joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d63d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
mov rsi, rdx
mov rdi, rcx
mov dl, byte [rdx + 0xb8]
movzx eax, byte [rsi + 0xd8]
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14007d698
cmp eax, 1
jne 0x14007d6b5
cmp dl, 7
jne 0x14007d698
mov cl, 1
mov dl, 4
call fcn.1400210cc
lea rcx, [rsp + 0x180]
mov qword [rcx], 3
mov qword [rcx + 8], rax
jmp 0x14007d919
movzx eax, byte [rsi + 0x60]
test rax, rax
mov byte [rsp + 0x34], dl
je 0x14007d71d
cmp eax, 1
jne 0x14007d725
mov r12b, byte [rsi + 0x61]
mov r13b, 1
xor ebp, ebp
jmp 0x14007d723
mov cl, 1
mov dl, 3
call fcn.1400210cc
mov rdi, rax
mov al, byte [0x1401660a0]
mov ecx, 0xa0
mov edx, 8
call fcn.14003e6a0
test rax, rax
je 0x14007e00e
mov rbx, rax
mov qword [rax], 3
mov qword [rax + 8], rdi
mov al, byte [0x1401660a0]
mov ecx, 8
mov edx, 8
call fcn.14003e6a0
test rax, rax
je 0x14007e01d
mov rdi, rax
mov qword [rax], rbx
lea rbx, [0x140121fd8]
jmp 0x14007d924
xor r13d, r13d
mov bpl, 1
jmp 0x14007d760
call fcn.140022aff
mov r14, rax
mov rax, qword [rsi + 0x68]
lea rdx, [rax + 0x18]
mov r10, qword [rax]
mov r8, qword [rax + 8]
mov r9, qword [rax + 0x10]
lea rbx, [rsp + 0x60]
mov rcx, rbx
call qword [r10]
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov r13b, 2
xor ebp, ebp
lea rdx, [rsi + 0x88]
mov rax, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
lea rbx, [rsp + 0x190]
mov rcx, rbx
call qword [rax]
lea rdx, [rsi + 0xa8]
mov rax, qword [rsi + 0x90]
mov r8, qword [rsi + 0x98]
mov r9, qword [rsi + 0xa0]
lea r15, [rsp + 0x60]
mov rcx, r15
call qword [rax]
movzx eax, word [rsi + 0xb0]
mov word [r15 + 0x20], ax
mov byte [rbx - 0x10], r13b
mov byte [rbx - 0xf], r12b
mov qword [rbx - 8], r14
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm1
mov rax, qword [r15 + 0x20]
mov qword [rbx + 0x40], rax
mov rbx, qword [rbx + 0x10]
test bpl, bpl
je 0x14007d839
test rbx, rbx
je 0x14007d85c
cmp byte [rsp + 0x34], 7
test rbx, rbx
je 0x14007d85c
test r13b, r13b
je 0x14007d931
movzx eax, r13b
cmp eax, 1
jne 0x14007d935
mov bpl, 1
jmp 0x14007d933
xor ebp, ebp
jmp 0x14007d96b
call fcn.140022aff
mov ecx, 8
mov edx, 0xa0
call fcn.1400ff140
mov ecx, 8
mov edx, 8
call fcn.1400ff140
Function at 0x14009dc80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140004380
cmp rax, rcx
je 0x14009dca5
cmp rdx, 4
jae 0x14009dca8
xor eax, eax
xor r8d, r8d
jmp 0x14009dd40
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140105700]
movdqa xmm3, xmmword [0x140105710]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14009dcd0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14009dd57
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14009dd40
ret

Function at 0x1400a168f
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]

Function at 0x1400a198b
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
xorps xmm0, xmm0
push rdi
ror byte [rdi], 0x29
and al, 0x50
push rax
Function at 0x1400a3146
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400a3173
xor eax, eax
jmp 0x1400a3181
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1400a5110
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x14014cf20]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400a5183
mov rcx, rdi
Function at 0x1400aeff0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rsi, rcx
mov r14, qword [rdx]
mov esi, dword [rdx]
Function at 0x1400b0680
Capabilities:
Create process on windows
Encode data using base64
Encrypt data using speck
Get common file path
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x678
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x5e0], xmm6
mov qword [rbp + 0x5d8], 0xfffffffffffffffe
mov qword [rbp + 0x440], r8
add al, 0
add byte [rax - 0x77], cl
invalid
call 0x14f0b06c1
mov dh, 0x82
movabs al, byte [0x560958948000000]
add byte [rax], al
mov rbx, qword [rdx + 0x98]
test al, al
jne 0x1400b06ed
test rbx, rbx
jne 0x1400b06ed
mov qword [rbp + 0x408], 0
xor r12d, r12d
jmp 0x1400b1321
mov qword [rbp + 0x4d0], 0
mov qword [rbp + 0x4e0], 0
test al, al
jne 0x1400b0926
mov qword [rbp + 0x598], rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x1400b3ec6
lea rbx, [rbp]
lea rsi, [rbp + 0x450]
lea r14, [rbp + 0x568]
mov qword [rbp + 0x5a0], rax
mov rdi, rax
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x568], rax
lea rax, [rbp + 0x568]
mov qword [rbp + 0x450], rax
lea rax, [fcn.1400aa3e0]
mov qword [rbp + 0x458], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
mov qword [rbp], 0
lea rax, [rbp + 0x450]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 1
lea rdx, str.library_std_src_syswindowsos.rs
lea rcx, [rbp - 0x20]
call fcn.1400ff5b0
jmp 0x1400b402a

Function at 0x1400b7520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
lea rcx, [rsp + 0x40]
and al, 0x40

Function at 0x1400b8a00
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x68], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x64], ecx
xor edi, edi
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor eax, eax
mov qword [rbp - 8], rax
nop
Function at 0x1400b9750
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1401660a0]
mov ecx, 0x10
mov edx, 8
call fcn.14003e6a0
test rax, rax
je 0x1400b9846
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400b9950]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400b9838
mov rcx, qword [rbx]
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
call qword [rax]
mov rax, qword [rbp - 0x18]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x1400b9811
cmp qword [rax + 0x10], 0x11
jae 0x1400b97fa
mov r8, qword [rbp - 0x10]
jmp 0x1400b9802
mov r8, qword [rbp - 0x10]
mov r8, qword [r8 - 8]
mov rcx, qword [0x140165ff0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x140165ff0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add bh, bh
adc eax, 0x4b837
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
Function at 0x1406619c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1406619cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1406619dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1406619c5
lea eax, [rcx + 1]
jmp 0x1406619eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1406619fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1406619e4
sub eax, 3
jb 0x140661a1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140661a6d
sar eax, 1
movsxd rbp, eax
jb 0x140661a54
jmp 0x140661a2c
add ebx, ebx
jne 0x140661a2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140661a54
inc ecx
add ebx, ebx
jne 0x140661a3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140661a54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140661a4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140661a3c
add ecx, 2
jmp 0x140661a59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140661982
jmp 0x1406619cd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2a2e00
mov dl, 0x3d
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140661ab9
cmp rsi, rcx
jae 0x140661ac1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140661aa0
cmp al, 0x8f
ja 0x140661aa0
cmp byte [rsi - 2], 0xf
je 0x140661aa6
sub al, 0xe8
cmp al, 1
ja 0x140661a8a
cmp rsi, rcx
jae 0x140661ac1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140661a90
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140661ac1
lodsb al, byte [rsi]
jmp 0x140661aa0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x65d000]
mov eax, dword [rdi]
or eax, eax
je 0x140661b2a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x662b30]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140661ace
jns 0x140661b03
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140661b0d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140661b24
mov qword [rbx], rax
add rbx, 8
jmp 0x140661aee
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140661b6e
cmp al, 0xef
ja 0x140661b56
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140661b36
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140661b45
mov eax, dword [rdi]
add rdi, 4
jmp 0x140661b45
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140661bc2
sub rsp, 0xffffffffffffff80
jmp 0x14027dec8
Function at 0x14000d948
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call fcn.140139d60
mov rcx, rax
add rsp, 0x28
jmp 0x14012f970
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140138f40
