joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aa45
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [rcx + 0x18]
test eax, eax
je fcn.004d6970
dec eax
ret

Function at 0x45ac55
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x45acad
mov rsi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x45acad
mov rbx, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x45acad
mov rsi, rax
mov r15d, 1
jmp 0x45ad34
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x45ad9c
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x45ad9c
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x45ad9c
mov rsi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x45ad9c
mov rdi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x45ad9c
mov rbx, qword [rsp + 0x20]
xor r15d, r15d
mov ecx, 0x20
mov edx, 8
call fcn.00403ce0
test rax, rax
je 0x45add6
mov r14, rax
mov qword [rax], r15
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
xor eax, eax
lock cmpxchg qword [0x00572060], r14
je 0x45ad8d
mov rsi, rax
cmp qword [r14], 0
jne 0x45ad7d
mov rcx, qword [r14 + 8]
call sub.kernel32.dll_CloseHandle
mov edx, 8
mov rcx, r14
call fcn.00403d70
mov r14, rsi
mov rax, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
and qword [rcx], 0
lea rax, str.ntdll.dll
mov qword [rcx + 0x20], rax
and qword [rcx + 0x28], 0
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_parking_lot_core_0.9.10_src_thread_parker_windows_mod.rs
call fcn.0042fe10
ud2
mov ecx, 0x20
mov edx, 8
call fcn.00404d20
ud2
Function at 0x45b1cb
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
call fcn.0045b2a1
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x45b1f7
mov rsi, rax
mov rax, qword [rax + 8]
test rax, rax
cmove rsi, rax
jne 0x45b286
call fcn.0045b2a1
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x45b284
mov rsi, rax
test rax, rax
jne 0x45b248
mov ecx, 0x40
mov edx, 8
call fcn.00403ce0
test rax, rax
je 0x45b290
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rax, [0x004fe090]
mov qword [rsi + 0x38], rax
call fcn.0045b2a1
mov ecx, eax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.0045ae08
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm2
mov rax, qword [rdi + 0x30]
mov qword [rsi + 0x30], rax
cmp qword [rsi + 8], 0
movups xmmword [rsi], xmm0
je 0x45b286
lock dec qword [0x00572050]
jmp 0x45b286
xor esi, esi
mov rax, rsi
add rsp, 0x58
pop rdi
pop rsi
ret
mov ecx, 0x40
mov edx, 8
call fcn.00404d20
ud2

Function at 0x45b2a1
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x004fe0a8]
test eax, eax
je 0x45b2ae
dec eax
ret
lea rcx, [0x004fe090]
jmp fcn.004d6970

Function at 0x45ba43
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x004fe0c8]
test eax, eax
je 0x45ba50
dec eax
ret
lea rcx, [0x004fe0b0]
jmp fcn.004d6970
Function at 0x45baae
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rdi, rcx
call fcn.0045ba43
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x45bae0
mov rsi, rax
mov rax, qword [rax]
test rax, rax
cmove rsi, rax
jne 0x45bc83
call fcn.0045ba43
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x45bc81
mov rsi, rax
test rax, rax
jne 0x45bb37
mov ecx, 0x10
mov edx, 8
call fcn.00403ce0
test rax, rax
je 0x45bcf7
mov rsi, rax
and qword [rax], 0
lea rax, [0x004fe0b0]
mov qword [rsi + 8], rax
call fcn.0045ba43
mov ecx, eax
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x45bb53
mov rbx, qword [rdi]
and qword [rdi], 0
test rbx, rbx
jne 0x45bc74
xor ecx, ecx
call fcn.0045bd08
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.0045eab8
test rax, rax
jne 0x45bc91
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
lea rbx, [rsp + 0x90]
lea r8, [0x005394a8]
mov rcx, rbx
mov rdx, rdi
call fcn.0045e90b
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
movups xmmword [rbx + 0x18], xmm2
movups xmmword [rbx + 8], xmm1
movups xmmword [rbx - 8], xmm0
movups xmm0, xmmword [rbx - 0x10]
movaps xmmword [rdi], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rdi + 0x20], xmm0
mov rax, qword [rbx + 0x20]
mov qword [rdi + 0x30], rax
mov ecx, 0x170
mov edx, 0x10
call fcn.00403ce0
test rax, rax
je 0x45bceb
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
add rcx, 0x10
mov r8d, 0x100
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rbx + 0x110], 0x40
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmm2, xmmword [rsp + 0x60]
movups xmmword [rbx + 0x118], xmm0
movups xmmword [rbx + 0x128], xmm1
movups xmmword [rbx + 0x138], xmm2
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x148], rax
mov eax, 0x10000
mov qword [rbx + 0x150], rax
mov qword [rbx + 0x158], rax
and qword [rbx + 0x160], 0
mov rcx, qword [rsi]
mov qword [rsi], rbx
call fcn.0045bd08
jmp 0x45bc83
xor esi, esi
mov rax, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x20], rax
lea rax, [0x0052b270]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rax], rdi
lea rdx, str.could_not_initialize_thread_rng:
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x10], rdx
mov edx, 1
mov qword [rcx + 0x18], rdx
and qword [rcx], 0
lea r8, [0x0045ea6a]
mov qword [rax + 8], r8
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdx
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_rand_0.8.5_src_rngs_thread.rs
call fcn.0042fe10
ud2
mov ecx, 0x170
mov edx, 0x10
jmp 0x45bd01
mov ecx, 0x10
mov edx, 8
call fcn.00404d20
ud2
Function at 0x45eab8
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov r12d, 0x20
xor esi, esi
mov r13d, 0xffffffff
test r12, r12
je 0x45eb43
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x45ead8
mov ebx, eax
mov rcx, r14
mov edx, r15d
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x45ead8
xor ebx, 0x80000000
je 0x45eb41
mov ecx, 4
mov edx, 4
call fcn.00403ce0
test rax, rax
je 0x45eb56
mov rsi, rax
mov dword [rax], ebx
jmp 0x45eb43
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.00404d20
ud2
Function at 0x49a83f
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rdx + 0x80], r8
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.004a49da
mov eax, dword [r14]
cmp eax, 2
je 0x49aa61
test eax, eax
je 0x49aa18
mov rax, qword [rsi + 0x40]
cmp rax, qword [rsi + 0x58]
jne 0x49aa4b
mov rdx, qword [rsp + 0xf0]
mov r15d, dword [rsp + 0x34]
mov r13, qword [rsp + 0x38]
mov rbx, r13
shr rbx, 0x20
cmp rdx, rbx
mov r8, rbx
cmovb r8, rdx
lea r9, [0x00531d00]
mov rcx, r12
mov qword [rsp + 0x70], r8
call fcn.0048fbcc
cmp rdx, rbx
ja 0x49aac3
mov rbp, rdx
mov rbx, rax
mov r12, rdx
add r12, r15
mov eax, r13d
add rax, r12
mov rdx, qword [rsi + 0x58]
cmp rdx, rax
jae 0x49a8fc
lea rcx, [rsi + 0x48]
mov rdx, rax
call fcn.004a344d
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rsi + 0x50]
lea rax, [0x00531ef8]
mov qword [rsp + 0x20], rax
mov r8, r15
mov r9, r12
call fcn.004a5a6f
lea rcx, [0x00531f10]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, rbx
mov r9, rbp
call fcn.00458e34
mov rcx, qword [rsi + 0x50]
mov rdx, qword [rsi + 0x58]
lea r9, [0x00531f28]
mov r8, r15
call fcn.004a4747
mov r13, rax
mov rbp, rdx
xor eax, eax
test r13, r13
cmove ebp, eax
mov rcx, qword [rsi + 0x50]
mov rdx, qword [rsi + 0x58]
lea rax, [0x00531f40]
mov qword [rsp + 0x20], rax
mov r8, r15
mov r9, r12
call fcn.004a5a6f
mov r15, rax
mov rbx, rdx
test rax, rax
mov eax, 0
cmove ebx, eax
mov rcx, qword [rsi + 0x50]
mov rdx, qword [rsi + 0x58]
lea r9, [0x00531f58]
mov r8, r12
call fcn.004a4999
test rax, rax
mov ecx, 0
cmove edx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 7
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x54], 6
mov qword [rsp + 0x58], rax
movabs rax, 0x400000000
lea r8, [rsp + 0x78]
mov qword [r8], rax
mov qword [r8 + 8], r14
lea rcx, [rsi + 0x60]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x49aa24
mov r14d, eax
shl r14, 0x20
or r14, 2
jmp 0x49aa66
movabs r14, 0x8009031700000002
jmp 0x49aa66
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x50]
cmp qword [rsi + 0x58], rax
jb 0x49aa3a
mov qword [rsi + 0x58], rax
and qword [rsi + 0x40], 0
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x1e0], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.004a597e
cmp qword [rbx], 0
je 0x49aab2
mov r14, qword [rsp + 0x38]
mov rcx, r14
call fcn.004586c8
cmp al, 0xd
jne 0x49aa8b
mov qword [rdi], 2
and qword [rsi + 0x80], 0
mov rcx, r14
call fcn.00499d17
jmp 0x49aa9e
mov qword [rdi], 1
mov qword [rdi + 8], r14
and qword [rsi + 0x80], 0
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x1e0]
and qword [rdi], 0
mov qword [rdi + 8], rax
jmp 0x49aa96
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, [0x00531ee0]
mov edx, 0x3e
call fcn.0042fe50
ud2
Function at 0x49aadd
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rdx + 0x90], r8
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.004a384b
mov eax, dword [r14]
cmp eax, 2
je 0x49acff
test eax, eax
je 0x49acb6
mov rax, qword [rsi + 0x40]
cmp rax, qword [rsi + 0x58]
jne 0x49ace9
mov rdx, qword [rsp + 0xf0]
mov r15d, dword [rsp + 0x34]
mov r13, qword [rsp + 0x38]
mov rbx, r13
shr rbx, 0x20
cmp rdx, rbx
mov r8, rbx
cmovb r8, rdx
lea r9, [0x00531d00]
mov rcx, r12
mov qword [rsp + 0x70], r8
call fcn.0048fbcc
cmp rdx, rbx
ja 0x49ad61
mov rbp, rdx
mov rbx, rax
mov r12, rdx
add r12, r15
mov eax, r13d
add rax, r12
mov rdx, qword [rsi + 0x58]
cmp rdx, rax
jae 0x49ab9a
lea rcx, [rsi + 0x48]
mov rdx, rax
call fcn.004a344d
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rsi + 0x50]
lea rax, [0x00531ef8]
mov qword [rsp + 0x20], rax
mov r8, r15
mov r9, r12
call fcn.004a5a6f
lea rcx, [0x00531f10]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, rbx
mov r9, rbp
call fcn.00458e34
mov rcx, qword [rsi + 0x50]
mov rdx, qword [rsi + 0x58]
lea r9, [0x00531f28]
mov r8, r15
call fcn.004a4747
mov r13, rax
mov rbp, rdx
xor eax, eax
test r13, r13
cmove ebp, eax
mov rcx, qword [rsi + 0x50]
mov rdx, qword [rsi + 0x58]
lea rax, [0x00531f40]
mov qword [rsp + 0x20], rax
mov r8, r15
mov r9, r12
call fcn.004a5a6f
mov r15, rax
mov rbx, rdx
test rax, rax
mov eax, 0
cmove ebx, eax
mov rcx, qword [rsi + 0x50]
mov rdx, qword [rsi + 0x58]
lea r9, [0x00531f58]
mov r8, r12
call fcn.004a4999
test rax, rax
mov ecx, 0
cmove edx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 7
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x54], 6
mov qword [rsp + 0x58], rax
movabs rax, 0x400000000
lea r8, [rsp + 0x78]
mov qword [r8], rax
mov qword [r8 + 8], r14
lea rcx, [rsi + 0x60]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x49acc2
mov r14d, eax
shl r14, 0x20
or r14, 2
jmp 0x49ad04
movabs r14, 0x8009031700000002
jmp 0x49ad04
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x50]
cmp qword [rsi + 0x58], rax
jb 0x49acd8
mov qword [rsi + 0x58], rax
and qword [rsi + 0x40], 0
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0xe0], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.004a47dc
cmp qword [rbx], 0
je 0x49ad50
mov r14, qword [rsp + 0x38]
mov rcx, r14
call fcn.004586c8
cmp al, 0xd
jne 0x49ad29
mov qword [rdi], 2
and qword [rsi + 0x90], 0
mov rcx, r14
call fcn.00499d17
jmp 0x49ad3c
mov qword [rdi], 1
mov qword [rdi + 8], r14
and qword [rsi + 0x90], 0
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0xe0]
and qword [rdi], 0
mov qword [rdi + 8], rax
jmp 0x49ad34
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, [0x00531ee0]
mov edx, 0x3e
call fcn.0042fe50
ud2
Function at 0x4a1782
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], r8
mov rcx, r8
call fcn.004a19bd
mov r15, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
lea rdi, [r14 + 0x10]
lea r12, [rsp + 0x72]
cmp qword [r14 + 8], 0xffffffffffffffff
lea rbp, [rsp + 0x32]
mov r13d, 0
cmovne r13, r14
mov eax, 0x7fffffff
cmp rdx, rax
cmovb rax, rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], r13
mov rdx, qword [r14 + 0x20]
lea rcx, [rsp + 0x68]
mov r8, rbx
xor r9d, r9d
call fcn.004e8185
mov al, byte [rsp + 0x71]
cmp al, 3
je 0x4a1912
mov rsi, qword [rsp + 0x68]
cmp al, 2
je 0x4a1934
mov cl, byte [rsp + 0x70]
movzx edx, word [r12 + 4]
mov word [rbp + 4], dx
mov edx, dword [r12]
mov dword [rbp], edx
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x30], cl
mov byte [rsp + 0x31], al
mov rcx, r13
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.40.0_src_io_poll_evented.rs
call fcn.004edc86
mov rcx, qword [r13 + 8]
mov rdx, r15
mov r8, qword [rsp + 0x40]
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
jne 0x4a1919
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x274a
je 0x4a1927
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.004586c8
cmp al, 0xd
jne 0x4a18ec
mov rax, qword [r13]
test rax, rax
je 0x4a18ec
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
lock inc qword [rdx]
jle 0x4a197f
mov r13, rbp
mov rbp, r15
add rcx, 0x10
mov r8, qword [rax]
mov r9b, byte [rax + 0x18]
call fcn.004585b2
mov r15, rax
xor ecx, ecx
call fcn.00458708
test r15, r15
je 0x4a18e1
mov ecx, 1
mov rdx, rsi
call fcn.00458712
mov rsi, r15
mov r15, rbp
mov rbp, r13
mov r13, qword [rsp + 0x20]
mov rcx, rsi
call fcn.004586c8
cmp al, 0xd
jne 0x4a1934
mov rcx, rdi
lea rdx, [rsp + 0x28]
call fcn.004e83a5
mov rcx, rsi
call fcn.004ed6ba
jmp 0x4a17f0
mov ebx, 1
jmp 0x4a1936
cdqe
test rax, rax
je 0x4a192b
mov qword [rsp + 0x60], rax
jmp 0x4a192d
xor eax, eax
jmp 0x4a192d
jne 0x4a1983
mov qword [rsp + 0x58], rax
xor esi, esi
xor ebx, ebx
test rbx, rbx
jne 0x4a1965
test rsi, rsi
jne 0x4a1965
lea rcx, [rsp + 0x48]
call fcn.004a15e5
mov rdi, rax
xor esi, esi
xor ecx, ecx
xor edx, edx
call fcn.004a1627
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
call fcn.004a19d7
mov rax, rbx
mov rdx, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rax, [0x00538ea0]
lea rcx, [rsp + 0x68]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
and qword [rcx], 0
lea rax, str.ntdll.dll
mov qword [rcx + 0x20], rax
and qword [rcx + 0x28], 0
lea rdx, str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.40.0_src_io_poll_evented.rs
call fcn.0042fe10
ud2
Function at 0x4a43f3
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x20]
mov rcx, qword [rdx + 0x30]
mov rdx, qword [rdx + 0x38]
lea r9, [0x00531e70]
call fcn.004a4747
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x4a44c7
test eax, eax
je 0x4a44e3
cmp eax, 0x90317
je 0x4a454e
cmp eax, 0x90321
jne 0x4a4556
mov dword [rdi + 0x108], 0x10000
xor ebx, ebx
mov byte [rdi + 0x10c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.004a4785
and qword [rdi + 0xd8], 0
mov byte [rsi + 1], bl
jmp 0x4a4564
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xd8], rax
mov byte [rsi + 1], 0
jmp 0x4a4552
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x38]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 8]
and qword [rdi + 0x18], 0
call fcn.004a4758
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.00432f0e
and qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.004a4785
xor eax, eax
cmp qword [rdi + 0x20], rbx
sete al
mov qword [rdi + 0xd8], rax
mov byte [rsi + 1], 0
jmp 0x4a4564
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x4a4564
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x4a55bc
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x20]
mov rcx, qword [rdx + 0x30]
mov rdx, qword [rdx + 0x38]
lea r9, [0x00531e70]
call fcn.004a4747
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x4a5690
test eax, eax
je 0x4a56ac
cmp eax, 0x90317
je 0x4a5717
cmp eax, 0x90321
jne 0x4a571f
mov dword [rdi + 0x208], 0x10000
xor ebx, ebx
mov byte [rdi + 0x20c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.004a5927
and qword [rdi + 0x1d8], 0
mov byte [rsi + 1], bl
jmp 0x4a572d
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1d8], rax
mov byte [rsi + 1], 0
jmp 0x4a571b
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x38]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 8]
and qword [rdi + 0x18], 0
call fcn.004a4758
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.00432f0e
and qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.004a5927
xor eax, eax
cmp qword [rdi + 0x20], rbx
sete al
mov qword [rdi + 0x1d8], rax
mov byte [rsi + 1], 0
jmp 0x4a572d
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x4a572d
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x4ab8b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
sub r8, rdx
cmp r8, 0x20
jae 0x4ab8d1
cmp rcx, rdx
je 0x4ab8dc
cmp r8, 4
jae 0x4ab8df
xor eax, eax
mov rcx, rdx
jmp 0x4ab96c
mov rcx, rdx
mov rdx, r8
jmp fcn.0042e350
xor eax, eax
ret
mov rcx, r8
and rcx, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x004ff6b0]
movdqa xmm3, xmmword [0x004ff6c0]
pxor xmm1, xmm1
movzx r9d, word [rdx + rax]
movd xmm4, r9d
movzx r9d, word [rdx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp rcx, rax
jne 0x4ab900
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp rcx, r8
je 0x4ab989
add rcx, rdx
add rdx, r8
nop
xor r8d, r8d
cmp byte [rcx], 0xc0
lea r9, [rcx + 1]
setge r8b
add rax, r8
mov rcx, r9
cmp r9, rdx
jne 0x4ab970
ret