joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cabe0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.1400cbf40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x1400cb8b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400ee168]
test eax, eax
je 0x1400cb94a
lea rax, [0x1400ee140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400ee170]
mov qword [rbp - 8], rax
jmp 0x1400cb92e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400cb922
cmp qword [rbp - 0x10], 0
je 0x1400cb922
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400cb8e8
lea rax, [0x1400ee140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400cb94b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400cba50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400cba78
mov eax, 0
jmp 0x1400cbac6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400cbaa1
mov eax, 0
jmp 0x1400cbac6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400cbac1
mov eax, 0
jmp 0x1400cbac6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400cbacc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400cbb4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400cbb41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400cbb41
mov rax, qword [rbp - 8]
jmp 0x1400cbb5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400cbb14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140037660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400376f0
cmp r10, r11
jb 0x140037766
cmp r10, rdx
ja 0x14003777a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400376f2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1400376d0
jmp 0x140037754
ja 0x1400376fa
mov r11, r10
cmp rax, r8
jne 0x140037694
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140037730
mov rdi, r8
sub ecx, edx
jns 0x14003774b
jmp 0x140037756
cmp r8, rsi
je 0x14003778b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140037756
xor al, 1
cmp rdi, rsi
jne 0x140037710
jmp 0x140037756
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1401094d0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140109240
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valueC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.5_srcwin.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140109250
ud2

Function at 0x14003e623
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rsp + 0x20]
mov qword [rdi], 0
mov rcx, rdx
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rdi]
test eax, eax
je 0x14003e65a
call sub.ole32.dll_CoTaskMemFree
mov byte [rsi + 0x18], 2
jmp 0x14003e679
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x20]
mov rcx, rsi
call fcn.1400d3bf0
mov rcx, qword [rsp + 0x20]
call sub.ole32.dll_CoTaskMemFree
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140041261
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x18]
xor eax, eax
test rbx, rbx
setne al
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
mov rcx, rsi
call fcn.14003fda7
test rbx, rbx
je 0x1400412ab
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.14003fda7
movzx eax, byte [rdi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
mov rcx, rsi
call fcn.14003fda7
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400412cd
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rax
movabs rax, 0x100000001b3
mov r9, qword [rcx + 0x18]
xor r8d, r8d
test r9, r9
setne r8b
mov qword [rsp], r8
mov r8, qword [rdx]
xor r10d, r10d
movzx r11d, byte [rsp + r10]
inc r10
xor r8, r11
imul r8, rax
cmp r10, 8
jne 0x1400412f0
test r9, r9
je 0x140041332
mov r9, qword [rcx + 8]
test r9, r9
je 0x140041355
mov rcx, qword [rcx]
xor r10d, r10d
movzx r11d, byte [rcx + r10]
xor r11, r8
imul r11, rax
inc r10
mov r8, r11
cmp r9, r10
jne 0x140041319
jmp 0x140041358
movzx ecx, byte [rcx]
mov qword [rsp], rcx
xor ecx, ecx
movzx r9d, byte [rsp + rcx]
inc rcx
xor r8, r9
imul r8, rax
cmp rcx, 8
jne 0x14004133b
mov qword [rdx], r8
jmp 0x14004135b
mov r11, r8
mov qword [rdx], r11
pop rax
ret
Function at 0x14004af0f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov ebx, ecx
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x38], rax
mov r14, qword [rdx + 0x10]
mov r12, qword [rdx + 0x18]
mov rax, qword [rdx + 0x30]
mov qword [rsp + 0x40], rax
mov eax, dword [rdx + 0x38]
mov dword [rsp + 0x28], eax
mov r13, qword [rdx]
mov eax, dword [rdx + 8]
mov dword [rsp + 0x24], eax
mov al, byte [rdx + 0x44]
mov byte [rsp + 0x23], al
mov al, byte [rdx + 0x45]
mov byte [rsp + 0x22], al
mov ebp, dword [rdx + 0x40]
mov eax, dword [rdx + 0x3c]
mov dword [rsp + 0x2c], eax
mov rax, qword [rdx + 0x28]
mov qword [rsp + 0x30], rax
lea rcx, [0x1400aea4c]
call fcn.14004f0da
mov rsi, rax
mov rdi, rdx
xorps xmm6, xmm6
movups xmmword [rsp + 0x50], xmm6
mov r15d, 8
mov ecx, 0x220
mov edx, 8
call fcn.14002d260
test rax, rax
je 0x14004b178
movzx ecx, bl
mov r9d, 2
sub r9d, ecx
xor ecx, ecx
mov edx, 1
cmp r14, rdx
mov r8d, 0
sbb r8, r8
or r8, r12
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], 0
movups xmm0, xmmword [rsp + 0x49]
movups xmmword [rax + 0x19], xmm0
mov r10, qword [rsp + 0x58]
mov qword [rax + 0x28], r10
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], r15
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rsi
mov qword [rax + 0x50], rdi
movups xmmword [rax + 0x58], xmm6
mov qword [rax + 0x68], rcx
lea r10, [0x140152010]
mov qword [rax + 0x70], r10
mov qword [rax + 0x78], rcx
mov qword [rax + 0x80], r15
mov qword [rax + 0x88], rcx
mov qword [rax + 0x90], r13
mov r10d, dword [rsp + 0x24]
mov dword [rax + 0x98], r10d
movabs r10, 0xffff0000ffff
mov qword [rax + 0xa0], r10
mov qword [rax + 0xb8], rcx
movups xmmword [rax + 0xa8], xmm6
mov qword [rax + 0xc0], r15
mov qword [rax + 0xc8], rcx
mov dword [rax + 0xd0], ecx
mov dword [rax + 0xd4], r9d
mov dword [rax + 0xd8], ecx
mov r9d, dword [rsp + 0x28]
mov dword [rax + 0xe0], r9d
movaps xmm0, xmmword [0x140112ab0]
movups xmmword [rax + 0xe4], xmm0
mov dword [rax + 0x104], ecx
mov dword [rax + 0x118], ecx
mov r9b, byte [rsp + 0x23]
mov byte [rax + 0x12c], r9b
mov r9b, byte [rsp + 0x22]
mov byte [rax + 0x12d], r9b
mov qword [rax + 0x138], rcx
mov byte [rax + 0x140], 3
mov dword [rax + 0x168], ebp
mov dword [rax + 0x16c], ebp
mov r9, qword [rsp + 0x30]
mov qword [rax + 0x170], r9
mov qword [rax + 0x178], rcx
mov dword [rax + 0x188], ecx
mov dword [rax + 0x19c], ecx
mov dword [rax + 0x1b0], ecx
mov dword [rax + 0x1c8], ecx
mov r9d, dword [rsp + 0x2c]
mov dword [rax + 0x1cc], r9d
mov dword [rax + 0x1d0], 0x7fffffff
mov dword [rax + 0x1d4], ebp
mov word [rax + 0x1d8], 1
mov qword [rax + 0x1e0], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x1e8], rdx
mov qword [rax + 0x1f0], rcx
mov qword [rax + 0x1f8], r8
mov qword [rax + 0x200], rcx
mov rdx, qword [rsp + 0x40]
mov qword [rax + 0x208], rdx
mov qword [rax + 0x210], rcx
mov byte [rax + 0x218], bl
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x220
mov edx, 8
call fcn.140108e10
ud2
Function at 0x14007c0fe
Capabilities:
Create process on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov word [rsp + 0x3a], cx
mov dword [rsp + 0x3c], edx
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1400d79d0
cmp byte [rsi + 0x18], 2
jne 0x14007c15d
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0xa0]
mov qword [r8], rax
lea rax, str.D:_aOyasumiOyasumi_src_shared_srcwindows.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, fcn.1400f6cbc
mov edx, 0x2b
call fcn.1401094e0
ud2
lea rdx, [rsp + 0x70]
mov rax, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
add rcx, rax
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.14007bddd
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rsi]
jne 0x14007c1a1
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.14007c0c5
mov rdx, qword [rsi + 0x10]
mov rsi, qword [rsp + 0x60]
xor ebp, ebp
mov word [rsi + rdx*2], bp
lea rax, [rsp + 0x3a]
lea rcx, [rsp + 0xa0]
mov qword [rcx], rax
lea rax, [fcn.1400357f0]
mov qword [rcx + 8], rax
lea rax, [rsp + 0x3c]
mov qword [rcx + 0x10], rax
lea rax, [0x1400358f0]
mov qword [rcx + 0x18], rax
lea rax, str.Tried_to_shrink_to_a_larger_capacity
lea rbx, [rsp + 0x70]
mov qword [rbx + 0x10], rax
mov eax, 2
mov qword [rbx + 0x18], rax
mov qword [rbx], 0
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x28], rax
lea r14, [rsp + 0x40]
mov rcx, r14
mov rdx, rbx
call fcn.14002db70
mov rdi, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
add rax, rdi
mov r14, qword [r14]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov word [rbx + 0x10], bp
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x70]
call fcn.14007bddd
test r14, r14
je 0x14007c252
mov rcx, qword [0x1401849b0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rsp + 0x50]
cmp rdx, qword [rsp + 0x40]
jne 0x14007c26f
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c0c5
mov rdx, qword [rdi + 0x10]
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov word [rdi + rdx*2], ax
lea rcx, str.struct_NVMLSetPowerManagementLimitRequeststruct_MSIAfterburnerSetProfileRequestlibrarypanic_abort_srclib.rs
lea rdx, [rsp + 0x70]
mov qword [rdx], rcx
lea rcx, str.runas
mov qword [rdx + 8], rcx
mov word [rdx + 0x10], ax
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call fcn.14007bddd
mov rdx, qword [rbx + 8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r8, rsi
mov r9, rdi
call qword [sym.imp.shell32.dll_ShellExecuteW]
call fcn.1400e8230
ud2
Function at 0x140096123
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov qword [rsp + 0x40], r9
mov r13d, r8d
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0x1e0]
mov rbx, qword [r14 + 8]
mov r15d, dword [r14]
mov r12d, dword [r14 + 4]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.14003ecb9
mov dil, byte [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.14003ecb9
mov sil, byte [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.14003ecb9
mov rbp, qword [rax + 0x88]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.14003ecb9
cmp dil, 5
ja 0x1400961db
cmp dil, 3
jne 0x140096212
mov edi, dword [rax + 0xb8]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.14003f2e3
lea rcx, [rax + 0x60]
mov edx, edi
mov r8d, dword [rsp + 0x34]
mov r9d, r13d
call fcn.14004a7c8
cmp sil, 5
ja 0x140096226
test rbp, rbp
jne 0x140096226
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
mov r8, r14
call fcn.1400962a4
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov r8d, r15d
mov r9d, r12d
call fcn.14003ecb9
mov eax, dword [rax + 0xb8]
lea rdx, [rsp + 0x58]
mov dword [rdx + 4], eax
mov eax, dword [rsp + 0x34]
mov dword [rdx + 8], eax
mov byte [rdx], 8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r8, rdi
mov r9, r14
call fcn.140094810
mov rcx, rsi
mov rdx, r14
mov r8, qword [rsp + 0x48]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140048f8f
Function at 0x1400ad569
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x38]
cmp rdx, rcx
jb 0x1400ad6fe
mov rax, qword [rdi + 0x30]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1400ad674
cmp eax, 0x80090318
je 0x1400ad6d2
test eax, eax
jne 0x1400ad6c2
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x30]
mov rax, qword [rdi + 0x38]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x18], 0
add r9, r8
jb 0x1400ad70c
cmp rax, r9
jb 0x1400ad71d
lea rax, [rdi + 8]
add rdx, rcx
mov rcx, rax
call fcn.14002e452
mov qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1400ad4df
xor eax, eax
cmp qword [rdi + 0x20], 0
sete al
mov qword [rdi + 0xa8], rax
mov byte [rsi + 1], 0
jmp 0x1400ad6f4
cmp eax, 0x90317
je 0x1400ad6ee
cmp eax, 0x90321
jne 0x1400ad6c2
mov dword [rdi + 0x100], 0x10000
xor ebx, ebx
mov byte [rdi + 0x104], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1400ad4df
mov qword [rdi + 0xa8], 0
mov byte [rsi + 1], bl
jmp 0x1400ad6f4
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1400ad6f4
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xa8], rax
mov byte [rsi + 1], 0
jmp 0x1400ad6f2
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.20_src_tls_stream.rsC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.2.1_src_buf_take.rsassertion_failed:_cnt___self.limit
call fcn.140109240
ud2
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.20_src_tls_stream.rsC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.2.1_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rdx, r9
call fcn.1401094d0
ud2
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.20_src_tls_stream.rsC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.2.1_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rcx, r9
mov rdx, rax
jmp 0x1400ad705
Function at 0x1400ad932
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x38]
cmp rdx, rcx
jb 0x1400adac7
mov rax, qword [rdi + 0x30]
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
movups xmmword [r8 + 0x30], xmm0
mov dword [r8], ecx
mov dword [r8 + 4], 1
mov qword [r8 + 8], rax
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], r8
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x1400ada3d
cmp eax, 0x80090318
je 0x1400ada9b
test eax, eax
jne 0x1400ada8b
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x30]
mov rax, qword [rdi + 0x38]
sub rcx, rdx
mov r8d, dword [rsp + 0x30]
mov r9, rcx
mov qword [rdi + 0x18], 0
add r9, r8
jb 0x1400adad5
cmp rax, r9
jb 0x1400adae6
lea rax, [rdi + 8]
add rdx, rcx
mov rcx, rax
call fcn.14002e452
mov qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.1400ad4df
xor eax, eax
cmp qword [rdi + 0x20], 0
sete al
mov qword [rdi + 0xa8], rax
mov byte [rsi + 1], 0
jmp 0x1400adabd
cmp eax, 0x90317
je 0x1400adab7
cmp eax, 0x90321
jne 0x1400ada8b
mov dword [rdi + 0xd8], 0x10000
xor ebx, ebx
mov byte [rdi + 0xdc], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.1400ad4df
mov qword [rdi + 0xa8], 0
mov byte [rsi + 1], bl
jmp 0x1400adabd
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
jmp 0x1400adabd
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0xa8], rax
mov byte [rsi + 1], 0
jmp 0x1400adabb
mov byte [rsi + 1], 1
xor ebx, ebx
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.20_src_tls_stream.rsC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.2.1_src_buf_take.rsassertion_failed:_cnt___self.limit
call fcn.140109240
ud2
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.20_src_tls_stream.rsC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.2.1_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rdx, r9
call fcn.1401094d0
ud2
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.20_src_tls_stream.rsC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_bytes_1.2.1_src_buf_take.rsassertion_failed:_cnt___self.limit
mov rcx, r9
mov rdx, rax
jmp 0x1400adace
Function at 0x1400ae852
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
test rcx, rcx
je 0x1400ae884
mov r8, qword [rcx + 8]
cmp qword [rcx], 0
mov qword [rcx], 0
jne 0x1400aea12
lea rcx, [0x1400aea4c]
call fcn.14004f0da
mov rsi, rax
mov rdi, rdx
movabs r15, 0x736f6d6570736575
xor r15, rax
movabs r12, 0x646f72616e646f6d
xor r12, rdx
movabs r13, 0x6c7967656e657261
xor r13, rax
movabs rbp, 0x7465646279746573
xor rbp, rdx
mov ebx, 1
lea r14, [rsp + 0x58]
xorps xmm6, xmm6
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
movups xmmword [r14], xmm6
mov qword [r14 + 0x10], 0
mov qword [rsp + 0x20], rbx
mov r8d, 8
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x20]
call fcn.14003fda7
mov rax, qword [rsp + 0x38]
mov r9, qword [rsp + 0x58]
shl r9, 0x38
or r9, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
add r8, rax
rol rax, 0xd
xor rcx, r9
xor rax, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x30]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, r8
xor rax, rdx
rol rdx, 0x20
xor r8, r9
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
rol rcx, 0x15
xor rax, r8
add rdx, rax
rol rax, 0x11
mov r8, rdx
rol r8, 0x20
xor r8, rax
xor r8, rcx
inc rbx
xor r8, rdx
je 0x1400ae8d7
mov eax, dword [0x140184a60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0xe8], 1
mov qword [rax + 0xf0], r8
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret