joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007bfed
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14007c013
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14007bffd
mov qword [rcx], rax
ret

Function at 0x1400a380f
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x1400a3835
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x1400a381f
mov qword [rcx], rax
ret

Function at 0x1400a38d1
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor eax, eax
test rbx, rbx
setne al
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
call fcn.1400a189d
test rbx, rbx
je 0x1400a3912
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.1400a380f
add rdi, 8
mov rcx, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.1400a39fe

Function at 0x1400c0188
Capabilities:
Set socket configuration

Disassembly:
mov edx, 1
jmp 0x1400c09e6
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
cmp word [rcx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov rax, qword [0x1403c7068]
cmp rax, 3
jne 0x1400c0a78
mov ecx, edi
mov edx, esi
xor r8d, r8d
call sub.WS2_32.dll_socket
cmp rax, 0xffffffffffffffff
je 0x1400c0a56
mov rsi, rax
lea r8, [rsp + 0x34]
mov dword [r8], 1
mov rcx, rax
mov edx, 0x8004667e
call sub.WS2_32.dll_ioctlsocket
test eax, eax
je 0x1400c0a65
call fcn.1400c0849
mov rdi, rax
mov rcx, rsi
call sub.WS2_32.dll_closesocket
mov ebx, 1
jmp 0x1400c0a6a
mov ebx, 1
call fcn.1400c0849
mov rdi, rax
jmp 0x1400c0a6a
xor ebx, ebx
mov rdi, rsi
mov rax, rbx
mov rdx, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x33]
mov byte [rax], 1
lea r8, [rsp + 0x38]
mov qword [r8], rax
lea rax, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_mio_0.8.11_src_sys_windows_net.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1403c7068]
lea r9, [0x14030b8a8]
xor edx, edx
call fcn.140192cc0
jmp 0x1400c0a0d
Function at 0x1400c0192
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1400c0aae
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0xc]
lea rdx, [rsp + 0x20]
movups xmmword [rdx + 0xc], xmm1
movaps xmmword [rdx], xmm0
mov r8d, dword [rdi + 0x1c]
mov rcx, qword [rsi]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x1400c01d7
xor eax, eax
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
call fcn.1400c00d4
mov ecx, eax
and ecx, 3
lea rdx, [0x14030b7e8]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
xor ecx, ecx
cmp byte [rax + 0x10], 0xd
cmove rax, rcx
jmp 0x1400c01cf
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x2733
je case.default.0x1400c01ef
jmp 0x1400c01cf
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0xd
je case.default.0x1400c01ef
jmp 0x1400c01cf
cmp byte [rax + 0xf], 0xd
jne 0x1400c01cf
mov rsi, rax
dec rsi
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400c024a
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.140185f30
mov edx, 0x18
mov r8d, 8
mov rcx, rsi
call fcn.140185f30
jmp case.default.0x1400c01ef

Function at 0x1400c09e6
Capabilities:
Set socket configuration

Disassembly:
mov edx, 1
jmp 0x1400c09e6
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
cmp word [rcx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov rax, qword [0x1403c7068]
cmp rax, 3
jne 0x1400c0a78
mov ecx, edi
mov edx, esi
xor r8d, r8d
call sub.WS2_32.dll_socket
cmp rax, 0xffffffffffffffff
je 0x1400c0a56
mov rsi, rax
lea r8, [rsp + 0x34]
mov dword [r8], 1
mov rcx, rax
mov edx, 0x8004667e
call sub.WS2_32.dll_ioctlsocket
test eax, eax
je 0x1400c0a65
call fcn.1400c0849
mov rdi, rax
mov rcx, rsi
call sub.WS2_32.dll_closesocket
mov ebx, 1
jmp 0x1400c0a6a
mov ebx, 1
call fcn.1400c0849
mov rdi, rax
jmp 0x1400c0a6a
xor ebx, ebx
mov rdi, rsi
mov rax, rbx
mov rdx, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x33]
mov byte [rax], 1
lea r8, [rsp + 0x38]
mov qword [r8], rax
lea rax, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_mio_0.8.11_src_sys_windows_net.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1403c7068]
lea r9, [0x14030b8a8]
xor edx, edx
call fcn.140192cc0
jmp 0x1400c0a0d

Function at 0x1400c153c
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsi + 0x20]
add rsp, 0x50
pop rsi
ret

Function at 0x1400c47f8
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400c4811
dec ecx
add rsp, 0x28
jmp fcn.140212314
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x1400c4808
Function at 0x1400c481d
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400c483e
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14021230c
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x1400c4831

Function at 0x1400c526c
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400c528d
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14021230c
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x1400c5280

Function at 0x1400c66d9
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400c66f2
dec ecx
add rsp, 0x28
jmp fcn.140212314
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x1400c66e9
Function at 0x1400c6c5c
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400c6c7d
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14021230c
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x1400c6c70
Function at 0x1401295b9
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov rdx, r8
mov r8, r9
call fcn.140143206
mov dword [rsp + 0x30], 0x800
and dword [rsp + 0x34], 0
lea rdi, [rsp + 0x38]
mov edx, 0x800
mov rcx, rdi
xor r8d, r8d
call fcn.140009464
cmp qword [rdi], 0
mov rcx, qword [rdi + 8]
jne 0x1401296de
lea rdi, [rsp + 0x38]
mov rax, qword [rdi + 0x10]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
and qword [rdi + 0x10], 0
mov rbx, qword [rbx]
mov r14, qword [rsp + 0x58]
lea r12, [rsp + 0x30]
lea r15, [rsp + 0x34]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x140129668
mov edx, dword [rsp + 0x30]
mov rcx, rdi
call fcn.140009895
mov rax, qword [rsp + 0x40]
jmp 0x140129633
test eax, eax
jne 0x14012968a
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x1401296af
movabs rax, 0xde00000002
jmp 0x140129692
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
lea rcx, [rsp + 0x38]
call fcn.1400095d1
jmp 0x1401296c3
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
lea rcx, [rsp + 0x50]
call fcn.1401c023a
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x48]
call fcn.140003b30
int3
Function at 0x14012c7a9
Capabilities:
Decrypt data via sspi

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x60]
mov rdx, qword [rdx + 0x78]
lea r8, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
call fcn.140129ee1
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x68]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xf0]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x14012c8f4
test eax, eax
je 0x14012c885
cmp eax, 0x90317
je 0x14012c8ee
cmp eax, 0x90321
jne 0x14012c912
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x58]
sub rdx, rax
mov rcx, rdi
call fcn.14012bdff
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x14012c920
mov rdx, qword [rsp + 0x40]
sub rdx, qword [rdi + 0x68]
mov r8d, dword [rsp + 0x38]
add r8, rdx
lea r14, [rdi + 0x40]
and qword [rdi + 0x50], 0
mov rcx, rbx
call fcn.140129e00
lea r8, [rdx + rax]
mov rcx, r14
mov rdx, rax
call fcn.140009820
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x58]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14012bdff
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x14012c920
mov byte [rsi + 1], 1
jmp 0x14012c90e
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14012c920
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14012c92f
Capabilities:
Decrypt data via sspi

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x160]
mov rdx, qword [rdx + 0x178]
lea r8, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
call fcn.140129ee1
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x68]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1f0]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x14012ca95
test eax, eax
je 0x14012ca14
cmp eax, 0x90317
je 0x14012ca8f
cmp eax, 0x90321
jne 0x14012cab3
mov dword [rdi + 0x1d0], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1d4], bl
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x178]
mov eax, 0
cmove eax, dword [rsp + 0x58]
sub rdx, rax
mov rcx, rdi
call fcn.14012be55
and qword [rdi + 0x210], 0
mov byte [rsi + 1], bl
jmp 0x14012cac1
mov rdx, qword [rsp + 0x40]
sub rdx, qword [rdi + 0x168]
mov r8d, dword [rsp + 0x38]
add r8, rdx
lea r14, [rdi + 0x140]
and qword [rdi + 0x150], 0
mov rcx, rbx
call fcn.140129e00
lea r8, [rdx + rax]
mov rcx, r14
mov rdx, rax
call fcn.140009820
and qword [rdi + 0x158], 0
xor ebx, ebx
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x178]
mov eax, dword [rsp + 0x58]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14012be55
xor eax, eax
cmp qword [rdi + 0x178], rbx
sete al
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
jmp 0x14012cac1
mov byte [rsi + 1], 1
jmp 0x14012caaf
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14012cac1
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14012cad0
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov eax, dword [r9 + 8]
cmp rax, r8
jb 0x14012cc4c
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov r14d, dword [r9]
mov edx, dword [r9 + 4]
lea rdi, [r14 + r8]
add rdx, rdi
lea rbx, [rcx + 0x180]
cmp qword [rcx + 0x190], rdx
jae 0x14012cb1f
mov rcx, rbx
xor r8d, r8d
call fcn.1400fbcd2
lea r9, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.140129eb9
lea rcx, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r15
call fcn.1400233fd
lea r8, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
mov rdx, r14
call fcn.140129ee1
mov r15, rax
mov r12, rdx
xor ebp, ebp
test rax, rax
cmove r12d, ebp
lea r9, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.140129eb9
mov r14, rax
mov r13, rdx
test rax, rax
cmove r13d, ebp
lea r8, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
mov rdx, rdi
call fcn.140129ea3
test rax, rax
cmove edx, ebp
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], r12d
mov dword [rcx + 4], 7
mov qword [rcx + 8], r15
mov dword [rcx + 0x10], r13d
mov dword [rcx + 0x14], 1
mov qword [rcx + 0x18], r14
mov dword [rcx + 0x20], edx
mov dword [rcx + 0x24], 6
mov qword [rcx + 0x28], rax
movabs rax, 0x400000000
lea r8, [rsp + 0x68]
mov qword [r8], rax
mov qword [r8 + 8], rcx
lea rcx, [rsi + 0x1f0]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x14012cc15
shl rax, 0x20
or rax, 2
jmp 0x14012cc3b
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rsi + 0x190], rax
jb 0x14012cc31
mov qword [rsi + 0x190], rax
and qword [rsi + 0x198], 0
xor eax, eax
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov edx, 0x3e
call fcn.140011b20
int3
Function at 0x14012cc65
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov eax, dword [r9 + 8]
cmp rax, r8
jb 0x14012cde1
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov r14d, dword [r9]
mov edx, dword [r9 + 4]
lea rdi, [r14 + r8]
add rdx, rdi
lea rbx, [rcx + 0x80]
cmp qword [rcx + 0x90], rdx
jae 0x14012ccb4
mov rcx, rbx
xor r8d, r8d
call fcn.1400fbcd2
lea r9, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.140129eb9
lea rcx, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r15
call fcn.1400233fd
lea r8, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
mov rdx, r14
call fcn.140129ee1
mov r15, rax
mov r12, rdx
xor ebp, ebp
test rax, rax
cmove r12d, ebp
lea r9, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.140129eb9
mov r14, rax
mov r13, rdx
test rax, rax
cmove r13d, ebp
lea r8, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
mov rdx, rdi
call fcn.140129ea3
test rax, rax
cmove edx, ebp
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], r12d
mov dword [rcx + 4], 7
mov qword [rcx + 8], r15
mov dword [rcx + 0x10], r13d
mov dword [rcx + 0x14], 1
mov qword [rcx + 0x18], r14
mov dword [rcx + 0x20], edx
mov dword [rcx + 0x24], 6
mov qword [rcx + 0x28], rax
movabs rax, 0x400000000
lea r8, [rsp + 0x68]
mov qword [r8], rax
mov qword [r8 + 8], rcx
lea rcx, [rsi + 0xf0]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x14012cdaa
shl rax, 0x20
or rax, 2
jmp 0x14012cdd0
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rsi + 0x90], rax
jb 0x14012cdc6
mov qword [rsi + 0x90], rax
and qword [rsi + 0x98], 0
xor eax, eax
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, str._home_ubuntu_.cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov edx, 0x3e
call fcn.140011b20
int3

Function at 0x14012ff0e
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14012ff27
dec ecx
add rsp, 0x28
jmp fcn.140212314
mov rcx, rax
call fcn.140190580
mov ecx, eax
jmp 0x14012ff1e

Function at 0x14014f200
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rdx, rcx
cmp rdx, 0x20
jae 0x14014f213
pop rbp
jmp fcn.140016940
nop
pop rbp
jmp fcn.140016450
Function at 0x140153100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov r10, qword [rcx]
test r10, r10
je 0x140153184
mov r11, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
cmp r8, r11
jae 0x140153184
movzx eax, byte [r10 + r8]
cmp eax, 0x49
mov rbx, rcx
je 0x14015319d
cmp eax, 0x42
jne 0x140153184
lea rax, [r8 + 1]
mov qword [rcx + 0x10], rax
mov r9b, 1
cmp rax, r11
jae 0x1401532cf
cmp byte [r10 + rax], 0x5f
jne 0x14015325c
lea rax, [r8 + 2]
mov qword [rcx + 0x10], rax
xor eax, eax
cmp rax, r8
jae 0x1401532cf
mov edx, dword [rcx + 0x18]
inc edx
cmp edx, 0x1f4
jbe 0x140153329
mov sil, 1
xor r9d, r9d
jmp 0x1401532d1
xor edx, edx
call fcn.140151e90
mov esi, eax
add sil, sil
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
inc r8
mov qword [rcx + 0x10], r8
xor edx, edx
call fcn.140151e90
test al, al
jne 0x14015330f
mov rdx, rbx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1401531dc
lea rdx, [0x1403200a4]
mov r8d, 1
call fcn.140014560
mov rdx, rbx
test al, al
jne 0x14015330f
mov rax, qword [rdx]
mov sil, 1
test rax, rax
je 0x140153190
xor r14d, r14d
lea rdi, [0x140320429]
nop word cs:[rax + rax]
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rdx + 8]
jae 0x140153214
cmp byte [rax + rcx], 0x45
je 0x140153362
sub r14, 1
jb 0x14015323c
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x14015323c
mov r8d, 2
mov rdx, rdi
call fcn.140014560
mov rdx, rbx
test al, al
jne 0x14015330f
mov rcx, rdx
call fcn.1401525e0
test al, al
jne 0x14015330f
mov rdx, rbx
mov rax, qword [rbx]
test rax, rax
jne 0x140153200
jmp 0x140153190
lea rdi, [r8 + 2]
xor eax, eax
mov r14d, 0x3e
nop dword [rax + rax]
movzx edx, byte [r10 + rdi - 1]
cmp dl, 0x5f
je 0x1401532c2
lea esi, [rdx - 0x30]
cmp sil, 0xa
jb 0x1401532a0
lea esi, [rdx - 0x61]
cmp sil, 0x1a
jae 0x140153292
add dl, 0xa9
jmp 0x14015329e
lea esi, [rdx - 0x41]
cmp sil, 0x1a
jae 0x1401532cf
add dl, 0xe3
mov esi, edx
mov qword [rcx + 0x10], rdi
mul r14
jo 0x1401532cf
movzx edx, sil
xor esi, esi
add rax, rdx
jb 0x1401532d1
lea rdx, [rdi + 1]
cmp rdi, r11
mov rdi, rdx
jb 0x140153270
jmp 0x1401532d1
mov qword [rcx + 0x10], rdi
inc rax
jne 0x14015315f
xor esi, esi
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x140153317
mov ecx, r9d
xor cl, 1
movzx ecx, cl
lea r8, [rcx + rcx*8]
add r8, 0x10
lea rcx, str.invalid_syntaxrecursion_limit_reached_for_______::closureshim:_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x140320408]
test r9b, r9b
cmovne rdx, rcx
mov rcx, rax
call fcn.140014560
mov rcx, rbx
test al, al
je 0x140153317
mov sil, 2
jmp 0x140153190
mov qword [rcx], 0
mov byte [rcx + 8], sil
xor esi, esi
jmp 0x140153190
cmp qword [rcx + 0x20], 0
je 0x140153322
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], edx
mov rsi, rcx
call fcn.140153100
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140153192
inc rcx
mov qword [rdx + 0x10], rcx
jmp 0x140153190
Function at 0x140156a4e
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rsi, rcx
movabs rax, 0x8000000000000000
mov byte [rsp + 0x4f], dl
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x68], 4
mov dword [rsp + 0xb0], 0x400010
cmp qword [rcx + 0x18], rax
je 0x140156abd
mov ecx, dword [rsi + 0x28]
mov dword [rsp + 0x90], ecx
mov rcx, qword [rsi + 0x20]
mov qword [rsp + 0x98], rcx
cmp qword [rsi + 0x30], rax
je 0x140156af4
mov rax, qword [rsi + 0x38]
mov rdx, qword [rsi + 0x40]
add rdx, rax
lea rcx, [rsp + 0xb8]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0x4f]
mov qword [rcx + 0x10], rax
xor edx, edx
call fcn.1401566c3
mov dword [rsp + 0xa0], eax
mov rdx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
lea r8, [rdx + rax*8]
lea rsi, [rsp + 0xb8]
mov rcx, rsi
call fcn.1401563ba
mov eax, dword [rsi + 0x10]
lea rcx, [rsp + 0x68]
mov dword [rcx + 4], eax
mov rax, qword [rsi + 8]
cmp byte [rsp + 0x4f], 1
mov qword [rcx + 8], rax
mov r8d, 2
sbb r8d, 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, [0x1403232b4]
xor ecx, ecx
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x140156b75
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov edi, 1
jmp 0x140156bb5
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rax, qword [str.Lp__]
mov al, byte [rax]
mov ecx, 0x20
mov edx, 8
call fcn.140185ed0
test rax, rax
je 0x140156bd3
mov rsi, rax
mov eax, 1
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rbx
xor edi, edi
lea rcx, [rsp + 0xb8]
call fcn.1401560d2
mov rax, rdi
mov rdx, rsi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 8
mov edx, 0x20
call fcn.140003b50
int3

Function at 0x1401607dc
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov r8d, dword [rdx + 0x80]
call sub.WS2_32.dll_connect
test eax, eax
je 0x1401607f9
add rsp, 0x28
jmp fcn.14016064c
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [rcx]
jmp 0x1401607dc

Function at 0x140160800
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
movzx eax, dl
lea r8, [rsp + 0x24]
mov dword [r8], eax
mov edx, 0x8004667e
call sub.WS2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x140160822
xor eax, eax
jmp 0x140160827
call fcn.14016064c
nop
add rsp, 0x28
ret

Function at 0x140160922
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r9d
mov dword [rsp + 0x20], 4
mov r9, rax
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140160947
xor eax, eax
jmp 0x14016094c
call fcn.14016064c
nop
add rsp, 0x38
ret
mov rcx, qword [rcx]
movzx r9d, dl
mov edx, 0xffff
mov r8d, 8
jmp 0x140160922