joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400282f0
Capabilities:
Check for software breakpoints
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1d08
call fcn.14011e170
sub rsp, rax
movdqa xmmword [rsp + 0x1cf0], xmm11
movaps xmmword [rsp + 0x1ce0], xmm10
movaps xmmword [rsp + 0x1cd0], xmm9
movaps xmmword [rsp + 0x1cc0], xmm8
movaps xmmword [rsp + 0x1cb0], xmm7
movaps xmmword [rsp + 0x1ca0], xmm6
mov qword [rsp + 0x38], rcx
lea r11, [r8 + 0x10]
movzx r10d, byte [r8 + 0x16]
movzx eax, byte [r8 + 0x11]
mov byte [rsp + 0x37], al
mov rax, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rsp + 0x2b8], rcx
mov qword [rsp + 0x2c0], rax
lea rax, [rax + 8]
mov qword [rsp + 0x2b0], rax
movzx eax, byte [r8 + 0x15]
mov byte [rsp + 0x36], al
movzx eax, byte [r8 + 0x13]
mov byte [rsp + 0x35], al
xorps xmm6, xmm6
movaps xmm7, xmmword [0x14012f720]
movss xmm8, dword [0x14012f730]
movdqa xmm9, xmmword [str.uespemosarenegylmodnarodsetybdet________________]
movdqa xmm10, xmmword [0x14012f750]
lea r12, [rsp + 0x3a0]
mov qword [rsp + 0x200], 0
lea r13, [rsp + 0x160]
mov qword [rsp + 0x260], rdx
Function at 0x14002c240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov rsi, qword [rdi + 0x28]
cmp rsi, 0x7fff
jbe 0x14002c2a7
lea rcx, [rdx + 0x18]
mov r9, qword [rdx]
mov rax, qword [rdx + 8]
mov r8, qword [rdx + 0x10]
mov rdx, rax
call qword [r9 + 0x10]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x14002c2a0
lea rcx, [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
call qword [rax + 0x10]
xor eax, eax
jmp 0x14002c3b9
lea r15, [rcx + 8]
movzx ebp, word [rcx + 0x30]
mov r14, qword [rcx + 0x28]
movzx ebx, byte [rcx + 0x32]
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
cmp rsi, qword [rdi + 0x18]
jne 0x14002c2e0
lea rcx, [rdi + 0x18]
call fcn.14001c990
mov rcx, qword [rdi + 0x20]
imul rax, rsi, 0x68
mov qword [rcx + rax], 0
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rcx + rax + 0x18], xmm0
movups xmmword [rcx + rax + 0x28], xmm1
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax + 0x38], rdx
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rcx + rax + 0x40], xmm0
movups xmmword [rcx + rax + 0x50], xmm1
mov word [rcx + rax + 0x60], bp
lea rcx, [rsi + 1]
mov qword [rdi + 0x28], rcx
mov rcx, qword [rdi + 0x48]
mov r8, qword [rdi + 0x50]
xor edx, edx
mov r9d, esi
nop dword [rax + rax]
mov r10, r14
mov r14d, 0
cmp r10, r8
jae 0x14002c340
movzx r11d, word [rcx + r10*4]
cmp r11w, 0xffff
je 0x14002c37c
inc rdx
movzx r14d, word [rcx + r10*4 + 2]
mov word [rcx + r10*4], r9w
mov word [rcx + r10*4 + 2], bp
inc r10
mov ebp, r14d
mov r9d, r11d
mov r14, r10
jmp 0x14002c340
xor bl, 1
mov word [rcx + r10*4], r9w
mov word [rcx + r10*4 + 2], bp
cmp rdx, 0x80
setb cl
test cl, bl
jne 0x14002c3a5
cmp qword [rdi], 0
jne 0x14002c3a5
mov qword [rdi], 1
mov rdx, qword [rdi + 0x28]
cmp rsi, rdx
jae 0x14002c3c6
mov rcx, qword [rdi + 0x20]
add rax, rcx
add rax, 0x18
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.C:Usersmilus.cargo_registry_srcindex.crates.io_6f17d22bba15001fhttp_0.2.12_srcheadermap.rs
mov rcx, rsi
call fcn.140122580
int3
Function at 0x140036d70
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
movdqa xmmword [rsp + 0x260], xmm15
movdqa xmmword [rsp + 0x250], xmm14
movdqa xmmword [rsp + 0x240], xmm13
movdqa xmmword [rsp + 0x230], xmm12
movdqa xmmword [rsp + 0x220], xmm11
movdqa xmmword [rsp + 0x210], xmm10
movdqa xmmword [rsp + 0x200], xmm9
movdqa xmmword [rsp + 0x1f0], xmm8
movdqa xmmword [rsp + 0x1e0], xmm7
movaps xmmword [rsp + 0x1d0], xmm6
mov qword [rsp + 0x198], rcx
mov rax, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2e0]
mov qword [rsp + 0x138], r9
mov qword [rcx + 0x10], 0
mov dword [rsp + 0x100], 0
mov qword [rsp + 0xf8], 0
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x1a0], rax
add r8, rdx
xorps xmm6, xmm6
movups xmmword [rsp + 0x1ad], xmm6
mov byte [rsp + 0x1bd], 0
movups xmmword [rsp + 0x1c0], xmm6
mov qword [rsp + 0x38], 0
lea r13, [rsp + 0x48]
mov dword [rsp + 0x48], 0
mov word [rsp + 0x4c], 0
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x54], 0
mov byte [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0
mov byte [rsp + 0x60], 0
mov dword [rsp + 0x64], 0
mov byte [rsp + 0x68], 0
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], r8
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0
mov rax, r9
shr rax, 0x20
mov byte [rsp + 0x9c], al
mov qword [rsp + 0x190], r9
mov dword [rsp + 0x98], r9d
movups xmm0, xmmword [rsp + 0x1aa]
movups xmmword [rsp + 0x9d], xmm0
mov eax, dword [rsp + 0x1ba]
mov dword [rsp + 0xad], eax
mov dword [rsp + 0xb8], 0
mov word [rsp + 0xbc], 0
movzx eax, word [rsp + 0x1ce]
mov word [rsp + 0xce], ax
movdqu xmm0, xmmword [rsp + 0x1be]
movdqu xmmword [rsp + 0xbe], xmm0
mov dword [rsp + 0xd8], 0x110000
mov byte [rsp + 0xdc], 0
xor ebp, ebp
lea rdi, [0x140148720]
lea r14, [0x14014c1f0]
xor eax, eax
jmp 0x140036f73
Function at 0x140070c30
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, r8
mov rdi, rdx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x60]
mov r8d, 0xb
mov rdx, rax
call fcn.1400c4880
mov dword [rsp + 0x38], 0x800
mov dword [rsp + 0x3c], 0
movzx eax, byte [0x14019f308]
mov edx, 0x800
xor ecx, ecx
call fcn.1400f8ae0
test rax, rax
je 0x140070dbb
mov rbx, rax
mov qword [rsp + 0x48], 0x800
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov r14, qword [rsp + 0x68]
lea rbp, [rsp + 0x38]
lea r15, [rsp + 0x3c]
mov r12, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
sub rsi, r13
nop word [rax + rax]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9, r15
call r12
cmp eax, 0xea
jne 0x140070d0e
mov r8d, dword [rsp + 0x38]
cmp rsi, r8
jae 0x140070cd0
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.14012aee0
mov rbx, qword [rsp + 0x50]
jmp 0x140070cba
test eax, eax
jne 0x140070d30
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x140070d98
movabs rax, 0xde00000002
jmp 0x140070d38
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rsp + 0x48], 0
je 0x140070d6a
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x14019f258]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x60], 0
je 0x140070d86
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x14019f258]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
cmp qword [rsp + 0x60], 0
jne 0x140070d72
jmp 0x140070d86
mov ecx, 1
mov edx, 0x800
call fcn.140122170
int3
Function at 0x140083d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
movdqa xmmword [rsp + 0x210], xmm8
movdqa xmmword [rsp + 0x200], xmm7
movdqa xmmword [rsp + 0x1f0], xmm6
mov qword [rsp + 0x1b8], r9
mov r14, r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x98], rcx
cmp byte [r8 + 0x10], 2
jne 0x140083eec
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x58], 0
je 0x140083eec
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsi + 0x60]
mov rdx, qword [rsi + 0x68]
mov rdi, qword [rsp + 0x38]
mov r8, rdi
call fcn.1400a7ed0
mov rcx, qword [rsi + 0x40]
mov rsi, qword [rsi + 0x48]
mov r12, rsi
and r12, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
mov qword [rsp + 0x30], rcx
lea r13, [rcx - 0x48]
lea r15, [rdi + 0x10]
xor ebp, ebp
pcmpeqd xmm7, xmm7
mov rax, qword [rsp + 0x30]
movdqu xmm8, xmmword [rax + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm6
pmovmskb edi, xmm0
test edi, edi
jne 0x140083e9a
pcmpeqb xmm8, xmm7
pmovmskb eax, xmm8
test eax, eax
jne 0x140083eec
add r12, rbp
add r12, 0x10
add rbp, 0x10
and r12, rsi
jmp 0x140083e49
lea eax, [rdi - 1]
and ax, di
mov edi, eax
je 0x140083e65
tzcnt eax, edi
add rax, r12
and rax, rsi
neg rax
lea rax, [rax + rax*8]
lea rbx, [rax*8]
add rbx, r13
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call fcn.1400260b0
test al, al
je 0x140083e90
add rbx, 0x10
mov rcx, r15
mov rdx, rbx
call fcn.140023870
test al, al
je 0x140083e90
mov rcx, r14
call fcn.1400837b0
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0xf0], rax
add byte [rax], al
add bl, dh
movq mm0, qword [r14]
Function at 0x14009be90
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x14009bed0
movabs r12, 0x8000000000000000
jmp 0x14009bf2a
mov rbx, qword [rsp + 0x20]
mov r15, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x14009bf0a
movzx eax, byte [0x14019f308]
xor ecx, ecx
mov rdx, rdi
call fcn.1400f8ae0
mov r14, rax
mov r12, rdi
test rax, rax
jne 0x14009bf13
mov ecx, 1
mov rdx, rdi
call fcn.140122170
xor r12d, r12d
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rdi
call fcn.140121660
mov rcx, rbx
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], r12
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400a2700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test byte [rdx], 1
je 0x1400a2740
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x1400a2862
add byte [rax], al
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x1400a2871
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call fcn.1400a28d0
jmp 0x1400a289d
Function at 0x1400a8750
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4d8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [rdx + 0x251]
test eax, eax
je 0x1400a8790
cmp eax, 3
jne 0x1400a9067
mov rdx, qword [rsi + 0x240]
mov r9, qword [rsi + 0x248]
jmp 0x1400a8b86
movups xmm0, xmmword [rsi + 0x70]
movups xmmword [rsi + 0x148], xmm0
movups xmm0, xmmword [rsi + 0x60]
movups xmmword [rsi + 0x138], xmm0
movups xmm0, xmmword [rsi + 0x50]
movups xmmword [rsi + 0x128], xmm0
movups xmm0, xmmword [rsi + 0x40]
movups xmmword [rsi + 0x118], xmm0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmm3, xmmword [rsi + 0x30]
movups xmmword [rsi + 0x108], xmm3
movups xmmword [rsi + 0xf8], xmm2
movups xmmword [rsi + 0xe8], xmm1
movups xmmword [rsi + 0xd8], xmm0
movups xmm0, xmmword [rsi + 0x80]
movups xmmword [rsi + 0x158], xmm0
movups xmm0, xmmword [rsi + 0x90]
movups xmmword [rsi + 0x168], xmm0
movups xmm0, xmmword [rsi + 0xa0]
movups xmmword [rsi + 0x178], xmm0
movups xmm0, xmmword [rsi + 0xb0]
movups xmmword [rsi + 0x188], xmm0
movups xmm0, xmmword [rsi + 0xc0]
movups xmmword [rsi + 0x198], xmm0
mov rax, qword [rsi + 0xd0]
mov qword [rsi + 0x1a8], rax
movzx eax, byte [rsi + 0x250]
mov byte [rsi + 0x252], al
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmmword [rsi + 0x1b0], xmm2
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x1c0], rax
movups xmmword [rsi + 0x1c8], xmm0
movups xmmword [rsi + 0x1d8], xmm1
mov rax, qword [rsi + 0x1b0]
lock inc qword [rax]
jle 0x1400a9065
mov rcx, qword [rsi + 0x1b8]
lea rcx, str.C:Usersmilus.cargo_registry_srcindex.crates.io_6f17d22bba15001f_reqwest_0.11.27_srcconnect.rs
call fcn.140122c50
Function at 0x1400a90c0
Capabilities:
Connect socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x14019f30c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x128]
test eax, eax
je 0x1400a91be
cmp eax, 1
je 0x1400a91ec
xor ebp, ebp
movzx eax, byte [rdi + 0xe8]
test eax, eax
jne 0x1400a9220
mov rcx, qword [rdi + 0x90]
mov qword [rdi + 0x98], rcx
mov eax, dword [rdi + 0x72]
movzx edx, word [rdi + 0x76]
shl rdx, 0x20
or rdx, rax
test byte [rdi + 0x70], 1
je 0x1400a9254
mov r10d, dword [rdi + 0x84]
mov r8d, dword [rdi + 0x88]
movzx eax, word [rdi + 0x8c]
shr rdx, 0x10
mov dword [rsp + 0x50], edx
mov rdx, qword [rdi + 0x78]
mov qword [rsp + 0x54], rdx
mov edx, dword [rdi + 0x80]
mov dword [rsp + 0x5c], edx
xorps xmm0, xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
mov dword [rsp + 0xc4], 0
rol ax, 8
mov dword [rsp + 0x60], r8d
mov r8d, 0x1c
mov r9w, 0x17
mov edx, r10d
jmp 0x1400a92a8
mov eax, dword [0x14019f30c]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
lea rcx, [r14 + 0xd8]
lea rdx, [0x140070690]
call fcn.1400ed020
mov byte [r14 + 0x128], 1
mov eax, dword [0x14019f30c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x125], 0
sete bpl
and bpl, byte [rax + 0x124]
movzx eax, byte [rdi + 0xe8]
test eax, eax
je 0x1400a9114
cmp eax, 3
jne 0x1400a9639
lea r15, [rdi + 0xe0]
movzx eax, byte [rdi + 0xe0]
test eax, eax
je 0x1400a930b
cmp eax, 3
jne 0x1400a9645
mov rax, qword [rdi + 0xd8]
jmp 0x1400a937f
mov rax, rdx
shr rax, 0x20
rol ax, 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0xc0], 0
mov r8d, 0x10
mov r9w, 2
mov word [rsp + 0x48], r9w
mov word [rsp + 0x4a], ax
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0xc8], r8d
lea rdx, [rsp + 0x48]
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x1400a92df
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x2733
jne 0x1400a9464
mov rdx, qword [rdi + 0x98]
mov qword [rdi + 0xa0], rdx
mov qword [rdi + 0xa8], 0
lea r15, [rdi + 0xe0]
mov byte [rdi + 0xe0], 0
add byte [rbp + 0x31], al
shr bl, 0xe
mov r14d, eax
shl r14, 0x20
or r14, 2
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.ws2_32.dll_closesocket]
mov eax, 2
jmp 0x1400a9603
lea rcx, str.C:Usersmilus.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_net_tcp_socket.rs
Function at 0x1400ae960
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm6
mov rdi, rdx
mov qword [rsp + 0x70], rcx
lea rax, [rdx + 0x1d4]
mov qword [rsp + 0x138], rax
lea rbx, [rdx + 0x10]
lea rax, [rdx + 0x1f0]
mov qword [rsp + 0x108], rax
xorps xmm6, xmm6
mov r13d, 0x400

Function at 0x1400afb10
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x178]
mov rdx, qword [rdx + 0x170]
cmp rcx, rdx
ja 0x1400afdc0
mov rax, qword [rdi + 0x168]
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x24], 1
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
lea rcx, [rdi + 0x1f0]
lea rdx, [rsp + 0x60]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1400afc86
cmp eax, 0x80090318
je 0x1400afd0c
test eax, eax
jne 0x1400afcf9
mov r8, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x168]
mov rax, qword [rdi + 0x170]
mov rcx, r8
sub rcx, rdx
mov ebx, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x150], 0
add r9, rbx
jb 0x1400afdf6
cmp r9, rax
ja 0x1400afe05
add rdx, rcx
add rbx, rdx
sub rbx, r8
xor r14d, r14d
cmp qword [rdi + 0x140], rbx
jb 0x1400afd9d
xor ecx, ecx
cmp eax, 0x90317
je 0x1400afd1d
cmp eax, 0x90321
jne 0x1400afcf9
xor r14d, r14d
cmp dword [rsp + 0x54], 5
mov dword [rdi + 0x1d0], 0x10000
cmove r14d, dword [rsp + 0x50]
mov byte [rdi + 0x1d4], 0
mov rcx, qword [rdi + 0x178]
mov rdx, rcx
sub rdx, r14
jb 0x1400afdcc
test r14d, r14d
je 0x1400afd41
mov rax, qword [rdi + 0x170]
mov rbx, rax
sub rbx, rdx
jb 0x1400afde4
mov qword [rdi + 0x170], 0
cmp rcx, r14
jne 0x1400afd23
cmp rax, rdx
jne 0x1400afd3a
jmp 0x1400afd41
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1400afd8f
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
jmp 0x1400afd82
mov byte [rsi + 1], 1
jmp 0x1400afd8d
cmp rax, rdx
je 0x1400afd41
mov rcx, qword [rdi + 0x168]
add rdx, rcx
mov r8, rbx
call fcn.140121660
mov qword [rdi + 0x170], rbx
mov qword [rdi + 0x178], r14
mov qword [rdi + 0x210], 0
jmp 0x1400afd89
lea rcx, [rdi + 0x140]
mov r15, rdx
xor edx, edx
mov r8, rbx
call fcn.14012aee0
mov rdx, r15
lea r8, str.C:Usersmilus.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u640
call fcn.1401225f0
Function at 0x1400afee0
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov r15, rdx
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rsi
call fcn.1400ae960
mov ecx, dword [rsp + 0x28]
cmp ecx, 2
jne 0x1400aff21
mov rdx, qword [rsp + 0x30]
mov eax, 1
test ecx, ecx
je 0x1400b0077
mov rdx, qword [rsi + 0x190]
mov r14, qword [rsi + 0x198]
cmp r14, rdx
jne 0x1400b00bd
mov rdi, qword [rsp + 0x30]
mov ebp, edi
shr rdi, 0x20
cmp r12, rdi
cmovb rdi, r12
mov r13d, dword [rsp + 0x2c]
lea r12, [rdi + r13]
add rbp, r12
sub rbp, r14
jbe 0x1400affb5
mov rax, qword [rsi + 0x180]
sub rax, r14
cmp rax, rbp
jb 0x1400b0123
mov rbx, qword [rsi + 0x188]
lea rcx, [rbx + r14]
cmp rbp, 2
jb 0x1400affa3
movabs rdx, 0x8009031700000002
jmp 0x1400b0112
lea rcx, [rsi + 0x180]
mov rdx, r14
mov r8, rbp
call fcn.14012aee0
mov r14, qword [rsi + 0x190]
mov rbx, qword [rsi + 0x188]
lea rcx, [rbx + r14]
lea ecx, [rbx + rsi]

Function at 0x1400b01a0
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r13, r8
mov r12, rdx
mov rdi, rcx
lea rcx, [rsp + 0x20]
Function at 0x1400c95b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
cmp byte [rcx + 0x79], 0
je 0x1400c95c4
xor eax, eax
jmp 0x1400c97ed
mov r8, qword [rcx + 0x48]
mov r9, qword [rcx + 0x50]
test byte [rcx], 1
je 0x1400c95ff
lea rdx, [rcx + 8]
mov rax, qword [rcx + 0x58]
cmp qword [rcx + 0x38], 0xffffffffffffffff
mov rdi, rcx
mov rcx, qword [rcx + 0x60]
je 0x1400c9736
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x1400c9745
cmp byte [rcx + 0x1a], 0
je 0x1400c961f
mov rsi, r8
xor eax, eax
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
jne 0x1400c9785
jmp 0x1400c97b7
mov rax, qword [rcx + 8]
movzx edx, byte [rcx + 0x18]
jmp 0x1400c9637
add rax, r10
mov qword [rcx + 8], rax
mov r10d, edx
xor dl, 1
test rax, rax
je 0x1400c9666
cmp rax, r9
jae 0x1400c9660
cmp byte [r8 + rax], 0xbf
jg 0x1400c9666
jmp 0x1400c97f5
jne 0x1400c97f5
cmp rax, r9
je 0x1400c975e
movzx ebx, byte [r8 + rax]
movzx r11d, bl
test r11b, r11b
jns 0x1400c96e0
mov esi, r11d
and esi, 0x1f
movzx edi, byte [r8 + rax + 1]
and edi, 0x3f
cmp r11b, 0xdf
jbe 0x1400c96ca
movzx r11d, byte [r8 + rax + 2]
shl edi, 6
and r11d, 0x3f
or r11d, edi
cmp bl, 0xf0
jb 0x1400c9722
movzx edi, byte [r8 + rax + 3]
and esi, 7
shl esi, 0x12
shl r11d, 6
and edi, 0x3f
or edi, r11d
or edi, esi
mov r11d, edi
test r10b, 1
je 0x1400c96e6
jmp 0x1400c972e
shl esi, 6
or esi, edi
mov r11d, esi
nop word cs:[rax + rax]
test r10b, 1
jne 0x1400c972e
mov r10d, 1
cmp r11d, 0x80
jb 0x1400c9630
mov r10d, 2
cmp r11d, 0x800
jb 0x1400c9630
cmp r11d, 0x10000
mov r10d, 4
sbb r10, 0
jmp 0x1400c9630
shl esi, 0xc
or r11d, esi
test r10b, 1
je 0x1400c96e6
mov byte [rcx + 0x18], dl
mov r9, rax
jmp 0x1400c9767
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x38]
mov rsi, r8
call fcn.1400a28d0
mov rcx, rdi
test byte [rsp + 0x38], 1
jne 0x1400c9785
jmp 0x1400c97b7
mov byte [rcx + 0x18], dl
test r10b, 1
je 0x1400c97a2
mov rsi, r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r9
mov eax, 1
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
je 0x1400c97b7
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rcx + 0x68]
sub rdx, r9
mov rax, rsi
add rax, r9
mov qword [rcx + 0x68], r8
jmp 0x1400c97ed
mov rsi, r8
mov byte [rcx + 0x1a], 1
xor eax, eax
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
jne 0x1400c9785
cmp byte [rcx + 0x79], 0
jne 0x1400c95bd
mov byte [rcx + 0x79], 1
cmp byte [rcx + 0x78], 1
jne 0x1400c97d5
mov rax, qword [rcx + 0x68]
mov rdx, qword [rcx + 0x70]
jmp 0x1400c97e6
mov rax, qword [rcx + 0x68]
mov rdx, qword [rcx + 0x70]
cmp rdx, rax
je 0x1400c95bd
sub rdx, rax
add rax, qword [rcx + 0x48]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov byte [rcx + 0x18], dl
lea rcx, str._rustc_41dd149fd6a6a06795fc6b9f54cb49af2f61775flibrarycore_src_strpattern.rs
mov qword [rsp + 0x20], rcx
mov rcx, r8
mov rdx, r9
mov r8, rax
call fcn.140122bb0
int3
Function at 0x1400cd630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
movaps xmmword [rsp + 0x150], xmm6
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
lea rcx, [rsp + 0xd0]
and al, 0xd0
add byte [rax], al
add byte [rcx + rcx*4 - 0xe], cl

Function at 0x1400d3320
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400d3345
cmp rax, rcx
je 0x1400d334b
cmp rdx, 4
jae 0x1400d334f
xor eax, eax
xor r8d, r8d
jmp 0x1400d33e0
pop rbp
jmp fcn.140008e60
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14012f6c0]
movdqa xmm3, xmmword [0x14012f6d0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400d3370
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400d33f7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400d33e0
pop rbp
ret