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x14012f9d5
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.14013a840
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
jne 0x14012f9e0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x14012fa0a
test rdi, rdi
je 0x14012fa36
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140014b80
xor eax, eax
jmp 0x14012f9d8
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x14012f9d8
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140014b80
jmp 0x14012f9d5
xor eax, eax
jmp 0x14012f9d8

Function at 0x140014c66
Capabilities:
Get hostname

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0xc]
and dword [rdi], 0
push 5
pop rcx
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_GetComputerNameExW
mov edx, dword [rdi]
lea rdi, [rbp - 0x48]
mov rcx, rdi
xor r8d, r8d
call fcn.140014bb8
cmp qword [rdi], 0
jne 0x140014d27
mov rax, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rdi
and qword [rbp - 0x18], 0
push 5
pop rcx
lea r8, [rbp - 0xc]
mov rdx, rdi
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x140014cf5
mov r8d, dword [rbp - 0xc]
mov qword [rbp - 0x18], r8
lea rcx, [rbp - 0x48]
mov rdx, rdi
call fcn.140127310
movups xmm0, xmmword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x140014d13
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
lea rcx, [rbp - 0x28]
call fcn.140014c4b
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x40]
test rcx, rcx
jne 0x140014d35
call fcn.140143290
mov rdx, qword [rbp - 0x38]
call fcn.14015a860
int3
Function at 0x140083051
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov rdx, r8
mov r8, r9
call fcn.140035b7a
mov dword [rbp - 0xc], 0x800
and dword [rbp - 0x10], 0
lea rcx, [rbp - 0x28]
mov edx, 0x800
xor r8d, r8d
call fcn.1400f9bf8
cmp qword [rbp - 0x28], 0
jne 0x14008316c
lea rdi, [rbp - 0x28]
movups xmm0, xmmword [rdi + 8]
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
mov rbx, qword [rbx]
lea r15, [rbp - 0xc]
lea r14, [rbp - 0x10]
mov r12, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rdx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
mov rcx, rbx
xor r8d, r8d
mov r9, r14
call r12
cmp eax, 0xea
jne 0x1400830fc
mov edx, dword [rbp - 0xc]
mov rcx, rdi
call fcn.140099f80
jmp 0x1400830ca
test eax, eax
jne 0x14008311b
mov eax, dword [rbp - 0xc]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 0x10]
cmp eax, 0xb
jbe 0x14008313f
movabs rax, 0xde00000002
jmp 0x140083123
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
lea rcx, [rbp - 0x28]
call fcn.1400015e4
jmp 0x140083151
mov rcx, qword [rbp - 0x18]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
lea rcx, [rbp - 0x40]
call fcn.140014170
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 0x20]
test rcx, rcx
jne 0x14008317c
call fcn.140143290
jmp 0x140083185
mov rdx, qword [rbp - 0x18]
call fcn.14015a860
ud2
Function at 0x140085110
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x60]
mov rdx, qword [rdx + 0x78]
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
call fcn.140083c52
mov r9, rdx
lea r14, [rsp + 0x78]
mov ebp, 1
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.14009d682
lea r15, [rsp + 0x88]
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.14009d682
lea r12, [rsp + 0x68]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.14009d682
lea r13, [rsp + 0x50]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call fcn.14009d682
movups xmm0, xmmword [r14]
movaps xmmword [r13 - 0x30], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [r13 - 0x20], xmm0
movups xmm0, xmmword [r12]
movaps xmmword [r13 - 0x10], xmm0
lea r14, [rsp + 0x68]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, r14
call fcn.14009d699
lea rcx, [rdi + 0xf0]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x1400852b3
test eax, eax
je 0x140085245
cmp eax, 0x90317
je 0x1400852ad
cmp eax, 0x90321
jne 0x1400852cc
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1400843b4
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x1400852da
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi + 0x68]
mov r8d, dword [rsp + 0x30]
add r8, rdx
lea r14, [rdi + 0x40]
and qword [rdi + 0x50], 0
mov rcx, rbx
call fcn.140083863
mov r8, rdx
mov rcx, r14
mov rdx, rax
call fcn.140115be4
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1400843b4
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x1400852da
mov byte [rsi + 1], 1
jmp 0x1400852c8
cmp dword [rsp + 0x34], 4
cmove ebp, dword [rsp + 0x30]
mov qword [rdi + 0x110], rbp
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x1400852da
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400852f3
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x160]
mov rdx, qword [rdx + 0x178]
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rbx
call fcn.140083c52
mov r9, rdx
lea r14, [rsp + 0x78]
mov ebp, 1
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.14009d682
lea r15, [rsp + 0x88]
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.14009d682
lea r12, [rsp + 0x68]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.14009d682
lea r13, [rsp + 0x50]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call fcn.14009d682
movups xmm0, xmmword [r14]
movaps xmmword [r13 - 0x30], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [r13 - 0x20], xmm0
movups xmm0, xmmword [r12]
movaps xmmword [r13 - 0x10], xmm0
lea r14, [rsp + 0x68]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, r14
call fcn.14009d699
lea rcx, [rdi + 0x1f0]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x1400854b1
test eax, eax
je 0x140085431
cmp eax, 0x90317
je 0x1400854ab
cmp eax, 0x90321
jne 0x1400854ca
mov dword [rdi + 0x1d0], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1d4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.140084355
and qword [rdi + 0x210], 0
mov byte [rsi + 1], bl
jmp 0x1400854d8
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi + 0x168]
mov r8d, dword [rsp + 0x30]
add r8, rdx
lea r14, [rdi + 0x140]
and qword [rdi + 0x150], 0
mov rcx, rbx
call fcn.140083863
mov r8, rdx
mov rcx, r14
mov rdx, rax
call fcn.140115be4
and qword [rdi + 0x158], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.140084355
xor eax, eax
cmp qword [rdi + 0x178], rbx
sete al
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
jmp 0x1400854d8
mov byte [rsi + 1], 1
jmp 0x1400854c6
cmp dword [rsp + 0x34], 4
cmove ebp, dword [rsp + 0x30]
mov qword [rdi + 0x210], rbp
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x1400854d8
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400854f1
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov eax, dword [r9 + 8]
cmp rax, r8
jb 0x140085692
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov r14d, dword [r9]
mov edx, dword [r9 + 4]
lea rbx, [r14 + r8]
add rdx, rbx
lea rdi, [rcx + 0x80]
cmp qword [rcx + 0x90], rdx
jae 0x140085540
mov rcx, rdi
xor r8d, r8d
call fcn.1400185d8
lea r9, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.140083c68
lea rcx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, r12
mov r9, r15
call fcn.14009b770
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
call fcn.140083c52
mov r9, rdx
lea r15, [rsp + 0x78]
mov rcx, r15
mov edx, 7
mov r8, rax
call fcn.14009d682
lea r9, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.140083c68
mov r9, rdx
lea r14, [rsp + 0x88]
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.14009d682
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov rcx, rdi
mov rdx, rbx
call fcn.14008384d
mov r9, rdx
lea rbx, [rsp + 0x98]
mov rcx, rbx
mov edx, 6
mov r8, rax
call fcn.14009d682
lea r12, [rsp + 0x60]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.14009d682
movups xmm0, xmmword [r15]
movaps xmmword [r12 - 0x30], xmm0
movups xmm0, xmmword [r14]
movaps xmmword [r12 - 0x20], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [r12 - 0x10], xmm0
lea rbx, [rsp + 0xa8]
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rbx
call fcn.14009d699
lea rcx, [rsi + 0xf0]
xor edx, edx
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x140085663
shl rax, 0x20
or rax, 2
jmp 0x140085681
mov edx, dword [rsp + 0x40]
add edx, dword [rsp + 0x30]
add edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.14009b2ac
and qword [rsi + 0x98], 0
xor eax, eax
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rs
mov edx, 0x3e
call fcn.14015ab50
int3