joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180087ae0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180087af0
test al, 1
je 0x180087b91
test al, 2
jne 0x180087b91
test al, 8
jne 0x180087b2a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.1800871b0
jmp 0x180087b44
test al, 0x10
je 0x180087b44
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x180087b91
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180106610
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180087b91
jne 0x180087b87
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180087ba0
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x180088db0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180088dd0
test al, 1
je 0x180088fa2
test al, 2
jne 0x180088fa2
test al, 8
jne 0x180088ef6
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180088e4d
xorps xmm6, xmm6
test eax, eax
jne 0x180088e79
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x180100580]
call fcn.1800f3480
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.180088cc0
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180088eda
test eax, eax
jne 0x180088f14
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x180100580]
call fcn.1800f3480
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x180088f14
test al, 0x10
je 0x180088f14
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180088fa2
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107510
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180088fa2
jne 0x180088f95
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180088f56
call fcn.180077ed0
lea rcx, [rsi + 0x30]
call fcn.180088cc0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180088f75
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fa958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x180089c20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180089c40
test al, 1
je 0x180089e12
test al, 2
jne 0x180089e12
test al, 8
jne 0x180089d66
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180089cbd
xorps xmm6, xmm6
test eax, eax
jne 0x180089ce9
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x180100580]
call fcn.1800f3480
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.180088cc0
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180089d4a
test eax, eax
jne 0x180089d84
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x180100580]
call fcn.1800f3480
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x180089d84
test al, 0x10
je 0x180089d84
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180089e12
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180106610
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180089e12
jne 0x180089e05
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180089dc6
call fcn.180077e30
lea rcx, [rsi + 0x30]
call fcn.180088cc0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180089de5
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fa958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x18008dbd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008dbe0
test al, 1
je 0x18008dc6d
test al, 2
jne 0x18008dc6d
test al, 8
jne 0x18008dc12
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18008e1a0
jmp 0x18008dc26
test al, 0x10
je 0x18008dc26
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18008dc6d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107510
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008dc6d
jne 0x18008dc66
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18008dc80
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x18008e340
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008e350
test al, 1
je 0x18008e3dd
test al, 2
jne 0x18008e3dd
test al, 8
jne 0x18008e382
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18008e1a0
jmp 0x18008e396
test al, 0x10
je 0x18008e396
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18008e3dd
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180106610
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008e3dd
jne 0x18008e3d6
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18008e3f0
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800a4dc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a4dd0
test al, 1
je 0x1800a4e5a
test al, 2
jne 0x1800a4e5a
test al, 8
jne 0x1800a4dff
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800a5360
jmp 0x1800a4e13
test al, 0x10
je 0x1800a4e13
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800a4e5a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107510
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a4e5a
jne 0x1800a4e53
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800a4e60
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x1800a5500
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a5510
test al, 1
je 0x1800a559a
test al, 2
jne 0x1800a559a
test al, 8
jne 0x1800a553f
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800a5360
jmp 0x1800a5553
test al, 0x10
je 0x1800a5553
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800a559a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180106610
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a559a
jne 0x1800a5593
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800a55a0
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800aa280
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800aa2a0
test al, 1
je 0x1800aa472
test al, 2
jne 0x1800aa472
test al, 8
jne 0x1800aa3c6
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800aa31d
xorps xmm6, xmm6
test eax, eax
jne 0x1800aa349
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x180100580]
call fcn.1800f3480
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800aa1c0
mov qword [rsi + 0x30], 3
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800aa3aa
test eax, eax
jne 0x1800aa3e4
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x180100580]
call fcn.1800f3480
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x1800aa3e4
test al, 0x10
je 0x1800aa3e4
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800aa472
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107510
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800aa472
jne 0x1800aa465
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800aa426
call fcn.180077ed0
lea rcx, [rsi + 0x30]
call fcn.1800aa1c0
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800aa445
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fa958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800ab1a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800ab1c0
test al, 1
je 0x1800ab392
test al, 2
jne 0x1800ab392
test al, 8
jne 0x1800ab2e6
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800ab23d
xorps xmm6, xmm6
test eax, eax
jne 0x1800ab269
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x180100580]
call fcn.1800f3480
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800aa1c0
mov qword [rsi + 0x30], 3
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800ab2ca
test eax, eax
jne 0x1800ab304
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x180100580]
call fcn.1800f3480
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fa9d4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x1800ab304
test al, 0x10
je 0x1800ab304
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800ab392
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180106610
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ab392
jne 0x1800ab385
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800ab346
call fcn.180077e30
lea rcx, [rsi + 0x30]
call fcn.1800aa1c0
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800ab365
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fa958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x1800b0670
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b0680
test al, 1
je 0x1800b0722
test al, 2
jne 0x1800b0722
test al, 8
jne 0x1800b06bb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800b0d20
jmp 0x1800b06d5
test al, 0x10
je 0x1800b06d5
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800b0722
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107510
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b0722
jne 0x1800b0718
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800b0730
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800b0ec0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b0ed0
test al, 1
je 0x1800b0f72
test al, 2
jne 0x1800b0f72
test al, 8
jne 0x1800b0f0b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800b0d20
jmp 0x1800b0f25
test al, 0x10
je 0x1800b0f25
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800b0f72
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180106610
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b0f72
jne 0x1800b0f68
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800b0f80
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800c23a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800c23b0
test al, 1
je 0x1800c2452
test al, 2
jne 0x1800c2452
test al, 8
jne 0x1800c23eb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800c2210
jmp 0x1800c2405
test al, 0x10
je 0x1800c2405
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800c2452
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107510
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800c2452
jne 0x1800c2448
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800c2460
nop
add rsp, 0xfa0
pop rsi
ret
ud2

Function at 0x1800c2a40
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800c2a50
test al, 1
je 0x1800c2af2
test al, 2
jne 0x1800c2af2
test al, 8
jne 0x1800c2a8b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800c2210
jmp 0x1800c2aa5
test al, 0x10
je 0x1800c2aa5
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800c2af2
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180106610
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800c2af2
jne 0x1800c2ae8
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800c2b00
nop
add rsp, 0xfa0
pop rsi
ret
ud2
Function at 0x1800c9e60
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0x1c0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov rdi, rax
shl rdi, 0x20
or rdi, 2
test eax, eax
jne 0x1800c9ea2
mov rdi, qword [rsp + 0x28]
je 0x1800c9f0f
mov eax, edi
and eax, 3
xor r14d, r14d
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1800c9f82
test rax, rax
je 0x1800c9f82
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1800c9ef8
cmp qword [rdi + 0x10], 0x11
jb 0x1800c9ee6
mov r14, qword [r14 - 8]
mov rcx, qword [0x1801fa958]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1801fa958]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1800c9f82
mov r15, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
test rbx, rbx
je 0x1800c9f65
movzx eax, byte [0x1801fa9d0]
mov rcx, qword [0x1801fa958]
test rcx, rcx
jne 0x1800c9f43
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800c9f56
mov rcx, rax
mov qword [0x1801fa958], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1800c9f6b
mov ecx, 1
mov rdx, rbx
call fcn.180166060
ud2
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.180158470
mov rcx, rdi
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov qword [rsi + 8], r14
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800cbeb0
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x198]
cmp rax, qword [rdx + 0x190]
ja 0x1800cc16c
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x180]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0x1c0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1800cc023
cmp eax, 0x80090318
je 0x1800cc0a5
test eax, eax
jne 0x1800cc0c3
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x180]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x170], 0
add rcx, rbx
jb 0x1800cc16c
cmp rcx, qword [rdi + 0x190]
ja 0x1800cc16c
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x168], rbx
jb 0x1800cc14f
xor r12d, r12d
mov rcx, qword [rdi + 0x160]
add rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.180158470
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x170], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x178], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r15
jb 0x1800cc16c
test r15, r15
je 0x1800cc0f1
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x1800cc16c
mov qword [rdi + 0x190], 0
cmp rax, r15
jne 0x1800cc0d3
cmp rcx, rdx
jne 0x1800cc0ea
jmp 0x1800cc0f1
cmp eax, 0x90317
je 0x1800cc0bd
cmp eax, 0x90321
jne 0x1800cc0c3
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x140], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x144], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r14
jb 0x1800cc16c
test r14, r14
je 0x1800cc127
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x1800cc16c
mov qword [rdi + 0x190], 0
cmp rax, r14
jne 0x1800cc109
cmp rcx, rdx
jne 0x1800cc120
jmp 0x1800cc127
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x1f8], rax
jmp 0x1800cc139
mov byte [rsi + 1], 1
jmp 0x1800cc13d
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1800cc13f
cmp rcx, rdx
je 0x1800cc0f1
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call fcn.180158470
mov qword [rdi + 0x190], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x198], r15
mov qword [rdi + 0x1f8], rax
jmp 0x1800cc139
cmp rcx, rdx
je 0x1800cc127
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call fcn.180158470
mov qword [rdi + 0x190], rbx
mov qword [rdi + 0x198], r14
mov qword [rdi + 0x1f8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x160]
xor edx, edx
mov r8, rbx
call fcn.180167f60
mov r12, qword [rdi + 0x170]
jmp 0x1800cbf9d
ud2
Function at 0x1800ce240
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x98]
cmp rax, qword [rdx + 0x90]
ja 0x1800ce4e1
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x80]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0xc0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1800ce3a4
cmp eax, 0x80090318
je 0x1800ce420
test eax, eax
jne 0x1800ce43e
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x80]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x70], 0
add rcx, rbx
jb 0x1800ce4e1
cmp rcx, qword [rdi + 0x90]
ja 0x1800ce4e1
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x68], rbx
jb 0x1800ce4ca
xor r12d, r12d
mov rcx, qword [rdi + 0x60]
add rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.180158470
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x70], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x78], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r15
jb 0x1800ce4e1
test r15, r15
je 0x1800ce46c
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x1800ce4e1
mov qword [rdi + 0x90], 0
cmp rax, r15
jne 0x1800ce44e
cmp rcx, rdx
jne 0x1800ce465
jmp 0x1800ce46c
cmp eax, 0x90317
je 0x1800ce438
cmp eax, 0x90321
jne 0x1800ce43e
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x40], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x44], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r14
jb 0x1800ce4e1
test r14, r14
je 0x1800ce4a2
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x1800ce4e1
mov qword [rdi + 0x90], 0
cmp rax, r14
jne 0x1800ce484
cmp rcx, rdx
jne 0x1800ce49b
jmp 0x1800ce4a2
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0xf8], rax
jmp 0x1800ce4b4
mov byte [rsi + 1], 1
jmp 0x1800ce4b8
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1800ce4ba
cmp rcx, rdx
je 0x1800ce46c
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.180158470
mov qword [rdi + 0x90], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x98], r15
mov qword [rdi + 0xf8], rax
jmp 0x1800ce4b4
cmp rcx, rdx
je 0x1800ce4a2
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call fcn.180158470
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x98], r14
mov qword [rdi + 0xf8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x60]
xor edx, edx
mov r8, rbx
call fcn.180167f60
mov r12, qword [rdi + 0x70]
jmp 0x1800ce327
ud2