joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402e3800
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x78
call fcn.14022aff0
sub rsp, rax
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx edi, byte [rcx]
mov rbp, r9
mov r10, qword [rsp + 0xe0]
mov r13, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov rax, qword [rcx + 0x28]
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x48], rax
test dil, 0x40
jne 0x1402e3878
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r12d, reloc.WS2_32.dll_ntohs
xor esi, esi
mov r8d, edi
mov eax, r12d
and r8d, 7
mov ecx, esi
sub eax, r8d
mov dword [rsp + 0x40], r8d
mov byte [rbx], r8b
cmp eax, r12d
jae 0x1402e38b8
mov edx, eax
add rdx, rbx
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x1402e38a1
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rbp
je 0x1402e38d2
mov eax, 0xffffffff
jmp 0x1402e39fd
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x1402e3953
lea rax, [rbx + 0x10]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r14, rdi
add r15, rdi
sub rbp, rdi
je 0x1402e39a9
shr rdi, 4
lea r8, [rbx + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rsi
sub r9, rbx
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
add rdx, rax
movzx ecx, dil
add rdx, rcx
shr rdi, 8
mov byte [r8], dl
lea rax, [r8 + r9]
shr rdx, 8
test rax, rax
je 0x1402e3958
test rdi, rdi
jne 0x1402e3920
test rdx, rdx
jne 0x1402e3920
jmp 0x1402e3958
test r13, r13
je 0x1402e39a9
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r13
test rbp, rbp
je 0x1402e399a
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rcx + r14]
inc esi
xor al, byte [rsp + rcx + 0x50]
mov byte [rcx + r15], al
xor byte [rcx + rbx + 0x10], al
mov ecx, esi
cmp rcx, rbp
jb 0x1402e3980
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r13
jmp 0x1402e39b3
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
sub r12d, dword [rsp + 0x40]
cmp r12d, 0x10
jae 0x1402e39d4
mov r8d, reloc.WS2_32.dll_recv
mov ecx, r12d
sub r8d, r12d
add rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call r13
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x58]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14022a640
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402e58c0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1402e5a29
mov eax, 8
call fcn.14022aff0
sub rsp, rax
xor r10d, r10d
mov r11, rcx
cmp r8, rax
jb 0x1402e59fd
lea rcx, [r9 - 1]
lea rax, [rdx - 1]
add rcx, r8
add rax, r8
cmp r9, rax
ja 0x1402e5901
cmp rcx, rdx
jae 0x1402e59fd
lea rax, [r8 - 1]
add rax, r11
cmp r9, rax
ja 0x1402e5916
cmp rcx, r11
jae 0x1402e59fd
mov rcx, r11
mov qword [rsp + 0x10], rbx
sub rcx, rdx
mov qword [rsp], rdi
cmp r8, 0x40
jb 0x1402e59b7
mov rdi, r8
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r8
sub rsi, rdi
mov rbx, r9
lea rax, [rdx + 0x10]
sub rbx, rdx
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rcx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rcx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r10, rsi
jb 0x1402e5950
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x1402e59ef
mov rbx, r8
and rbx, 0xfffffffffffffff8
mov rdi, r9
lea rax, [r10 + rdx]
sub rdi, rdx
nop dword [rax + rax]
movq xmm1, qword [rcx + rax]
add r10, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r10, rbx
jb 0x1402e59d0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r10, r8
jae 0x1402e5a25
sub r11, rdx
lea rax, [r10 + rdx]
sub r9, rdx
sub r8, r10
nop word [rax + rax]
movzx ecx, byte [rax + r11]
xor cl, byte [rax]
mov byte [rax + r9], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1402e5a10
add rsp, 8
ret
Function at 0x1402e5b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov eax, 0x20
call fcn.14022aff0
sub rsp, rax
mov rdi, qword [rcx + 0x28]
mov rbx, rdx
mov rbp, rcx
cmp rdx, rdi
ja 0x1402e5b4e
shl rbx, 4
add rbx, qword [rcx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rbx, rcx
jb 0x1402e5b9a
sub rdx, rcx
lea r8, str.cryptomodesocb128.c
add rdx, 4
mov r9d, WSAStartup
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.14022c7d0
test rax, rax
jne 0x1402e5b96
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, rbx
mov qword [rsp + 0x50], r15
mov r15, rdi
shl r15, 4
sub r12, rdi
nop word [rax + rax]
mov rcx, qword [rbp + 0x58]
mov edx, 1
add rcx, r15
movzx edi, byte [rcx]
lea rsi, [rcx + 0x10]
shr dil, 7
mov r8, rsi
neg dil
and dil, 0x87
call fcn.1402e5710
xor byte [rsi + 0xf], dil
add r15, 0x10
sub r12, 1
jne 0x1402e5bc0
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbp + 0x28], rbx
shl rbx, 4
add rbx, qword [rbp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1402ec9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.14022aff0
sub rsp, rax
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0xd0]
mov r13, r9
mov rax, qword [rsp + 0xc0]
mov rdi, rcx
mov rcx, qword [rsp + 0xc8]
mov esi, r8d
mov r12, qword [rsp + 0xd8]
mov r15, rdx
movzx r8d, byte [r14 + 3]
xor ebp, ebp
movzx edx, byte [r14 + 7]
movzx r9d, byte [r14]
movzx r10d, byte [r14 + 4]
mov ebx, dword [r12]
mov qword [rsp + 0x28], rax
movzx eax, byte [r14 + 1]
shl eax, 8
or r9d, eax
mov qword [rsp + 0x30], rcx
movzx eax, byte [r14 + 2]
mov ecx, edx
shl eax, 0x10
or r9d, eax
shl ecx, 8
mov eax, r8d
mov qword [rsp + 0x38], r14
shl eax, 0x18
or r9d, eax
mov qword [rsp + 0x40], r12
movzx eax, byte [r14 + 5]
shl eax, 8
or r10d, eax
mov dword [rsp + 0x20], r9d
movzx eax, byte [r14 + 6]
or ecx, eax
mov byte [rsp + 0x48], r9b
mov eax, ecx
mov byte [rsp + 0x4b], r8b
shl eax, 0x10
or r10d, eax
mov byte [rsp + 0x4e], cl
mov eax, r9d
mov dword [rsp + 0x24], r10d
shr eax, 8
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x4c], r10b
mov byte [rsp + 0x4d], al
mov byte [rsp + 0x4f], dl
test esi, esi
je 0x1402ecbcd
mov r12, qword [rsp + 0x28]
sub r15, rdi
mov r14, qword [rsp + 0x30]
dec esi
test ebx, ebx
jne 0x1402ecb62
mov r9, r14
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, r13
call fcn.1402cec40
mov r9d, dword [rsp + 0x20]
mov eax, r9d
mov r10d, dword [rsp + 0x24]
shr eax, 8
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x4b], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x4d], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x4e], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x4f], al
inc ebp
mov byte [rsp + 0x48], r9b
mov byte [rsp + 0x4c], r10b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x48]
xor cl, byte [rdi]
mov byte [r15 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x1402ecaf7
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
test ebp, ebp
je 0x1402ecbcd
mov eax, r9d
mov byte [r14], r9b
shr eax, 8
mov byte [r14 + 1], al
mov eax, r9d
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, r10d
shr eax, 8
mov byte [r14 + 5], al
mov eax, r10d
shr eax, 0x10
shr r9d, 0x18
mov byte [r14 + 4], r10b
shr r10d, 0x18
mov byte [r14 + 7], r10b
mov byte [r14 + 3], r9b
mov byte [r14 + 6], al
mov dword [r12], ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14022a640
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402ee0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.14022aff0
sub rsp, rax
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, qword [rsp + 0xb0]
mov r12, rdx
mov r13, qword [rsp + 0xb8]
mov rsi, rcx
mov qword [rsp + 0x28], r9
mov ebp, r8d
xor r14d, r14d
mov qword [rsp + 0x30], r13
movzx r10d, byte [r15]
movzx eax, byte [r15 + 1]
mov r9d, r10d
movzx r8d, byte [r15 + 4]
movzx ecx, byte [r15 + 6]
mov edx, r8d
mov ebx, dword [r13]
shl r9d, 8
or r9d, eax
shl edx, 8
movzx eax, byte [r15 + 2]
mov r11d, r9d
shl eax, 8
shl r11d, 0x10
or r11d, eax
shl ecx, 8
movzx eax, byte [r15 + 3]
or r11d, eax
mov byte [rsp + 0x38], r10b
movzx eax, byte [r15 + 5]
or edx, eax
mov dword [rsp + 0x20], r11d
movzx eax, byte [r15 + 7]
mov edi, edx
or ecx, eax
shl edi, 0x10
or edi, ecx
mov byte [rsp + 0x39], r9b
mov eax, r11d
mov dword [rsp + 0x24], edi
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3b], r11b
mov byte [rsp + 0x3c], r8b
mov byte [rsp + 0x3d], dl
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], dil
test ebp, ebp
je 0x1402ee29b
mov r13, qword [rsp + 0x28]
sub r12, rsi
movzx r8d, dil
movzx edx, r11b
nop dword [rax]
dec ebp
test ebx, ebx
jne 0x1402ee237
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.1402eda10
mov r11d, dword [rsp + 0x20]
mov eax, r11d
mov edi, dword [rsp + 0x24]
mov edx, r11d
shr eax, 0x18
mov r8d, edi
mov byte [rsp + 0x38], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x39], al
mov eax, r11d
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 0x18
mov byte [rsp + 0x3c], al
mov eax, edi
shr eax, 0x10
mov byte [rsp + 0x3d], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3e], al
inc r14d
mov byte [rsp + 0x3b], dl
mov byte [rsp + 0x3f], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x38]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x1402ee1d0
mov r13, qword [rsp + 0x30]
test r14d, r14d
je 0x1402ee29b
mov eax, r11d
mov byte [r15 + 3], dl
shr eax, 0x18
mov byte [r15], al
mov eax, r11d
shr eax, 0x10
mov byte [r15 + 1], al
mov eax, edi
shr eax, 0x18
mov byte [r15 + 4], al
mov eax, edi
shr eax, 0x10
shr r11d, 8
shr edi, 8
mov byte [r15 + 6], dil
mov byte [r15 + 2], r11b
mov byte [r15 + 5], al
mov byte [r15 + 7], r8b
mov dword [r13], ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14022a640
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402f0b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.14022aff0
sub rsp, rax
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, qword [rsp + 0xb0]
mov r12, rdx
mov r13, qword [rsp + 0xb8]
mov rsi, rcx
mov qword [rsp + 0x28], r9
mov ebp, r8d
xor r14d, r14d
mov qword [rsp + 0x30], r13
movzx r10d, byte [r15]
movzx eax, byte [r15 + 1]
mov r9d, r10d
movzx r8d, byte [r15 + 4]
movzx ecx, byte [r15 + 6]
mov edx, r8d
mov ebx, dword [r13]
shl r9d, 8
or r9d, eax
shl edx, 8
movzx eax, byte [r15 + 2]
mov r11d, r9d
shl eax, 8
shl r11d, 0x10
or r11d, eax
shl ecx, 8
movzx eax, byte [r15 + 3]
or r11d, eax
mov byte [rsp + 0x38], r10b
movzx eax, byte [r15 + 5]
or edx, eax
mov dword [rsp + 0x20], r11d
movzx eax, byte [r15 + 7]
mov edi, edx
or ecx, eax
shl edi, 0x10
or edi, ecx
mov byte [rsp + 0x39], r9b
mov eax, r11d
mov dword [rsp + 0x24], edi
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3b], r11b
mov byte [rsp + 0x3c], r8b
mov byte [rsp + 0x3d], dl
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], dil
test ebp, ebp
je 0x1402f0d4b
mov r13, qword [rsp + 0x28]
sub r12, rsi
movzx r8d, dil
movzx edx, r11b
nop dword [rax]
dec ebp
test ebx, ebx
jne 0x1402f0ce7
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.1402f0490
mov r11d, dword [rsp + 0x20]
mov eax, r11d
mov edi, dword [rsp + 0x24]
mov edx, r11d
shr eax, 0x18
mov r8d, edi
mov byte [rsp + 0x38], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x39], al
mov eax, r11d
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 0x18
mov byte [rsp + 0x3c], al
mov eax, edi
shr eax, 0x10
mov byte [rsp + 0x3d], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3e], al
inc r14d
mov byte [rsp + 0x3b], dl
mov byte [rsp + 0x3f], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x38]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x1402f0c80
mov r13, qword [rsp + 0x30]
test r14d, r14d
je 0x1402f0d4b
mov eax, r11d
mov byte [r15 + 3], dl
shr eax, 0x18
mov byte [r15], al
mov eax, r11d
shr eax, 0x10
mov byte [r15 + 1], al
mov eax, edi
shr eax, 0x18
mov byte [r15 + 4], al
mov eax, edi
shr eax, 0x10
shr r11d, 8
shr edi, 8
mov byte [r15 + 6], dil
mov byte [r15 + 2], r11b
mov byte [r15 + 5], al
mov byte [r15 + 7], r8b
mov dword [r13], ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14022a640
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402f2e80
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, gethostbyname
call fcn.14022aff0
sub rsp, rax
movsxd rbx, ecx
mov edi, r8d
mov dword [rsp + 0x40], 1
mov rbp, rdx
cmp ebx, 0xffffffff
jne 0x1402f2eeb
call fcn.1402723d0
lea r8, str.BIO_connect
lea edx, [rbx + 0x55]
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1402724f0
xor r8d, r8d
lea ecx, [rbx + 0x21]
mov edx, 0x87
call fcn.1402725f0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov edx, edi
mov qword [rsp + 0x48], rsi
shr edx, 3
mov ecx, ebx
and edx, 1
call fcn.14029ab30
test eax, eax
je 0x1402f2f9e
mov rsi, rbx
test dil, 4
je 0x1402f2fb5
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1402f2fb5
call fcn.1402723d0
lea r8, str.BIO_connect
mov edx, 0x5e
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1402724f0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov ecx, 2
mov edx, eax
call fcn.1402725f0
call fcn.1402723d0
lea r8, str.BIO_connect
mov edx, 0x60
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1402724f0
xor r8d, r8d
mov edx, 0x89
mov ecx, 0x20
call fcn.1402725f0
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test dil, 0x10
je 0x1402f3042
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
mov rcx, rsi
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1402f3042
call fcn.1402723d0
lea r8, str.BIO_connect
mov edx, 0x68
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1402724f0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov ecx, 2
mov edx, eax
call fcn.1402725f0
call fcn.1402723d0
lea r8, str.BIO_connect
mov edx, 0x6a
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1402724f0
xor r8d, r8d
mov edx, 0x8a
jmp 0x1402f2f94
mov rcx, rbp
call fcn.140295480
mov rcx, rbp
mov ebx, eax
call fcn.140156580
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1402f30d6
mov ecx, eax
call fcn.140270c20
test eax, eax
jne 0x1402f2f9e
call fcn.1402723d0
lea r8, str.BIO_connect
mov edx, WSAStartup
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1402724f0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_connect__
mov ecx, 2
mov edx, eax
call fcn.1402725f0
call fcn.1402723d0
lea r8, str.BIO_connect
mov edx, reloc.WS2_32.dll_WSACleanup
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1402724f0
xor r8d, r8d
lea edx, [r8 + 0x67]
jmp 0x1402f2f94
mov eax, 1
jmp 0x1402f2fa0
Function at 0x1402f4720
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.14022aff0
sub rsp, rax
cmp dword [0x1404c5200], 0
jne 0x1402f48a0
mov qword [rsp + 0x40], rsi
lea r8d, [rax + 8]
mov qword [rsp + 0x48], rdi
lea rcx, str.OPENSSL_ia32cap
mov qword [rsp + 0x30], rbx
lea rdi, [0x1404c51a0]
mov rdx, rdi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], r14
mov dword [0x1404c5200], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x1402f4862
movzx ebx, word [0x1404c51a0]
xor ebp, ebp
cmp bx, 0x7e
mov ecx, ebp
mov r14d, 2
cmove ecx, r14d
add rcx, rdi
call fcn.1402f48b0
mov rsi, rax
cmp bx, 0x7e
jne 0x1402f47e1
lea rcx, [0x1404c6b50]
mov rbx, rax
call fcn.140001030
not rsi
movabs rcx, 0xedfff7fdffffffff
and rax, rsi
and ebx, 0x1000000
mov rsi, rax
and rsi, rcx
test rbx, rbx
cmove rsi, rax
jmp 0x1402f47fa
cmp word [0x1404c51a0], 0x3a
jne 0x1402f47fa
lea rcx, [0x1404c6b50]
call fcn.140001030
mov rsi, rax
movzx eax, word [0x1404c51a0]
test ax, ax
je 0x1402f4818
lea rdi, [rdi + 2]
cmp ax, 0x3a
je 0x1402f4821
movzx eax, word [rdi]
test ax, ax
jne 0x1402f4806
mov qword [0x1404c6b58], rbp
jmp 0x1402f4871
movzx ebx, word [rdi]
cmp bx, 0x7e
cmove rbp, r14
lea rcx, [rdi + rbp]
call fcn.1402f48b0
mov rcx, rax
shr rcx, 0x20
cmp bx, 0x7e
jne 0x1402f4854
not eax
not ecx
and dword [0x1404c6b58], eax
and dword [0x1404c6b5c], ecx
jmp 0x1402f4871
mov dword [0x1404c6b58], eax
mov dword [0x1404c6b5c], ecx
jmp 0x1402f4871
lea rcx, [0x1404c6b50]
call fcn.140001030
mov rsi, rax
mov r14, qword [rsp + 0x20]
mov eax, esi
mov rdi, qword [rsp + 0x48]
bts eax, 0xa
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
shr rsi, 0x20
mov dword [0x1404c6b54], esi
mov rsi, qword [rsp + 0x40]
mov dword [0x1404c6b50], eax
add rsp, 0x28
ret
Function at 0x14030efd0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x28
call fcn.14022aff0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x50], r9d
jne 0x14030f0c8
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x14030f0c8
mov qword [rsp + 0x20], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x14030f080
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x14030f02a
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x14030f02a
cmp cl, 0xbb
jne 0x14030f06d
inc eax
cmp eax, ebx
jl 0x14030f014
sub ebx, eax
test eax, eax
jne 0x14030f084
call fcn.1402723d0
lea r8, str.RSA_padding_check_X931
mov edx, 0x56
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1402724f0
mov edx, 0x8a
xor r8d, r8d
lea ecx, [r8 + 4]
call fcn.1402725f0
mov rbx, qword [rsp + 0x20]
mov eax, 0xffffffff
add rsp, 0x28
ret
call fcn.1402723d0
lea r8, str.RSA_padding_check_X931
mov edx, 0x4e
jmp 0x14030f041
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x14030f0b1
call fcn.1402723d0
lea r8, str.RSA_padding_check_X931
mov edx, 0x5f
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1402724f0
mov edx, 0x8b
jmp 0x14030f052
mov r8d, ebx
mov rcx, r11
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.1402723d0
lea r8, str.RSA_padding_check_X931
mov edx, 0x43
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1402724f0
xor r8d, r8d
mov edx, 0x89
lea ecx, [r8 + 4]
call fcn.1402725f0
mov eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x140329b30
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1a0
call fcn.14022aff0
sub rsp, rax
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, r8
mov rsi, rdx
mov r8, r9
lea rdx, str.SHA512
call fcn.140236820
