joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180087b00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180087b20
test al, 1
je 0x180087cf1
test al, 2
jne 0x180087cf1
test al, 8
jne 0x180087c45
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180087b9d
xorps xmm6, xmm6
test eax, eax
jne 0x180087bc9
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800879f0
mov byte [rsi + 0xa8], 4
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180087c29
test eax, eax
jne 0x180087c63
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x180087c63
test al, 0x10
je 0x180087c63
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180087cf1
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180109b90
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180087cf1
jne 0x180087ce4
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180087ca5
call fcn.180079960
lea rcx, [rsi + 0x30]
call fcn.1800879f0
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180087cc4
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fe9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x180088990
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800889b0
test al, 1
je 0x180088b81
test al, 2
jne 0x180088b81
test al, 8
jne 0x180088ad5
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180088a2d
xorps xmm6, xmm6
test eax, eax
jne 0x180088a59
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800879f0
mov byte [rsi + 0xa8], 4
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180088ab9
test eax, eax
jne 0x180088af3
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x180088af3
test al, 0x10
je 0x180088af3
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180088b81
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180108c00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180088b81
jne 0x180088b74
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180088b35
call fcn.1800798c0
lea rcx, [rsi + 0x30]
call fcn.1800879f0
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180088b54
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fe9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x180089440
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180089450
test al, 1
je 0x1800894f1
test al, 2
jne 0x1800894f1
test al, 8
jne 0x18008948a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.180089270
jmp 0x1800894a4
test al, 0x10
je 0x1800894a4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x1800894f1
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180109b90
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800894f1
jne 0x1800894e7
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180089500
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x180089c50
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180089c60
test al, 1
je 0x180089d01
test al, 2
jne 0x180089d01
test al, 8
jne 0x180089c9a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.180089270
jmp 0x180089cb4
test al, 0x10
je 0x180089cb4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x180089d01
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180108c00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180089d01
jne 0x180089cf7
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180089d10
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x18008ae70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008ae90
test al, 1
je 0x18008b062
test al, 2
jne 0x18008b062
test al, 8
jne 0x18008afb6
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008af0d
xorps xmm6, xmm6
test eax, eax
jne 0x18008af39
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.18008ad80
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008af9a
test eax, eax
jne 0x18008afd4
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x18008afd4
test al, 0x10
je 0x18008afd4
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x18008b062
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180109b90
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008b062
jne 0x18008b055
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18008b016
call fcn.180079960
lea rcx, [rsi + 0x30]
call fcn.18008ad80
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x18008b035
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fe9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x18008bd90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008bdb0
test al, 1
je 0x18008bf82
test al, 2
jne 0x18008bf82
test al, 8
jne 0x18008bed6
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008be2d
xorps xmm6, xmm6
test eax, eax
jne 0x18008be59
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.18008ad80
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008beba
test eax, eax
jne 0x18008bef4
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x18008bef4
test al, 0x10
je 0x18008bef4
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x18008bf82
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180108c00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008bf82
jne 0x18008bf75
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18008bf36
call fcn.1800798c0
lea rcx, [rsi + 0x30]
call fcn.18008ad80
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x18008bf55
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fe9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x18008fee0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008fef0
test al, 1
je 0x18008ff7d
test al, 2
jne 0x18008ff7d
test al, 8
jne 0x18008ff22
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18008fd40
jmp 0x18008ff36
test al, 0x10
je 0x18008ff36
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18008ff7d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180109b90
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008ff7d
jne 0x18008ff76
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18008ff90
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x1800904b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800904c0
test al, 1
je 0x18009054d
test al, 2
jne 0x18009054d
test al, 8
jne 0x1800904f2
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18008fd40
jmp 0x180090506
test al, 0x10
je 0x180090506
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18009054d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180108c00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18009054d
jne 0x180090546
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.180090560
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800a7100
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a7110
test al, 1
je 0x1800a719a
test al, 2
jne 0x1800a719a
test al, 8
jne 0x1800a713f
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800a6f60
jmp 0x1800a7153
test al, 0x10
je 0x1800a7153
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800a719a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180109b90
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a719a
jne 0x1800a7193
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800a71a0
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x1800a7740
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a7750
test al, 1
je 0x1800a77da
test al, 2
jne 0x1800a77da
test al, 8
jne 0x1800a777f
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800a6f60
jmp 0x1800a7793
test al, 0x10
je 0x1800a7793
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800a77da
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180108c00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a77da
jne 0x1800a77d3
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800a77e0
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800ac570
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800ac590
test al, 1
je 0x1800ac762
test al, 2
jne 0x1800ac762
test al, 8
jne 0x1800ac6b6
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800ac60d
xorps xmm6, xmm6
test eax, eax
jne 0x1800ac639
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800ac4b0
mov qword [rsi + 0x30], 3
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800ac69a
test eax, eax
jne 0x1800ac6d4
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x1800ac6d4
test al, 0x10
je 0x1800ac6d4
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800ac762
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180109b90
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ac762
jne 0x1800ac755
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800ac716
call fcn.180079960
lea rcx, [rsi + 0x30]
call fcn.1800ac4b0
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800ac735
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fe9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800ad3e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800ad400
test al, 1
je 0x1800ad5d2
test al, 2
jne 0x1800ad5d2
test al, 8
jne 0x1800ad526
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800ad47d
xorps xmm6, xmm6
test eax, eax
jne 0x1800ad4a9
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800ac4b0
mov qword [rsi + 0x30], 3
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800ad50a
test eax, eax
jne 0x1800ad544
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801026d0]
call fcn.1800f56d0
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fea34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x1800ad544
test al, 0x10
je 0x1800ad544
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800ad5d2
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180108c00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ad5d2
jne 0x1800ad5c5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800ad586
call fcn.1800798c0
lea rcx, [rsi + 0x30]
call fcn.1800ac4b0
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800ad5a5
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fe9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x1800b2a30
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b2a40
test al, 1
je 0x1800b2ae2
test al, 2
jne 0x1800b2ae2
test al, 8
jne 0x1800b2a7b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800b3030
jmp 0x1800b2a95
test al, 0x10
je 0x1800b2a95
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800b2ae2
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180109b90
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b2ae2
jne 0x1800b2ad8
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800b2af0
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800b31d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b31e0
test al, 1
je 0x1800b3282
test al, 2
jne 0x1800b3282
test al, 8
jne 0x1800b321b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800b3030
jmp 0x1800b3235
test al, 0x10
je 0x1800b3235
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800b3282
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180108c00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b3282
jne 0x1800b3278
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800b3290
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800c46b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800c46c0
test al, 1
je 0x1800c4762
test al, 2
jne 0x1800c4762
test al, 8
jne 0x1800c46fb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800c4520
jmp 0x1800c4715
test al, 0x10
je 0x1800c4715
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800c4762
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180109b90
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800c4762
jne 0x1800c4758
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800c4770
nop
add rsp, 0xfa0
pop rsi
ret
ud2

Function at 0x1800c4d50
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800c4d60
test al, 1
je 0x1800c4e02
test al, 2
jne 0x1800c4e02
test al, 8
jne 0x1800c4d9b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800c4520
jmp 0x1800c4db5
test al, 0x10
je 0x1800c4db5
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800c4e02
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180108c00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800c4e02
jne 0x1800c4df8
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800c4e10
nop
add rsp, 0xfa0
pop rsi
ret
ud2
Function at 0x1800cc170
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800cc1b2
mov rdi, qword [rsp + 0x28]
je 0x1800cc21f
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800cc292
test rax, rax
je 0x1800cc292
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800cc208
cmp qword [rdi + 0x10], 0x11
jb 0x1800cc1f6
mov r14, qword [r14 - 8]
mov rcx, qword [0x1801fe9b8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1801fe9b8]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1800cc292
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800cc275
movzx eax, byte [0x1801fea30]
mov rcx, qword [0x1801fe9b8]
test rcx, rcx
jne 0x1800cc253
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800cc266
mov rcx, rax
mov qword [0x1801fe9b8], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800cc27b
mov ecx, 1
mov rdx, rbx
call fcn.180169390
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180167370
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret