joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a90
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
lea r8, str.ApMsgFwd_Mutex_Object
mov qword [rsp + 0x30], r14
mov r14, rcx
xor edx, edx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
mov rbp, rax
je 0x401bea
lea r8, [0x00406600]
xor edx, edx
mov ecx, 0xf001f
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test rax, rax
mov rdi, rax
je 0x401bdc
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x20], 0x1a0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov r12, rax
je 0x401bce
lea r8, str.ApMsgFwd_Event_Start
xor edx, edx
mov ecx, 0x100002
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], r13
call qword [sym.imp.KERNEL32.dll_OpenEventA]
lea r8, str.ApMsgFwd_Event_Finish
xor edx, edx
mov ecx, 0x100002
mov r13, rax
call qword [sym.imp.KERNEL32.dll_OpenEventA]
test r13, r13
mov rbx, rax
je 0x401bad
test rax, rax
je 0x401ba4
mov edx, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
mov rdx, r14
mov r8d, 0x1a0
call sub.msvcrt.dll_memcpy
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [r12 + 8]
mov rcx, rbp
mov qword [r14 + 8], rax
mov esi, eax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
mov r13, qword [rsp + 0x38]
je 0x401bc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rbx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x58]
movsxd rax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x402d90
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x00406940]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x00406a38]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x402e11
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x00406a38]
jmp 0x402e2d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x00406a38], r11
mov qword [0x004069d8], rax
mov rax, qword [0x00406730]
mov qword [0x004068b0], r11
mov qword [0x004069c0], rdi
mov dword [0x004068a0], 0xc0000409
mov dword [0x004068a4], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x00406728]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004042f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x00406730]
jne 0x403199
rol rcx, 0x10
test cx, 0xffff
jne 0x403195
ret
ror rcx, 0x10
jmp 0x402d90
Function at 0x402ec0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x00400000], 0x5a4d
je 0x402efd
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x402f8b
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x402f21
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x402f8b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x402f68
cmp ecx, 0x20b
je 0x402f40
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x402f8b
cmp dword [rax + 0x84], 0xe
ja 0x402f54
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x402f8b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x402f8b
cmp dword [rax + 0x74], 0xe
ja 0x402f79
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x402f8b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x00406f18], 0xffffffffffffffff
mov qword [0x00406f20], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x00406e1c]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x00406e18]
mov dword [rcx], eax
call fcn.00403160
cmp dword [0x00406740], 0
jne 0x402fe5
lea rcx, [fcn.00403160]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x004042e8]
lea rcx, [0x004042e0]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x00406e14]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x00406e10]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x004042d8]
lea rcx, [0x004042c8]
call fcn.00496000
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x403086
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x403076
cmp al, 0x22
je 0x403076
jmp 0x403060
cmp byte [r8], 0x22
jne 0x403096
inc r8
mov qword [rsp + 0x30], r8
jmp 0x403096
cmp byte [r8], 0x20
jbe 0x403096
inc r8
mov qword [rsp + 0x30], r8
jmp 0x403086
movzx eax, byte [r8]
test al, al
je 0x4030ac
cmp al, 0x20
ja 0x4030ac
inc r8
mov qword [rsp + 0x30], r8
jmp 0x403096
test byte [rsp + 0x8c], 1
je 0x4030c1
movzx r9d, word [rsp + 0x90]
jmp 0x4030c7
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.00401680
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x4030e3
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x403107
mov eax, edi
jmp 0x403110
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x140b8431e
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
lea r11, [0x140b9c540]
lea rsp, [rsp + 8]
movzx r10d, byte [rcx]
push 0x439da2a3
xor r10d, r9d
and r10d, 0xff
mov r10d, dword [r11 + r10*4]
shr r9d, 8
rol dword [rsp + 2], 0x98
xor r9d, r10d
inc rcx
xor r9d, 0x41b26726
push 0xffffffff95842aad
dec rax
lea rsp, [rsp + 0x10]
jne 0x140b8432a
push 0xffffffffbcabe225
not r9d
push 0xffffffffee04559f
mov dword [rdi], r9d
lea rsp, [rsp + 0x10]
jmp fcn.140b80bf3

Function at 0x140b8de6c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], 0x29100bf
lea rsp, [rsp + 0x20]
je 0x140b8deea
push rsi
mov esi, 0xe8881584
lea rsi, [0x140b98aa8]
mov r9d, 0x422ed002
movzx r9d, byte [r8 + r9 - 0x422ed002]
push 0xffffffffae0ece8c
xor r9d, ecx
and r9d, 0xff
ror qword [rsp], 0x63
mov r9d, dword [rsi + r9*4]
push 0x32307d09
not dword [rsp + 0xa]
shr ecx, 8
xor ecx, r9d
inc r8
ror byte [rsp + 0xd], 0x42
xor ecx, 0xe28365a1
dec r10
push 0x67342b38
lea rsp, [rsp + 0x18]
jne 0x140b8de8d
mov esi, 0xd4931999
pop rsi
not ecx
jmp 0x140b7d970
Function at 0x140026c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x140026d10
cmp r10, rax
jb 0x140026d84
cmp r10, rdx
ja 0x140026d98
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x140026d12
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x140026cf0
jmp 0x140026d73
ja 0x140026d1a
mov rax, r10
cmp r11, r8
jne 0x140026cc2
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x140026d50
mov r15, rbx
sub ecx, edx
jns 0x140026d6a
jmp 0x140026d75
cmp rbx, r14
je 0x140026da9
movzx ebp, byte [r15 + 1]
add r15, 2
and edx, 0x7f
shl edx, 8
or edx, ebp
sub ecx, edx
js 0x140026d75
xor al, 1
cmp r15, r14
jne 0x140026d30
jmp 0x140026d75
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.1400e35a0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400e34d0
ud2
lea rcx, [0x14014ea11]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400e34e0
ud2

Function at 0x14002f3b4
Capabilities:
Hash data using fnv

Disassembly:
mov r9, qword [rcx]
xor r11d, r11d
movabs r10, 0x100000001b3
cmp r8, r11
je 0x14002f3da
movzx eax, byte [rdx + r11]
xor r9, rax
imul r9, r10
inc r11
jmp 0x14002f3c4
mov qword [rcx], r9
ret

Function at 0x14002f5bf
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor ecx, ecx
cmp qword [rdi + 0x18], 0
setne cl
call fcn.14002f391
cmp qword [rdi + 0x18], 0
je 0x14002f5f6
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14002f3b4
mov cl, byte [rdi]
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400d7c3f
Function at 0x14004de10
Capabilities:
Decode data using base64 via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rdx, rcx
lea rsi, [rsp + 0x48]
mov r8d, 0x5d5
mov rcx, rsi
call fcn.140024ff0
cmp qword [rsi], 0
je 0x14004deb8
mov ecx, 0x2b
xor edx, edx
call fcn.14009a6f5
mov rsi, rax
mov rdi, rdx
movups xmm0, xmmword [str.PEM_representation_contains_non_UTF_8_bytes]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x140113df1]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x140113dfc]
movups xmmword [rax + 0x1b], xmm0
mov ecx, 0x18
call fcn.14001fe38
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], 0x2b
lea r8, [0x14011e0e8]
mov cl, 0x14
mov rdx, rax
call fcn.1400b1dd0
mov rsi, rax
mov eax, 1
mov rdx, rsi
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x58]
mov rax, rsi
shr rax, 0x20
jne 0x14004df90
mov rdi, qword [rsp + 0x50]
lea r12, [rsp + 0x44]
and dword [r12], 0
xorps xmm6, xmm6
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov edx, esi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.crypt32.dll_CryptStringToBinaryA]
test eax, eax
je 0x14004df6e
mov r15d, dword [rsp + 0x44]
mov rcx, r15
mov dl, 1
call fcn.14009a6f5
mov rbx, rax
mov r14, rdx
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov edx, esi
xor r8d, r8d
mov r9, rax
call qword [sym.imp.crypt32.dll_CryptStringToBinaryA]
test eax, eax
je 0x14004df78
mov ecx, 0x10001
mov rdx, rbx
mov r8d, r15d
call qword [sym.imp.crypt32.dll_CertCreateCertificateContext]
mov rdi, rax
mov rsi, rax
test rax, rax
jne 0x14004df53
call fcn.14004cfd9
mov rsi, rax
mov rcx, rbx
mov rdx, r14
call fcn.140021595
test rdi, rdi
je 0x14004de9d
xor eax, eax
jmp 0x14004dea2
call fcn.14004cfd9
jmp 0x14004de9a
call fcn.14004cfd9
mov rsi, rax
mov rcx, rbx
mov rdx, r14
call fcn.140021595
jmp 0x14004de9d
lea rcx, str.assertion_failed:_pem.len_____u32::max_value___as_usizeC:Users_tuxis.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.21_srccert_context.rs
lea r8, [0x14011e200]
mov edx, 0x38
call fcn.1400e34e0
ud2

Function at 0x14004e102
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsi + 0x20]
add rsp, 0x50
pop rsi
ret
Function at 0x14004fbd8
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140051fac
test rax, rax
je 0x14004fc10
mov edx, 4
mov rcx, rax
call fcn.14001d460
jmp 0x14004fc49
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.14004f04c
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.14004f0cc
Function at 0x140051fac
Capabilities:
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdx, rcx
mov ebx, 0x20
xor r14d, r14d
mov r15d, 0xffffffff
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test rbx, rbx
je 0x140052027
cmp rbx, r15
mov r8d, 0xffffffff
cmovb r8, rbx
sub rbx, r8
lea rsi, [rdx + r8]
xor ecx, ecx
mov r9d, 2
call r12
mov rdx, rsi
cmp eax, 0xc0000000
jb 0x140051fd1
mov edi, eax
xor edi, 0x80000000
je 0x140052024
mov ecx, 4
mov edx, 4
call fcn.14001d3d0
test rax, rax
je 0x140052038
mov r14, rax
mov dword [rax], edi
jmp 0x140052027
xor r14d, r14d
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.1400e3100
ud2
Function at 0x14005f397
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0xc0]
mov rcx, qword [rdx + 0xa8]
mov rdx, qword [rdx + 0xb8]
lea r9, str.C:Users_tuxis.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.21_src_tls_stream.rs
call fcn.14005e0a0
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 8]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14005f478
test eax, eax
je 0x14005f497
cmp eax, 0x90317
je 0x14005f518
cmp eax, 0x90321
jne 0x14005f520
mov dword [rdi + 0x108], 0x10000
xor ebx, ebx
mov byte [rdi + 0x10c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xc0]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14005f337
and qword [rdi + 0x80], 0
mov byte [rsi + 1], bl
jmp 0x14005f52e
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x80], rax
mov byte [rsi + 1], 0
jmp 0x14005f51c
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0xa8]
mov rdx, qword [rdi + 0xb8]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x88]
and qword [rdi + 0x98], 0
call fcn.14005f538
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.14001ef6c
and qword [rdi + 0xa0], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0xc0]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14005f337
xor eax, eax
cmp qword [rdi + 0xc0], rbx
sete al
mov qword [rdi + 0x80], rax
mov byte [rsi + 1], 0
jmp 0x14005f52e
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x14005f52e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005f7fc
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x1c0]
mov rcx, qword [rdx + 0x1a8]
mov rdx, qword [rdx + 0x1b8]
lea r9, str.C:Users_tuxis.cargo_registry_srcgithub.com_1ecc6299db9ec823_schannel_0.1.21_src_tls_stream.rs
call fcn.14005e0a0
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 8]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14005f8dd
test eax, eax
je 0x14005f8fc
cmp eax, 0x90317
je 0x14005f97d
cmp eax, 0x90321
jne 0x14005f985
mov dword [rdi + 0x208], 0x10000
xor ebx, ebx
mov byte [rdi + 0x20c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1c0]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14005f79c
and qword [rdi + 0x180], 0
mov byte [rsi + 1], bl
jmp 0x14005f993
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x180], rax
mov byte [rsi + 1], 0
jmp 0x14005f981
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x1a8]
mov rdx, qword [rdi + 0x1b8]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x188]
and qword [rdi + 0x198], 0
call fcn.14005f538
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.14001ef6c
and qword [rdi + 0x1a0], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x1c0]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14005f79c
xor eax, eax
cmp qword [rdi + 0x1c0], rbx
sete al
mov qword [rdi + 0x180], rax
mov byte [rsi + 1], 0
jmp 0x14005f993
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x14005f993
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005f99d
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx + 0x18], 2
jne fcn.14005f9b0
add rcx, 0x20
jmp fcn.1400d4242
Function at 0x1400638d4
Capabilities:
Connect socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov r14, r8
mov rdi, rdx
mov r15, rcx
movzx eax, byte [rdx + 0x78]
test eax, eax
je 0x140063918
cmp eax, 3
je 0x14006398c
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:Users_tuxis.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_util_0.7.7_srclib.rs
lea r8, str.C:Users_tuxis.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.27.0_src_net_tcp_socket.rs
mov edx, 0x23
call fcn.1400e34e0
ud2
mov rax, qword [rdi]
mov qword [rdi + 8], rax
movups xmm0, xmmword [rdi + 0x58]
movups xmm1, xmmword [rdi + 0x68]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.1400d1d6f
mov rcx, qword [rdi + 8]
mov r8d, dword [rsi + 0x80]
mov rdx, rsi
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x14006397b
call fcn.14004cfd9
mov r12, rax
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.1400a401c
cmp al, 0xd
jne 0x1400639d9
lea rcx, [rsp + 0x30]
call fcn.140005d7d
mov rax, qword [rdi + 8]
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], rax
mov byte [rdi + 0x50], 0
lea rsi, [rdi + 0x10]
lea rbx, [rsp + 0x50]
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call fcn.140063a1c
mov rbx, qword [rbx + 0x10]
cmp rbx, 3
jne 0x1400639bb
mov byte [rdi + 0x78], 3
mov qword [r15 + 0x10], 3
jmp 0x140063a00
mov r12, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
movups xmm0, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rsi
call fcn.140062d50
jmp 0x1400639e7
mov rcx, qword [rdi + 8]
call fcn.14005c41f
mov ebx, 2
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [r15 + 0x18], xmm0
mov byte [rdi + 0x78], 1
mov qword [r15], r12
mov qword [r15 + 8], r14
mov qword [r15 + 0x10], rbx
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140090b1a
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov rsi, rdx
mov r14, rcx
lea rdi, [rsp + 0x58]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.1400909ed
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
and dword [r15], 0
mov ecx, 0x800
call fcn.14004c359
mov rbx, rax
lea r12, [rsp + 0x40]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x140090bb7
mov edx, dword [rsp + 0x38]
mov rcx, r12
call fcn.14001eeac
mov rbx, qword [rsp + 0x40]
jmp 0x140090b82
test eax, eax
jne 0x140090bd9
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x140090bf8
movabs rax, 0xde00000002
jmp 0x140090be1
shl rax, 0x20
or rax, 2
mov qword [r14], rax
mov byte [r14 + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140021595
jmp 0x140090c0e
mov rcx, qword [rsp + 0x50]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov byte [r14 + 0x18], al
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.14009ade2
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret