joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140133660
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [0x14023df88]
test eax, eax
jne 0x1401336b3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x140133693
mov dword [0x14023df88], 1
jmp 0x1401336ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1401336ad
mov dword [0x14023df88], 2
jmp 0x1401337a9
mov eax, dword [0x14023df88]
cmp eax, 1
jne 0x1401337a0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x1401337f3
cmp word [rdi], 0
mov qword [rsp + 0x50], rbp
mov rbx, rdi
mov qword [rsp + 0x58], r12
je 0x1401336f5
add rbx, 2
cmp word [rbx], 0
jne 0x1401336e1
add rbx, 2
cmp word [rbx], 0
jne 0x1401336e1
xor r12d, r12d
sub rbx, rdi
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
sar rbx, 1
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x140133793
mov rcx, rbp
call fcn.14012d670
test rax, rax
mov rsi, rax
je 0x140133793
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14013376d
mov rcx, rsi
call fcn.140123ff0
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x140133779
cmp eax, 2
je 0x1401337a9
test eax, eax
jne 0x1401337f3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x1401337f3
cmp byte [rax], 0
je 0x1401337d2
nop
add rax, 1
cmp byte [rax], 0
jne 0x1401337c0
add rax, 1
cmp byte [rax], 0
jne 0x1401337c0
sub eax, ebx
add eax, 1
movsxd rsi, eax
mov rcx, rsi
call fcn.14012d670
test rax, rax
mov rdi, rax
jne 0x140133805
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14011e9b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140134fb0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0xb0
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov esi, ecx
mov r9d, 0x78
and ecx, 0x3ff
mov rbp, r8
mov ebx, edx
lea edx, [r9 - 0x77]
lea r8, [rsp + 0x20]
bts ecx, 0xa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x140135099
movzx ecx, byte [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0xc8], rdi
test cl, cl
lea r8, [rsp + 0x20]
mov edi, edx
je 0x14013504a
nop
lea eax, [rcx - 0x61]
add r8, 1
cmp al, 5
ja 0x140135030
add cl, 0xd9
jmp 0x14013503a
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x14013503a
add cl, 0xf9
movsx eax, cl
mov cl, byte [r8]
add edi, edi
test cl, cl
lea edi, [rax + rdi*8 - 0x30]
jne 0x140135020
cmp esi, edi
je 0x14013508c
test ebx, ebx
je 0x14013508c
mov rdi, qword [rbp]
movzx eax, byte [rdi]
lea rcx, [rdi + 1]
nop
cmp al, 0x41
jl 0x140135068
cmp al, 0x5a
jle 0x14013506e
sub al, 0x61
cmp al, 0x19
ja 0x140135079
mov al, byte [rcx]
add edx, 1
add rcx, 1
jmp 0x140135060
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp edx, ecx
je 0x140135091
mov eax, 1
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14011f1c0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x140138940
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.14012adf0
xor ebx, ebx
cmp qword [0x14023e070], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x140138a6c
lea rcx, [0x1401bc760]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140138b7f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140138b7f
mov rcx, rax
call fcn.14012ad20
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14023e070], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14012ad20
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14023e078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14012ad20
lea rcx, [rsp + 0x98]
mov qword [0x14023e080], rax
call fcn.140122120
test eax, eax
je 0x140138a1f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14011eda0
cmp dword [rsp + 0x98], 2
jne 0x140138a6c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14012ad20
test rax, rax
mov qword [0x14023e090], rax
je 0x140138a6c
lea rdx, [0x1401bc6f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14012ad20
mov qword [0x14023e088], rax
mov rcx, qword [0x14023e088]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140138b18
cmp qword [0x14023e090], rbp
je 0x140138b18
call fcn.14012aee0
mov rcx, qword [0x14023e090]
mov rsi, rax
call fcn.14012aee0
test rsi, rsi
mov r12, rax
je 0x140138b18
test rax, rax
je 0x140138b18
call rsi
test rax, rax
je 0x140138ae3
lea rcx, [rsp + 0x34]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140138ae3
test byte [rsp + 0x40], 1
jne 0x140138b18
lea rcx, [rsp + 0x30]
call fcn.140122170
test eax, eax
je 0x140138b05
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14011eda0
cmp dword [rsp + 0x30], 4
jb 0x140138b12
bts edi, 0x15
jmp 0x140138b56
bts edi, 0x12
jmp 0x140138b56
mov rcx, qword [0x14023e078]
cmp rcx, rbp
je 0x140138b56
call fcn.14012aee0
test rax, rax
je 0x140138b56
call rax
test rax, rax
mov rbx, rax
je 0x140138b56
mov rcx, qword [0x14023e080]
cmp rcx, rbp
je 0x140138b56
call fcn.14012aee0
test rax, rax
je 0x140138b56
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14023e070]
call fcn.14012aee0
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140138b7f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140138b81
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013b380
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x140229498]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x14023e10c]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x14013b401
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14013b3e4
mov dword [0x14023e10c], 1
jmp 0x14013b406
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14013b3fb
mov dword [0x14023e10c], 2
jmp 0x14013b42b
mov eax, dword [0x14023e10c]
cmp eax, 1
jne 0x14013b41e
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x14013b532
cmp eax, 2
je 0x14013b42b
test eax, eax
jne 0x14013b530
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x14013b43a
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
movsxd r12, eax
je 0x14013b530
jle 0x14013b530
xor edx, edx
mov rax, 0xffffffffffffffe0
mov rcx, r12
div r12
cmp rax, 1
jb 0x14013b530
add rcx, 0x10
cmp rcx, 0x400
ja 0x14013b4b8
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14013b496
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140187630
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14013b530
mov dword [rbx], 0xcccc
jmp 0x14013b4cb
call fcn.140124300
test rax, rax
mov rbx, rax
je 0x14013b4cf
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x14013b530
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x14013b51a
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
mov r8, rbx
test eax, eax
lea edx, [r9 + 2]
mov ecx, esi
jne 0x14013b509
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x14013b512
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x14013b52c
call fcn.140123ff0
mov eax, edi
jmp 0x14013b532
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.14011f1c0
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14013b690
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x140229498]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x14023e110]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x14013b748
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14013b6f4
mov dword [0x14023e110], 1
jmp 0x14013b756
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14013b742
mov dword [0x14023e110], 2
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.14011f1c0
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [0x14023e110]
cmp eax, 2
je 0x14013b709
test eax, eax
je 0x14013b709
cmp eax, 1
jne 0x14013b77e
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x14013b765
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
movsxd r12, eax
jne 0x14013b782
xor eax, eax
jmp 0x14013b71c
jle 0x14013b77e
xor edx, edx
mov rax, 0xffffffffffffffe0
div r12
cmp rax, 2
jb 0x14013b77e
lea rcx, [r12 + r12 + 0x10]
cmp rcx, 0x400
ja 0x14013b7d5
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14013b7b7
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140187630
sub rsp, rax
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14013b77e
mov dword [rbx], 0xcccc
jmp 0x14013b7e8
call fcn.140124300
test rax, rax
mov rbx, rax
je 0x14013b7ec
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x14013b77e
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14013b83f
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
xor edx, edx
test eax, eax
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov ecx, esi
mov qword [rsp + 0x30], rdi
jne 0x14013b82e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x14013b837
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x14013b851
call fcn.140123ff0
mov eax, edi
jmp 0x14013b71c

Function at 0x14013d600
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14013d647
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14011f1c0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140120340
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14011f1c0
add rsp, 0x38
ret
Function at 0x140149870
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rdi
mov eax, 0x270
call fcn.140187630
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rax, qword [0x140229498]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x1401498eb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1401498eb
lea rbx, [rbp + 0x248]
call fcn.1401219d0
mov rdx, qword [rbp + 0x240]
lea rcx, [rax + 0x60]
mov r8, rbx
call fcn.140133090
jmp 0x140149a9f
mov r8, qword [rbp + 0x240]
mov rcx, r8
call fcn.1401495b0
add eax, 1
mov edi, eax
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140149915
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140187630
sub rsp, rcx
lea rbx, [rsp + 0x50]
test rbx, rbx
jne 0x14014993a
lea rbx, str.no_stack_
jmp 0x1401499ed
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14014997a
xor edx, edx
test rdi, rdi
je 0x14014997a
nop
nop
mov rax, qword [rbp + 0x240]
add rdx, 1
cmp rdx, rdi
movsx ecx, byte [rdx + rax - 1]
mov word [rbx + rdx*2 - 2], cx
jb 0x140149960
xor edx, edx
test rdi, rdi
je 0x1401499ed
lea r9, [0x140000000]
cmp word [rbx + rdx*2], 0x25
jne case.0x1401499b6.47
lea r8, [rbx + rdx*2 + 2]
movzx eax, word [r8]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x1401499b6.47
cdqe
movzx eax, byte [r9 + rax + 0x149ad4]
mov ecx, dword [r9 + rax*4 + 0x149abc]
add rcx, r9
jmp rcx
add rdx, 1
add r8, 2
jmp 0x140149994
mov word [rbx + rdx*2 + 2], 0x53
jmp case.0x1401499b6.47
mov word [rbx + rdx*2 + 2], reloc.WS2_32.dll_WSAStartup
jmp case.0x1401499b6.47
mov word [rbx + rdx*2 + 2], 0x43
jmp case.0x1401499b6.47
mov word [rbx + rdx*2 + 2], 0x63
add rdx, 1
cmp rdx, rdi
jb 0x140149988
lea r9, [rbp + 0x248]
lea rcx, [rbp + 0x10]
mov r8, rbx
mov edx, 0xff
call fcn.140185cd0
mov word [rbp + 0x20e], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x140149a86
call fcn.140149740
test eax, eax
jle 0x140149a86
lea rdx, str.OPENSSL
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rsp + 0x40], 0
xor r9d, r9d
mov rbx, rax
lea rax, [rbp + 0x10]
xor r8d, r8d
mov qword [rbp], rax
lea rax, [rbp]
mov dx, 1
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov rcx, rbx
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x140149a9f
lea r8, str.OpenSSL:_FATAL
lea rdx, [rbp + 0x10]
mov r9d, reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.14011f1c0
lea rsp, [rbp + 0x220]
pop rdi
pop rbx
pop rbp
ret
Function at 0x140155fa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r13
mov eax, 0x68
call fcn.140187630
sub rsp, rax
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r13, qword [rsp + 0xb0]
lea edi, [rdx - 1]
mov esi, r9d
lea eax, [rdi - 0x29]
mov r12, r8
cmp r9d, eax
jle 0x140156003
mov edx, 0x79
lea r9, str..crypto_rsa_rsa_oaep.c
mov dword [rsp + 0x20], gethostbyname
lea ecx, [rdx - 0x75]
lea r8d, [rdx - 0xb]
call fcn.140145b20
xor eax, eax
jmp 0x1401561dc
cmp edi, 0x29
jge 0x14015602f
mov edx, 0x79
lea r9, str..crypto_rsa_rsa_oaep.c
mov dword [rsp + 0x20], reloc.WS2_32.dll_gethostbyaddr
lea ecx, [rdx - 0x75]
lea r8d, [rdx - 1]
call fcn.140145b20
xor eax, eax
jmp 0x1401561dc
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbp
mov byte [rcx], 0
lea rbp, [rcx + 0x15]
lea rbx, [rcx + 1]
call fcn.140157280
movsxd rdx, dword [rsp + 0xb8]
xor r9d, r9d
mov r8, rbp
mov rcx, r13
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.140156f00
mov r11d, edi
lea rcx, [rbp + 0x14]
sub r11d, esi
xor edx, edx
sub r11d, 0x29
movsxd r8, r11d
call fcn.14011f1f0
movsxd r11, esi
movsxd rax, edi
sub rax, r11
mov r8, rsi
mov rdx, r12
lea rcx, [rax + rbp - 0x14]
mov byte [rax + rbp - 0x15], 1
call fcn.14011e9b0
mov edx, socket
mov rcx, rbx
call fcn.1401449b0
test eax, eax
jle 0x1401560f1
add edi, 0xffffffec
lea rdx, str..crypto_rsa_rsa_oaep.c
mov r8d, 0x48
mov ecx, edi
call fcn.1401461b0
test rax, rax
mov rsi, rax
jne 0x1401560f8
lea r9, str..crypto_rsa_rsa_oaep.c
lea edx, [rax + 0x79]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov dword [rsp + 0x20], 0x4b
call fcn.140145b20
xor eax, eax
jmp 0x1401561d2
call fcn.140157280
mov r9d, socket
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140155e40
test edi, edi
jle 0x140156142
mov r11, rsi
mov rcx, rbp
mov r10d, edi
sub r11, rbp
nop
nop
nop
movzx eax, byte [r11 + rcx]
add rcx, 1
xor byte [rcx - 1], al
sub r10, 1
jne 0x140156130
call fcn.140157280
lea rcx, [rsp + 0x30]
mov r9d, edi
mov r8, rbp
mov edx, socket
mov qword [rsp + 0x20], rax
call fcn.140155e40
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x31]
lea r9, [rsp + 0x32]
lea r10, [rsp + 0x33]
lea r11, [rsp + 0x34]
sub rdx, rbx
sub r8, rbx
sub r9, rbx
sub r10, rbx
mov ecx, 4
sub r11, rbx
nop
movzx eax, byte [rdx + rbx]
add rbx, 5
xor byte [rbx - 5], al
movzx eax, byte [r8 + rbx - 5]
xor byte [rbx - 4], al
movzx eax, byte [r9 + rbx - 5]
xor byte [rbx - 3], al
movzx eax, byte [r10 + rbx - 5]
xor byte [rbx - 2], al
movzx eax, byte [r11 + rbx - 5]
xor byte [rbx - 1], al
sub rcx, 1
jne 0x140156190
mov rcx, rsi
call fcn.140146530
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011f1c0
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1401565a0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.140187630
sub rsp, rax
cmp dword [rsp + 0x60], r9d
mov r10, rcx
jne 0x140156688
movzx eax, byte [r8]
cmp al, 0x6a
je 0x1401565cb
cmp al, 0x6b
jne 0x140156688
cmp al, 0x6b
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
jne 0x140156637
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x1401565fa
movzx ecx, byte [rdx]
add rdx, 1
cmp cl, 0xba
je 0x1401565fa
cmp cl, 0xbb
jne 0x14015662d
add eax, 1
cmp eax, ebx
jl 0x1401565e2
sub ebx, eax
test eax, eax
jne 0x14015663b
mov dword [rsp + 0x20], 0x8a
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.140145b20
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x81
jmp 0x140156608
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x140156671
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], 0x93
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.140145b20
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r10
call fcn.14011e9b0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], WSAStartup
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.140145b20
or eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x140167e10
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x250
mov rdi, r8
movzx r8d, word [r8]
mov esi, ecx
cmp r8d, 2
mov ebp, r9d
mov ebx, edx
lea rcx, [0x14023eac0]
je 0x140167e65
cmp r8d, 0x17
je 0x140167e5c
lea rdx, str.__trying_family__d
call fcn.140002fd0
jmp 0x140167e71
lea rdx, str.__trying_IPv6
jmp 0x140167e6c
lea rdx, str.__trying_IPv4
call fcn.140002fd0
movzx ecx, word [rdi]
xor r12d, r12d
mov r8d, ebx
cmp byte [reloc.WS2_32.dll_accept], r12b
mov edx, esi
jne 0x140167e9d
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
jmp 0x140167ea5
call qword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
test ebx, ebx
jns 0x140167f09
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.socket
lea rcx, [rsp + 0x40]
or r9d, 0xffffffff
mov edx, 0x100
mov byte [rsp + 0x40], r12b
mov ebx, eax
call fcn.14007b3b0
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.14007f910
lea rcx, [rsp + 0x144]
lea rdx, [rsp + 0x40]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x144]
call fcn.14011f050
int3
cmp byte [rsp + 0x280], r12b
je 0x140167f1c
xor edx, edx
mov ecx, ebx
call fcn.140033600
movsxd rsi, ebx
nop
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x140167fcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2714
je 0x140167f20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x140167fcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.WS2_32.dll_closesocket]
lea r8, str.connect
lea rcx, [rsp + 0x40]
or r9d, 0xffffffff
mov edx, 0x100
mov byte [rsp + 0x40], r12b
call fcn.14007b3b0
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.14007f910
lea rcx, [rsp + 0x144]
lea rdx, [rsp + 0x40]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x144]
call fcn.14011f050
int3
lea r11, [rsp + 0x250]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret