joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140040680
cmp r11, r10
ja 0x1400406f7
cmp r10, rdx
ja 0x140040709
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140040682
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140040660
jmp 0x1400406e4
ja 0x14004068a
mov r11, r10
cmp rax, r8
jne 0x14004062e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400406c0
mov rdi, r8
sub ecx, edx
jns 0x1400406db
jmp 0x1400406e6
cmp r8, rsi
je 0x140040718
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400406e6
xor al, 1
cmp rdi, rsi
jne 0x1400406a0
jmp 0x1400406e6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140104ad0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140104890
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140104c30
int3
Function at 0x14004d4ea
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14004d59c
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
movabs r8, 0x736f6d6570736575
xor r8, rax
movabs r9, 0x646f72616e646f6d
xor r9, rdx
movabs r10, 0x6c7967656e657261
xor r10, rax
movabs r11, 0x7465646279746573
xor r11, rdx
lea rcx, [rsp + 0x30]
mov qword [rcx], r8
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], r9
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
mov qword [rcx + 0x40], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
call fcn.1400328f5
test rdi, rdi
je 0x14004d615
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14004d62c
movabs rcx, 0x100000001b3
mov rdx, qword [rsi]
xor eax, eax
test rdx, rdx
setne al
mov qword [rsp + 0x30], rax
movabs rax, 0xcbf29ce484222325
xor r8d, r8d
movzx r9d, byte [rsp + r8 + 0x30]
inc r8
xor rax, r9
imul rax, rcx
cmp r8, 8
jne 0x14004d5c3
test rdx, rdx
je 0x14004d721
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x14004d742
mov r8, qword [rsi + 8]
xor r9d, r9d
mov r10, rax
movzx eax, byte [r8 + r9]
xor rax, r10
imul rax, rcx
inc r9
mov r10, rax
cmp rdx, r9
jne 0x14004d5f9
jmp 0x14004d742
movzx eax, byte [rsi + 8]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rcx, [rsp + 0x30]
mov r8d, 8
call fcn.1400328f5
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14004d742
movzx edx, byte [rsi + 8]
mov qword [rsp + 0x30], rdx
xor edx, edx
movzx r8d, byte [rsp + rdx + 0x30]
inc rdx
xor rax, r8
imul rax, rcx
cmp rdx, 8
jne 0x14004d72c
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140067af2
Capabilities:
Encrypt data using speck
Parse credit card information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x238
movaps xmmword [rsp + 0x220], xmm6
mov qword [rsp + 0x58], rdx
mov r14, rcx
test r9, r9
je 0x140067c4f
lea rax, [r8 + r9]
xor edx, edx
movaps xmm0, xmmword [0x1401143b0]
mov rcx, r8

Function at 0x14006b52f
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
movaps xmmword [rsp + 0x210], xmm6
mov qword [rsp + 0x138], r9
mov word [rax + rdi], fs
add dword [rax], eax
add byte [rcx - 0x77], cl
invalid

Function at 0x1400700a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdx + 0x20]
lea rcx, [rax - 2]
cmp rcx, 2
jae 0x1400700da
cmp qword [rsi], 0
je 0x1400701a7
mov rax, qword [rsi + 8]
mov rdx, qword [rax]
and edx, 0xe
or rdx, 1
jmp 0x1400701ac
test rax, rax
jne 0x140070180
mov rbx, qword [rsi]
xor r14d, r14d
test rbx, rbx
je 0x1400700fa
mov rax, qword [rsi + 8]
mov rdx, qword [rax]
and edx, 0xe
jmp 0x1400700fc
xor edx, edx
mov rcx, rsi
call fcn.1400701bd
mov rdi, qword [rdi]
lea rax, [rdi + 8]
lea rdx, [rsp + 0x48]
mov dword [rdx], r14d
lea rcx, [0x14019e2d0]
mov qword [rdx + 8], rcx
lea r8, [rsp + 0x40]
mov dword [r8], r14d
lea r9, [rsp + 0x44]
mov dword [r9], r14d
mov rcx, qword [rdi]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x30], 0
mov r8d, 1
call sub.ws2_32.dll_WSARecv
cmp eax, 0xffffffff
je 0x140070164
cmp byte [rsi + 0x78], 0
je 0x140070170
mov qword [rsi + 0x20], 2
jmp 0x14007019e
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jne 0x14007018a
mov qword [rsi + 0x20], 1
lock inc qword [rdi + 0xe0]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 0x20], 3
mov qword [rsi + 0x28], rax
test rbx, rbx
jne 0x1400700c7
mov edx, 1
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400701bd
Function at 0x1400705a9
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r9
mov qword [rsp + 0x60], r8
mov r15, rdx
mov rbx, rcx
mov rax, qword [r9]
xor r14d, r14d
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400705e4
mov rax, qword [r12 + 8]
mov rdx, qword [rax]
and edx, 0xd
jmp 0x1400705e6
xor edx, edx
mov rcx, r12
call fcn.1400701bd
mov rsi, qword [rbx]
lea rdi, [rsi + 0x30]
mov rbx, qword [r15 + 8]
mov qword [rsp + 0x40], r15
mov rbp, qword [r15 + 0x10]
mov qword [rsp + 0x48], r12
mov r13b, byte [r12 + 0x78]
mov r15, qword [rsp + 0x60]
mov r12, rbp
sub r12, r15
jb 0x140070869
lea rax, [rbx + r15]
mov ecx, 0xffffffff
cmp r12, rcx
cmovb rcx, r12
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x54], r14d
mov rcx, qword [rsi]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x68]
mov r8d, 1
lea r9, [rsp + 0x54]
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x140070682
test r13b, r13b
je 0x1400706d1
mov eax, dword [rsp + 0x54]
cmp r12, rax
je 0x140070711
add r15, rax
jmp 0x140070611
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x3e5
je 0x1400706d6
mov ebx, eax
shl rbx, 0x20
jrcxz 0x1400706b4
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
lea rcx, [rdi + 0x30]
cmp qword [rsp + 0x58], 0
je 0x140070733
mov rdi, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
mov rdx, qword [rax]
and edx, 0xd
or rdx, 2
mov rsi, qword [rsp + 0x40]
jmp 0x140070742
mov edx, 2
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400701bd
lea rcx, [rdi + 0x30]
call fcn.1400702e5
mov qword [rdi + 0x30], 0
cmp qword [rsi], 0
je 0x14007081b
mov rcx, qword [0x1401aa478]
xor edx, edx
mov r8, rbx
jmp 0x140070815
lea r8, str.C:UsersAdmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fmio_0.6.23_src_syswindows_tcp.rs
mov rcx, r15
mov rdx, rbp
mov edx, ebp

Function at 0x140070fca
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140070ff6
xor eax, eax
jmp 0x140071003
call sub.kernel32.dll_GetLastError
shl rax, 0x20
and byte [rax - 0x7d], cl
invalid
invalid
add rsp, 0x38
ret

Function at 0x1400744d7
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
mov r15, rdx
mov qword [rsp + 0x118], rcx
lea rdi, [rsp + 0xb0]
lea r12, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
Function at 0x14009ffab
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x1a0]
mov rdx, qword [rdx + 0x198]
cmp rdx, rcx
jb 0x1400a0168
mov rax, qword [rdi + 0x190]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x218]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1400a00db
cmp eax, 0x80090318
je 0x1400a013c
test eax, eax
jne 0x1400a012c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x190]
mov rax, qword [rdi + 0x198]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x178], 0
add r9, r8
jb 0x1400a0174
cmp rax, r9
jb 0x1400a0183
lea rax, [rdi + 0x168]
add rdx, rcx
add r8, rdx
mov rcx, rax
call fcn.14006f861
mov qword [rdi + 0x180], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1a0]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14009ff12
xor eax, eax
cmp qword [rdi + 0x1a0], 0
sete al
mov qword [rdi + 0x238], rax
mov byte [rsi + 1], 0
jmp 0x1400a015e
cmp eax, 0x90317
je 0x1400a0158
cmp eax, 0x90321
jne 0x1400a012c
mov dword [rdi + 0x1f8], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1fc], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1a0]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14009ff12
mov qword [rdi + 0x238], 0
mov byte [rsi + 1], bl
jmp 0x1400a015e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1400a015e
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x238], rax
mov byte [rsi + 1], 0
jmp 0x1400a015c
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x14016ef18]
call fcn.140104890
lea r8, [0x14016ef30]
mov rdx, r9
call fcn.140104ad0
lea r8, [0x14016ef30]
mov rcx, r9
mov rdx, rax
call fcn.140104890
int3
Function at 0x1400a119b
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0xa0]
mov rdx, qword [rdx + 0x98]
cmp rdx, rcx
jb 0x1400a1352
mov rax, qword [rdi + 0x90]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x118]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1400a12c5
cmp eax, 0x80090318
je 0x1400a1326
test eax, eax
jne 0x1400a1316
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x90]
mov rax, qword [rdi + 0x98]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x78], 0
add r9, r8
jb 0x1400a135e
cmp rax, r9
jb 0x1400a136d
lea rax, [rdi + 0x68]
add rdx, rcx
add r8, rdx
mov rcx, rax
call fcn.14006f861
mov qword [rdi + 0x80], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xa0]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1400a1380
xor eax, eax
cmp qword [rdi + 0xa0], 0
sete al
mov qword [rdi + 0x138], rax
mov byte [rsi + 1], 0
jmp 0x1400a1348
cmp eax, 0x90317
je 0x1400a1342
cmp eax, 0x90321
jne 0x1400a1316
mov dword [rdi + 0xf8], 0x10000
xor ebx, ebx
mov byte [rdi + 0xfc], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xa0]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1400a1380
mov qword [rdi + 0x138], 0
mov byte [rsi + 1], bl
jmp 0x1400a1348
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1400a1348
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x138], rax
mov byte [rsi + 1], 0
jmp 0x1400a1346
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, [0x14016ef18]
call fcn.140104890
lea r8, [0x14016ef30]
mov rdx, r9
call fcn.140104ad0
lea r8, [0x14016ef30]
mov rcx, r9
mov rdx, rax
call fcn.140104890
int3
Function at 0x1400a156c
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, r8
mov r12, rdx
mov rdi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.1400a037a
mov eax, dword [rbx]
cmp eax, 2
jne 0x1400a15ab
mov rdx, qword [rsp + 0x30]
mov esi, 1
jmp 0x1400a170e
mov esi, 1
test eax, eax
je 0x1400a16be
mov r13, qword [rdi + 0xc0]
cmp r13, qword [rdi + 0xb8]
jne 0x1400a16f8
mov r14, qword [rsp + 0x30]
mov edx, r14d
shr r14, 0x20
cmp r15, r14
cmovb r14, r15
mov ebp, dword [rsp + 0x2c]
lea r15, [r14 + rbp]
add rdx, r15
cmp r13, rdx
jae 0x1400a1602
lea rcx, [rdi + 0xa8]
call fcn.1400a0196
mov r13, qword [rdi + 0xb8]
cmp r13, r15
jb 0x1400a1722
invalid
mov rcx, qword [rdi + 0xb0]
add rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.1401035b1
cmp r13, rbp
jb 0x1400a172e
mov rdx, qword [rdi + 0xb8]
cmp rdx, r15
jb 0x1400a1740
mov rax, qword [rdi + 0xb0]
lea rcx, [rax + rbp]
sub edx, r15d
add r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x2c], 7
mov qword [rsp + 0x30], rax
and al, 0x30
movabs rdx, 0x8009031700000002
jmp 0x1400a170e
lea r8, [0x14016ef48]
mov rcx, r15
jmp 0x1400a1738
lea r8, [0x14016ef60]
mov rcx, rbp
mov rdx, r13
call fcn.140104890
lea r8, [0x14016ef78]
mov rcx, r15
call fcn.140104890
int3
Function at 0x1400a178d
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, r8
mov r12, rdx
mov rdi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.14009ef12
mov eax, dword [rbx]
cmp eax, 2
jne 0x1400a17cc
mov rdx, qword [rsp + 0x30]
mov esi, 1
jmp 0x1400a192f
mov esi, 1
test eax, eax
je 0x1400a18df
mov r13, qword [rdi + 0x1c0]
cmp r13, qword [rdi + 0x1b8]
jne 0x1400a1919
mov r14, qword [rsp + 0x30]
mov edx, r14d
shr r14, 0x20
cmp r15, r14
cmovb r14, r15
mov ebp, dword [rsp + 0x2c]
lea r15, [r14 + rbp]
add rdx, r15
cmp r13, rdx
jae 0x1400a1823
lea rcx, [rdi + 0x1a8]
call fcn.1400a0196
mov r13, qword [rdi + 0x1b8]
cmp r13, r15
jb 0x1400a1943
mov rcx, qword [rdi + 0x1b0]
add rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.1401035b1
cmp r13, rbp
jb 0x1400a194f
mov rdx, qword [rdi + 0x1b8]
cmp rdx, r15
jb 0x1400a1961
mov rax, qword [rdi + 0x1b0]
lea rcx, [rax + rbp]
sub edx, r15d
add r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x2c], 7
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x4c], 6
mov qword [rsp + 0x50], r15
movabs rax, 0x400000000
lea r8, [rsp + 0x68]
mov qword [r8], rax
mov qword [r8 + 8], rbx
lea rcx, [rdi + 0x218]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x1400a18eb
mov edx, eax
shl rdx, 0x20
or rdx, 2
jmp 0x1400a192f
movabs rdx, 0x8009031700000002
jmp 0x1400a192f
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rdi + 0x1b8], rax
jb 0x1400a1907
mov qword [rdi + 0x1b8], rax
mov qword [rdi + 0x1c0], 0
mov qword [rdi + 0x240], r14
mov rcx, rdi
call fcn.14009fc4a
test rax, rax
jne 0x1400a192f
mov rdx, qword [rdi + 0x240]
xor esi, esi
mov rax, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x14016ef48]
mov rcx, r15
jmp 0x1400a1959
lea r8, [0x14016ef60]
mov rcx, rbp
mov rdx, r13
call fcn.140104890
lea r8, [0x14016ef78]
mov rcx, r15
call fcn.140104890
int3

Function at 0x1400a5513
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, rdx
movzx eax, byte [rdx + 0x1d1]
test eax, eax
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x60], rcx
je 0x1400a5564
cmp eax, 3
jne case.default.0x1400a5562
mov rdi, r8
lea r14, [rsi + 0x100]
movzx eax, byte [rsi + 0x138]
lea rcx, [0x1401a08fc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rsi + 0x1b8]
mov qword [rsi + 0x20], rax
movups xmm0, xmmword [rsi + 0x1c0]
movups xmmword [rsi + 0x28], xmm0
mov cl, byte [rsi + 0x1d2]
mov byte [rsi + 0x1d0], cl
mov qword [rsi + 0x38], 0
mov qword [rsi + 0x40], rax
xor r15d, r15d
jmp 0x1400a55a3
lea rcx, str.C:UsersAdmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fhyper_0.13.10_srcclientconnecthttp.rs
call fcn.140104e90
Function at 0x1400a6000
Capabilities:
Access peb ldr_data
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov r12, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [rdx + 0x68]
test eax, eax
je 0x1400a6062
cmp eax, 3
jne 0x1400a664a
mov rcx, qword [rsi + 0x60]
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
lea r8, [rsp + 0x38]
mov dword [r8], 1
mov rcx, r14
mov edx, 0x8004667e
add al, 0x80
Function at 0x1400c2a2c
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, rdx
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x40]
mov qword [rdx], r8
add r8, 0xb
mov qword [rdx + 8], r8
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rcx, [rsp + 0x60]
call fcn.1400cc02a
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
mov al, byte [0x1401aa510]
mov edx, 0x800
xor ecx, ecx
call fcn.1400e4e70
test rax, rax
je 0x1400c2bb0
mov r14, rax
lea rbx, [rsp + 0x40]
mov qword [rbx], 0x800
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], 0
mov r15, qword [rsp + 0x68]
lea rbp, [rsp + 0x30]
lea r12, [rsp + 0x34]
mov rsi, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
sub rsi, r13
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov rdx, r15
xor r8d, r8d
mov r9, r12
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400c2b0b
mov r8d, dword [rsp + 0x30]
cmp rsi, r8
jae 0x1400c2acd
mov rcx, rbx
mov rdx, r13
call fcn.140106a86
mov r14, qword [rsp + 0x48]
jmp 0x1400c2ac0
test eax, eax
jne 0x1400c2b2d
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x1400c2b69
movabs rax, 0xde00000002
jmp 0x1400c2b35
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rsp + 0x40], 0
je 0x1400c2b82
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1401aa478]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400c2b82
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
cmp qword [rsp + 0x60], 0
je 0x1400c2b9e
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1401aa478]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
mov edx, 0x800
call fcn.140103bc0
int3
Function at 0x1400c3d42
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x838
mov r13, rdx
mov r15, rcx
mov rsi, qword [rdx]
mov r14, qword [rdx + 8]
cmp rsi, 2
jne 0x1400c3d78
mov qword [r15 + 8], r14
mov qword [r15], 3
jmp 0x1400c55af
mov rdi, qword [r13 + 0x108]
mov rax, qword [r13 + 0x110]
mov qword [rsp + 0x128], rax
mov rax, qword [r13 + 0x118]
mov qword [rsp + 0x120], rax
mov rbx, qword [r13 + 0x120]
mov rax, qword [r13 + 0x128]
mov qword [rsp + 0xe0], rax
mov al, byte [0x1401aa510]
mov edx, 0xd0
xor ecx, ecx
call fcn.1400e4e70
test rax, rax
je 0x1400c480e
mov r12, rax
mov eax, 1
mov qword [r12], rax
mov qword [r12 + 8], rax
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x38], 4
lock inc qword [r12]
jle case.0x1400c47ee.2
lea rdx, [r13 + 0x10]
lea rax, [rsp + 0x180]
mov qword [rax - 8], rsi
mov qword [rax], r14
lea rcx, [rsp + 0x188]
mov r8d, 0xf8
call fcn.1401035b1
mov eax, 2
mov qword [rsp + 0x58], rax
cmp rdi, 2
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x138], r12
jne 0x1400c3e51
mov qword [rsp + 0x130], rsi
jmp 0x1400c4016
test rdi, rdi
je 0x1400c3e7b
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x120]
mov r15, qword [rsp + 0xe0]
mov rdx, rbx
jmp 0x1400c3f58
lea rdi, [rsp + 0x678]
mov rcx, rdi
mov rdx, 0xfffffffffffffffe
xor r8d, r8d
call fcn.140063fbc
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movups xmm3, xmmword [rdi + 0x30]
movaps xmmword [rsp + 0x560], xmm1
movaps xmmword [rsp + 0x550], xmm0
movaps xmmword [rsp + 0x3a0], xmm2
movaps xmmword [rsp + 0x3b0], xmm3
movups xmm0, xmmword [rdi + 0x40]
movaps xmmword [rsp + 0x3c0], xmm0
mov al, byte [0x1401aa510]
mov edx, 0x30
xor ecx, ecx
call fcn.1400e4e70
test rax, rax
je 0x1400c5299
mov rdi, rax
movaps xmm0, xmmword [rsp + 0x3a0]
movaps xmm1, xmmword [rsp + 0x3b0]
movaps xmm2, xmmword [rsp + 0x3c0]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
movaps xmm0, xmmword [rsp + 0x550]
movaps xmm1, xmmword [rsp + 0x560]
and al, 0x60
add eax, 0x290f0000
test byte [rax + rdx*4], ah
add byte [rax], al
add byte [rdi], cl
sub dword [rsp + 0xa0], ecx
Function at 0x1400c8f20
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400c8f45
cmp rax, rcx
je 0x1400c8f4b
cmp rdx, 4
jae 0x1400c8f52
xor eax, eax
xor r8d, r8d
jmp 0x1400c8ff0
pop rbp
jmp fcn.1400380b0
xor eax, eax
jmp 0x1400c9007
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1401142b0]
movdqa xmm3, xmmword [0x1401142c0]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400c8f80
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400c9007
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400c8ff0
pop rbp
ret