joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18020d100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x18020d2bc
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x18020d258
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180208a10
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x18020d1f2
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x18020d2bc
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180146c80
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180214d59
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180214f57
push rbp
mov eax, 0xe0
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
inc rsi
lea r13, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.18020c7c0
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.18020c820
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.180208a10
mov rcx, r13
call fcn.18020c7c0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.18020c820
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.180208a10
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
dec rsi
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x180214dc0
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180146c80
add rsp, 0xe0
pop rbp
repz ret

Function at 0x1802150a0
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.18014af80
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180219ea0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r15
mov eax, 0x68
call fcn.18014c9d0
sub rsp, rax
mov r12d, dword [rsp + 0xc0]
mov r15, rcx
movsxd rsi, edx
mov ecx, r12d
mov ebx, 1
mov edx, esi
shl ebx, cl
mov rcx, r15
mov ebp, r9d
mov rdi, r8
mov qword [rsp + 0x28], r8
call fcn.1801b8b70
test rax, rax
jne 0x180219efd
add rsp, 0x68
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0xb0], rsi
cmp r12d, 3
jg 0x180219f75
xor r10d, r10d
test rsi, rsi
jle 0x18021a12c
movsxd r11, ebx
shl r11, 3
nop
xor r9d, r9d
xor edx, edx
test ebx, ebx
jle 0x180219f5d
mov r8, rdi
nop dword [rax]
mov ecx, edx
inc edx
add r8, 8
xor ecx, ebp
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov rax, qword [r8 - 8]
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or r9, rcx
cmp edx, ebx
jl 0x180219f30
mov rax, qword [r15]
inc r10
add rdi, r11
mov qword [rax + r10*8 - 8], r9
cmp r10, rsi
jl 0x180219f20
jmp 0x18021a12c
lea ecx, [r12 - 2]
mov edx, ebp
mov r8d, 1
sar edx, cl
shl r8d, cl
mov qword [rsp + 0x60], r14
lea ecx, [rdx - 1]
lea eax, [r8 - 1]
xor r14d, r14d
and ebp, eax
shr ecx, 0x1f
mov eax, edx
not eax
movsxd r11, r8d
mov qword [rsp + 0x20], r14
shr eax, 0x1f
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 1
and eax, 1
neg rax
mov qword [rsp + 0x38], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
mov ecx, edx
xor edx, 3
xor ecx, 2
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x40], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
lea ecx, [rdx - 1]
not edx
shr ecx, 0x1f
neg eax
shr edx, 0x1f
and ecx, edx
and eax, 1
neg ecx
neg rax
and ecx, 1
mov qword [rsp + 0x48], rax
neg rcx
mov qword [rsp + 0x30], rcx
test rsi, rsi
jle 0x18021a127
movsxd rax, ebx
mov qword [rsp + 0xb8], r13
shl rax, 3
mov qword [rsp + 0x50], rax
mov rax, rsi
nop word [rax + rax]
xor esi, esi
xor r10d, r10d
test r11, r11
jle 0x18021a0f7
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov r9, r11
shl r9, 4
mov rbx, r11
mov r13, r11
add r9, rdi
mov rdi, qword [rsp + 0x48]
neg rbx
neg r13
mov r12, r11
add rbx, rbx
nop dword [rax]
mov rax, qword [r9 + r11*8]
mov r8d, r10d
add r9, 8
and rax, rcx
mov rcx, qword [r9 - 8]
mov rdx, qword [r9 + r13*8 - 8]
and rcx, rdi
xor r8d, ebp
and rdx, r14
or rcx, rax
mov rax, qword [r9 + rbx*8 - 8]
inc r10d
or rdx, rcx
lea ecx, [r8 - 1]
and rax, r15
shr ecx, 0x1f
or rax, rdx
not r8d
shr r8d, 0x1f
and ecx, r8d
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or rsi, rcx
dec r12
mov rcx, qword [rsp + 0x30]
jne 0x18021a080
mov rdi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [r15]
add rdi, qword [rsp + 0x50]
inc r14
mov qword [rcx + r14*8 - 8], rsi
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rdi
cmp r14, rax
jl 0x18021a040
mov r13, qword [rsp + 0xb8]
mov r14, qword [rsp + 0x60]
mov ecx, dword [rsp + 0xa8]
mov dword [r15 + 8], ecx
mov rcx, r15
call fcn.1801b85f0
mov eax, 1
add rsp, 0x68
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180220130
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0xb0
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, qword [rsp + 0x120]
mov rax, qword [rsp + 0x110]
mov r14, qword [rsp + 0x128]
mov ebx, r9d
mov qword [rsp + 0x40], r8
mov r13, rcx
mov qword [rsp + 0x38], rax
lea esi, [rdx - 1]
mov dword [rsp + 0x30], ebx
test rbp, rbp
jne 0x180220197
call fcn.1801bb390
mov rbp, rax
test r14, r14
mov rcx, rbp
cmove r14, rbp
call fcn.180194c30
mov r15d, esi
movsxd r12, eax
lea eax, [r12 + r12]
sub r15d, eax
lea ecx, [r15 - 1]
cmp ebx, ecx
jle 0x1802201e4
mov edx, 0x9a
lea r9, str.crypto_rsa_rsa_oaep.c
mov ecx, 4
lea r8d, [rdx - 0x2c]
mov dword [rsp + 0x20], 0x3c
call fcn.18018f910
xor eax, eax
jmp 0x1802203aa
inc eax
cmp esi, eax
jge 0x180220213
mov edx, 0x9a
lea r9, str.crypto_rsa_rsa_oaep.c
mov ecx, 4
lea r8d, [rdx - 0x22]
mov dword [rsp + 0x20], 0x42
call fcn.18018f910
xor eax, eax
jmp 0x1802203aa
movsxd rdx, dword [rsp + 0x118]
mov rcx, qword [rsp + 0x38]
mov byte [r13], 0
lea rbx, [r13 + 1]
lea r13, [r12 + r13 + 1]
xor r9d, r9d
mov r8, r13
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x28], 0
mov rdi, r12
mov qword [rsp + 0x20], rbp
call fcn.1801bb090
test eax, eax
je 0x1802203a0
mov ebp, dword [rsp + 0x30]
lea rcx, [r12 + r13]
xor edx, edx
sub r15d, ebp
dec r15d
movsxd r8, r15d
call fcn.18014af80
mov rdx, qword [rsp + 0x40]
movsxd r11, ebp
movsxd rcx, esi
mov r8d, ebp
sub rcx, r11
sub rcx, r12
add rcx, r13
mov byte [rcx - 1], 1
call fcn.180147850
mov edx, r12d
mov rcx, rbx
call fcn.1801a0ac0
test eax, eax
jle 0x1802203a0
sub esi, r12d
lea rdx, str.crypto_rsa_rsa_oaep.c
mov r8d, 0x57
movsxd rcx, esi
call fcn.1801a04c0
mov rbp, rax
test rax, rax
jne 0x1802202ea
lea r9, str.crypto_rsa_rsa_oaep.c
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov edx, 0x9a
mov dword [rsp + 0x20], 0x59
call fcn.18018f910
jmp 0x1802203a0
mov r9d, r12d
mov r8, rbx
mov edx, esi
mov rcx, rax
mov qword [rsp + 0x20], r14
call fcn.18021ffa0
test eax, eax
js 0x18022038b
test esi, esi
jle 0x180220330
mov r9, rbp
mov rcx, r13
mov edx, esi
sub r9, r13
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x180220320
lea rcx, [rsp + 0x50]
mov r9d, esi
mov r8, r13
mov edx, r12d
mov qword [rsp + 0x20], r14
call fcn.18021ffa0
test eax, eax
js 0x18022038b
test r12d, r12d
jle 0x18022036f
lea rcx, [rsp + 0x50]
sub rcx, rbx
nop dword [rax]
movzx eax, byte [rcx + rbx]
inc rbx
xor byte [rbx - 1], al
dec rdi
jne 0x180220360
lea rdx, str.crypto_rsa_rsa_oaep.c
mov r8d, 0x67
mov rcx, rbp
call fcn.1801a0590
mov eax, 1
jmp 0x1802203a2
lea rdx, str.crypto_rsa_rsa_oaep.c
mov r8d, WSAGetLastError
mov rcx, rbp
call fcn.1801a0590
xor eax, eax
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180146c80
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x180220f10
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, gethostname
call fcn.18014c9d0
sub rsp, rax
mov r10, rcx
cmp dword [rsp + 0x60], r9d
jne 0x180220ff6
movzx eax, byte [r8]
cmp al, 0x6a
je 0x180220f3b
cmp al, 0x6b
jne 0x180220ff6
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp al, 0x6b
jne 0x180220fa5
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x180220f68
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x180220f68
cmp cl, 0xbb
jne 0x180220f9b
inc eax
cmp eax, ebx
jl 0x180220f52
sub ebx, eax
test eax, eax
jne 0x180220fa9
mov dword [rsp + 0x20], 0x50
mov edx, 0x80
lea r9, str.crypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.18018f910
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x48
jmp 0x180220f76
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x180220fdf
mov edx, 0x80
lea r9, str.crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], 0x58
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.18018f910
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r10
call fcn.180147850
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, str.crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], 0x3d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.18018f910
or eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x1802260a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
mov rdi, r9
mov r9d, r8d
xor r10d, r10d
xor r8b, r8b
mov r11, rdx
test rcx, rcx
je 0x180226128
test rdx, rdx
je 0x180226128
movzx eax, byte [rcx]
test r9d, r9d
jne 0x1802260d7
cmp rax, 0x7f
jbe 0x180226120
mov r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x180226130
mov r8b, 0xff
cmp rax, 0x80
jbe 0x1802260f0
mov r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x180226130
jne 0x180226120
mov edx, 1
cmp rdx, r11
jae 0x18022610f
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rdx
or r10d, eax
cmp rdx, r11
jb 0x180226100
neg r10d
sbb r8b, r8b
movzx r8d, r8b
mov r10d, r8d
and r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x180226130
mov edx, 1
mov r11, r10
mov qword [rsp + 0x18], rsi
test rdi, rdi
je 0x180226193
mov rsi, qword [rdi]
test rsi, rsi
je 0x180226193
mov qword [rsp + 0x10], rbx
movzx ebx, r8b
mov byte [rsi], r8b
mov eax, ebx
mov r10d, r10d
lea r9, [rcx + r11]
and eax, 1
test r11, r11
je 0x18022618b
mov r8, r9
sub r8, rcx
add r10, rsi
nop dword [rax + rax]
movzx ecx, byte [r9 - 1]
dec r9
dec r8
xor ecx, ebx
add eax, ecx
mov byte [r10 + r8], al
shr eax, 8
test r8, r8
jne 0x180226170
add qword [rdi], rdx
mov rbx, qword [rsp + 0x10]
mov rax, rdx
mov rsi, qword [rsp + 0x18]
pop rdi
ret
mov eax, 0x28
call fcn.18014c9d0
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
mov rcx, qword [rcx + 8]
and r8d, 0x100
add rsp, 0x28
jmp 0x1802260a0
Function at 0x1802261a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, gethostname
call fcn.18014c9d0
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x1802261df
mov edx, 0xe2
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
mov dword [rsp + 0x20], 0x9a
call fcn.18018f910
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x1802261f2
mov dword [rdx], r8d
cmp r9, 1
jne 0x180226216
test rcx, rcx
je 0x18022620c
movzx eax, byte [r10]
test r8d, r8d
je 0x18022620a
not al
inc al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx eax, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
test al, al
jne 0x18022622c
mov ebx, 1
jmp 0x180226258
cmp al, 0xff
jne 0x180226295
mov ecx, 1
mov edx, ebx
cmp rcx, r9
jae 0x18022624f
nop dword [rax]
movzx eax, byte [rcx + r10]
inc rcx
or edx, eax
cmp rcx, r9
jb 0x180226240
test edx, edx
setne bl
test ebx, ebx
je 0x180226295
movzx eax, byte [r10 + 1]
and eax, 0x80
cmp r8d, eax
jne 0x180226295
mov edx, 0xe2
lea r9, str.crypto_asn1_a_int.c
mov ecx, recv
lea r8d, [rdx - 5]
mov dword [rsp + 0x20], 0xbb
call fcn.18018f910
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rdi
movsxd rdi, ebx
sub r9, rdi
test r11, r11
je 0x1802262eb
neg r8d
lea r8, [rdi + r10]
sbb al, al
add r8, r9
movzx eax, al
mov ecx, eax
mov ebx, eax
and ecx, 1
test r9, r9
je 0x1802262eb
mov rdx, r8
sub rdx, rdi
sub rdx, r10
nop dword [rax]
movzx eax, byte [r8 - 1]
dec r8
dec rdx
xor eax, ebx
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x1802262d0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret

Function at 0x180226300
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rdi
mov rdi, r9
mov r9d, r8d
xor r10d, r10d
xor r8b, r8b
mov r11, rdx
test rcx, rcx
je 0x180226128
test rdx, rdx
je 0x180226128
movzx eax, byte [rcx]
test r9d, r9d
jne 0x1802260d7
cmp rax, 0x7f
jbe 0x180226120
mov r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x180226130
mov r8b, 0xff
cmp rax, 0x80
jbe 0x1802260f0
mov r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x180226130
jne 0x180226120
mov edx, 1
cmp rdx, r11
jae 0x18022610f
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rdx
or r10d, eax
cmp rdx, r11
jb 0x180226100
neg r10d
sbb r8b, r8b
movzx r8d, r8b
mov r10d, r8d
and r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x180226130
mov edx, 1
mov r11, r10
mov qword [rsp + 0x18], rsi
test rdi, rdi
je 0x180226193
mov rsi, qword [rdi]
test rsi, rsi
je 0x180226193
mov qword [rsp + 0x10], rbx
movzx ebx, r8b
mov byte [rsi], r8b
mov eax, ebx
mov r10d, r10d
lea r9, [rcx + r11]
and eax, 1
test r11, r11
je 0x18022618b
mov r8, r9
sub r8, rcx
add r10, rsi
nop dword [rax + rax]
movzx ecx, byte [r9 - 1]
dec r9
dec r8
xor ecx, ebx
add eax, ecx
mov byte [r10 + r8], al
shr eax, 8
test r8, r8
jne 0x180226170
add qword [rdi], rdx
mov rbx, qword [rsp + 0x10]
mov rax, rdx
mov rsi, qword [rsp + 0x18]
pop rdi
ret
mov eax, 0x28
call fcn.18014c9d0
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
mov rcx, qword [rcx + 8]
and r8d, 0x100
add rsp, 0x28
jmp 0x1802260a0
Function at 0x180228b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
movsxd rsi, r8d
mov rdi, rdx
mov rbp, rcx
mov r8, rsi
call fcn.18014b280
test eax, eax
jle 0x180228b8b
lea rdx, str.cryptox509v3_v3_addr.c
lea rcx, str.assertion_failed:_memcmp_min__max__length____0
mov r8d, 0x159
call fcn.1801a4d90
xor r8d, r8d
test esi, esi
jle 0x180228bb8
mov rdx, rbp
mov r9, rdi
mov rcx, rdi
sub rdx, rdi
neg r9
movzx eax, byte [rcx]
cmp byte [rdx + rcx], al
jne 0x180228bb8
inc rcx
inc r8d
lea rax, [r9 + rcx]
cmp rax, rsi
jl 0x180228ba1
lea edx, [rsi - 1]
movsxd rcx, edx
test edx, edx
js 0x180228be6
mov r9, rbp
lea rax, [rcx + rdi]
sub r9, rdi
nop dword [rax]
cmp byte [rax + r9], 0
jne 0x180228be6
cmp byte [rax], 0xff
jne 0x180228be6
dec edx
dec rax
dec rcx
jns 0x180228bd0
cmp r8d, edx
jl case.0x180228c39.2
jle 0x180228bfe
lea eax, [r8*8]
jmp 0x180228c80
movsxd rax, r8d
movzx r9d, byte [rax + rdi]
movzx r10d, byte [rax + rbp]
movzx edx, r9b
xor dl, r10b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x180228c39.2
lea r11, [0x180000000]
cdqe
movzx eax, byte [r11 + rax + 0x228cb8]
mov ecx, dword [r11 + rax*4 + 0x228c98]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x180228c6a
mov eax, 6
jmp 0x180228c6a
mov eax, 5
jmp 0x180228c6a
mov eax, 4
jmp 0x180228c6a
mov eax, 3
jmp 0x180228c6a
mov eax, 2
jmp 0x180228c6a
mov eax, 1
test dl, r10b
jne case.0x180228c39.2
and r9b, dl
cmp r9b, dl
jne case.0x180228c39.2
lea eax, [rax + r8*8]
jmp 0x180228c80
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180230f30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x40
call fcn.18014c9d0
sub rsp, rax
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test r8, r8
jne 0x180230f68
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
test rcx, rcx
je 0x180230ff6
test rdx, rdx
je 0x180230fba
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rbx
call fcn.1801a56e0
test rax, rax
jne 0x180230fe2
mov qword [rsp + 0x50], rdi
lea rdi, [0x180346a88]
mov ecx, 4
repe cmpsb byte [rsi], byte [rdi]
mov rdi, qword [rsp + 0x50]
jne 0x180230fba
mov rcx, rbx
call fcn.180161c94
test rax, rax
jne 0x180230ffe
mov rcx, qword [rbp + 0x10]
lea rax, str.default
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
call fcn.1801a56e0
test rax, rax
je 0x180230f56
mov rax, qword [rax + 0x10]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
mov rcx, rbx
call fcn.180161c94
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x1802335c0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
mov eax, 0x40
call fcn.18014c9d0
sub rsp, rax
cmp dword [rsp + 0x70], 2
movsxd rsi, r9d
mov rdi, r8
mov r12, rcx
je 0x180233650
test rdx, rdx
je 0x18023363c
mov r9, rdx
lea rdx, [rsp + 0x30]
xor r8d, r8d
xor ecx, ecx
call fcn.1802270d0
cmp dword [rsp + 0x30], 0xffffffff
je 0x18023363c
mov dword [rsp + 0x20], gethostbyname
mov ecx, reloc.WS2_32.dll_recv
lea r9, str.cryptoececx_meth.c
mov edx, 0x10a
lea r8d, [rcx + 0x56]
call fcn.18018f910
xor eax, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r12
ret
test rdi, rdi
je 0x180233646
cmp esi, 0x20
je 0x180233650
mov dword [rsp + 0x20], gethostname
jmp 0x18023360f
mov r8d, 0x3a
lea rdx, str.cryptoececx_meth.c
mov qword [rsp + 0x50], rbx
lea ecx, [r8 - 0x12]
call fcn.1801a0510
mov rbx, rax
test rax, rax
jne 0x18023369a
lea r9, str.cryptoececx_meth.c
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
mov edx, 0x10a
mov dword [rsp + 0x20], 0x3c
call fcn.18018f910
xor eax, eax
jmp 0x18023379d
cmp dword [rsp + 0x70], 0
jne 0x1802336b4
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.180147850
jmp 0x180233788
mov r8d, 0x43
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x23]
call fcn.1801d3e20
mov r11, rax
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x1802336fe
lea r9, str.cryptoececx_meth.c
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
mov edx, 0x10a
mov dword [rsp + 0x20], 0x45
call fcn.18018f910
mov r8d, 0x46
jmp 0x180233732
cmp dword [rsp + 0x70], 2
jne 0x18023375e
mov edx, 0x20
mov rcx, rax
call fcn.1801a0ac0
test eax, eax
jg 0x180233745
mov rcx, qword [rbx + 0x20]
lea rdx, str.cryptoececx_meth.c
mov r8d, 0x4b
call fcn.1801d3e80
mov r8d, 0x4c
lea rdx, str.cryptoececx_meth.c
mov rcx, rbx
call fcn.1801a0590
xor eax, eax
jmp 0x18023379d
mov rax, qword [rbx + 0x20]
and byte [rax], 0xf8
mov rax, qword [rbx + 0x20]
and byte [rax + 0x1f], 0x7f
mov rax, qword [rbx + 0x20]
or byte [rax + 0x1f], 0x40
jmp 0x18023377c
mov rax, qword [rdi]
mov qword [r11], rax
mov rax, qword [rdi + 8]
mov qword [r11 + 8], rax
mov rax, qword [rdi + 0x10]
mov qword [r11 + 0x10], rax
mov rax, qword [rdi + 0x18]
mov qword [r11 + 0x18], rax
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.18025fa20
mov r8, rbx
mov edx, 0x40a
mov rcx, r12
call fcn.1801cde70
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r12
ret