypting_additional_blob_n
call fcn.18004d68c
mov eax, dword [rbx + 0xc]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], eax
lea rax, [rbx + 0x14]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x18002ebda
lea rcx, str.___CredentialBlob:
call fcn.18004d68c
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.180052eb4
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.18004d68c
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18002ebee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
mov edx, eax
call fcn.18004d68c
cmp dword [rbx + 0x10], 0
je 0x18002ec86
lea rcx, str.Decrypting_additional_blob_n
call fcn.18004d68c
mov eax, dword [rbx + 0x10]
lea rcx, [rbx + 0x14]
mov dword [rbp - 0x20], eax
mov eax, dword [rbx + 0xc]
xor r9d, r9d
add rcx, rax
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x18002ec72
lea rcx, str.___UnkBlob_______:
call fcn.18004d68c
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.180052eb4
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.18004d68c
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18002ec86
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180036c54
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, rdx
mov rbp, rcx
lea rdx, [r11 + 0x10]
mov rcx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x180036d03
mov eax, dword [rsp + 0x38]
test eax, eax
jle 0x180036cec
xor ebx, ebx
test eax, eax
jle 0x180036ce3
mov rsi, rdi
mov rcx, qword [rsi]
lea rdx, str._HTC:
mov r8d, 5
call fcn.1800cbcbc
test eax, eax
je 0x180036cbc
inc ebx
add rsi, 8
cmp ebx, dword [rsp + 0x38]
jl 0x180036c95
jmp 0x180036ce3
movsxd rax, ebx
xor edx, edx
mov rcx, qword [rdi + rax*8]
lea r8d, [rdx + 0xa]
add rcx, 0xa
call fcn.1800cb3f0
mov rcx, rbp
mov edx, eax
mov ebx, eax
call fcn.180036d34
test rbx, rbx
jne 0x180036cf8
lea rcx, str.__No_shared_memory__no_SSO_enabled___n
jmp 0x180036cf3
lea rcx, str.ERROR_Citrix_SSO_Program_args___No_command_module_
call fcn.18004d68c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180036d17
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_Citrix_SSO_Program_args___CommandLineToArgvW__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180036d34
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rsp + 0x60]
mov esi, 4
mov r8, rax
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x180036eca
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov qword [rsp + 0x20], 0x61c
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x180036ea9
mov ebx, 0x610
mov ecx, 0x40
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180036e9e
mov rcx, rax
mov eax, reloc.WLDAP32.dll_Ordinal_12
lea r8, [rsi + 0xc]
lea edx, [rax + 0x74]
movups xmm0, xmmword [r8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [r8 + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [r8 + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [r8 + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [r8 + 0x70]
add rcx, rdx
add r8, rdx
movups xmmword [rcx - 0x10], xmm1
dec rax
jne 0x180036dd3
movups xmm0, xmmword [r8]
lea r8d, [rax + 1]
mov edx, ebx
movups xmmword [rcx], xmm0
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
test eax, eax
je 0x180036e81
mov edx, dword [rdi + 0x400]
lea rbx, [rdi + 0x404]
mov rcx, rbx
call fcn.180036f14
mov eax, dword [rdi + 0x604]
mov r9d, dword [rdi + 0x400]
mov dword [rsp + 0x28], eax
lea r8, [rdi + 0x200]
lea rcx, str._Username__:__s_n_Domain____:__s_n_Password__:__.s_n_flags_type:_0x_08x_n
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call fcn.18004d68c
jmp 0x180036e95
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___CryptUnprotectMemory__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x180036ebd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___MapViewOfFile__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180036ede
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___DuplicateHandle__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180036f14
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
test edx, edx
je 0x180036f34
mov r9d, edx
mov dl, byte [rcx]
mov al, dl
xor al, r8b
mov r8b, dl
xor al, 0x43
mov byte [rcx], al
inc rcx
dec r9
jne 0x180036f1e
ret
Function at 0x18003a5f4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rax, [rdx + r9]
xor edi, edi
mov rbx, r8
mov r9, rax
mov r10, rdx
mov r11, rcx
sub r9, rdx
cmp rdx, rax
cmova r9, rdi
test r9, r9
je 0x18003a674
sub r10, rbx
movzx edx, byte [r11 + 0x100]
inc rdi
movzx r8d, byte [rdx + r11]
add byte [r11 + 0x101], r8b
movzx eax, byte [r11 + 0x101]
mov cl, byte [rax + r11]
mov byte [rdx + r11], cl
movzx eax, byte [r11 + 0x101]
add ecx, r8d
mov byte [rax + r11], r8b
movzx eax, cl
mov cl, byte [rax + r11]
xor cl, byte [r10 + rbx]
mov byte [rbx], cl
inc byte [r11 + 0x100]
inc rbx
cmp rdi, r9
jb 0x18003a622
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x18003da84
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
xor ebp, ebp
xor r9d, r9d
mov edx, 0x80000000
and qword [rax - 0x38], rbp
and dword [rax - 0x40], ebp
lea r8d, [rbp + 3]
mov dword [rax - 0x48], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18003dbce
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18003dbaf
mov r12d, 0x10000000
lea ecx, [rbp + 0x40]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18003dbc3
mov rax, qword [rsp + 0x80]
xor ecx, ecx
test rax, rax
jle 0x18003dba4
lea r14, [rcx + 0x10000000]
mov rbx, rax
mov rdx, rcx
sub rbx, rcx
cmp r14, rax
mov rcx, rdi
cmovl rbx, r12
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18003db7c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003db6d
mov edx, dword [rsp + 0x78]
mov r8d, 1
mov rcx, rsi
call fcn.18003d9c8
add ebp, eax
jmp 0x18003db90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___ReadFile__0x_08x__n
jmp 0x18003db89
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___SetFilePointerEx__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rax, qword [rsp + 0x80]
mov rcx, r14
cmp r14, rax
jl 0x18003db0f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18003dbc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___GetFileSizeEx__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003dbe2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___CreateFile__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov eax, ebp
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180041434
Capabilities:
Terminate thread

Disassembly:
test rcx, rcx
je 0x1800414f7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
cmp qword [rdi + 0x78], 0
je 0x18004147c
test esi, esi
je 0x18004146d
cmp qword [rdi + 0x78], 0xffffffffffffffff
je 0x18004146d
xor edx, edx
mov rcx, rdi
call fcn.1800419d4
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rdi + 0x78], 0
mov rcx, qword [rdi + 0x88]
and dword [rdi + 0x80], 0
test rcx, rcx
je 0x18004149f
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rdi + 0x88], 0
mov rcx, qword [rdi + 0x98]
and dword [rdi + 0x90], 0
test rcx, rcx
je 0x1800414c2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rdi + 0x98], 0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1800414d0
call fcn.1800cb3fc
mov rbx, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, rbx
test rbx, rbx
jne 0x180041451
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18004167c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x1800416e9
mov rcx, qword [rcx + 0x78]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800416e9
movzx r9d, word [rbx + 0x2a]
cmp r8d, r9d
ja 0x1800416d8
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x1800416f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__WriteFile__0x_08x__n
mov r8d, eax
call fcn.18004d68c
jmp 0x1800416f8
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.18004d68c
jmp 0x1800416f8
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.18004d68c
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18004170c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800417b2
mov rax, qword [rcx + 0x78]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1800417b2
movzx edi, word [rcx + 0x28]
lea ecx, [rbp + 0x40]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r14], rax
test rax, rax
je 0x1800417c1
mov rcx, qword [rbx + 0x78]
and qword [rsp + 0x20], rbp
mov r9, rsi
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
test eax, eax
je 0x180041789
cmp dword [rsi], edi
je 0x1800417c1
mov edx, dword [rsi]
mov r8d, edi
lea rcx, str.ERROR_kull_m_busylight_device_read_raw____device__u___u_byte_s__readed___u_wanted_n
jmp 0x18004179c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_read_raw____device__u__ReadFile__0x_08x__n
mov r8d, eax
call fcn.18004d68c
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [r14], rax
and dword [rsi], 0
jmp 0x1800417c1
mov edx, dword [rcx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_read_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.18004d68c
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret

Function at 0x1800419d4
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x80000000
mov rbx, rcx
test rcx, rcx
je 0x180041a32
mov rcx, qword [rbx + 0x98]
and dword [rbx + 0x90], 0
test rcx, rcx
je 0x180041a22
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rbx + 0x98], 0
test esi, esi
je 0x180041a2b
mov rbx, qword [rbx]
jmp 0x180041a2d
xor ebx, ebx
test rbx, rbx
jne 0x1800419ff
lea rdx, [rsp + 0x30]
mov r9d, esi
mov r8d, 1
mov rcx, rdi
call fcn.180041928
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret