joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800cb180
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xf70
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800cb190
test al, 1
je 0x1800cb232
test al, 2
jne 0x1800cb232
test al, 8
jne 0x1800cb1cb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800cb050
jmp 0x1800cb1e5
test al, 0x10
je 0x1800cb1e5
mov rax, qword [rsi + 0xf90]
test rax, rax
je 0x1800cb232
mov rcx, qword [rsi + 0xf98]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801192c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800cb232
jne 0x1800cb228
mov rcx, rsi
add rsp, 0xf70
pop rsi
jmp fcn.1800cb240
nop
add rsp, 0xf70
pop rsi
ret
ud2

Function at 0x1800cb7c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xf70
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800cb7d0
test al, 1
je 0x1800cb872
test al, 2
jne 0x1800cb872
test al, 8
jne 0x1800cb80b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800cb050
jmp 0x1800cb825
test al, 0x10
je 0x1800cb825
mov rax, qword [rsi + 0xf90]
test rax, rax
je 0x1800cb872
mov rcx, qword [rsi + 0xf98]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118680
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800cb872
jne 0x1800cb868
mov rcx, rsi
add rsp, 0xf70
pop rsi
jmp fcn.1800cb880
nop
add rsp, 0xf70
pop rsi
ret
ud2
Function at 0x1800d33c0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.Secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800d3402
mov rdi, qword [rsp + 0x28]
je 0x1800d3471
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800d34dd
test rax, rax
je 0x1800d34dd
lea rbx, [rdi - 1]
mov rcx, qword [rdi - 1]
mov rax, qword [rdi + 7]
call qword [rax]
mov rax, qword [rdi + 7]
cmp qword [rax + 8], 0
je 0x1800d345a
mov r8, qword [rdi - 1]
cmp qword [rax + 0x10], 0x11
jb 0x1800d344b
mov r8, qword [r8 - 8]
mov rcx, qword [0x18021a960]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18021a960]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800d34dd
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800d34c0
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x1800d349e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800d34b1
mov rcx, rax
mov qword [0x18021a960], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800d34c6
mov ecx, 1
mov rdx, rbx
call fcn.18017f950
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180171d20
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800d53f0
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x198]
cmp rax, qword [rdx + 0x190]
ja 0x1800d56ac
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x180]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0x1c0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1800d5563
cmp eax, 0x80090318
je 0x1800d55e5
test eax, eax
jne 0x1800d5603
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x180]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x170], 0
add rcx, rbx
jb 0x1800d56ac
cmp rcx, qword [rdi + 0x190]
ja 0x1800d56ac
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x168], rbx
jb 0x1800d568f
xor r12d, r12d
mov rcx, qword [rdi + 0x160]
add rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.180171d20
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x170], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x178], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r15
jb 0x1800d56ac
test r15, r15
je 0x1800d5631
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x1800d56ac
mov qword [rdi + 0x190], 0
cmp rax, r15
jne 0x1800d5613
test rcx, rcx
jne 0x1800d562a
jmp 0x1800d5631
cmp eax, 0x90317
je 0x1800d55fd
cmp eax, 0x90321
jne 0x1800d5603
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x140], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x144], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r14
jb 0x1800d56ac
test r14, r14
je 0x1800d5667
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x1800d56ac
mov qword [rdi + 0x190], 0
cmp rax, r14
jne 0x1800d5649
test rcx, rcx
jne 0x1800d5660
jmp 0x1800d5667
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x1f8], rax
jmp 0x1800d5679
mov byte [rsi + 1], 1
jmp 0x1800d567d
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1800d567f
cmp rcx, rdx
je 0x1800d5631
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call fcn.180171d20
mov qword [rdi + 0x190], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x198], r15
mov qword [rdi + 0x1f8], rax
jmp 0x1800d5679
cmp rcx, rdx
je 0x1800d5667
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call fcn.180171d20
mov qword [rdi + 0x190], rbx
mov qword [rdi + 0x198], r14
mov qword [rdi + 0x1f8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x160]
xor edx, edx
mov r8, rbx
call fcn.180181bc0
mov r12, qword [rdi + 0x170]
jmp 0x1800d54dd
ud2
Function at 0x1800d8550
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x98]
cmp rax, qword [rdx + 0x90]
ja 0x1800d87f1
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x80]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0xc0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1800d86b4
cmp eax, 0x80090318
je 0x1800d8730
test eax, eax
jne 0x1800d874e
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x80]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x70], 0
add rcx, rbx
jb 0x1800d87f1
cmp rcx, qword [rdi + 0x90]
ja 0x1800d87f1
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x68], rbx
jb 0x1800d87da
xor r12d, r12d
mov rcx, qword [rdi + 0x60]
add rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.180171d20
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x70], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x78], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r15
jb 0x1800d87f1
test r15, r15
je 0x1800d877c
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x1800d87f1
mov qword [rdi + 0x90], 0
cmp rax, r15
jne 0x1800d875e
test rcx, rcx
jne 0x1800d8775
jmp 0x1800d877c
cmp eax, 0x90317
je 0x1800d8748
cmp eax, 0x90321
jne 0x1800d874e
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x40], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x44], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r14
jb 0x1800d87f1
test r14, r14
je 0x1800d87b2
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x1800d87f1
mov qword [rdi + 0x90], 0
cmp rax, r14
jne 0x1800d8794
test rcx, rcx
jne 0x1800d87ab
jmp 0x1800d87b2
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0xf8], rax
jmp 0x1800d87c4
mov byte [rsi + 1], 1
jmp 0x1800d87c8
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1800d87ca
cmp rcx, rdx
je 0x1800d877c
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.180171d20
mov qword [rdi + 0x90], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x98], r15
mov qword [rdi + 0xf8], rax
jmp 0x1800d87c4
cmp rcx, rdx
je 0x1800d87b2
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.180171d20
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x98], r14
mov qword [rdi + 0xf8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x60]
xor edx, edx
mov r8, rbx
call fcn.180181bc0
mov r12, qword [rdi + 0x70]
jmp 0x1800d8637
ud2
Function at 0x1800dd5a0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xc0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.Secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800dd5e2
mov rdi, qword [rsp + 0x28]
je 0x1800dd651
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800dd6bd
test rax, rax
je 0x1800dd6bd
lea rbx, [rdi - 1]
mov rcx, qword [rdi - 1]
mov rax, qword [rdi + 7]
call qword [rax]
mov rax, qword [rdi + 7]
cmp qword [rax + 8], 0
je 0x1800dd63a
mov r8, qword [rdi - 1]
cmp qword [rax + 0x10], 0x11
jb 0x1800dd62b
mov r8, qword [r8 - 8]
mov rcx, qword [0x18021a960]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18021a960]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800dd6bd
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800dd6a0
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x1800dd67e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800dd691
mov rcx, rax
mov qword [0x18021a960], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800dd6a6
mov ecx, 1
mov rdx, rbx
call fcn.18017f950
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180171d20
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800ed600
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800ed620
test al, 1
je 0x1800ed782
test al, 2
jne 0x1800ed782
test al, 8
jne 0x1800ed66c
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800ed68c
lea rax, [rax + 0xd0]
jmp 0x1800ed69a
test al, 0x10
je 0x1800ed6ef
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800ed782
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
jmp 0x1800ed6ef
call fcn.180111aa0
test rax, rax
je 0x1800ed77a
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.1800ed480
mov qword [rsi + 0x30], 4
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800ed6e1
lea rax, [rax + 0xd0]
jmp 0x1800ed6eb
call fcn.180111aa0
test rax, rax
je 0x1800ed6ef
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801192c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ed782
jne 0x1800ed76e
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800ed731
call fcn.18008bf40
lea rcx, [rsi + 0x30]
call fcn.1800ed480
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800ed750
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x1800ed6aa
ud2
Function at 0x1800ee770
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800ee790
test al, 1
je 0x1800ee8f2
test al, 2
jne 0x1800ee8f2
test al, 8
jne 0x1800ee7dc
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800ee7fc
lea rax, [rax + 0xd0]
jmp 0x1800ee80a
test al, 0x10
je 0x1800ee85f
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800ee8f2
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
jmp 0x1800ee85f
call fcn.180111aa0
test rax, rax
je 0x1800ee8ea
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
lea rcx, [rsi + 0x30]
call fcn.1800ed480
mov qword [rsi + 0x30], 4
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xc8], 0
je 0x1800ee851
lea rax, [rax + 0xd0]
jmp 0x1800ee85b
call fcn.180111aa0
test rax, rax
je 0x1800ee85f
movups xmmword [rax + 0x20], xmm6
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118680
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ee8f2
jne 0x1800ee8de
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800ee8a1
call fcn.18008bea0
lea rcx, [rsi + 0x30]
call fcn.1800ed480
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x1800ee8c0
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
xorps xmm6, xmm6
jmp 0x1800ee81a
ud2
Function at 0x1800f6320
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1800f6387
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x1800f63ce
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je 0x1800f63c3
xor r9d, r9d
lea r10, [0x180206750]
xor r8d, r8d
nop word cs:[rax + rax]
movzx r11d, byte [rax + r9]
or r8d, dword [r10 + r11*4]
inc r9
cmp rdx, r9
jne 0x1800f63b0
jmp 0x1800f63c6
xor r8d, r8d
mov dword [rsp + 0x98], r8d
mov r14, qword [rcx + 0x10]
test r14, r14
je 0x1800f6454
mov rax, r14
shr rax, 0x3c
jne 0x1800f6551
mov rdi, qword [rcx]
lea rbx, [r14*8]
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x1800f6414
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800f6542
mov rcx, rax
mov qword [0x18021a960], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1800f6542
mov rsi, rax
lea r8, [rdi + r14*8]
sub r8, rdi
add r8, 0xfffffffffffffff8
mov rbx, r8
shr rbx, 3
and r8, 0xfffffffffffffff8
add r8, 8
mov rcx, rax
mov rdx, rdi
call fcn.180171d20
inc ebx
jmp 0x1800f645b
xor ebx, ebx
mov esi, 8
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
lea rdx, [0x1801de8cd]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x1800f64e6
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov ebx, 1
test r14, r14
je 0x1800f64cb
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rbx
mov rdx, rdi
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
movaps xmm6, xmmword [rsp + 0x50]
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x1800f650c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1800f6555
mov rcx, rax
mov qword [0x18021a960], rax
mov r8d, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1800f6555
mov rdi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm6
xor ebx, ebx
test r14, r14
jne 0x1800f64b9
jmp 0x1800f64cb
mov ecx, 8
mov rdx, rbx
call fcn.18017f950
ud2
ud2
mov ecx, 8
mov edx, 0x20
call fcn.18017f950
ud2
Function at 0x1800ff5f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1801df810]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1800ff663
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1800ff69a
test eax, eax
js 0x1800ff674
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1800ff68d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1800fdd60
mov rcx, rax
call fcn.1800fde40
mov ecx, 7
int 0x29
ud2
Function at 0x180100a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x180100a30
test ecx, ecx
jne 0x180100a80
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x180100a3c
test ecx, ecx
jne 0x180100a80
mov rcx, rdi
call fcn.1801008f0
movzx ecx, al
test bpl, bpl
jne 0x180100a87
lea rdx, [rdi + 0x10]
xor eax, eax
cmp byte [rdi + 0x10], 6
cmove rdx, rax
je case.0x180100a73.2
movzx r8d, byte [rdx]
mov eax, 6
lea r9, [0x180100bdc]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rax, qword [rdx + 0x10]
add rax, 4
jmp case.0x180100a73.2
xor ecx, ecx
test bpl, bpl
je 0x180100a4c
xor eax, eax
add rcx, rax
movzx r10d, bl
lea r9, [rcx + r10]
mov rax, qword [rdi + 8]
cmp rax, r9
jb 0x180100bd7
mov r11, qword [rdi]
lea rdx, [r11 + r9]
cmp rax, r9
jne 0x180100aba
movzx r8d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x180100b39
movzx r8d, byte [rdi + 0x10]
add rcx, r10
sub rcx, rax
inc rcx
lea rdi, [rax + r11]
dec rdi
xor r10d, r10d
cmp r8b, 3
jae 0x180100b00
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x180100b1b
inc rcx
dec rdi
cmp rcx, 1
jne 0x180100ae0
jmp 0x180100b39
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x180100b1b
cmp ebx, 0x5c
je 0x180100b1b
inc rcx
dec rdi
cmp rcx, 1
jne 0x180100b00
jmp 0x180100b39
neg rcx
add r9, rcx
inc r9
cmp rax, r9
jb 0x180100bd7
add r11, r9
mov r10d, 1
mov rdx, r11
sub rax, r9
je 0x180100b62
mov cl, 9
cmp rax, 2
je 0x180100b66
cmp rax, 1
jne 0x180100b75
cmp byte [rdx], 0x2e
jne 0x180100b75
xor ecx, ecx
cmp r8b, 3
setae cl
lea ecx, [rcx + rcx*2]
add ecx, 7
jmp 0x180100b75
mov cl, 0xa
jmp 0x180100b75
cmp byte [rdx], 0x2e
jne 0x180100b75
cmp byte [rdx + 1], 0x2e
sete cl
xor cl, 9
add r10, rax
mov qword [rsi], r10
mov byte [rsi + 8], cl
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rax, r8
add rax, 8
jmp case.0x180100a73.2
mov rax, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rax, r8
add rax, 2
jmp case.0x180100a73.2
mov eax, 2
jmp case.0x180100a73.2
ud2
Function at 0x180102450
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1801df810]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1801024bc
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1801024cb
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x180102503
cmp eax, 0x103
je 0x18010250d
test eax, eax
js 0x1801024e8
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x180102503
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1800fdd60
mov rcx, rax
call fcn.1800fde40
mov ecx, 7
int 0x29
ud2