joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008fa00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x78
call fcn.14028b850
sub rsp, rax
mov eax, dword [rsp + 0x90]
cdq
and edx, 0x3f
add eax, edx
sar eax, 6
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 8]
cmp dword [rsp + 0x38], eax
jl 0x14008fa58
mov rcx, qword [rsp + 0x80]
call fcn.14008b260
mov eax, 1
jmp 0x14008fbf7
xor edx, edx
mov eax, dword [rsp + 0x90]
mov ecx, 0x40
div ecx
mov dword [rsp + 0x48], edx
mov eax, 0x40
sub eax, dword [rsp + 0x48]
mov dword [rsp + 0x60], eax
xor edx, edx
mov eax, dword [rsp + 0x60]
mov ecx, 0x40
div ecx
mov dword [rsp + 0x60], edx
mov ecx, dword [rsp + 0x60]
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
shr rcx, 8
mov rax, qword [rsp + 0x28]
or rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rax + 8]
sub eax, ecx
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x80], rax
je 0x14008faf2
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x80]
call fcn.14008b680
test rax, rax
jne 0x14008faf2
xor eax, eax
jmp 0x14008fbf7
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
movsxd rcx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
lea rax, [rax + rcx*8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x14008fb3d
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x3c]
sub eax, 1
cmp dword [rsp + 0x20], eax
jge 0x14008fba2
mov eax, dword [rsp + 0x20]
add eax, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x48]
movzx ecx, al
mov rdx, qword [rsp + 0x40]
shr rdx, cl
mov eax, dword [rsp + 0x60]
movzx ecx, al
mov rax, qword [rsp + 0x58]
shl rax, cl
and rax, qword [rsp + 0x28]
or rdx, rax
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x50]
mov qword [rax + rcx*8], rdx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
jmp 0x14008fb32
mov eax, dword [rsp + 0x48]
movzx ecx, al
mov rdx, qword [rsp + 0x40]
shr rdx, cl
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x50]
mov qword [rax + rcx*8], rdx
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x10]
mov dword [rcx + 0x10], eax
mov rcx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x3c]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, 1
add rsp, 0x78
ret

Function at 0x140095910
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x28
call fcn.14028b850
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov r11d, eax
mov rax, qword [rsp + 0x30]
mov dword [rax], r11d
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0xffffffff
jne 0x140095946
xor eax, eax
jmp 0x14009594b
mov eax, 1
add rsp, 0x28
ret
Function at 0x140095b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x28
call fcn.14028b850
sub rsp, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov byte [rsp], 0
mov qword [rsp + 0x10], 0
jmp 0x140095b9d
mov rax, qword [rsp + 0x10]
add rax, 1
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x10], rax
jae 0x140095bde
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
add rax, rcx
movzx eax, byte [rax]
movzx edx, al
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
add rax, rcx
movzx eax, byte [rax]
movzx eax, al
mov ecx, edx
xor ecx, eax
movzx eax, byte [rsp]
or eax, ecx
mov byte [rsp], al
jmp 0x140095b8f
movzx eax, byte [rsp]
add rsp, 0x28
ret
Function at 0x1400a4be0
Capabilities:
Resolve dns

Disassembly:
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.14028b850
sub rsp, rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov rax, qword [rsp + 0x70]
mov byte [rax], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400a4d01
mov rax, qword [rsp + 0x28]
movsx eax, word [rax + 0x10]
cmp eax, 2
jne 0x1400a4ce0
mov rax, qword [rsp + 0x28]
movsx rax, word [rax + 0x12]
cmp rax, 4
jne 0x1400a4ce0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x1400a4c84
mov rax, qword [rsp + 0x20]
add rax, 8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax], 0
je 0x1400a4ce0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
call fcn.1400a48d0
mov r11, rax
mov rax, qword [rsp + 0x30]
mov qword [rax], r11
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x1400a4ccd
mov eax, 8
jmp 0x1400a4d56
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov qword [rsp + 0x30], rax
jmp 0x1400a4c76
mov r9d, 0x400
mov r8, qword [rsp + 0x28]
mov r8, qword [r8]
mov edx, 0x401
mov rcx, qword [rsp + 0x70]
call sub.MSVCR90.dll_strncpy_s
xor eax, eax
jmp 0x1400a4d56
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0x2af9
je 0x1400a4d35
cmp dword [rsp + 0x38], 0x2afa
je 0x1400a4d3c
cmp dword [rsp + 0x38], 0x2afb
je 0x1400a4d43
cmp dword [rsp + 0x38], 0x2afc
je 0x1400a4d4a
jmp 0x1400a4d51
mov eax, 0x2af9
jmp 0x1400a4d56
mov eax, 0x2afa
jmp 0x1400a4d56
mov eax, 0x2afb
jmp 0x1400a4d56
mov eax, 0x2af9
jmp 0x1400a4d56
mov eax, 0x2af9
add rsp, 0x48
ret
Function at 0x1400a61f0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.14028b850
sub rsp, rax
cmp dword [0x1403764a8], 0
jne 0x1400a62a9
mov dword [0x1403764a8], 1
mov r8d, 0x198
xor edx, edx
lea rcx, [0x140376310]
call sub.MSVCR90.dll_memset
lea rdx, [0x140376310]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400a62a9
call fcn.140088000
lea r8, str.BIO_sock_init
mov edx, 0x94
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock.c
call fcn.1400881c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov edx, eax
mov ecx, 2
call fcn.140088360
call fcn.140088000
lea r8, str.BIO_sock_init
mov edx, 0x96
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x7a
mov ecx, 0x20
call fcn.140088360
mov eax, 0xffffffff
jmp 0x1400a62ae
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400a62f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14028b850
sub rsp, rax
movsxd rcx, dword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1400a635f
call fcn.140088000
lea r8, str.BIO_socket_ioctl
mov edx, 0xd1
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock.c
call fcn.1400881c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov edx, eax
mov ecx, 2
call fcn.140088360
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1400a63e0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
mov eax, 0x278
call fcn.14028b850
sub rsp, rax
cmp dword [rsp + 0x280], 0
jl 0x1400a640e
cmp dword [rsp + 0x280], 0x40
jl 0x1400a6418
mov eax, 0xffffffff
jmp 0x1400a656f
cmp qword [rsp + 0x290], 0
jne 0x1400a642d
mov eax, 1
jmp 0x1400a656f
xor ecx, ecx
call fcn.1400784b0
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x250]
cmp qword [rsp + 0x290], rax
jge 0x1400a6455
xor eax, eax
jmp 0x1400a656f
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x258], 0
jmp 0x1400a647b
mov eax, dword [rsp + 0x258]
add eax, 1
mov dword [rsp + 0x258], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x258], eax
jae 0x1400a64a1
mov ecx, dword [rsp + 0x258]
mov eax, dword [rsp + 0x280]
cmp qword [rsp + rcx*8 + 0x48], rax
jne 0x1400a649f
jmp 0x1400a64a1
jmp 0x1400a646a
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x258], eax
jne 0x1400a64d3
cmp dword [rsp + 0x40], 0x40
jae 0x1400a64d3
mov ecx, dword [rsp + 0x258]
mov eax, dword [rsp + 0x280]
mov qword [rsp + rcx*8 + 0x48], rax
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
xor eax, eax
test eax, eax
jne 0x1400a645d
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x250]
mov rax, qword [rsp + 0x290]
sub rax, rcx
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x288], 0
je 0x1400a6510
mov qword [rsp + 0x260], 0
jmp 0x1400a651d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x260], rax
cmp dword [rsp + 0x288], 0
je 0x1400a6536
lea rax, [rsp + 0x40]
mov qword [rsp + 0x268], rax
jmp 0x1400a6542
mov qword [rsp + 0x268], 0
mov ecx, dword [rsp + 0x280]
add ecx, 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x268]
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x278
ret
Function at 0x1400bcab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x18
call fcn.14028b850
sub rsp, rax
movzx eax, byte [rsp + 0x38]
and eax, 1
mov dword [rsp], eax
cmp qword [rsp + 0x30], 0
je 0x1400bcb08
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
add rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
sub rax, 1
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x1400bcb69
mov rax, qword [rsp + 0x28]
sub rax, 1
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rax]
movzx eax, byte [rsp + 0x38]
xor ecx, eax
mov eax, dword [rsp]
add eax, ecx
mov dword [rsp], eax
mov rax, qword [rsp + 0x20]
sub rax, 1
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rsp]
mov byte [rcx], al
mov eax, dword [rsp]
shr eax, 8
mov dword [rsp], eax
jmp 0x1400bcb08
add rsp, 0x18
ret
Function at 0x1400d4290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x18
call fcn.14028b850
sub rsp, rax
mov dword [rsp], 0
jmp 0x1400d42be
mov eax, dword [rsp]
add eax, 1
mov dword [rsp], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp], eax
jge 0x1400d42e7
movsxd rcx, dword [rsp]
mov rax, qword [rsp + 0x20]
movzx edx, byte [rax + rcx]
movsxd rcx, dword [rsp]
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + rcx]
cmp edx, eax
jne 0x1400d42e7
jmp 0x1400d42b5
mov eax, dword [rsp + 0x30]
sub eax, 1
mov dword [rsp + 8], eax
jmp 0x1400d42ff
mov eax, dword [rsp + 8]
sub eax, 1
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x1400d432f
movsxd rcx, dword [rsp + 8]
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + rcx]
test eax, eax
jne 0x1400d432f
movsxd rcx, dword [rsp + 8]
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + rcx]
cmp eax, 0xff
jne 0x1400d432f
jmp 0x1400d42f4
mov eax, dword [rsp + 8]
cmp dword [rsp], eax
jge 0x1400d4342
mov eax, 0xffffffff
jmp 0x1400d4448
mov eax, dword [rsp + 8]
cmp dword [rsp], eax
jle 0x1400d4356
mov eax, dword [rsp]
shl eax, 3
jmp 0x1400d4448
movsxd rcx, dword [rsp]
mov rax, qword [rsp + 0x20]
movzx edx, byte [rax + rcx]
movsxd rcx, dword [rsp]
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rax + rcx]
mov eax, edx
xor eax, ecx
mov byte [rsp + 4], al
movzx eax, byte [rsp + 4]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
sub eax, 1
mov dword [rsp + 0xc], eax
cmp dword [rsp + 0xc], 0x7e
ja case.0x1400d43b1.2
movsxd rax, dword [rsp + 0xc]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0xd4470]
mov eax, dword [rcx + rax*4 + 0xd4450]
add rax, rcx
jmp rax
mov dword [rsp + 8], 7
jmp 0x1400d4400
mov dword [rsp + 8], 6
jmp 0x1400d4400
mov dword [rsp + 8], 5
jmp 0x1400d4400
mov dword [rsp + 8], 4
jmp 0x1400d4400
mov dword [rsp + 8], 3
jmp 0x1400d4400
mov dword [rsp + 8], 2
jmp 0x1400d4400
mov dword [rsp + 8], 1
jmp 0x1400d4400
mov eax, 0xffffffff
jmp 0x1400d4448
movsxd rcx, dword [rsp]
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + rcx]
movzx ecx, byte [rsp + 4]
and eax, ecx
test eax, eax
jne 0x1400d4435
movsxd rcx, dword [rsp]
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rax + rcx]
movzx eax, byte [rsp + 4]
and ecx, eax
movzx eax, byte [rsp + 4]
cmp ecx, eax
je 0x1400d443e
mov eax, 0xffffffff
jmp 0x1400d4448
mov ecx, dword [rsp + 8]
mov eax, dword [rsp]
lea eax, [rcx + rax*8]
add rsp, 0x18
ret
Function at 0x140107d70
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x68
call fcn.14028b850
sub rsp, rax
mov qword [rsp + 0x38], 0
mov edx, 1
mov rcx, qword [rsp + 0x70]
call fcn.1401082f0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.140108800
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140107e40
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140107e19
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140107e0c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x50]
shl r8, 3
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
call fcn.1401088e0
mov rcx, qword [rsp + 0x70]
call fcn.140108270
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x140107e52
mov rax, qword [rsp + 0x38]
jmp 0x140107f24
mov edx, 1
mov rcx, qword [rsp + 0x70]
call fcn.1401082f0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.140108800
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140107f0b
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x20], 0xf0000040
mov r9d, reloc.WS2_32.dll_shutdown
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140107ee4
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140107ed7
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x58]
shl r8, 3
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
call fcn.1401088e0
mov rcx, qword [rsp + 0x70]
call fcn.140108270
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x140107f1a
mov rax, qword [rsp + 0x38]
jmp 0x140107f24
mov rcx, qword [rsp + 0x70]
call fcn.140108270
add rsp, 0x68
ret
Function at 0x14012a590
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbx
mov eax, 0x40
call fcn.14028b850
sub rsp, rax
mov dword [rsp + 0x30], 1
cmp dword [rsp + 0x50], 0xffffffff
jne 0x14012a5f1
call fcn.140088000
lea r8, str.BIO_connect
mov edx, 0x54
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x87
mov ecx, 0x20
call fcn.140088360
xor eax, eax
jmp 0x14012a812
mov eax, dword [rsp + 0x60]
and eax, 8
test eax, eax
je 0x14012a606
mov dword [rsp + 0x34], 1
jmp 0x14012a60e
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x50]
call fcn.1400a6370
test eax, eax
jne 0x14012a626
xor eax, eax
jmp 0x14012a812
mov eax, dword [rsp + 0x60]
and eax, 4
test eax, eax
je 0x14012a6c8
movsxd rcx, dword [rsp + 0x50]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 8
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14012a6c8
call fcn.140088000
lea r8, str.BIO_connect
mov edx, 0x5e
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.1400881c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.140088360
call fcn.140088000
lea r8, str.BIO_connect
mov edx, 0x60
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x89
mov ecx, 0x20
call fcn.140088360
xor eax, eax
jmp 0x14012a812
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
je 0x14012a76a
movsxd rcx, dword [rsp + 0x50]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 1
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14012a76a
call fcn.140088000
lea r8, str.BIO_connect
mov edx, 0x68
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.1400881c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov edx, eax
mov ecx, 2
call fcn.140088360
call fcn.140088000
lea r8, str.BIO_connect
mov edx, 0x6a
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 0x20
call fcn.140088360
xor eax, eax
jmp 0x14012a812
mov rcx, qword [rsp + 0x58]
call fcn.1400a5220
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call fcn.14006e1e0
movsxd rcx, dword [rsp + 0x50]
mov r8d, ebx
mov rdx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14012a80d
mov ecx, 0xffffffff
call fcn.14012ac70
test eax, eax
jne 0x14012a809
call fcn.140088000
lea r8, str.BIO_connect
mov edx, WSAStartup
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.1400881c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_connect__
mov edx, eax
mov ecx, 2
call fcn.140088360
call fcn.140088000
lea r8, str.BIO_connect
mov edx, reloc.WS2_32.dll_WSACleanup
lea rcx, str.....Srcopenssl_3.0.12crypto_bio_bio_sock2.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x67
mov ecx, 0x20
call fcn.140088360
xor eax, eax
jmp 0x14012a812
mov eax, 1
add rsp, 0x40
pop rbx
ret
Function at 0x14012a9c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14028b850
sub rsp, rax
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r11, qword [rsp + 0x40]
movsxd rcx, dword [r11 + 0x38]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x40]
call fcn.1400654e0
cmp dword [rsp + 0x20], 0
jg 0x14012aa3e
mov ecx, dword [rsp + 0x20]
call fcn.14012ac70
test eax, eax
je 0x14012aa3e
mov edx, 0xa
mov rcx, qword [rsp + 0x40]
call fcn.140065530
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14014f060
Capabilities:
Hash data using sha224

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x28
call fcn.14028b850
sub rsp, rax
mov r8d, reloc.WS2_32.dll_WSASetLastError
xor edx, edx
mov rcx, qword [rsp + 0x30]
call sub.MSVCR90.dll_memset
mov r11, qword [rsp + 0x30]
mov dword [r11], 0xc1059ed8
mov rax, qword [rsp + 0x30]
mov dword [rax + 4], 0x367cd507
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 0x3070dd17
mov rax, qword [rsp + 0x30]
mov dword [rax + 0xc], 0xf70e5939
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x10], 0xffc00b31
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x14], 0x68581511
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x18], 0x64f98fa7
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x1c], 0xbefa4fa4
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x6c], 0x1c
mov eax, 1
add rsp, 0x28
ret

Function at 0x14014f100
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x28
call fcn.14028b850
sub rsp, rax
mov r8d, reloc.WS2_32.dll_WSASetLastError
xor edx, edx
mov rcx, qword [rsp + 0x30]
call sub.MSVCR90.dll_memset
mov r11, qword [rsp + 0x30]
mov dword [r11], 0x6a09e667
mov rax, qword [rsp + 0x30]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rsp + 0x30]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x1c], 0x5be0cd19
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x6c], 0x20
mov eax, 1
add rsp, 0x28
ret
Function at 0x140153610
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 8]
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
mov rcx, qword [rsp + 8]
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov rax, qword [rsp + 8]
mov qword [rax + 0x40], 0
mov rax, qword [rsp + 8]
mov qword [rax + 0x48], 0
mov rax, qword [rsp + 8]
mov dword [rax + 0xd0], 0
mov rax, qword [rsp + 8]
mov dword [rax + 0xd4], getservbyname
mov eax, 1
ret

Function at 0x1401536f0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 8]
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
mov rcx, qword [rsp + 8]
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
mov rcx, qword [rsp + 8]
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
mov rcx, qword [rsp + 8]
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
mov rax, qword [rsp + 8]
mov qword [rax + 0x40], 0
mov rax, qword [rsp + 8]
mov qword [rax + 0x48], 0
mov rax, qword [rsp + 8]
mov dword [rax + 0xd0], 0
mov rax, qword [rsp + 8]
mov dword [rax + 0xd4], 0x40
mov eax, 1
ret