joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002d56
Capabilities:
Hash data using sha512

Disassembly:
jmp 0x180158560
push rbx
mov eax, 0x110
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rsp + 0x100], rax
test r8, r8
mov dword [rsp + 0xf4], 0x40
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x180298240]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rdx, rcx
movabs rax, 0x3c6ef372fe94f82b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call sym.libcrypto_1_1_x64.dll_SHA512_Update
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.libcrypto_1_1_x64.dll_SHA512_Final
mov edx, 0xd8
lea rcx, [rsp + 0x20]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800028c4
add rsp, 0x110
pop rbx
ret
Function at 0x180003594
Capabilities:
Set socket configuration

Disassembly:
jmp 0x18003e150
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, gethostbyname
call fcn.180001055
sub rsp, rax
movsxd rbx, ecx
mov edi, r8d
mov dword [rsp + 0x40], 1
mov rbp, rdx
cmp ebx, 0xffffffff
jne 0x18003e1ae
lea r9, str.crypto_bio_b_sock2.c
mov dword [rsp + 0x20], 0x52
lea edx, [rax + 0x5a]
lea ecx, [rax - 0x10]
lea r8d, [rax + 0x57]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov edx, edi
mov qword [rsp + 0x48], rsi
shr edx, 3
mov ecx, ebx
and edx, 1
call sym.libcrypto_1_1_x64.dll_BIO_socket_nbio
test eax, eax
je 0x18003e23d
mov rsi, rbx
test dil, 4
je 0x18003e254
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x18003e254
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, recv
mov dword [rsp + 0x20], 0x5c
mov r8d, eax
lea r9, str.crypto_bio_b_sock2.c
lea ecx, [rdx - 0xc]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov edx, 0x8a
mov dword [rsp + 0x20], 0x5d
lea r9, str.crypto_bio_b_sock2.c
lea ecx, [rdx - 0x6a]
lea r8d, [rdx - 1]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test dil, 0x10
je 0x18003e2c1
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
mov rcx, rsi
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x18003e2c1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, recv
mov dword [rsp + 0x20], 0x65
mov r8d, eax
lea r9, str.crypto_bio_b_sock2.c
lea ecx, [rdx - 0xc]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov edx, 0x8a
mov dword [rsp + 0x20], 0x66
lea r9, str.crypto_bio_b_sock2.c
mov r8d, edx
lea ecx, [rdx - 0x6a]
jmp 0x18003e238
mov rcx, rbp
call fcn.18000598e
mov rcx, rbp
mov ebx, eax
call fcn.180002941
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18003e33a
mov ecx, eax
call sym.libcrypto_1_1_x64.dll_BIO_sock_should_retry
test eax, eax
jne 0x18003e23d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov dword [rsp + 0x20], WSAStartup
mov ecx, edx
lea r9, str.crypto_bio_b_sock2.c
mov r8d, eax
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov edx, 0x8a
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSAGetLastError
lea r9, str.crypto_bio_b_sock2.c
lea ecx, [rdx - 0x6a]
lea r8d, [rdx - 0x23]
jmp 0x18003e238
mov eax, 1
jmp 0x18003e23f
Function at 0x18000371f
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x18016e7d0
mov eax, 0x28
call fcn.180001055
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800038cd
Capabilities:
Generate random numbers via winapi

Disassembly:
jmp 0x18013cba0
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.180001055
sub rsp, rax
lea edx, [rax - 0x1f]
mov rdi, rcx
call fcn.1800027ac
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call fcn.180003aad
test rax, rax
je 0x18013cc14
mov qword [rsp + 0x30], rbx
mov r8d, esi
xor ebx, ebx
mov rdx, rax
xor ecx, ecx
lea r9d, [rbx + 2]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
mov rcx, rdi
cmove rbx, rsi
mov rdx, rbx
lea r8, [rbx*8]
call fcn.180004f16
mov rcx, rdi
call fcn.18000620d
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x18013cc1c
mov rcx, rdi
call fcn.18000620d
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180003d5f
Capabilities:
Write file on windows

Disassembly:
jmp 0x18013d360
push rbx
mov eax, 0x470
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea rdx, [rsp + 0x30]
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
js 0x18013d3dd
mov eax, 0x8000
test word [rsp + 0x36], ax
jne 0x18013d3dd
mov edx, reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x20], 0xb7
lea r9, str.crypto_rand_randfile.c
lea ecx, [rdx - 0x4c]
lea r8d, [rdx + 0xa]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov r8, rbx
lea rdx, str.Filename
mov ecx, 2
call sym.libcrypto_1_1_x64.dll_ERR_add_error_data
mov eax, 0xffffffff
jmp 0x18013d491
mov edx, 0x400
lea rcx, [rsp + 0x60]
call sym.libcrypto_1_1_x64.dll_RAND_priv_bytes
cmp eax, 1
jne 0x18013d3d3
lea rdx, [0x18022fabc]
mov qword [rsp + 0x488], rdi
mov rcx, rbx
call fcn.180005475
mov rdi, rax
test rax, rax
jne 0x18013d445
lea r9, str.crypto_rand_randfile.c
mov dword [rsp + 0x20], 0xe9
lea edx, [rax + 0x70]
lea ecx, [rax + 0x24]
lea r8d, [rax + 0x79]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov r8, rbx
lea rdx, str.Filename
lea ecx, [rdi + 2]
call sym.libcrypto_1_1_x64.dll_ERR_add_error_data
lea eax, [rdi - 1]
jmp 0x18013d489
mov edx, 0x180
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
mov r9, rdi
lea rcx, [rsp + 0x60]
mov edx, 1
mov r8d, 0x400
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov edx, 0x400
lea rcx, [rsp + 0x60]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov eax, ebx
mov rdi, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800028c4
add rsp, 0x470
pop rbx
ret
Function at 0x180003dff
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x1801565b0
xor eax, eax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x58], rax
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov eax, 1
mov dword [rcx], 0xc1059ed8
mov dword [rcx + 4], 0x367cd507
mov dword [rcx + 8], 0x3070dd17
mov dword [rcx + 0xc], 0xf70e5939
mov dword [rcx + 0x10], 0xffc00b31
mov dword [rcx + 0x14], 0x68581511
mov dword [rcx + 0x18], 0x64f98fa7
mov dword [rcx + 0x1c], 0xbefa4fa4
mov dword [rcx + 0x6c], 0x1c
ret

Function at 0x180004188
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180154450
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x20
call fcn.180001055
sub rsp, rax
mov rsi, r9
mov rbp, r9
shr rsi, 3
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp r8, r9
jb 0x180154510
nop
xor edx, edx
test rsi, rsi
je 0x180154500
nop word [rax + rax]
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx]
shl rcx, 8
add rbx, 8
or rcx, rax
xor qword [r14 + rdx*8], rcx
inc rdx
cmp rdx, rsi
jb 0x1801544a0
mov rcx, r14
call fcn.180153a80
sub rdi, rbp
cmp rdi, rbp
jae 0x180154490
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800041c9
Capabilities:
Read file on windows

Disassembly:
jmp 0x18013d0b0
push rbx
push rbp
push r14
mov eax, 0x570
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rsp + 0x560], rax
xor ebp, ebp
mov ebx, edx
mov r14, rcx
test edx, edx
jne 0x18013d0e6
xor eax, eax
jmp 0x18013d2af
lea rdx, [0x1801def64]
mov qword [rsp + 0x5a0], rsi
call fcn.180005475
mov rsi, rax
test rax, rax
jne 0x18013d13a
lea r9, str.crypto_rand_randfile.c
mov dword [rsp + 0x20], 0x62
lea edx, [rax + 0x6f]
lea ecx, [rax + 0x24]
lea r8d, [rax + 0x79]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov r8, r14
lea rdx, str.Filename
lea ecx, [rsi + 2]
call sym.libcrypto_1_1_x64.dll_ERR_add_error_data
lea eax, [rsi - 1]
jmp 0x18013d2a7
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
test eax, eax
jns 0x18013d19b
mov edx, reloc.WS2_32.dll_WSAGetLastError
mov dword [rsp + 0x20], WSAGetLastError
lea r9, str.crypto_rand_randfile.c
lea ecx, [rdx - 0x4b]
lea r8d, [rdx + 2]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov r8, r14
lea rdx, str.Filename
mov ecx, 2
call sym.libcrypto_1_1_x64.dll_ERR_add_error_data
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 0xffffffff
jmp 0x18013d2a7
mov qword [rsp + 0x5a8], rdi
test ebx, ebx
jns 0x18013d1bb
mov eax, 0x8000
mov ebx, 0x100
test word [rsp + 0x36], ax
cmovne ebx, dword [rsp + 0x44]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_setbuf]
test ebx, ebx
jle 0x18013d1da
cmp ebx, 0x500
mov eax, 0x400
cmovle eax, ebx
jmp 0x18013d1df
mov eax, 0x500
movsxd r8, eax
lea rcx, [rsp + 0x60]
mov r9, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x18013d21f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x18013d21f
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
test edi, edi
je 0x18013d1c6
jmp 0x18013d223
test edi, edi
je 0x18013d243
movd xmm2, edi
lea rcx, [rsp + 0x60]
cvtdq2pd xmm2, xmm2
mov edx, edi
call sym.libcrypto_1_1_x64.dll_RAND_add
add ebp, edi
test ebx, ebx
jle 0x18013d1da
sub ebx, edi
test ebx, ebx
jg 0x18013d1ca
mov edx, 0x500
lea rcx, [rsp + 0x60]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call sym.libcrypto_1_1_x64.dll_RAND_status
mov rdi, qword [rsp + 0x5a8]
test eax, eax
jne 0x18013d2a5
lea r9, str.crypto_rand_randfile.c
mov dword [rsp + 0x20], 0xa6
lea edx, [rax + 0x6f]
lea ecx, [rax + 0x24]
lea r8d, [rax + 0x76]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov r8, r14
lea rdx, str.Filename
mov ecx, 2
call sym.libcrypto_1_1_x64.dll_ERR_add_error_data
mov eax, 0xffffffff
jmp 0x18013d2a7
mov eax, ebp
mov rsi, qword [rsp + 0x5a0]
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.1800028c4
add rsp, 0x570
pop r14
pop rbp
pop rbx
ret
Function at 0x180004c96
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x180156660
push rbx
mov eax, 0xa0
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
test r8, r8
mov dword [rsp + 0x20], 0x6a09e667
lea rbx, [0x1802981d8]
mov dword [rsp + 0x24], 0xbb67ae85
cmovne rbx, r8
mov dword [rsp + 0x28], 0x3c6ef372
xor eax, eax
mov dword [rsp + 0x2c], 0xa54ff53a
mov r8, rdx
mov qword [rsp + 0x40], rax
mov rdx, rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov dword [rsp + 0x8c], 0x20
call sym.libcrypto_1_1_x64.dll_SHA256_Update
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.libcrypto_1_1_x64.dll_SHA256_Final
mov edx, reloc.WS2_32.dll_WSASetLastError
lea rcx, [rsp + 0x20]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800028c4
add rsp, 0xa0
pop rbx
ret

Function at 0x180004e2b
Capabilities:
Resolve dns

Disassembly:
jmp 0x18003daf0
mov eax, 0x28
call fcn.180001055
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.WS2_32.dll_gethostbyname]

Function at 0x180004f39
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1801b9860
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x1801b98ee
movsxd rax, dword [0x18000003c]
lea rdx, [0x180000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1801b98ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1801b98ee
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1801b98d5
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1801b98cf
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1801b98d7
add rdx, 0x28
jmp 0x1801b98b4
xor edx, edx
test rdx, rdx
jne 0x1801b98e0
xor al, al
jmp 0x1801b98f4
cmp dword [rdx + 0x24], 0
jge 0x1801b98ea
xor al, al
jmp 0x1801b98f4
mov al, 1
jmp 0x1801b98f4
xor al, al
jmp 0x1801b98f4
add rsp, 0x18
ret
Function at 0x180004f7a
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x18003db90
push rbx
mov eax, gethostbyname
call fcn.180001055
sub rsp, rax
movsxd rbx, ecx
test edx, edx
je 0x18003dbcc
lea r9, str.crypto_bio_b_sock.c
mov dword [rsp + 0x20], 0x16b
lea edx, [rax + 0x5d]
lea ecx, [rax - 0x10]
lea r8d, [rax + 0x5c]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, qword [r8]
mov dword [rsp + 0x48], 0x1c
call fcn.180003c8d
mov rdx, rax
lea r8, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x18003dc3f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], 0x160
mov r8d, eax
lea r9, str.crypto_bio_b_sock.c
lea ecx, [rdx - 0xe]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov edx, 0x8d
mov dword [rsp + 0x20], 0x161
lea r9, str.crypto_bio_b_sock.c
lea ecx, [rdx - 0x6d]
lea r8d, [rdx - 9]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
xor eax, eax
add rsp, 0x30
pop rbx
ret
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x1c
jbe 0x18003dc72
mov edx, 0x8d
mov dword [rsp + 0x20], 0x165
lea r9, str.crypto_bio_b_sock.c
lea ecx, [rdx - 0x6d]
lea r8d, [rdx - 8]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1800050bf
Capabilities:
Resolve dns

Disassembly:
jmp 0x18003a2f0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x60
call fcn.180001055
sub rsp, rax
xor edi, edi
mov ebx, r9d
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
cmp r9d, 0x17
ja 0x18003a46f
mov eax, 0x800005
bt eax, ebx
jae 0x18003a46f
call sym.libcrypto_1_1_x64.dll_BIO_sock_init
cmp eax, 1
jne 0x18003a48f
mov eax, dword [rsp + 0xa0]
mov ecx, edi
mov qword [rsp + 0x80], r15
xorps xmm0, xmm0
mov dword [rsp + 0x30], ecx
xorps xmm1, xmm1
mov dword [rsp + 0x34], ebx
mov r15d, edi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], edi
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
test rsi, rsi
je 0x18003a386
test ebx, ebx
jne 0x18003a386
bts ecx, 0xa
mov dword [rsp + 0x30], ecx
cmp ebp, 1
jne 0x18003a391
or ecx, ebp
mov dword [rsp + 0x30], ecx
mov rbp, qword [rsp + 0xa8]
lea r8, [rsp + 0x30]
mov r9, rbp
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x18003a3ee
cmp ebx, 8
je 0x18003a445
mov ecx, dword [rsp + 0x30]
bt ecx, 0xa
jae 0x18003a400
btr ecx, 0xa
lea r8, [rsp + 0x30]
or ecx, 4
mov r9, rbp
mov dword [rsp + 0x30], ecx
mov rdx, r14
mov rcx, rsi
mov r15d, ebx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
jne 0x18003a3b3
mov r15, qword [rsp + 0x80]
mov edi, 1
jmp 0x18003a48f
mov edx, 0x8f
mov dword [rsp + 0x20], 0x2da
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rcx - 0x1e]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
test r15d, r15d
cmovne ebx, r15d
mov ecx, ebx
call fcn.1800066cc
mov rdx, rax
mov ecx, 1
call sym.libcrypto_1_1_x64.dll_ERR_add_error_data
mov r15, qword [rsp + 0x80]
jmp 0x18003a48f
mov edx, 0x8f
mov dword [rsp + 0x20], 0x2cb
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rdx - 0x4e]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov r15, qword [rsp + 0x80]
jmp 0x18003a48f
mov edx, 0x8f
mov dword [rsp + 0x20], 0x297
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rdx - 0xc]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x180005128
Capabilities:
Set socket configuration

