File Information hashes and primary classification
File name
6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8
File size
8.6 MiB
Architecture
X64
- MD5
- 5d132fb6ec6fac12f01687f2c0375353
- SHA1
- 8a14c93548156a67789a7da7f6dd4ea0ca91519e
- SHA256
- 6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8
- TLSH
- T10b960b03e63261dec5fac139952a7323f8b03cdd8a35e767455093a22b74b64ae3db14
- Imphash
- 7159df2f64515146daa2fa421ec17aa6
- Rich header
- -
Metadata parser-extracted fields
YARA Signatures 5 matching rules
Type.SUSPICIOUS
network
TorUsage
lateral movement
CreateService
Type.UNCOMMON
fingerprint
EnumerateProcesses
Type.INFO
compiler
MSVC_2015_linker
library
Zlib
Kesakode similarity verdict
No Kesakode verdict available.
Anomalies signals worth reviewing
entropy:
BigBufferNoXrefMediumToHighEntropy
strings:
BigStringHiScore
DynamicString
HugeStringBinary
StringBase64
code:
CrossSectionJump
HighXrefLoopingFunction
HugeGapBetweenFunctions
ManyHighValueImmediates
ManyUniqueImmediateBytes
SequentialFunction
SpaghettiFunction
StackArrayInitialisationX64
XorInLoop
imports:
CryptoApiUsage
DownloaderApiUsage
integrity:
NoChecksum
sections:
SectionNameUnknown
time:
TimeDateStampZero
Constants identified constants and patterns
compress:
zinflate_distanceExtraBits__32_lil_120
1
zinflate_distanceStarts__16_lil_60
1
zinflate_lengthStarts__16_lil_58
1
Zlib_base_dist__32_lil_120
1
Zlib_dist_code__8_byt_512
1
crypto:
ChaCha
8
AES_Rijndael_S___ARIA_S1__8_byt_256
4
AES_Rijndael_Si___ARIA_X1__8_byt_256
4
Lucifer__outerbridge__DFLTKY__8_byt_16
4
Crypton_kp__32_lil_16
2
MurmurHash3
2
_First_Oakley_Default_Group___768_bit__from_RFC2409__8_byt_96
1
_Second_Oakley_Default_Group___1024_bit__from_RFC2409__8_byt_128
1
ASCII_to_BIN_table__8_byt_128
1
B64EncodeTable__8_byt_ASC_64
1
base64_map__8_byt_80
1
Blowfish_s_init__32_lil_4096
1
CAST_S__32_lil_8188
1
DES_odd_parity__8_byt_256
1
DES_semi_weak_keys__8_byt_96
1
DES_skb__32_lil_2048
1
DES_SPR_SPtrans__32_lil_2048
1
EC_curve__EC_NIST_CHAR2_233B_SEED__8_byt_20
1
EC_curve__EC_NIST_CHAR2_283B_SEED__8_byt_20
1
EC_curve__EC_NIST_CHAR2_409B_SEED__8_byt_20
1
EC_curve__EC_NIST_CHAR2_571B_SEED__8_byt_20
1
EC_curve__EC_NIST_PRIME_192_SEED__8_byt_20
1
EC_curve__EC_NIST_PRIME_224_SEED__8_byt_20
1
EC_curve__EC_NIST_PRIME_384_SEED__8_byt_20
1
EC_curve__EC_NIST_PRIME_521_SEED__8_byt_20
1
EC_curve__EC_SECG_CHAR2_113R1_SEED__8_byt_20
1
EC_curve__EC_SECG_CHAR2_113R2_SEED__8_byt_20
1
EC_curve__EC_SECG_CHAR2_131R1_SEED__8_byt_20
1
EC_curve__EC_SECG_CHAR2_131R2_SEED__8_byt_20
1
EC_curve__EC_SECG_CHAR2_193R1_SEED__8_byt_20
1
EC_curve__EC_SECG_CHAR2_193R2_SEED__8_byt_20
1
EC_curve__EC_SECG_PRIME_112R1_SEED__8_byt_20
1
hash:
RIPEMD128
128
MD5
2
RIPEMD160
2
xxhash
2
CRC_32_IEEE_802_3_poly_0x04C11DB7__32_lil_refl_True
1
SHA256_Hash_constant_words_K__0x428a2f98___32_lil_256
1
SSH_RSA_id_sha1_OBJ_ID__oiw_14__secsig_3__algorithms_2__26__8_byt_15
1
oid:
pkcs1-MGF
7
sha-256
7
hashAlgos
6
sm4Cipher
5
sha-224
4
sha-384
4
mitsubishiSecurityAlgorithm
3
sha-512
3
aes192-wrap
2
aes256-wrap
2
cms3DESwrap
2
curveEd448
2
ecPublicKey
2
rsaEncryption
2
rsaPSS
2
sm2ECC
2
aes128-CBC
1
aes128-CCM
1
aes128-CFB
1
aes128-ECB
1
aes128-GCM
1
aes128-OFB
1
aes128-wrap
1
aes128-wrap-pad
1
aes192-CBC
1
aes192-CCM
1
aes192-CFB
1
aes192-ECB
1
aes192-GCM
1
aes192-OFB
1
aes192-wrap-pad
1
aes256-CBC
1
registry:
HKEY_CURRENT_USER
8
HKEY_LOCAL_MACHINE
3
HKEY_USERS
1
Strings highest-value extracted strings
| Address | String | Refs | Encoding | Score |
|---|---|---|---|---|
| 0x1406D1DDF | You have a %sPort entry with all of IPv4 and IPv6 and .onion disabled; that won't work. | 1 | ASCII | 225 |
| 0x14072592B | Attachstream to a circuit is not supported for .onion addresses currently. Failing. | 1 | ASCII | 225 |
| 0x1406686A1 | 08C9BCF367E6096A3BA7CA8485AE67BB2BF894FE72F36E3CF1361D5F3AF54FA5D182E6AD7F520E511F6C3E2B8C68059B6BBD41FBABD9831F79217... | 1 | BINARY | 222 |
| 0x1403D89BB | B4FFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00 | 1 | BINARY | 221 |
| 0x1403E3295 | B4FFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00 | 1 | BINARY | 221 |
| 0x1403E763C | B4FFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00 | 1 | BINARY | 221 |
| 0x1403A1E83 | 060000000000000003000000000000000700000000000000080000000000000009000000000000000A000000000000000B000000000000000C000... | 1 | BINARY | 220 |
| 0x1403A1D3F | 0A0000000000000004000000000000000B000000000000000C000000000000000D000000000000000E000000000000000F0000000000000010000... | 1 | BINARY | 220 |
| 0x1404076B5 | 68FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00 | 1 | BINARY | 220 |
| 0x1403F8852 | DAFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00 | 1 | BINARY | 220 |
| 0x1403D6382 | DAFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00 | 1 | BINARY | 220 |
| 0x1403F6630 | DAFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00 | 1 | BINARY | 220 |
| 0x1407279B1 | Closed %u streams for service %s.onion for reason %s. Fetch status: %s. | 1 | ASCII | 220 |
| 0x1407258B5 | Onion address %s requested from a port with .onion disabled | 1 | ASCII | 220 |
| 0x1403BFD50 | FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFFFFFFFFF1F00FCFFF... | 1 | BINARY | 219 |
| 0x1406689C0 | 6E642033000000006E642033000000006E642033000000006E6420330000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 219 |
| 0x1404060FD | F8FFFFFFFFFF3F000000000000000000F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFF... | 1 | BINARY | 219 |
| 0x140409937 | FFFFFFFFFFFF0700F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFF... | 1 | BINARY | 219 |
| 0x1403D14E7 | FFFFFFFFFFFF0700FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FFFFFFFFFFFF0700FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFF... | 1 | BINARY | 219 |
| 0x14040840C | FFFFFFFFFFFF0700F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFF... | 1 | BINARY | 219 |
| 0x1406110A0 | 870000000000000000000000000000000000000004030000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 219 |
| 0x1403D8974 | 0000000000000000FFFFFFFFFFFF0700FFFFFFFFFFFF0700FCFFFFFFFFFF1F0000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 219 |
| 0x140409383 | F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFF... | 1 | BINARY | 219 |
| 0x140408D3D | F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFF... | 1 | BINARY | 219 |
| 0x140407E50 | F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFF... | 1 | BINARY | 219 |
| 0x14040780A | F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFFFFFFFFF3F00F8FFF... | 1 | BINARY | 219 |
| 0x1403C783A | FFFFFFFF00000000FFFFFFFF00000000FFFFFFFFFFFFFF000000000000000000FFFFFFFF00000000FFFFFFFF00000000FFFFFFFFFFFF070000000... | 1 | BINARY | 219 |
| 0x1404075D4 | FFFFFFFFFFFF0700FFFFFFFFFFFF07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 219 |
| 0x1403C1C77 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 219 |
| 0x1403C7B45 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 219 |
| 0x1403C263C | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 219 |
| 0x1403C405E | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 219 |
| 0x1404142F3 | C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | 1 | BINARY | 219 |
| 0x1401F3D04 | 1B0000002800000014000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 219 |
| 0x14072407F | Rend stream is %d seconds late. Giving up on address '%s.onion'. | 1 | ASCII | 219 |
| 0x140338D12 | 010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000... | 1 | BINARY | 218 |
| 0x1403EE9E6 | FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFF... | 1 | BINARY | 218 |
| 0x1403E8096 | FEFFFFFFFFFF0F0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403BC50A | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403E01B4 | FEFFFFFFFFFF0F000000000000000000FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFFFFFFFFF0F00FEFFF... | 1 | BINARY | 218 |
| 0x1403F3CE5 | FEFFFFFFFFFF0F0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403F6735 | FEFFFFFFFFFF0F0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403E5794 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403C8AB5 | FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FBF4E | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D2644 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D44B2 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D6BED | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D9226 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403C6684 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D7BEE | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D3734 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403DA221 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D558C | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403EDEB4 | FEFFFFFFFFFF0F0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FF46D | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140402124 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140403EF6 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x14040035A | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140403011 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FD6A3 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FE588 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x14040123F | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FA4A1 | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140404DDB | FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403C257A | 0000000000000000FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D6324 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403DC262 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403C4C44 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403CA272 | 0000000000000000FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403C3781 | 0000000000000000FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF070000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403C5A65 | 0000000000000000FFFFFFFFFFFF0700FFFFFFFFFFFF0700000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403C5378 | 0000000000000000FFFFFFFFFFFF0700FFFFFFFFFFFF0700000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FB992 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140401B70 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140403942 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FEEB9 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FB34C | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FDFD4 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140402A5D | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140404827 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x140400C8B | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FFDA6 | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403FD0EF | 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403D1154 | FFFFFFFFFFFF07000000000000000000FFFFFFFFFFFF0700000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1403C3F11 | FFFFFFFFFFFF0700FFFFFFFFFFFF07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x14000F5F4 | 010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1401BA1DE | 000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 218 |
| 0x1406E82EB | offset == ((sizeof(".onion checksum") - 1) + 32 + sizeof(uint8_t)) | 1 | ASCII | 218 |
| 0x14032295A | 000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 214 |
| 0x140329D6C | 010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 210 |
| 0x140660C7D | FFFFFF03000000000000000000000000FFFFFF03000000000000000000000000FFFFFF030000000000000000000000006E6420330000000000000... | 1 | BINARY | 209 |
| 0x140660C04 | FFFFFF03000000000000000000000000FFFFFF03000000000000000000000000FFFFFF030000000000000000000000006E6420330000000000000... | 1 | BINARY | 209 |
| 0x1403FEDCC | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403D73EB | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403FACB3 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403EE942 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403D5ACB | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403D9A1E | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x140400B9E | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403D4D89 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x140403855 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403D8169 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403D3CAF | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403D2F31 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403EC02E | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403F3C45 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403FDEE7 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x140402970 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403C9A9A | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403C6E4A | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403FD002 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x140407556 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1404055DF | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403BFCD5 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x14040AD32 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x14040473A | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403DA760 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x140401A83 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x1403FFCB9 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x140408C50 | FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700FFFFFFFFFFFF0700 | 1 | BINARY | 206 |
| 0x14040F2F6 | 343F0000000000000000000000000000FFFFFFFF00800000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 204 |
| 0x14068F90C | 00000100000000000000000000000000FFFFFF7F000000000000000000000000FFFFFF7F00000000FFFFFF7F00000000FFFFFF7F0000000000000... | 1 | BINARY | 203 |
| 0x1407328D2 | .onion | 1 | ASCII | 202 |
| 0x14074DB90 | .onion | 1 | ASCII | 202 |
| 0x1401F6674 | 002000000000000048000000B40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 201 |
| 0x1407BAD21 | CreateToolhelp32Snapshot | 2 | ASCII | 201 |
| 0x14056783D | 200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000... | 1 | BINARY | 198 |
| 0x140230C2E | 736574796264657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... | 1 | BINARY | 198 |
| 0x1406E82C9 | .onion checksum | 1 | ASCII | 197 |
| 0x1406FAA82 | CreateServiceA | 2 | ASCII | 195 |
| 0x1406DDA3B | --defaults-torrc | 3 | ASCII | 194 |
| 0x140732CF0 | FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0... | 2 | ASCII | 190 |
| 0x140732BE0 | D67DE440CBBBDC1936D693D34AFD0AD50C84D239A45F520BB88174CB98BCE951849F912E639C72FB13B4B4D7177E16D55AC179BA420B2A29FE324... | 2 | ASCII | 190 |
| 0x1407BAD48 | Module32Next | 2 | ASCII | 187 |
| 0x140725D10 | HTTP/1.0 405 Method Not Allowed\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n<html>\n<head>\n<title>This is ... | 1 | ASCII | 183 |
| 0x14073A1A0 | HTTP/1.0 501 Tor is not an HTTP Proxy\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n<html>\n<head>\n<title>Th... | 1 | ASCII | 182 |
| 0x140715F94 | Tor is running as a server, but you are running %s; this probably won't work. See https://www.torproject.org/docs/faq... | 1 | ASCII | 182 |
| 0x14073A775 | Your application (using socks%d to port %d) is giving Tor only an IP address. Applications that do DNS resolves thems... | 1 | ASCII | 180 |
| 0x140712C16 | Onion services version 2 are obsolete. Please see https://blog.torproject.org/v2-deprecation-timeline for more detail... | 1 | ASCII | 180 |
| 0x1406D10C9 | This build of Tor is covered by the GNU General Public License (https://www.gnu.org/licenses/gpl-3.0.en.html)\n | 1 | ASCII | 180 |
| 0x1406DDD8F | Copyright (c) 2001-2004, Roger Dingledine\nCopyright (c) 2004-2006, Roger Dingledine, Nick Mathewson\nCopyright (c) 2... | 1 | ASCII | 179 |
| 0x1406CF580 | Tor can't help you if you use it wrong! Learn how to be safe at https://support.torproject.org/faq/staying-anonymous/ | 1 | ASCII | 179 |
| 0x1406DA23F | UseEntryGuards is disabled, but you have configured one or more hidden services on this Tor instance. Your hidden se... | 1 | ASCII | 178 |
| 0x140716904 | Tor is currently configured as a relay and a hidden service. That's not very secure: you should probably run your hid... | 1 | ASCII | 178 |
| 0x1406EED64 | You are running a new relay. Thanks for helping the Tor network! If you wish to know what will happen in the upcoming... | 1 | ASCII | 178 |
| 0x1406DA4F0 | EntryNodes is set with multiple entries and at least one hidden service is configured. Pinning entry nodes can possib... | 1 | ASCII | 177 |
| 0x1406EF0C8 | You can check the status of your bridge relay at https://bridges.torproject.org/status?id=%s | 1 | ASCII | 174 |
| 0x1406D7EE6 | .onion,.exit | 1 | ASCII | 172 |
| 0x140818310 | providers/implementations/ciphers/cipher_aes_hw_aesni.inc | 1 | ASCII | 170 |
| 0x140744F93 | System\CurrentControlSet\Services\Tcpip\Parameters | 1 | ASCII | 170 |
| 0x14021F137 | setybdetarenegylmodnaroduespemossetybdet | 1 | ASCII | 169 |
| 0x140738D7F | Conflux=1 Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-... | 1 | ASCII | 166 |
| 0x140787C50 | /var/tmp/dist/openssl/ssl/ct_log_list.cnf | 1 | ASCII | 165 |
| 0x1407967FB | /var/tmp/dist/openssl/lib/ossl-modules | 1 | ASCII | 165 |
| 0x14070B7F8 | Somebody attempted to publish an extrainfo with size %d. Either this is an attack, or the MAX_EXTRAINFO_UPLOAD_SIZE (... | 1 | ASCII | 164 |
| 0x14070C21A | Uh-oh. We're sending a RELAY_COMMAND_EXTEND cell, but we have run out of RELAY_EARLY cells on that circuit. Commands... | 1 | ASCII | 164 |
| 0x1406DB003 | CookieAuthFileGroupReadable is set, but will have no effect: you must specify an explicit CookieAuthFile to have it g... | 1 | ASCII | 164 |
| 0x14076B376 | Intel Hardware Cryptographic Service Provider | 1 | UTF16 | 164 |
| 0x140745095 | System\CurrentControlSet\Services\VxD\MSTCP | 1 | ASCII | 164 |
| 0x1406D050E | ed25519_signing_secret_key_encrypted.tmp | 1 | ASCII | 164 |
| 0x14075D7F0 | /tor/status-vote/current/consensus/ | 1 | ASCII | 164 |
| 0x14075D820 | /tor/status-vote/current/consensus- | 1 | ASCII | 164 |
| 0x1407239F0 | 2beaa7557c3c93ec | 3 | ASCII | 164 |
| 0x140705240 | ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES... | 1 | ASCII | 163 |
| 0x140704980 | ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:E... | 1 | ASCII | 163 |
| 0x14074F680 | compiler: x86_64-w64-mingw32-cc -m64 -Wa,--noexecstack -Qunused-arguments -Wall -O3 -fstack-protector-strong -fno-str... | 1 | ASCII | 163 |
| 0x140700EAF | hibernate_state == HIBERNATE_STATE_LOWBANDWIDTH || hibernate_state == HIBERNATE_STATE_DORMANT || hibernate_state == H... | 1 | ASCII | 163 |
| 0x1406FB063 | Unsupported command (--list-fingerprint, --hash-password, --keygen, --dump-config, --verify-config, or --key-expirati... | 1 | ASCII | 163 |
| 0x140748E93 | !fast_mem_is_zero( (char *) &desc->superencrypted_data.auth_ephemeral_pubkey, sizeof(desc->superencrypted_data.auth_e... | 1 | ASCII | 163 |
| 0x14072849A | Fetching v3 hidden service descriptor failed: http status 400 (%s). Dirserver didn't like our query? Retrying at anot... | 1 | ASCII | 163 |
| 0x1407158F2 | You need at least a single managed-proxy to specify a transport listen address. The ServerTransportListenAddr line wi... | 1 | ASCII | 163 |
| 0x14070DF66 | Received an inbound RELAY_EARLY cell on circuit %u. Closing circuit. Please report this event, along with the followi... | 1 | ASCII | 163 |
| 0x1406EEA43 | We just generated an extra-info descriptor with statistics that exceeds the 50 KB upload limit. Removing last added s... | 1 | ASCII | 163 |
| 0x1406EDF71 | Unable to use configured IPv6 ORPort "%s" in a descriptor. Skipping it. Try specifying a globally reachable address e... | 1 | ASCII | 163 |
| 0x1406DC34E | HiddenServiceNonAnonymousMode does not provide any server anonymity. It must be used with HiddenServiceSingleHopMode ... | 1 | ASCII | 163 |
| 0x1406DC2CF | HiddenServiceSingleHopMode does not provide any server anonymity. It must be used with HiddenServiceNonAnonymousMode ... | 1 | ASCII | 163 |
| 0x1407240C0 | circuit->purpose == CIRCUIT_PURPOSE_C_GENERAL failed. The purpose on the circuit was %s; it was in state %s, path_sta... | 1 | ASCII | 163 |
| 0x140755EE8 | Somebody asked us for an older TLS authentication method (AUTHTYPE_RSA_SHA256_TLSSECRET) which we don't support. | 1 | ASCII | 163 |
| 0x1407A70C5 | /var/tmp/dist/openssl/ssl/cert.pem | 1 | ASCII | 163 |
| 0x1406DC3CD | HiddenServiceNonAnonymousMode is incompatible with using Tor as an anonymous client. Please set Socks/Trans/NATD/DNSP... | 1 | ASCII | 162 |
| 0x140768319 | stable-uptime=%lu stable-mtbf=%lu fast-speed=%lu guard-wfu=%.03f%% guard-tk=%lu guard-bw-inc-exits=%lu guard-bw-exc-e... | 1 | ASCII | 162 |
| 0x1407188EF | You have set ClientUseIPv4 1, but ReachableAddresses, ReachableORAddresses, or ReachableDirAddresses reject all IPv4 ... | 1 | ASCII | 162 |
| 0x1407246C5 | Refusing to connect to non-hidden-service hostname or IP address %s because Port has OnionTrafficOnly set (or NoDNSRe... | 1 | ASCII | 162 |
| 0x140737A5B | Auto-discovered IPv6 address %s has not been found reachable. However, IPv4 address is reachable. Publishing server d... | 1 | ASCII | 162 |
| 0x1406FDD9B | Service %s just picked %u intro points and wanted %u for %s descriptor. It currently has %d intro points. Launching E... | 1 | ASCII | 162 |
| 0x14073777F | IPv4 address '%s' with accept6/reject6 field type in exit policy. Ignoring, but continuing to parse rules. (Use accep... | 1 | ASCII | 162 |
| 0x140716F91 | Configured to measure directory request statistics, but no GeoIP database found. Please specify a GeoIP database usin... | 1 | ASCII | 162 |
| 0x140728549 | Fetching v3 hidden service descriptor failed: http status %d (%s) response unexpected from HSDir server %s'. Retrying... | 1 | ASCII | 162 |
| 0x140716261 | Bridges are not supposed to publish router descriptors to the directory authorities. Please correct your PublishServe... | 1 | ASCII | 162 |
| 0x1406DB087 | You have set UseDefaultFallbackDirs 1 and FallbackDir(s). Ignoring UseDefaultFallbackDirs, and using the FallbackDir(... | 1 | ASCII | 162 |
| 0x1407016EF | 650 CIRC_BW ID=%d READ=%lu WRITTEN=%lu TIME=%s DELIVERED_READ=%lu OVERHEAD_READ=%lu DELIVERED_WRITTEN=%lu OVERHEAD_WR... | 1 | ASCII | 162 |
| 0x140724872 | Rejecting request for anonymous connection to private address %s on a TransPort or NATDPort. Possible loop in your N... | 1 | ASCII | 162 |
| 0x1407136E4 | TestingV3AuthInitialVoteDelay plus TestingV3AuthInitialDistDelay must be less than TestingV3AuthInitialVotingInterval | 1 | ASCII | 162 |
| 0x1407118F0 | HTTP/1.0 501 Tor ControlPort is not an HTTP proxy\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n<html>\n<head... | 1 | ASCII | 161 |
| 0x140727D77 | !(TO_CIRCUIT(circ)->purpose != CIRCUIT_PURPOSE_C_INTRODUCING && TO_CIRCUIT(circ)->purpose != CIRCUIT_PURPOSE_C_INTROD... | 1 | ASCII | 161 |
| 0x140718990 | You have configured tor to use or prefer IPv6 (or UseBridges 1), but ReachableAddresses, ReachableORAddresses, or Rea... | 1 | ASCII | 161 |
| 0x1406DAD19 | HTTPProxy configured, but no SOCKS proxy, HTTPS proxy, or any other TCP proxy configured. Watch out: this configurati... | 1 | ASCII | 161 |
| 0x1406DB2E5 | TestingTorNetwork may only be configured in combination with a non-default set of DirAuthority or both of AlternateDi... | 1 | ASCII | 161 |
| 0x14070AFA8 | Somebody attempted to publish a router descriptor '%s' (source: %s) with size %d. Either this is an attack, or the MA... | 1 | ASCII | 161 |
| 0x1407A169A | next-attempt-at %s\nn-download-failures %u\nn-download-attempts %u\nschedule %s\nwant-authority %s\nincrement-on %s\n... | 1 | ASCII | 161 |
| 0x1406F979F | Could not read your DNS config from '%s' - please investigate your DNS configuration. This is possibly a problem. Mea... | 1 | ASCII | 161 |
| 0x1406D9FB0 | Servers must be able to freely connect to the rest of the Internet, so they must not set Reachable*Addresses or Fasci... | 1 | ASCII | 161 |
| 0x1407873FC | The max supported SSL/TLS version needs the MD5-SHA1 digest but it is not available in the loaded providers. Use (D)T... | 1 | ASCII | 161 |
| 0x1406F1478 | Outgoing connection to %s doesn't satisfy ClientPreferIPv6%sPort %d, with ClientUseIPv4 %d, and reachable_addr_use_ip... | 1 | ASCII | 161 |
| 0x14073E9B1 | Too much Middle bandwidth on the network to calculate balanced bandwidth-weights. Consider increasing the number of G... | 1 | ASCII | 161 |
| 0x1406EDAE8 | We're configured as a V3 authority, but we were unable to load our v3 authority keys and certificate! Use tor-gencert... | 1 | ASCII | 161 |
| 0x14070AC0C | Descriptor from router %s has no Ed25519 key, when we previously knew an Ed25519 for it. Ignoring for now, since Ed25... | 1 | ASCII | 161 |
| 0x14071F20B | '%s' expands into rules which apply to all IPv4 and IPv6 addresses. (Use accept/reject *4:* for IPv4 or accept[6]/rej... | 1 | ASCII | 161 |
| 0x140720808 | The cbtrecentcircs consensus parameter came back zero! This disables adaptive timeouts since we can't keep track of ... | 1 | ASCII | 161 |
| 0x1406E800B | Could not pick a hidden service directory for the requested hidden service: they are all either down or excluded, and... | 1 | ASCII | 161 |
| 0x1406D9AB7 | You have specified at least one relative path (see above) with the RunAsDaemon option. RunAsDaemon is not compatible ... | 1 | ASCII | 161 |
| 0x140713020 | Hidden service proof-of-work defenses are enabled in our configuration but this build of tor does not include the req... | 1 | ASCII | 161 |
| 0x140733945 | Discrepancy in counts for queued destroy cells on circuitmux. n=%lld. queue_size=%lld. manual_total=%lld. manual_to... | 1 | ASCII | 161 |
| 0x14071586C | Tor is not configured as a relay but you specified a ServerTransportPlugin line (%s). The ServerTransportPlugin line ... | 1 | ASCII | 161 |
| 0x140720CB3 | Tor now sees network activity. Restoring circuit build timeout recording. Network was down for %d seconds during %d c... | 1 | ASCII | 161 |
| 0x14071701E | Configured to measure entry node statistics, but no GeoIP database found. Please specify a GeoIP database using the G... | 1 | ASCII | 161 |
| 0x1406FEB22 | Invalid hexadecimal encoding. Maybe you tried a plain text password? If so, the standard requires that you put it i... | 1 | ASCII | 161 |
| 0x1406D0AF6 | We've been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which... | 1 | ASCII | 161 |
| 0x14074043C | We received a networkstatus that contains two signatures from the same voter with the same algorithm. Ignoring the se... | 1 | ASCII | 161 |
| 0x1407170F1 | Configured to measure statistics. Look for the *-stats files that will first be written to the data directory in 24 h... | 1 | ASCII | 161 |
| 0x14073A673 | Your application (using socks4a to port %d) instructed Tor to take care of the DNS resolution itself if necessary. Th... | 1 | ASCII | 161 |
| 0x14073AD07 | Your application (using socks5 to port %d) instructed Tor to take care of the DNS resolution itself if necessary. Thi... | 1 | ASCII | 161 |
| 0x14073D182 | Unexpected space in versions list member %s. (These are supposed to be comma-separated; I'll pretend you used commas ... | 1 | ASCII | 161 |
| 0x1406DD3AE | Your log may contain sensitive information - %s. Don't log unless it serves an important reason. Overwrite the log af... | 1 | ASCII | 161 |
| 0x140758588 | DROPTIMEOUTS is dangerous; make sure you understand the risks before using it. It may be removed in a future version ... | 1 | ASCII | 161 |
| 0x1407378E2 | '%s' expands into rules which apply to all private IPv4 and IPv6 addresses. (Use accept/reject private:* for IPv4 and... | 1 | ASCII | 161 |
| 0x1406DD1D7 | DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connec... | 1 | ASCII | 161 |
| 0x1407305F5 | Uploading hidden service descriptor: http status 400 (%s) response from dirserver %s. Malformed hidden service descri... | 1 | ASCII | 161 |
| 0x1407584F1 | DROPGUARDS is dangerous; make sure you understand the risks before using it. It may be removed in a future version of... | 1 | ASCII | 161 |
| 0x14071604F | Nickname '%s', nicknames must be between 1 and 19 characters inclusive, and must contain only the characters [a-zA-Z0... | 1 | ASCII | 161 |
| 0x14075BF67 | Possible replay detected! An INTRODUCE2 cell with the same ENCRYPTED section was seen %ld seconds ago. Dropping cell. | 1 | ASCII | 161 |
| 0x1406CF8EB | Error initializing dns subsystem; exiting. To retry instead, set the ServerDNSAllowBrokenResolvConf option. | 1 | ASCII | 161 |
| 0x140706017 | purpose_to_search_for == CIRCUIT_PURPOSE_C_GENERAL || purpose_to_search_for == CIRCUIT_PURPOSE_HS_VANGUARDS | 1 | ASCII | 161 |
| 0x1407440AA | Unrecognized flag passed to evdns_base_new(). Assuming you meant EVDNS_BASE_INITIALIZE_NAMESERVERS. | 1 | ASCII | 161 |
| 0x1407B94E0 | ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ | 4 | ASCII | 161 |
| 0x1407FFA3D | providers/implementations/ciphers/cipher_camellia_cts.inc | 4 | ASCII | 161 |
| 0x1407F9EF3 | providers/implementations/ciphers/cipher_aes_cts.inc | 4 | ASCII | 161 |
| 0x14078F68B | /var/tmp/dist/openssl/lib/engines-3 | 1 | ASCII | 161 |
| 0x14075B7FF | /var/tmp/dist/openssl/lib/engines-3 | 1 | ASCII | 161 |
| 0x14075DE87 | /tor/post/consensus-signature | 1 | ASCII | 161 |
| 0x1406DA63F | HiddenServiceNonAnonymousMode is set. Every hidden service on this tor instance is NON-ANONYMOUS. If the HiddenServic... | 1 | ASCII | 160 |
| 0x1407045E5 | We were built to run on a 64-bit CPU, with OpenSSL 1.0.1 or later, but with a version of OpenSSL that apparently lack... | 1 | ASCII | 160 |
| 0x14070B42A | Fingerprint and/or ed25519 identity is marked rejected -- if you think this is a mistake please set a valid email add... | 1 | ASCII | 160 |
| 0x14071E356 | dirreq-stats-end %s (%d s)\ndirreq-v3-ips %s\ndirreq-v3-reqs %s\ndirreq-v3-resp ok=%u,not-enough-sigs=%u,unavailable=... | 1 | ASCII | 160 |
| 0x140740DA0 | Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandw... | 1 | ASCII | 160 |
| 0x140718841 | Tor cannot connect to the Internet if ReachableAddresses, ReachableORAddresses, or ReachableDirAddresses reject all a... | 1 | ASCII | 160 |
| 0x1406FEE17 | Password did not match HashedControlPassword value from configuration. Maybe you tried a plain text password? If so, ... | 1 | ASCII | 160 |
| 0x1407323B6 | (((*elm)->hs_circuitmap_node.hte_hash) % head->hth_table_length) == ((((*elm)->hs_circuitmap_node.hte_next)->hs_circu... | 1 | ASCII | 160 |
| 0x14073DBA5 | Nobody has voted on the Running flag. Generating and publishing a consensus without Running nodes would make many cli... | 1 | ASCII | 160 |
| 0x1406F9A00 | eventdns: Received a DNS packet from an IP address to which we did not send a request. This could be a DNS spoofing a... | 1 | ASCII | 160 |
| 0x1406D9CC1 | You have asked to exclude certain relays from all positions in your circuits. Expect hidden services and other Tor fe... | 1 | ASCII | 160 |
| 0x1406FF215 | Extended ORPort authentication cookie was not set. That's weird since we should have done that on startup. This might... | 1 | ASCII | 160 |
| 0x14072EE0E | Wanted to contact directory mirror %s for %s, but it's in our ExcludedNodes list and StrictNodes is set. Skipping. Th... | 1 | ASCII | 160 |
| 0x1407173B1 | We are listening on a non-IPv4 DirPort. This is not allowed. Consider either setting an IPv4 address or simply removi... | 1 | ASCII | 160 |
| 0x1406FC968 | (((*elm)->hs_service_node.hte_hash) % head->hth_table_length) == ((((*elm)->hs_service_node.hte_next)->hs_service_nod... | 1 | ASCII | 160 |
Functions high-value functions
Function listings
0x1404D82A0 sub_1404d82a0 str 3 api 0 imm 4 Unknown
sub_1404d82a0() {
test dl, 0x01
jnz .1
lea rdx, ["crypto/pem/pem_lib.c"]
mov r8d, 0xE2
jmp sub_140419a50()
.1:
lea rax, ["crypto/pem/pem_lib.c"]
mov rdx, r8
mov r8, rax
mov r9d, 0xE0
jmp sub_140481ed0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
undefined8 sub_1404d82a0(uint64_t param_1,uint64_t param_2,undefined8 param_3)
{
int64_t iVar1;
undefined8 uVar2;
if ((param_2 & 1) == 0) {
uVar2 = 0xe2;
sub_140419a50:
if (0x14084c8c0 != sub_140419a50) {
/* WARNING: Could not recover jumptable at 0x000140419a63. Too many branches */
/* WARNING: Treating indirect jump as call */
uVar2 = (*0x14084c8c0)();
return uVar2;
}
/* WARNING: Treating indirect jump as call */
uVar2 = (*api-ms-win-crt-heap-l1-1-0.free)(param_1, "crypto/pem/pem_lib.c", uVar2);
return uVar2;
}
uVar2 = "crypto/pem/pem_lib.c";
if (param_1 != 0) {
if ((([0x0x140860ff8] != '\x01') || (param_1 < [0x0x140861020])) ||
([0x0x140861020] + [0x0x140861028] <= param_1)) {
OPENSSL_cleanse(param_1, param_3);
uVar2 = 0xe0;
goto sub_140419a50;
}
uVar2 = sub_14044f910([0x0x140861000]);
if (uVar2 != 0) {
iVar1 = sub_140481520(param_1);
OPENSSL_cleanse(param_1, iVar1);
[0x0x140861008] = [0x0x140861008] - iVar1;
sub_1404817e0(param_1);
if (*([0x0x140861000] + 8) != 0) {
*([0x0x140861000] + 8) = 0;
jmp_kernel32.ReleaseSRWLockExclusive();
return 1;
}
jmp_kernel32.ReleaseSRWLockShared();
return 1;
}
}
return uVar2;
}
0x1404D8270 sub_1404d8270 str 2 api 0 imm 4 Unknown
sub_1404d8270() {
movsxd rcx, ecx
test dl, 0x01
jnz .1
lea rdx, ["crypto/pem/pem_lib.c"]
mov r8d, 0xE8
jmp 0x1404198F0
.1:
lea rdx, ["crypto/pem/pem_lib.c"]
mov r8d, 0xE7
jmp sub_140480d50()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
undefined (*) [16] sub_1404d8270(int32_t param_1,uint64_t param_2)
{
undefined (*pauVar1) [16];
code *pcVar2;
int32_t iVar3;
undefined (*pauVar4) [16];
int64_t iVar5;
uint64_t uVar6;
uint64_t uVar7;
uint8_t uVar8;
uint64_t uVar9;
uint64_t uVar10;
int64_t iVar11;
uint64_t uVar12;
uint64_t uVar13;
int64_t *piVar14;
uint64_t uVar15;
uint64_t uVar16;
undefined8 uVar17;
int64_t iVar18;
int64_t *piVar19;
int64_t iVar20;
int64_t iVar21;
int64_t iVar22;
bool bVar23;
undefined (*pauStack_68) [16];
uVar9 = param_1;
if ((param_2 & 1) == 0) {
uVar17 = 0xe8;
}
else {
uVar17 = 0xe7;
if ([0x0x140860ff8] != '\0') {
iVar3 = sub_14044f910([0x0x140861000], "crypto/pem/pem_lib.c", 0xe7);
uVar7 = [0x0x140861038];
if (iVar3 == 0) {
return 0x0;
}
pauVar4 = 0x0;
iVar5 = 0;
if (uVar9 <= [0x0x140861028]) {
iVar5 = [0x0x140861038] * 8;
uVar10 = [0x0x140861040];
iVar20 = -1;
uVar13 = [0x0x140861038];
iVar21 = 0;
do {
iVar11 = iVar21;
uVar12 = uVar13;
iVar22 = iVar20;
uVar13 = uVar12 - 1;
iVar5 = iVar5 + -8;
bVar23 = uVar10 < uVar9;
uVar10 = uVar10 * 2;
iVar20 = iVar22 + -1;
iVar21 = iVar11 + -8;
} while (bVar23);
if (uVar13 < 0) {
pauVar4 = 0x0;
iVar5 = 0;
}
else {
pauStack_68 = 0x140861030;
pauVar4 = 0x0;
iVar20 = 0;
do {
piVar14 = *(0x140861030[-1] + iVar20 * 8 + iVar5 + 0x10);
if (piVar14 != 0x0) {
uVar9 = [0x0x140861028];
iVar5 = [0x0x140861048];
if (iVar20 == 0) goto code_r0x00014048129c;
iVar21 = -iVar20;
uVar10 = uVar13 + iVar20 & 0xffffffff;
iVar20 = [0x0x140861038] * 8;
goto code_r0x000140480ea9;
}
iVar22 = iVar22 + -1;
iVar11 = iVar11 + -8;
iVar21 = uVar13 + iVar20;
iVar20 = iVar20 + -1;
} while (0 < iVar21);
iVar5 = 0;
}
}
code_r0x0001404813bf:
[0x0x140861008] = [0x0x140861008] + iVar5;
sub_14044f930([0x0x140861000]);
return pauVar4;
}
}
if (0x14084c8b0 != 0x1404198f0) {
/* WARNING: Could not recover jumptable at 0x000140419903. Too many branches */
/* WARNING: Treating indirect jump as call */
pauVar4 = (*0x14084c8b0)();
return pauVar4;
}
if (uVar9 == 0) {
return 0x0;
}
if ([0x0x140860b90] == '\0') {
[0x0x140860b90] = '\x01';
}
/* WARNING: Treating indirect jump as call */
pauVar4 = (*api-ms-win-crt-heap-l1-1-0.malloc)(uVar9, "crypto/pem/pem_lib.c", uVar17);
return pauVar4;
while( true ) {
iVar22 = iVar22 + 1;
uVar10 = uVar10 + 1;
iVar11 = iVar11 + 8;
iVar21 = iVar21 + -1;
uVar9 = [0x0x140861028];
if (iVar21 == 0) break;
code_r0x000140480ea9:
uVar9 = uVar7 + iVar22;
if ((uVar9 < 0) || ([0x0x140861038] <= uVar10)) goto code_r0x0001404813e6;
uVar15 = [0x0x140861028] >> (uVar10 & 0x3f);
uVar6 = piVar14 - 0x140861020;
if ((uVar6 & uVar15 - 1) != 0) goto code_r0x0001404813ff;
if ((uVar6 | uVar15) >> 0x20 == 0) {
uVar6 = (uVar6 & 0xffffffff) / (uVar15 & 0xffffffff);
}
else {
uVar6 = uVar6 / uVar15;
}
uVar6 = uVar6 + (1LL << (uVar10 & 0x3f));
if ((uVar6 == 0) || ([0x0x140861058] <= uVar6)) goto code_r0x000140481418;
if ((*([0x0x140861050] + (uVar6 >> 3)) >> (uVar6 & 7) & 1) != 0) goto code_r0x000140481431;
sub_1404821e0(piVar14, uVar9 & 0xffffffff, [0x0x140861048]);
iVar5 = *piVar14;
if (iVar5 != 0) {
*(iVar5 + 8) = piVar14[1];
}
*piVar14[1] = iVar5;
if (((*piVar14 != 0) &&
((pauVar4 = *(*piVar14 + 8), pauVar4 < 0x140861030 ||
(*0x140861030 + [0x0x140861038] * 8 <= pauVar4)))) &&
((pauVar4 < 0x140861020 || (*0x140861020 + [0x0x140861028] <= pauVar4))))
goto code_r0x0001404814c7;
if (piVar14 == *(*0x140861030 + iVar22 * 8 + iVar20)) goto code_r0x00014048144a;
uVar9 = uVar7 + iVar22 + 1;
if ((uVar9 < 0) || (uVar6 = uVar9 & 0xffffffff, [0x0x140861038] <= uVar6)) goto code_r0x0001404813e6;
uVar16 = [0x0x140861028] >> (uVar6 & 0x3f);
uVar15 = piVar14 - 0x140861020;
if ((uVar16 - 1 & uVar15) != 0) goto code_r0x0001404813ff;
uVar8 = uVar9;
iVar18 = 1LL << (uVar8 & 0x3f);
if ((uVar15 | uVar16) >> 0x20 == 0) {
uVar15 = (uVar15 & 0xffffffff) / (uVar16 & 0xffffffff);
}
else {
uVar15 = uVar15 / uVar16;
}
uVar15 = uVar15 + iVar18;
if ((uVar15 == 0) || ([0x0x140861058] <= uVar15)) goto code_r0x000140481418;
if ((*([0x0x140861050] + (uVar15 >> 3)) >> (uVar15 & 7) & 1) != 0) goto code_r0x000140481463;
sub_140482000(piVar14, uVar9 & 0xffffffff, [0x0x140861048]);
sub_140482100(*0x140861030 + iVar11 + iVar20, piVar14);
if (*(*0x140861030 + iVar22 * 8 + iVar20 + 8) != piVar14) goto code_r0x00014048147c;
if ([0x0x140861038] <= uVar6) goto code_r0x0001404813e6;
piVar14 = piVar14 + ([0x0x140861028] >> (uVar8 & 0x3f));
uVar15 = [0x0x140861028] >> (uVar6 & 0x3f);
uVar6 = piVar14 - 0x140861020;
if ((uVar6 & uVar15 - 1) != 0) goto code_r0x0001404813ff;
if ((uVar6 | uVar15) >> 0x20 == 0) {
uVar6 = (uVar6 & 0xffffffff) / (uVar15 & 0xffffffff);
}
else {
uVar6 = uVar6 / uVar15;
}
uVar6 = uVar6 + iVar18;
if ((uVar6 == 0) || ([0x0x140861058] <= uVar6)) goto code_r0x000140481418;
if ((*([0x0x140861050] + (uVar6 >> 3)) >> (uVar6 & 7) & 1) != 0) goto code_r0x000140481495;
sub_140482000(piVar14, uVar9 & 0xffffffff, [0x0x140861048]);
sub_140482100(*0x140861030 + iVar11 + iVar20);
iVar5 = [0x0x140861048];
pauStack_68 = 0x140861030;
if (*(*0x140861030 + iVar22 * 8 + iVar20 + 8) != piVar14) goto code_r0x0001404814ae;
piVar19 = [0x0x140861028] >> (uVar8 & 0x3f);
uVar6 = [0x0x140861028] >> (uVar8 & 0x3f);
uVar9 = piVar14 - 0x140861020;
if ((uVar9 | uVar6) >> 0x20 == 0) {
uVar9 = (uVar9 & 0xffffffff) / (uVar6 & 0xffffffff);
}
else {
uVar9 = uVar9 / uVar6;
}
uVar15 = uVar9 + iVar18 ^ 1;
uVar9 = uVar9 + iVar18 >> 3;
if (((*([0x0x140861048] + uVar9) >> (uVar15 & 7) & 1) == 0) ||
((1LL << (uVar15 & 7) & *([0x0x140861050] + uVar9)) != 0)) {
if (piVar14 != piVar19) goto code_r0x00014048126e;
}
else if (piVar14 - piVar19 != *0x140861020 + (uVar15 & iVar18 - 1U) * uVar6) {
code_r0x00014048126e:
uVar9 = 0x294;
sub_140469b60("assertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)", "crypto/mem_sec.c");
break;
}
}
code_r0x00014048129c:
if ((uVar13 < 0) || ([0x0x140861038] <= (uVar13 & 0xffffffff))) {
code_r0x0001404813e6:
sub_140469b60("assertion failed: list >= 0 && list < sh.freelist_size", "crypto/mem_sec.c", 0x157);
code_r0x0001404813ff:
sub_140469b60("assertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0", "crypto/mem_sec.c", 0x158);
code_r0x000140481418:
sub_140469b60("assertion failed: bit > 0 && bit < sh.bittable_size", "crypto/mem_sec.c", 0x15a);
code_r0x000140481431:
sub_140469b60("assertion failed: !sh_testbit(temp, slist, sh.bitmalloc)", "crypto/mem_sec.c", 0x27f);
code_r0x00014048144a:
sub_140469b60("assertion failed: temp != sh.freelist[slist]", "crypto/mem_sec.c", 0x282);
code_r0x000140481463:
sub_140469b60("assertion failed: !sh_testbit(temp, slist, sh.bitmalloc)", "crypto/mem_sec.c", 0x288);
code_r0x00014048147c:
sub_140469b60("assertion failed: sh.freelist[slist] == temp", "crypto/mem_sec.c", 0x28b);
/* listing truncated */
0x140475AB0 sub_140475ab0 str 2 api 0 imm 3 Unknown
sub_140475ab0() {
mov r9, r8
test edx, edx
jz .1
lea rdx, ["TRUE"]
mov r8d, 0x04
jmp sub_140475860()
.1:
lea rdx, ["FALSE"]
mov r8d, 0x05
jmp sub_140475860()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
undefined8 sub_140475ab0(int64_t param_1,int32_t param_2,int64_t *param_3)
{
int64_t iVar1;
int32_t iVar2;
int64_t iVar3;
int64_t iVar4;
undefined8 *puVar5;
int64_t iVar6;
undefined8 uVar7;
if (param_2 == 0) {
iVar6 = "FALSE";
uVar7 = 5;
}
else {
iVar6 = "TRUE";
uVar7 = 4;
}
iVar1 = *param_3;
if (param_1 == 0) {
iVar3 = 0;
if (iVar6 != 0) goto code_r0x0001404758a1;
code_r0x0001404758e6:
iVar6 = 0;
code_r0x0001404758e8:
puVar5 = func_0x0001404198f0(0x18, "crypto/x509/v3_utl.c", 0x39);
if (puVar5 == 0x0) {
puVar5 = 0x0;
}
else {
if (iVar1 == 0) {
iVar4 = sub_140308aa0();
*param_3 = iVar4;
if (iVar4 == 0) goto code_r0x00014047594e;
}
*puVar5 = 0;
puVar5[1] = iVar3;
puVar5[2] = iVar6;
iVar2 = sub_140309360(*param_3, puVar5);
if (iVar2 != 0) {
return 1;
}
}
}
else {
iVar3 = sub_1404562f0(param_1, "crypto/x509/v3_utl.c", 0x2f);
if (iVar3 == 0) {
iVar3 = 0;
}
else {
if (iVar6 == 0) goto code_r0x0001404758e6;
code_r0x0001404758a1:
iVar4 = jmp_api-ms-win-crt-private-l1-1-0.memchr(iVar6, 0, uVar7);
if ((iVar4 == 0) && (iVar6 = sub_140456360(iVar6, uVar7, "crypto/x509/v3_utl.c", 0x35), iVar6 != 0))
goto code_r0x0001404758e8;
}
puVar5 = 0x0;
iVar6 = 0;
}
code_r0x00014047594e:
sub_140452b20();
sub_140452c40("crypto/x509/v3_utl.c", 0x44, "x509v3_add_len_value");
sub_140452d10(0x22, 0xc0100, 0);
if (iVar1 == 0) {
sub_140308880(*param_3);
*param_3 = 0;
}
sub_140419a50(puVar5, "crypto/x509/v3_utl.c", 0x49);
sub_140419a50(iVar3, "crypto/x509/v3_utl.c", 0x4a);
sub_140419a50(iVar6, "crypto/x509/v3_utl.c", 0x4b);
return 0;
}
0x14061C4A0 sub_14061c4a0 str 2 api 0 imm 2 Unknown
sub_14061c4a0() {
lea rcx, ["NULL"]
lea rdx, ["crypto/ct/ct_x509v3.c"]
mov r8d, 0x12
jmp sub_1404562f0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
int64_t sub_14061c4a0(void)
{
char *pcVar1;
int64_t iVar2;
if (["NULL"] == '\0') {
iVar2 = func_0x0001404198f0(1, "crypto/ct/ct_x509v3.c", 0x12);
}
else {
iVar2 = 0;
do {
pcVar1 = iVar2 + 0x1407d890b;
iVar2 = iVar2 + 1;
if (*pcVar1 == '\0') break;
} while (-1 < iVar2);
iVar2 = func_0x0001404198f0((iVar2 & 0x7fffffff) + 1, "crypto/ct/ct_x509v3.c", 0x12);
}
if (iVar2 == 0) {
iVar2 = 0;
}
else {
jmp_api-ms-win-crt-string-l1-1-0.strcpy(iVar2, "NULL");
}
return iVar2;
}
0x1404159C0 sub_1404159c0 str 1 api 0 imm 5 Unknown
sub_1404159c0() {
sub rsp, 0x38
mov [rsp+0x28], r8
mov [rsp+0x20], rdx
lea r9, ["mgf1-digest"]
mov edx, 0xFFFFFFFF
mov r8d, 0x7F0
call sub_140415790()
nop
add rsp, 0x38
ret
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_1404159c0(undefined8 param_1,undefined8 param_2,undefined8 param_3)
{
sub_140415790(param_1, 0xffffffff, 0x7f0, "mgf1-digest", param_2, param_3);
return;
}
0x1405DC570 sub_1405dc570 str 1 api 0 imm 5 Unknown
sub_1405dc570() {
lea r8, ["crypto/modes/gcm128.c"]
mov edx, 0x1B8
mov r9d, 0x741
jmp sub_140419bf0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_1405dc570(int64_t param_1)
{
if (param_1 == 0) {
return;
}
OPENSSL_cleanse(param_1);
if (0x14084c8c0 == sub_140419a50) {
/* WARNING: Treating indirect jump as call */
(*api-ms-win-crt-heap-l1-1-0.free)(param_1);
return;
}
/* WARNING: Could not recover jumptable at 0x000140419c35. Too many branches */
/* WARNING: Treating indirect jump as call */
(*0x14084c8c0)(param_1, "crypto/modes/gcm128.c", 0x741);
return;
}
0x140679320 sub_140679320 str 1 api 0 imm 5 Unknown
sub_140679320() {
test rcx, rcx
jz .1
lea r8, ["providers/implementations/ciphers/cipher_aes_cbc_hmac_sha.c"]
mov edx, 0x318
mov r9d, 0x158
jmp sub_140456400()
.1:
xor eax, eax
ret
}
/* DISPLAY WARNING: Type casts are NOT being printed */
int64_t sub_140679320(int64_t param_1)
{
int64_t iVar1;
if (param_1 == 0) {
return 0;
}
iVar1 = 0;
if (param_1 != 0) {
iVar1 = func_0x0001404198f0(0x318, "providers/implementations/ciphers/cipher_aes_cbc_hmac_sha.c", 0x158);
if (iVar1 == 0) {
sub_140452b20();
sub_140452c40("crypto/o_str.c", 0x3c, "CRYPTO_memdup");
iVar1 = 0;
sub_140452d10(0xf, 0xc0100, 0);
}
else {
jmp_api-ms-win-crt-private-l1-1-0.memcpy(iVar1, param_1, 0x318);
}
}
return iVar1;
}
0x140679C00 sub_140679c00 str 1 api 0 imm 5 Unknown
sub_140679c00() {
lea r8, ["providers/implementations/ciphers/cipher_aes_cbc_hmac_sha.c"]
mov edx, 0x348
mov r9d, 0x17A
jmp sub_140456400()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
int64_t sub_140679c00(int64_t param_1)
{
int64_t iVar1;
iVar1 = 0;
if (param_1 != 0) {
iVar1 = func_0x0001404198f0(0x348, "providers/implementations/ciphers/cipher_aes_cbc_hmac_sha.c", 0x17a);
if (iVar1 == 0) {
sub_140452b20();
sub_140452c40("crypto/o_str.c", 0x3c, "CRYPTO_memdup");
iVar1 = 0;
sub_140452d10(0xf, 0xc0100, 0);
}
else {
jmp_api-ms-win-crt-private-l1-1-0.memcpy(iVar1, param_1, 0x348);
}
}
return iVar1;
}
0x140469B60 sub_140469b60 str 1 api 0 imm 4 Unknown
sub_140469b60() {
sub rsp, 0x28
mov r9, rcx
lea rcx, ["%s:%d: OpenSSL internal error: %s\n"]
call sub_140469750()
mov ecx, 0x16
call jmp_api-ms-win-crt-runtime-l1-1-0.raise()
mov ecx, 0x03
call jmp_api-ms-win-crt-runtime-l1-1-0._exit()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_140469b60(undefined8 param_1,undefined8 param_2,undefined8 param_3)
{
code *pcVar1;
sub_140469750("%s:%d: OpenSSL internal error: %s\u25d9", param_2, param_3, param_1);
jmp_api-ms-win-crt-runtime-l1-1-0.raise(0x16);
jmp_api-ms-win-crt-runtime-l1-1-0._exit(3);
pcVar1 = swi(3);
(*pcVar1)();
return;
}
0x1405687F0 sub_1405687f0 str 1 api 0 imm 4 Unknown
sub_1405687f0() {
lea rdx, ["ssl/ssl_conf.c"]
mov ecx, 0xB0
mov r8d, 0x3CE
jmp sub_140419930()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
int64_t sub_1405687f0(void)
{
int64_t iVar1;
if (0x14084c8b0 == 0x1404198f0) {
if ([0x0x140860b90] == '\0') {
[0x0x140860b90] = '\x01';
}
iVar1 = jmp_api-ms-win-crt-heap-l1-1-0.malloc(0xb0, "ssl/ssl_conf.c", 0x3ce);
}
else {
iVar1 = (*0x14084c8b0)(0xb0);
}
if (iVar1 == 0) {
iVar1 = 0;
}
else {
jmp_api-ms-win-crt-string-l1-1-0.memset(iVar1, 0, 0xb0);
}
return iVar1;
}
0x1405A9F20 sub_1405a9f20 str 1 api 0 imm 4 Unknown
sub_1405a9f20() {
mov rax, [rcx]
test rax, rax
jz .1
test byte ptr [rax], 0x08
jnz .2
.1:
ret
.2:
lea rdx, ["crypto/x509/pcy_tree.c"]
mov r8d, 0x272
jmp sub_140419a50()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_1405a9f20(uint8_t **param_1)
{
if ((*param_1 != 0x0) && ((**param_1 & 8) != 0)) {
if (0x14084c8c0 != sub_140419a50) {
/* WARNING: Could not recover jumptable at 0x000140419a63. Too many branches */
/* WARNING: Treating indirect jump as call */
(*0x14084c8c0)();
return;
}
/* WARNING: Treating indirect jump as call */
(*api-ms-win-crt-heap-l1-1-0.free)(param_1, "crypto/x509/pcy_tree.c", 0x272);
return;
}
return;
}
0x140677D30 sub_140677d30 str 1 api 0 imm 4 Unknown
sub_140677d30() {
lea r8, ["providers/implementations/ciphers/cipher_aes_gcm.c"]
mov edx, 0x3C0
mov r9d, 0x39
jmp sub_140419bf0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_140677d30(int64_t param_1)
{
if (param_1 == 0) {
return;
}
OPENSSL_cleanse(param_1);
if (0x14084c8c0 == sub_140419a50) {
/* WARNING: Treating indirect jump as call */
(*api-ms-win-crt-heap-l1-1-0.free)(param_1);
return;
}
/* WARNING: Could not recover jumptable at 0x000140419c35. Too many branches */
/* WARNING: Treating indirect jump as call */
(*0x14084c8c0)(param_1, "providers/implementations/ciphers/cipher_aes_gcm.c", 0x39);
return;
}
0x140678020 sub_140678020 str 1 api 0 imm 4 Unknown
sub_140678020() {
lea r8, ["providers/implementations/ciphers/cipher_aes_ccm.c"]
mov edx, 0x1A0
mov r9d, 0x3D
jmp sub_140419bf0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_140678020(int64_t param_1)
{
if (param_1 == 0) {
return;
}
OPENSSL_cleanse(param_1);
if (0x14084c8c0 == sub_140419a50) {
/* WARNING: Treating indirect jump as call */
(*api-ms-win-crt-heap-l1-1-0.free)(param_1);
return;
}
/* WARNING: Could not recover jumptable at 0x000140419c35. Too many branches */
/* WARNING: Treating indirect jump as call */
(*0x14084c8c0)(param_1, "providers/implementations/ciphers/cipher_aes_ccm.c", 0x3d);
return;
}
0x14067D8E0 sub_14067d8e0 str 1 api 0 imm 4 Unknown
sub_14067d8e0() {
lea r8, ["providers/implementations/ciphers/cipher_aria_gcm.c"]
mov edx, 0x3D8
mov r9d, 0x32
jmp sub_140419bf0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_14067d8e0(int64_t param_1)
{
if (param_1 == 0) {
return;
}
OPENSSL_cleanse(param_1);
if (0x14084c8c0 == sub_140419a50) {
/* WARNING: Treating indirect jump as call */
(*api-ms-win-crt-heap-l1-1-0.free)(param_1);
return;
}
/* WARNING: Could not recover jumptable at 0x000140419c35. Too many branches */
/* WARNING: Treating indirect jump as call */
(*0x14084c8c0)(param_1, "providers/implementations/ciphers/cipher_aria_gcm.c", 0x32);
return;
}
0x14067DBD0 sub_14067dbd0 str 1 api 0 imm 4 Unknown
sub_14067dbd0() {
lea r8, ["providers/implementations/ciphers/cipher_aria_ccm.c"]
mov edx, 0x1B0
mov r9d, 0x32
jmp sub_140419bf0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_14067dbd0(int64_t param_1)
{
if (param_1 == 0) {
return;
}
OPENSSL_cleanse(param_1);
if (0x14084c8c0 == sub_140419a50) {
/* WARNING: Treating indirect jump as call */
(*api-ms-win-crt-heap-l1-1-0.free)(param_1);
return;
}
/* WARNING: Could not recover jumptable at 0x000140419c35. Too many branches */
/* WARNING: Treating indirect jump as call */
(*0x14084c8c0)(param_1, "providers/implementations/ciphers/cipher_aria_ccm.c", 0x32);
return;
}
0x140682690 sub_140682690 str 1 api 0 imm 4 Unknown
sub_140682690() {
lea r8, ["providers/implementations/digests/sha3_prov.c"]
mov edx, 0x1A0
mov r9d, 0x102
jmp sub_140419bf0()
}
/* DISPLAY WARNING: Type casts are NOT being printed */
void sub_140682690(int64_t param_1)
{
if (param_1 == 0) {
return;
}
OPENSSL_cleanse(param_1);
if (0x14084c8c0 == sub_140419a50) {
/* WARNING: Treating indirect jump as call */
(*api-ms-win-crt-heap-l1-1-0.free)(param_1);
return;
}
/* WARNING: Could not recover jumptable at 0x000140419c35. Too many branches */
/* WARNING: Treating indirect jump as call */
(*0x14084c8c0)(param_1, "providers/implementations/digests/sha3_prov.c", 0x102);
return;
}
| Library | Functions |
|---|---|
| openssl | 22 |
| curl | 2 |