joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ffd10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov rax, qword [0x1402409c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [rcx + 0x7c], 0
lea r15, [rcx + 0x7c]
mov edi, reloc.WS2_32.dll_sendto
lea rsi, [rcx + 0x130]
mov rbx, rcx
mov r14, r9
mov r12d, r8d
mov r13, rdx
lea ecx, [rdi + 0xc]
jne 0x1400ffda1
mov eax, dword [rsi]
test eax, eax
jne 0x1400ffd66
mov r8d, edi
jmp 0x1400ffd70
xor r8d, r8d
cmp eax, 1
cmove r8d, ecx
lea rbp, [rbx + 0x120]
mov qword [rsp + 0x28], r15
mov rcx, rbp
mov dword [rsp + 0x20], 0xa
lea rdx, [rbx + 0xbc]
lea r9, str.Client_Key
call fcn.14012b620
mov ecx, 0x20
jmp 0x1400ffda8
lea rbp, [rbx + 0x120]
mov eax, dword [rsi]
test eax, eax
jne 0x1400ffdb3
mov r8, rdi
jmp 0x1400ffdbd
xor r8d, r8d
cmp eax, 1
cmove r8, rcx
lea r9, [rsp + 0x50]
mov rdx, r15
mov rcx, rbp
call fcn.14012b610
mov eax, dword [rsi]
mov r15d, 0x20
test eax, eax
jne 0x1400ffdde
mov r8d, edi
jmp 0x1400ffde8
xor r8d, r8d
cmp eax, 1
cmove r8d, r15d
mov r9, qword [rbx + 0x110]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
mov eax, dword [rbx + 0x11c]
mov rcx, rbp
mov dword [rsp + 0x20], eax
call fcn.14012b620
mov rcx, rbx
call fcn.1401015b0
movsxd r8, eax
test eax, eax
jle 0x1400ffe4b
xor edx, edx
lea rax, [rsp + 0x30]
sub rbx, rax
nop dword [rax]
lea rax, [rsp + 0x30]
add rax, rdx
movzx ecx, byte [rax + rbx + 0x7c]
xor cl, byte [rax]
mov byte [rsp + rdx + 0x70], cl
inc rdx
cmp rdx, r8
jl 0x1400ffe30
mov eax, dword [rsi]
test eax, eax
je 0x1400ffe5a
xor edi, edi
cmp eax, 1
cmove rdi, r15
mov r8d, dword [r14]
lea rcx, [rsp + 0x70]
sub r12d, r8d
mov rdx, rdi
mov r9d, r12d
add r8, r13
call fcn.140127cd0
cmp eax, 0xffffffff
jne 0x1400ffe7c
xor al, al
jmp 0x1400ffe81
add dword [r14], eax
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14008b890
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400fff30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x98
mov rax, qword [0x1402409c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, dword [rsp + 0xf0]
lea rdi, [rcx + 0xbc]
mov r14d, r8d
mov rbp, rdx
mov r13, rcx
mov r8d, ebx
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.1401498b0
cmp rbx, 0x20
jae 0x14010017d
lea eax, [rbx + 1]
mov byte [rsp + rbx + 0x50], 0
cmp eax, 0x20
jae 0x14010017d
mov byte [rsp + rax + 0x50], 0
lea eax, [rbx + 2]
cmp eax, 0x20
jae 0x14010017d
mov ecx, dword [r13 + 0x130]
mov byte [rsp + rax + 0x50], 0
lea eax, [rbx + 3]
mov qword [rsp + 0x90], r12
xor r12d, r12d
mov byte [rsp + rax + 0x50], 1
lea ebx, [r12 + 0x20]
test ecx, ecx
jne 0x1400fffcf
lea eax, [rcx + 0x14]
jmp 0x1400fffd8
cmp ecx, 1
mov eax, r12d
cmove eax, ebx
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x50]
mov r8d, r14d
mov dword [rsp + 0x20], eax
mov rdx, rbp
lea rcx, [r13 + 0x120]
call fcn.14012b620
mov eax, dword [r13 + 0x130]
test eax, eax
jne 0x140100009
lea r8d, [rax + 0x14]
jmp 0x140100013
cmp eax, 1
mov r8, r12
cmove r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1401498b0
mov eax, dword [rsp + 0xf8]
cmp eax, 2
jb 0x140100158
mov qword [rsp + 0x88], r15
lea r15d, [rax - 1]
nop dword [rax]
mov eax, dword [r13 + 0x130]
test eax, eax
jne 0x140100054
mov ebx, reloc.WS2_32.dll_sendto
mov eax, ebx
jmp 0x140100062
cmp eax, 1
jne 0x1401000e1
mov eax, 0x20
lea r10, [rsp + 0x30]
mov r8d, r14d
mov qword [rsp + 0x28], r10
lea r9, [rsp + 0x30]
mov rdx, rbp
mov dword [rsp + 0x20], eax
lea rcx, [r13 + 0x120]
call fcn.14012b620
mov eax, ebx
lea rdx, [rdi - 1]
add rdx, rax
mov rcx, r12
lea rax, [rsp + rax + 0x2f]
cmp rdi, rax
ja 0x1401000a7
lea rax, [rsp + 0x30]
cmp rdx, rax
jae 0x14010010d
mov eax, 0xfffffff8
lea r8, [rsp + 0x30]
mov edx, ebx
and rdx, rax
mov rax, rdi
sub r8, rdi
nop dword [rax]
movq xmm0, qword [rax]
add rcx, 8
movq xmm1, qword [r8 + rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp rcx, rdx
jl 0x1401000c0
jmp 0x14010010d
lea rax, [rsp + 0x30]
mov r8d, r14d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rbp
mov dword [rsp + 0x20], r12d
lea rcx, [r13 + 0x120]
mov ebx, r12d
call fcn.14012b620
mov rcx, r12
mov edx, ebx
cmp rcx, rdx
jge 0x140100141
lea r8, [rsp + 0x30]
sub r8, rdi
lea rax, [rcx + rdi]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140100130
mov ebx, 0x20
sub r15, 1
jne 0x140100040
mov r15, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008b890
add rsp, 0x98
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14008c288
int3
Function at 0x14010c410
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], 1
call fcn.140099228
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov rcx, rbx
mov dword [rax], 0
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14010c471
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
lea r8, str.WSAGetLastError__:__d
lea rdx, str.socket
lea ecx, [rbx + 3]
call fcn.1400d2db0
test ebx, ebx
sete al
add rsp, 0x30
pop rbx
ret
Function at 0x14010cb60
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 4
mov rsi, r9
mov rdi, rcx
test rcx, rcx
je 0x14010cc49
test rdx, rdx
je 0x14010cc8d
test r8d, r8d
je 0x14010ccd1
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14010cc3c
mov qword [rsp + 0x58], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov dword [rdi + 8], eax
call fcn.140099228
mov dword [rax], ebx
mov eax, dword [rdi + 8]
mov rbx, qword [rsp + 0x58]
cmp eax, 0xb
je 0x14010cbd3
add eax, 0xffffd8cd
cmp eax, 1
ja 0x14010cc2c
mov r8, rsi
mov edx, reloc.WS2_32.dll_recv
mov rcx, rdi
call fcn.14010c730
test al, al
je 0x14010cc2c
mov rcx, qword [rdi]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x50], 0xffffffff
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
mov ecx, dword [rsp + 0x50]
test eax, eax
jne 0x14010cc1e
test ecx, ecx
je 0x14010cc3c
mov dword [rdi + 8], ecx
call fcn.140099228
mov ecx, dword [rsp + 0x50]
mov dword [rax], ecx
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret
mov ecx, 2
call fcn.140098f98
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
lea rax, str.sock
mov r9d, 0x35d
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_socket_connect
mov qword [rsp + 0x20], rax
call fcn.1400c21c0
call fcn.140099068
int3
mov ecx, 2
call fcn.140098f98
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
lea rax, str.addr
mov r9d, 0x35e
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_socket_connect
mov qword [rsp + 0x20], rax
call fcn.1400c21c0
call fcn.140099068
int3
mov ecx, 2
call fcn.140098f98
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
lea rax, str.addrlen
mov r9d, 0x35f
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_socket_connect
mov qword [rsp + 0x20], rax
call fcn.1400c21c0
call fcn.140099068
int3
Function at 0x14010ce00
Capabilities:
Resolve dns

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1402409c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x40], 0x80
test rcx, rcx
je 0x14010ceb0
mov rcx, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14010ce96
mov edx, dword [rsp + 0x40]
lea r8, [rsp + 0xd0]
xor eax, eax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov r9d, 0x100
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x14010ce96
lea rcx, [rsp + 0xd0]
call fcn.1400cb300
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14008b890
add rsp, 0x1e8
ret
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14008b890
add rsp, 0x1e8
ret
mov ecx, 2
call fcn.140098f98
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
lea rax, str.sock
mov r9d, 0x5de
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_socket_getnameinfo
mov qword [rsp + 0x20], rax
call fcn.1400c21c0
call fcn.140099068
int3
Function at 0x14010cf00
Capabilities:
Query or enumerate registry value
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1402409c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov esi, ecx
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14010cf55
lea r8, [rbp + 7]
mov dword [rbp + 7], 1
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14010cf5c
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x14010d10d
mov qword [rsp + 0xc8], rbx
cmp esi, 1
je 0x14010d0e7
mov rcx, rdi
call fcn.14010c410
test al, al
jne 0x14010cf91
lea r8, str.Failed_to_enable_TCP_NODELAY.
mov ecx, 2
lea rdx, str.socket
call fcn.1400d2db0
lea r9, [rbp + 0x13]
mov dword [rbp + 0x13], 1
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 8
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14010d0e7
xor ebx, ebx
mov dword [rbp + 7], 4
lea rax, [rbp + 0x1f]
mov dword [rbp + 0x17], ebx
xor r8d, r8d
mov dword [rbp + 0x27], 1
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov dword [rbp + 0x2b], 0x1d4c0
lea r9d, [rbx + 1]
mov dword [rbp + 0x2f], 0x2710
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14010d0b3
mov rcx, qword [rbp + 0x1f]
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xb]
lea rax, [rbp + 0xf]
xor r8d, r8d
lea rdx, str.KeepAliveTime
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14010d04b
cmp dword [rbp + 0xb], 4
jne 0x14010d05b
mov eax, dword [rbp + 0xf]
cmp eax, dword [rbp + 0x2b]
jae 0x14010d05b
jmp 0x14010d058
mov eax, dword [rbp + 0x2b]
mov ecx, 0x6ddd00
cmp eax, ecx
cmova eax, ecx
mov dword [rbp + 0x2b], eax
mov rcx, qword [rbp + 0x1f]
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xb]
lea rax, [rbp + 0xf]
xor r8d, r8d
lea rdx, str.KeepAliveInterval
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14010d099
cmp dword [rbp + 0xb], 4
jne 0x14010d0a9
mov eax, dword [rbp + 0xf]
cmp eax, dword [rbp + 0x2f]
jae 0x14010d0a9
jmp 0x14010d0a6
mov eax, dword [rbp + 0x2f]
mov ecx, 0x3e8
cmp eax, ecx
cmova eax, ecx
mov dword [rbp + 0x2f], eax
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rbx
lea r8, [rbp + 0x27]
mov qword [rsp + 0x30], rax
mov r9d, recv
mov dword [rsp + 0x28], ebx
mov edx, 0x98000004
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov ecx, 0x18
call fcn.1400c9740
mov rbx, rax
mov qword [rax], rdi
mov dword [rax + 0xc], esi
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rbx + 0x10], eax
mov rax, rbx
mov rbx, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008b890
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010d400
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push rdi
push r13
push r14
sub rsp, 0x38
mov r13d, r9d
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x14010d4fe
test rdx, rdx
je 0x14010d542
test r8, r8
je 0x14010d586
mov dword [rcx + 8], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], r15
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
cmp rsi, 0xffffffffffffffff
sete r15b
jne 0x14010d4d8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r12
mov r12, qword [rsp + 0x80]
nop dword [rax + rax]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov dword [rdi + 8], eax
call fcn.140099228
mov dword [rax], ebx
mov eax, dword [rdi + 8]
cmp eax, 0xb
je 0x14010d494
add eax, 0xffffd8cd
cmp eax, 1
ja 0x14010d4ce
mov r8, r12
mov edx, 0x300
mov rcx, rdi
call fcn.14010c730
test al, al
je 0x14010d4ce
mov dword [rdi + 8], 0
mov r9d, r13d
mov rcx, qword [rdi]
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
cmp rsi, 0xffffffffffffffff
sete r15b
je 0x14010d470
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
test r15b, r15b
mov rax, 0xffffffffffffffff
mov r15, qword [rsp + 0x30]
cmovne rsi, rax
mov rax, rsi
mov rsi, qword [rsp + 0x68]
add rsp, 0x38
pop r14
pop r13
pop rdi
pop rbp
ret
mov ecx, 2
call fcn.140098f98
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
lea rax, str.sock
mov r9d, 0x43d
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_socket_recv
mov qword [rsp + 0x20], rax
call fcn.1400c21c0
call fcn.140099068
int3
mov ecx, 2
call fcn.140098f98
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
lea rax, [0x140170b54]
mov r9d, 0x43e
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_socket_recv
mov qword [rsp + 0x20], rax
call fcn.1400c21c0
call fcn.140099068
int3
mov ecx, 2
call fcn.140098f98
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
lea rax, str.buflen
mov r9d, 0x43f
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_socket_recv
mov qword [rsp + 0x20], rax
call fcn.1400c21c0
call fcn.140099068
int3
Function at 0x14011fe50
Capabilities:
Resolve dns

Disassembly:
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14011fe7f
nop dword [rax]
cmp dword [rcx], edx
je 0x14011fe73
ja 0x14011fe7f
mov rcx, qword [rcx + 0x268]
test rcx, rcx
jne 0x14011fe60
ret
lea rdx, [rcx + 0x280]
jmp fcn.14011fab0
ret

Function at 0x140124660
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebx, edx
mov rcx, qword [0x140250908]
test rcx, rcx
jne 0x1401246a8
xor r9d, r9d
lea rdx, [0x1401b8220]
xor r8d, r8d
lea rcx, [0x140250908]
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jns 0x1401246a1
lea r8, str.BCryptOpenAlgorithmProvider__:__ld
jmp 0x1401246d1
mov rcx, qword [0x140250908]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1401246ca
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea r8, str.BCryptGenRandom__:__ld
mov r9d, eax
lea rdx, str.mongoc
xor ecx, ecx
call fcn.1400d2db0
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140127cd0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov rsi, rdx
test r8, r8
je 0x140127e4e
lea r14, [0x1401bdfc0]
cmp rdx, 2
jbe 0x140127d99
lea r10d, [rbx + 4]
nop dword [rax + rax]
movzx edx, byte [rcx + 1]
sub rsi, 3
movzx r11d, byte [rcx]
movzx eax, dl
movzx r9d, byte [rcx + 2]
and dl, 0xf
shr al, 4
movzx r8d, r11b
and r8b, 3
shl dl, 2
shl r8b, 4
add rcx, 3
add r8b, al
movzx eax, r9b
shr al, 6
add dl, al
cmp r10, rbp
ja 0x140127e4e
and r9d, 0x3f
mov eax, r11d
shr rax, 2
add r10, 4
movzx eax, byte [rax + r14]
mov byte [rbx + rdi], al
movzx eax, r8b
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 1], al
movzx eax, dl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 2], al
movzx eax, byte [r9 + r14]
mov byte [rbx + rdi + 3], al
add rbx, 4
cmp rsi, 2
ja 0x140127d10
test rsi, rsi
je 0x140127e41
xor r8b, r8b
mov word [rsp + 0x51], 0
xor r9b, r9b
mov byte [rsp + 0x50], r8b
xor dl, dl
test rsi, rsi
je 0x140127ddc
mov rdx, rcx
mov r8, rsi
lea rcx, [rsp + 0x50]
call fcn.1401498b0
movzx r9d, byte [rsp + 0x52]
movzx edx, byte [rsp + 0x51]
movzx r8d, byte [rsp + 0x50]
movzx eax, dl
shr r9b, 6
movzx ecx, r8b
shr al, 4
and r8b, 3
shr cl, 2
and dl, 0xf
shl r8b, 4
shl dl, 2
add r8b, al
lea rax, [rbx + 4]
add dl, r9b
cmp rax, rbp
ja 0x140127e4e
movzx eax, cl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi], al
movzx eax, r8b
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 1], al
cmp rsi, 1
jne 0x140127e2c
mov al, 0x3d
jmp 0x140127e34
movzx eax, dl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 2], al
mov byte [rbx + rdi + 3], 0x3d
add rbx, 4
cmp rbx, rbp
jae 0x140127e4e
mov byte [rbx + rdi], 0
mov eax, ebx
jmp 0x140127e53
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14012b6d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r10, r8
mov r11, rdx
mov r9d, eax
test r8, r8
je 0x14012b708
sub r11, rcx
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r11 + rcx]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or r9d, r8d
sub r10, 1
jne 0x14012b6f0
test r9d, r9d
setne al
ret

Function at 0x14012ef90
Capabilities:
Decrypt data via sspi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x80
mov rax, qword [0x1402409c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r9, qword [rcx + 0x40]
xor ebp, ebp
mov rbx, rcx
mov esi, ebp
test r9, r9
je 0x14012f120
mov qword [rsp + 0x98], rdi
nop dword [rax]
test esi, esi
jne 0x14012f118
mov r8, qword [rbx + 0x50]
lea edx, [rsi + 1]
lea rcx, [rsp + 0x30]
call fcn.140131b60
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call fcn.140131b60
xor r9d, r9d
lea rcx, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call fcn.140131b60
xor r9d, r9d
lea rcx, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call fcn.140131b60
lea r8d, [rsi + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140131b70
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
call sub.Secur32.dll_DecryptMessage
mov esi, eax
test eax, eax
je 0x14012f071
cmp eax, 0x90321
je 0x14012f071
cmp eax, 0x90317
je 0x14012f071
cmp eax, 0x80090318
je 0x14012f108
mov dword [rbx + 0x68], 1
jmp 0x14012f108
cmp dword [rsp + 0x44], 1
jne 0x14012f0b7
mov rax, qword [rbx + 0x38]
lea rcx, [rbx + 0x38]
sub rax, qword [rbx + 0x48]
mov edi, dword [rsp + 0x40]
cmp rax, rdi
jae 0x14012f099
lea rdx, [rbx + 0x58]
mov r8d, edi
call fcn.1401325f0
test rdi, rdi
je 0x14012f0b7
mov rcx, qword [rbx + 0x58]
mov r8, rdi
add rcx, qword [rbx + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1401498b0
add qword [rbx + 0x48], rdi
cmp dword [rsp + 0x64], 5
jne 0x14012f0ee
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14012f0ee
mov r8d, eax
mov rax, qword [rbx + 0x40]
cmp rax, r8
jbe 0x14012f0f2
mov rcx, qword [rbx + 0x50]
mov rdx, rcx
sub rdx, r8
add rdx, rax
call fcn.1401498b0
mov eax, dword [rsp + 0x60]
mov qword [rbx + 0x40], rax
jmp 0x14012f0f2
mov qword [rbx + 0x40], rbp
cmp esi, 0x90317
jne 0x14012f108
mov byte [rbx + 0x6c], 1
cmp byte [rbx + 0x6d], bpl
jne 0x14012f108
mov byte [rbx + 0x6d], 1
mov rax, qword [rbx + 0x40]
mov r9d, eax
test rax, rax
jne 0x14012efd0
mov rdi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008b890
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x14012f850
Capabilities:
Encrypt data via sspi

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x98
mov rax, qword [0x1402409c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, qword [rcx + 0x88]
mov rdi, r8
mov r15, rdx
mov rbp, rcx
test rbx, rbx
je 0x14012f9e2
cmp dword [rbx + 0x20], 0
mov qword [rsp + 0xd8], rsi
jne 0x14012f8b8
mov rcx, qword [rbx + 0x10]
lea r8, [rbx + 0x18]
mov edx, 4
call sub.Secur32.dll_QueryContextAttributesA
test eax, eax
je 0x14012f8b8
mov rax, 0xffffffffffffffff
jmp 0x14012f9bd
mov eax, dword [rbx + 0x20]
mov ecx, dword [rbx + 0x1c]
cmp rdi, rax
mov qword [rsp + 0x90], r14
cmova rdi, rax
mov eax, dword [rbx + 0x18]
add rax, rdi
add rcx, rax
call fcn.1400c96f0
mov r9d, dword [rbx + 0x18]
lea rcx, [rsp + 0x40]
mov r8, rax
mov edx, 7
mov r14, rax
call fcn.140131b60
mov r8d, dword [rbx + 0x18]
lea rcx, [rsp + 0x50]
add r8, r14
mov r9d, edi
mov edx, 1
call fcn.140131b60
mov r8d, dword [rbx + 0x18]
lea rcx, [rsp + 0x60]
mov r9d, dword [rbx + 0x1c]
add r8, rdi
add r8, r14
mov edx, 6
call fcn.140131b60
xor r9d, r9d
lea rcx, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
call fcn.140131b60
mov r8d, 4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140131b70
mov rcx, qword [rsp + 0x58]
mov r8, rdi
mov rdx, r15
call fcn.1401498b0
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
call sub.Secur32.dll_EncryptMessage
test eax, eax
jne 0x14012f99a
mov r8d, dword [rsp + 0x60]
mov rdx, r14
add r8d, dword [rsp + 0x40]
mov rcx, rbp
add r8d, dword [rsp + 0x50]
mov edi, r8d
call fcn.140132f20
mov rbx, rax
jmp 0x14012f9a1
mov rbx, 0xffffffffffffffff
mov rcx, r14
call fcn.1400c96e0
mov r14, qword [rsp + 0x90]
cmp rdi, rbx
jne 0x14012f9ba
mov ebx, dword [rsp + 0x50]
mov rax, rbx
mov rsi, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14008b890
add rsp, 0x98
pop r15
pop rdi
pop rbp
pop rbx
ret
mov ecx, 2
call fcn.140098f98
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_stream_tls_secure_channel.c
lea rax, str.secure_channel
mov r9d, 0xfc
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str._mongoc_stream_tls_secure_channel_write
mov qword [rsp + 0x20], rax
call fcn.1400c21c0
call fcn.140099068
int3