joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b56e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b5700
test al, 1
je 0x1800b5862
test al, 2
jne 0x1800b5862
test al, 8
jne 0x1800b574c
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800b576c
lea rax, [rax + 0xd0]
jmp 0x1800b577a
test al, 0x10
je 0x1800b57cf
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b5862
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
jmp 0x1800b57cf
call fcn.180113ba0
test rax, rax
je 0x1800b585a
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.1800b5620
mov qword [rsi + 0x30], 3
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800b57c1
lea rax, [rax + 0xd0]
jmp 0x1800b57cb
call fcn.180113ba0
test rax, rax
je 0x1800b57cf
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011b290
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b5862
jne 0x1800b584e
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800b5811
call fcn.180084290
lea rcx, [rsi + 0x30]
call fcn.1800b5620
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b5830
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x1800b578a
ud2
Function at 0x1800b6280
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b62a0
test al, 1
je 0x1800b6402
test al, 2
jne 0x1800b6402
test al, 8
jne 0x1800b62ec
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800b630c
lea rax, [rax + 0xd0]
jmp 0x1800b631a
test al, 0x10
je 0x1800b636f
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b6402
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
jmp 0x1800b636f
call fcn.180113ba0
test rax, rax
je 0x1800b63fa
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.1800b5620
mov qword [rsi + 0x30], 3
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800b6361
lea rax, [rax + 0xd0]
jmp 0x1800b636b
call fcn.180113ba0
test rax, rax
je 0x1800b636f
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011a500
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b6402
jne 0x1800b63ee
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800b63b1
call fcn.1800841f0
lea rcx, [rsi + 0x30]
call fcn.1800b5620
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b63d0
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x1800b632a
ud2

Function at 0x1800bb7c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x200
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800bb7d0
test al, 1
je 0x1800bb872
test al, 2
jne 0x1800bb872
test al, 8
jne 0x1800bb80b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.1800bb690
jmp 0x1800bb825
test al, 0x10
je 0x1800bb825
mov rax, qword [rsi + 0x220]
test rax, rax
je 0x1800bb872
mov rcx, qword [rsi + 0x228]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011b290
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800bb872
jne 0x1800bb868
mov rcx, rsi
add rsp, 0x200
pop rsi
jmp fcn.1800bb880
nop
add rsp, 0x200
pop rsi
ret
ud2
Function at 0x1800bbd80
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x200
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800bbd90
test al, 1
je 0x1800bbe32
test al, 2
jne 0x1800bbe32
test al, 8
jne 0x1800bbdcb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.1800bb690
jmp 0x1800bbde5
test al, 0x10
je 0x1800bbde5
mov rax, qword [rsi + 0x220]
test rax, rax
je 0x1800bbe32
mov rcx, qword [rsi + 0x228]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011a500
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800bbe32
jne 0x1800bbe28
mov rcx, rsi
add rsp, 0x200
pop rsi
jmp fcn.1800bbe40
nop
add rsp, 0x200
pop rsi
ret
ud2
Function at 0x1800cca70
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xf70
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800cca80
test al, 1
je 0x1800ccb22
test al, 2
jne 0x1800ccb22
test al, 8
jne 0x1800ccabb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800cd020
jmp 0x1800ccad5
test al, 0x10
je 0x1800ccad5
mov rax, qword [rsi + 0xf90]
test rax, rax
je 0x1800ccb22
mov rcx, qword [rsi + 0xf98]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011b290
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ccb22
jne 0x1800ccb18
mov rcx, rsi
add rsp, 0xf70
pop rsi
jmp fcn.1800ccb30
nop
add rsp, 0xf70
pop rsi
ret
ud2

Function at 0x1800cd150
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xf70
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800cd160
test al, 1
je 0x1800cd202
test al, 2
jne 0x1800cd202
test al, 8
jne 0x1800cd19b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800cd020
jmp 0x1800cd1b5
test al, 0x10
je 0x1800cd1b5
mov rax, qword [rsi + 0xf90]
test rax, rax
je 0x1800cd202
mov rcx, qword [rsi + 0xf98]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011a500
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800cd202
jne 0x1800cd1f8
mov rcx, rsi
add rsp, 0xf70
pop rsi
jmp fcn.1800cd210
nop
add rsp, 0xf70
pop rsi
ret
ud2
Function at 0x1800d4f60
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.Secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800d4fa2
mov rdi, qword [rsp + 0x28]
je 0x1800d500f
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800d5082
test rax, rax
je 0x1800d5082
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800d4ff8
cmp qword [rdi + 0x10], 0x11
jb 0x1800d4fe6
mov r14, qword [r14 - 8]
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18021e9c0]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800d5082
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800d5065
movzx eax, byte [0x18021ea38]
mov rcx, qword [0x18021e9c0]
test rcx, rcx
jne 0x1800d5043
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800d5056
mov rcx, rax
mov qword [0x18021e9c0], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800d506b
mov ecx, 1
mov rdx, rbx
call fcn.1801828e0
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180180980
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800d6fb0
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x198]
cmp rax, qword [rdx + 0x190]
ja 0x1800d726c
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x180]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0x1c0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1800d7123
cmp eax, 0x80090318
je 0x1800d71a5
test eax, eax
jne 0x1800d71c3
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x180]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x170], 0
add rcx, rbx
jb 0x1800d726c
cmp rcx, qword [rdi + 0x190]
ja 0x1800d726c
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x168], rbx
jb 0x1800d724f
xor r12d, r12d
mov rcx, qword [rdi + 0x160]
add rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.180180980
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x170], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x178], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r15
jb 0x1800d726c
test r15, r15
je 0x1800d71f1
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x1800d726c
mov qword [rdi + 0x190], 0
cmp rax, r15
jne 0x1800d71d3
cmp rcx, rdx
jne 0x1800d71ea
jmp 0x1800d71f1
cmp eax, 0x90317
je 0x1800d71bd
cmp eax, 0x90321
jne 0x1800d71c3
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x140], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x144], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r14
jb 0x1800d726c
test r14, r14
je 0x1800d7227
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x1800d726c
mov qword [rdi + 0x190], 0
cmp rax, r14
jne 0x1800d7209
cmp rcx, rdx
jne 0x1800d7220
jmp 0x1800d7227
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x1f8], rax
jmp 0x1800d7239
mov byte [rsi + 1], 1
jmp 0x1800d723d
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1800d723f
cmp rcx, rdx
je 0x1800d71f1
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call fcn.180180980
mov qword [rdi + 0x190], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x198], r15
mov qword [rdi + 0x1f8], rax
jmp 0x1800d7239
cmp rcx, rdx
je 0x1800d7227
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call fcn.180180980
mov qword [rdi + 0x190], rbx
mov qword [rdi + 0x198], r14
mov qword [rdi + 0x1f8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x160]
xor edx, edx
mov r8, rbx
call fcn.180184d40
mov r12, qword [rdi + 0x170]
jmp 0x1800d709d
ud2
Function at 0x1800d8700
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x98]
cmp rax, qword [rdx + 0x90]
ja 0x1800d89a1
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x80]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0xc0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1800d8864
cmp eax, 0x80090318
je 0x1800d88e0
test eax, eax
jne 0x1800d88fe
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x80]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x70], 0
add rcx, rbx
jb 0x1800d89a1
cmp rcx, qword [rdi + 0x90]
ja 0x1800d89a1
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x68], rbx
jb 0x1800d898a
xor r12d, r12d
mov rcx, qword [rdi + 0x60]
add rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.180180980
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x70], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x78], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r15
jb 0x1800d89a1
test r15, r15
je 0x1800d892c
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x1800d89a1
mov qword [rdi + 0x90], 0
cmp rax, r15
jne 0x1800d890e
cmp rcx, rdx
jne 0x1800d8925
jmp 0x1800d892c
cmp eax, 0x90317
je 0x1800d88f8
cmp eax, 0x90321
jne 0x1800d88fe
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x40], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x44], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r14
jb 0x1800d89a1
test r14, r14
je 0x1800d8962
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x1800d89a1
mov qword [rdi + 0x90], 0
cmp rax, r14
jne 0x1800d8944
cmp rcx, rdx
jne 0x1800d895b
jmp 0x1800d8962
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0xf8], rax
jmp 0x1800d8974
mov byte [rsi + 1], 1
jmp 0x1800d8978
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1800d897a
cmp rcx, rdx
je 0x1800d892c
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.180180980
mov qword [rdi + 0x90], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x98], r15
mov qword [rdi + 0xf8], rax
jmp 0x1800d8974
cmp rcx, rdx
je 0x1800d8962
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.180180980
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x98], r14
mov qword [rdi + 0xf8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x60]
xor edx, edx
mov r8, rbx
call fcn.180184d40
mov r12, qword [rdi + 0x70]
jmp 0x1800d87e7
ud2
Function at 0x1800d8c90
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xc0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.Secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800d8cd2
mov rdi, qword [rsp + 0x28]
je 0x1800d8d3f
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800d8db2
test rax, rax
je 0x1800d8db2
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800d8d28
cmp qword [rdi + 0x10], 0x11
jb 0x1800d8d16
mov r14, qword [r14 - 8]
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18021e9c0]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800d8db2
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800d8d95
movzx eax, byte [0x18021ea38]
mov rcx, qword [0x18021e9c0]
test rcx, rcx
jne 0x1800d8d73
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800d8d86
mov rcx, rax
mov qword [0x18021e9c0], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800d8d9b
mov ecx, 1
mov rdx, rbx
call fcn.1801828e0
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180180980
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800ef410
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800ef430
test al, 1
je 0x1800ef592
test al, 2
jne 0x1800ef592
test al, 8
jne 0x1800ef47c
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800ef49c
lea rax, [rax + 0xd0]
jmp 0x1800ef4aa
test al, 0x10
je 0x1800ef4ff
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800ef592
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
jmp 0x1800ef4ff
call fcn.180113ba0
test rax, rax
je 0x1800ef58a
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.1800ef2b0
mov qword [rsi + 0x30], 4
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800ef4f1
lea rax, [rax + 0xd0]
jmp 0x1800ef4fb
call fcn.180113ba0
test rax, rax
je 0x1800ef4ff
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011b290
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ef592
jne 0x1800ef57e
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800ef541
call fcn.180084290
lea rcx, [rsi + 0x30]
call fcn.1800ef2b0
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800ef560
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x1800ef4ba
ud2
Function at 0x1800f0560
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800f0580
test al, 1
je 0x1800f06e2
test al, 2
jne 0x1800f06e2
test al, 8
jne 0x1800f05cc
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800f05ec
lea rax, [rax + 0xd0]
jmp 0x1800f05fa
test al, 0x10
je 0x1800f064f
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800f06e2
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
jmp 0x1800f064f
call fcn.180113ba0
test rax, rax
je 0x1800f06da
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.1800ef2b0
mov qword [rsi + 0x30], 4
mov eax, dword [0x18021ea3c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800f0641
lea rax, [rax + 0xd0]
jmp 0x1800f064b
call fcn.180113ba0
test rax, rax
je 0x1800f064f
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011a500
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800f06e2
jne 0x1800f06ce
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800f0691
call fcn.1800841f0
lea rcx, [rsi + 0x30]
call fcn.1800ef2b0
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800f06b0
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x1800f060a
ud2
Function at 0x1800f8390
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1800f83f7
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x1800f843e
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je 0x1800f8433
xor r9d, r9d
lea r10, [0x18020ac40]
xor r8d, r8d
nop word cs:[rax + rax]
movzx r11d, byte [rax + r9]
or r8d, dword [r10 + r11*4]
inc r9
cmp rdx, r9
jne 0x1800f8420
jmp 0x1800f8436
xor r8d, r8d
mov dword [rsp + 0x98], r8d
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1800f84c5
js 0x1800f85d4
mov rbx, qword [rcx]
lea r14, [rsi*8]
movzx eax, byte [0x18021ea38]
mov rcx, qword [0x18021e9c0]
test rcx, rcx
jne 0x1800f8484
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800f85be
mov rcx, rax
mov qword [0x18021e9c0], rax
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1800f85be
mov rdi, rax
lea r8, [rbx + rsi*8]
sub r8, rbx
add r8, 0xfffffffffffffff8
mov r14, r8
shr r14, 3
and r8, 0xfffffffffffffff8
add r8, 8
mov rcx, rax
mov rdx, rbx
call fcn.180180980
inc r14d
jmp 0x1800f84cd
xor r14d, r14d
mov edi, 8
mov dword [rsp + 0x64], r14d
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
lea rdx, [0x1801e2d95]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x1800f855a
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
test rsi, rsi
je 0x1800f853f
mov rcx, qword [0x18021e9c0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, r14
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
movaps xmm6, xmmword [rsp + 0x50]
movzx eax, byte [0x18021ea38]
mov rcx, qword [0x18021e9c0]
test rcx, rcx
jne 0x1800f8587
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800f85d8
mov rcx, rax
mov qword [0x18021e9c0], rax
mov r8d, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1800f85d8
mov rbx, rax
mov qword [rax], 1
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm6
xor r14d, r14d
test rsi, rsi
jne 0x1800f852d
jmp 0x1800f853f
shr rsi, 0x39
not esi
and esi, 8
mov rcx, rsi
mov rdx, r14
call fcn.1801828e0
ud2
ud2
mov ecx, 8
mov edx, 0x20
call fcn.1801828e0
ud2
Function at 0x180101340
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1801e3cd0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1801013b3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1801013ea
test eax, eax
js 0x1801013c4
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1801013dd
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1800ffc40
mov rcx, rax
call fcn.1800ffd20
mov ecx, 7
int 0x29
ud2