joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180093250
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180093270
test al, 1
je 0x180093441
test al, 2
jne 0x180093441
test al, 8
jne 0x180093395
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800932ed
xorps xmm6, xmm6
test eax, eax
jne 0x180093319
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rbx + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.180093140
mov byte [rsi + 0xa8], 4
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x180093379
test eax, eax
jne 0x1800933b3
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rdi + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x1800933b3
test al, 0x10
je 0x1800933b3
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180093441
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011d6d0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180093441
jne 0x180093434
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800933f5
call fcn.1800857d0
lea rcx, [rsi + 0x30]
call fcn.180093140
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180093414
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1802219b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800940e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180094100
test al, 1
je 0x1800942d1
test al, 2
jne 0x1800942d1
test al, 8
jne 0x180094225
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x18009417d
xorps xmm6, xmm6
test eax, eax
jne 0x1800941a9
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rbx + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.180093140
mov byte [rsi + 0xa8], 4
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x180094209
test eax, eax
jne 0x180094243
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rdi + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x180094243
test al, 0x10
je 0x180094243
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1800942d1
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011c740
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800942d1
jne 0x1800942c4
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180094285
call fcn.180085730
lea rcx, [rsi + 0x30]
call fcn.180093140
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1800942a4
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1802219b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x180094b90
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180094ba0
test al, 1
je 0x180094c41
test al, 2
jne 0x180094c41
test al, 8
jne 0x180094bda
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.1800949c0
jmp 0x180094bf4
test al, 0x10
je 0x180094bf4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x180094c41
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011d6d0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180094c41
jne 0x180094c37
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180094c50
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x1800953a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800953b0
test al, 1
je 0x180095451
test al, 2
jne 0x180095451
test al, 8
jne 0x1800953ea
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.1800949c0
jmp 0x180095404
test al, 0x10
je 0x180095404
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x180095451
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011c740
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180095451
jne 0x180095447
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180095460
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x1800965c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800965e0
test al, 1
je 0x1800967b2
test al, 2
jne 0x1800967b2
test al, 8
jne 0x180096706
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x18009665d
xorps xmm6, xmm6
test eax, eax
jne 0x180096689
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rbx + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.1800964d0
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800966ea
test eax, eax
jne 0x180096724
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rdi + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x180096724
test al, 0x10
je 0x180096724
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x1800967b2
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011d6d0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800967b2
jne 0x1800967a5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180096766
call fcn.1800857d0
lea rcx, [rsi + 0x30]
call fcn.1800964d0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180096785
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1802219b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800974e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180097500
test al, 1
je 0x1800976d2
test al, 2
jne 0x1800976d2
test al, 8
jne 0x180097626
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x18009757d
xorps xmm6, xmm6
test eax, eax
jne 0x1800975a9
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rbx + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.1800964d0
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x18009760a
test eax, eax
jne 0x180097644
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rdi + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x180097644
test al, 0x10
je 0x180097644
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x1800976d2
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011c740
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800976d2
jne 0x1800976c5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180097686
call fcn.180085730
lea rcx, [rsi + 0x30]
call fcn.1800964d0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x1800976a5
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1802219b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x18009b3b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18009b3c0
test al, 1
je 0x18009b44d
test al, 2
jne 0x18009b44d
test al, 8
jne 0x18009b3f2
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18009ba60
jmp 0x18009b406
test al, 0x10
je 0x18009b406
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18009b44d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011d6d0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18009b44d
jne 0x18009b446
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18009b460
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x18009bc00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18009bc10
test al, 1
je 0x18009bc9d
test al, 2
jne 0x18009bc9d
test al, 8
jne 0x18009bc42
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18009ba60
jmp 0x18009bc56
test al, 0x10
je 0x18009bc56
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18009bc9d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011c740
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18009bc9d
jne 0x18009bc96
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18009bcb0
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800b2680
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b2690
test al, 1
je 0x1800b271a
test al, 2
jne 0x1800b271a
test al, 8
jne 0x1800b26bf
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800b2c20
jmp 0x1800b26d3
test al, 0x10
je 0x1800b26d3
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800b271a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011d6d0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b271a
jne 0x1800b2713
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800b2720
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x1800b2dc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b2dd0
test al, 1
je 0x1800b2e5a
test al, 2
jne 0x1800b2e5a
test al, 8
jne 0x1800b2dff
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800b2c20
jmp 0x1800b2e13
test al, 0x10
je 0x1800b2e13
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800b2e5a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011c740
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b2e5a
jne 0x1800b2e53
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800b2e60
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800b7b40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b7b60
test al, 1
je 0x1800b7d32
test al, 2
jne 0x1800b7d32
test al, 8
jne 0x1800b7c86
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800b7bdd
xorps xmm6, xmm6
test eax, eax
jne 0x1800b7c09
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rbx + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.1800b7a80
mov qword [rsi + 0x30], 3
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800b7c6a
test eax, eax
jne 0x1800b7ca4
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rdi + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x1800b7ca4
test al, 0x10
je 0x1800b7ca4
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b7d32
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011d6d0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b7d32
jne 0x1800b7d25
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800b7ce6
call fcn.1800857d0
lea rcx, [rsi + 0x30]
call fcn.1800b7a80
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b7d05
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1802219b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800b8a60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b8a80
test al, 1
je 0x1800b8c52
test al, 2
jne 0x1800b8c52
test al, 8
jne 0x1800b8ba6
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800b8afd
xorps xmm6, xmm6
test eax, eax
jne 0x1800b8b29
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rbx + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.1800b7a80
mov qword [rsi + 0x30], 3
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800b8b8a
test eax, eax
jne 0x1800b8bc4
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x1801160b0]
call fcn.1801027c0
mov byte [rdi + 0x118], 1
mov eax, dword [0x180221a34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x1800b8bc4
test al, 0x10
je 0x1800b8bc4
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b8c52
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011c740
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b8c52
jne 0x1800b8c45
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800b8c06
call fcn.180085730
lea rcx, [rsi + 0x30]
call fcn.1800b7a80
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b8c25
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1802219b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x1800bdfe0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800bdff0
test al, 1
je 0x1800be092
test al, 2
jne 0x1800be092
test al, 8
jne 0x1800be02b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800be5e0
jmp 0x1800be045
test al, 0x10
je 0x1800be045
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800be092
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011d6d0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800be092
jne 0x1800be088
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800be0a0
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800be780
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800be790
test al, 1
je 0x1800be832
test al, 2
jne 0x1800be832
test al, 8
jne 0x1800be7cb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800be5e0
jmp 0x1800be7e5
test al, 0x10
je 0x1800be7e5
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800be832
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011c740
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800be832
jne 0x1800be828
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800be840
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800cfab0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800cfac0
test al, 1
je 0x1800cfb62
test al, 2
jne 0x1800cfb62
test al, 8
jne 0x1800cfafb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800d00a0
jmp 0x1800cfb15
test al, 0x10
je 0x1800cfb15
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800cfb62
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011d6d0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800cfb62
jne 0x1800cfb58
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800cfb70
nop
add rsp, 0xfa0
pop rsi
ret
ud2

Function at 0x1800d0230
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800d0240
test al, 1
je 0x1800d02e2
test al, 2
jne 0x1800d02e2
test al, 8
jne 0x1800d027b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800d00a0
jmp 0x1800d0295
test al, 0x10
je 0x1800d0295
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800d02e2
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.18011c740
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800d02e2
jne 0x1800d02d8
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800d02f0
nop
add rsp, 0xfa0
pop rsi
ret
ud2
Function at 0x1800d7650
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800d7692
mov rdi, qword [rsp + 0x28]
je 0x1800d76ff
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800d7772
test rax, rax
je 0x1800d7772
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800d76e8
cmp qword [rdi + 0x10], 0x11
jb 0x1800d76d6
mov r14, qword [r14 - 8]
mov rcx, qword [0x1802219b8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1802219b8]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1800d7772
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800d7755
movzx eax, byte [0x180221a30]
mov rcx, qword [0x1802219b8]
test rcx, rcx
jne 0x1800d7733
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800d7746
mov rcx, rax
mov qword [0x1802219b8], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800d775b
mov ecx, 1
mov rdx, rbx
call fcn.180183f50
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180181ff0
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret