joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400548f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140086080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140054985
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400549e6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.14002f1f0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140067a80
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x140054aa1
sub ecx, 1
je 0x140054b14
sub ecx, 1
je 0x140054a50
cmp ecx, 1
je 0x140054a33
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400739b0]
call fcn.14002f1f0
jmp 0x140054b14
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140054620
test eax, eax
je 0x140054b14
jmp 0x1400549ba
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140054b14
sub rax, rsi
cmp rax, rbp
jae 0x140054b14
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.14002f370
jmp 0x140054b14
cmp r8d, 4
jle 0x140054b14
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140054b14
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14002f110
mov esi, eax
test eax, eax
je 0x140054af3
mov edx, 5
mov rcx, rbx
call fcn.1400555e0
mov eax, esi
jmp 0x1400549ba
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14003da10
mov rcx, r14
call fcn.14003dcf0
test eax, eax
je 0x1400549b8
mov edx, 5
mov rcx, rbx
call fcn.1400555e0
mov eax, Ordinal_45
jmp 0x1400549ba
Function at 0x1400678b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400678f2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140067939
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140067992
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140067950
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400679d3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14007912a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14007912b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400679a0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14006889c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400688e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400688e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400688e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400688e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400688e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400688e8
xor al, al
add rsp, 0x28
ret
Function at 0x14013e5d0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1402a7660
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14013e7d0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
push rdi
push r13
mov eax, gethostbyname
call fcn.1402a7660
sub rsp, rax
mov eax, dword [0x14036d7e4]
mov r13d, ecx
mov ebx, 1
cmp eax, 2
je 0x14013e843
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x14036d7e4], ebx
je 0x14013e81d
cmp eax, ebx
je 0x14013e800
mov eax, dword [0x14036d7e4]
cmp eax, 2
jne 0x14013e861
jmp 0x14013e843
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
lea r8, [0x14013e6e0]
xor edx, edx
xor ecx, ecx
mov dword [0x14036d7e0], eax
call fcn.140142fa0
mov dword [0x14036d7e4], 2
mov r8d, 0x97
lea rdx, str.crypto_threads_win.c
lea ecx, [r8 - 0x3f]
call fcn.140132160
mov rdi, rax
test rax, rax
jne 0x14013e86c
xor eax, eax
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.140163d20
mov qword [rdi + 0x30], rax
call fcn.140163920
mov qword [rdi + 0x40], rax
call fcn.140163920
mov qword [rdi + 0x50], rax
call fcn.140163d20
mov qword [rdi + 0x38], rax
call fcn.140163d20
cmp r13d, ebx
mov qword [rdi + 0x48], rax
mov r8d, 0x85
lea rdx, str.crypto_threads_win.c
cmovge ebx, r13d
inc ebx
movsxd rbx, ebx
lea rcx, [rbx*8]
call fcn.140132160
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14013e908
cmp qword [rdi + 0x40], 0
je 0x14013e908
cmp qword [rdi + 0x50], 0
je 0x14013e908
cmp qword [rdi + 0x30], 0
je 0x14013e908
cmp qword [rdi + 0x38], 0
je 0x14013e908
cmp qword [rdi + 0x48], 0
jne 0x14013e961
mov r8d, 0xa8
lea rdx, str.crypto_threads_win.c
mov rcx, rax
call fcn.140131ed0
lea rcx, [rdi + 0x40]
call fcn.140163880
lea rcx, [rdi + 0x50]
call fcn.140163880
lea rcx, [rdi + 0x38]
call fcn.140163cb0
lea rcx, [rdi + 0x48]
call fcn.140163cb0
lea rcx, [rdi + 0x30]
call fcn.140163cb0
mov r8d, 0xae
lea rdx, str.crypto_threads_win.c
mov rcx, rdi
call fcn.140131ed0
xor edi, edi
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
Function at 0x14013e990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x20
call fcn.1402a7660
sub rsp, rax
mov rbx, rcx
lea esi, [rax - 0x21]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14036d7e0]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x14013ea1e
mov r8d, 0xdd
lea rdx, str.crypto_threads_win.c
lea ecx, [r8 + 0x13]
call fcn.140132160
mov r14, rax
test rax, rax
jne 0x14013ea0f
mov r8d, 0xde
lea rdx, str.crypto_threads_win.c
lea rcx, str.assertion_failed:_data___NULL
call fcn.1401321a0
mov ecx, dword [0x14036d7e0]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
mov rax, r14
cmp qword [rax], 0
jne 0x14013ea2f
cmp esi, 0xffffffff
cmove esi, ecx
cmp qword [rax + 0x10], rbx
je 0x14013eaf3
inc ecx
add rax, 0x18
cmp ecx, 0xa
jl 0x14013ea23
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop dword [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x14013ea50
mov rcx, qword [rbx + 0x10]
mov r8d, eax
lea rdx, [r8*8]
lock inc qword [rdx + rcx]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x14013ea74
cmp r8d, eax
je 0x14013ead2
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lock dec qword [rdx + rax]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x14013eaa0
mov r8d, eax
mov rax, qword [rbx + 0x10]
lea rdx, [r8*8]
lock inc qword [rdx + rax]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x14013eac4
cmp r8d, eax
jne 0x14013ea90
movsxd rax, esi
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x10]
lea rdx, [r14 + rcx*8]
mov dword [rdx + 8], 1
mov qword [rdx + 0x10], rbx
lea rcx, [rax + r8*8]
mov qword [rdx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14013eb10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1402a7660
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14036d7e0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r9d, r9d
lea rdx, [rsi + 0x10]
xor r8d, r8d
cmp qword [rdx], rdi
je 0x14013eb79
inc r9d
inc r8
add rdx, 0x18
cmp r8, 0xa
jl 0x14013eb54
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movsxd rax, r9d
lea rcx, [rax + rax*2]
add dword [rsi + rcx*8 + 8], 0xffffffff
lea rbx, [rsi + rcx*8]
jne 0x14013ebc8
mov rax, qword [rbx]
mov rcx, 0xffffffffffffffff
lock xadd qword [rax], rcx
cmp rcx, 1
jns 0x14013ebb9
mov r8d, 0x10b
lea rdx, str.crypto_threads_win.c
lea rcx, str.assertion_failed:_ret___0
call fcn.1401321a0
mov qword [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401425d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, gethostbyname
call fcn.1402a7660
sub rsp, rax
lea edx, [rax - 0x2f]
mov rbx, rcx
call fcn.1401421a0
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call fcn.140142080
xor edi, edi
mov r14, rax
test rax, rax
je 0x140142677
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
mov esi, edi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140142653
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rbx
call fcn.140142130
mov rcx, rbx
call fcn.1401422f0
test rax, rax
jne 0x14014270b
mov edx, 1
mov rcx, rbx
call fcn.1401421a0
mov rdx, rax
mov rcx, rbx
mov rsi, rax
call fcn.140142080
mov rbp, rax
test rax, rax
je 0x140142703
mov r9d, reloc.WS2_32.dll_shutdown
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1401426e3
mov rcx, qword [rsp + 0x58]
mov r8, rbp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rdi, rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rdi*8]
mov rdx, rdi
mov rcx, rbx
call fcn.140142130
mov rcx, rbx
call fcn.1401422f0
test rax, rax
jne 0x14014270b
mov rcx, rbx
call fcn.1401422f0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14014b290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov eax, 0x20
call fcn.1402a7660
sub rsp, rax
mov rdi, qword [rcx + 0x28]
mov rbx, rdx
mov rbp, rcx
cmp rdx, rdi
ja 0x14014b2ce
shl rbx, 4
add rbx, qword [rcx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rbx, rcx
jb 0x14014b31a
sub rdx, rcx
lea r8, str.cryptomodesocb128.c
add rdx, 4
mov r9d, WSAStartup
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.140131f00
test rax, rax
jne 0x14014b316
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, rbx
mov qword [rsp + 0x50], r15
mov r15, rdi
shl r15, 4
sub r12, rdi
nop word [rax + rax]
mov rcx, qword [rbp + 0x58]
mov edx, 1
add rcx, r15
movzx edi, byte [rcx]
lea rsi, [rcx + 0x10]
shr dil, 7
mov r8, rsi
neg dil
and dil, 0x87
call fcn.14014ae90
xor byte [rsi + 0xf], dil
add r15, 0x10
sub r12, 1
jne 0x14014b340
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbp + 0x28], rbx
shl rbx, 4
add rbx, qword [rbp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14014b3a0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.1402a7660
sub rsp, rax
cmp dword [0x14036da90], 0
jne 0x14014b520
mov qword [rsp + 0x40], rsi
lea r8d, [rax + 8]
mov qword [rsp + 0x48], rdi
lea rcx, str.OPENSSL_ia32cap
mov qword [rsp + 0x30], rbx
lea rdi, [0x14036da30]
mov rdx, rdi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], r14
mov dword [0x14036da90], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x14014b4e2
movzx ebx, word [0x14036da30]
xor ebp, ebp
cmp bx, 0x7e
mov ecx, ebp
mov r14d, 2
cmove ecx, r14d
add rcx, rdi
call fcn.14014b530
mov rsi, rax
cmp bx, 0x7e
jne 0x14014b461
lea rcx, [0x14036ff00]
mov rbx, rax
call fcn.140001030
not rsi
movabs rcx, 0xedfff7fdffffffff
and rax, rsi
and ebx, 0x1000000
mov rsi, rax
and rsi, rcx
test rbx, rbx
cmove rsi, rax
jmp 0x14014b47a
cmp word [0x14036da30], 0x3a
jne 0x14014b47a
lea rcx, [0x14036ff00]
call fcn.140001030
mov rsi, rax
movzx eax, word [0x14036da30]
test ax, ax
je 0x14014b498
lea rdi, [rdi + 2]
cmp ax, 0x3a
je 0x14014b4a1
movzx eax, word [rdi]
test ax, ax
jne 0x14014b486
mov qword [0x14036ff08], rbp
jmp 0x14014b4f1
movzx ebx, word [rdi]
cmp bx, 0x7e
cmove rbp, r14
lea rcx, [rdi + rbp]
call fcn.14014b530
mov rcx, rax
shr rcx, 0x20
cmp bx, 0x7e
jne 0x14014b4d4
not eax
not ecx
and dword [0x14036ff08], eax
and dword [0x14036ff0c], ecx
jmp 0x14014b4f1
mov dword [0x14036ff08], eax
mov dword [0x14036ff0c], ecx
jmp 0x14014b4f1
lea rcx, [0x14036ff00]
call fcn.140001030
mov rsi, rax
mov r14, qword [rsp + 0x20]
mov eax, esi
mov rdi, qword [rsp + 0x48]
bts eax, 0xa
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
shr rsi, 0x20
mov dword [0x14036ff04], esi
mov rsi, qword [rsp + 0x40]
mov dword [0x14036ff00], eax
add rsp, 0x28
ret
Function at 0x140174440
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.1402a7660
sub rsp, rax
cmp dword [0x14036de30], 0
jne 0x1401744fa
xor edx, edx
mov dword [0x14036de30], 1
mov r8d, 0x198
lea rcx, [0x14036de40]
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x202
lea rdx, [0x14036de40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1401744fa
call fcn.140138ad0
lea r8, str.BIO_sock_init
mov edx, 0x99
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140138bf0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov ecx, 2
mov edx, eax
call fcn.140138d50
call fcn.140138ad0
lea r8, str.BIO_sock_init
mov edx, 0x9b
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140138bf0
xor r8d, r8d
lea edx, [r8 + 0x7a]
lea ecx, [rdx - 0x5a]
call fcn.140138d50
mov eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret

Function at 0x140174510
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402a7660
sub rsp, rax
mov dword [rsp + 0x30], edx
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x140174572
call fcn.140138ad0
lea r8, str.BIO_socket_ioctl
mov edx, 0xf7
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140138bf0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov ecx, 2
mov edx, eax
call fcn.140138d50
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x140174580
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x260
call fcn.1402a7660
sub rsp, rax
mov rax, qword [0x140363e40]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, ecx
mov rbx, r8
mov esi, edx
cmp ecx, 0xffffffff
jne 0x1401745b3
mov eax, ecx
jmp 0x140174613
test rbx, rbx
jne 0x1401745bd
lea eax, [rbx + 1]
jmp 0x140174613
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov rcx, rax
cmp rbx, rax
jge 0x1401745d0
xor eax, eax
jmp 0x140174613
xor eax, eax
mov qword [rsp + 0x48], rdi
sub ebx, ecx
mov dword [rsp + 0x34], eax
test esi, esi
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
cmovne r8, rax
lea rdx, [rsp + 0x40]
cmove rdx, rax
lea ecx, [rdi + 1]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1402a72d0
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x140175340
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.1402a7660
sub rsp, rax
mov rax, qword [0x140363e40]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x14036dfe0], 0
lea rax, [0x140174cc0]
mov qword [rsp + 0x28], rax
lea rbx, str.getaddrinfo
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x140175100]
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [0x140174c60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x140175519
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14017550f
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14017543a
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14017549a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140175507
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14017549a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140175507
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1401754f6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x1401754b0
mov rax, qword [rsp + 0x28]
mov qword [0x140360988], rax
mov rax, qword [rsp + 0x38]
mov qword [0x140360998], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1403609a8], rax
jmp 0x1401754ff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x14036dfe0], 1
mov rax, rbp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1402a72d0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x1401c5420
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1a0
call fcn.1402a7660
sub rsp, rax
mov rax, qword [0x140363e40]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, r8
mov rsi, rdx
mov r8, r9
lea rdx, str.SHA512
call fcn.140155d80
mov rdi, rax
test rax, rax
je 0x1401c54a3
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r9 + 0x20]
call fcn.140154d70
mov rcx, rdi
mov ebx, eax
call fcn.140155dd0
test ebx, ebx
jne 0x1401c54aa
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x150]
call fcn.140001240
xor eax, eax
jmp 0x1401c555e
movzx eax, byte [rsp + 0x16f]
lea rdx, [rsp + 0x150]
and byte [rsp + 0x150], 0xf8
lea rcx, [rsp + 0xb0]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x16f], al
call fcn.1401c4660
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x30]
call fcn.1401c1020
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.1401c12a0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.1401c12a0
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1401c2940
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x80]
call fcn.1401c2940
movzx eax, byte [rsp + 0x30]
lea rcx, [rsp + 0x150]
shl al, 7
mov edx, 0x40
xor byte [rsi + 0x1f], al
call fcn.140001240
mov eax, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1402a72d0
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret