joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f37e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400f37f0
test al, 1
je 0x1400f389d
test al, 2
jne 0x1400f38b7
test al, 8
jne 0x1400f382e
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x110], 7
lea rdx, [rsp + 0x50]
call fcn.1400f3630
jmp 0x1400f384c
test al, 0x10
je 0x1400f384c
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1400f3935
mov rcx, qword [rsi + 0x220]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140158e00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400f38d1
jne 0x1400f3893
mov rcx, rsi
add rsp, 0x230
pop rsi
jmp fcn.1400f3980
nop
add rsp, 0x230
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f10d0]
mov edx, 0x23
call fcn.14016f3d0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1110]
mov edx, 0x25
call fcn.14016f3d0
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.14005a1b0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:__
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
lea rdx, [0x1401f1158]
jmp 0x1400f396f
lea rax, str.waker_missing
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, method..virtual_32
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.32.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.14016f2f0
ud2
Function at 0x1400f4170
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400f4180
test al, 1
je 0x1400f422d
test al, 2
jne 0x1400f4247
test al, 8
jne 0x1400f41be
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x110], 7
lea rdx, [rsp + 0x50]
call fcn.1400f3630
jmp 0x1400f41dc
test al, 0x10
je 0x1400f41dc
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1400f42c5
mov rcx, qword [rsi + 0x220]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401577f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x1400f4261
jne 0x1400f4223
mov rcx, rsi
add rsp, 0x230
pop rsi
jmp fcn.1400f4310
nop
add rsp, 0x230
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f10d0]
mov edx, 0x23
call fcn.14016f3d0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1110]
mov edx, 0x25
call fcn.14016f3d0
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.14005a1b0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:__
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
lea rdx, [0x1401f1158]
jmp 0x1400f42ff
lea rax, str.waker_missing
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, method..virtual_32
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.32.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.14016f2f0
ud2
Function at 0x140105a40
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfc0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140105a50
test al, 1
je 0x140105afd
test al, 2
jne 0x140105b17
test al, 8
jne 0x140105a8e
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x568], 4
lea rdx, [rsp + 0x58]
call fcn.1401063c0
jmp 0x140105aac
test al, 0x10
je 0x140105aac
mov rax, qword [rsi + 0xfb0]
test rax, rax
je 0x140105b98
mov rcx, qword [rsi + 0xfa8]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140158e00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x140105b31
jne 0x140105af3
mov rcx, rsi
add rsp, 0xfc0
pop rsi
jmp fcn.140105bf0
nop
add rsp, 0xfc0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f10d0]
mov edx, 0x23
call fcn.14016f3d0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1110]
mov edx, 0x25
call fcn.14016f3d0
ud2
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.14005a1b0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:__
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 2
lea rdx, [0x1401f1158]
jmp 0x140105bd5
lea rax, str.waker_missing
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x58], 0
lea rax, method..virtual_32
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.32.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.14016f2f0
ud2
Function at 0x140106560
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfc0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140106570
test al, 1
je 0x14010661d
test al, 2
jne 0x140106637
test al, 8
jne 0x1401065ae
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x568], 4
lea rdx, [rsp + 0x58]
call fcn.1401063c0
jmp 0x1401065cc
test al, 0x10
je 0x1401065cc
mov rax, qword [rsi + 0xfb0]
test rax, rax
je 0x1401066b8
mov rcx, qword [rsi + 0xfa8]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401577f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x28], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x28]
jb 0x140106651
jne 0x140106613
mov rcx, rsi
add rsp, 0xfc0
pop rsi
jmp fcn.140106710
nop
add rsp, 0xfc0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f10d0]
mov edx, 0x23
call fcn.14016f3d0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1110]
mov edx, 0x25
call fcn.14016f3d0
ud2
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [fcn.14005a1b0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, str.current:___sub:__
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 2
lea rdx, [0x1401f1158]
jmp 0x1401066f5
lea rax, str.waker_missing
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x58], 0
lea rax, method..virtual_32
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.32.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x58]
call fcn.14016f2f0
ud2
Function at 0x14010f1e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm9
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
mov eax, dword [0x140221400]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x18], 0
jne 0x14010f234
call fcn.14014c4e0
mov eax, dword [0x140221400]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm8, xmmword [rax + 0x20]
inc qword [rax + 0x20]
pshufd xmm7, xmm8, 0x44
pxor xmm7, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm6, xmm8, 0xee
pxor xmm6, xmmword [0x140176670]
mov ebx, 1
lea r12, [rsp + 0x60]
xorps xmm9, xmm9
lea r14, [rsp + 0x30]
lea r15, [rsp + 0x28]
nop dword [rax + rax]
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm6
movdqa xmmword [rsp + 0x50], xmm8
movaps xmmword [r12], xmm9
mov qword [r12 + 0x10], 0
mov qword [rsp + 0x28], rbx
mov r8d, 8
mov rcx, r14
mov rdx, r15
call fcn.14006f130
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
shl rsi, 0x38
or rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
add rdx, rax
rol rax, 0xd
xor rcx, rsi
xor rax, rdx
rol rdx, 0x20
mov rdi, qword [rsp + 0x38]
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rcx, rdx
xor rax, rdi
rol rdi, 0x20
xor rdx, rsi
add rdx, rax
rol rax, 0xd
xor rax, rdx
rol rdx, 0x20
xor rdi, 0xff
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0xd
xor rax, rdx
rol rdx, 0x20
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0xd
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
rol rcx, 0x15
xor rax, rdx
add rdi, rax
rol rax, 0x11
mov rdx, rdi
rol rdx, 0x20
xor rax, rdi
xor rax, rcx
inc rbx
xor rax, rdx
je 0x14010f290
mov ecx, dword [0x140221400]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov byte [rcx + 8], 1
mov qword [rcx + 0x10], rax
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm9, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14010fb30
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rcx
lea rcx, [rdx + 0x60]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x14010fb6f
mov rdi, qword [rsp + 0x28]
je 0x14010fbe5
movabs rcx, 0xffffffff00000003
and rcx, rdi
mov eax, edi
and eax, 3
movabs rdx, 0x8009030e00000002
cmp rcx, rdx
cmp eax, 1
jne 0x14010fc34
lea rbx, [rdi - 1]
mov rcx, qword [rdi - 1]
mov rax, qword [rdi + 7]
call qword [rax]
mov rax, qword [rdi + 7]
cmp qword [rax + 8], 0
je 0x14010fbcf
mov r8, qword [rbx]
cmp qword [rax + 0x10], 0x11
jb 0x14010fbc0
mov r8, qword [r8 - 8]
mov rcx, qword [0x140221370]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x140221370]
xor esi, esi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14010fc54
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x14010fc38
mov rcx, qword [0x140221370]
test rcx, rcx
jne 0x14010fc12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14010fc25
mov rcx, rax
mov qword [0x140221370], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14010fc3d
mov edx, 1
mov rcx, rbx
call fcn.14016c090
ud2
xor esi, esi
jmp 0x14010fc54
mov esi, 1
mov rcx, rsi
mov rdx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [r14 + 8], rbx
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], rbx
mov qword [r14], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14012cb60
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x2f0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14012cb70
test al, 1
je 0x14012cc1d
test al, 2
jne 0x14012cc37
test al, 8
jne 0x14012cbae
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x2c0], 4
lea rdx, [rsp + 0x50]
call fcn.14012dad0
jmp 0x14012cbcc
test al, 0x10
je 0x14012cbcc
mov rax, qword [rsi + 0x2e8]
test rax, rax
je 0x14012ccb5
mov rcx, qword [rsi + 0x2e0]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140158e00
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14012cc51
jne 0x14012cc13
mov rcx, rsi
add rsp, 0x2f0
pop rsi
jmp fcn.14012cd00
nop
add rsp, 0x2f0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f10d0]
mov edx, 0x23
call fcn.14016f3d0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1110]
mov edx, 0x25
call fcn.14016f3d0
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.14005a1b0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:__
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
lea rdx, [0x1401f1158]
jmp 0x14012ccef
lea rax, str.waker_missing
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, method..virtual_32
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.32.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.14016f2f0
ud2
Function at 0x14012dc70
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x2f0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14012dc80
test al, 1
je 0x14012dd2d
test al, 2
jne 0x14012dd47
test al, 8
jne 0x14012dcbe
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x2c0], 4
lea rdx, [rsp + 0x50]
call fcn.14012dad0
jmp 0x14012dcdc
test al, 0x10
je 0x14012dcdc
mov rax, qword [rsi + 0x2e8]
test rax, rax
je 0x14012ddc5
mov rcx, qword [rsi + 0x2e0]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401577f0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rsp + 0x20], rax
shl rax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rsp + 0x20]
jb 0x14012dd61
jne 0x14012dd23
mov rcx, rsi
add rsp, 0x2f0
pop rsi
jmp fcn.14012de10
nop
add rsp, 0x2f0
pop rsi
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1401f10d0]
mov edx, 0x23
call fcn.14016f3d0
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1401f1110]
mov edx, 0x25
call fcn.14016f3d0
ud2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.14005a1b0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, str.current:___sub:__
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
lea rdx, [0x1401f1158]
jmp 0x14012ddff
lea rax, str.waker_missing
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, method..virtual_32
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
lea rdx, str.C:UsersUser.cargo_registry_srcgithub.com_1ecc6299db9ec823_tokio_1.32.0_src_runtime_taskcore.rs
lea rcx, [rsp + 0x50]
call fcn.14016f2f0
ud2
Function at 0x1401369d0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x20
jae 0x1401369eb
test rdx, rdx
je 0x1401369f0
cmp rdx, 4
jae 0x1401369f3
xor eax, eax
mov r8, rcx
jmp 0x140136b54
jmp fcn.14005a730
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
lea rax, [r8 - 4]
mov r9, rax
shr r9, 2
inc r9
test rax, rax
je 0x140136b79
mov r10, r9
and r10, 0xfffffffffffffffe
pxor xmm0, xmm0
xor r11d, r11d
movdqa xmm2, xmmword [0x140176930]
movdqa xmm3, xmmword [0x140176600]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx eax, word [rcx + r11]
movd xmm4, eax
movzx eax, word [rcx + r11 + 2]
movd xmm5, eax
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm4, xmm0
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm0, xmm5, 0xd4
pshufd xmm5, xmm0, 0xd4
pand xmm5, xmm3
paddq xmm5, xmm1
movzx eax, word [rcx + r11 + 4]
movd xmm0, eax
movzx eax, word [rcx + r11 + 6]
movd xmm1, eax
pcmpgtb xmm0, xmm2
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0xd4
pshufd xmm0, xmm0, 0xd4
pand xmm0, xmm3
paddq xmm0, xmm4
pcmpgtb xmm1, xmm2
punpcklbw xmm1, xmm1
pshuflw xmm1, xmm1, 0xd4
pshufd xmm1, xmm1, 0xd4
pand xmm1, xmm3
paddq xmm1, xmm5
add r11, 8
add r10, 0xfffffffffffffffe
jne 0x140136a40
test r9b, 1
je 0x140136b3a
movzx eax, word [rcx + r11]
movd xmm2, eax
movzx eax, word [rcx + r11 + 2]
movd xmm3, eax
movdqa xmm4, xmmword [0x140176930]
pcmpgtb xmm2, xmm4
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0xd4
pshufd xmm2, xmm2, 0xd4
movdqa xmm5, xmmword [0x140176600]
pand xmm2, xmm5
paddq xmm0, xmm2
pcmpgtb xmm3, xmm4
punpcklbw xmm3, xmm3
pshuflw xmm2, xmm3, 0xd4
pshufd xmm2, xmm2, 0xd4
pand xmm2, xmm5
paddq xmm1, xmm2
paddq xmm0, xmm1
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
movq rax, xmm1
cmp r8, rdx
je 0x140136b78
add r8, rcx
add rcx, rdx
nop word [rax + rax]
xor edx, edx
cmp byte [r8], 0xc0
lea r9, [r8 + 1]
setge dl
add rax, rdx
mov r8, r9
cmp r9, rcx
jne 0x140136b60
ret
pxor xmm0, xmm0
xor r11d, r11d
pxor xmm1, xmm1
test r9b, 1
jne 0x140136ae3
jmp 0x140136b3a
Function at 0x140136e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rcx]
test rdi, rdi
je 0x140136ec2
mov r11, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
cmp r9, r11
jae 0x140136ec2
movzx eax, byte [rdi + r9]
cmp eax, 0x49
je 0x140136edd
cmp eax, 0x42
jne 0x140136ec2
lea rcx, [r9 + 1]
mov qword [rsi + 0x10], rcx
cmp rcx, r11
jae 0x140136f1a
cmp byte [rdi + rcx], 0x5f
jne 0x140136f1a
lea rax, [r9 + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x140137012
mov rcx, rsi
xor edx, edx
call fcn.140131f90
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc r9
mov qword [rsi + 0x10], r9
mov rcx, rsi
xor edx, edx
call fcn.140131f90
test al, al
jne 0x140136f15
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140136f8c
lea rdx, [0x1401eaaeb]
mov r8d, 1
call fcn.14005b380
test al, al
je 0x140136f8c
mov dil, 2
jmp 0x140136ed1
xor eax, eax
mov r10d, 0x3e
nop word cs:[rax + rax]
mov r8b, 1
cmp rcx, r11
jae 0x14013706c
movzx edx, byte [rdi + rcx]
cmp dl, 0x5f
je 0x140137006
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x140136f6f
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x140136f5e
add dl, 0xa9
jmp 0x140136f6d
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14013706c
add dl, 0xe3
mov ebx, edx
inc rcx
mov qword [rsi + 0x10], rcx
mul r10
jo 0x14013706c
movzx edx, bl
add rax, rdx
jae 0x140136f30
jmp 0x14013706c
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x140136ed1
xor ebx, ebx
lea r14, [0x1401eaee6]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140136fc4
cmp byte [rax + rcx], 0x45
je 0x1401370cd
sub rbx, 1
jb 0x140136fe9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140136fe9
mov r8d, 2
mov rdx, r14
call fcn.14005b380
test al, al
jne 0x140136f15
mov rcx, rsi
call fcn.1401370e0
test al, al
jne 0x140136f15
mov rax, qword [rsi]
test rax, rax
jne 0x140136fb0
jmp 0x140136ed1
inc rcx
mov qword [rsi + 0x10], rcx
inc rax
je 0x14013706c
cmp rax, r9
jae 0x140137069
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1401370bd
cmp qword [rsi + 0x20], 0
je 0x1401370b6
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140136e70
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140136ed3
mov r8b, 1
xor ebx, ebx
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1401370ac
lea rax, [0x1401eaeb1]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14005b380
mov dil, 2
test al, al
jne 0x140136ed1
mov qword [rsi], 0
mov byte [rsi + 8], bl
xor edi, edi
jmp 0x140136ed1
mov bl, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x140137077
jmp 0x1401370ac
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x140136ed1
Function at 0x140139330
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rcx + 8]
test rax, rax
je 0x140139397
mov edx, dword [rcx + 0x10]
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x1401393db
mov rdx, qword [rcx + 0x28]
test rdx, rdx
je 0x1401393d2
xor edi, edi
lea r8, [0x1402181f0]
xor ebx, ebx
nop word cs:[rax + rax]
movzx esi, byte [rax + rdi]
or ebx, dword [r8 + rsi*4]
inc rdi
cmp rdx, rdi
jne 0x1401393c0
jmp 0x1401393d4
xor ebx, ebx
mov dword [rsp + 0x98], ebx
mov rsi, qword [rcx + 0x40]
test rsi, rsi
je 0x14013945b
mov rax, rsi
shr rax, 0x3c
jne 0x140139550
mov rdi, qword [rcx + 0x38]
lea rbx, [rsi*8]
mov rcx, qword [0x140221370]
test rcx, rcx
jne 0x140139422
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x140139541
mov rcx, rax
mov qword [0x140221370], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140139541
mov r14, rax
lea r8, [rdi + rsi*8]
sub r8, rdi
lea rbx, [r8 - 8]
shr rbx, 3
and r8, 0xfffffffffffffff8
mov rcx, rax
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
inc ebx
jmp 0x140139463
xor ebx, ebx
mov r14d, 8
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x68], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x1401394ee
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov ebx, 1
test rsi, rsi
je 0x1401394d3
mov rcx, qword [0x140221370]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rbx
mov rdx, rdi
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
movaps xmm6, xmmword [rsp + 0x50]
mov rcx, qword [0x140221370]
test rcx, rcx
jne 0x140139514
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x140139557
mov rcx, rax
mov qword [0x140221370], rax
mov r8d, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140139557
mov rdi, rax
movaps xmm0, xmmword [0x140176600]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm6
xor ebx, ebx
test rsi, rsi
jne 0x1401394c1
jmp 0x1401394d3
mov edx, 8
mov rcx, rbx
call fcn.14016c090
ud2
call fcn.140013880
ud2
mov ecx, 0x20
mov edx, 8
call fcn.14016c090
ud2