joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2580c15b0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x2580c15d1
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp fcn.2580e8830

Function at 0x2580c8790
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x158
movaps xmmword [rsp + 0x140], xmm6
cmp qword [0x25816fb40], 0
mov qword [rsp + 0x170], rcx
mov qword [rsp + 0x178], rdx
mov byte [rsp + 0x2f], 1
je 0x2580c8887
mov rax, qword [0x25816fc20]
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [0x25816fc20], rax
call sub.msvcrt.dll__setjmp
cdqe
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x2580c88b0
xor r12d, r12d
cmp qword [rsp + 0x170], 0
je 0x2580c885c
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_strlen
mov edx, 7
lea rcx, [0x2580ea020]
cmp rax, rdx
movq xmm6, rax
mov rbx, rax
cmovge rdx, rax
movq xmm0, rdx
add rdx, 0x11
punpcklqdq xmm6, xmm0
call fcn.2580e12b0
mov rdx, qword [rsp + 0x170]
lea r8, [rbx + 1]
movups xmmword [rax], xmm6
lea rcx, [rax + 0x10]
mov r12, rax
call sub.msvcrt.dll_memcpy
mov rcx, r12
call qword [0x25816fb40]
cmp qword [rsp + 0x38], 0
mov byte [rsp + 0x2f], 0
mov rax, qword [0x25816fc20]
mov rax, qword [rax]
mov qword [0x25816fc20], rax
jne 0x2580c8919
movzx eax, byte [rsp + 0x2f]
test al, al
jne 0x2580c8928
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x158
pop rbx
pop r12
ret
mov rax, qword [0x25816fc20]
mov rax, qword [rax]
mov qword [rsp + 0x38], 0
mov qword [0x25816fc20], rax
mov rax, qword [0x25817d7c8]
mov rbx, qword [rax + 0x28]
test rbx, rbx
je 0x2580c88eb
add qword [rbx - 0x10], 8
mov rax, qword [0x25817d7c8]
test rax, rax
je 0x2580c8906
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
sub rdx, 8
mov qword [rax - 0x10], rdx
cmp rdx, 7
ja 0x2580c8906
call fcn.2580dfe40
cmp qword [rsp + 0x38], 0
mov qword [0x25817d7c8], rbx
je 0x2580c8887
call fcn.2580c9220
jmp 0x2580c8887
mov ecx, 2
call qword [fcn.2580e9160]
mov rcx, qword [rsp + 0x170]
mov edx, 1
mov r8, qword [rsp + 0x178]
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.2580e8830
jmp 0x2580c8894
Function at 0x2580cb340
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.2580e9160]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.2580e8830
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
mov rax, qword [0x25817d7c0]
cmp rax, 0xdab
jg 0x2580cb3be
lea rdx, [0x258176a60]
mov qword [rdx + rax*8], rcx
add rax, 1
mov qword [0x25817d7c0], rax
add rsp, 0x28
ret
call fcn.2580cb340
nop
nop word cs:[rax + rax]
nop
push r12
sub rsp, 0x30
mov rax, qword [0x25817d7c0]
cmp rax, 0xdab
jg 0x2580cb46f
lea rdx, [0x258176a60]
lea rcx, [0x2580c43d0]
mov qword [rdx + rax*8], rcx
add rax, 1
lea r12, [0x2580c92d0]
mov qword [0x25817d7c0], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.2580c17d0
call fcn.2580c2be0
mov rdx, r12
mov ecx, 2
call fcn.2580e87e8
mov rdx, r12
mov ecx, 0xb
call fcn.2580e87e8
mov rdx, r12
mov ecx, 0x16
call fcn.2580e87e8
mov rdx, r12
mov ecx, 8
call fcn.2580e87e8
mov rdx, r12
mov ecx, 4
call fcn.2580e87e8
nop
add rsp, 0x30
pop r12
ret
call fcn.2580cb340
nop
nop word cs:[rax + rax]

Function at 0x2580cb5e0
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.2580e9160]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.2580e8830
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
mov rax, qword [0x258176a40]
cmp rax, 0xdab
jg 0x2580cb65e
lea rdx, [0x25816fce0]
mov qword [rdx + rax*8], rcx
add rax, 1
mov qword [0x258176a40], rax
add rsp, 0x28
ret
call fcn.2580cb5e0
nop
nop word cs:[rax + rax]
nop
Function at 0x2580d65c0
Capabilities:
Access peb ldr_data

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbx, [0x2580ed820]
mov r13, rcx
mov r12d, edx
lea rcx, [0x2580ed860]
mov edx, 0x4fb6fba0
call fcn.2580d0760
mov edx, 0x64a40ee0
mov rcx, rax
call fcn.2580d5d30
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop dword [rax]
movzx eax, word [r13]
mov rdx, r13
test ax, ax
je 0x2580d6640
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x2580d66c0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x2580d6620
mov r8, qword [rdi + 0x50]
movzx eax, word [r8]
test ax, ax
je 0x2580d6670
mov rdx, r8
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x2580d66e0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x2580d6650
mov rdx, r8
mov rcx, r13
call fcn.2580d11c0
mov edx, 0x2596cfa0
mov rcx, rbx
mov rbp, rax
call fcn.2580d0760
mov edx, 0x5d8b0ae0
mov rcx, rax
call fcn.2580d5d30
test rbp, rbp
je 0x2580d66f6
mov rdi, qword [rdi]
cmp rsi, rdi
jne 0x2580d6610
mov edx, r12d
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x2580dfb10
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x2580d6620
jmp 0x2580d6640
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x2580d6650
jmp 0x2580d6670
mov rax, qword [rdi + 0x20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
push r12
push rbx
sub rsp, 0x48
mov r12, rcx
test edx, edx
je 0x2580dfbc0
mov edx, 0x290d68a0
lea rcx, [0x2580ef980]
lea rbx, [rsp + 0x30]
call fcn.2580d0760
mov edx, 0x76f635e0
mov rcx, rax
call fcn.2580d5d30
mov rax, qword [0x258168830]
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [rax]
mov rax, qword [0x2581687e0]
lea r9, [rsp + 0x28]
xor edx, edx
mov r8, rbx
xor ecx, ecx
call qword [rax]
mov edx, 0x401bb3e0
lea rcx, [0x2580ef940]
mov r12d, eax
call fcn.2580d0760
mov edx, 0x2596cfa0
mov rcx, rax
call fcn.2580d5d30
xor eax, eax
test r12d, r12d
cmove rax, qword [rsp + 0x28]
add rsp, 0x48
pop rbx
pop r12
ret
mov edx, 0x4c68d8e0
lea rcx, [0x2580ef900]
call fcn.2580d0760
mov edx, 0x21e21ea0
mov rcx, rax
call fcn.2580d5d30
xor eax, eax
add rsp, 0x48
pop rbx
pop r12
ret
Function at 0x2580dfbf0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 0x4fb6fba0
mov r12, rcx
mov rcx, qword [0x258168d60]
call fcn.2580d0760
mov edx, 0x64a40ee0
mov rcx, rax
call fcn.2580d5d30
mov rbx, qword [0x258168d70]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop word [rax + rax]
movzx eax, word [r12]
mov rdx, r12
test ax, ax
je 0x2580dfc70
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x2580dfcf0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x2580dfc50
mov r8, qword [rdi + 0x50]
movzx eax, word [r8]
test ax, ax
je 0x2580dfca0
mov rdx, r8
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x2580dfd10
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x2580dfc80
mov rdx, r8
mov rcx, r12
call fcn.2580d11c0
mov edx, 0x2596cfa0
mov rcx, rbx
mov rbp, rax
call fcn.2580d0760
mov edx, 0x5d8b0ae0
mov rcx, rax
call fcn.2580d5d30
test rbp, rbp
je 0x2580dfd26
mov rdi, qword [rdi]
cmp rsi, rdi
jne 0x2580dfc40
mov edx, 1
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x2580dfb10
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x2580dfc50
jmp 0x2580dfc70
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x2580dfc80
jmp 0x2580dfca0
mov rax, qword [rdi + 0x20]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x2580e2070
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.2580e9160
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.2580e9160
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x2580e29e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x258184528]
test eax, eax
je 0x2580e2a7a
lea rax, [0x258184500]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x258184530]
mov qword [rbp - 8], rax
jmp 0x2580e2a5e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2580e2a52
cmp qword [rbp - 0x10], 0
je 0x2580e2a52
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2580e2a18
lea rax, [0x258184500]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2580e2a7b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x2580e2b80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2580e2ba8
mov eax, 0
jmp 0x2580e2bf6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2580e2bd1
mov eax, 0
jmp 0x2580e2bf6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2580e2bf1
mov eax, 0
jmp 0x2580e2bf6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x2580e2bfc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2580e2c7a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2580e2c71
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2580e2c71
mov rax, qword [rbp - 8]
jmp 0x2580e2c8f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2580e2c44
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140012266
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov esi, ecx
shr esi, 8
lea r8, [rdx + r8*2]
xor edi, edi
cmp rdx, r8
je 0x1400122e2
lea rbx, [rdx + 2]
movzx r15d, byte [rdx + 1]
lea r14, [rdi + r15]
cmp byte [rdx], sil
jne 0x1400122c2
cmp rdi, r14
ja 0x14001231f
cmp r14, rax
ja 0x14001231f
add rdi, r9
xor edx, edx
cmp r15, rdx
je 0x1400122cc
lea r12, [rdx + 1]
cmp byte [rdi + rdx], cl
mov rdx, r12
jne 0x1400122af
jmp 0x1400122d4
mov rdx, rbx
mov rdi, r14
jbe 0x140012289
jmp 0x1400122e2
mov rdx, rbx
mov rdi, r14
jmp 0x140012289
xor eax, eax
and al, 1
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movzx ecx, cx
add r10, r11
mov al, 1
cmp r11, r10
je 0x1400122d6
lea r8, [r11 + 1]
movzx edx, byte [r11]
test dl, dl
js 0x140012300
mov r11, r8
jmp 0x140012317
cmp r8, r10
je 0x14001231f
and edx, 0x7f
shl edx, 8
movzx r8d, byte [r11 + 1]
add r11, 2
or edx, r8d
sub ecx, edx
js 0x1400122d6
xor al, 1
jmp 0x1400122ea
ud2

Function at 0x140019f9b
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140019fc1
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140019fab
mov qword [rcx], rax
ret

Function at 0x14001a0a9
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14002d48e
test rbx, rbx
je 0x14001a0e2
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140019f9b
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140019f93
Function at 0x140031c81
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf0
mov rbx, rdx
mov rsi, rcx
mov ecx, 0x18
mov edx, 8
call fcn.14003054d
mov rdi, rax
mov eax, 1
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], 0
cmp rbx, 0xffffffffffffffff
je 0x140031e6d
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x2c]
mov dword [r8], pe_nt_image_headers64
mov rcx, rbx
call sub.ws2_32.dll_getpeername
cmp eax, 0xffffffff
je 0x140031d16
movsxd r8, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x70]
call fcn.140072dcc
jmp 0x140031d27
call fcn.14007612c
mov qword [rsp + 0x38], rax
mov word [rsp + 0x30], 2
lea r14, [rsp + 0x50]
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x2c]
mov dword [r8], pe_nt_image_headers64
mov rcx, rbx
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x140031d85
movsxd r8, dword [rsp + 0x2c]
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140072dcc
movzx ebx, word [rsp + 0x50]
jmp 0x140031d9a
call fcn.14007612c
mov qword [rsp + 0x58], rax
mov word [rsp + 0x50], 2
mov bx, 2
movzx ebp, word [rsp + 0x30]
cmp bp, 2
je 0x140031e38
cmp bx, 2
je 0x140031e38
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
mov ecx, 0x40
mov edx, 4
call fcn.14003054d
mov r14, rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmm3, xmmword [rsp + 0xa0]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x30], xmm3
xor ecx, ecx
call fcn.1400315cd
mov qword [rsi], r14
lea rax, [0x1400c3730]
mov qword [rsi + 8], rax
jmp 0x140031e3c
and qword [rsi], 0
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], 1
mov rdx, qword [rsp + 0x38]
mov ecx, ebp
call fcn.140031e71
mov rdx, qword [rsp + 0x58]
mov ecx, ebx
call fcn.140031e71
nop
add rsp, 0xf0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x1400361f6
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x140106050]
test r14, r14
jne 0x140036325
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x14003625d
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14003625d
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14003625d
mov r15, rax
xor ebx, ebx
jmp 0x1400362de
lea rcx, [0x1400fa0c8]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140036339
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140036339
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140036339
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140036339
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x140036339
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.14003633d
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x140106050], r14
je 0x140036325
mov rdi, rax
cmp qword [r14], 0
je 0x140036315
mov rcx, qword [r14 + 0x10]
call sub.kernel32.dll_CloseHandle
mov edx, 8
mov rcx, r14
call fcn.14000ac40
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
ud2

Function at 0x1400364d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x14008b080]
call fcn.140074bc0
mov ecx, eax
add rsp, 0x28
jmp fcn.140087c84
Function at 0x14003b769
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r13, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rdx + 0x138], r8
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.14003b9ab
mov eax, dword [rbx]
cmp eax, 2
je 0x14003b931
test eax, eax
je 0x14003b8e4
mov rdx, qword [rsi + 0x1b8]
cmp rdx, qword [rsi + 0x1b0]
jne 0x14003b91b
mov rcx, qword [rsp + 0xe0]
mov r15d, dword [rsp + 0x2c]
mov r14, qword [rsp + 0x30]
mov eax, r14d
shr r14, 0x20
cmp rcx, r14
cmovb r14, rcx
lea r12, [r14 + r15]
add rax, r12
lea rbp, [rsi + 0x1a0]
cmp rdx, rax
jae 0x14003b802
mov rcx, rbp
mov rdx, rax
call fcn.14003d40e
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rbp]
mov r8, r15
mov r9, r12
call fcn.14003d45e
cmp rdx, r14
jne 0x14003b9a4
mov rcx, rax
mov rdx, r13
mov r8, r14
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsi + 0x1b0]
cmp rdx, r15
jb 0x14003b9a0
mov r13, qword [rsi + 0x1a0]
mov rcx, r13
mov r8, r15
mov r9, r12
call fcn.14003d45e
mov rcx, qword [rsi + 0x1b0]
cmp rcx, r12
jb 0x14003b9a0
xor r8d, r8d
test rax, rax
cmove edx, r8d
sub ecx, r12d
add r12, qword [rsi + 0x1a0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x2c], 7
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], 6
mov qword [rsp + 0x50], r12
movabs rax, 0x400000000
lea r8, [rsp + 0x68]
mov qword [r8], rax
mov qword [r8 + 8], rbx
lea rcx, [rsi + 0x1c0]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x14003b8f0
mov ebx, eax
shl rbx, 0x20
or rbx, 2
jmp 0x14003b936
movabs rbx, 0x8009031700000002
jmp 0x14003b936
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rsi + 0x1b0], rax
jb 0x14003b90c
mov qword [rsi + 0x1b0], rax
and qword [rsi + 0x1b8], 0
mov qword [rsi + 0x200], r14
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rsi
call fcn.14003c51d
cmp qword [rbx], 0
je 0x14003b98f
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], 1
mov rcx, rbx
call fcn.14001c5d4
cmp al, 0xd
jne 0x14003b96b
lea rcx, [rsp + 0x30]
mov qword [rdi], 2
and qword [rsi + 0x138], 0
call fcn.14003b658
jmp 0x14003b97e
mov qword [rdi], 1
mov qword [rdi + 8], rbx
and qword [rsi + 0x138], 0
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x200]
and qword [rdi], 0
mov qword [rdi + 8], rax
jmp 0x14003b976
ud2
call fcn.14001121e
ud2
Function at 0x14003c606
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r13, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rdx + 0x38], r8
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.14003c83f
mov eax, dword [rbx]
cmp eax, 2
je 0x14003c7cb
test eax, eax
je 0x14003c77e
mov rdx, qword [rsi + 0xb8]
cmp rdx, qword [rsi + 0xb0]
jne 0x14003c7b5
mov rcx, qword [rsp + 0xe0]
mov r15d, dword [rsp + 0x2c]
mov r14, qword [rsp + 0x30]
mov eax, r14d
shr r14, 0x20
cmp rcx, r14
cmovb r14, rcx
lea r12, [r14 + r15]
add rax, r12
lea rbp, [rsi + 0xa0]
cmp rdx, rax
jae 0x14003c69c
mov rcx, rbp
mov rdx, rax
call fcn.14003d40e
mov rdx, qword [rsi + 0xb0]
mov rcx, qword [rbp]
mov r8, r15
mov r9, r12
call fcn.14003d45e
cmp rdx, r14
jne 0x14003c838
mov rcx, rax
mov rdx, r13
mov r8, r14
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsi + 0xb0]
cmp rdx, r15
jb 0x14003c834
mov r13, qword [rsi + 0xa0]
mov rcx, r13
mov r8, r15
mov r9, r12
call fcn.14003d45e
mov rcx, qword [rsi + 0xb0]
cmp rcx, r12
jb 0x14003c834
xor r8d, r8d
test rax, rax
cmove edx, r8d
sub ecx, r12d
add r12, qword [rsi + 0xa0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x2c], 7
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], 6
mov qword [rsp + 0x50], r12
movabs rax, 0x400000000
lea r8, [rsp + 0x68]
mov qword [r8], rax
mov qword [r8 + 8], rbx
lea rcx, [rsi + 0xc0]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x14003c78a
mov ebx, eax
shl rbx, 0x20
or rbx, 2
jmp 0x14003c7d0
movabs rbx, 0x8009031700000002
jmp 0x14003c7d0
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x28]
add eax, dword [rsp + 0x48]
cmp qword [rsi + 0xb0], rax
jb 0x14003c7a6
mov qword [rsi + 0xb0], rax
and qword [rsi + 0xb8], 0
mov qword [rsi + 0x100], r14
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rsi
call fcn.14003d34b
cmp qword [rbx], 0
je 0x14003c823
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], 1
mov rcx, rbx
call fcn.14001c5d4
cmp al, 0xd
jne 0x14003c802
lea rcx, [rsp + 0x30]
mov qword [rdi], 2
and qword [rsi + 0x38], 0
call fcn.14003b658
jmp 0x14003c812
mov qword [rdi], 1
mov qword [rdi + 8], rbx
and qword [rsi + 0x38], 0
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x100]
and qword [rdi], 0
mov qword [rdi + 8], rax
jmp 0x14003c80d
ud2
call fcn.14001121e
ud2