joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x140007b4f
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x1f], 0x696c7075
mov dword [rbp - 0x1b], 0x65746163
mov word [rbp - 0x11], 0x78
mov byte [rbp - 0x17], 0x54
mov byte [rbp - 0x12], 0x45
mov byte [rbp - 0x20], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140007b47
mov rax, qword [rbp + 0x48]
mov r9d, esi
mov qword [rsp + 0x28], rax
mov r8, r14
mov eax, dword [rbp + 0x40]
mov edx, r15d
mov rcx, r12
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140007b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov word [rbp - 0xa], 0x7261
mov rsi, rcx
mov dword [rbp - 7], 0x65707954
xor ebx, ebx
mov word [rbp - 3], 0x41
mov word [rbp - 0xd], 0x6942
mov word [rbp - 0x10], 0x6547
mov byte [rbp - 0xb], WSASetLastError
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 8], 0x79
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007bdb
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x140007bf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x1a], 0x746e6572
mov dword [rbp - 0x1f], 0x75437465
mov dword [rbp - 0x12], 0x737365
mov dword [rbp - 0x16], 0x636f7250
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x1b], WSACleanup
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007c45
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140007c54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14d, r8d
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.140007718
mov rdi, rax
test rax, rax
je 0x140007ce4
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x69467465
mov rcx, rax
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0x10], 0x416f66
mov dword [rbp - 0x15], 0x496e6f69
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x11], WSASetLastError
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007cdc
mov r9, rsi
mov r8d, r14d
mov edx, r15d
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x140007d04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x4c746547
mov byte [rbp - 4], bl
mov dword [rbp - 0xb], 0x72457473
mov word [rbp - 6], 0x726f
mov byte [rbp - 7], WSACleanup
mov byte [rbp - 0xc], 0x61
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007d4d
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x140007d5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, r8d
mov dword [rbp - 0x18], 0x6c694665
mov rsi, rdx
mov word [rbp - 0x14], 0x4e65
mov r14, rcx
mov dword [rbp - 0x20], 0x4d746547
xor ebx, ebx
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x11], 0x41656d
mov byte [rbp - 0x12], 0x61
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007dcc
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x140007de8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x140007e90
lea rdx, [rbp - 0x20]
mov word [rbp - 0x11], 0x6972
mov rcx, rax
mov dword [rbp - 0xb], 0x6c636144
mov dword [rbp - 0x16], 0x73654479
mov word [rbp - 0xe], 0x6f74
mov dword [rbp - 0x1d], 0x75636553
mov byte [rbp - 0x12], 0x63
mov byte [rbp - 7], bl
mov word [rbp - 0x19], 0x6972
mov byte [rbp - 0xf], reloc.WS2_32.dll_WSASetLastError
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0xc], WSACleanup
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007e88
mov r9, rsi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x140007eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x1e], 0x72685474
mov rsi, rcx
mov word [rbp - 0x20], 0x6547
xor ebx, ebx
mov dword [rbp - 0x17], 0x746e6f43
mov dword [rbp - 0x13], 0x747865
mov word [rbp - 0x19], 0x6461
mov byte [rbp - 0x1a], 0x65
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007f15
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140008014
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0xb], 0x61726269
mov byte [rbp - 4], bl
mov rdi, rcx
mov dword [rbp - 0xf], 0x4c64616f
mov word [rbp - 6], 0x4179
mov byte [rbp - 0x10], 0x4c
mov byte [rbp - 7], WSACleanup
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008069
mov rcx, rdi
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x1400080cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov esi, r9d
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400076dc
mov rdi, rax
test rax, rax
je 0x14000814b
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xb], 0x6f426567
mov rcx, rax
mov dword [rbp - 0x10], 0x7373654d
mov byte [rbp - 0xc], 0x61
mov word [rbp - 7], 0x4178
mov byte [rbp - 5], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008143
mov r9d, esi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x14000816c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov edi, r8d
mov word [rbp - 0xf], 0x6570
mov esi, edx
mov word [rbp - 6], reloc.WS2_32.dll_WSAStartup
mov r14d, ecx
mov word [rbp - 9], 0x6563
or rbx, 0xffffffffffffffff
mov word [rbp - 0xc], 0x7250
mov byte [rbp - 0xd], WSASetLastError
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 7], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], 0x4f
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400081df
mov r8d, edi
mov edx, esi
mov ecx, r14d
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x1400081fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov word [rbp - 0xc], 0x7365
mov byte [rbp - 2], bl
mov rdi, rdx
mov rsi, rcx
mov word [rbp - 9], 0x3233
mov dword [rbp - 0x10], 0x636f7250
mov dword [rbp - 6], 0x74737269
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 7], 0x46
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008261
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x140008278
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
mov edi, 1
call fcn.1400aa274
mov rbx, rax
test rax, rax
je 0x140008329
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xf], 0x6e456765
mov rcx, rax
mov word [rbp - 4], 0x41
mov dword [rbp - 9], 0x4579654b
mov byte [rbp - 0x10], 0x52
mov word [rbp - 0xb], 0x6d75
mov byte [rbp - 5], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140008321
mov rax, qword [rbp + 0x58]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov r8, r14
mov rax, qword [rbp + 0x50]
mov edx, r15d
mov qword [rsp + 0x30], rax
mov rcx, r12
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000834c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14d, r8d
mov r15, rdx
mov r12, rcx
mov edi, 1
call fcn.1400aa274
mov rbx, rax
test rax, rax
je 0x1400083e2
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x4f676552
mov rcx, rax
mov word [rbp - 0xc], 0x6570
mov dword [rbp - 9], 0x4579654b
mov word [rbp - 4], 0x57
mov byte [rbp - 0xa], WSASetLastError
mov byte [rbp - 5], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400083da
mov rax, qword [rbp + 0x40]
mov r9d, esi
mov r8d, r14d
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, r12
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140008404
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov edi, 1
call fcn.1400aa274
mov rbx, rax
test rax, rax
je 0x1400084ad
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x4565756c
mov rcx, rax
mov dword [rbp - 0x20], 0x51676552
mov word [rbp - 0x11], 0x57
mov word [rbp - 0x19], 0x5679
mov word [rbp - 0x1c], 0x6575
mov byte [rbp - 0x12], 0x78
mov byte [rbp - 0x17], 0x61
mov byte [rbp - 0x1a], WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400084a5
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r14
mov rax, qword [rbp + 0x40]
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400085f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.140007718
mov rdi, rax
test rax, rax
je 0x14000867b
lea rdx, [rbp - 0x10]
mov dword [rbp - 5], 0x416575
mov rcx, rax
mov dword [rbp - 0x10], 0x51726556
mov dword [rbp - 0xa], 0x61567972
mov word [rbp - 0xc], 0x6575
mov byte [rbp - 6], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008673
mov r9, rsi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x14000869c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
call fcn.1400aa32c
mov rbx, rax
test rax, rax
je 0x1400086ff
lea rdx, [rbp - 0x10]
mov dword [rbp - 6], 0x79726f
mov rcx, rax
mov word [rbp - 0xd], 0x7246
mov word [rbp - 0x10], 0x5457
mov dword [rbp - 0xb], 0x654d6565
mov byte [rbp - 0xe], 0x53
mov byte [rbp - 7], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400086f7
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400aa6c4
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
Function at 0x14000bcec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov ecx, 0x2710
mov dword [0x1400d3644], 1
call fcn.14000e868
call fcn.1400a7d04
