joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060ee0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x2c8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060ef0
test al, 1
je 0x140060fd6
test al, 2
jne 0x140060fd6
test al, 8
jne 0x140060f2b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.14009e880
jmp 0x140060f49
test al, 0x10
je 0x140060f49
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140060fd6
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060fd6
jne 0x140060fcb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060f91
mov rcx, rdi
call fcn.1400a3180
lea rcx, [rsi + 0x30]
call fcn.14005fce0
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140060fb0
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x2c8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x2c8
pop rdi
pop rsi
ret
ud2

Function at 0x140060fe0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060ff0
test al, 1
je 0x1400610c3
test al, 2
jne 0x1400610c3
test al, 8
jne 0x14006102a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.14009dd20
jmp 0x140061042
test al, 0x10
je 0x140061042
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x1400610c3
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1400610c3
jne 0x1400610bb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14006108a
mov rcx, rdi
call fcn.1400a3180
lea rcx, [rsi + 0x30]
call fcn.14005ddd0
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x1400610a3
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x58
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x58
pop rdi
pop rsi
ret
ud2

Function at 0x1400610d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400610e0
test al, 1
je 0x140061181
test al, 2
jne 0x140061181
test al, 8
jne 0x14006111a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.14009e960
jmp 0x140061134
test al, 0x10
je 0x140061134
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140061181
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140061181
jne 0x140061177
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.14005e920
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x140061190
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400611a0
test al, 1
je 0x140061286
test al, 2
jne 0x140061286
test al, 8
jne 0x1400611db
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.14009df00
jmp 0x1400611f9
test al, 0x10
je 0x1400611f9
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140061286
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140061286
jne 0x14006127b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140061241
mov rcx, rdi
call fcn.1400f3f00
lea rcx, [rsi + 0x30]
call fcn.14005ec40
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140061260
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x208
pop rdi
pop rsi
ret
ud2

Function at 0x140061290
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400612a0
test al, 1
je 0x140061386
test al, 2
jne 0x140061386
test al, 8
jne 0x1400612db
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 0xc
lea rdx, [rsp + 0x20]
call fcn.14009ea70
jmp 0x1400612f9
test al, 0x10
je 0x1400612f9
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140061386
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140061386
jne 0x14006137b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140061341
mov rcx, rdi
call fcn.1400f3f00
lea rcx, [rsi + 0x30]
call fcn.14005f440
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140061360
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x1d8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x140063590
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x178]
cmp rax, qword [rdx + 0x170]
ja 0x14006384b
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x168]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0x1f0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x140063702
cmp eax, 0x80090318
je 0x140063784
test eax, eax
jne 0x1400637a2
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x168]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x150], 0
add rcx, rbx
jb 0x14006384b
cmp rcx, qword [rdi + 0x170]
ja 0x14006384b
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x140], rbx
jb 0x14006382e
xor r12d, r12d
mov rcx, qword [rdi + 0x148]
add rcx, r12
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x150], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x158], 0
mov rax, qword [rdi + 0x178]
mov rdx, rax
sub rdx, r15
jb 0x14006384b
test r15, r15
je 0x1400637d0
mov rcx, qword [rdi + 0x170]
mov rbx, rcx
sub rbx, rdx
jb 0x14006384b
mov qword [rdi + 0x170], 0
cmp rax, r15
jne 0x1400637b2
cmp rcx, rdx
jne 0x1400637c9
jmp 0x1400637d0
cmp eax, 0x90317
je 0x14006379c
cmp eax, 0x90321
jne 0x1400637a2
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0x1d0], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0x1d4], 0
mov rax, qword [rdi + 0x178]
mov rdx, rax
sub rdx, r14
jb 0x14006384b
test r14, r14
je 0x140063806
mov rcx, qword [rdi + 0x170]
mov rbx, rcx
sub rbx, rdx
jb 0x14006384b
mov qword [rdi + 0x170], 0
cmp rax, r14
jne 0x1400637e8
cmp rcx, rdx
jne 0x1400637ff
jmp 0x140063806
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x210], rax
jmp 0x140063818
mov byte [rsi + 1], 1
jmp 0x14006381c
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14006381e
cmp rcx, rdx
je 0x1400637d0
mov rcx, qword [rdi + 0x168]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x170], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x178], r15
mov qword [rdi + 0x210], rax
jmp 0x140063818
cmp rcx, rdx
je 0x140063806
mov rcx, qword [rdi + 0x168]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x170], rbx
mov qword [rdi + 0x178], r14
mov qword [rdi + 0x210], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x140]
xor edx, edx
mov r8, rbx
call fcn.140110050
mov r12, qword [rdi + 0x150]
jmp 0x14006367c
ud2
Function at 0x1400648a0
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x78]
cmp rax, qword [rdx + 0x70]
ja 0x140064b04
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x68]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
lea rcx, [rdx + 0xf0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x1400649eb
cmp eax, 0x80090318
je 0x140064a55
test eax, eax
jne 0x140064a73
mov rax, qword [rsp + 0x40]
mov r14, qword [rdi + 0x68]
sub rax, r14
mov ebx, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x50], 0
add rcx, rbx
jb 0x140064b04
cmp rcx, qword [rdi + 0x70]
ja 0x140064b04
add r14, rax
xor r15d, r15d
cmp qword [rdi + 0x40], rbx
jb 0x140064aed
xor r12d, r12d
mov rcx, qword [rdi + 0x48]
add rcx, r12
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
add r12, rbx
cmp dword [rsp + 0x5c], 5
mov qword [rdi + 0x50], r12
cmove r15d, dword [rsp + 0x58]
mov qword [rdi + 0x58], 0
mov rax, qword [rdi + 0x78]
mov rdx, rax
sub rdx, r15
jb 0x140064b04
test r15, r15
je 0x140064a9b
mov rcx, qword [rdi + 0x70]
mov rbx, rcx
sub rbx, rdx
jb 0x140064b04
mov qword [rdi + 0x70], 0
cmp rax, r15
jne 0x140064a83
cmp rcx, rdx
jne 0x140064a97
jmp 0x140064a9b
cmp eax, 0x90317
je 0x140064a6d
cmp eax, 0x90321
jne 0x140064a73
xor r14d, r14d
cmp dword [rsp + 0x5c], 5
mov dword [rdi + 0xd0], 0x10000
cmove r14d, dword [rsp + 0x58]
mov byte [rdi + 0xd4], 0
mov rax, qword [rdi + 0x78]
mov rdx, rax
sub rdx, r14
jb 0x140064b04
test r14, r14
je 0x140064ac8
mov rcx, qword [rdi + 0x70]
mov rbx, rcx
sub rbx, rdx
jb 0x140064b04
mov qword [rdi + 0x70], 0
cmp rax, r14
jne 0x140064ab0
cmp rcx, rdx
jne 0x140064ac4
jmp 0x140064ac8
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
mov qword [rdi + 0x110], rax
jmp 0x140064ad7
mov byte [rsi + 1], 1
jmp 0x140064adb
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x140064add
cmp rcx, rdx
je 0x140064a9b
mov rcx, qword [rdi + 0x68]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x70], rbx
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x78], r15
mov qword [rdi + 0x110], rax
jmp 0x140064ad7
cmp rcx, rdx
je 0x140064ac8
mov rcx, qword [rdi + 0x68]
add rdx, rcx
mov r8, rbx
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x70], rbx
mov qword [rdi + 0x78], r14
mov qword [rdi + 0x110], 0
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x40]
xor edx, edx
mov r8, rbx
call fcn.140110050
mov r12, qword [rdi + 0x50]
jmp 0x140064977
ud2
Function at 0x1400692e0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0xb
mov rdx, rax
call fcn.14009a6b0
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
movzx eax, byte [0x140206138]
mov rcx, qword [0x140206128]
test rcx, rcx
jne 0x140069347
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14006947f
mov rcx, rax
mov qword [0x140206128], rax
mov r8d, 0x800
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14006947f
mov rbx, rax
mov qword [rsp + 0x38], 0x800
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov r14, qword [rsp + 0x58]
lea rbp, [rsp + 0x30]
lea r15, [rsp + 0x34]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x48]
sub r12, r13
nop word cs:[rax + rax]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400693e0
mov r8d, dword [rsp + 0x30]
cmp r12, r8
jae 0x1400693a0
lea rcx, [rsp + 0x38]
mov rdx, r13
call fcn.140110050
mov rbx, qword [rsp + 0x40]
jmp 0x140069386
test eax, eax
jne 0x140069402
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x140069461
movabs rax, 0xde00000002
jmp 0x14006940a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0x38], 0
je 0x140069434
mov rcx, qword [0x140206128]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x50], 0
je 0x14006944f
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x140206128]
xor edx, edx
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x50], 0
jne 0x14006943c
jmp 0x14006944f
ud2
Function at 0x14008dc80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x80
mov ecx, dword [0x140195120]
test ecx, ecx
je 0x14008ddea
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x14008dcb1
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x14008de1c
mov ecx, dword [0x140195120]
test ecx, ecx
je 0x14008de22
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x14008de3f
mov rsi, rax
test rax, rax
jne 0x14008dd46
movzx eax, byte [0x140206138]
mov rcx, qword [0x140206128]
test rcx, rcx
jne 0x14008dd03
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14008de60
mov rcx, rax
mov qword [0x140206128], rax
mov r8d, 0x60
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14008de60
mov rsi, rax
lea rax, [0x140195108]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140195120]
test ecx, ecx
je 0x14008de4d
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsi + 0x48]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmm3, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 8], 1
movups xmm0, xmmword [0x1401ceb40]
movups xmmword [rsi + 0x50], xmm0
movups xmm0, xmmword [0x1401ceb30]
movups xmmword [rsi + 0x40], xmm0
movups xmm0, xmmword [0x1401ceb20]
movups xmmword [rsi + 0x30], xmm0
movups xmm0, xmmword [0x1401ceb10]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [0x1401ceb00]
movups xmmword [rsi + 0x10], xmm0
cmp qword [rsp + 0x20], 0
je 0x14008de1c
mov rax, qword [rsp + 0x30]
cmp rax, 2
je 0x14008de1c
lea rcx, [rsp + 0x38]
test rax, rax
je 0x14008de0c
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14008de1c
call fcn.1400a3180
jmp 0x14008de1c
lea rcx, [0x140195108]
call fcn.1400df3b0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x14008dca3
jmp 0x14008dcb1
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14008de1c
call fcn.1400f3f00
add rsi, 0x10
jmp 0x14008de41
lea rcx, [0x140195108]
call fcn.1400df3b0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x14008dcd0
xor esi, esi
mov rax, rsi
add rsp, 0x80
pop rsi
ret
lea rcx, [0x140195108]
call fcn.1400df3b0
mov ecx, eax
jmp 0x14008dd3e
ud2
Function at 0x140092ca0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140092ce2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140092cea
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140092cfb
jmp 0x140092d12
xor r10d, r10d
jmp 0x140092d9d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140092d12
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140092d29
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140092d49
add r11, r8
jmp 0x140092e7a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140092e12
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140092dc0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140092e30
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140092e42
jmp 0x140092e5c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140092e5c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140092e76
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400932e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140093376
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x140199d40]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140199d50]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140092ca0
test rdi, rdi
je 0x140093405
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14009341e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140093516
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140093598
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140093523
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400933e0
cmp r9, 8
jae 0x14009352c
jmp 0x140093598
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140092ca0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140093598
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140093598
mov r8, rcx
cmp r9, 8
jb 0x140093598
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140093530
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14009b830
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
je 0x14009b86d
movabs rdi, 0x8000000000000000
jmp 0x14009b8d5
mov rbx, qword [rsp + 0x28]
mov r14, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x14009b8b9
movzx eax, byte [0x140206138]
mov rcx, qword [0x140206128]
test rcx, rcx
jne 0x14009b8a5
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14009b8b7
mov rcx, rax
mov qword [0x140206128], rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
mov r15, rax
test rax, rax
jne 0x14009b8bf
ud2
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call sub.crypt32.dll_CertFreeCertificateContext
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rdi
mov qword [rsi], rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400d9d60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x140195038]
test ecx, ecx
je 0x1400d9e26
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400d9d8d
mov rsi, rax
cmp byte [rax + 8], 0
jne 0x1400d9e20
mov ecx, dword [0x140195038]
test ecx, ecx
je 0x1400d9e48
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400d9e65
mov rsi, rax
test rax, rax
jne 0x1400d9e1a
movzx eax, byte [0x140206138]
mov rcx, qword [0x140206128]
test rcx, rcx
jne 0x1400d9ddf
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400d9e80
mov rcx, rax
mov qword [0x140206128], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400d9e80
mov rsi, rax
lea rax, [0x140195020]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x140195038]
test ecx, ecx
je 0x1400d9e70
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
jmp 0x1400d9e67
lea rcx, [0x140195020]
call fcn.1400df3b0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x1400d9d80
jmp 0x1400d9d8d
lea rcx, [0x140195020]
call fcn.1400df3b0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x1400d9dac
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140195020]
call fcn.1400df3b0
mov ecx, eax
jmp 0x1400d9e12
ud2

Function at 0x1400daf10
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1400daf3e
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1400e5fc0
ud2