joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003da48
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14003da78
xor eax, eax
jmp 0x14003db3b
mov rbp, rbx
cmp word [rax], si
je 0x14003da9d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14003da84
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14003da80
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14003c020
movsxd r14, eax
test eax, eax
jne 0x14003dadb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14003da71
mov rcx, r14
call fcn.140037fec
mov rdi, rax
test rax, rax
jne 0x14003daf4
xor ecx, ecx
call fcn.1400371ac
jmp 0x14003dad0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14003c020
test eax, eax
jne 0x14003db25
mov rcx, rdi
call fcn.1400371ac
jmp 0x14003db2f
xor ecx, ecx
call fcn.1400371ac
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400403bc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140036dd4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14004045d
cmp ebx, dword [rsp + 0x30]
je 0x140040456
test esi, esi
je 0x140040456
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140040431
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14004043e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14004041b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140040442
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14004045f
mov eax, 1
jmp 0x14004045f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140040ec4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140084c60]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140040f1b
cmp word [rdx], r13w
jne 0x140040f1b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140040f20
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140041045
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140041066
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140040f59
mov rdx, r9
mov word [rbx], cx
jmp 0x140040f80
cmp r9, r8
jae 0x140040f90
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140040f3a
jmp 0x140041045
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004103a
cmp dword [rsp + 0x80], esi
je 0x14004103a
lea r8, [0x140084c60]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140041012
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140040fe2
mov word [rbx], r13w
jmp 0x140041042
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140040fef
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140041042
cmp word [rsp + 0x70], r13w
jne 0x14004101f
cmp rbx, r14
je 0x140040fdc
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14003b56c
cmp word [rsp + 0x70], r13w
je 0x140041045
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140084c60]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14004103f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140041045
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x2884210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.02884397
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x2884241
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x2884227
add dl, dl
jne 0x288424e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x28842ae
xor eax, eax
add dl, dl
jne 0x288425d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x2884365
add dl, dl
jne 0x288426e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x288427b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2884288
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2884295
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x28842a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x2884236
mov eax, 1
add dl, dl
jne 0x28842be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x28842cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x28842b3
sub eax, ebx
mov ebx, 1
jne 0x2884304
mov ecx, 1
add dl, dl
jne 0x28842e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x28842f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x28842db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x2884236
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2884320
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x288432d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x2884315
cmp eax, 0x7d00
jae 0x2884353
cmp eax, 0x500
jb 0x288434e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x2884236
cmp eax, 0x7f
ja 0x2884356
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x2884236
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x288438a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x2884236
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000d7ab
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
lea rdi, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rbx, [rsp + 0x2c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call sub.advapi32.dll_GetUserNameW
mov r8d, dword [rbx]
cmp r8, 0x101
jae 0x14000d808
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140004c52
nop
add rsp, 0x230
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x14000d80c
Capabilities:
Get hostname

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
lea rdi, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rbx, [rsp + 0x2c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call sub.kernel32.dll_GetComputerNameW
mov r8d, dword [rbx]
cmp r8, 0x101
jae 0x14000d869
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140004c52
nop
add rsp, 0x230
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x140019fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov esi, ecx
shr esi, 8
lea r8, [rdx + r8*2]
xor edi, edi
cmp rdx, r8
je 0x14001a01c
lea rbx, [rdx + 2]
movzx r15d, byte [rdx + 1]
lea r14, [rdi + r15]
cmp byte [rdx], sil
jne 0x140019ffc
cmp rdi, r14
ja 0x14001a059
cmp r14, rax
ja 0x14001a059
add rdi, r9
xor edx, edx
cmp r15, rdx
je 0x14001a006
lea r12, [rdx + 1]
cmp byte [rdi + rdx], cl
mov rdx, r12
jne 0x140019fe9
jmp 0x14001a00e
mov rdx, rbx
mov rdi, r14
jbe 0x140019fc3
jmp 0x14001a01c
mov rdx, rbx
mov rdi, r14
jmp 0x140019fc3
xor eax, eax
and al, 1
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movzx ecx, cx
add r10, r11
mov al, 1
cmp r11, r10
je 0x14001a010
lea r8, [r11 + 1]
movzx edx, byte [r11]
test dl, dl
js 0x14001a03a
mov r11, r8
jmp 0x14001a051
cmp r8, r10
je 0x14001a059
and edx, 0x7f
shl edx, 8
movzx r8d, byte [r11 + 1]
add r11, 2
or edx, r8d
sub ecx, edx
js 0x14001a010
xor al, 1
jmp 0x14001a024
ud2
Function at 0x140027c5b
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14007cf84
test rbx, rbx
je 0x140027c94
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140027cae
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140027ca6

Function at 0x140027cae
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140027cd4
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140027cbe
mov qword [rcx], rax
ret
Function at 0x14003b53c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x218
movaps xmmword [rsp + 0x200], xmm6
mov r14, r8
mov rdi, rdx
mov r12, rcx
mov qword [rsp + 0x130], r9
mov qword [rsp + 0x158], r9
lea rbx, [rdx + r8]
Function at 0x14003dc5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, r8
mov r8, rdx
xor edx, edx
jmp fcn.14003d4ad
Function at 0x14003f4a7
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdx + 0x20]
lea rcx, [rax - 2]
cmp rcx, 2
jae 0x14003f4d6
mov edx, 1
mov rcx, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
jmp fcn.14003f5d0
test rax, rax
jne 0x14003f5c8
cmp qword [rsi], 0
je 0x14003f4f1
mov rax, qword [rsi + 8]
mov rdx, qword [rax]
and edx, 0xe
jmp 0x14003f4f3
xor edx, edx
mov rcx, rsi
call fcn.14003f5ef
mov rbx, qword [rdi]
lea rdx, [rsp + 0x50]
and dword [rdx], 0
lea rax, [rbx + 8]
lea rcx, [0x1400fb828]
mov qword [rdx + 8], rcx
lea r8, [rsp + 0x38]
and dword [r8], 0
lea rdi, [rsp + 0x3c]
and dword [rdi], 0
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
and qword [rsp + 0x30], 0
mov r8d, 1
mov r9, rdi
call sub.ws2_32.dll_WSARecv
mov r8d, dword [rdi]
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov edx, eax
call fcn.14004000e
mov rax, qword [rdi]
cmp rax, 1
je 0x14003f585
cmp eax, 2
jne 0x14003f5ad
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsi + 0x28]
xor ecx, ecx
call fcn.14003f610
mov qword [rsi + 0x20], 3
mov qword [rsi + 0x28], rdi
jmp 0x14003f59e
cmp byte [rsi + 0x78], 0
je 0x14003f5ad
mov rdx, qword [rsi + 0x28]
xor ecx, ecx
call fcn.14003f610
mov qword [rsi + 0x20], 2
mov edx, 1
mov rcx, rsi
call fcn.14003f5d0
jmp 0x14003f5c8
mov rdx, qword [rsi + 0x28]
xor ecx, ecx
call fcn.14003f610
mov qword [rsi + 0x20], 1
lock inc qword [rbx + 0xe8]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003f95b
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rbx, r9
mov qword [rsp + 0x58], r8
mov rdi, rdx
mov r14, rcx
cmp qword [r9], 0
je 0x14003f98e
mov rax, qword [rbx + 8]
mov rdx, qword [rax]
and edx, 0xd
jmp 0x14003f990
xor edx, edx
mov rcx, rbx
call fcn.14003f5ef
mov rbp, qword [r14]
lea rsi, [rbp + 0x30]
mov r14, qword [rdi]
mov qword [rsp + 0x48], rdi
mov r12, qword [rdi + 0x10]
mov qword [rsp + 0x50], rbx
mov r15b, byte [rbx + 0x78]
lea r13, [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rdi, r12
sub rdi, rbx
jb 0x14003fba0
lea rax, [r14 + rbx]
mov ecx, 0xffffffff
cmp rdi, rcx
cmovb rcx, rdi
mov dword [rsp + 0x70], ecx
mov qword [rsp + 0x78], rax
and dword [rsp + 0x44], 0
mov rcx, qword [rbp]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rsi
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
mov r8d, 1
lea r9, [rsp + 0x44]
call sub.ws2_32.dll_WSASend
mov r8d, dword [rsp + 0x44]
mov rcx, r13
mov edx, eax
call fcn.14004000e
mov rax, qword [rsp + 0x60]
cmp rax, 1
jne 0x14003fa4a
test r15b, r15b
je 0x14003fafe
mov rax, qword [rsp + 0x68]
cmp rax, rdi
je 0x14003fb3b
add rbx, rax
jmp 0x14003f9be
cmp eax, 2
jne 0x14003fb03
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
lea rcx, [rdi + 0x30]
call fcn.14003f732
mov qword [rdi + 0x30], 3
mov qword [rdi + 0x38], rsi
mov edx, 2
mov rcx, rdi
call fcn.14003f5d0
mov rax, qword [rdi + 0x18]
cmp rax, 2
jne 0x14003fb69
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x14003fb69
add rdx, 0x20
lea rdi, [rsp + 0x70]
mov rcx, rdi
call fcn.14003ef0e
cmp qword [rdi], 0
jne 0x14003fba0
mov rdi, qword [rsp + 0x78]
mov bl, byte [rsp + 0x80]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rdi + 0x20]
cmp rax, qword [rdi + 0x18]
jae 0x14003fb8f
mov r8, qword [rdi + 0x10]
imul r9, rax, 0x18
mov qword [r8 + r9], rcx
mov qword [r8 + r9 + 8], rdx
and qword [r8 + r9 + 0x10], 0
inc rax
mov qword [rdi + 0x20], rax
jmp 0x14003fb94
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
lea rcx, [rsi + 0x30]
call fcn.14003f732
mov qword [rsi + 0x30], 1
mov rax, qword [rsp + 0x48]
movups xmm0, xmmword [rax]
movups xmmword [rsi + 0x38], xmm0
mov rax, qword [rax + 0x10]
mov qword [rsi + 0x48], rax
mov qword [rsi + 0x50], rbx
lock inc qword [rbp + 0xe8]
jmp 0x14003fb7a
mov edx, 2
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
call fcn.14003f5d0
lea rcx, [rsi + 0x30]
call fcn.14003f732
and qword [rsi + 0x30], 0
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 8]
mov rcx, r14
jmp 0x14003fb75
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
call fcn.140010c6f
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140010c6f
mov rcx, rdi
mov edx, ebx
call fcn.14003f644
jmp 0x14003fb7a
ud2
Function at 0x1400401e7
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140040213
xor eax, eax
jmp 0x140040218
call fcn.14003f61f
nop
add rsp, 0x38
ret

Function at 0x14004858f
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [rdx + 0x1c8]
cmp qword [rdx + 0x1c0], rax
jb 0x14004872b
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x1b0]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], eax
mov dword [r8 + 4], 1
mov qword [r8 + 8], rcx
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x1f0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14004866a
test eax, eax
je 0x140048689
cmp eax, 0x90317
je 0x14004870b
cmp eax, 0x90321
jne 0x140048713
mov dword [rdi + 0x170], 0x10000
xor ebx, ebx
mov byte [rdi + 0x174], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1c8]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140048523
and qword [rdi + 0x228], 0
mov byte [rsi + 1], bl
jmp 0x140048721
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x228], rax
mov byte [rsi + 1], 0
jmp 0x14004870f
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x1b0]
mov rdx, qword [rdi + 0x1c0]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x190]
and qword [rdi + 0x1a0], 0
call fcn.140048739
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.1400108e9
and qword [rdi + 0x1a8], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1c8]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140048523
xor eax, eax
cmp qword [rdi + 0x1c8], rbx
sete al
mov qword [rdi + 0x228], rax
mov byte [rsi + 1], 0
jmp 0x140048721
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x140048721
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x140049571
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [rdx + 0xc8]
cmp qword [rdx + 0xc0], rax
jb 0x140049707
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0xb0]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], eax
mov dword [r8 + 4], 1
mov qword [r8 + 8], rcx
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0xf0]
ud2
Function at 0x1400498e2
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, r9
mov rdi, rdx
mov rsi, rcx
mov r13, qword [rsp + 0xe0]
cmp dword [rdx], 2
jne 0x140049924
add rdi, 8
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.140097e41
jmp 0x140049aee
mov qword [rdi + 0x68], r8
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.140048905
mov eax, dword [rbx]
cmp eax, 2
je 0x140049aca
test eax, eax
je 0x140049a7d
mov rdx, qword [rdi + 0xe8]
cmp rdx, qword [rdi + 0xe0]
jne 0x140049ab4
mov r12d, dword [rsp + 0x2c]
mov r14, qword [rsp + 0x30]
mov eax, r14d
shr r14, 0x20
cmp r13, r14
cmovb r14, r13
lea r13, [r14 + r12]
add rax, r13
lea rbp, [rdi + 0xd0]
cmp rdx, rax
jae 0x14004999c
mov rcx, rbp
mov rdx, rax
call fcn.140011fd7
mov rdx, qword [rdi + 0xe0]
mov rcx, qword [rbp]
mov r8, r12
mov r9, r13
call fcn.140048739
cmp rdx, r14
jne 0x140049b16
mov rcx, rax
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rdi + 0xe0]
cmp rdx, r12
jb 0x140049b12
mov r15, qword [rdi + 0xd0]
mov rcx, r15
mov r8, r12
mov r9, r13
call fcn.140048739
mov rcx, qword [rdi + 0xe0]
cmp rcx, r13
jb 0x140049b12
xor r8d, r8d
shl rax, 0x20
or rax, 2
jmp 0x140049acf
movabs rax, 0x8009031700000002
jmp 0x140049acf
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rdi + 0xe0], rax
jb 0x140049aa5
mov qword [rdi + 0xe0], rax
and qword [rdi + 0xe8], 0
mov qword [rdi + 0x130], r14
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.140049777
cmp qword [rbx], 0
je 0x140049b02
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov eax, 1
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rcx, rsi
call fcn.140048888
and qword [rdi + 0x68], 0
mov rax, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdi + 0x130]
mov qword [rsp + 0x30], rax
xor eax, eax
jmp 0x140049ad9
ud2
call fcn.140010a13
ud2
Function at 0x140049b6a
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r13, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rdx + 0x168], r8
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.14004773f
mov eax, dword [rbx]
cmp eax, 2
je 0x140049d31
test eax, eax
je 0x140049ce4
mov rdx, qword [rsi + 0x1e8]
cmp rdx, qword [rsi + 0x1e0]
jne 0x140049d1b
mov rcx, qword [rsp + 0xe0]
mov r15d, dword [rsp + 0x2c]
mov r14, qword [rsp + 0x30]
mov eax, r14d
shr r14, 0x20
cmp rcx, r14
cmovb r14, rcx
lea r12, [r14 + r15]
add rax, r12
lea rbp, [rsi + 0x1d0]
cmp rdx, rax
jae 0x140049c03
mov rcx, rbp
mov rdx, rax
call fcn.140011fd7
fild dword [rbx - 0x74b70004]
xchg esi, eax
loopne 0x140049c02
add byte [rax], al
mov rcx, qword [rbp]
mov r8, r15
clc
mov r9, r12
call fcn.140048739
invalid
jmp 0x140049c10
dec dword [rcx + rdi - 0xe]
jne 0x140049d7d
mov rcx, rax
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsi + 0x1e0]
cmp rdx, r15
jb 0x140049d79
mov r13, qword [rsi + 0x1d0]
mov rcx, r13
mov r8, r15
mov r9, r12
call fcn.140048739
mov rcx, qword [rsi + 0x1e0]
cmp rcx, r12
jb 0x140049d79
xor r8d, r8d
test rax, rax
cmove edx, r8d
sub ecx, r12d
add r12, qword [rsi + 0x1d0]
xorps xmm0, xmm0
push rdi
ror byte [rdi], 0x11
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x2c], 7
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], 6
mov qword [rsp + 0x50], r12
movabs rax, 0x400000000
lea r8, [rsp + 0x68]
mov qword [r8], rax
mov qword [r8 + 8], rbx
lea rcx, [rsi + 0x1f0]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x140049cf0
shl rax, 0x20
or rax, 2
jmp 0x140049d36
movabs rax, 0x8009031700000002
jmp 0x140049d36
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rsi + 0x1e0], rax
jb 0x140049d0c
mov qword [rsi + 0x1e0], rax
and qword [rsi + 0x1e8], 0
mov qword [rsi + 0x230], r14
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rsi
call fcn.1400482dc
cmp qword [rbx], 0
je 0x140049d69
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov eax, 1
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rcx, rdi
call fcn.140048888
and qword [rsi + 0x168], 0
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x230]
mov qword [rsp + 0x30], rax
xor eax, eax
jmp 0x140049d40
ud2
call fcn.140010a13
ud2
Function at 0x14004d0a9
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rdx
mov eax, dword [rcx]
mov dword [rsp + 0x24], eax
mov rax, qword [rdx + 0x10]
or rax, qword [rdx]
jne 0x14001ad79
lea rax, [rsp + 0x25]
lea rcx, [rsp + 0x26]
lea rdx, [rsp + 0x27]
lea r8, [rsp + 0x24]
lea r9, [rsp + 0x70]
mov qword [r9], r8
lea r8, [0x140019941]
mov qword [r9 + 8], r8
mov qword [r9 + 0x10], rax
mov qword [r9 + 0x18], r8
mov qword [r9 + 0x20], rcx
mov qword [r9 + 0x28], r8
mov qword [r9 + 0x30], rdx
mov qword [r9 + 0x38], r8
lea rax, [0x1400a7f50]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov eax, 4
mov qword [r8 + 8], rax
and qword [r8 + 0x20], 0
mov qword [r8 + 0x10], r9
mov qword [r8 + 0x18], rax
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.140018e0f
jmp 0x14001ae07
lea rcx, [rsp + 0x28]
and qword [rcx], 0
lea rax, [rsp + 0x25]
lea rdx, [rsp + 0x26]
lea r8, [rsp + 0x27]
lea r9, [rsp + 0x24]
lea r10, [rsp + 0x70]
mov qword [r10], r9
lea r9, [0x140019941]
mov qword [r10 + 8], r9
mov qword [r10 + 0x10], rax
mov qword [r10 + 0x18], r9
mov qword [r10 + 0x20], rdx
mov qword [r10 + 0x28], r9
lea rax, [0x1400a7f50]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov eax, 4
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
mov qword [r10 + 0x30], r8
mov qword [r10 + 0x38], r9
mov qword [rdx + 0x10], r10
mov qword [rdx + 0x18], rax
call fcn.14001b231
test al, al
jne 0x14001ae11
mov r8, qword [rsp + 0x28]
cmp r8, 0x10
jae 0x14001ae11
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140017683
nop
add rsp, 0xb0
pop rsi
ret
ud2
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
mov rbx, rdx
mov qword [rsp + 0x40], rcx
movzx eax, byte [rdx + 0x1e1]
test eax, eax
mov qword [rsp + 0x48], r8
je 0x14004d0fe
cmp eax, 3
jne case.0x14004d0fc.1
mov r13, r8
lea r12, [rbx + 0xc0]
movzx eax, byte [rbx + 0xf8]
lea rcx, [0x1400fd124]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rbx + 0x1c8]
mov qword [rbx + 0x1a0], rax
movups xmm0, xmmword [rbx + 0x1d0]
movups xmmword [rbx + 0x1a8], xmm0
mov cl, byte [rbx + 0x1e2]
mov byte [rbx + 0x1e0], cl
and qword [rbx + 0x1b8], 0
mov qword [rbx + 0x1c0], rax
xor r13d, r13d
cmp eax, 9