Disassembly:
jmp 0x18003dd90
push rbx
mov eax, gethostbyname
call fcn.180001055
sub rsp, rax
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x18003ddd5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 5
mov dword [rsp + 0x20], 0xc3
mov r8d, eax
lea r9, str.crypto_bio_b_sock.c
lea ecx, [rdx - 3]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1800051f5
Capabilities:
Hash data using sha512

Disassembly:
jmp 0x1801590b0
movabs rax, 0x6a09e667f3bcc908
mov dword [rcx + 0xd4], 0x40
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov dword [rcx + 0xd0], eax
mov eax, 1
ret

Function at 0x1800053c6
Capabilities:
Encode data using xor

Disassembly:
jmp 0x180086c50
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x180086c77
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x180086c60
movzx eax, r9b
ret
Function at 0x18000590c
Capabilities:
Hash data using sha384

Disassembly:
jmp 0x180158480
movabs rax, 0xcbbb9d5dc1059ed8
mov dword [rcx + 0xd4], gethostbyname
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov dword [rcx + 0xd0], eax
mov eax, 1
ret
Function at 0x180005b3c
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1800f2e60
mov eax, 0x28
call fcn.180001055
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.1800f3360

Function at 0x180005c8b
Capabilities:
Hash data using murmur3
Hash data using sha256

Disassembly:
jmp 0x180156c10
mov eax, 0x28
call fcn.180001055
sub rsp, rax
lea r8d, [rax - 0x27]
add rsp, 0x28
jmp fcn.180156db0

Function at 0x180005d35
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x180156450
push rbx
mov eax, 0xa0
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
test r8, r8
mov dword [rsp + 0x20], 0xc1059ed8
lea rbx, [0x1802981b8]
mov dword [rsp + 0x24], 0x367cd507
cmovne rbx, r8
mov dword [rsp + 0x28], 0x3070dd17
xor eax, eax
mov dword [rsp + 0x2c], 0xf70e5939
mov r8, rdx
mov qword [rsp + 0x40], rax
mov rdx, rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x30], 0xffc00b31
mov dword [rsp + 0x34], 0x68581511
mov dword [rsp + 0x38], 0x64f98fa7
mov dword [rsp + 0x3c], 0xbefa4fa4
mov dword [rsp + 0x8c], 0x1c
call sym.libcrypto_1_1_x64.dll_SHA256_Update
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.libcrypto_1_1_x64.dll_SHA256_Final
mov edx, reloc.WS2_32.dll_WSASetLastError
lea rcx, [rsp + 0x20]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800028c4
add rsp, 0xa0
pop rbx
ret

Function at 0x180005ede
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x18010a050
mov eax, 0x28
call fcn.180001055
sub rsp, rax
lea r8d, [rax - 0x27]
add rsp, 0x28
jmp fcn.1800067f3
Function at 0x180006aa5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
cmp dword [rsp + 0x70], 0

Function at 0x18000722f
Capabilities:
Hash data with md5

Disassembly:
jmp 0x180109180
xor eax, eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov dword [rcx + 0x58], eax
mov eax, 1
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
ret
Function at 0x180014670
Capabilities:
Encode data using xor

Disassembly:
jmp 0x180014670
mov eax, 0x28
call fcn.180001055
sub rsp, rax
cmp r9d, 1
jne 0x18001468c
add rsp, 0x28
jmp sym.libcrypto_1_1_x64.dll_AES_encrypt
add rsp, 0x28
jmp sym.libcrypto_1_1_x64.dll_AES_decrypt