joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bd930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, r9
mov r9, rcx
xor r11d, r11d
xor cl, cl
mov r10, rdx
test r9, r9
je 0x1400bd9b7
test rdx, rdx
je 0x1400bd9b7
movzx eax, byte [r9]
test r8d, r8d
jne 0x1400bd96a
cmp rax, 0x7f
jbe 0x1400bd9af
mov r11d, 1
mov edx, r11d
add rdx, r10
jmp 0x1400bd9bf
mov cl, 0xff
cmp rax, 0x80
jbe 0x1400bd982
mov r11d, 1
mov edx, r11d
add rdx, r10
jmp 0x1400bd9bf
jne 0x1400bd9af
mov edx, 1
cmp rdx, r10
jae 0x1400bd9a0
nop
movzx eax, byte [rdx + r9]
inc rdx
or r11d, eax
cmp rdx, r10
jb 0x1400bd990
neg r11d
sbb cl, cl
movzx ecx, cl
mov r11d, ecx
and r11d, 1
mov edx, r11d
add rdx, r10
jmp 0x1400bd9bf
mov edx, 1
mov r10, r11
test rbx, rbx
je 0x1400bda0f
mov rax, qword [rbx]
test rax, rax
je 0x1400bda0f
mov r8d, r11d
mov byte [rax], cl
movzx r11d, cl
add r8, rax
mov eax, r11d
and eax, 1
test r10, r10
je 0x1400bda0c
add r8, r10
nop word [rax + rax]
movzx ecx, byte [r10 + r9 - 1]
dec r10
dec r8
xor ecx, r11d
add eax, ecx
mov byte [r8], al
shr eax, 8
test r10, r10
jne 0x1400bd9f0
add qword [rbx], rdx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400bda20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.1402563f0
sub rsp, rax
mov r10, rcx
test r9, r9
jne 0x1400bda6a
call fcn.1400baf40
lea r8, str.c2i_ibuf
lea rcx, str.crypto_asn1_a_int.c
mov edx, 0xa0
call fcn.1400bafb0
xor r8d, r8d
mov edx, 0xde
lea ecx, [r8 + 0xd]
call fcn.1400bb200
xor eax, eax
add rsp, 0x28
ret
movzx r11d, byte [r8]
and r11d, 0x80
test rdx, rdx
je 0x1400bda7d
mov dword [rdx], r11d
cmp r9, 1
jne 0x1400bdaa1
test rcx, rcx
je 0x1400bda97
movzx eax, byte [r8]
test r11d, r11d
je 0x1400bda95
not al
inc al
mov byte [rcx], al
mov eax, 1
add rsp, 0x28
ret
movzx eax, byte [r8]
mov qword [rsp + 0x20], rbx
xor ebx, ebx
test al, al
jne 0x1400bdab7
mov ebx, 1
jmp 0x1400bdae8
cmp al, 0xff
jne 0x1400bdb31
mov ecx, 1
mov edx, ebx
cmp rcx, r9
jae 0x1400bdadf
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
or edx, eax
cmp rcx, r9
jb 0x1400bdad0
test edx, edx
setne bl
test ebx, ebx
je 0x1400bdb31
movzx eax, byte [r8 + 1]
and eax, 0x80
cmp r11d, eax
jne 0x1400bdb31
call fcn.1400baf40
lea r8, str.c2i_ibuf
lea rcx, str.crypto_asn1_a_int.c
mov edx, 0xc1
call fcn.1400bafb0
xor r8d, r8d
mov edx, 0xdd
lea ecx, [r8 + 0xd]
call fcn.1400bb200
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
movsxd rcx, ebx
sub r9, rcx
test r10, r10
je 0x1400bdb7c
neg r11d
mov rdx, r9
sbb al, al
add r8, rcx
movzx eax, al
mov ecx, eax
mov r11d, eax
and ecx, 1
test r9, r9
je 0x1400bdb7c
add r8, r9
nop word [rax + rax]
movzx eax, byte [r8 - 1]
dec r8
dec rdx
xor eax, r11d
add ecx, eax
mov byte [rdx + r10], cl
shr ecx, 8
test rdx, rdx
jne 0x1400bdb60
mov rax, r9
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x1400bdb90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.1402563f0
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
mov rcx, qword [rcx + 8]
and r8d, 0x100
add rsp, 0x28
jmp fcn.1400bd930
Function at 0x1400c48f0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [rbx], eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1400c4960
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1402563f0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400f2dd0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
movzx ebp, r9w
mov qword [rdi], 0
mov r12d, r8d
mov r13d, edx
mov byte [r14], 0
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rsi, rax
test rax, rax
je 0x1400f2eaa
cmp word [rax + 0x10], 2
mov qword [rsp + 0x40], rbx
jne 0x1400f2e6d
cmp word [rax + 0x12], 4
jne 0x1400f2e6d
mov rbx, qword [rax + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400f2e6d
mov r9d, dword [rcx]
movzx r8d, bp
mov edx, r12d
mov ecx, r13d
call fcn.1400f2d20
mov qword [rdi], rax
test rax, rax
je 0x1400f2ea3
mov rcx, qword [rbx + 8]
add rbx, 8
lea rdi, [rax + 0x28]
test rcx, rcx
jne 0x1400f2e42
mov r8, qword [rsi]
mov r9d, 0x400
mov rcx, r14
lea edx, [r9 + 1]
call fcn.1402589fc
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov eax, 8
jmp 0x1400f2e84
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2af9
je 0x1400f2ec1
dec eax
je 0x1400f2ecf
dec eax
je 0x1400f2ec8
dec eax
mov eax, 0x2af9
jmp 0x1400f2e89
mov eax, 0x2afb
jmp 0x1400f2e89
mov eax, 0x2afa
jmp 0x1400f2e89
Function at 0x1400f3740
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1403bd624], 0
lea rax, [0x1400f31b0]
lea rbx, [0x14030dc78]
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x1400f34d0]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
lea rax, [0x14030dc58]
mov qword [rsp + 0x40], rax
lea rax, [fcn.1400f3150]
mov qword [rsp + 0x48], rax
jne 0x1400f3919
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400f390f
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
mov qword [rsp + 0x290], rsi
call fcn.140258998
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.140258d8c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400f383a
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400f389a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.140258998
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.140258d8c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400f3907
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400f389a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400f3907
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1400f38f6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x1400f38b0
mov rax, qword [rsp + 0x28]
mov qword [0x1403b94b0], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1403b94c0], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.1400f3150], rax
jmp 0x1400f38ff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1403bd624], 1
movzx eax, bp
lea rcx, [0x1403b94a8]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140254fb0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x1400f4250
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.1402563f0
sub rsp, rax
cmp dword [0x1403bd7d8], 0
jne 0x1400f4308
lea rcx, [0x1403bd640]
xor edx, edx
mov r8d, 0x198
mov dword [0x1403bd7d8], 1
call fcn.140254810
lea rdx, [0x1403bd640]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400f4308
call fcn.1400baf40
lea r8, str.BIO_sock_init
lea rcx, str.crypto_bio_bio_sock.c
mov edx, __WSAFDIsSet
call fcn.1400bafb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov edx, eax
mov ecx, 2
call fcn.1400bb200
call fcn.1400baf40
lea r8, str.BIO_sock_init
lea rcx, str.crypto_bio_bio_sock.c
mov edx, __WSAFDIsSet
call fcn.1400bafb0
xor r8d, r8d
lea edx, [r8 + 0x7a]
lea ecx, [rdx - 0x5a]
call fcn.1400bb200
or eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400f4350
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov dword [rsp + 0x30], edx
lea r8, [rsp + 0x30]
movsxd rcx, ecx
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x1400f43b2
call fcn.1400baf40
lea r8, str.BIO_socket_ioctl
lea rcx, str.crypto_bio_bio_sock.c
mov edx, 0xd1
call fcn.1400bafb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov edx, eax
mov ecx, 2
call fcn.1400bb200
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x1400f43c0
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x260
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, r8
mov esi, edx
mov edi, ecx
cmp ecx, 0x3f
ja 0x1400f4453
test rbx, rbx
jne 0x1400f43fa
lea eax, [r8 + 1]
jmp 0x1400f4456
xor ecx, ecx
call fcn.140253f10
mov r11, rax
cmp rbx, rax
jge 0x1400f440d
xor eax, eax
jmp 0x1400f4456
xor eax, eax
sub ebx, r11d
test esi, esi
mov dword [rsp + 0x34], eax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x40]
cmovne r8, rax
cmove rdx, rax
lea rax, [rsp + 0x30]
lea ecx, [rdi + 1]
xor r9d, r9d
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], ebx
call qword [sym.imp.WS2_32.dll_select]
jmp 0x1400f4456
or eax, 0xffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400fcec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
mov rbx, rdx
mov rdi, rcx
movsxd r11, r8d
test r8d, r8d
jle 0x1400fcefd
mov r9, rdx
sub rcx, rdx
neg rdx
movzx eax, byte [r9]
cmp byte [rcx + r9], al
jne 0x1400fcefd
inc r9
inc r10d
lea rax, [rdx + r9]
cmp rax, r11
jl 0x1400fcee4
lea edx, [r8 - 1]
movsxd rcx, edx
test edx, edx
js 0x1400fcf28
mov r8, rdi
lea rax, [rcx + rbx]
sub r8, rbx
cmp byte [rax + r8], 0
jne 0x1400fcf28
cmp byte [rax], 0xff
jne 0x1400fcf28
dec edx
dec rax
dec rcx
jns 0x1400fcf12
cmp r10d, edx
jl case.0x1400fcf81.2
jle 0x1400fcf46
lea eax, [r10*8]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
movsxd rax, r10d
movzx r8d, byte [rax + rbx]
movzx r9d, byte [rax + rdi]
movzx edx, r8b
xor dl, r9b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x1400fcf81.2
lea r11, [0x140000000]
cdqe
movzx eax, byte [r11 + rax + 0xfcffc]
mov ecx, dword [r11 + rax*4 + 0xfcfdc]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x1400fcfb2
mov eax, 6
jmp 0x1400fcfb2
mov eax, 5
jmp 0x1400fcfb2
mov eax, 4
jmp 0x1400fcfb2
mov eax, 3
jmp 0x1400fcfb2
mov eax, 2
jmp 0x1400fcfb2
mov eax, 1
test dl, r9b
jne case.0x1400fcf81.2
and r8b, dl
cmp r8b, dl
jne case.0x1400fcf81.2
lea eax, [rax + r10*8]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
or eax, 0xffffffff
ret

Function at 0x14011a9c0
Capabilities:
Encode data using xor

Disassembly:
push rdi
movsxd rdi, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x14011aa74
movsxd rdx, dword [rdx + 8]
mov qword [rsp + 0x10], rbx
lea rbx, [rcx - 1]
not rcx
shr rbx, 0x3f
xor r9d, r9d
shr rcx, 0x3f
and rbx, rcx
movsxd rcx, dword [r8 + 8]
xor rcx, rdx
dec rbx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 8], edx
xor dword [r8 + 8], ecx
movsxd rdx, dword [r11 + 0x10]
movsxd rcx, dword [r8 + 0x10]
xor rcx, rdx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 0x10], edx
xor dword [r8 + 0x10], ecx
mov ecx, dword [r11 + 0x14]
mov eax, dword [r8 + 0x14]
xor rax, rcx
and eax, 4
and rax, rbx
xor ecx, eax
mov dword [r11 + 0x14], ecx
xor dword [r8 + 0x14], eax
test rdi, rdi
jle 0x14011aa6f
mov rax, qword [r10]
mov r8, qword [r11]
inc r9
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r10]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rdi
jl 0x14011aa41
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x14013a5e0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x14013a605
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
inc rcx
xor dl, al
or r9b, dl
dec r8
jne 0x14013a5f0
movzx eax, r9b
ret

Function at 0x14013e1b0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, gethostbyname
call fcn.1402563f0
sub rsp, rax
mov r14, rdx
mov r13, r8
mov rbp, rcx
mov r15d, 0x20
lea rdx, str.enginese_capi.c
mov r8d, 0x5e2
mov ecx, r15d
mov r12d, r9d
call fcn.1400b4570
mov rsi, rax
test rax, rax
jne 0x14013e20d
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov qword [rsp + 0x68], rdi
cmp r12d, 1
jne 0x14013e253
cmp dword [0x1403bd900], 0
je 0x14013e253
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov rax, r13
sub r8, r13
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14013e244
add rax, 2
test ecx, ecx
jne 0x14013e230
test edx, edx
jne 0x14013e253
lea r13, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea r12d, [rdx + 0x18]
mov qword [rsp + 0x60], rbx
test rbp, rbp
je 0x14013e2c4
cmp dword [rbp], 2
jl 0x14013e2c4
cmp qword [rbp + 8], 0
je 0x14013e2c4
mov rcx, r14
call fcn.14013cbf0
mov rcx, r13
mov rdi, rax
call fcn.14013cbf0
lea rdx, str.capi_get_key__contname_s__provname_s__type_d_n
mov r8, rdi
mov rcx, rbp
mov r9, rax
mov rbx, rax
mov dword [rsp + 0x20], r12d
call fcn.14013cb50
lea rdx, str.enginese_capi.c
mov r8d, 0x5f6
mov rcx, rbx
call fcn.1400b4640
lea rdx, str.enginese_capi.c
mov r8d, 0x5f7
mov rcx, rdi
call fcn.1400b4640
test dword [rbp + 0x38], 0x20000
mov eax, 0
lea rcx, [rsi + 8]
cmovne eax, r15d
mov r9d, r12d
mov r8, r13
mov rdx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14013e34c
cmp dword [0x1403bd8e8], eax
jne 0x14013e302
call fcn.1400a4a30
mov dword [0x1403bd8e8], eax
call fcn.1400baf40
lea r8, str.ERR_CAPI_error
lea rcx, str.f:downloadsopenssl_3.0.13enginese_capi_err.c
mov edx, 0x5c
call fcn.1400bafb0
mov ecx, dword [0x1403bd8e8]
xor r8d, r8d
lea edx, [r8 + 0x68]
call fcn.1400bb200
lea rcx, str.enginese_capi.c
xor r8d, r8d
mov edx, 0x5fd
call fcn.1400bafb0
call fcn.14013d6c0
jmp 0x14013e38d
mov ebx, dword [rsp + 0x80]
mov rcx, qword [rsi + 8]
lea r8, [rsi + 0x10]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x14013e3a6
lea rdx, str.enginese_capi.c
lea ecx, [rax + 0x75]
mov r8d, 0x602
call fcn.14013c8c0
call fcn.14013d6c0
mov rcx, qword [rsi + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, str.enginese_capi.c
mov r8d, 0x60c
mov rcx, rsi
call fcn.1400b4640
xor eax, eax
jmp 0x14013e3b3
mov dword [rsi + 0x18], ebx
mov qword [rsi], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x140149340
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, gethostbyname
call fcn.1402563f0
sub rsp, rax
movsxd rdi, ecx
mov ebx, r8d
mov rsi, rdx
mov dword [rsp + 0x40], 1
cmp edi, 0xffffffff
jne 0x1401493ab
call fcn.1400baf40
lea r8, str.BIO_connect
lea edx, [rdi + 0x55]
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.1400bafb0
lea ecx, [rdi + 0x21]
xor r8d, r8d
mov edx, 0x87
call fcn.1400bb200
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, ebx
mov ecx, edi
shr edx, 3
and edx, 1
call fcn.1400f4350
test eax, eax
je 0x140149399
test bl, 4
je 0x140149461
lea r9, [rsp + 0x40]
mov rcx, rdi
mov edx, 0xffff
mov r8d, 8
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140149461
call fcn.1400baf40
lea r8, str.BIO_connect
lea rcx, str.crypto_bio_bio_sock2.c
mov edx, 0x5e
call fcn.1400bafb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.1400bb200
call fcn.1400baf40
lea r8, str.BIO_connect
lea rcx, str.crypto_bio_bio_sock2.c
mov edx, 0x60
call fcn.1400bafb0
mov edx, 0x89
xor r8d, r8d
lea ecx, [rdx - 0x69]
call fcn.1400bb200
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test bl, 0x10
je 0x140149502
mov edx, 6
lea r9, [rsp + 0x40]
mov rcx, rdi
lea r8d, [rdx - 5]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140149502
call fcn.1400baf40
lea r8, str.BIO_connect
lea rcx, str.crypto_bio_bio_sock2.c
mov edx, 0x68
call fcn.1400bafb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.1400bb200
call fcn.1400baf40
lea r8, str.BIO_connect
lea rcx, str.crypto_bio_bio_sock2.c
mov edx, 0x6a
call fcn.1400bafb0
mov edx, 0x8a
xor r8d, r8d
lea ecx, [rdx - 0x6a]
call fcn.1400bb200
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rsi
call fcn.1400f3950
mov rcx, rsi
mov ebx, eax
call fcn.14020d7c0
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1401495a7
or ecx, eax
call fcn.1400caaf0
test eax, eax
jne 0x140149595
call fcn.1400baf40
lea r8, str.BIO_connect
lea rcx, str.crypto_bio_bio_sock2.c
mov edx, WSAStartup
call fcn.1400bafb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_connect__
mov edx, eax
mov ecx, 2
call fcn.1400bb200
call fcn.1400baf40
lea r8, str.BIO_connect
lea rcx, str.crypto_bio_bio_sock2.c
mov edx, reloc.WS2_32.dll_WSACleanup
call fcn.1400bafb0
xor r8d, r8d
lea edx, [r8 + 0x67]
lea ecx, [rdx - 0x47]
call fcn.1400bb200
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140152770
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x170
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r13, qword [rsp + 0x1d0]
xor ebp, ebp
mov rdi, r9
movsxd rbx, r8d
mov r12, rdx
mov rsi, rcx
mov r14d, ebp
test r9, r9
je 0x1401527d3
cmp r9, qword [rcx]
je 0x1401527ce
test rdx, rdx
je 0x1401527c7
test r8d, r8d
jns 0x1401527ce
xor eax, eax
jmp 0x1401529b3
mov qword [rcx], r9
jmp 0x1401527db
mov rdi, qword [rcx]
test rdi, rdi
je 0x1401527c7
mov rcx, rdi
call fcn.1400c6d80
test al, 2
jne 0x1401527c7
mov qword [rsp + 0x168], r15
mov r15d, 1
test r12, r12
je 0x140152970
mov rcx, rdi
mov r14d, r15d
call fcn.1400c6ce0
cmp eax, 0x90
jg 0x1401529d5
test eax, eax
js 0x1401529d5
cmp eax, ebx
jge 0x14015286f
mov rcx, qword [rsi + 8]
mov r8, r13
mov rdx, rdi
call fcn.1400b4410
test eax, eax
je 0x1401529d5
mov rcx, qword [rsi + 8]
mov r8, rbx
mov rdx, r12
call fcn.1400b25a0
test eax, eax
je 0x1401529d5
mov rcx, qword [rsi + 8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call fcn.1400b26c0
test eax, eax
je 0x1401529d5
mov ebx, dword [rsp + 0x20]
jmp 0x14015288f
cmp ebx, 0x90
ja 0x1401529d5
lea rcx, [rsp + 0x30]
mov r8, rbx
mov rdx, r12
call fcn.140255100
mov dword [rsp + 0x20], ebx
cmp ebx, 0x90
je 0x1401528ae
mov eax, ebx
mov r8d, 0x90
xor edx, edx
lea rcx, [rsp + rax + 0x30]
sub r8d, ebx
call fcn.140254810
mov rcx, rbp
movzx eax, byte [rsp + rcx + 0x30]
add rcx, 2
xor al, 0x36
mov byte [rsp + rcx + 0xbe], al
movzx eax, byte [rsp + rcx + 0x2f]
xor al, 0x36
mov byte [rsp + rcx + 0xbf], al
cmp rcx, 0x90
jl 0x1401528b1
mov rcx, qword [rsi + 0x10]
mov r8, r13
mov rdx, rdi
call fcn.1400b4410
test eax, eax
je 0x140152988
mov rcx, rdi
call fcn.1400c6ce0
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0xc0]
movsxd r8, eax
call fcn.1400b25a0
test eax, eax
je 0x140152988
mov rcx, rbp
movzx eax, byte [rsp + rcx + 0x30]
add rcx, 2
xor al, 0x5c
mov byte [rsp + rcx + 0xbe], al
movzx eax, byte [rsp + rcx + 0x2f]
xor al, 0x5c
mov byte [rsp + rcx + 0xbf], al
cmp rcx, 0x90
jl 0x140152914
mov rcx, qword [rsi + 0x18]
mov r8, r13
mov rdx, rdi
call fcn.1400b4410
test eax, eax
je 0x140152988
mov rcx, rdi
call fcn.1400c6ce0
mov rcx, qword [rsi + 0x18]
lea rdx, [rsp + 0xc0]
movsxd r8, eax
call fcn.1400b25a0
test eax, eax
je 0x140152988
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 8]
call fcn.1400b33b0
test eax, eax
cmovne ebp, r15d
test r14d, r14d
je 0x1401529a9
lea rcx, [rsp + 0x30]
mov edx, 0x90
call fcn.1400f5f80
lea rcx, [rsp + 0xc0]
mov edx, 0x90
call fcn.1400f5f80
mov eax, ebp
mov r15, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x170
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x1401529ab
Function at 0x140154cc0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
lea edx, [rax - 0x1f]
mov rdi, rcx
call fcn.140156010
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call fcn.140156260
test rax, rax
je 0x140154d34
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov r8d, esi
lea r9d, [rbx + 2]
mov rdx, rax
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
mov rcx, rdi
test eax, eax
cmove rbx, rsi
mov rdx, rbx
lea r8, [rbx*8]
call fcn.140156310
mov rcx, rdi
call fcn.140155e60
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x140154d3c
mov rcx, rdi
call fcn.140155e60
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14015a650
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r10, rdx
test rcx, rcx
je 0x14015a66c
test byte [rcx + 0x5c], 2
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x14015a673
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r9d, r9d
jle 0x14015a75f
inc r8
nop
movzx ecx, byte [r8 - 1]
cmp r9d, 3
jl 0x14015a6e3
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 2], al
movzx eax, byte [rdx + r11]
mov byte [r10 + 3], al
jmp 0x14015a73b
shl ecx, 0x10
cmp r9d, 2
jne 0x14015a6f5
movzx eax, byte [r8]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 1], al
cmp r9d, 1
jne 0x14015a726
lea eax, [r9 + 0x3c]
jmp 0x14015a732
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r11]
mov byte [r10 + 2], al
mov byte [r10 + 3], 0x3d
sub r9d, 3
add r10, 4
add ebx, 4
add r8, 3
test r9d, r9d
jg 0x14015a680
mov byte [r10], 0
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
mov byte [rdx], bl
mov eax, ebx
mov rbx, qword [rsp + 8]
ret