mov rdi, rax
test rax, rax
je 0x140329bb3
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r9 + 0x20]
call fcn.1402357a0
mov rcx, rdi
mov ebx, eax
call fcn.140236870
test ebx, ebx
jne 0x140329bba
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x150]
call fcn.140001240
xor eax, eax
jmp 0x140329c6e
movzx eax, byte [rsp + 0x16f]
lea rdx, [rsp + 0x150]
and byte [rsp + 0x150], 0xf8
lea rcx, [rsp + 0xb0]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x16f], al
call fcn.140328e50
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x30]
call fcn.1403257e0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.140325a60
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.140325a60
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140327100
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x80]
call fcn.140327100
movzx eax, byte [rsp + 0x30]
lea rcx, [rsp + 0x150]
shl al, 7
mov edx, 0x40
xor byte [rsi + 0x1f], al
call fcn.140001240
mov eax, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14022a640
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140329c90
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1a8
call fcn.14022aff0
sub rsp, rax
mov rax, qword [0x1404bf700]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r12, qword [rsp + 0x210]
mov r15, r8
mov r8, qword [rsp + 0x220]
mov r14, rdx
mov rsi, rcx
lea rdx, str.SHA512
mov rcx, qword [rsp + 0x218]
mov r13, r9
call fcn.140236820
mov rdi, rax
call fcn.140236760
xor ebp, ebp
mov rbx, rax
test rdi, rdi
je 0x140329e9b
test rax, rax
je 0x140329e9b
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140235d90
test eax, eax
je 0x140329e9b
lea r8d, [rbp + 0x20]
mov rdx, r12
mov rcx, rbx
call fcn.140235dd0
test eax, eax
je 0x140329e9b
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0xd0]
call fcn.140235c00
test eax, eax
je 0x140329e9b
movzx eax, byte [rsp + 0xef]
xor r8d, r8d
and byte [rsp + 0xd0], 0xf8
and al, 0x3f
or al, 0x40
mov rdx, rdi
mov rcx, rbx
mov byte [rsp + 0xef], al
call fcn.140235d90
test eax, eax
je 0x140329e9b
lea r8d, [rbp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0xf0]
call fcn.140235dd0
test eax, eax
je 0x140329e9b
mov r8, r15
mov rdx, r14
mov rcx, rbx
call fcn.140235dd0
test eax, eax
je 0x140329e9b
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x110]
call fcn.140235c00
test eax, eax
je 0x140329e9b
lea rcx, [rsp + 0x110]
call fcn.14032c400
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
call fcn.140328e50
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140328dc0
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.140235d90
test eax, eax
je 0x140329e9b
lea r8d, [rbp + 0x20]
mov rdx, rsi
mov rcx, rbx
call fcn.140235dd0
test eax, eax
je 0x140329e9b
lea r8d, [rbp + 0x20]
mov rdx, r13
mov rcx, rbx
call fcn.140235dd0
test eax, eax
je 0x140329e9b
mov r8, r15
mov rdx, r14
mov rcx, rbx
call fcn.140235dd0
test eax, eax
je 0x140329e9b
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x150]
call fcn.140235c00
test eax, eax
je 0x140329e9b
lea rcx, [rsp + 0x150]
call fcn.14032c400
lea rcx, [rsi + 0x20]
lea r9, [rsp + 0x110]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x150]
call fcn.14032a380
mov ebp, 1
mov edx, 0x40
lea rcx, [rsp + 0x110]
call fcn.140001240
mov edx, 0x40
lea rcx, [rsp + 0xd0]
call fcn.140001240
mov rcx, rdi
call fcn.140236870
mov rcx, rbx
call fcn.1402366b0
mov eax, ebp
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14022a640
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret