joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8a3f
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rbx, r9
mov rsi, r8
mov r11, rdx
movabs rdi, 0x100000001b3
mov r15, qword [r9]
mov r8, qword [r9 + 0x10]
lea rdx, [r8*8]
movabs rax, 0xcbf29ce484222325
mov r9, r15
test rdx, rdx
je 0x4b8ab2
movzx r10d, byte [r9 + 4]
xor rax, r10
imul rax, rdi
movzx r10d, byte [r9 + 5]
xor r10, rax
mov eax, dword [r9]
add r9, 8
imul r10, rdi
xor rax, r10
imul rax, rdi
add rdx, 0xfffffffffffffff8
jmp 0x4b8a81
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x4b8c0c
xor edx, edx
div r9
mov rdi, rdx
mov rax, qword [rsi]
mov r12, rdx
shl r12, 5
movzx edx, word [rax + r12 + 0x1c]
cmp dx, word [rsi + 0x20]
jne 0x4b8b26
cmp qword [rax + r12 + 0x10], r8
jne 0x4b8b26
mov r14, qword [rax + r12]
xor r9d, r9d
cmp r8, r9
je 0x4b8bdf
mov rdx, r9
mov r9b, byte [r14 + r9*8 + 4]
cmp r9b, byte [r15 + rdx*8 + 4]
jne 0x4b8b1d
mov r9b, byte [r15 + rdx*8 + 5]
cmp byte [r14 + rdx*8 + 5], r9b
jne 0x4b8b1d
lea r9, [rdx + 1]
mov r10d, dword [r14 + rdx*8]
cmp r10d, dword [r15 + rdx*8]
je 0x4b8aeb
cmp rdx, r8
jae 0x4b8bdf
mov qword [rsp + 0x28], rcx
lea r13, [rsp + 0x30]
mov rcx, r13
mov rdx, r15
mov r14, r11
call fcn.004b8c37
lea rbp, [rsp + 0x48]
mov rcx, rbp
mov rdx, r14
mov r8, r13
call fcn.004b77a7
mov eax, dword [rbp]
cmp eax, 0x27
jne 0x4b8bbd
mov rdx, qword [rsi + 0x10]
cmp rdx, rdi
jbe 0x4b8c26
mov edi, dword [rsp + 0x4c]
movzx ebp, word [rsi + 0x20]
mov rsi, qword [rsi]
mov rcx, qword [rsi + r12]
mov rdx, qword [rsi + r12 + 8]
call fcn.004ae61f
mov rax, qword [rbx + 0x10]
mov qword [rsi + r12 + 0x10], rax
movups xmm0, xmmword [rbx]
movups xmmword [rsi + r12], xmm0
mov dword [rsi + r12 + 0x18], edi
mov word [rsi + r12 + 0x1c], bp
mov rax, qword [rsp + 0x28]
mov dword [rax + 4], edi
mov dword [rax], 0x27
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x50]
mov edx, dword [rsi - 4]
mov r8, qword [rsp + 0x28]
lea rdi, [r8 + 8]
mov ecx, 0xf
rep movsq qword [rdi], qword [rsi]
mov dword [r8], eax
mov dword [r8 + 4], edx
jmp 0x4b8bed
mov eax, dword [rax + r12 + 0x18]
mov dword [rcx + 4], eax
mov dword [rcx], 0x27
mov rdx, qword [rbx + 8]
mov rcx, r15
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.004ae61f
lea rcx, [0x006089b0]
lea r8, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.3.8_src_nfa_thompson_map.rs
mov edx, 0x39
call fcn.00464920
ud2
lea r8, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.3.8_src_nfa_thompson_map.rs
mov rcx, rdi
call fcn.00463840
ud2
Function at 0x4f1b42
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
lea rcx, [0x005ab0a8]
call fcn.0047906d
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x4f1b75
cmp qword [rax + 8], 0
je 0x4f1b75
add rax, 0x10
jmp 0x4f1c03
lea rbx, [0x005ab0a8]
mov rcx, rbx
call fcn.0047906d
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4f1c01
mov rdi, rax
test rax, rax
jne 0x4f1bc5
mov ecx, 0x18
mov edx, 8
call fcn.004ad1f5
mov rdi, rax
mov qword [rax], rbx
and qword [rax + 8], 0
mov rcx, rbx
call fcn.0047906d
mov ecx, eax
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x4f1bdc
mov rax, qword [rsi]
and qword [rsi], 0
test rax, rax
je 0x4f1bdc
mov rcx, qword [rsi + 8]
jmp 0x4f1bef
mov ecx, 1
lock xadd qword [0x005ab0a0], rcx
test rcx, rcx
je 0x4f1c0b
lea rax, [rdi + 0x10]
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rcx
jmp 0x4f1c03
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.regex:_thread_ID_allocation_space_exhausted
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, str.unknownassertion_failed:_success_usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_whoami_1.4.1_src_windows.rs
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.3.8_src_util_pool.rs
call fcn.00463750
ud2
Function at 0x514530
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x98]
mov rcx, qword [rdx + 0x80]
mov rdx, qword [rdx + 0x90]
lea r9, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsf
call fcn.0051334c
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xc0]
xor r8d, r8d
xor r9d, r9d
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x51460d
test eax, eax
je 0x514629
cmp eax, 0x90317
je 0x5146a2
cmp eax, 0x90321
jne 0x5146aa
mov dword [rdi + 0x40], 0x10000
xor ebx, ebx
mov byte [rdi + 0x44], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.005144d0
and qword [rdi + 0xf8], 0
mov byte [rsi + 1], bl
jmp 0x5146b8
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x5146a6
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x80]
mov rdx, qword [rdi + 0x90]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x60]
and qword [rdi + 0x70], 0
call fcn.005146cc
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.0043ebf0
and qword [rdi + 0x78], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.005144d0
xor eax, eax
cmp qword [rdi + 0x98], rbx
sete al
mov qword [rdi + 0xf8], rax
mov byte [rsi + 1], 0
jmp 0x5146b8
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x5146b8
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x5149c4
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x198]
mov rcx, qword [rdx + 0x180]
mov rdx, qword [rdx + 0x190]
lea r9, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.22_src_tls_stream.rsf
call fcn.0051334c
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1c0]
xor r8d, r8d
xor r9d, r9d
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x514aa7
test eax, eax
je 0x514ac6
cmp eax, 0x90317
je 0x514b48
cmp eax, 0x90321
jne 0x514b50
mov dword [rdi + 0x140], 0x10000
xor ebx, ebx
mov byte [rdi + 0x144], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.00514964
and qword [rdi + 0x1f8], 0
mov byte [rsi + 1], bl
jmp 0x514b5e
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x514b4c
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x180]
mov rdx, qword [rdi + 0x190]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x160]
and qword [rdi + 0x170], 0
call fcn.005146cc
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.0043ebf0
and qword [rdi + 0x178], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x198]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.00514964
xor eax, eax
cmp qword [rdi + 0x198], rbx
sete al
mov qword [rdi + 0x1f8], rax
mov byte [rsi + 1], 0
jmp 0x514b5e
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x514b5e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x514b68
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne fcn.00514b7a
add rcx, 8
jmp fcn.0059c500
Function at 0x515896
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rdi, rcx
lea rcx, [0x005ab0e0]
call fcn.0047906d
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x5158dd
mov rcx, rax
cmp qword [rax + 8], 0
je 0x5158dd
add rcx, 0x10
jmp 0x515a05
lea rbx, [0x005ab0e0]
mov rcx, rbx
call fcn.0047906d
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x515a03
mov rsi, rax
test rax, rax
jne 0x515931
mov ecx, 0x18
mov edx, 8
call fcn.0050adaa
mov rsi, rax
mov qword [rax], rbx
and qword [rax + 8], 0
mov rcx, rbx
call fcn.0047906d
mov ecx, eax
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov qword [rsp + 0x20], rsi
test rdi, rdi
je 0x515965
mov rax, qword [rdi]
and qword [rdi], 0
test rax, rax
je 0x515965
mov rax, qword [rdi + 8]
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx + 0x10]
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], rax
jmp 0x515a05
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.0047a9cd
mov rcx, rdi
call fcn.00515a21
mov rbx, rax
mov r14, rdx
movabs r12, 0x736f6d6570736575
xor r12, rax
movabs r13, 0x646f72616e646f6d
xor r13, rdx
movabs rbp, 0x6c7967656e657261
xor rbp, rax
movabs rsi, 0x7465646279746573
xor rsi, rdx
mov r15d, 1
xor eax, eax
xorps xmm6, xmm6
test rax, rax
jne 0x51594b
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r14
movups xmmword [rdi + 0x30], xmm6
and qword [rdi + 0x40], 0
mov rcx, rdi
mov rdx, r15
call fcn.0050dc79
mov rcx, rdi
call fcn.0047ffc0
inc r15
jmp 0x5159bf
xor ecx, ecx
mov rax, rcx
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x516526
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rsp + 0xf0]
cmp dword [rdx], 2
jne 0x5166c1
mov qword [rsp + 0x58], rsi
lea r15, [r14 + 8]
xor ecx, ecx
cmp qword [r14 + 0x20], 0xffffffffffffffff
lea r13, [r14 + 0x20]
cmove r13, rcx
mov ebp, 0xffffffff
cmp rax, rbp
cmovb rbp, rax
xorps xmm6, xmm6
mov rdx, qword [r14 + 0x18]
lea rcx, [rsp + 0x40]
mov r8, rbx
mov r9b, 1
call fcn.0059c2a4
mov al, byte [rsp + 0x49]
cmp al, 3
je 0x5166dc
mov rcx, qword [rsp + 0x40]
cmp al, 2
je 0x5166ea
mov dl, byte [rsp + 0x48]
lea r9, [rsp + 0x4a]
movzx r8d, word [r9 + 4]
lea r10, [rsp + 0x6a]
mov word [r10 + 4], r8w
mov r8d, dword [r9]
mov dword [r10], r8d
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], dl
mov byte [rsp + 0x69], al
mov rcx, r13
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.32.0_src_io_poll_evented.rs
call fcn.0059b064
mov rcx, qword [r13]
and dword [rsp + 0x54], 0
movups xmmword [rsp + 0x28], xmm6
and dword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, ebp
lea r9, [rsp + 0x54]
call sub.WS2_32.dll_WSASend
cmp eax, 0xffffffff
jne 0x5166f8
call sub.WS2_32.dll_WSAGetLastError
mov r12d, eax
shl r12, 0x20
or r12, 2
mov rcx, r12
call fcn.004a28a0
cmp al, 0xd
jne 0x51668b
mov rax, qword [r13 + 8]
test rax, rax
je 0x51668b
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x51673f
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.004a2778
mov rsi, rax
xor ecx, ecx
call fcn.0055b978
test rsi, rsi
je 0x51668b
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], 1
mov ecx, 1
mov rdx, r12
call fcn.004a28fc
mov r12, rsi
jmp 0x516699
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], r12
mov rcx, r12
call fcn.0044d3d8
cmp al, 0xd
jne 0x516716
mov rcx, r15
lea rdx, [rsp + 0x60]
call fcn.0059c23f
lea rcx, [rsp + 0x48]
call fcn.00596b39
jmp 0x516582
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9, rdi
call fcn.00515fb5
mov rax, rsi
jmp 0x516726
mov rax, qword [rsp + 0x58]
mov qword [rax], 2
jmp 0x516726
mov rax, qword [rsp + 0x58]
mov qword [rax], 1
jmp 0x516710
mov ecx, dword [rsp + 0x54]
and qword [rsp + 0x40], 0
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x58]
and qword [rax], 0
mov qword [rax + 8], rcx
jmp 0x516726
mov rax, qword [rsp + 0x58]
mov qword [rax], 1
mov qword [rax + 8], r12
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x54c83e
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x58]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.0054c966
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
and dword [r15], 0
mov ecx, 0x800
call fcn.00555c28
mov rbx, rax
lea r12, [rsp + 0x40]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x54c8db
mov edx, dword [rsp + 0x38]
mov rcx, r12
call fcn.005a8335
mov rbx, qword [rsp + 0x40]
jmp 0x54c8a6
test eax, eax
jne 0x54c8fd
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x54c91b
movabs rax, 0xde00000002
jmp 0x54c905
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.0041f3fd
jmp 0x54c92f
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.005a7885
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x5538d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x55392b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x55392b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x553946
cmp eax, 0x42
jne 0x55392b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x5539f6
cmp byte [r9 + r11], 0x5f
jne 0x5539f6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x553a5e
mov rcx, rsi
xor edx, edx
call fcn.0054f0e0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.0054f0e0
test al, al
jne 0x553af1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x553982
lea rdx, [0x0066e8e3]
mov r8d, 1
call fcn.004645e0
test al, al
jne 0x553af1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x55393a
xor r14d, r14d
lea rbx, [0x0066ec98]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x5539b4
cmp byte [rax + rcx], 0x45
je 0x553b13
sub r14, 1
jb 0x5539d9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x5539d9
mov r8d, 2
mov rdx, rbx
call fcn.004645e0
test al, al
jne 0x553af1
mov rcx, rsi
call fcn.005509a0
test al, al
jne 0x553af1
mov rax, qword [rsi]
test rax, rax
jne 0x5539a0
jmp 0x55393a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x553ab8
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x553a52
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x553a3c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x553a2b
add dl, 0xa9
jmp 0x553a3a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x553ab8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x553ab8
movzx edx, bl
add rax, rdx
jae 0x553a00
jmp 0x553ab8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x553ab8
cmp rax, rcx
jae 0x553ab5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x553b0b
cmp qword [rsi + 0x20], 0
je 0x553b04
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.005538d0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x55393c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x553af9
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x0066ec58]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.004645e0
test al, al
je 0x553af9
mov dil, 2
jmp 0x55393a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x55393a
mov dil, 1
xor r8d, r8d
jmp 0x553aba
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x55393a
Function at 0x55612e
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x68], 4
mov dword [rsp + 0xb0], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x556191
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x90], edx
mov qword [rsp + 0x98], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x5561ce
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je 0x5561c3
xor r9d, r9d
lea r10, [0x006a0250]
xor r8d, r8d
movzx r11d, byte [rax + r9]
or r8d, dword [r10 + r11*4]
inc r9
cmp rdx, r9
jne 0x5561b0
jmp 0x5561c6
xor r8d, r8d
mov dword [rsp + 0xa0], r8d
mov r15, qword [rcx + 0x10]
lea rsi, [r15*8]
test r15, r15
je 0x556228
xor ebx, ebx
mov rax, r15
shr rax, 0x3c
sete al
jne 0x5562e9
mov r14, qword [rcx]
mov bl, al
shl rbx, 3
mov rcx, rbx
mov rdx, rsi
call fcn.004a0976
test rax, rax
je 0x5562f0
mov rdi, rax
xor eax, eax
mov rcx, qword [r14 + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp r15, rax
jne 0x556213
mov eax, r15d
jmp 0x55622f
xor eax, eax
mov edi, 8
lea rcx, [rsp + 0x68]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.Secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x556285
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x5562bd
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov ecx, 8
mov edx, 0x20
call fcn.004a0976
test rax, rax
je 0x5562f8
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r12
xor r14d, r14d
test r15, r15
je 0x5562d2
mov edx, 8
mov rcx, rdi
mov r8, rsi
call fcn.004051be
mov rax, r14
mov rdx, rbx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.0043b4d0
ud2
mov rcx, rbx
mov rdx, rsi
jmp 0x556302
mov ecx, 8
mov edx, 0x20
call fcn.0043b510
ud2

Function at 0x55694e
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call sub.Secur32.dll_QueryContextAttributesW
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x556977
mov rdx, qword [rsp + 0x20]
jmp 0x55697f
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x55afd3
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, dword [rdx]
movdqa xmm0, xmmword [rdx]
mov r10, qword [rsp + 0x68]
pshufd xmm1, xmm0, 0x55
movd edx, xmm1
mov esi, r8d
rol esi, 0x19
pshufd xmm1, xmm0, 0xee
mov edi, eax
rol edi, 0x19
movd r11d, xmm1
mov ebx, edx
rol ebx, 0x19
mov ebp, r11d
rol ebp, 0x19
mov r14d, r8d
rol r14d, 0xe
xor r14d, esi
mov esi, eax
rol esi, 0xe
xor esi, edi
mov r15d, edx
rol r15d, 0xe
xor r15d, ebx
mov r12d, r11d
rol r12d, 0xe
xor r12d, ebp
shr r8d, 3
xor r8d, r14d
mov edi, eax
shr edi, 3
xor edi, esi
mov ebx, edx
shr ebx, 3
xor ebx, r15d
mov ebp, r11d
shr ebp, 3
xor ebp, r12d
pshufd xmm0, xmm0, 0xff
movd esi, xmm0
mov r14d, dword [r10 + 4]
mov r15d, r14d
rol r15d, 0xf
mov r12d, dword [r10]
mov r13d, r14d
rol r13d, 0xd
xor r13d, r15d
shr r14d, 0xa
add esi, dword [r9 + 8]
xor r14d, r13d
mov r15d, r12d
rol r15d, 0xf
add esi, ebp
mov ebp, r12d
rol ebp, 0xd
add esi, r14d
xor ebp, r15d
shr r12d, 0xa
xor r12d, ebp
add r11d, dword [r9 + 4]
add r11d, ebx
add r11d, r12d
mov ebx, esi
rol ebx, 0xf
mov ebp, esi
rol ebp, 0xd
xor ebp, ebx
mov ebx, esi
shr ebx, 0xa
xor ebx, ebp
add edx, dword [r9]
add edx, edi
mov r9d, r11d
rol r9d, 0xf
add edx, ebx
mov edi, r11d
rol edi, 0xd
xor edi, r9d
mov r9d, r11d
shr r9d, 0xa
xor r9d, edi
add eax, dword [r10 + 0xc]
add eax, r8d
add eax, r9d
mov dword [rcx], eax
mov dword [rcx + 4], edx
mov dword [rcx + 8], r11d
mov dword [rcx + 0xc], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x55b935
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg1 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x55b951
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg2 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret
Function at 0x55bee0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x55bf0c
xor eax, eax
jmp 0x55bf11
call fcn.004a1ed9
nop
add rsp, 0x38
ret

Function at 0x55d3f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x005ab170]
test ecx, ecx
je 0x55d4cf
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x55d424
mov rdi, rax
cmp qword [rax + 8], 0
je 0x55d424
add rdi, 0x10
jmp 0x55d4c5
mov ecx, dword [0x005ab170]
test ecx, ecx
je 0x55d4e2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x55d4c3
mov rsi, rax
test rax, rax
jne 0x55d493
movzx eax, byte [0x006be1f0]
mov ecx, 0x20
mov edx, 8
call fcn.00417db0
test rax, rax
je 0x55d505
mov rsi, rax
lea rax, [0x005ab158]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x005ab170]
test ecx, ecx
je 0x55d4f5
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 0x10]
cmp qword [rsi + 8], 0
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 8], 1
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
je 0x55d4c5
test rcx, rcx
je 0x55d4c5
lock dec qword [rcx]
jne 0x55d4c5
call fcn.0055d530
jmp 0x55d4c5
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x005ab158]
call fcn.0055d750
mov ecx, eax
jmp 0x55d406
lea rcx, [0x005ab158]
call fcn.0055d750
mov ecx, eax
jmp 0x55d434
lea rcx, [0x005ab158]
call fcn.0055d750
mov ecx, eax
jmp 0x55d48b
mov ecx, 8
mov edx, 0x20
call fcn.0043b510
ud2