joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006dd90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18006ddb0
test al, 1
je 0x18006df82
test al, 2
jne 0x18006df82
test al, 8
jne 0x18006ded6
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18006de2d
xorps xmm6, xmm6
test eax, eax
jne 0x18006de59
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1800defa0]
call fcn.1800d1c10
mov byte [rbx + 0x110], 1
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.18006ce30
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18006deba
test eax, eax
jne 0x18006def4
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1800defa0]
call fcn.1800d1c10
mov byte [rdi + 0x110], 1
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x18006def4
test al, 0x10
je 0x18006def4
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x18006df82
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e5360
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18006df82
jne 0x18006df75
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18006df36
call fcn.1800050f0
lea rcx, [rsi + 0x30]
call fcn.18006ce30
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x18006df55
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180168b78]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x180071ee0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180071ef0
test al, 1
je 0x180071f7d
test al, 2
jne 0x180071f7d
test al, 8
jne 0x180071f22
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.180071d40
jmp 0x180071f36
test al, 0x10
je 0x180071f36
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x180071f7d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e62f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180071f7d
jne 0x180071f76
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.180071f90
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x1800724b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800724c0
test al, 1
je 0x18007254d
test al, 2
jne 0x18007254d
test al, 8
jne 0x1800724f2
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.180071d40
jmp 0x180072506
test al, 0x10
je 0x180072506
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18007254d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e5360
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18007254d
jne 0x180072546
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.180072560
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800890d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800890e0
test al, 1
je 0x18008916a
test al, 2
jne 0x18008916a
test al, 8
jne 0x18008910f
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.180088f30
jmp 0x180089123
test al, 0x10
je 0x180089123
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x18008916a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e62f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008916a
jne 0x180089163
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.180089170
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x180089670
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180089680
test al, 1
je 0x18008970a
test al, 2
jne 0x18008970a
test al, 8
jne 0x1800896af
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.180088f30
jmp 0x1800896c3
test al, 0x10
je 0x1800896c3
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x18008970a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e5360
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008970a
jne 0x180089703
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.180089710
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x18008e550
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008e570
test al, 1
je 0x18008e742
test al, 2
jne 0x18008e742
test al, 8
jne 0x18008e696
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008e5ed
xorps xmm6, xmm6
test eax, eax
jne 0x18008e619
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1800defa0]
call fcn.1800d1c10
mov byte [rbx + 0x110], 1
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.18008e490
mov qword [rsi + 0x30], 3
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008e67a
test eax, eax
jne 0x18008e6b4
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1800defa0]
call fcn.1800d1c10
mov byte [rdi + 0x110], 1
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x18008e6b4
test al, 0x10
je 0x18008e6b4
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x18008e742
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e62f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008e742
jne 0x18008e735
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18008e6f6
call fcn.18005c200
lea rcx, [rsi + 0x30]
call fcn.18008e490
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x18008e715
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180168b78]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x18008f3c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008f3e0
test al, 1
je 0x18008f5b2
test al, 2
jne 0x18008f5b2
test al, 8
jne 0x18008f506
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008f45d
xorps xmm6, xmm6
test eax, eax
jne 0x18008f489
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1800defa0]
call fcn.1800d1c10
mov byte [rbx + 0x110], 1
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.18008e490
mov qword [rsi + 0x30], 3
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008f4ea
test eax, eax
jne 0x18008f524
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1800defa0]
call fcn.1800d1c10
mov byte [rdi + 0x110], 1
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x18008f524
test al, 0x10
je 0x18008f524
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x18008f5b2
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e5360
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008f5b2
jne 0x18008f5a5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18008f566
call fcn.1800050f0
lea rcx, [rsi + 0x30]
call fcn.18008e490
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x18008f585
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180168b78]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x180094960
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180094970
test al, 1
je 0x180094a12
test al, 2
jne 0x180094a12
test al, 8
jne 0x1800949ab
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.180095010
jmp 0x1800949c5
test al, 0x10
je 0x1800949c5
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x180094a12
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e62f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180094a12
jne 0x180094a08
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.180094a20
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800951b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800951c0
test al, 1
je 0x180095262
test al, 2
jne 0x180095262
test al, 8
jne 0x1800951fb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.180095010
jmp 0x180095215
test al, 0x10
je 0x180095215
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x180095262
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e5360
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180095262
jne 0x180095258
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.180095270
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800a6740
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a6750
test al, 1
je 0x1800a67f2
test al, 2
jne 0x1800a67f2
test al, 8
jne 0x1800a678b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800a65b0
jmp 0x1800a67a5
test al, 0x10
je 0x1800a67a5
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800a67f2
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e62f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a67f2
jne 0x1800a67e8
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800a6800
nop
add rsp, 0xfa0
pop rsi
ret
ud2

Function at 0x1800a6d30
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a6d40
test al, 1
je 0x1800a6de2
test al, 2
jne 0x1800a6de2
test al, 8
jne 0x1800a6d7b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800a65b0
jmp 0x1800a6d95
test al, 0x10
je 0x1800a6d95
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800a6de2
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e5360
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a6de2
jne 0x1800a6dd8
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800a6df0
nop
add rsp, 0xfa0
pop rsi
ret
ud2
Function at 0x1800ae150
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800ae192
mov rdi, qword [rsp + 0x28]
je 0x1800ae1ff
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800ae272
test rax, rax
je 0x1800ae272
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800ae1e8
cmp qword [rdi + 0x10], 0x11
jb 0x1800ae1d6
mov r14, qword [r14 - 8]
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x180168b78]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1800ae272
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800ae255
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800ae233
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800ae246
mov rcx, rax
mov qword [0x180168b78], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800ae25b
mov ecx, 1
mov rdx, rbx
call fcn.180103b10
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.1800f64f0
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800b00f0
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x198]
cmp rax, qword [rdx + 0x190]
ja 0x1800b03ac
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x180]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0x1c0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1800b0263
cmp eax, 0x80090318
je 0x1800b02e5
test eax, eax
jne 0x1800b0303
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x180]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x170], 0
add rcx, rbx
jb 0x1800b03ac
cmp rcx, qword [rdi + 0x190]
ja 0x1800b03ac
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x168], rbx
jb 0x1800b038f
xor r12d, r12d
mov rcx, qword [rdi + 0x160]
add rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.1800f64f0
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x170], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x178], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r15
jb 0x1800b03ac
test r15, r15
je 0x1800b0331
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x1800b03ac
mov qword [rdi + 0x190], 0
cmp rax, r15
jne 0x1800b0313
cmp rcx, rdx
jne 0x1800b032a
jmp 0x1800b0331
cmp eax, 0x90317
je 0x1800b02fd
cmp eax, 0x90321
jne 0x1800b0303
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x140], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x144], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r14
jb 0x1800b03ac
test r14, r14
je 0x1800b0367
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x1800b03ac
mov qword [rdi + 0x190], 0
cmp rax, r14
jne 0x1800b0349
cmp rcx, rdx
jne 0x1800b0360
jmp 0x1800b0367
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x1f8], rax
jmp 0x1800b0379
mov byte [rsi + 1], 1
jmp 0x1800b037d
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1800b037f
cmp rcx, rdx
je 0x1800b0331
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call fcn.1800f64f0
mov qword [rdi + 0x190], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x198], r15
mov qword [rdi + 0x1f8], rax
jmp 0x1800b0379
cmp rcx, rdx
je 0x1800b0367
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call fcn.1800f64f0
mov qword [rdi + 0x190], rbx
mov qword [rdi + 0x198], r14
mov qword [rdi + 0x1f8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x160]
xor edx, edx
mov r8, rbx
call fcn.180105950
mov r12, qword [rdi + 0x170]
jmp 0x1800b01dd
ud2
Function at 0x1800b2140
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x98]
cmp rax, qword [rdx + 0x90]
ja 0x1800b23e1
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x80]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0xc0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1800b22a4
cmp eax, 0x80090318
je 0x1800b2320
test eax, eax
jne 0x1800b233e
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x80]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x70], 0
add rcx, rbx
jb 0x1800b23e1
cmp rcx, qword [rdi + 0x90]
ja 0x1800b23e1
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x68], rbx
jb 0x1800b23ca
xor r12d, r12d
mov rcx, qword [rdi + 0x60]
add rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.1800f64f0
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x70], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x78], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r15
jb 0x1800b23e1
test r15, r15
je 0x1800b236c
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x1800b23e1
mov qword [rdi + 0x90], 0
cmp rax, r15
jne 0x1800b234e
cmp rcx, rdx
jne 0x1800b2365
jmp 0x1800b236c
cmp eax, 0x90317
je 0x1800b2338
cmp eax, 0x90321
jne 0x1800b233e
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x40], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x44], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r14
jb 0x1800b23e1
test r14, r14
je 0x1800b23a2
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x1800b23e1
mov qword [rdi + 0x90], 0
cmp rax, r14
jne 0x1800b2384
cmp rcx, rdx
jne 0x1800b239b
jmp 0x1800b23a2
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0xf8], rax
jmp 0x1800b23b4
mov byte [rsi + 1], 1
jmp 0x1800b23b8
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1800b23ba
cmp rcx, rdx
je 0x1800b236c
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.1800f64f0
mov qword [rdi + 0x90], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x98], r15
mov qword [rdi + 0xf8], rax
jmp 0x1800b23b4
cmp rcx, rdx
je 0x1800b23a2
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.1800f64f0
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x98], r14
mov qword [rdi + 0xf8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x60]
xor edx, edx
mov r8, rbx
call fcn.180105950
mov r12, qword [rdi + 0x70]
jmp 0x1800b2227
ud2
Function at 0x1800b25d0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xc0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800b2612
mov rdi, qword [rsp + 0x28]
je 0x1800b267f
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800b26f2
test rax, rax
je 0x1800b26f2
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800b2668
cmp qword [rdi + 0x10], 0x11
jb 0x1800b2656
mov r14, qword [r14 - 8]
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x180168b78]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1800b26f2
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800b26d5
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800b26b3
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800b26c6
mov rcx, rax
mov qword [0x180168b78], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800b26db
mov ecx, 1
mov rdx, rbx
call fcn.180103b10
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.1800f64f0
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800c8fd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x2c0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800c8fe0
test al, 1
je 0x1800c9082
test al, 2
jne 0x1800c9082
test al, 8
jne 0x1800c901b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800c8e40
jmp 0x1800c9035
test al, 0x10
je 0x1800c9035
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800c9082
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e62f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800c9082
jne 0x1800c9078
mov rcx, rsi
add rsp, 0x2c0
pop rsi
jmp fcn.1800c9090
nop
add rsp, 0x2c0
pop rsi
ret
ud2

Function at 0x1800c9a80
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x2c0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800c9a90
test al, 1
je 0x1800c9b32
test al, 2
jne 0x1800c9b32
test al, 8
jne 0x1800c9acb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800c8e40
jmp 0x1800c9ae5
test al, 0x10
je 0x1800c9ae5
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800c9b32
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e5360
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800c9b32
jne 0x1800c9b28
mov rcx, rsi
add rsp, 0x2c0
pop rsi
jmp fcn.1800c9b40
nop
add rsp, 0x2c0
pop rsi
ret
ud2