joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401518c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1401518d0
test al, 1
je 0x1401519a0
test al, 2
jne 0x1401519a0
test al, 8
jne 0x140151907
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x40], 5
lea rdx, [rsp + 0x20]
call fcn.140162f60
jmp 0x14015191f
test al, 0x10
je 0x14015191f
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1401519a0
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1401519a0
jne 0x140151998
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140151967
mov rcx, rdi
call fcn.14014d110
lea rcx, [rsi + 0x30]
call fcn.14014f570
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140151980
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x48
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x48
pop rdi
pop rsi
ret
ud2

Function at 0x1401519b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1401519c0
test al, 1
je 0x140151a61
test al, 2
jne 0x140151a61
test al, 8
jne 0x1401519fa
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.140163ff0
jmp 0x140151a14
test al, 0x10
je 0x140151a14
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140151a61
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140151a61
jne 0x140151a57
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.140151260
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x140151a70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x2c8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140151a80
test al, 1
je 0x140151b66
test al, 2
jne 0x140151b66
test al, 8
jne 0x140151abb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140162c90
jmp 0x140151ad9
test al, 0x10
je 0x140151ad9
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140151b66
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140151b66
jne 0x140151b5b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140151b21
mov rcx, rdi
call fcn.140062fd0
lea rcx, [rsi + 0x30]
call fcn.14014eee0
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140151b40
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x2c8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x2c8
pop rdi
pop rsi
ret
ud2
Function at 0x140151b70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfa8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140151b80
test al, 1
je 0x140151c66
test al, 2
jne 0x140151c66
test al, 8
jne 0x140151bbb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140163f10
jmp 0x140151bd9
test al, 0x10
je 0x140151bd9
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140151c66
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140151c66
jne 0x140151c5b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140151c21
mov rcx, rdi
call fcn.14014d110
lea rcx, [rsi + 0x30]
call fcn.140150890
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140151c40
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0xfa8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0xfa8
pop rdi
pop rsi
ret
ud2

Function at 0x140151c70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140151c80
test al, 1
je 0x140151d66
test al, 2
jne 0x140151d66
test al, 8
jne 0x140151cbb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 0xc
lea rdx, [rsp + 0x20]
call fcn.140162e80
jmp 0x140151cd9
test al, 0x10
je 0x140151cd9
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140151d66
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140151d66
jne 0x140151d5b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140151d21
mov rcx, rdi
call fcn.140062fd0
lea rcx, [rsi + 0x30]
call fcn.14014fff0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140151d40
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x1d8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x140151d70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140151d80
test al, 1
je 0x140151e53
test al, 2
jne 0x140151e53
test al, 8
jne 0x140151dba
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.1401642d0
jmp 0x140151dd2
test al, 0x10
je 0x140151dd2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140151e53
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140151e53
jne 0x140151e4b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140151e1a
mov rcx, rdi
call fcn.140062fd0
lea rcx, [rsi + 0x30]
call fcn.14014ed60
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140151e33
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x58
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x58
pop rdi
pop rsi
ret
ud2

Function at 0x140151e60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfa8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140151e70
test al, 1
je 0x140151f56
test al, 2
jne 0x140151f56
test al, 8
jne 0x140151eab
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140163f10
jmp 0x140151ec9
test al, 0x10
je 0x140151ec9
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140151f56
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140151f56
jne 0x140151f4b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140151f11
mov rcx, rdi
call fcn.140062fd0
lea rcx, [rsi + 0x30]
call fcn.140150890
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140151f30
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0xfa8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0xfa8
pop rdi
pop rsi
ret
ud2
Function at 0x140151f60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140151f70
test al, 1
je 0x140152040
test al, 2
jne 0x140152040
test al, 8
jne 0x140151fa7
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x40], 5
lea rdx, [rsp + 0x20]
call fcn.140162f60
jmp 0x140151fbf
test al, 0x10
je 0x140151fbf
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140152040
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140152040
jne 0x140152038
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140152007
mov rcx, rdi
call fcn.140062fd0
lea rcx, [rsi + 0x30]
call fcn.14014f570
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140152020
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x48
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x48
pop rdi
pop rsi
ret
ud2

