joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov r8, rdx
mov rdx, rcx
mov qword [rsp + 0x20], 1
lea r9, [0x1401690d3]
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.140026140
cmp qword [rsi], 0
je 0x140001d93
lea rdx, [rsp + 0x58]
cmp qword [rdx + 0x30], 0xffffffffffffffff
mov r8, qword [rdx + 0x40]
mov r9, qword [rdx + 0x48]
mov rax, qword [rdx + 0x50]
mov rcx, qword [rdx + 0x58]
je 0x140001e86
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x140001e95
mov bpl, byte [rsp + 0x6a]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov r15b, byte [rsp + 0x68]
xor r14d, r14d
test bpl, bpl
jne 0x140001eb1
mov eax, r15d
xor al, 1
mov byte [rsp + 0x68], al
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140001ef4
test rax, rax
je 0x140001ed5
test rdx, rdx
je 0x140001ea1
mov r8b, byte [rax]
movzx ecx, r8b
test cl, cl
jns 0x140001e40
mov edx, ecx
and edx, 0x1f
movzx r9d, byte [rax + 1]
and r9d, 0x3f
cmp cl, 0xdf
jbe 0x140001e31
movzx ecx, byte [rax + 2]
shl r9d, 6
and ecx, 0x3f
or ecx, r9d
cmp r8b, 0xf0
jb 0x140001e3b
movzx eax, byte [rax + 3]
and edx, 7
shl edx, 0x12
shl ecx, 6
and eax, 0x3f
or eax, ecx
or eax, edx
mov ecx, eax
jmp 0x140001e40
shl edx, 6
or edx, r9d
mov ecx, edx
jmp 0x140001e40
shl edx, 0xc
or ecx, edx
test r15b, r15b
jne 0x140001ea6
cmp ecx, 0x110000
je 0x140001eb1
mov eax, 1
cmp ecx, 0x80
jb 0x140001e76
mov eax, 2
cmp ecx, 0x800
jb 0x140001e76
cmp ecx, 0x10000
mov eax, 4
sbb rax, 0
add rsi, rax
mov qword [rsp + 0x58], rsi
mov r15b, 1
jmp 0x140001db5
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x38]
call fcn.140001f26
jmp 0x140001eb6
test r15b, r15b
je 0x140001ed0
mov qword [rsp + 0x40], rsi
mov r14d, 1
mov qword [rsp + 0x38], r14
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x140001eb1
lea rax, str._rustc_a28077b28a02b92985b3a3faecf92813155f1ea1librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
mov r9, rdi
call fcn.14011ddd0
ud2
Function at 0x14000261d
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov bx, 0x1337
test r8w, r8w
jne 0x140002746
lea rbx, [rsp + 0x24]
and dword [rbx], 0
mov ecx, 5
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
mov r15d, dword [rbx]
test r15, r15
je 0x140002795
mov rcx, r15
mov dl, 1
call fcn.1400b6058
mov rbx, rax
mov r14, rdx
lea r8, [rsp + 0x24]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x1400027c7
mov eax, dword [rsp + 0x24]
lea rcx, [r15 - 1]
cmp rcx, rax
jne 0x1400027f9
lea rcx, [r15 + r15]
xor eax, eax
test rcx, rcx
je 0x1400026bc
cmp word [rbx + rax*2], 0
je 0x1400026b9
inc rax
add rcx, 0xfffffffffffffffe
jmp 0x1400026a4
mov r15, rax
lea r12, [rsp + 0x28]
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1400bc080
mov rcx, qword [r12]
mov rdx, qword [r12 + 8]
call fcn.14000f090
mov al, byte [0x1401e3c78]
mov ecx, 0x1b
mov edx, 1
call fcn.14000e9f0
test rax, rax
je 0x140002830
mov r15, rax
movups xmm0, xmmword [0x140124a83]
movups xmmword [rax + 0xb], xmm0
movups xmm0, xmmword [str.safeupdate_rev2_inso_teaserFailed_building_the_Runtime]
movups xmmword [rax], xmm0
test r14, r14
je 0x140002725
mov edx, 2
mov rcx, rbx
call fcn.14000ea80
mov edx, 0x1b
mov rcx, r15
mov r8w, 1
call fcn.14000261d
mov ebx, eax
mov edx, 0x1b
mov rcx, r15
call fcn.14000f090
xor eax, eax
mov ecx, 0xff
cmp rsi, rax
je 0x140002785
movzx edx, byte [rdi + rax]
mov r8d, ebx
and r8d, ecx
xor r8d, edx
mov edx, r8d
shl edx, 4
and edx, ecx
xor edx, r8d
shrd bx, dx, 8
mov r8d, edx
shr r8d, 4
shl edx, 3
xor edx, r8d
xor edx, ebx
inc rax
mov ebx, edx
jmp 0x14000274d
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.issue_with_buffer_size
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, str._rustc_a28077b28a02b92985b3a3faecf92813155f1ea1librarycore_srccharmethods.rs
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.srcmain.rs
jmp 0x140002829
lea rax, str.syscall_fail
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, str._rustc_a28077b28a02b92985b3a3faecf92813155f1ea1librarycore_srccharmethods.rs
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.srcmain.rs
jmp 0x140002829
lea rax, str.issue_with_size
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, str._rustc_a28077b28a02b92985b3a3faecf92813155f1ea1librarycore_srccharmethods.rs
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.srcmain.rs
call fcn.14011d6a0
ud2
mov ecx, 1
mov edx, 0x1b
call fcn.14011cc70
ud2
Function at 0x140025bd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140025c60
cmp r11, r10
ja 0x140025cd6
cmp r10, rdx
ja 0x140025cea
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140025c62
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140025c40
jmp 0x140025cc4
ja 0x140025c6a
mov r11, r10
cmp rax, r8
jne 0x140025c04
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140025ca0
mov rdi, r8
sub ecx, edx
jns 0x140025cbb
jmp 0x140025cc6
cmp r8, rsi
je 0x140025cfb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140025cc6
xor al, 1
cmp rdi, rsi
jne 0x140025c80
jmp 0x140025cc6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14011da70
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14011d7e0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_a28077b28a02b92985b3a3faecf92813155f1ea1library_std_src_synconce.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14011d860
ud2

Function at 0x14002d12e
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x14002d154
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x14002d13e
mov qword [rcx], rax
ret

Function at 0x14002d23c
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14002d103
test rbx, rbx
je 0x14002d275
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14002d12e
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14002d126
Function at 0x14004a30b
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x1401e3b10]
test r14, r14
jne 0x14004a442
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14004a375
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004a375
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004a375
mov r15, rax
xor ebx, ebx
jmp 0x14004a3fa
lea rcx, [0x140162868]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14004a456
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004a456
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004a456
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004a456
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x14004a456
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.1400db051
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x1401e3b10], r14
je 0x14004a442
mov rdi, rax
cmp qword [r14], 0
je 0x14004a432
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 8
mov rcx, r14
call fcn.14000ea80
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.8_src_thread_parkerwindowsmod.rs
lea r8, [0x140162970]
mov edx, 0x5b
call fcn.14011e8f9
ud2
Function at 0x14004be2a
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.14004df8d
test rax, rax
je 0x14004be62
mov edx, 4
mov rcx, rax
call fcn.14000ea80
jmp 0x14004be9b
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.14004b2a7
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.14004b2fc
Function at 0x14004df8d
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r12d, 0x20
mov r13d, 0xffffffff
mov rbp, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.advapi32.dll_SystemFunction036]
test r12, r12
je 0x14004e020
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call rbp
cmp eax, 0xc0000000
jb 0x14004dfba
mov ebx, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x14004dfba
xor ebx, 0x80000000
je 0x14004e020
mov al, byte [0x1401e3c78]
mov ecx, 4
mov edx, 4
call fcn.14000e9f0
test rax, rax
je 0x14004e033
mov dword [rax], ebx
jmp 0x14004e022
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.14011cc70
ud2
Function at 0x140068347
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6c8
mov r15, r8
mov rdi, rdx
mov qword [rsp + 0x78], rcx
mov rdx, qword [rdx + 0x3f0]
add rdx, 0x10
lea rsi, [rsp + 0x180]
mov rcx, rsi
call fcn.1400977b2
lea rdx, str.C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001fh2_0.3.21_srcproto_streams_streams.rs
mov rcx, rsi
call case.0x14009e4f9.75
mov rcx, qword [rax + 0x168]
or rcx, qword [rax + 0x178]
je 0x1400683a9
mov rcx, rax
call fcn.140047faf
jmp case.0x14001c89e.1217
mov rsi, qword [rax + 0x218]
mov rcx, rax
call fcn.140047faf
cmp rsi, 1
ja case.0x14001c89e.1217
mov rdx, qword [rdi + 0x3f0]
add rdx, 0x10
lea rcx, [rdi + 0x390]
call fcn.1400713be
mov rdx, qword [rdi + 0x368]
cmp rdx, 2
jne 0x1400683f0
mov qword [rsp + 0x180], 2
jmp 0x14006843f
lea rsi, [rdi + 0x368]
lea rbx, [rdi + 0x380]
mov rcx, qword [rdi + 0x370]
add byte [rax - 0x75], cl
xchg dword [rax + 3], edi
add byte [rax], al
add byte [rax - 0x7b], cl
invalid
je 0x14006841f
mov rdx, rax
call fcn.140078518
mov rcx, rax
mov rax, rdx
mov rdx, rbx
call qword [rax + 0x70]
mov rbx, rax
lea r14, [rsp + 0x180]
mov rcx, r14
mov rdx, rsi
call fcn.1400ceb76
mov qword [r14 + 0x18], rbx
mov rax, qword [rdi + 0x388]
mov rcx, qword [rsp + 0x180]
mov rdx, qword [rsp + 0x188]
movups xmm0, xmmword [rsp + 0x190]
add dword [rax], eax
add byte [rdi], cl
sub dword [rsp + 0x460], eax
mov qword [rsp + 0x450], rcx
add byte [rax], al
mov qword [rsp + 0x458], rdx
and al, 0x58
add al, 0
add byte [rax - 0x77], cl
test byte [rax + rsi*2], ah
add al, 0
add byte [rax], al
cmp dword [rsp + 0x450], 2
push rax
add al, 0
add byte [rdx], al
je 0x14006849d
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x450]
call fcn.1400ceba7
mov qword [rsp + 0x5d8], 2
and qword [rsp + 0x5f8], 0
add byte [rax], al
lea r14, [rdi + 0x48]
lea rax, [rdi + 0x400]
mov qword [rsp + 0x170], rax
lea rax, [rdi + 0x390]
mov qword [rsp + 0x178], rax
lea r12, [rsp + 0x2b8]
lea rbp, [rsp + 0x180]
add byte [rax], al
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x68], r15
mov qword [rsp + 0xc8], r14
Function at 0x140078304
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x98]
mov rcx, qword [rdx + 0x80]
mov rdx, qword [rdx + 0x90]
lea r9, str.C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
call fcn.1400780a6
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xc0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x1400783e2
test eax, eax
je 0x1400783fe
cmp eax, 0x90317
je 0x140078476
cmp eax, 0x90321
jne 0x14007847e
mov dword [rdi + 0x40], 0x10000
xor ebx, ebx
mov byte [rdi + 0x44], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1400782a4
and qword [rdi + 0xf8], 0
mov byte [rsi + 1], bl
jmp 0x14007848c
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x14007847a
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x80]
mov rdx, qword [rdi + 0x90]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x60]
and qword [rdi + 0x70], 0
call fcn.1400784a0
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.14001056a
and qword [rdi + 0x78], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1400782a4
xor eax, eax
cmp qword [rdi + 0x98], rbx
sete al
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x14007848c
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x14007848c
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007874e
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x198]
mov rcx, qword [rdx + 0x180]
mov rdx, qword [rdx + 0x190]
xchg edx, eax
nop
add dword [rax], eax
add byte [rbp + rcx*4 + 0xd], cl
imul esi, ebx, 0x2ae8000e
stc
invalid
push qword [rcx]
leave
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1c0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x140078832
test eax, eax
je 0x140078851
cmp eax, 0x90317
je 0x1400788d2
cmp eax, 0x90321
jne 0x1400788da
mov dword [rdi + 0x140], 0x10000
xor ebx, ebx
mov byte [rdi + 0x144], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1400786ee
and qword [rdi + 0x1f8], 0
mov byte [rsi + 1], bl
jmp 0x1400788e8
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x1400788d6
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x180]
mov rdx, qword [rdi + 0x190]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x160]
and qword [rdi + 0x170], 0
call fcn.1400784a0
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.14001056a
and qword [rdi + 0x178], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
jl 0x1400788c2
push rsp
add eax, 0x98978b48
add dword [rax], eax
add byte [rbx + 0xf502444], cl
ret
sub rdx, rax
mov rcx, rdi
call fcn.1400786ee
xor eax, eax
cmp qword [rdi + 0x198], rbx
sete al
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x1400788e8
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x1400788e8
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400788f2
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne 0x140078904
add rcx, 8
jmp fcn.1400cbfa0
invalid
invalid
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
mov qword [rcx + 0x38], rdx
mov rcx, r8
call fcn.140078a96
mov rbx, rax
mov r14, rdx
lea r15, [rsp + 0x28]
mov rcx, rsi
call fcn.140078b6d
add byte [rax], al
test rdx, rdx
jne 0x1400789a7
mov rcx, r15
mov rdx, rsi
mov edx, esi
call fcn.140077440
mov eax, dword [rsp + 0x28]
cmp eax, 2
je 0x140078a36
test eax, eax
je 0x1400789a7
cmp qword [rsi + 0xf8], 0
je 0x14007898a
mov rcx, r15
mov rdx, rsi
call fcn.1400780df
cmp qword [rsp + 0x28], 0
jne 0x140078a36
cmp qword [rsp + 0x30], 0
je 0x1400789a7
and qword [rsi + 0xf8], 0
mov rcx, r15
mov rdx, rsi
call fcn.140078304
cmp byte [rsp + 0x28], 0
jne 0x140078a36
cmp byte [rsp + 0x29], 0
je 0x140078930
mov rcx, rsi
call fcn.140078b6d
mov r15, rdx
test rax, rax
je 0x140078a3b
mov r13, rax
cmp r14, r15
mov r12, r15
cmovb r12, r14
lea r9, str.C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
mov rcx, r12
mov rdx, rbx
mov r8, r14
call case.0x14006202e.504
mov rbx, rax
mov r14, rdx
lea r9, str.C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
mov rcx, r13
mov rdx, r15
mov r8, r12
loopne 0x1400789dc
movabs eax, dword [0x8d48d18949fff98d]
or eax, 0xee9e6
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, r14
mov r8, rax
call fcn.1400894e9
mov rax, qword [rsi + 0x78]
add rax, r12
cmp rax, qword [rsi + 0x70]
ja 0x140078a7c
mov qword [rsi + 0x78], rax
mov rcx, rdi
mov rdx, r12
call fcn.140078b03
xor r15d, r15d
jmp 0x140078a62
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov rcx, r15
call fcn.140001397
cmp al, 0xd
jne 0x140078a62
and qword [rsi + 0x38], 0
xor eax, eax
mov rdx, r15
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
lea r8, str.C:Users_vagrant.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rs
mov edx, 0x3b
call fcn.14011d860
ud2
Function at 0x140085b0f
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x50]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.1400859e0
lea r13, [rsp + 0x30]
mov dword [r13], 0x800
lea r15, [rsp + 0x34]
and dword [r15], 0
mov ecx, 0x800
call fcn.1400b7389
mov rbx, rax
lea r12, [rsp + 0x38]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi]
mov rbp, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rbp
cmp eax, 0xea
jne 0x140085bb1
mov edx, dword [rsp + 0x30]
mov rcx, r12
call fcn.1400104aa
mov rbx, qword [rsp + 0x38]
jmp 0x140085b7f
test eax, eax
jne 0x140085bd3
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x140085bf1
movabs rax, 0xde00000002
jmp 0x140085bdb
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.14000f090
jmp 0x140085c05
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
call fcn.1400b66a9
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140089460
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.140089402
cmp eax, 1
je 0x140089496
mov eax, eax
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
cmp eax, 2
jne 0x1400894ab
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400e5620
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400e5c40
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140102970
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [rdi]
call fcn.1400e5880
call fcn.1400e4f00
movdqu xmmword [rsi], xmm0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
movups xmm2, xmmword [rcx]
mov eax, dword [r8 + 0xf0]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
lea r8, [r8 + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec eax
movups xmm1, xmmword [r8]
lea r8, [r8 + 0x10]
jne 0x1400e5c5a
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rdx], xmm2
pxor xmm2, xmm2
repz ret
push rbx
push rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x1401e30a8]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rsi, rdx
mov rbx, rcx
mov rdx, r8
lea rcx, [rsp + 0x60]
mov rdi, r8
call fcn.140102e10
mov r8d, 1
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140103ae0
mov edx, dword [rdi + 0xf0]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140102cc0
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
call fcn.140102ec0
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14010d1e0
add rsp, 0x430
pop rdi
pop rsi
pop rbx
ret