joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001a10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r13, rdx
mov rbx, rcx
lea edx, [r15 + 0x41]
mov r14d, r9d
mov r12d, r8d
lea ecx, [rdx - 1]
mov esi, r15d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
cmp rax, r15
je 0x140001b33
lea ebp, [r15 + 7]
cmp r12d, ebp
jb 0x140001a72
lea rcx, str.ERROR_kull_m_busylight_request_create___count_u__max_is_7__n
mov edx, r12d
call fcn.14000c030
cmp r12d, ebp
cmovb ebp, r12d
mov esi, 1
cmp ebp, r15d
jbe 0x140001ade
mov r8, rdi
lea r9, [rdi + 3]
lea rdx, [r13 + 1]
sub r8, r13
mov r10d, ebp
mov al, byte [rdx - 1]
movzx ecx, al
test al, 0xf0
jne 0x140001a9e
or ecx, 0x10
mov byte [r8 + rdx], cl
mov al, byte [rdx]
add rdx, 8
mov byte [r9 - 1], al
mov al, byte [rdx - 7]
mov byte [r9], al
mov al, byte [rdx - 6]
add r9, 8
sub r10, rsi
mov byte [r9 - 7], al
mov al, byte [rdx - 5]
mov byte [r9 - 6], al
mov al, byte [rdx - 4]
mov byte [r9 - 5], al
mov al, byte [rdx - 3]
mov byte [r9 - 4], al
mov al, byte [rdx - 2]
mov byte [r9 - 3], al
jne 0x140001a91
mov r9d, 0xff
mov byte [rdi + 0x39], 4
mov byte [rdi + 0x3a], 4
mov byte [rdi + 0x3b], Ordinal_88
movzx ecx, r15w
lea rdx, [rdi + 1]
mov byte [rdi + 0x3e], r9b
mov byte [rdi + 0x3d], r9b
mov byte [rdi + 0x3c], r9b
mov r8d, 0x3e
movzx eax, byte [rdx]
add rdx, rsi
add cx, ax
sub r8, rsi
jne 0x140001b0a
movzx eax, cx
shr ax, 8
mov byte [rdi + 0x3f], al
movzx eax, cx
cdq
and edx, r9d
add eax, edx
and eax, r9d
sub eax, edx
mov byte [rdi + 0x40], al
cmp esi, r15d
je 0x140001bdd
jmp 0x140001bcb
mov ebp, r15d
cmp rbx, r15
je 0x140001bad
mov rcx, qword [rbx + 0x78]
cmp rcx, r15
je 0x140001bad
cmp rcx, 0xffffffffffffffff
je 0x140001bad
movzx r9d, word [rbx + 0x2a]
mov r8d, Ordinal_69
cmp r9d, r8d
jb 0x140001b9c
lea r9, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
cmp eax, r15d
jne 0x140001bbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__WriteFile__0x_08x__n
mov r8d, eax
call fcn.14000c030
jmp 0x140001bbc
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.14000c030
jmp 0x140001bbc
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000c030
and esi, ebp
cmp r14d, r15d
je 0x140001bc8
mov rbx, qword [rbx]
jmp 0x140001bcb
mov rbx, r15
cmp rbx, r15
jne 0x140001b41
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002104
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
mov r12, rcx
mov edx, 0x338
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400022d5
and dword [rbx + 0x1c], 0
and dword [rbx + 0x20], 0
lea rbp, [rax + 8]
mov eax, 0x4000000
mov r8, r12
xor edx, edx
mov dword [rbp], eax
mov dword [rbx + 0xc], eax
mov eax, SQLGetData
mov rcx, rbp
mov word [rbx + 0x28], ax
call fcn.140001f8c
test eax, eax
je 0x1400022b7
mov edi, 0x100
lea rdx, [rbx + 0x22a]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1400022c3
mov rax, rdi
lea rcx, [rbx + 0x22a]
cmp byte [rcx], 0
je 0x1400021a5
inc rcx
sub rax, 1
jne 0x140002197
test rax, rax
je 0x1400022c3
mov rcx, rdi
mov r9d, 0
sub rcx, rax
sub rdi, rcx
lea rax, [rcx + rbx + 0x22a]
je 0x1400021f9
lea r8, [0x1400e1388]
lea rcx, [rdi + rcx + 0x7ffffeff]
sub r8, rax
test rcx, rcx
je 0x1400021f4
mov dl, byte [r8 + rax]
test dl, dl
je 0x1400021f4
mov byte [rax], dl
dec rcx
inc rax
sub rdi, 1
jne 0x1400021d9
test rdi, rdi
jne 0x140002202
dec rax
mov r9d, 0x8007007a
mov byte [rax], 0
test r9d, r9d
js 0x1400022c3
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], rbp
lea rax, [0x140001eb0]
mov qword [rsp + 0x50], rax
lea rax, [0x140001e7c]
lea r9, [0x140001d10]
mov qword [rsp + 0x48], rax
lea rax, [0x140001e44]
lea r8, [0x140001d00]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140001e10]
lea rdx, [fcn.140016720]
mov qword [rsp + 0x38], rax
lea rax, [0x140001dd8]
lea rcx, [rbx + 0x32c]
mov qword [rsp + 0x30], rax
lea rax, [0x140001da0]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140001d18]
mov qword [rsp + 0x20], rax
call sub.Cabinet.dll_FCICreate
mov qword [rbx], rax
test rax, rax
jne 0x1400022d5
mov ecx, dword [rbx + 0x32c]
call fcn.140002088
mov edx, dword [rbx + 0x32c]
lea rcx, str.ERROR_kull_m_cabinet_create___FCICreate_failed_with_error_code__d:__S_n
mov r8, rax
call fcn.14000c030
jmp 0x1400022c3
lea rcx, str.ERROR_kull_m_cabinet_create___Failed_to_initialize_the_cabinet_information_structure._n
call fcn.14000c030
cmp qword [rbx], 0
jne 0x1400022d5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140004c90
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, qword [rsp + 0xb0]
xor r12d, r12d
mov r15, r8
and qword [r11 - 0x48], r12
lea rax, [r11 - 0x30]
mov r8, rcx
mov rcx, qword [r14]
mov r13d, r9d
mov rbx, rdx
mov qword [r11 - 0x50], rax
and dword [r11 - 0x58], r12d
lea edi, [r12 + 1]
lea r9d, [r12 + 0x10]
mov edx, 0x660e
mov dword [rsp + 0x40], edi
call fcn.140003b18
test eax, eax
je 0x140004de8
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
lea edx, [rdi + 3]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140004dc7
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140004db8
lea ecx, [rdi + 0x3f]
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, qword [rsp + 0xa0]
mov qword [rbx], rax
mov rdi, rax
test rax, rax
je 0x140004ddb
mov rbp, qword [rsp + 0xa8]
mov r8, r13
mov rdx, r15
mov rcx, rax
mov dword [rbp], r13d
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x48]
lea r8d, [r12 + 1]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r12d, eax
test eax, eax
jne 0x140004ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptDecrypt__0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
and dword [rbp], r12d
mov qword [rbx], rax
jmp 0x140004ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptSetKeyParam__IV___0x_08x__n
jmp 0x140004dd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptSetKeyParam__MODE___0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x140004dfc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___kull_m_crypto_hkey__0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, qword [r14]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x50]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140004eec
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x70
xor ebx, ebx
lea rax, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov ebp, r9d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x58], ebx
mov qword [r11 - 0x18], rbx
mov dword [rsp + 0x68], 1
mov r12, r8
mov edi, edx
mov rsi, rcx
call fcn.140013168
mov qword [rsp + 0x40], rax
cmp rax, rbx
je 0x14000502a
mov r9d, dword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rdx, rax
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, ebx
je 0x14000500b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov rdx, r12
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
cmp eax, ebx
je 0x140004feb
lea ecx, [rbx + 2]
mov r9d, 0x2000
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
cmp rax, rbx
je 0x140004fde
mov r9, qword [rsp + 0xa8]
lea r8, [rsp + 0x40]
mov edx, edi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140005048
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x140004fff
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptImportKey__0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, qword [rsp + 0x30]
call fcn.140003d2c
jmp 0x14000501f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptAcquireContext__0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140006058
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r13d, r9d
mov r14, r8
mov esi, edx
mov r12, rcx
xor ebx, ebx
mov dword [rax - 0x34], ebx
lea r9d, [rbx + 8]
lea r8, str.Microsoft_Primitive_Provider
lea rdx, str.SHA256
lea rcx, [rax - 0x20]
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
js 0x14000619d
and dword [rsp + 0x28], ebx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
lea r8, [rsp + 0x40]
lea rdx, str.ObjectLength
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
js 0x140006181
mov edx, dword [rsp + 0x40]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14000618f
and dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r12
mov r9d, dword [rsp + 0x40]
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCreateHash
test eax, eax
js 0x140006168
xor r9d, r9d
mov r8d, r13d
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call sub.bcrypt.dll_BCryptHashData
xor r9d, r9d
lea r8d, [rbx + 0x20]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
call sub.bcrypt.dll_BCryptFinishHash
test eax, eax
setns bl
mov dword [rsp + 0x44], ebx
test ebx, ebx
jne 0x14000615c
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_ngc_signature_derived___BCryptFinishHash:_0x_08x_n
call fcn.14000c030
mov rcx, qword [rsp + 0x50]
call sub.bcrypt.dll_BCryptDestroyHash
jmp 0x140006176
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_ngc_signature_derived___BCryptCreateHash:_0x_08x_n
call fcn.14000c030
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000618f
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_ngc_signature_derived___BCryptGetProperty:_0x_08x_n
call fcn.14000c030
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
jmp 0x1400061ab
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_ngc_signature_derived___BCryptOpenAlgorithmProvider:_0x_08x_n
call fcn.14000c030
jmp 0x1400061bd
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140009924
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov esi, dword [rcx + 0x1c]
mov eax, 0x8004
mov rbp, rcx
xor edi, edi
cmp esi, 0x8009
mov r15, rdx
cmove esi, eax
mov ecx, esi
call fcn.1400049d0
mov ecx, dword [rbp + 0x28]
call fcn.140004af4
mov ecx, dword [rbp + 0x28]
mov ebx, eax
call fcn.140004a60
lea ecx, [rdi + 0x40]
lea r13d, [rax + rbx]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
je 0x140009b2a
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x20]
lea r13d, [rdi + 0x14]
lea r14d, [rdi + 0x10]
mov dword [rsp + 0x28], eax
lea r9, [rbp + 0x34]
mov r8d, r13d
mov rdx, r15
mov ecx, esi
mov dword [rsp + 0x20], r14d
call fcn.140003fc8
test eax, eax
je 0x140009b21
mov ecx, dword [rbp + 0x28]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov r8d, ebx
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.140004704
test eax, eax
je 0x140009b0d
mov rcx, qword [rsp + 0x50]
lea r8, [r12 + rbx]
lea edx, [rdi + 1]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140009ae5
mov eax, dword [rbp + 0x54]
lea ecx, [rdi + 0x40]
mov rdx, rax
mov dword [rsp + 0xa0], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140009ae5
mov r8d, dword [rsp + 0xa0]
mov rdx, qword [rbp + 0x4c]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0xa0]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140009adc
cmp dword [rbp + 0x2c], r13d
mov rcx, qword [rsp + 0xc0]
mov rdx, rsi
cmovb r13d, dword [rbp + 0x2c]
mov r8d, r13d
call sub.msvcrt.dll_memcpy
mov ebx, dword [rbp + 0x30]
mov ebp, dword [rbp + 0x2c]
mov rcx, qword [rsp + 0xb8]
cmp ebx, r14d
cmovb r14d, ebx
add rbp, rsi
mov rdx, rbp
mov r8d, r14d
call sub.msvcrt.dll_memcpy
add ebx, 0xfffffff0
mov edi, 1
je 0x140009adc
xor edx, edx
test ebx, ebx
je 0x140009adc
lea rcx, [rbp + 0x10]
test edi, edi
je 0x140009adc
xor eax, eax
cmp byte [rcx], al
sete al
inc edx
inc rcx
and edi, eax
cmp edx, ebx
jb 0x140009ac6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x58]
call fcn.140003d2c
test eax, eax
jne 0x140009b21
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_close_hprov_delete_container__0x_08x__n
jmp 0x140009b1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_hkey_session__0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009e4c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
cmp dword [0x14014023c], ebx
je 0x140009e98
call fcn.1400136d4
mov ebx, eax
test eax, eax
jne 0x140009f3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_file_readGeneric___kull_m_string_quick_base64_to_Binary__0x_08x__n
mov edx, eax
call fcn.14000c030
jmp 0x140009f3d
and qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r9d
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x140009f3d
cmp rax, 0xffffffffffffffff
je 0x140009f3d
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140009f34
cmp dword [rsp + 0x4c], ebx
jne 0x140009f34
mov rax, qword [rsp + 0x48]
mov ecx, 0x40
mov edx, eax
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp], rax
test rax, rax
je 0x140009f34
mov r8d, dword [rsi]
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140009f2a
mov eax, dword [rsp + 0x40]
cmp dword [rsi], eax
jne 0x140009f2a
mov ebx, 1
jmp 0x140009f34
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14000b418
Capabilities:
Get domain controller name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
or edx, 0x40020000
lea rax, [r11 + 0x20]
mov rsi, r8
mov qword [r11 - 0x10], rax
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ebx, ebx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov qword [r11 + 0x20], rbx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, ebx
jne 0x14000b4b0
mov rax, qword [rsp + 0x58]
or rcx, 0xffffffffffffffff
mov rdi, qword [rax]
xor eax, eax
add rdi, 4
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsi], rax
cmp rax, rbx
je 0x14000b4a4
mov rax, qword [rsp + 0x58]
mov r8, rdi
mov ebx, 1
mov rdx, qword [rax]
add rdx, 4
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x58]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x14000b4be
lea rcx, str.ERROR_kull_m_net_getDC___DsGetDcName:__u_n
mov edx, eax
call fcn.14000c030
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b4d0
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
neg ecx
mov rdi, rdx
sbb esi, esi
and dword [rax + 8], ebx
lea r8, [rax + 8]
and esi, 3
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14000b55d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14000b55d
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x14000b571
lea r8, [rsp + 0x30]
lea ecx, [rsi + 4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ebx, eax
test eax, eax
jne 0x14000b571
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_data___0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000b571
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_init___0x_08x__n
mov edx, eax
call fcn.14000c030
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d648
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0xd0
mov r13d, r8d
mov edi, ecx
mov rsi, rdx
xor ebp, ebp
lea rcx, [rax - 0x78]
xor edx, edx
lea ebx, [rbp + 0x68]
or r13d, 0x10
mov r8, rbx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x60], ebx
cmp qword [rsp + 0x120], rbp
je 0x14000d69b
mov rbx, qword [rsp + 0x120]
jmp 0x14000d6ac
mov edx, reloc.ODBC32.dll_SQLAllocHandle
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rbx, rbx
je 0x14000d7e7
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsdup]
mov rsi, rax
test rax, rax
je 0x14000d7e7
test edi, edi
je 0x14000d769
sub edi, 1
je 0x14000d730
cmp edi, 1
jne 0x14000d7ca
mov r9d, dword [rsp + 0x100]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x14000d79c
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
and dword [rsp + 0x28], ebp
and qword [rsp + 0x20], rbp
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14000d79c
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], rbp
and qword [rsp + 0x30], rbp
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], r13d
and dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
test eax, eax
je 0x14000d7ca
cmp dword [rsp + 0x128], 0
jne 0x14000d7b7
cmp qword [rsp + 0x120], 0
jne 0x14000d7de
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x120], 0
jne 0x14000d7de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
lea r11, [rsp + 0xd0]
mov eax, ebp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret