joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074890
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400748b0
test al, 1
je 0x1400749c7
test al, 2
jne 0x1400749c7
test al, 8
jne 0x1400748f4
mov rdi, qword [rsi + 0x28]
xor ecx, ecx
call fcn.140102310
test rax, rax
je 0x140074914
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x140074917
test al, 0x10
je 0x140074937
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1400749c7
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x140074937
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.1400725a0
mov byte [rsi + 0xa8], 4
xor ecx, ecx
call fcn.140102310
test rax, rax
je 0x140074937
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1400749c7
jne 0x1400749bb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14007497f
mov rcx, rdi
call fcn.140039fc0
lea rcx, [rsi + 0x30]
call fcn.1400725a0
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x14007499e
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
ud2

Function at 0x1400749d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400749f0
test al, 1
je 0x140074b07
test al, 2
jne 0x140074b07
test al, 8
jne 0x140074a34
mov rdi, qword [rsi + 0x28]
xor ecx, ecx
call fcn.140102310
test rax, rax
je 0x140074a54
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x140074a57
test al, 0x10
je 0x140074a77
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x140074b07
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x140074a77
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.1400725a0
mov byte [rsi + 0xa8], 4
xor ecx, ecx
call fcn.140102310
test rax, rax
je 0x140074a77
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140074b07
jne 0x140074afb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140074abf
mov rcx, rdi
call fcn.14006f510
lea rcx, [rsi + 0x30]
call fcn.1400725a0
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x140074ade
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
ud2
Function at 0x140074b10
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140074b20
test al, 1
je 0x140074bf0
test al, 2
jne 0x140074bf0
test al, 8
jne 0x140074b57
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x40], 5
lea rdx, [rsp + 0x20]
call fcn.1400861b0
jmp 0x140074b6f
test al, 0x10
je 0x140074b6f
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140074bf0
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140074bf0
jne 0x140074be8
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140074bb7
mov rcx, rdi
call fcn.14006f510
lea rcx, [rsi + 0x30]
call fcn.1400727c0
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140074bd0
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x48
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x48
pop rdi
pop rsi
ret
ud2

Function at 0x140074c00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140074c10
test al, 1
je 0x140074cb1
test al, 2
jne 0x140074cb1
test al, 8
jne 0x140074c4a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.140087240
jmp 0x140074c64
test al, 0x10
je 0x140074c64
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140074cb1
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140074cb1
jne 0x140074ca7
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.1400744b0
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x140074cc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x2c8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140074cd0
test al, 1
je 0x140074db6
test al, 2
jne 0x140074db6
test al, 8
jne 0x140074d0b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140085ee0
jmp 0x140074d29
test al, 0x10
je 0x140074d29
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140074db6
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140074db6
jne 0x140074dab
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140074d71
mov rcx, rdi
call fcn.140039fc0
lea rcx, [rsi + 0x30]
call fcn.140072130
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140074d90
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x2c8
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x2c8
pop rdi
pop rsi
ret
ud2
Function at 0x140074dc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfa8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140074dd0
test al, 1
je 0x140074eb6
test al, 2
jne 0x140074eb6
test al, 8
jne 0x140074e0b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140087160
jmp 0x140074e29
test al, 0x10
je 0x140074e29
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140074eb6
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140074eb6
jne 0x140074eab
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140074e71
mov rcx, rdi
call fcn.14006f510
lea rcx, [rsi + 0x30]
call fcn.140073ae0
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140074e90
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0xfa8
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0xfa8
pop rdi
pop rsi
ret
ud2

Function at 0x140074ec0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140074ed0
test al, 1
je 0x140074fb6
test al, 2
jne 0x140074fb6
test al, 8
jne 0x140074f0b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 0xc
lea rdx, [rsp + 0x20]
call fcn.1400860d0
jmp 0x140074f29
test al, 0x10
je 0x140074f29
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140074fb6
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140074fb6
jne 0x140074fab
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140074f71
mov rcx, rdi
call fcn.140039fc0
lea rcx, [rsi + 0x30]
call fcn.140073240
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140074f90
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x1d8
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x140074fc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140074fd0
test al, 1
je 0x1400750a3
test al, 2
jne 0x1400750a3
test al, 8
jne 0x14007500a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.140087520
jmp 0x140075022
test al, 0x10
je 0x140075022
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x1400750a3
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1400750a3
jne 0x14007509b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14007506a
mov rcx, rdi
call fcn.140039fc0
lea rcx, [rsi + 0x30]
call fcn.140071fb0
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140075083
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x58
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x58
pop rdi
pop rsi
ret
ud2

Function at 0x1400750b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfa8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400750c0
test al, 1
je 0x1400751a6
test al, 2
jne 0x1400751a6
test al, 8
jne 0x1400750fb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140087160
jmp 0x140075119
test al, 0x10
je 0x140075119
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1400751a6
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1400751a6
jne 0x14007519b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140075161
mov rcx, rdi
call fcn.140039fc0
lea rcx, [rsi + 0x30]
call fcn.140073ae0
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140075180
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0xfa8
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0xfa8
pop rdi
pop rsi
ret
ud2
Function at 0x1400751b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400751c0
test al, 1
je 0x140075290
test al, 2
jne 0x140075290
test al, 8
jne 0x1400751f7
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x40], 5
lea rdx, [rsp + 0x20]
call fcn.1400861b0
jmp 0x14007520f
test al, 0x10
je 0x14007520f
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140075290
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075290
jne 0x140075288
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140075257
mov rcx, rdi
call fcn.140039fc0
lea rcx, [rsi + 0x30]
call fcn.1400727c0
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140075270
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x48
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x48
pop rdi
pop rsi
ret
ud2

Function at 0x1400752a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400752b0
test al, 1
je 0x140075396
test al, 2
jne 0x140075396
test al, 8
jne 0x1400752eb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 0xc
lea rdx, [rsp + 0x20]
call fcn.1400860d0
jmp 0x140075309
test al, 0x10
je 0x140075309
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140075396
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075396
jne 0x14007538b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140075351
mov rcx, rdi
call fcn.14006f510
lea rcx, [rsi + 0x30]
call fcn.140073240
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140075370
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x1d8
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x1400753a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400753b0
test al, 1
je 0x140075483
test al, 2
jne 0x140075483
test al, 8
jne 0x1400753ea
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.140087520
jmp 0x140075402
test al, 0x10
je 0x140075402
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140075483
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075483
jne 0x14007547b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14007544a
mov rcx, rdi
call fcn.14006f510
lea rcx, [rsi + 0x30]
call fcn.140071fb0
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140075463
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x58
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x58
pop rdi
pop rsi
ret
ud2

Function at 0x140075490
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400754a0
test al, 1
je 0x140075586
test al, 2
jne 0x140075586
test al, 8
jne 0x1400754db
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.140084900
jmp 0x1400754f9
test al, 0x10
je 0x1400754f9
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140075586
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075586
jne 0x14007557b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140075541
mov rcx, rdi
call fcn.140039fc0
lea rcx, [rsi + 0x30]
call fcn.140072a20
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140075560
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x208
pop rdi
pop rsi
ret
ud2
Function at 0x140075590
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400755a0
test al, 1
je 0x140075686
test al, 2
jne 0x140075686
test al, 8
jne 0x1400755db
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
call fcn.140087450
jmp 0x1400755f9
test al, 0x10
je 0x1400755f9
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140075686
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401065a0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075686
jne 0x14007567b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140075641
mov rcx, rdi
call fcn.140039fc0
lea rcx, [rsi + 0x30]
call fcn.140074630
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140075660
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0xc8
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0xc8
pop rdi
pop rsi
ret
ud2

Function at 0x140075690
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400756a0
test al, 1
je 0x140075786
test al, 2
jne 0x140075786
test al, 8
jne 0x1400756db
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.140084900
jmp 0x1400756f9
test al, 0x10
je 0x1400756f9
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140075786
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075786
jne 0x14007577b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140075741
mov rcx, rdi
call fcn.14006f510
lea rcx, [rsi + 0x30]
call fcn.140072a20
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140075760
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x208
pop rdi
pop rsi
ret
ud2
Function at 0x140075790
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x2c8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400757a0
test al, 1
je 0x140075886
test al, 2
jne 0x140075886
test al, 8
jne 0x1400757db
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140085ee0
jmp 0x1400757f9
test al, 0x10
je 0x1400757f9
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140075886
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075886
jne 0x14007587b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140075841
mov rcx, rdi
call fcn.14006f510
lea rcx, [rsi + 0x30]
call fcn.140072130
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140075860
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x2c8
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x2c8
pop rdi
pop rsi
ret
ud2

Function at 0x140075890
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400758a0
test al, 1
je 0x140075986
test al, 2
jne 0x140075986
test al, 8
jne 0x1400758db
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
call fcn.140087450
jmp 0x1400758f9
test al, 0x10
je 0x1400758f9
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140075986
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075986
jne 0x14007597b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140075941
mov rcx, rdi
call fcn.14006f510
lea rcx, [rsi + 0x30]
call fcn.140074630
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140075960
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0xc8
pop rdi
pop rsi
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0xc8
pop rdi
pop rsi
ret
ud2

Function at 0x140075990
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400759a0
test al, 1
je 0x140075a41
test al, 2
jne 0x140075a41
test al, 8
jne 0x1400759da
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.140087240
jmp 0x1400759f4
test al, 0x10
je 0x1400759f4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140075a41
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140106840
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140075a41
jne 0x140075a37
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.140074570
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x140088d10
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x198]
cmp rax, qword [rdx + 0x190]
ja 0x140088fcb
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x180]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0x1c0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x140088e82
cmp eax, 0x80090318
je 0x140088f04
test eax, eax
jne 0x140088f22
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x180]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x170], 0
add rcx, rbx
jb 0x140088fcb
cmp rcx, qword [rdi + 0x190]
ja 0x140088fcb
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x168], rbx
jb 0x140088fae
xor r12d, r12d
mov rcx, qword [rdi + 0x160]
add rcx, r12
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x170], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x178], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r15
jb 0x140088fcb
test r15, r15
je 0x140088f50
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x140088fcb
mov qword [rdi + 0x190], 0
cmp rax, r15
jne 0x140088f32
cmp rcx, rdx
jne 0x140088f49
jmp 0x140088f50
cmp eax, 0x90317
je 0x140088f1c
cmp eax, 0x90321
jne 0x140088f22
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x140], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x144], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r14
jb 0x140088fcb
test r14, r14
je 0x140088f86
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x140088fcb
mov qword [rdi + 0x190], 0
cmp rax, r14
jne 0x140088f68
cmp rcx, rdx
jne 0x140088f7f
jmp 0x140088f86
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x1f8], rax
jmp 0x140088f98
mov byte [rsi + 1], 1
jmp 0x140088f9c
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x140088f9e
cmp rcx, rdx
je 0x140088f50
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x190], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x198], r15
mov qword [rdi + 0x1f8], rax
jmp 0x140088f98
cmp rcx, rdx
je 0x140088f86
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x190], rbx
mov qword [rdi + 0x198], r14
mov qword [rdi + 0x1f8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x160]
xor edx, edx
mov r8, rbx
call fcn.140045f90
mov r12, qword [rdi + 0x170]
jmp 0x140088dfc
ud2