joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400201b0
cmp r11, r10
ja 0x140020226
cmp r10, rdx
ja 0x140020238
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400201b2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140020190
jmp 0x140020214
ja 0x1400201ba
mov r11, r10
cmp rax, r8
jne 0x140020154
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400201f0
mov rdi, r8
sub ecx, edx
jns 0x14002020b
jmp 0x140020216
cmp r8, rsi
je 0x140020247
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140020216
xor al, 1
cmp rdi, rsi
jne 0x1400201d0
jmp 0x140020216
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001bb10
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001b0d0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14001e660
int3
Function at 0x14002c0ff
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14002c135
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14002c13d
mov esi, dword [rdx]
mov r9d, 4
jmp 0x14002c142
xor r10d, r10d
jmp 0x14002c1f0
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14002c165
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14002c17c
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14002c19c
add r11, r8
jmp 0x14002c2c0
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14002c264
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14002c212
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14002c276
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x14002c27c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14002c2a2
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14002c2bc
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002c2c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14002c37a
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
movabs r8, 0x736f6d6570736575
xor r8, rax
movabs r9, 0x646f72616e646f6d
xor r9, rdx
movabs r10, 0x6c7967656e657261
xor r10, rax
movabs r11, 0x7465646279746573
xor r11, rdx
lea rcx, [rsp + 0x30]
mov qword [rcx], r8
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], r9
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
mov qword [rcx + 0x40], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
call fcn.14002c0ff
test rdi, rdi
je 0x14002c3f3
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14002c40a
movabs rcx, 0x100000001b3
mov rdx, qword [rsi]
xor eax, eax
test rdx, rdx
setne al
mov qword [rsp + 0x30], rax
movabs rax, 0xcbf29ce484222325
xor r8d, r8d
movzx r9d, byte [rsp + r8 + 0x30]
inc r8
xor rax, r9
imul rax, rcx
cmp r8, 8
jne 0x14002c3a1
test rdx, rdx
je 0x14002c4ff
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x14002c520
mov r8, qword [rsi + 8]
xor r9d, r9d
mov r10, rax
movzx eax, byte [r8 + r9]
xor rax, r10
imul rax, rcx
inc r9
mov r10, rax
cmp rdx, r9
jne 0x14002c3d7
jmp 0x14002c520
movzx eax, byte [rsi + 8]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rcx, [rsp + 0x30]
mov r8d, 8
call fcn.14002c0ff
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14002c520
movzx edx, byte [rsi + 8]
mov qword [rsp + 0x30], rdx
xor edx, edx
movzx r8d, byte [rsp + rdx + 0x30]
inc rdx
xor rax, r8
imul rax, rcx
cmp rdx, 8
jne 0x14002c50a
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14004fbeb
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdx + 0x20]
lea rcx, [rax - 2]
cmp rcx, 2
jae 0x14004fc25
cmp qword [rsi], 0
je 0x14004fcf2
mov rax, qword [rsi + 8]
mov rdx, qword [rax]
and edx, 0xe
or rdx, 1
jmp 0x14004fcf7
test rax, rax
jne 0x14004fccb
mov rbx, qword [rsi]
xor r14d, r14d
test rbx, rbx
je 0x14004fc45
mov rax, qword [rsi + 8]
mov rdx, qword [rax]
and edx, 0xe
jmp 0x14004fc47
xor edx, edx
mov rcx, rsi
call fcn.14004fd08
mov rdi, qword [rdi]
lea rax, [rdi + 8]
lea rdx, [rsp + 0x48]
mov dword [rdx], r14d
lea rcx, [0x14018ced8]
mov qword [rdx + 8], rcx
lea r8, [rsp + 0x40]
mov dword [r8], r14d
lea r9, [rsp + 0x44]
mov dword [r9], r14d
mov rcx, qword [rdi]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x30], 0
mov r8d, 1
call sub.ws2_32.dll_WSARecv
cmp eax, 0xffffffff
je 0x14004fcaf
cmp byte [rsi + 0x78], 0
je 0x14004fcbb
mov qword [rsi + 0x20], 2
jmp 0x14004fce9
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jne 0x14004fcd5
mov qword [rsi + 0x20], 1
lock inc qword [rdi + 0xe8]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 0x20], 3
mov qword [rsi + 0x28], rax
test rbx, rbx
jne 0x14004fc12
mov edx, 1
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14004fd08
Function at 0x140050a46
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140050a72
xor eax, eax
jmp 0x140050a7f
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x140051779
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400517af
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400517b7
mov esi, dword [rdx]
mov r9d, 4
jmp 0x1400517bc
xor r10d, r10d
jmp 0x14005186a
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400517df
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400517f6
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140051816
add r11, r8
jmp 0x14005193a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400518de
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14005188c
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400518f0
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x1400518f6
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14005191c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140051936
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005ef67
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x1a8]
mov rdx, qword [rdx + 0x1a0]
cmp rdx, rcx
jb 0x14005f123
mov rax, qword [rdi + 0x198]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x220]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x14005f096
cmp eax, 0x80090318
je 0x14005f0f7
test eax, eax
jne 0x14005f0e7
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x198]
mov rax, qword [rdi + 0x1a0]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x180], 0
add r9, r8
jb 0x14005f12f
cmp rax, r9
jb 0x14005f13e
lea rax, [rdi + 0x170]
add rdx, rcx
add r8, rdx
mov rcx, rax
call fcn.140012f88
mov qword [rdi + 0x188], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1a8]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14005eece
xor eax, eax
cmp qword [rdi + 0x1a8], 0
sete al
mov qword [rdi + 0x240], rax
mov byte [rsi + 1], 0
jmp 0x14005f119
cmp eax, 0x90317
je 0x14005f113
cmp eax, 0x90321
jne 0x14005f0e7
mov dword [rdi + 0x200], 0x10000
xor ebx, ebx
mov byte [rdi + 0x204], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1a8]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14005eece
mov qword [rdi + 0x240], 0
mov byte [rsi + 1], bl
jmp 0x14005f119
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x14005f119
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x240], rax
mov byte [rsi + 1], 0
jmp 0x14005f117
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x14015d858]
call fcn.14001b0d0
lea r8, [0x14015d870]
mov rdx, r9
call fcn.14001bb10
lea r8, [0x14015d870]
mov rcx, r9
mov rdx, rax
call fcn.14001b0d0
int3
Function at 0x1400600ed
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0xa8]
mov rdx, qword [rdx + 0xa0]
cmp rdx, rcx
jb 0x1400602a6
mov rax, qword [rdi + 0x98]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x120]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x140060219
cmp eax, 0x80090318
je 0x14006027a
test eax, eax
jne 0x14006026a
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x98]
mov rax, qword [rdi + 0xa0]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x80], 0
add r9, r8
jb 0x1400602b2
cmp rax, r9
jb 0x1400602c1
lea rax, [rdi + 0x70]
add rdx, rcx
add r8, rdx
mov rcx, rax
call fcn.140012f88
mov qword [rdi + 0x88], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xa8]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1400602d4
xor eax, eax
cmp qword [rdi + 0xa8], 0
sete al
mov qword [rdi + 0x140], rax
mov byte [rsi + 1], 0
jmp 0x14006029c
cmp eax, 0x90317
je 0x140060296
cmp eax, 0x90321
jne 0x14006026a
mov dword [rdi + 0x100], 0x10000
xor ebx, ebx
mov byte [rdi + 0x104], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xa8]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1400602d4
mov qword [rdi + 0x140], 0
mov byte [rsi + 1], bl
jmp 0x14006029c
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x14006029c
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x140], rax
mov byte [rsi + 1], 0
jmp 0x14006029a
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x14015d858]
call fcn.14001b0d0
lea r8, [0x14015d870]
mov rdx, r9
call fcn.14001bb10
lea r8, [0x14015d870]
mov rcx, r9
mov rdx, rax
call fcn.14001b0d0
int3
Function at 0x1400604fe
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, r9
mov r12, r8
mov rdi, rdx
mov rsi, rcx
lea r14, [rsp + 0x28]
mov rcx, r14
call fcn.14005f2f3
mov eax, dword [r14]
cmp eax, 2
je 0x14006068e
test eax, eax
je 0x14006063e
mov rbp, qword [rdi + 0xc8]
cmp rbp, qword [rdi + 0xc0]
jne 0x140060678
mov rbx, qword [rsp + 0x30]
mov edx, ebx
shr rbx, 0x20
cmp r15, rbx
cmovb rbx, r15
mov r13d, dword [rsp + 0x2c]
lea r15, [rbx + r13]
add rdx, r15
cmp rbp, rdx
jae 0x140060585
lea rcx, [rdi + 0xb0]
call fcn.140013039
mov rbp, qword [rdi + 0xc0]
cmp rbp, r15
jb 0x1400606bf
mov rcx, qword [rdi + 0xb8]
add rcx, r13
mov rdx, r12
mov r8, rbx
call sub.msvcrt.dll_memcpy
cmp rbp, r13
jb 0x1400606cb
mov rdx, qword [rdi + 0xc0]
cmp rdx, r15
jb 0x1400606dd
mov rax, qword [rdi + 0xb8]
lea rcx, [rax + r13]
sub edx, r15d
add r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x2c], 7
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x4c], 6
mov qword [rsp + 0x50], r15
movabs rax, 0x400000000
lea r8, [rsp + 0x68]
mov qword [r8], rax
mov qword [r8 + 8], r14
lea rcx, [rdi + 0x120]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x14006064a
shl rax, 0x20
or rax, 2
jmp 0x140060693
movabs rax, 0x8009031700000002
jmp 0x140060693
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rdi + 0xc0], rax
jb 0x140060666
mov qword [rdi + 0xc0], rax
mov qword [rdi + 0xc8], 0
mov qword [rdi + 0x148], rbx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.14006036d
cmp qword [rbx], 0
je 0x1400606b0
mov rax, qword [rsp + 0x30]
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdi + 0x148]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14006069c
lea r8, [0x14015d888]
mov rcx, r15
jmp 0x1400606d5
lea r8, [0x14015d8a0]
mov rcx, r13
mov rdx, rbp
call fcn.14001b0d0
lea r8, [0x14015d8b8]
mov rcx, r15
call fcn.14001b0d0
int3
Function at 0x140060737
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, r9
mov r12, r8
mov rdi, rdx
mov rsi, rcx
lea r14, [rsp + 0x28]
mov rcx, r14
call fcn.14005df0b
mov eax, dword [r14]
cmp eax, 2
je 0x1400608c7
test eax, eax
je 0x140060877
mov rbp, qword [rdi + 0x1c8]
cmp rbp, qword [rdi + 0x1c0]
jne 0x1400608b1
mov rbx, qword [rsp + 0x30]
mov edx, ebx
shr rbx, 0x20
cmp r15, rbx
cmovb rbx, r15
mov r13d, dword [rsp + 0x2c]
lea r15, [rbx + r13]
add rdx, r15
cmp rbp, rdx
jae 0x1400607be
lea rcx, [rdi + 0x1b0]
call fcn.140013039
mov rbp, qword [rdi + 0x1c0]
cmp rbp, r15
jb 0x1400608f8
mov rcx, qword [rdi + 0x1b8]
add rcx, r13
mov rdx, r12
mov r8, rbx
call sub.msvcrt.dll_memcpy
cmp rbp, r13
jb 0x140060904
mov rdx, qword [rdi + 0x1c0]
cmp rdx, r15
jb 0x140060916
mov rax, qword [rdi + 0x1b8]
lea rcx, [rax + r13]
sub edx, r15d
add r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x2c], 7
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x4c], 6
mov qword [rsp + 0x50], r15
movabs rax, 0x400000000
lea r8, [rsp + 0x68]
mov qword [r8], rax
mov qword [r8 + 8], r14
lea rcx, [rdi + 0x220]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x140060883
shl rax, 0x20
or rax, 2
jmp 0x1400608cc
movabs rax, 0x8009031700000002
jmp 0x1400608cc
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rdi + 0x1c0], rax
jb 0x14006089f
mov qword [rdi + 0x1c0], rax
mov qword [rdi + 0x1c8], 0
mov qword [rdi + 0x248], rbx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.14005eba5
cmp qword [rbx], 0
je 0x1400608e9
mov rax, qword [rsp + 0x30]
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdi + 0x248]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400608d5
lea r8, [0x14015d888]
mov rcx, r15
jmp 0x14006090e
lea r8, [0x14015d8a0]
mov rcx, r13
mov rdx, rbp
call fcn.14001b0d0
lea r8, [0x14015d8b8]
mov rcx, r15
call fcn.14001b0d0
int3
Function at 0x140064647
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
mov rbx, rdx
mov qword [rsp + 0x48], rcx
movzx eax, byte [rdx + 0x1e1]
test eax, eax
mov qword [rsp + 0x50], r8
je 0x140064698
cmp eax, 3
jne case.default.0x140064696
mov r12, r8
lea r13, [rbx + 0xc0]
movzx eax, byte [rbx + 0xf8]
lea rcx, [0x14010366c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rbx + 0x1c8]
mov qword [rbx + 0x1a0], rax
movups xmm0, xmmword [rbx + 0x1d0]
movups xmmword [rbx + 0x1a8], xmm0
mov cl, byte [rbx + 0x1e2]
mov byte [rbx + 0x1e0], cl
mov qword [rbx + 0x1b8], 0
mov qword [rbx + 0x1c0], rax
xor r12d, r12d
jmp 0x1400646ef
lea rcx, str._async_fn__resumed_after_completion_root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_http_0.2.11_src_header_value.rsunable_to_find_any_user_specified_roots_in_the_final_cert_chainbytes_remaining_on_streamOut_of_bounds_accesspolling_StreamFuture_twice_root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_futures_util_0.3.30_src_stream_stream_into_future.rs
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_hyper_0.13.10_src_client_connect_http.rs
Function at 0x1400a3d3a
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rbx, rdx
mov rsi, rcx
lea r14, [rsp + 0x38]
mov qword [r14], r8
add r8, 0xb
mov qword [r14 + 8], r8
mov word [r14 + 0x10], 0
mov dword [r14 + 0x18], 1
lea r12, [rsp + 0x58]
mov rcx, r12
mov rdx, r14
call fcn.1400fd28f
lea r13, [rsp + 0x30]
mov dword [r13], 0x800
lea r15, [rsp + 0x34]
mov dword [r15], 0
mov ecx, 0x800
call fcn.1400f4dd8
mov rdi, rdx
mov qword [r14], rax
mov qword [r14 + 8], rdx
mov qword [r14 + 0x10], 0
mov r12, qword [r12 + 8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, r12
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400a3e00
mov r8d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
sub rax, rdx
cmp rax, r8
jae 0x1400a3db8
mov rcx, r14
call fcn.1400ad3df
mov rdi, qword [rsp + 0x40]
jmp 0x1400a3db8
test eax, eax
jne 0x1400a3e22
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x1400a3e56
movabs rax, 0xde00000002
jmp 0x1400a3e2a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0x38], 0
je 0x1400a3e6a
mov rcx, qword [0x14019e0f8]
xor edx, edx
mov r8, rdi
call fcn.1400fdef8
jmp 0x1400a3e6a
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x58], 0
je 0x1400a3e85
mov r8, qword [rsp + 0x60]
mov rcx, qword [0x14019e0f8]
xor edx, edx
call fcn.1400fdef8
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400aa3b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.14001a940
cmp rax, rcx
je 0x1400aa3d5
cmp rdx, 4
jae 0x1400aa3d8
xor eax, eax
xor r8d, r8d
jmp 0x1400aa470
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140103d90]
movdqa xmm3, xmmword [0x140103da0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400aa400
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400aa487
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400aa470
ret