mov word [rsp + 0x3b], WSASetLastError
mov dword [rsp + 0x32], 0x6c656e72
mov dword [rsp + 0x36], 0x642e3233
mov word [rsp + 0x30], 0x656b
mov byte [rsp + 0x3a], WSASetLastError
call fcn.1400a722c
call fcn.14000b990
or ebx, 0xffffffff
lea rcx, [0x1400d36a0]
mov edx, ebx
call fcn.140013bec
mov rcx, rax
call fcn.1400a8444
mov edx, ebx
lea rcx, [0x1400d36a0]
call fcn.140013eec
and dword [rbp + 0x70], 0
lea rcx, [rsp + 0x50]
mov ebx, 0x104
xor edx, edx
mov r8d, ebx
call fcn.14001b5f0
mov r8d, ebx
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.140007d5c
test eax, eax
je 0x14000bdb2
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
mov r9d, 0x20
lea rcx, [rbp + 0x70]
xor r8d, r8d
call fcn.140023d1c
and dword [rbp + 0x78], 0
lea rcx, [rsp + 0x30]
xor ebx, ebx
mov word [rsp + 0x49], 0x6165
mov word [rsp + 0x46], 0x6854
mov dword [rsp + 0x41], 0x74616572
mov word [rsp + 0x4b], 0x64
mov byte [rsp + 0x40], 0x43
mov byte [rsp + 0x48], WSACleanup
mov byte [rsp + 0x45], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400d3610], rax
test rax, rax
je 0x14000be5c
cmp qword [0x1400d3660], 0
jne 0x14000be57
lea rcx, [rbp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea r8, [0x14000a734]
and dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
call rax
mov qword [0x1400d3660], rax
test rax, rax
jne 0x14000be57
mov ecx, 0xbb8
call fcn.14000e868
inc ebx
cmp ebx, 3
jge 0x14000be57
mov rax, qword [0x1400d3610]
jmp 0x14000be09
mov eax, 1
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rbp
ret
Function at 0x14000d844
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12d, ecx
mov edi, 1
call fcn.14000d804
mov rbx, rax
test rax, rax
je 0x14000d8ef
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x72657551
mov rcx, rax
mov word [rbp - 0x1d], 0x636f
mov dword [rbp - 0x14], 0x676e6972
mov word [rbp - 0x20], 0x7341
mov word [rbp - 0x16], 0x7453
mov word [rbp - 0x10], 0x41
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x17], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000d8e7
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r14
mov rax, qword [rbp + 0x40]
mov edx, r15d
mov ecx, r12d
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000d974
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, 0x80004005
call fcn.14000d7d8
mov rbx, rax
test rax, rax
je 0x14000d9e6
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xf], 0x6572436f
mov rcx, rax
mov word [rbp - 8], 0x7547
mov word [rbp - 5], 0x64
mov word [rbp - 0xa], 0x6574
mov byte [rbp - 0xb], 0x61
mov byte [rbp - 0x10], 0x43
mov byte [rbp - 6], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d9de
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
Function at 0x14000da00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x14000dad8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x74616572
mov rcx, rax
mov dword [rbp - 0x14], 0x55734173
mov dword [rbp - 0x19], 0x65636f72
mov dword [rbp - 0xf], 0x417265
mov byte [rbp - 0x20], 0x43
mov word [rbp - 0x1b], 0x5065
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000dad0
mov rax, qword [rbp + 0x70]
mov r9, rsi
mov qword [rsp + 0x50], rax
mov r8, r14
mov rax, qword [rbp + 0x68]
mov rdx, r15
mov qword [rsp + 0x48], rax
mov rcx, r12
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x50]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x48]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000dafc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov dword [rbp - 0x16], 0x6d756c6f
mov rsi, rcx
mov word [rbp - 0x1d], 0x4664
or rbx, 0xffffffffffffffff
mov word [rbp - 0x20], 0x6946
mov dword [rbp - 0x1b], 0x74737269
mov word [rbp - 0x12], 0x5765
mov byte [rbp - 0x1e], WSASetLastError
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x17], 0x56
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000db69
mov edx, edi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x14000db84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 0x10], 0x46746547
mov rsi, rcx
mov word [rbp - 6], 0x65
or ebx, 0xffffffff
mov word [rbp - 0xc], 0x6c69
mov word [rbp - 9], 0x6953
mov byte [rbp - 0xa], 0x65
mov byte [rbp - 7], 0x7a
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000dbe6
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret