joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140167b50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe88
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xdf0], xmm13
movaps xmmword [rbp + 0xde0], xmm12
movaps xmmword [rbp + 0xdd0], xmm11
movdqa xmmword [rbp + 0xdc0], xmm10
movdqa xmmword [rbp + 0xdb0], xmm9
movdqa xmmword [rbp + 0xda0], xmm8
movdqa xmmword [rbp + 0xd90], xmm7
movdqa xmmword [rbp + 0xd80], xmm6
mov qword [rbp + 0xd78], 0xfffffffffffffffe
mov rax, qword [rcx]
cmp rax, 4
je 0x14016b10c
cmp eax, 3
je 0x14016b124
mov r15, rdx
cmp eax, 2
mov qword [rbp + 0xd18], rcx
jne 0x14016a51e
lea rdi, [rcx + 8]
lea rax, [rcx + 0x98]
mov qword [rbp + 0xd50], rax
lea rax, [rcx + 0x10]
mov qword [rbp + 0xd28], rax
lea rax, [rcx + 0xa8]
mov qword [rbp + 0xce8], rax
movdqa xmm6, xmmword [str.0000000000000000__t]
pcmpeqd xmm7, xmm7
movdqa xmm8, xmmword [0x140268c20]
movdqa xmm9, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmm10, xmmword [0x140268730]
xorps xmm11, xmm11
lea rsi, [rbp + 0x720]
lea rbx, [rbp + 0xa80]
mov qword [rbp + 0xcb0], r15
mov qword [rbp + 0xcf8], rdi
nop word cs:[rax + rax]
mov rdx, r15
call fcn.14016f500
test rax, rax
je 0x14016a601
test rdx, rdx
je 0x14016a77c
mov rax, qword [rbp + 0xd18]
lea rcx, str.Map_must_not_be_polled_after_it_returned__Poll::Ready_
lea r8, str.C:UsersAdmin_scooppersist_rustup.cargo_registry_srcindex.crates.io_6f17d22bba15001f_futures_util_0.3.31_src_future_futuremap.rs
mov edx, 0x36
call fcn.14025bae0
lea rcx, str.C:UsersAdmin_scooppersist_rustup.cargo_registry_srcindex.crates.io_6f17d22bba15001fhyper_0.14.31_srcclientconn.rs
call fcn.14025bec0
Function at 0x140180720
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rax, qword [rcx]
nop dword [rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140180740
test al, 1
je 0x140180833
test al, 2
jne 0x14018084b
test al, 8
mov qword [rbp + 0x38], rcx
jne 0x14018077c
add rcx, 0x20
mov dword [rbp - 0x30], 2
lea rdx, [rbp - 0x30]
call fcn.140182010
add byte [rax], al
jmp 0x140180798
test al, 0x10
je 0x140180798
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx + 0x70]
test rax, rax
je 0x1401808c0
mov rcx, qword [rcx + 0x78]
call qword [rax + 0x10]
mov rsi, qword [rbp + 0x38]
mov rax, qword [rsi + 0x80]
test rax, rax
je 0x1401807d5
mov r8, qword [rsi + 0x88]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x28]
call qword [r8 + 0x28]
mov rsi, qword [rbp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.14020f950
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x30], eax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rbp + 0x30]
jb 0x140180863
jne 0x140180828
mov rcx, rsi
call fcn.14017f490
mov rax, qword [rbp + 0x38]
mov r8, qword [rax - 8]
mov rcx, qword [0x14034f0b8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0xe8
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1402dcbc0]
mov edx, 0x23
call fcn.14025bae0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1402dcc00]
mov edx, 0x25
call fcn.14025bae0
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x20]
mov qword [rbp], rax
lea rax, [fcn.140038660]
mov qword [rbp + 8], rax
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rax
lea rax, str.current:___sub:
adc eax, 0x45894800
movabs al, byte [0x2a845c748]
mov qword [rbp - 0x40], 0
mov rax, rbp
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
lea rdx, [0x1402dcc48]
lea rcx, [rbp - 0x60]
call fcn.14025ba30
lea rax, str.waker_missing
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rdx, str.C:UsersAdmin_scooppersist_rustup.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtime_taskcore.rs
lea edx, [0x1402dc7d8]
lea rcx, [rbp - 0x30]
call fcn.14025ba30
ud2
Function at 0x140181bd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rax, qword [rcx]
nop dword [rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140181bf0
test al, 1
je 0x140181ce3
test al, 2
jne 0x140181cfb
test al, 8
mov qword [rbp + 0x38], rcx
jne 0x140181c2c
add rcx, 0x20
mov dword [rbp - 0x30], 2
lea rdx, [rbp - 0x30]
call fcn.140182010
jmp 0x140181c48
test al, 0x10
je 0x140181c48
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx + 0x70]
test rax, rax
je 0x140181d70
mov rcx, qword [rcx + 0x78]
call qword [rax + 0x10]
mov rsi, qword [rbp + 0x38]
mov rax, qword [rsi + 0x80]
test rax, rax
je 0x140181c85
mov r8, qword [rsi + 0x88]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rbp + 0x28], rax
sub byte [r8 - 0x73], r9b
push rbp
sub byte [rcx - 1], al
push rax
sub byte [rax - 0x75], cl
jne 0x140181cbd
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1402dcbc0]
mov edx, 0x23
call fcn.14025bae0
lea rcx, str.assertion_failed:__prev.is_complete__

Function at 0x14018b4c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], 0xfffffffffffffffe
add byte [rax], al
invalid
invalid
invalid
dec dword [rax - 0x75]
add dword [rax + 0x48c28948], edx
xor edx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14018b4e0
Function at 0x14018c8f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], 0xfffffffffffffffe
mov rax, qword [rcx]
nop
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14018c910
test al, 1
je 0x14018ca24
test al, 2
jne 0x14018ca3c
test al, 8
mov qword [rbp + 0xb8], rcx
jne 0x14018c94f
add rcx, 0x20
mov dword [rbp - 0x60], 2
lea rdx, [rbp - 0x60]
call fcn.14018cdc0
jmp 0x14018c974
test al, 0x10
je 0x14018c974
mov rcx, qword [rbp + 0xb8]
mov rax, qword [rcx + 0xf0]
test rax, rax
je 0x14018caca
mov rcx, qword [rcx + 0xf8]
call qword [rax + 0x10]
mov rsi, qword [rbp + 0xb8]
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x14018c9bd
mov r8, qword [rsi + 0x108]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa8]
call qword [r8 + 0x28]
mov rsi, qword [rbp + 0xb8]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.14020c110
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rbp + 0xb0], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rbp + 0xb0]
jb 0x14018ca54
jne 0x14018ca19
mov rcx, rsi
call fcn.140185790
mov rax, qword [rbp + 0xb8]
mov r8, qword [rax - 8]
mov rcx, qword [0x14034f0b8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x168
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1402dcbc0]
mov edx, 0x23
call fcn.14025bae0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1402dcc00]
mov edx, 0x25
call fcn.14025bae0
mov qword [rbp + 0xa0], rax
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x80], rax
lea rax, [fcn.140038660]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0xb0]
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], rax
lea rax, str.current:___sub:
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 2
mov qword [rbp + 0x70], 0
lea rax, [rbp + 0x80]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 2
lea rdx, [0x1402dcc48]
lea rcx, [rbp + 0x50]
call fcn.14025ba30
lea rax, str.waker_missing
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
lea rdx, str.C:UsersAdmin_scooppersist_rustup.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtime_taskcore.rs
lea rcx, [rbp - 0x60]
call fcn.14025ba30
ud2

Function at 0x1401932d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x4c0
add byte [rax - 0x73], cl
lodsb al, byte [rsi]
and al, 0x80
add byte [rax], al
invalid
Function at 0x140194d80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x4c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x428], 0xfffffffffffffffe
mov rdi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rdi], rcx
jne 0x140194db0
test al, 1
je 0x14019503b
test al, 2
jne 0x140195053
test al, 8
mov qword [rbp + 0x408], rdi
jne 0x140194e1b
mov dword [rbp - 0x60], 2
mov rsi, qword [rdi + 0x28]
mov eax, dword [0x14034f154]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x120]
test eax, eax
je 0x140194e49
cmp eax, 1
je 0x140194e97
mov qword [rbp + 0x410], 0
jmp 0x140194ebf
test al, 0x10
je 0x140194f8a
mov rcx, qword [rbp + 0x408]
mov rax, qword [rcx + 0x240]
test rax, rax
je 0x1401950f3
mov rcx, qword [rcx + 0x248]
call qword [rax + 0x10]
jmp 0x140194f8a
mov byte [rbp + 0x427], 1
mov eax, dword [0x14034f154]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [rax + 0xd8]
lea rdx, [0x1402024e0]
call case.0x14019bee2.322
mov eax, dword [0x14034f154]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x120], 1
mov rdi, qword [rbp + 0x408]
mov eax, dword [0x14034f154]
mov rcx, qword gs:[0x58]
and eax, 0x58
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1402dcbc0]
mov edx, 0x23
call fcn.14025bae0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1402dcc00]
mov edx, 0x25
call fcn.14025bae0
Function at 0x140196510
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x330], xmm7
movaps xmmword [rbp + 0x320], xmm6
mov qword [rbp + 0x318], 0xfffffffffffffffe
mov qword [rbp + 0x2e8], rdx
mov rax, qword [rcx]
cmp rax, 3
je 0x140198413
mov rsi, rcx
cmp eax, 2
mov qword [rbp + 0x308], rcx
jne 0x140196571
lea rbx, [rsi + 8]
jmp 0x140196cfd
mov qword [rbp + 0x270], 0
lea rcx, [rbp + 0x270]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1401984e1
mov rcx, qword [rbp + 0x270]
call case.0x1401a72f6.612
mov rdi, rax
mov ebx, edx
mov rsi, qword [rsi + 0x528]
lea r14, [rsi + 0x10]
mov cl, 1
xor eax, eax
lock cmpxchg byte [rsi + 0x10], cl
jne 0x1401980bd
mov rax, qword [0x14034f148]
shl rax, 1
test rax, rax
jne 0x1401980d8
mov dword [rbp + 0x2f8], 0
mov qword [rbp + 0x2f0], r14
add al, byte [rax]
add byte [rdi], cl
mov dh, 0x46
adc dword [rax + rax*8 + 0x1b0c850f], eax
add byte [rax], al
mov rcx, r14
call fcn.140265af0
mov rax, qword [0x14034f148]
shl rax, 1
test rax, rax
je 0x1401965cf
call fcn.140265bb0
xor al, 1
mov dword [rbp + 0x2f8], eax
lea rcx, str.Map_must_not_be_polled_after_it_returned__Poll::Ready_
lea r8, str.C:UsersAdmin_scooppersist_rustup.cargo_registry_srcindex.crates.io_6f17d22bba15001f_futures_util_0.3.31_src_future_futuremap.rs
mov edx, 0x36
call fcn.14025bae0
or al, 0
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
add cl, byte [rax - 0x77]
lea rax, str.std_src_syspalwindows_time.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__valueSequenceDataDataMagicParamnumber_of_read_bytes_exceeds_limit
lea r9, fcn.1401e0310
lea r8, [rbp + 0x40]
mov edx, 0x2b
call fcn.14025bdc0
jmp 0x14019866b
add byte [rax], al
Function at 0x1401af7f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
mov eax, 0x1088
call fcn.140259970
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xff0], 0xfffffffffffffffe
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1401af820
test al, 1
je 0x1401af934
test al, 2
jne 0x1401af94c
test al, 8
mov qword [rbp + 0xfd8], rcx
jne 0x1401af85f
add rcx, 0x20
mov dword [rbp - 0x60], 2
lea rdx, [rbp - 0x60]
call fcn.1401afce0
jmp 0x1401af884
test al, 0x10
je 0x1401af884
mov rcx, qword [rbp + 0xfd8]
mov rax, qword [rcx + 0x1010]
test rax, rax
je 0x1401af9ec
mov rcx, qword [rcx + 0x1018]
call qword [rax + 0x10]
mov rsi, qword [rbp + 0xfd8]
mov rax, qword [rsi + 0x1020]
test rax, rax
je 0x1401af8cd
mov r8, qword [rsi + 0x1028]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
add rcx, rax
add rcx, 0x10
mov rax, qword [rsi + 0x28]
mov qword [rbp + 0xfc8], rax
lea rdx, [rbp + 0xfc8]
call qword [r8 + 0x28]
mov rsi, qword [rbp + 0xfd8]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.14020f950
cmp rax, 1
mov eax, 2
sbb rax, 0
mov qword [rbp + 0xfd0], rax
shl eax, 6
neg rax
lock xadd qword [rsi], rax
shr rax, 6
cmp rax, qword [rbp + 0xfd0]
jb 0x1401af964
jne 0x1401af929
mov rcx, rsi
call fcn.140166dc0
mov rax, qword [rbp + 0xfd8]
mov r8, qword [rax - 8]
mov rcx, qword [0x14034f0b8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x1088
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1402dcbc0]
mov edx, 0x23
call fcn.14025bae0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1402dcc00]
mov edx, 0x25
call fcn.14025bae0
mov qword [rbp + 0xfc0], rax
lea rax, [rbp + 0xfc0]
mov qword [rbp + 0xfa0], rax
lea rax, [fcn.140038660]
mov qword [rbp + 0xfa8], rax
lea rcx, [rbp + 0xfd0]
mov qword [rbp + 0xfb0], rcx
mov qword [rbp + 0xfb8], rax
lea rax, str.current:___sub:
mov qword [rbp + 0xf70], rax
mov qword [rbp + 0xf78], 2
mov qword [rbp + 0xf90], 0
lea rax, [rbp + 0xfa0]
mov qword [rbp + 0xf80], rax
mov qword [rbp + 0xf88], 2
lea rdx, [0x1402dcc48]
lea rcx, [rbp + 0xf70]
call fcn.14025ba30
lea rax, str.waker_missing
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
test al, 1
add byte [rax], al
add byte [rax - 0x39], cl
mov r8b, 8
add byte [rax], al
add byte [rdi], cl
push rdi
ror byte [rdi], 0x11
mov r8d, 0xc3158d48
int 0x12
add byte [rax - 0x73], cl
invalid
invalid
call fcn.14025ba30
ud2

Function at 0x1401b0ff0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
mov eax, 0x1088
add byte [rax], al
Function at 0x1401bc370
Capabilities:
Get remote cert context via schannel

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rbp - 8], 0
lea r8, [rbp - 8]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1401bc3ba
movabs rdi, 0x8000000000000000
jmp 0x1401bc402
mov r15, qword [rbp - 8]
mov r14, qword [r15 + 8]
mov edi, dword [r15 + 0x10]
test rdi, rdi
je 0x1401bc3e6
movzx eax, byte [0x14034f150]
xor ecx, ecx
mov rdx, rdi
call fcn.1401fcae0
test rax, rax
je 0x1401bc41a
mov rbx, rax
jmp 0x1401bc3eb
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.14025a776
mov rcx, r15
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x10], r15
mov ecx, 1
mov rdx, rdi
call fcn.14025b3e0
ud2

Function at 0x1401bc670
Capabilities:
Get remote cert context via schannel

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x140], xmm6
mov qword [rbp + 0x138], 0xfffffffffffffffe
mov rdi, rdx
mov qword [rbp + 0x110], rcx
lea rax, [rdx + 0xd4]
mov qword [rbp + 0x18], rax
lea rax, [rdx + 0x10]
mov qword [rbp - 0x20], rax
lea rax, [rdx + 0xf0]
mov qword [rbp + 0x80], rax
lea rax, [rdx + 0x80]
mov qword [rbp + 0x10], rax
xorps xmm6, xmm6
movzx eax, byte [rdi + 0xd0]
test eax, eax
je 0x1401bc724
Function at 0x1401be490
Capabilities:
Get remote cert context via schannel

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rdx + 0x1f0]
mov qword [rbp - 8], 0
lea r8, [rbp - 8]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1401be4da
movabs rdi, 0x8000000000000000
jmp 0x1401be522
mov r15, qword [rbp - 8]
mov r14, qword [r15 + 8]
mov edi, dword [r15 + 0x10]
test rdi, rdi
je 0x1401be506
movzx eax, byte [0x14034f150]
xor ecx, ecx
mov rdx, rdi
call fcn.1401fcae0
test rax, rax
je 0x1401be53a
mov rbx, rax
jmp 0x1401be50b
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.14025a776
mov rcx, r15
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x10], r15
mov ecx, 1
mov rdx, rdi
call fcn.14025b3e0
ud2

Function at 0x1401be910
Capabilities:
Get remote cert context via schannel

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1c8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x130], xmm6
mov qword [rbp + 0x128], 0xfffffffffffffffe
mov rdi, rdx
mov qword [rbp + 0x100], rcx
lea rax, [rdx + 0x1d4]
mov qword [rbp + 0x10], rax
lea r13, [rdx + 0x10]
lea rax, [rdx + 0x1f0]
mov qword [rbp + 0x70], rax
lea rax, [rdx + 0x180]
mov qword [rbp + 8], rax
xorps xmm6, xmm6
mov qword [rbp + 0xe0], r13
movzx eax, byte [rdi + 0x1d0]
test eax, eax
je 0x1401be9c6

Function at 0x1401c00f0
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x178]
mov rdx, qword [rdx + 0x170]
cmp rcx, rdx
ja 0x1401c041a
mov rax, qword [rdi + 0x168]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
and al, 0x28
lea r8, [0x1402d4700]
call fcn.14025ba70
Function at 0x1401d9de0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1401d9e05
cmp rax, rcx
je 0x1401d9e0b
cmp rdx, 4
jae 0x1401d9e0f
xor eax, eax
xor r8d, r8d
jmp 0x1401d9ea0
pop rbp
jmp fcn.140038a10
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1402687d0]
movdqa xmm3, xmmword [0x1402687e0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1401d9e30
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1401d9eb7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1401d9ea0
pop rbp
ret
Function at 0x1401ddd40
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r9, r8
mov qword [rsp + 0x98], rcx
movzx eax, byte [0x14034e068]
cmp al, 1
je 0x1401df0a0
movzx eax, al
cmp eax, 0xff
je 0x1401df087
mov rax, qword [rsp + 0x98]
mov esi, dword [rax]
mov r11d, dword [rax + 4]
mov r10d, dword [rax + 8]
mov r8d, dword [rax + 0xc]
mov eax, dword [rax + 0x10]
shl r9, 6
add r9, rdx
mov qword [rsp + 0xb8], r9
nop word cs:[rax + rax]
mov rdi, r9
mov rsi, rdx
call fcn.1402654e0
mov rdx, rsi
mov r9, rdi
test al, al
je 0x1401ddd7b
mov rcx, qword [rsp + 0x98]
mov r8, r9
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1401df0d0
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqu xmm0, xmmword [rcx]
pshufd xmm3, xmm0, 0xff
pinsrd xmm3, dword [rcx + 8], 1
pinsrd xmm3, dword [rcx + 4], 2
pinsrd xmm3, dword [rcx], 3
movd xmm7, dword [rcx + 0x10]
pslldq xmm7, 0xc
shl r8, 6
add r8, rdx
movdqa xmm0, xmmword [0x140268c80]
nop word cs:[rax + rax]

Function at 0x1401df0d0
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r9, r8
mov qword [rsp + 0x98], rcx
movzx eax, byte [0x14034e068]
cmp al, 1
je 0x1401df0a0
movzx eax, al
cmp eax, 0xff
je 0x1401df087
mov rax, qword [rsp + 0x98]
mov esi, dword [rax]
mov r11d, dword [rax + 4]
mov r10d, dword [rax + 8]
mov r8d, dword [rax + 0xc]
mov eax, dword [rax + 0x10]
shl r9, 6
add r9, rdx
mov qword [rsp + 0xb8], r9
nop word cs:[rax + rax]
mov rdi, r9
mov rsi, rdx
call fcn.1402654e0
mov rdx, rsi
mov r9, rdi
test al, al
je 0x1401ddd7b
mov rcx, qword [rsp + 0x98]
mov r8, r9
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1401df0d0
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqu xmm0, xmmword [rcx]
pshufd xmm3, xmm0, 0xff
pinsrd xmm3, dword [rcx + 8], 1
pinsrd xmm3, dword [rcx + 4], 2
pinsrd xmm3, dword [rcx], 3
movd xmm7, dword [rcx + 0x10]
pslldq xmm7, 0xc
shl r8, 6
add r8, rdx
movdqa xmm0, xmmword [0x140268c80]
nop word cs:[rax + rax]
Function at 0x1401e0b00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1402d9028]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
add dword [rax], eax
add byte [rbp + 0x18], dh
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1401e0b9e
test eax, eax
js 0x1401e0b7d
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1401e0b94
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add dword [rax], eax
add byte [rax], al
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x1402d9090]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call case.0x14019bee2.319
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1401e02f0
mov ecx, 7
int 0x29
ud2

Function at 0x1401e6310
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx

Function at 0x1401e7c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
lea ebp, [rsp + 0x60]

Function at 0x1401e8140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push rbp
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movdqa xmmword [rbp - 0x10], xmm6