joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004db40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rdx + 0x10]
movzx ebp, byte [rdx + 0x18]
movzx eax, byte [0x18016cbc0]
mov rcx, qword [0x18016cb80]
test rcx, rcx
jne 0x18004db8a
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x18004ddcf
mov rcx, rax
mov qword [0x18016cb80], rax
mov r8d, 0x5f0
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x18004ddcf
mov rbx, rax
mov byte [rsp + 0x27], bpl
mov qword [rsp + 0x30], r14
lea r15, [rsi + 0x20]
movabs r12, 0x800000000000000
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call fcn.1800f9370
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x28], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
nop word [rax + rax]
mov r14d, 1
lock xadd qword [0x18016cb08], r14
mov r13, r14
xor r13, rcx
lea r11, [rdx + r13]
mov rax, r13
rol rax, 0x10
xor rax, r11
lea rbp, [rax + r8]
rol rax, 0x15
xor rax, rbp
add r13, r9
mov r11, r13
xor r11, r10
rol r13, 0x20
xor r14, rbp
add r14, r11
rol r11, 0xd
mov rbp, rax
xor r11, r14
rol r14, 0x20
xor rbp, r12
add r13, rbp
shrd rbp, rax, 0x30
xor rbp, r13
add r14, rbp
rol rbp, 0x15
add r13, r11
rol r11, 0x11
xor rbp, r14
xor r11, r13
rol r13, 0x20
xor r14, r12
add r14, r11
rol r11, 0xd
xor r11, r14
rol r14, 0x20
xor r13, 0xff
add r13, rbp
rol rbp, 0x10
xor rbp, r13
add r14, rbp
rol rbp, 0x15
add r13, r11
rol r11, 0x11
xor r11, r13
rol r13, 0x20
xor rbp, r14
add r14, r11
rol r11, 0xd
xor r11, r14
rol r14, 0x20
add r13, rbp
rol rbp, 0x10
xor rbp, r13
add r14, rbp
rol rbp, 0x15
add r13, r11
rol r11, 0x11
xor r11, r13
rol r13, 0x20
xor rbp, r14
add r14, r11
rol r11, 0xd
add r13, rbp
rol rbp, 0x10
xor rbp, r13
rol rbp, 0x15
xor r11, r14
add r13, r11
rol r11, 0x11
mov r14, r13
rol r14, 0x20
xor r14, r11
xor r14, rbp
xor r14, r13
je 0x18004dc10
mov rax, qword [rsi + 0x40]
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdi + 0x128], xmm1
movups xmmword [rdi + 0x118], xmm0
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x138], rcx
movzx ecx, byte [rsp + 0x27]
mov byte [rdi + 0x140], cl
mov qword [rdi], 0
mov qword [rdi + 8], rbx
mov qword [rdi + 0x80], 0
mov qword [rdi + 0x88], rbx
mov rcx, qword [rsp + 0x28]
mov qword [rdi + 0x100], rcx
mov qword [rdi + 0x108], r14
mov qword [rdi + 0x110], rax
mov r8, qword [rsi + 0x48]
test r8, r8
je 0x18004ddbd
cmp qword [rsi + 0x50], 0
je 0x18004ddbd
mov rcx, qword [0x18016cb80]
xor edx, edx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.180106200
ud2
Function at 0x1800576c0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov rbx, rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0xb
mov rdx, rax
call fcn.180057380
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
movzx eax, byte [0x18016cbc0]
mov rcx, qword [0x18016cb80]
test rcx, rcx
jne 0x180057728
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x180057869
mov rcx, rax
mov qword [0x18016cb80], rax
mov r8d, 0x800
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x180057869
mov r14, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x800
mov qword [rsp + 0x48], 0
mov rdi, qword [rsp + 0x50]
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x34]
mov rbp, qword [sym.imp.advapi32.dll_RegQueryValueExW]
lea r12, [rsp + 0x38]
nop word cs:[rax + rax]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rbp
cmp eax, 0xea
jne 0x1800577c5
mov r8d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rax, rdx
cmp rax, r8
jae 0x180057780
mov rcx, r12
call fcn.1801085a0
mov r14, qword [rsp + 0x38]
jmp 0x180057780
test eax, eax
jne 0x1800577f6
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x18005784b
movabs rax, 0xde00000002
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x40], 0
jne 0x18005780d
jmp 0x18005781f
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x40], 0
je 0x18005781f
mov rcx, qword [0x18016cb80]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x58], 0
je 0x180057839
mov rcx, qword [0x18016cb80]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x58], 0
jne 0x180057827
jmp 0x180057839
mov ecx, 1
mov edx, 0x800
call fcn.180106200
ud2
Function at 0x180069420
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180069440
test al, 1
je 0x1800695a1
test al, 2
jne 0x1800695a1
test al, 8
jne 0x18006948c
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18016cbc4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc0], 0
je 0x1800694ac
lea rax, [rax + 0xc8]
jmp 0x1800694ba
test al, 0x10
je 0x18006950e
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1800695a1
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x18006950e
call fcn.1800e0e20
test rax, rax
je 0x180069599
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.180069310
mov byte [rsi + 0xa8], 4
mov eax, dword [0x18016cbc4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc0], 0
je 0x180069500
lea rax, [rax + 0xc8]
jmp 0x18006950a
call fcn.1800e0e20
test rax, rax
je 0x18006950e
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e8370
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800695a1
jne 0x18006958d
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180069550
call fcn.18005bb50
lea rcx, [rsi + 0x30]
call fcn.180069310
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x18006956f
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov rcx, qword [0x18016cb80]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x1800694ca
ud2
Function at 0x180069ff0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18006a010
test al, 1
je 0x18006a171
test al, 2
jne 0x18006a171
test al, 8
jne 0x18006a05c
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18016cbc4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc0], 0
je 0x18006a07c
lea rax, [rax + 0xc8]
jmp 0x18006a08a
test al, 0x10
je 0x18006a0de
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x18006a171
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x18006a0de
call fcn.1800e0e20
test rax, rax
je 0x18006a169
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.180069310
mov byte [rsi + 0xa8], 4
mov eax, dword [0x18016cbc4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc0], 0
je 0x18006a0d0
lea rax, [rax + 0xc8]
jmp 0x18006a0da
call fcn.1800e0e20
test rax, rax
je 0x18006a0de
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e7730
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18006a171
jne 0x18006a15d
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18006a120
call fcn.18005bab0
lea rcx, [rsi + 0x30]
call fcn.180069310
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x18006a13f
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov rcx, qword [0x18016cb80]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x18006a09a
ud2

Function at 0x18006a780
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18006a790
test al, 1
je 0x18006a831
test al, 2
jne 0x18006a831
test al, 8
jne 0x18006a7ca
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.18006ad30
jmp 0x18006a7e4
test al, 0x10
je 0x18006a7e4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x18006a831
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e8370
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18006a831
jne 0x18006a827
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.18006a840
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x18006ae90
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18006aea0
test al, 1
je 0x18006af41
test al, 2
jne 0x18006af41
test al, 8
jne 0x18006aeda
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.18006ad30
jmp 0x18006aef4
test al, 0x10
je 0x18006aef4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x18006af41
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e7730
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18006af41
jne 0x18006af37
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.18006af50
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x18006ed60
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18006ed70
test al, 1
je 0x18006edfd
test al, 2
jne 0x18006edfd
test al, 8
jne 0x18006eda2
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18006f3c0
jmp 0x18006edb6
test al, 0x10
je 0x18006edb6
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18006edfd
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e8370
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18006edfd
jne 0x18006edf6
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18006ee10
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x18006f4f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18006f500
test al, 1
je 0x18006f58d
test al, 2
jne 0x18006f58d
test al, 8
jne 0x18006f532
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18006f3c0
jmp 0x18006f546
test al, 0x10
je 0x18006f546
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18006f58d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e7730
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18006f58d
jne 0x18006f586
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18006f5a0
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x180070330
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x1e0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180070340
test al, 1
je 0x1800703e2
test al, 2
jne 0x1800703e2
test al, 8
jne 0x18007037b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 0xc
lea rdx, [rsp + 0x28]
call fcn.180070200
jmp 0x180070395
test al, 0x10
je 0x180070395
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x1800703e2
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e8370
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800703e2
jne 0x1800703d8
mov rcx, rsi
add rsp, 0x1e0
pop rsi
jmp fcn.1800703f0
nop
add rsp, 0x1e0
pop rsi
ret
ud2
Function at 0x1800708e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x1e0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800708f0
test al, 1
je 0x180070992
test al, 2
jne 0x180070992
test al, 8
jne 0x18007092b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 0xc
lea rdx, [rsp + 0x28]
call fcn.180070200
jmp 0x180070945
test al, 0x10
je 0x180070945
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180070992
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e7730
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180070992
jne 0x180070988
mov rcx, rsi
add rsp, 0x1e0
pop rsi
jmp fcn.1800709a0
nop
add rsp, 0x1e0
pop rsi
ret
ud2
Function at 0x1800883a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800883b0
test al, 1
je 0x18008843a
test al, 2
jne 0x18008843a
test al, 8
jne 0x1800883df
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.180088270
jmp 0x1800883f3
test al, 0x10
je 0x1800883f3
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x18008843a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e8370
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008843a
jne 0x180088433
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.180088440
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x180088900
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180088910
test al, 1
je 0x18008899a
test al, 2
jne 0x18008899a
test al, 8
jne 0x18008893f
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.180088270
jmp 0x180088953
test al, 0x10
je 0x180088953
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x18008899a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e7730
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008899a
jne 0x180088993
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800889a0
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x18008d350
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008d370
test al, 1
je 0x18008d4d2
test al, 2
jne 0x18008d4d2
test al, 8
jne 0x18008d3bc
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18016cbc4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc0], 0
je 0x18008d3dc
lea rax, [rax + 0xc8]
jmp 0x18008d3ea
test al, 0x10
je 0x18008d43f
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x18008d4d2
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
jmp 0x18008d43f
call fcn.1800e0e20
test rax, rax
je 0x18008d4ca
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.18008d290
mov qword [rsi + 0x30], 3
mov eax, dword [0x18016cbc4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc0], 0
je 0x18008d431
lea rax, [rax + 0xc8]
jmp 0x18008d43b
call fcn.1800e0e20
test rax, rax
je 0x18008d43f
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e8370
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008d4d2
jne 0x18008d4be
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18008d481
call fcn.18005bb50
lea rcx, [rsi + 0x30]
call fcn.18008d290
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x18008d4a0
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov rcx, qword [0x18016cb80]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x18008d3fa
ud2
Function at 0x18008de40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008de60
test al, 1
je 0x18008dfc2
test al, 2
jne 0x18008dfc2
test al, 8
jne 0x18008deac
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18016cbc4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc0], 0
je 0x18008decc
lea rax, [rax + 0xc8]
jmp 0x18008deda
test al, 0x10
je 0x18008df2f
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x18008dfc2
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
jmp 0x18008df2f
call fcn.1800e0e20
test rax, rax
je 0x18008dfba
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.18008d290
mov qword [rsi + 0x30], 3
mov eax, dword [0x18016cbc4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc0], 0
je 0x18008df21
lea rax, [rax + 0xc8]
jmp 0x18008df2b
call fcn.1800e0e20
test rax, rax
je 0x18008df2f
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e7730
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008dfc2
jne 0x18008dfae
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18008df71
call fcn.18005bab0
lea rcx, [rsi + 0x30]
call fcn.18008d290
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x18008df90
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov rcx, qword [0x18016cb80]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x18008deea
ud2

Function at 0x180093470
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x200
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180093480
test al, 1
je 0x180093522
test al, 2
jne 0x180093522
test al, 8
jne 0x1800934bb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.180093340
jmp 0x1800934d5
test al, 0x10
je 0x1800934d5
mov rax, qword [rsi + 0x220]
test rax, rax
je 0x180093522
mov rcx, qword [rsi + 0x228]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e8370
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180093522
jne 0x180093518
mov rcx, rsi
add rsp, 0x200
pop rsi
jmp fcn.180093530
nop
add rsp, 0x200
pop rsi
ret
ud2
Function at 0x180093ae0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x200
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180093af0
test al, 1
je 0x180093b92
test al, 2
jne 0x180093b92
test al, 8
jne 0x180093b2b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.180093340
jmp 0x180093b45
test al, 0x10
je 0x180093b45
mov rax, qword [rsi + 0x220]
test rax, rax
je 0x180093b92
mov rcx, qword [rsi + 0x228]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e7730
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180093b92
jne 0x180093b88
mov rcx, rsi
add rsp, 0x200
pop rsi
jmp fcn.180093ba0
nop
add rsp, 0x200
pop rsi
ret
ud2
Function at 0x1800a48a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xf70
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a48b0
test al, 1
je 0x1800a4952
test al, 2
jne 0x1800a4952
test al, 8
jne 0x1800a48eb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800a4e50
jmp 0x1800a4905
test al, 0x10
je 0x1800a4905
mov rax, qword [rsi + 0xf90]
test rax, rax
je 0x1800a4952
mov rcx, qword [rsi + 0xf98]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e8370
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a4952
jne 0x1800a4948
mov rcx, rsi
add rsp, 0xf70
pop rsi
jmp fcn.1800a4960
nop
add rsp, 0xf70
pop rsi
ret
ud2

Function at 0x1800a4f80
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xf70
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a4f90
test al, 1
je 0x1800a5032
test al, 2
jne 0x1800a5032
test al, 8
jne 0x1800a4fcb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800a4e50
jmp 0x1800a4fe5
test al, 0x10
je 0x1800a4fe5
mov rax, qword [rsi + 0xf90]
test rax, rax
je 0x1800a5032
mov rcx, qword [rsi + 0xf98]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1800e7730
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a5032
jne 0x1800a5028
mov rcx, rsi
add rsp, 0xf70
pop rsi
jmp fcn.1800a5040
nop
add rsp, 0xf70
pop rsi
ret
ud2
Function at 0x1800acd90
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800acdd2
mov rdi, qword [rsp + 0x28]
je 0x1800ace3f
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800aceb2
test rax, rax
je 0x1800aceb2
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800ace28
cmp qword [rdi + 0x10], 0x11
jb 0x1800ace16
mov r14, qword [r14 - 8]
mov rcx, qword [0x18016cb80]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x18016cb80]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1800aceb2
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800ace95
movzx eax, byte [0x18016cbc0]
mov rcx, qword [0x18016cb80]
test rcx, rcx
jne 0x1800ace73
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800ace86
mov rcx, rax
mov qword [0x18016cb80], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800ace9b
mov ecx, 1
mov rdx, rbx
call fcn.180106200
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.1800f8be0
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret