joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140098fd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x2f8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140098fe0
test al, 1
je 0x1400990cf
test al, 2
jne 0x1400990e7
test al, 8
jne 0x14009901b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x58], 4
lea rdx, [rsp + 0x58]
call fcn.140069e50
jmp 0x140099039
test al, 0x10
je 0x140099039
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x14009916b
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140102930
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x1400990ff
jne 0x1400990c4
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140099088
mov rcx, rdi
call fcn.1400c1e10
lea rcx, [rsi + 0x30]
call fcn.140068e00
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1400990a7
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140198260]
xor edx, edx
add rsp, 0x2f8
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x2f8
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401623a0]
mov edx, 0x23
call fcn.14011b5f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401623e0]
mov edx, 0x25
call fcn.14011b5f0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.140008650]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x140162428]
lea rcx, [rsp + 0x58]
call fcn.14011b520
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:UsersCodeX.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.14011b520
int3
Function at 0x1400991b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400991c0
test al, 1
je 0x1400992af
test al, 2
jne 0x1400992c7
test al, 8
jne 0x1400991fb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 0xc
lea rdx, [rsp + 0x50]
call fcn.14006a0d0
jmp 0x140099219
test al, 0x10
je 0x140099219
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x14009934b
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140102930
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400992df
jne 0x1400992a4
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140099268
mov rcx, rdi
call fcn.1400c1e10
lea rcx, [rsi + 0x30]
call fcn.140096f20
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140099287
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140198260]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x208
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401623a0]
mov edx, 0x23
call fcn.14011b5f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401623e0]
mov edx, 0x25
call fcn.14011b5f0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140008650]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140162428]
lea rcx, [rsp + 0x50]
call fcn.14011b520
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersCodeX.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.14011b520
int3
Function at 0x140099390
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400993a0
test al, 1
je 0x140099482
test al, 2
jne 0x14009949a
test al, 8
jne 0x1400993da
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x38], 0x3b9aca01
lea rdx, [rsp + 0x30]
call fcn.14006a730
jmp 0x1400993f2
test al, 0x10
je 0x1400993f2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140099521
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140102930
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x1400994b2
jne 0x140099477
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140099441
mov rcx, rdi
call fcn.1400c1e10
lea rcx, [rsi + 0x30]
call fcn.140069bd0
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x14009945a
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140198260]
xor edx, edx
add rsp, 0x88
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x88
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401623a0]
mov edx, 0x23
call fcn.14011b5f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401623e0]
mov edx, 0x25
call fcn.14011b5f0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [fcn.140008650]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140162428]
lea rcx, [rsp + 0x30]
call fcn.14011b520
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.C:UsersCodeX.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x30]
call fcn.14011b520
int3
Function at 0x140099560
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140099570
test al, 1
je 0x14009965f
test al, 2
jne 0x140099677
test al, 8
jne 0x1400995ab
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x50], 7
lea rdx, [rsp + 0x50]
call fcn.14006a210
jmp 0x1400995c9
test al, 0x10
je 0x1400995c9
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1400996fb
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140102d10
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14009968f
jne 0x140099654
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140099618
mov rcx, rdi
call fcn.1400c2010
lea rcx, [rsi + 0x30]
call fcn.140096370
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140099637
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140198260]
xor edx, edx
add rsp, 0x238
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401623a0]
mov edx, 0x23
call fcn.14011b5f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401623e0]
mov edx, 0x25
call fcn.14011b5f0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140008650]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rdx, [0x140162428]
lea rcx, [rsp + 0x50]
call fcn.14011b520
lea rax, str.waker_missing
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rdx, str.C:UsersCodeX.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.14011b520
int3
Function at 0x140099740
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140099750
test al, 1
je 0x140099832
test al, 2
jne 0x14009984a
test al, 8
jne 0x14009978a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x38], 0x3b9aca01
lea rdx, [rsp + 0x30]
call fcn.14006a730
jmp 0x1400997a2
test al, 0x10
je 0x1400997a2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x1400998d1
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140102d10
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x140099862
jne 0x140099827
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1400997f1
mov rcx, rdi
call fcn.1400c2010
lea rcx, [rsi + 0x30]
call fcn.140069bd0
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x14009980a
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140198260]
xor edx, edx
add rsp, 0x88
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x88
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401623a0]
mov edx, 0x23
call fcn.14011b5f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401623e0]
mov edx, 0x25
call fcn.14011b5f0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [fcn.140008650]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rdx, [0x140162428]
lea rcx, [rsp + 0x30]
call fcn.14011b520
lea rax, str.waker_missing
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.C:UsersCodeX.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x30]
call fcn.14011b520
int3
Function at 0x140099910
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140099920
test al, 1
je 0x1400999c8
test al, 2
jne 0x1400999e0
test al, 8
jne 0x14009995a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0xc8], 4
lea rdx, [rsp + 0x58]
call fcn.1400692b0
jmp 0x140099978
test al, 0x10
je 0x140099978
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140099a64
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140102930
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x1400999f8
jne 0x1400999be
mov rcx, rsi
add rsp, 0xd0
pop rsi
jmp fcn.1400978f0
nop
add rsp, 0xd0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401623a0]
mov edx, 0x23
call fcn.14011b5f0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401623e0]
mov edx, 0x25
call fcn.14011b5f0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.140008650]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rdx, [0x140162428]
lea rcx, [rsp + 0x58]
call fcn.14011b520
lea rax, str.waker_missing
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, str.C:UsersCodeX.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.14011b520
int3
Function at 0x14009f350
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, r8
mov rdi, rdx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x60]
mov r8d, 0xb
mov rdx, rax
call fcn.1400af590
mov dword [rsp + 0x38], 0x800
mov dword [rsp + 0x3c], 0
movzx eax, byte [0x140198310]
mov edx, 0x800
xor ecx, ecx
call fcn.1400f3050
test rax, rax
je 0x14009f4db
mov rbx, rax
mov qword [rsp + 0x48], 0x800
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov r14, qword [rsp + 0x68]
lea rbp, [rsp + 0x38]
lea r15, [rsp + 0x3c]
mov r12, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
sub rsi, r13
nop word [rax + rax]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9, r15
call r12
cmp eax, 0xea
jne 0x14009f42e
mov r8d, dword [rsp + 0x38]
cmp rsi, r8
jae 0x14009f3f0
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.140123dc0
mov rbx, qword [rsp + 0x50]
jmp 0x14009f3da
test eax, eax
jne 0x14009f450
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x14009f4b8
movabs rax, 0xde00000002
jmp 0x14009f458
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rsp + 0x48], 0
je 0x14009f48a
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x140198260]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x60], 0
je 0x14009f4a6
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x140198260]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
cmp qword [rsp + 0x60], 0
jne 0x14009f492
jmp 0x14009f4a6
mov ecx, 1
mov edx, 0x800
call fcn.14011b260
int3
Function at 0x1400ad900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14008da90
test al, al
je 0x1400ad973
mov byte [rsi + 0x20], 3
lea rcx, [r14 + 0x18]
mov rax, qword [r14]
mov rdx, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
call qword [rax + 0x10]
mov rax, qword [rbx]
test rax, rax
je 0x1400ade8e
mov rax, qword [rax + 0x10]
lea rcx, [rbx + 0x18]
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x28], rsi
mov rcx, rdi
mov rdx, rbx
call fcn.14001d3c0
mov ebp, eax
movzx r13d, word [rdi + 0x58]
mov r14d, ebp
mov esi, ebp

Function at 0x1400aff20
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, [rdx + 0xf0]
add byte [rax], al
add byte [rax - 0x39], cl
and al, 0x20
add byte [rax], al
add byte [rax], al
Function at 0x1400df550
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400df575
cmp rax, rcx
je 0x1400df57b
cmp rdx, 4
jae 0x1400df57f
xor eax, eax
xor r8d, r8d
jmp 0x1400df610
pop rbp
jmp fcn.140008a60
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1401286c0]
movdqa xmm3, xmmword [0x1401286d0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400df5a0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400df627
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400df610
pop rbp
ret

Function at 0x1400e2ae0
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
add byte [rax], al
Function at 0x1400e7760
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
test r8, r8
je 0x1400e77bb
mov rsi, r9
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov r14, rax
mov eax, 1
test r14, r14
je 0x1400e77c1
cmp r14, 0xffffffffffffffff
jne 0x1400e77d9
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
jmp 0x1400e77cb
xor edx, edx
xor eax, eax
jmp 0x1400e77cb
movabs rdx, 0x600000002
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov dword [rbp - 0x10], 0
lea rdx, [rbp - 0x10]
mov rcx, r14
call qword [sym.imp.kernel32.dll_GetConsoleMode]
test eax, eax
je 0x1400e78b1
movzx ecx, byte [rsi + 4]
test rcx, rcx
je 0x1400e7925
cmp cl, 4
jae 0x1400e79e4
movups xmm0, xmmword [0x14015f528]
movaps xmmword [rbp + 0x20], xmm0
mov eax, 0xffffffff
cmp rbx, rax
cmovb rax, rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, r14
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400e7916
mov rcx, r14
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x20]
cmp eax, 0x103
je 0x1400e7a16
test eax, eax
js 0x1400e798c
cmp rbx, 0x1000
mov r8d, 0x1000
cmovb r8, rbx
lea rcx, [rbp + 0x20]
mov rdx, rdi
call fcn.140009b90
cmp qword [rbp + 0x20], 0
je 0x1400e7999

Function at 0x1400ecbf0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.1400ed030
mov rax, qword [rbp - 0x60]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x1400ecc46
lea rcx, [rbp - 0x58]
call fcn.1400e7370
mov qword [rsi], rdi
jmp 0x1400ece97
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x410], 2
mov qword [rbp + 0x418], 0

Function at 0x1400ef930
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.1400ed030
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1400ef98d
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
call 0x1005c86bf
Function at 0x1400f2090
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov rax, qword [0x140198268]
cmp rax, 3
jne 0x1400f2282
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x1400f22a8
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call fcn.14011a750
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x1400f2128
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400f21e4
inc rdx
cmp rax, rdx
jne 0x1400f2110
jmp 0x1400f224d
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x1400f215e
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400f21e4
inc rdx
cmp rcx, rdx
jne 0x1400f2140
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x1400f2162
jmp 0x1400f21ae
lea rdx, [rdi - 0xf]
movdqa xmm0, xmmword [0x140128700]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1400f21ae
add rcx, 0x10
cmp rcx, rdx
jbe 0x1400f2180
sub rax, rcx
je 0x1400f224d
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x1400f21e1
inc rdx
cmp rax, rdx
jne 0x1400f21d0
jmp 0x1400f224d
add rdx, rcx
cmp rdx, rdi
jne 0x1400f224d
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400f2261
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400f2279
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400f22ba
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x1400f22ba
mov rbx, rdx
call fcn.1401256a0
mov rdx, rbx
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
jbe 0x1400f20e7
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.140125710
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f2b50
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140198310]
mov edx, 0x10
xor ecx, ecx
call fcn.1400f3050
test rax, rax
je 0x1400f2c49
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400f2d00]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400f2c3b
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x1400f2be7
mov rcx, qword [rbp - 0x18]
call rax
mov r8, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x1400f2c14
cmp qword [rax + 0x10], 0x11
jb 0x1400f2c05
mov r8, qword [r8 - 8]
mov rcx, qword [0x140198260]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x140198260]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14011b280
ud2