Function at 0x140152050
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140152060
test al, 1
je 0x140152146
test al, 2
jne 0x140152146
test al, 8
jne 0x14015209b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 0xc
lea rdx, [rsp + 0x20]
call fcn.140162e80
jmp 0x1401520b9
test al, 0x10
je 0x1401520b9
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140152146
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140152146
jne 0x14015213b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140152101
mov rcx, rdi
call fcn.14014d110
lea rcx, [rsi + 0x30]
call fcn.14014fff0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140152120
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x1d8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x140152150
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140152160
test al, 1
je 0x140152233
test al, 2
jne 0x140152233
test al, 8
jne 0x14015219a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.1401642d0
jmp 0x1401521b2
test al, 0x10
je 0x1401521b2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140152233
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140152233
jne 0x14015222b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1401521fa
mov rcx, rdi
call fcn.14014d110
lea rcx, [rsi + 0x30]
call fcn.14014ed60
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140152213
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x58
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x58
pop rdi
pop rsi
ret
ud2

Function at 0x140152240
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140152250
test al, 1
je 0x140152336
test al, 2
jne 0x140152336
test al, 8
jne 0x14015228b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.1401616b0
jmp 0x1401522a9
test al, 0x10
je 0x1401522a9
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140152336
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140152336
jne 0x14015232b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1401522f1
mov rcx, rdi
call fcn.140062fd0
lea rcx, [rsi + 0x30]
call fcn.14014f7d0
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140152310
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x208
pop rdi
pop rsi
ret
ud2
Function at 0x140152340
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140152350
test al, 1
je 0x140152436
test al, 2
jne 0x140152436
test al, 8
jne 0x14015238b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
call fcn.140164200
jmp 0x1401523a9
test al, 0x10
je 0x1401523a9
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140152436
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140152436
jne 0x14015242b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1401523f1
mov rcx, rdi
call fcn.140062fd0
lea rcx, [rsi + 0x30]
call fcn.1401513e0
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140152410
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0xc8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0xc8
pop rdi
pop rsi
ret
ud2

Function at 0x140152440
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140152450
test al, 1
je 0x140152536
test al, 2
jne 0x140152536
test al, 8
jne 0x14015248b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.1401616b0
jmp 0x1401524a9
test al, 0x10
je 0x1401524a9
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140152536
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140152536
jne 0x14015252b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1401524f1
mov rcx, rdi
call fcn.14014d110
lea rcx, [rsi + 0x30]
call fcn.14014f7d0
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140152510
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x208
pop rdi
pop rsi
ret
ud2
Function at 0x140152540
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x2c8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140152550
test al, 1
je 0x140152636
test al, 2
jne 0x140152636
test al, 8
jne 0x14015258b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140162c90
jmp 0x1401525a9
test al, 0x10
je 0x1401525a9
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140152636
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140152636
jne 0x14015262b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1401525f1
mov rcx, rdi
call fcn.14014d110
lea rcx, [rsi + 0x30]
call fcn.14014eee0
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140152610
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x2c8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x2c8
pop rdi
pop rsi
ret
ud2

Function at 0x140152640
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140152650
test al, 1
je 0x140152736
test al, 2
jne 0x140152736
test al, 8
jne 0x14015268b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
call fcn.140164200
jmp 0x1401526a9
test al, 0x10
je 0x1401526a9
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140152736
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140152736
jne 0x14015272b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1401526f1
mov rcx, rdi
call fcn.14014d110
lea rcx, [rsi + 0x30]
call fcn.1401513e0
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140152710
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0xc8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0xc8
pop rdi
pop rsi
ret
ud2

Function at 0x140152740
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140152750
test al, 1
je 0x1401527f1
test al, 2
jne 0x1401527f1
test al, 8
jne 0x14015278a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.140163ff0
jmp 0x1401527a4
test al, 0x10
je 0x1401527a4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x1401527f1
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1401527f1
jne 0x1401527e7
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.140151320
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x140165ac0
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x198]
cmp rax, qword [rdx + 0x190]
ja 0x140165d7b
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x180]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0x1c0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x140165c32
cmp eax, 0x80090318
je 0x140165cb4
test eax, eax
jne 0x140165cd2
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x180]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x170], 0
add rcx, rbx
jb 0x140165d7b
cmp rcx, qword [rdi + 0x190]
ja 0x140165d7b
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x168], rbx
jb 0x140165d5e
xor r12d, r12d
mov rcx, qword [rdi + 0x160]
add rcx, r12
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x170], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x178], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r15
jb 0x140165d7b
test r15, r15
je 0x140165d00
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x140165d7b
mov qword [rdi + 0x190], 0
cmp rax, r15
jne 0x140165ce2
cmp rcx, rdx
jne 0x140165cf9
jmp 0x140165d00
cmp eax, 0x90317
je 0x140165ccc
cmp eax, 0x90321
jne 0x140165cd2
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x140], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x144], 0
mov rax, qword [rdi + 0x198]
mov rdx, rax
sub rdx, r14
jb 0x140165d7b
test r14, r14
je 0x140165d36
mov rcx, qword [rdi + 0x190]
mov rbx, rcx
sub rbx, rdx
jb 0x140165d7b
mov qword [rdi + 0x190], 0
cmp rax, r14
jne 0x140165d18
cmp rcx, rdx
jne 0x140165d2f
jmp 0x140165d36
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x1f8], rax
jmp 0x140165d48
mov byte [rsi + 1], 1
jmp 0x140165d4c
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x140165d4e
cmp rcx, rdx
je 0x140165d00
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x190], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x198], r15
mov qword [rdi + 0x1f8], rax
jmp 0x140165d48
cmp rcx, rdx
je 0x140165d36
mov rcx, qword [rdi + 0x180]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x190], rbx
mov qword [rdi + 0x198], r14
mov qword [rdi + 0x1f8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x160]
xor edx, edx
mov r8, rbx
call fcn.140089e50
mov r12, qword [rdi + 0x170]
jmp 0x140165bac
ud2
Function at 0x140167060
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x98]
cmp rax, qword [rdx + 0x90]
ja 0x140167300
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x80]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0xc0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x1401671c3
cmp eax, 0x80090318
je 0x14016723f
test eax, eax
jne 0x14016725d
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x80]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x70], 0
add rcx, rbx
jb 0x140167300
cmp rcx, qword [rdi + 0x90]
ja 0x140167300
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x68], rbx
jb 0x1401672e9
xor r12d, r12d
mov rcx, qword [rdi + 0x60]
add rcx, r12
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x70], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x78], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r15
jb 0x140167300
test r15, r15
je 0x14016728b
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x140167300
mov qword [rdi + 0x90], 0
cmp rax, r15
jne 0x14016726d
cmp rcx, rdx
jne 0x140167284
jmp 0x14016728b
cmp eax, 0x90317
je 0x140167257
cmp eax, 0x90321
jne 0x14016725d
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x40], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x44], 0
mov rax, qword [rdi + 0x98]
mov rdx, rax
sub rdx, r14
jb 0x140167300
test r14, r14
je 0x1401672c1
mov rcx, qword [rdi + 0x90]
mov rbx, rcx
sub rbx, rdx
jb 0x140167300
mov qword [rdi + 0x90], 0
cmp rax, r14
jne 0x1401672a3
cmp rcx, rdx
jne 0x1401672ba
jmp 0x1401672c1
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0xf8], rax
jmp 0x1401672d3
mov byte [rsi + 1], 1
jmp 0x1401672d7
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1401672d9
cmp rcx, rdx
je 0x14016728b
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x90], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x98], r15
mov qword [rdi + 0xf8], rax
jmp 0x1401672d3
cmp rcx, rdx
je 0x1401672c1
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x98], r14
mov qword [rdi + 0xf8], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x60]
xor edx, edx
mov r8, rbx
call fcn.140089e50
mov r12, qword [rdi + 0x70]
jmp 0x140167146
ud2