joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140249860
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.1404a6760
sub rsp, rax
cmp dword [0x140652390], 0
jne 0x14024991d
xor edx, edx
mov dword [0x140652390], 1
mov r8d, 0x198
lea rcx, [0x1406523a0]
call fcn.1404dea80
mov ecx, 0x202
lea rdx, [0x1406523a0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14024991d
call fcn.14021e530
lea r8, str.BIO_sock_init
mov edx, reloc.OLEAUT32.dll_DllRegisterServer
lea rcx, str.crypto_bio_bio_sock.c
call fcn.14021e650
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov ecx, 2
mov edx, eax
call fcn.14021e7b0
call fcn.14021e530
lea r8, str.BIO_sock_init
mov edx, 0x98
lea rcx, str.crypto_bio_bio_sock.c
call fcn.14021e650
xor r8d, r8d
mov edx, 0x7a
mov ecx, 0x20
call fcn.14021e7b0
mov eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret

Function at 0x140249930
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, 0x20
call fcn.1404a6760
sub rsp, rax
mov dword [rsp + 0x30], edx
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x140249992
call fcn.14021e530
lea r8, str.BIO_socket_ioctl
mov edx, 0xf4
lea rcx, str.crypto_bio_bio_sock.c
call fcn.14021e650
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov ecx, 2
mov edx, eax
call fcn.14021e7b0
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x1402499a0
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x260
call fcn.1404a6760
sub rsp, rax
mov rax, qword [0x14064a080]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, ecx
mov rbx, r8
mov esi, edx
cmp ecx, 0xffffffff
jne 0x1402499d3
mov eax, ecx
jmp 0x140249a35
test rbx, rbx
jne 0x1402499df
mov eax, 1
jmp 0x140249a35
xor ecx, ecx
call fcn.1404be7b0
mov rcx, rax
cmp rbx, rax
jge 0x1402499f2
xor eax, eax
jmp 0x140249a35
xor eax, eax
mov qword [rsp + 0x48], rdi
sub ebx, ecx
mov dword [rsp + 0x34], eax
test esi, esi
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
cmovne r8, rax
lea rdx, [rsp + 0x40]
cmove rdx, rax
lea ecx, [rdi + 1]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1404a5b80
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x14024a760
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.1404a6760
sub rsp, rax
mov rax, qword [0x14064a080]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x140652540], 0
lea rax, [0x14024a0d0]
mov qword [rsp + 0x28], rax
lea rbx, [0x140512710]
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x14024a510]
mov qword [rsp + 0x38], rax
lea rax, [0x140512730]
mov qword [rsp + 0x40], rax
lea rax, [0x14024a070]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x14024a939
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14024a92f
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1404be4bc
lea r8, [0x140512740]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1404c0220
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14024a85a
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14024a8ba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1404be4bc
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1404c0220
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14024a927
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14024a8ba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14024a927
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x14024a916
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x14024a8d0
mov rax, qword [rsp + 0x28]
mov qword [0x1406427c8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1406427d8], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1406427e8], rax
jmp 0x14024a91f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x140652540], 1
mov rax, rbp
lea rcx, [0x1406427c0]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1404a5b80
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x14024a970
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x870
call fcn.1404a6760
sub rsp, rax
mov rax, qword [0x14064a080]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r13, qword [rsp + 0x8c8]
mov r14, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x400
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], bpl
mov r12d, ebp
mov word [rsp + 0x20], r9w
call fcn.1404dea80
xor edx, edx
mov byte [rsp + 0x450], bpl
mov r8d, 0x400
lea rcx, [rsp + 0x451]
call fcn.1404dea80
lea rbx, [rsp + 0x40]
mov r9d, 0x400
mov r8, r14
mov qword [rsp + 0x30], rbx
mov edx, 0x401
lea rcx, [rsp + 0x40]
lea rdi, [rsp + 0x450]
call fcn.1404c028c
mov r15, 0xffffffffffffffff
mov rcx, r14
mov qword [r13], rbp
mov rsi, r13
mov byte [rdi], bpl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x14024ab7e
cmp word [rax + 0x10], 2
jne 0x14024aaa7
cmp word [rax + 0x12], 4
jne 0x14024aaa7
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x14024aaa2
nop dword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.14024abe0
mov qword [rsi], rax
test rax, rax
je 0x14024ab77
add rbx, 8
lea rsi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x14024aa70
mov rbx, qword [rsp + 0x30]
mov r8, qword [r14]
mov r9d, 0x400
mov edx, 0x401
mov rcx, rdi
call fcn.1404c028c
cmp qword [r13], rbp
jne 0x14024ab21
mov rax, r15
inc rax
cmp byte [rdi + rax], bpl
jne 0x14024aac6
test rax, rax
je 0x14024ab98
mov r8, rdi
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14024aaf4
inc rax
test ecx, ecx
jne 0x14024aae1
test edx, edx
je 0x14024ab98
inc r12d
cmp r12d, 0x10
je 0x14024ab98
mov r14, qword [rsp + 0x38]
mov rax, rbx
mov rbx, rdi
mov rdi, rax
mov qword [rsp + 0x30], rbx
jmp 0x14024aa30
cmp dword [rsp + 0x8c0], ebp
je 0x14024abab
nop
cmp byte [rdi + r15 + 1], bpl
lea r15, [r15 + 1]
jne 0x14024ab30
lea rdx, [r15 + 1]
mov ecx, 1
call fcn.1404bbc14
mov rbx, rax
test rax, rax
jne 0x14024ab56
mov rbx, rbp
jmp 0x14024ab65
mov r8, rdi
lea rdx, [r15 + 1]
mov rcx, rax
call fcn.1404be4bc
mov rax, qword [r13]
mov qword [rax + 0x18], rbx
mov rax, qword [r13]
cmp qword [rax + 0x18], rbp
jne 0x14024abab
mov ebp, 8
jmp 0x14024abab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x14024aba6
sub ecx, 1
je 0x14024ab9f
sub ecx, 1
jne 0x14024aba6
mov ebp, 0x2afb
jmp 0x14024abab
mov ebp, 0x2afa
jmp 0x14024abab
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1404a5b80
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140257b70
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x140257bdc
movzx ecx, byte [rcx]
test cl, cl
je 0x140257bdc
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140257b90
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140257ca0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x140257d10
movzx ecx, byte [rcx]
test cl, cl
je 0x140257d10
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
mov r8d, eax
and r9d, 0xffffffdf
or r9d, r11d
mov ecx, 0x20
mov edx, r9d
add r11d, 0x100
shr edx, 2
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140257cc0
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140258e70
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.1404a6760
sub rsp, rax
cmp dword [0x140652620], 0
jne 0x140258ff1
mov qword [rsp + 0x30], rbx
lea rcx, [0x140513390]
mov qword [rsp + 0x40], rsi
lea rbx, [0x1406525c0]
mov qword [rsp + 0x38], rbp
mov rdx, rbx
mov qword [rsp + 0x48], rdi
mov r8d, gethostbyaddr
mov qword [rsp + 0x20], r14
mov dword [0x140652620], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x140258fb3
movzx edi, word [rbx]
xor ebp, ebp
cmp di, 0x7e
mov ecx, ebp
mov r14d, 2
cmove ecx, r14d
add rcx, rbx
call fcn.140259000
mov rsi, rax
cmp di, 0x7e
jne 0x140258f2f
lea rcx, [0x140656cf0]
mov rdi, rax
call fcn.140001030
not rsi
movabs rcx, 0xedfff7fdffffffff
and rax, rsi
and edi, 0x1000000
mov rsi, rax
and rsi, rcx
test rdi, rdi
cmove rsi, rax
jmp 0x140258f44
cmp word [rbx], 0x3a
jne 0x140258f44
lea rcx, [0x140656cf0]
call fcn.140001030
mov rsi, rax
movzx eax, word [rbx]
test ax, ax
je 0x140258f61
nop dword [rax]
cmp ax, 0x3a
je 0x140258f6a
add rbx, r14
movzx eax, word [rbx]
test ax, ax
jne 0x140258f50
mov qword [0x140656cf8], rbp
jmp 0x140258fc2
test rbx, rbx
je 0x140258f61
add rbx, r14
movzx edi, word [rbx]
cmp di, 0x7e
cmove rbp, r14
lea rcx, [rbx + rbp]
call fcn.140259000
mov rcx, rax
shr rcx, 0x20
cmp di, 0x7e
jne 0x140258fa5
not eax
not ecx
and dword [0x140656cf8], eax
and dword [0x140656cfc], ecx
jmp 0x140258fc2
mov dword [0x140656cf8], eax
mov dword [0x140656cfc], ecx
jmp 0x140258fc2
lea rcx, [0x140656cf0]
call fcn.140001030
mov rsi, rax
mov r14, qword [rsp + 0x20]
mov eax, esi
mov rdi, qword [rsp + 0x48]
bts eax, 0xa
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
shr rsi, 0x20
mov dword [0x140656cf4], esi
mov rsi, qword [rsp + 0x40]
mov dword [0x140656cf0], eax
add rsp, 0x28
ret
Function at 0x14025dcb0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1404a6760
sub rsp, rax
lea rcx, [0x1406527d8]
add rsp, 0x28
jmp fcn.140215970

Function at 0x14026a380
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x48
call fcn.1404a6760
sub rsp, rax
mov ebp, dword [rsp + 0xa0]
mov r12, rcx
mov ecx, ebp
movsxd r14, edx
mov ebx, 1
mov edx, r14d
shl ebx, cl
mov esi, r9d
mov rcx, r12
mov rdi, r8
call fcn.1402189e0
test rax, rax
jne 0x14026a3d7
add rsp, 0x48
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x98], r13
mov r13, r14
cmp ebp, 3
jg 0x14026a455
test r14d, r14d
jle 0x14026a5dc
xor r10d, r10d
movsxd r11, ebx
shl r11, 3
nop word [rax + rax]
xor r9d, r9d
xor eax, eax
test ebx, ebx
jle 0x14026a43d
mov r8, rdi
nop dword [rax]
mov ecx, eax
lea r8, [r8 + 8]
xor ecx, esi
inc eax
lea edx, [rcx - 1]
not ecx
shr edx, 0x1f
shr ecx, 0x1f
and edx, ecx
mov rcx, qword [r8 - 8]
neg edx
and edx, 1
neg rdx
and rdx, rcx
or r9, rdx
cmp eax, ebx
jl 0x14026a410
mov rax, qword [r12]
add rdi, r11
mov qword [rax + r10*8], r9
inc r10
cmp r10, r13
jl 0x14026a400
jmp 0x14026a5dc
lea ecx, [rbp - 2]
mov edx, esi
sar edx, cl
mov r8d, 1
shl r8d, cl
movsxd rbp, r8d
lea ecx, [rdx - 1]
shr ecx, 0x1f
lea eax, [r8 - 1]
and esi, eax
mov eax, edx
not eax
shr eax, 0x1f
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 1
and eax, 1
neg rax
mov qword [rsp + 0x30], rax
lea eax, [rcx - 1]
not ecx
shr eax, 0x1f
shr ecx, 0x1f
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 2
and eax, 1
xor edx, 3
neg rax
mov qword [rsp + 0x28], rax
lea eax, [rcx - 1]
not ecx
shr eax, 0x1f
shr ecx, 0x1f
and eax, ecx
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x20], rax
lea eax, [rdx - 1]
shr eax, 0x1f
not edx
shr edx, 0x1f
and eax, edx
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x90], rax
test r14d, r14d
jle 0x14026a5dc
xor r14d, r14d
movsxd rax, ebx
shl rax, 3
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r15
nop word [rax + rax]
xor r11d, r11d
xor r9d, r9d
test rbp, rbp
jle 0x14026a5b8
mov r12, qword [rsp + 0x90]
mov rax, rbp
neg rax
mov r8, rbp
shl r8, 4
mov r10, rbp
add r8, rdi
neg r10
add r10, r10
mov rbx, rbp
lea r15, [rax*8]
nop dword [rax + rax]
mov eax, r9d
lea r8, [r8 + 8]
xor eax, esi
inc r9d
lea edx, [rax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov rax, qword [r8 + rbp*8 - 8]
mov rcx, qword [r8 - 8]
and rax, r12
and rcx, qword [rsp + 0x20]
neg edx
or rcx, rax
and edx, 1
mov rax, qword [r15 + r8 - 8]
neg rdx
and rax, qword [rsp + 0x28]
or rax, rcx
mov rcx, qword [r8 + r10*8 - 8]
and rcx, qword [rsp + 0x30]
or rcx, rax
and rcx, rdx
or r11, rcx
sub rbx, 1
jne 0x14026a550
mov r12, qword [rsp + 0x80]
mov rax, qword [rsp + 0x38]
mov rcx, qword [r12]
add rdi, rax
mov qword [rcx + r14*8], r11
inc r14
cmp r14, r13
jl 0x14026a510
mov r15, qword [rsp + 0x40]
mov r14d, dword [rsp + 0x88]
mov r13, qword [rsp + 0x98]
mov eax, 1
mov dword [r12 + 8], r14d
add rsp, 0x48
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14026ff60
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x28
call fcn.1404a6760
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x50], r9d
jne 0x140270059
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x140270059
mov qword [rsp + 0x20], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x140270011
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x14026ffba
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x14026ffba
cmp cl, 0xbb
jne 0x14026fffe
inc eax
cmp eax, ebx
jl 0x14026ffa4
sub ebx, eax
test eax, eax
jne 0x140270015
call fcn.14021e530
lea r8, str.RSA_padding_check_X931
mov edx, 0x56
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.14021e650
mov edx, 0x8a
xor r8d, r8d
mov ecx, 4
call fcn.14021e7b0
mov rbx, qword [rsp + 0x20]
mov eax, 0xffffffff
add rsp, 0x28
ret
call fcn.14021e530
lea r8, str.RSA_padding_check_X931
mov edx, 0x4e
jmp 0x14026ffd1
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x140270042
call fcn.14021e530
lea r8, str.RSA_padding_check_X931
mov edx, 0x5f
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.14021e650
mov edx, 0x8b
jmp 0x14026ffe2
mov r8d, ebx
mov rcx, r11
call fcn.1404de3e0
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.14021e530
lea r8, str.RSA_padding_check_X931
mov edx, 0x43
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.14021e650
xor r8d, r8d
mov edx, 0x89
mov ecx, 4
call fcn.14021e7b0
mov eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x140285260
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1a0
call fcn.1404a6760
sub rsp, rax
mov rax, qword [0x14064a080]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, r8
mov rsi, rdx
mov r8, r9
lea rdx, str.SHA512
call fcn.140210490
mov rdi, rax
test rax, rax
je 0x1402852e6
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x150]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x20
mov rcx, rbx
call fcn.14020f220
mov rcx, rdi
mov ebx, eax
call fcn.1402104e0
test ebx, ebx
jne 0x1402852ed
mov edx, 0x40
lea rcx, [rsp + 0x150]
call fcn.140001240
xor eax, eax
jmp 0x1402853a1
movzx eax, byte [rsp + 0x16f]
lea rdx, [rsp + 0x150]
and byte [rsp + 0x150], 0xf8
lea rcx, [rsp + 0xb0]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x16f], al
call fcn.1402844a0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x30]
call fcn.140280e60
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.1402810e0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.1402810e0
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140282780
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x80]
call fcn.140282780
movzx eax, byte [rsp + 0x30]
lea rcx, [rsp + 0x150]
shl al, 7
mov edx, 0x40
xor byte [rsi + 0x1f], al
call fcn.140001240
mov eax, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1404a5b80
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1402853c0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1d0
call fcn.1404a6760
sub rsp, rax
mov rax, qword [0x14064a080]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x230]
mov r13, rdx
mov r15, qword [rsp + 0x250]
lea rdx, str.SHA512
mov qword [rsp + 0x38], r8
mov r14, rcx
mov rcx, qword [rsp + 0x260]
mov r8, qword [rsp + 0x268]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r9
call fcn.140210490
mov rdi, rax
call fcn.1402103d0
xor r12d, r12d
mov rbx, rax
test r15, r15
mov esi, r12d
cmovne rsi, qword [rsp + 0x258]
cmp byte [rsp + 0x248], r12b
je 0x140285461
test rsi, rsi
je 0x14028565d
cmp byte [rsp + 0x238], r12b
jne 0x140285474
test rsi, rsi
jne 0x14028565d
test rdi, rdi
je 0x14028565d
test rbx, rbx
je 0x14028565d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.14020f9d0
test eax, eax
je 0x14028565d
mov rdx, qword [rsp + 0x40]
mov r8d, 0x20
mov rcx, rbx
call fcn.14020fa10
test eax, eax
je 0x14028565d
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rsp + 0x100]
call fcn.14020f710
test eax, eax
je 0x14028565d
movzx eax, byte [rsp + 0x11f]
mov rdx, rdi
movzx r8d, byte [rsp + 0x238]
and al, 0x3f
and byte [rsp + 0x100], 0xf8
or al, 0x40
mov qword [rsp + 0x28], rsi
mov rcx, rbx
mov qword [rsp + 0x20], r15
movzx r15d, byte [rsp + 0x240]
movzx r9d, r15b
mov byte [rsp + 0x11f], al
call fcn.140285160
test eax, eax
je 0x14028565d
mov r8d, 0x20
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.14020fa10
test eax, eax
je 0x14028565d
mov r8, qword [rsp + 0x38]
mov rdx, r13
mov rcx, rbx
call fcn.14020fa10
test eax, eax
je 0x14028565d
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rsp + 0x140]
call fcn.14020f710
test eax, eax
je 0x14028565d
lea rcx, [rsp + 0x140]
call fcn.140287c20
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x60]
call fcn.1402844a0
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140284410
mov rax, qword [rsp + 0x48]
movzx r9d, r15b
movzx r8d, byte [rsp + 0x238]
mov rdx, rdi
mov qword [rsp + 0x28], rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140285160
test eax, eax
je 0x14028565d
mov r8d, 0x20
mov rdx, r14
mov rcx, rbx
call fcn.14020fa10
test eax, eax
je 0x14028565d
mov rdx, qword [rsp + 0x50]
mov r8d, 0x20
mov rcx, rbx
call fcn.14020fa10
test eax, eax
je 0x14028565d
mov r8, qword [rsp + 0x38]
mov rdx, r13
mov rcx, rbx
call fcn.14020fa10
test eax, eax
je 0x14028565d
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rsp + 0x180]
call fcn.14020f710
test eax, eax
je 0x14028565d
lea rcx, [rsp + 0x180]
call fcn.140287c20
lea rcx, [r14 + 0x20]
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x180]
call fcn.140285bd0
mov r12d, 1
mov edx, 0x40
lea rcx, [rsp + 0x140]
call fcn.140001240
mov edx, 0x40
lea rcx, [rsp + 0x100]
call fcn.140001240
mov rcx, rdi
call fcn.1402104e0
mov rcx, rbx
call fcn.140210320
mov eax, r12d
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1404a5b80
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140285a50
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x70]
mov eax, 0x170
call fcn.1404a6760
sub rsp, rax
mov rax, qword [0x14064a080]
xor rax, rsp
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x50]
movups xmm1, xmmword [rdx + 0x10]
movd eax, xmm0
movups xmmword [rbp + 0x40], xmm0
and al, 0xf8
mov byte [rbp + 0x40], al
mov rax, qword [rdx + 0x18]
lea rdx, [rbp + 0x40]
shr rax, 0x38
and al, 0x3f
or al, 0x40
movups xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x5f], al
call fcn.1402844a0
mov ecx, dword [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8, qword [rbp - 0x3c]
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rsp + 0x7c]
mov dword [rbp + 0x18], edx
mov rdx, qword [rbp - 0x5c]
mov dword [rbp - 0x10], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x80]
mov dword [rbp + 0x1c], edx
mov rdx, qword [rbp - 0x58]
mov dword [rbp - 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x7c]
mov dword [rbp + 0x20], edx
mov rdx, qword [rbp - 0x54]
mov dword [rbp - 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x78]
mov dword [rbp + 0x24], edx
mov rdx, qword [rbp - 0x50]
mov dword [rbp - 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x74]
mov dword [rbp + 0x28], edx
mov rdx, qword [rbp - 0x4c]
mov dword [rbp], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x70]
mov dword [rbp + 0x2c], edx
mov rdx, qword [rbp - 0x48]
mov dword [rbp + 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x6c]
mov dword [rbp + 0x30], edx
mov rdx, qword [rbp - 0x44]
mov dword [rbp + 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x68]
mov dword [rbp + 0x34], edx
mov rdx, qword [rbp - 0x40]
mov dword [rbp + 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov dword [rbp + 0x38], edx
lea rcx, [rsp + 0x20]
mov rdx, qword [rbp - 0x64]
mov dword [rbp + 0x10], eax
lea eax, [rdx + r8]
sub r8d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r8d
mov dword [rbp + 0x14], eax
call fcn.140280e60
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1402810e0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140282780
lea rcx, [rbp + 0x40]
mov edx, 0x20
call fcn.140001240
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1404a5b80
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
Function at 0x14028a590
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movd xmm4, r8d
mov r10d, r8d
pshufd xmm4, xmm4, 0
lea rcx, [rdx + 0x3c]
lea rax, [r9 + 0x3c]
cmp rdx, rax
ja 0x14028a5e1
cmp rcx, r9
jb 0x14028a5e1
sub r9, rdx
mov r8d, reloc.WS2_32.dll_recv
nop dword [rax + rax]
mov ecx, dword [r9 + rdx]
lea rdx, [rdx + 4]
mov eax, ecx
xor eax, dword [rdx - 4]
and eax, r10d
xor ecx, eax
mov dword [r9 + rdx - 4], ecx
xor dword [rdx - 4], eax
sub r8, 1
jne 0x14028a5c0
ret
sub r9, rdx
mov eax, 4
nop dword [rax]
movdqu xmm1, xmmword [r9 + rdx]
movdqu xmm2, xmmword [rdx]
lea rdx, [rdx + 0x10]
movdqa xmm3, xmm1
xorps xmm3, xmm2
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r9 + rdx - 0x10], xmm0
movdqu xmmword [rdx - 0x10], xmm3
sub rax, 1
jne 0x14028a5f0
ret