joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402018d0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call fcn.14039708c
test rax, rax
je 0x140201906
cmp rax, 0xffffffffffffffff
cmovne rbx, rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret

Function at 0x140203950
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, gethostbyname
call fcn.1401a7980
sub rsp, rax
mov rdi, rcx
lea rdx, str.crypto_thread_arch_thread_win.c
mov ecx, 8
mov r8d, 0x27
call fcn.1401a5490
mov rbx, rax
test rax, rax
je 0x1402039c5
mov qword [rsp + 0x28], 0
lea r8, [0x140203a60]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.14039708c
mov qword [rbx], rax
test rax, rax
je 0x1402039c5
mov qword [rdi + 0x20], rbx
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8d, reloc.WS2_32.dll_gethostbyname
mov qword [rdi + 0x20], 0
lea rdx, str.crypto_thread_arch_thread_win.c
mov rcx, rbx
call fcn.1401a53a0
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140208130
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x14020819c
movzx ecx, byte [rcx]
test cl, cl
je 0x14020819c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140208150
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x1402081d0
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x140208240
movzx ecx, byte [rcx]
test cl, cl
je 0x140208240
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
mov r8d, eax
and r9d, 0xffffffdf
or r9d, r11d
mov ecx, 0x20
mov edx, r9d
add r11d, 0x100
shr edx, 2
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1402081f0
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret
Function at 0x14020a1a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x1404b41c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call fcn.1401a9f50
mov r13, rax
test rax, rax
jne 0x14020a220
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1401db220
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.1401abd70
xor ecx, ecx
mov ebx, 0x4d
call qword [fcn.1403a1080]
jmp 0x14020a3d8
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, r13
mov qword [rsp + 0x170], r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14020a296
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1401db220
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.1401abd70
xor ecx, ecx
mov ebx, 0x4d
jmp 0x14020a3c2
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14020a2df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1401db220
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.1401abd70
mov ebx, 0x4d
jmp 0x14020a3b6
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x14020a314
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.1401abd70
mov ebx, 0x4d
jmp 0x14020a3ae
lea rcx, [rdi + 1]
call qword [fcn.1403a1cd0]
mov rbp, rax
test rax, rax
jne 0x14020a330
mov ebx, 0x1b
jmp 0x14020a3ae
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x14020a388
nop dword [rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14020a3fa
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14020a37f
mov edi, esi
jmp 0x14020a381
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x14020a340
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.140209f10
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [fcn.1403a1080]
mov rcx, r13
call fcn.1403a1080
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14019b850
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1401db220
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.1401abd70
mov ebx, 0x4d
jmp 0x14020a3a6
Function at 0x140210010
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov edx, ebx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x14021004b
mov edx, 0x2e
mov rcx, rdi
call fcn.14038ad10
test rax, rax
je 0x140210049
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140216d80
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x260
call fcn.1401a7980
sub rsp, rax
mov rax, qword [0x1404b41c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, ecx
mov rbx, r8
mov esi, edx
cmp ecx, 0xffffffff
jne 0x140216db3
mov eax, ecx
jmp 0x140216e15
test rbx, rbx
jne 0x140216dbf
mov eax, 1
jmp 0x140216e15
xor ecx, ecx
call fcn.14039d810
mov rcx, rax
cmp rbx, rax
jge 0x140216dd2
xor eax, eax
jmp 0x140216e15
xor eax, eax
mov qword [rsp + 0x48], rdi
sub ebx, ecx
mov dword [rsp + 0x34], eax
test esi, esi
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
cmovne r8, rax
lea rdx, [rsp + 0x40]
cmove rdx, rax
lea ecx, [rdi + 1]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14019b850
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret

Function at 0x140216e90
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, 0x20
call fcn.1401a7980
sub rsp, rax
mov dword [rsp + 0x30], edx
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x140216ef2
call fcn.1401a74c0
lea r8, str.BIO_socket_ioctl
mov edx, 0xf4
lea rcx, str.crypto_bio_bio_sock.c
call fcn.1401a75e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov ecx, 2
mov edx, eax
call fcn.1401a7740
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x140216f00
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.1401a7980
sub rsp, rax
cmp dword [0x1404bdac0], 0
jne 0x140216fbd
xor edx, edx
mov dword [0x1404bdac0], 1
mov r8d, 0x198
lea rcx, [0x1404bdad0]
call fcn.1403b7450
mov ecx, 0x202
lea rdx, [0x1404bdad0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140216fbd
call fcn.1401a74c0
lea r8, str.BIO_sock_init
mov edx, __WSAFDIsSet
lea rcx, str.crypto_bio_bio_sock.c
call fcn.1401a75e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov ecx, 2
mov edx, eax
call fcn.1401a7740
call fcn.1401a74c0
lea r8, str.BIO_sock_init
mov edx, 0x98
lea rcx, str.crypto_bio_bio_sock.c
call fcn.1401a75e0
xor r8d, r8d
mov edx, 0x7a
mov ecx, 0x20
call fcn.1401a7740
mov eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x140217190
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x870
call fcn.1401a7980
sub rsp, rax
mov rax, qword [0x1404b41c0]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r13, qword [rsp + 0x8c8]
mov r14, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x400
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], bpl
mov r12d, ebp
mov word [rsp + 0x20], r9w
call fcn.1403b7450
xor edx, edx
mov byte [rsp + 0x450], bpl
mov r8d, 0x400
lea rcx, [rsp + 0x451]
call fcn.1403b7450
lea rbx, [rsp + 0x40]
mov r9d, 0x400
mov r8, r14
mov qword [rsp + 0x30], rbx
mov edx, 0x401
lea rcx, [rsp + 0x40]
lea rdi, [rsp + 0x450]
call fcn.1403a3464
mov r15, 0xffffffffffffffff
mov rcx, r14
mov qword [r13], rbp
mov rsi, r13
mov byte [rdi], bpl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x14021739e
cmp word [rax + 0x10], 2
jne 0x1402172c7
cmp word [rax + 0x12], 4
jne 0x1402172c7
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x1402172c2
nop dword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.1402170e0
mov qword [rsi], rax
test rax, rax
je 0x140217397
add rbx, 8
lea rsi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x140217290
mov rbx, qword [rsp + 0x30]
mov r8, qword [r14]
mov r9d, 0x400
mov edx, 0x401
mov rcx, rdi
call fcn.1403a3464
cmp qword [r13], rbp
jne 0x140217341
mov rax, r15
inc rax
cmp byte [rdi + rax], bpl
jne 0x1402172e6
test rax, rax
je 0x1402173b8
mov r8, rdi
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140217314
inc rax
test ecx, ecx
jne 0x140217301
test edx, edx
je 0x1402173b8
inc r12d
cmp r12d, 0x10
je 0x1402173b8
mov r14, qword [rsp + 0x38]
mov rax, rbx
mov rbx, rdi
mov rdi, rax
mov qword [rsp + 0x30], rbx
jmp 0x140217250
cmp dword [rsp + 0x8c0], ebp
je 0x1402173cb
nop
cmp byte [rdi + r15 + 1], bpl
lea r15, [r15 + 1]
jne 0x140217350
lea rdx, [r15 + 1]
mov ecx, 1
call fcn.1403a02a0
mov rbx, rax
test rax, rax
jne 0x140217376
mov rbx, rbp
jmp 0x140217385
mov r8, rdi
lea rdx, [r15 + 1]
mov rcx, rax
call fcn.1403a2c28
mov rax, qword [r13]
mov qword [rax + 0x18], rbx
mov rax, qword [r13]
cmp qword [rax + 0x18], rbp
jne 0x1402173cb
mov ebp, 8
jmp 0x1402173cb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x1402173c6
sub ecx, 1
je 0x1402173bf
sub ecx, 1
jne 0x1402173c6
mov ebp, 0x2afb
jmp 0x1402173cb
mov ebp, 0x2afa
jmp 0x1402173cb
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.14019b850
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140217af0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.1401a7980
sub rsp, rax
mov rax, qword [0x1404b41c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1404be084], 0
lea rax, [0x140217460]
mov qword [rsp + 0x28], rax
lea rbx, [0x14045c338]
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x1402178a0]
mov qword [rsp + 0x38], rax
lea rax, [0x14045c348]
mov qword [rsp + 0x40], rax
lea rax, [0x140217400]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x140217cc9
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140217cbf
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1403a2c28
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1403a2b30
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140217bea
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140217c4a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1403a2c28
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1403a2b30
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140217cb7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140217c4a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140217cb7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x140217ca6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x140217c60
mov rax, qword [rsp + 0x28]
mov qword [str._t__], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1404b5100], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1404b5110], rax
jmp 0x140217caf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1404be084], 1
mov rax, rbp
lea rcx, [0x1404b50e8]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14019b850
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x140225aa0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [fcn.1403a1cd0]
mov rbx, rax
test rax, rax
jne 0x140225ae3
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x140225b30
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x140225b92
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x140225b50
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x140225bd1
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1403db680]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1403db681]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x140225ba0
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x140225e30
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1404b41c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140225e7c
mov eax, 0x1b
jmp 0x140225f4f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140225ec0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x140225f4f
mov rcx, rbp
call fcn.1401ab960
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x140225f2b
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140225f3b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140225f4d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14019b850
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140225f70
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x140225fd5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x140225f80
ret
Function at 0x140225fe0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1404b41c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140226063
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140226085
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14019b850
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.1401ab960
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x1402260e4
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1402260f4
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140226106
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x140226068
Function at 0x140232630
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, gethostbyname
call fcn.1401a7980
sub rsp, rax
movsxd rbx, ecx
mov edi, r8d
mov dword [rsp + 0x40], 1
mov rbp, rdx
cmp ebx, 0xffffffff
jne 0x14023269f
call fcn.1401a74c0
lea r8, str.BIO_connect
mov edx, 0x56
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1401a75e0
xor r8d, r8d
mov edx, 0x87
mov ecx, 0x20
call fcn.1401a7740
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov edx, edi
mov qword [rsp + 0x48], rsi
shr edx, 3
mov ecx, ebx
and edx, 1
call fcn.140216e90
test eax, eax
je 0x140232752
mov rsi, rbx
test dil, 4
je 0x140232769
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140232769
call fcn.1401a74c0
lea r8, str.BIO_connect
mov edx, 0x60
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1401a75e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov ecx, 2
mov edx, eax
call fcn.1401a7740
call fcn.1401a74c0
lea r8, str.BIO_connect
mov edx, 0x62
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1401a75e0
xor r8d, r8d
mov edx, 0x89
mov ecx, 0x20
call fcn.1401a7740
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test dil, 0x10
je 0x1402327f8
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1402327f8
call fcn.1401a74c0
lea r8, str.BIO_connect
mov edx, 0x6a
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1401a75e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov ecx, 2
mov edx, eax
call fcn.1401a7740
call fcn.1401a74c0
lea r8, str.BIO_connect
mov edx, WSASetLastError
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1401a75e0
xor r8d, r8d
mov edx, 0x8a
jmp 0x140232748
mov rcx, rbp
call fcn.1402182d0
mov rcx, rbp
mov ebx, eax
call fcn.1401ab980
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14023288d
mov ecx, eax
call fcn.140232500
test eax, eax
jne 0x140232752
call fcn.1401a74c0
lea r8, str.BIO_connect
mov edx, 0xb2
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1401a75e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_connect__
mov ecx, 2
mov edx, eax
call fcn.1401a7740
call fcn.1401a74c0
lea r8, str.BIO_connect
mov edx, 0xb4
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1401a75e0
xor r8d, r8d
mov edx, 0x67
jmp 0x140232748
mov eax, 1
jmp 0x140232754
Function at 0x140236d70
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, gethostbyname
call fcn.1401a7980
sub rsp, rax
mov edx, 1
mov rbx, rcx
call fcn.140236880
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call fcn.140236b00
xor edi, edi
mov r14, rax
test rax, rax
je 0x140236e1b
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
mov esi, edi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140236df7
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rbx
call fcn.140236bb0
mov rcx, rbx
call fcn.140236860
test rax, rax
jne 0x140236eaf
mov edx, 1
mov rcx, rbx
call fcn.140236880
mov rdx, rax
mov rcx, rbx
mov rsi, rax
call fcn.140236b00
mov rbp, rax
test rax, rax
je 0x140236ea7
mov r9d, reloc.WS2_32.dll_shutdown
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140236e87
mov rcx, qword [rsp + 0x58]
mov r8, rbp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rdi, rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rdi*8]
mov rdx, rdi
mov rcx, rbx
call fcn.140236bb0
mov rcx, rbx
call fcn.140236860
test rax, rax
jne 0x140236eaf
mov rcx, rbx
call fcn.140236860
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret