joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f000
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x14002f015
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14002f030
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.140038dd0

Function at 0x1400322c0
Capabilities:
Set socket configuration

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rcx, qword [rcx]
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x140032327
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x140032327
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x140032327
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x140032327
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140032369
mov dword [rbp - 4], r9d
mov dword [rsp + 0x20], 4
lea r9, [rbp - 4]
mov edx, 0xffff
mov r8d, 0x1006
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140032355
xor eax, eax
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbp
ret
lea rax, str.cannot_set_a_0_duration_timeout
add rsp, 0x30
pop rbp
ret

Function at 0x140032380
Capabilities:
Set socket configuration

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rcx, qword [rcx]
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x1400323e7
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x1400323e7
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x1400323e7
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x1400323e7
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x140032429
mov dword [rbp - 4], r9d
mov dword [rsp + 0x20], 4
lea r9, [rbp - 4]
mov edx, 0xffff
mov r8d, 0x1005
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140032415
xor eax, eax
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbp
ret
lea rax, str.cannot_set_a_0_duration_timeout
add rsp, 0x30
pop rbp
ret

Function at 0x140032450
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x140032486
movsxd rdx, eax
xor eax, eax
add rsp, 0x20
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1400324b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
add byte [rbx + 0x774fff8], al
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x140032506
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
Function at 0x140038dd0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14003b160
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140038e30
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.14003be50
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x140038e3c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x140038e68
test rdi, rdi
je 0x140038e94
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140013c40
xor eax, eax
jmp 0x140038e33
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x140038e33
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140013c40
jmp 0x140038e30
xor eax, eax
jmp 0x140038e33

Function at 0x140038ea0
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14003b160
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140038f00
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.14003be50
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x140038f0c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x140038f36
test rdi, rdi
je 0x140038f62
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140013c40
xor eax, eax
jmp 0x140038f03
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x140038f03
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140013c40
jmp 0x140038f00
xor eax, eax
jmp 0x140038f03
Function at 0x1400398c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14009bce8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x1400398f8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14003994f
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x14003995c
xor edx, edx
xor eax, eax
jmp 0x140039986
cmp eax, 0x103
je 0x140039990
test eax, eax
js 0x14003996f
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140039986
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140031990
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14002c960
mov ecx, 7
int 0x29
ud2

Function at 0x1400399e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14009bce8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140039a18
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140039a76
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140039aa3
test eax, eax
js 0x140039a82
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140039a99
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140031990
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14002c960
mov ecx, 7
int 0x29
ud2
Function at 0x140039b00
Capabilities:
Create udp socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov edi, edx
cmp word [rcx], 0
mov eax, 2
mov r14d, 0x17
cmove r14d, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, r14d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140039be1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x140039b68
mov esi, eax
cmp eax, 0x2726
jne 0x140039bd4
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, r14d
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x140039bcc
mov rsi, rax
xor ebx, ebx
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x140039be1
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov ebx, 1
mov rsi, rdi
jmp 0x140039be1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
mov rax, rbx
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x14003c830
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x186], ax
mov rax, qword [0x1400ebdf0]
cmp rax, 3
jne 0x14003c962
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
ja 0x14003c988
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
inc rdi
lea rcx, [rbp + 0x158]
mov rdx, rbx
mov r8, rdi
call fcn.14003e920
cmp qword [rbp + 0x158], 0
je 0x14003c8d1
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14003c953
mov rcx, qword [rbp + 0x160]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x178], 0
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x178]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14003c934
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14003c94c
mov rax, qword [rbp + 0x178]
movzx ecx, word [rbp + 0x186]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rbx, rdx
call fcn.14008c7c0
mov rdx, rbx
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
jbe 0x14003c887
lea r9, [rbp + 0x170]
mov rcx, rsi
mov r8, rdi
call fcn.14008c910
jmp 0x14003c953
Function at 0x14003cbf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov dword [rbp + 0x34], 0x80
lea rdx, [rbp - 0x60]
lea r8, [rbp + 0x34]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x14003cc7a
mov eax, dword [rbp + 0x34]
movzx ecx, word [rbp - 0x60]
cmp ecx, 0x17
je 0x14003cc8a
cmp ecx, 2
jne 0x14003ccc8
cmp eax, 0xf
jbe 0x14003cce2
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x14003ccd8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x14003cccf
cmp eax, 0x1b
jbe 0x14003ccfa
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov edx, dword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x24], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rbp + 0x22]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rbp + 0x32]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x14003ccd8
lea rax, str.invalid_argument_
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb8
pop rsi
pop rbp
ret
lea rcx, [0x14009c67a]
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len___mem::size_of::_c::sockaddr_in___
mov edx, 0x39
call fcn.14008d600
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in6___
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len___mem::size_of::_c::sockaddr_in___
mov edx, 0x3a
call fcn.14008d600
int3
Function at 0x140044ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14004507a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140045070
cmp r11, r10
ja 0x1400450f6
cmp r10, rdx
ja 0x140045108
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140045072
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140045050
jmp 0x1400450d7
ja 0x14004507a
mov r11, r10
cmp rax, r8
jne 0x140045017
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x1400450db
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400450b0
mov r8, r10
sub ecx, r9d
jns 0x1400450ce
jmp 0x1400450dd
cmp r10, rdx
je 0x1400450ea
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400450dd
xor al, 1
cmp r8, rdx
jne 0x140045090
jmp 0x1400450dd
xor eax, eax
jmp 0x1400450dd
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14008d4c0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14008da20
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14008d9b0
int3

Function at 0x1400467e0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 8], 0
lea r9, [rbp - 8]
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rbp - 8]
test eax, eax
je 0x14004682b
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140046858
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x28]
call case.0x14002f09b.169
mov rcx, qword [rbp - 8]
call sub.ole32.dll_CoTaskMemFree
movups xmm0, xmmword [rbp - 0x28]
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x1400473c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, dword [rcx + 0x5c]
movsxd rdx, dword [rcx + 0x60]
test rdx, rdx
jle 0x14004744a
movzx r9d, al
mov r8d, dword [rcx + 0x288]
cmp edx, 1
je 0x140047425
mov r10d, edx
and r10d, 0x7ffffffe
lea r11, [0x1400eb0a0]
nop
mov esi, r8d
shl esi, 8
shr r8d, 0x18
xor r8d, r9d
xor esi, dword [r11 + r8*4]
mov dword [rcx + 0x288], esi
mov r8d, esi
shl r8d, 8
shr esi, 0x18
xor esi, r9d
xor r8d, dword [r11 + rsi*4]
mov dword [rcx + 0x288], r8d
add r10d, 0xfffffffe
jne 0x1400473f0
test dl, 1
je 0x14004744a
mov r10d, r8d
shl r10d, 8
shr r8d, 0x18
xor r8d, r9d
lea r9, [0x1400eb0a0]
xor r10d, dword [r9 + r8*4]
mov dword [rcx + 0x288], r10d
mov byte [rcx + rax + 0x80], 1
cmp edx, 3
je 0x140047484
cmp edx, 2
je 0x140047472
cmp edx, 1
jne 0x1400474ba
lea rdx, [rcx + 0x40]
mov r8d, dword [rcx + 0x6c]
add rcx, 0x6c
jmp 0x140047523
lea rdx, [rcx + 0x40]
mov r8, qword [rcx + 0x40]
movsxd r9, dword [rcx + 0x6c]
mov byte [r8 + r9], al
jmp 0x1400474a9
lea rdx, [rcx + 0x40]
mov r8, qword [rcx + 0x40]
movsxd r9, dword [rcx + 0x6c]
mov byte [r8 + r9], al
movsxd r8, dword [rcx + 0x6c]
lea r9, [r8 + 1]
mov dword [rcx + 0x6c], r9d
mov r9, qword [rcx + 0x40]
mov byte [r9 + r8 + 1], al
mov r8d, dword [rcx + 0x6c]
inc r8d
mov dword [rcx + 0x6c], r8d
add rcx, 0x6c
jmp 0x140047523
mov byte [rdx + rcx + 0x7c], 1
lea rdx, [rcx + 0x40]
mov r8, qword [rcx + 0x40]
movsxd r9, dword [rcx + 0x6c]
mov byte [r8 + r9], al
movsxd r8, dword [rcx + 0x6c]
lea r9, [r8 + 1]
mov dword [rcx + 0x6c], r9d
mov r9, qword [rcx + 0x40]
mov byte [r9 + r8 + 1], al
movsxd r8, dword [rcx + 0x6c]
lea r9, [r8 + 1]
mov dword [rcx + 0x6c], r9d
mov r9, qword [rcx + 0x40]
mov byte [r9 + r8 + 1], al
movsxd r8, dword [rcx + 0x6c]
lea r9, [r8 + 1]
mov dword [rcx + 0x6c], r9d
mov r9, qword [rcx + 0x40]
mov byte [r9 + r8 + 1], al
mov r8d, dword [rcx + 0x6c]
inc r8d
mov dword [rcx + 0x6c], r8d
movzx eax, byte [rcx + 0x60]
add rcx, 0x6c
add al, 0xfc
mov rdx, qword [rdx]
movsxd r8, r8d
mov byte [rdx + r8], al
inc dword [rcx]
pop rsi
ret
Function at 0x140051700
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov r15, rdx
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rsi
call fcn.140051990
mov ecx, dword [rsp + 0x28]
cmp ecx, 2
jne 0x140051741
mov rdx, qword [rsp + 0x30]
mov eax, 1
jmp 0x140051909
mov eax, 1
test ecx, ecx
je 0x14005187f
mov rdx, qword [rsi + 0x60]
mov r14, qword [rsi + 0x68]
cmp r14, rdx
jne 0x1400518b9
mov rdi, qword [rsp + 0x30]
mov ebp, edi
shr rdi, 0x20
cmp r12, rdi
cmovb rdi, r12
mov r13d, dword [rsp + 0x2c]
lea r12, [rdi + r13]
add rbp, r12
sub rbp, r14
jbe 0x1400517c6
mov rax, qword [rsi + 0x50]
sub rax, r14
cmp rax, rbp
jb 0x14005191a
mov rbx, qword [rsi + 0x58]
lea rcx, [rbx + r14]
cmp rbp, 2
jb 0x1400517b7
lea r8, [rbp - 1]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add r14, rbp
dec r14
add rbx, r14
mov rcx, rbx
lea rbx, [rsp + 0x28]
mov byte [rcx], 0
inc r14
mov qword [rsi + 0x60], r14
cmp r12, r14
ja 0x140051953
mov rcx, qword [rsi + 0x58]
add rcx, r13
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsi + 0x60]
cmp rdx, r13
jb 0x140051965
cmp rdx, r12
jb 0x140051974
mov rax, qword [rsi + 0x58]
lea rcx, [rax + r13]
sub edx, r12d
add r12, rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x2c], 7
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x4c], 6
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
lea rcx, [rsi + 0xc8]
lea r8, [rsp + 0x68]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x14005188b
mov edx, eax
shl rdx, 0x20
or rdx, 2
jmp 0x140051737
movabs rdx, 0x8009031700000002
jmp 0x140051909
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
mov rdx, qword [rsi + 0x60]
cmp rdx, rax
jb 0x1400518a7
mov qword [rsi + 0x60], rax
mov rdx, rax
mov qword [rsi + 0x68], 0
mov qword [rsi + 0xf0], rdi
xor r14d, r14d
cmp r14, rdx
je 0x140051900
lea rdi, [rsi + 0xc0]
nop word cs:[rax + rax]
mov r8, rdx
sub r8, r14
jb 0x140051944
mov rdx, qword [rsi + 0x58]
add rdx, r14
mov rcx, rdi
call fcn.140032450
test rax, rax
jne 0x140051737
add r14, rdx
mov qword [rsi + 0x68], r14
mov rdx, qword [rsi + 0x60]
cmp r14, rdx
jne 0x1400518d0
mov rdx, qword [rsi + 0xf0]
xor eax, eax
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsi + 0x50]
mov rdx, r14
mov r8, rbp
call fcn.14008c090
mov r14, qword [rsi + 0x60]
mov rbx, qword [rsi + 0x58]
lea rcx, [rbx + r14]
cmp rbp, 2
jae 0x1400517a0
jmp 0x1400517b7
lea r8, [0x1400a2188]
mov rcx, r14
call fcn.14008d940
lea r8, [0x1400a20e8]
mov rcx, r12
mov rdx, r14
call fcn.14008d9b0
lea r8, [0x1400a2100]
mov rcx, r13
call fcn.14008d9b0
lea r8, [0x1400a2118]
mov rcx, r12
call fcn.14008d9b0
int3
Function at 0x140056410
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
mov rax, rcx
add qword [rcx + 0x30], 8
mov qword [rsp], rdx
mov r10, qword [rcx + 0x40]
test r10, r10
je 0x1400564b3
mov esi, 8
mov r9d, 8
sub r9, r10
cmp r9, 8
cmovb rsi, r9
xor r11d, r11d
xor r8d, r8d
cmp r9, 4
mov ecx, edx
cmovae r11, rcx
setae r8b
shl r8d, 2
lea rcx, [r8 + 1]
cmp rcx, rsi
jae 0x14005647a
movzx edx, word [rsp + r8]
lea ecx, [r8*8]
shl rdx, cl
or r11, rdx
or r8, 2
cmp r8, rsi
jae 0x140056491
movzx edx, byte [rsp + r8]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r11, rdx
lea ecx, [r10*8]
shl r11, cl
or r11, qword [rax + 0x38]
mov qword [rax + 0x38], r11
cmp r10, 8
jbe 0x1400564b8
add r10, 8
jmp 0x1400565f6
xor r9d, r9d
jmp 0x14005650c
mov r8, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, rdx
rol rdx, 0xd
xor r8, r11
xor rdx, rcx
rol rcx, 0x20
mov r10, qword [rax + 8]
add r10, r8
rol r8, 0x10
xor r8, r10
add rcx, r8
rol r8, 0x15
xor r8, rcx
add r10, rdx
rol rdx, 0x11
mov qword [rax + 0x18], r8
xor rdx, r10
rol r10, 0x20
mov qword [rax + 0x10], rdx
mov qword [rax + 8], r10
xor rcx, r11
mov qword [rax], rcx
mov ecx, 8
sub rcx, r9
mov r10d, ecx
and r10d, 7
and rcx, 0xfffffffffffffff8
cmp r9, rcx
jae 0x140056592
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rsi, qword [rax + 0x18]
mov r11, qword [rax + 0x10]
nop word cs:[rax + rax]
add rdx, r11
rol r11, 0xd
mov rdi, qword [rsp + r9]
xor r11, rdx
rol rdx, 0x20
xor rsi, rdi
add r8, rsi
rol rsi, 0x10
xor rsi, r8
add rdx, rsi
rol rsi, 0x15
add r8, r11
rol r11, 0x11
xor r11, r8
rol r8, 0x20
xor rsi, rdx
xor rdx, rdi
add r9, 8
cmp r9, rcx
jb 0x140056540
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], r11
mov qword [rax + 8], r8
mov qword [rax], rdx
cmp r10d, 4
jb 0x1400565af
mov r8d, dword [rsp + r9]
mov edx, 4
mov rcx, rdx
or rcx, 1
cmp rcx, r10
jb 0x1400565c0
jmp 0x1400565da
xor r8d, r8d
xor edx, edx
mov rcx, rdx
or rcx, 1
cmp rcx, r10
jae 0x1400565da
lea rcx, [rsp + rdx]
movzx r11d, word [r9 + rcx]
lea ecx, [rdx*8]
shl r11, cl
or r8, r11
or rdx, 2
cmp rdx, r10
jae 0x1400565f2
add r9, rdx
movzx r9d, byte [rsp + r9]
shl edx, 3
mov ecx, edx
shl r9, cl
or r8, r9
mov qword [rax + 0x38], r8
mov qword [rax + 0x40], r10
add rsp, 8
pop rdi
pop rsi
ret