joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e9774
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rdi, rdx
mov rsi, rcx
movdqa xmm0, xmmword [0x1401f5b40]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], WSAGetLastError
xor r14d, r14d
mov r8d, r14d
mov al, byte [rbp - 0x60]
xor byte [rbp + r8 - 0x5f], al
inc r8
cmp r8, 0x10
jb 0x1400e97b1
mov byte [rbp - 0x4f], r14b
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], r14b
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x40]
call fcn.140005250
nop
mov al, reloc.WS2_32.dll_listen
mov dword [rbp - 0x60], 0x46000d
mov dword [rbp - 0x5c], 0x7f0068
mov dword [rbp - 0x58], 0x680063
mov dword [rbp - 0x54], 0x3e0061
mov dword [rbp - 0x50], 0x23003f
mov dword [rbp - 0x4c], 0x610069
mov dword [rbp - 0x48], 0x61
mov rcx, r14
movsx eax, al
xor word [rbp + rcx*2 - 0x5e], ax
inc rcx
cmp rcx, 0xc
jae 0x1400e9834
mov al, byte [rbp - 0x60]
jmp 0x1400e981e
mov word [rbp - 0x46], r14w
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
lea rdx, [rbp - 0x5e]
lea rcx, [rbp - 0x20]
call fcn.140002cdc
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400e8a08
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400e98a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e98a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e9929
call fcn.140173310
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400e98ee
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e98e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e9923
call fcn.140173310
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], r14b
mov rdx, rdi
mov rcx, rsi
call rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
int3
Function at 0x1400e9930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov edi, ecx
movdqa xmm0, xmmword [0x1401f5d50]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], 0x66
xor esi, esi
mov edx, esi
mov al, byte [rbp - 0x60]
xor byte [rbp + rdx - 0x5f], al
inc rdx
cmp rdx, 0x10
jb 0x1400e9963
mov byte [rbp - 0x4f], sil
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], sil
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x48]
call fcn.140005250
nop
mov al, 0x78
mov dword [rbp - 0x60], 0x2d0078
mov dword [rbp - 0x5c], 0x1d000b
mov edx, 0xa
mov dword [rbp - 0x58], 0x4b000a
mov dword [rbp - 0x54], 0x56004a
mov dword [rbp - 0x50], 0x14001c
mov dword [rbp - 0x4c], reloc.WS2_32.dll_sendto
mov rcx, rsi
movsx eax, al
xor word [rbp + rcx*2 - 0x5e], ax
inc rcx
cmp rcx, rdx
jae 0x1400e99e2
mov al, byte [rbp - 0x60]
jmp 0x1400e99cd
mov word [rbp - 0x4a], si
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
lea rdx, [rbp - 0x5e]
lea rcx, [rbp - 0x28]
call fcn.140002cdc
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.1400e8a08
mov rbx, rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400e9a4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9a4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e9ac9
call fcn.140173310
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400e9a96
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e9ac3
call fcn.140173310
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], sil
mov ecx, edi
call rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
int3
Function at 0x1400e9ad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
movdqa xmm0, xmmword [0x1401f5ce0]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x7871747b
mov word [rbp - 0x4c], Ordinal_79
xor esi, esi
mov edx, esi
mov al, byte [rbp - 0x60]
xor byte [rbp + rdx - 0x5f], al
inc rdx
cmp rdx, 0x14
jb 0x1400e9b0b
mov byte [rbp - 0x4b], sil
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x40]
call fcn.140005250
nop
mov al, reloc.WS2_32.dll_ntohs
mov dword [rbp - 0x60], 0x4e000f
mov dword [rbp - 0x5c], 0x79006b
mov dword [rbp - 0x58], 0x7f006e
mov dword [rbp - 0x54], 0x3c0066
mov dword [rbp - 0x50], 0x21003d
mov dword [rbp - 0x4c], 0x63006b
mov dword [rbp - 0x48], 0x63
mov rcx, rsi
movsx eax, al
xor word [rbp + rcx*2 - 0x5e], ax
inc rcx
cmp rcx, 0xc
jae 0x1400e9b8d
mov al, byte [rbp - 0x60]
jmp 0x1400e9b77
mov word [rbp - 0x46], si
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
lea rdx, [rbp - 0x5e]
lea rcx, [rbp - 0x20]
call fcn.140002cdc
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400e8a08
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400e9bfe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e9c79
call fcn.140173310
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
mov word [rbp - 0x20], si
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400e9c45
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9c40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e9c73
call fcn.140173310
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
mov rcx, rdi
call rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
int3
Function at 0x1400e9c80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
movdqa xmm0, xmmword [0x1401f5900]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x26333f20
mov dword [rbp - 0x4c], 0x3c3d3b
xor esi, esi
mov ecx, esi
lea ebx, [rsi + 0x16]
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, rbx
jb 0x1400e9cc3
mov byte [rbp - 0x49], sil
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x40]
call fcn.140005250
nop
mov al, 0x7a
mov dword [rbp - 0x60], 0x31007a
mov r12d, Ordinal_32
mov dword [rbp - 0x5c], 0x8001f
lea r13d, [r12 - 0x17]
mov dword [rbp - 0x58], 0x1f0014
mov dword [rbp - 0x54], 0x490016
mov dword [rbp - 0x50], 0x540048
mov dword [rbp - 0x4c], 0x16001e
mov dword [rbp - 0x48], reloc.WLDAP32.dll_Ordinal_22
mov rcx, rsi
movsx eax, al
xor word [rbp + rcx*2 - 0x5e], ax
inc rcx
cmp rcx, 0xc
jae 0x1400e9d4f
mov al, byte [rbp - 0x60]
jmp 0x1400e9d39
mov word [rbp - 0x46], si
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
lea rdx, [rbp - 0x5e]
lea rcx, [rbp - 0x20]
call fcn.140002cdc
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400e8a08
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, r13
jb 0x1400e9dbe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9db9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r12
ja 0x1400e9e3c
call fcn.140173310
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
mov word [rbp - 0x20], si
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400e9e04
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9dff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r12
ja 0x1400e9e36
call fcn.140173310
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
mov rcx, rdi
call rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
int3
Function at 0x1400e9e44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x47]
sub rsp, 0xb0
mov rdi, rcx
mov dl, reloc.WLDAP32.dll_Ordinal_79
mov dword [rbp - 0x31], 0x2a3d0c4f
mov dword [rbp - 0x2d], 0x92a3b2e
mov dword [rbp - 0x29], 0x182a2326
xor esi, esi
mov byte [rbp - 0x25], sil
mov eax, esi
xor byte [rbp + rax - 0x30], dl
inc rax
cmp rax, 0xb
jae 0x1400e9e93
mov dl, byte [rbp - 0x31]
jmp 0x1400e9e81
mov byte [rbp - 0x25], sil
mov qword [rbp - 1], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], sil
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 1]
call fcn.140005250
nop
mov al, reloc.WS2_32.dll_socket
mov dword [rbp - 0x23], 0x5c0017
mov dword [rbp - 0x1f], 0x650072
mov dword [rbp - 0x1b], 0x720079
mov dword [rbp - 0x17], 0x24007b
mov dword [rbp - 0x13], 0x390025
mov dword [rbp - 0xf], 0x7b0073
mov dword [rbp - 0xb], 0x7b
mov rcx, rsi
movsx eax, al
xor word [rbp + rcx*2 - 0x21], ax
inc rcx
cmp rcx, 0xc
jae 0x1400e9f05
mov al, byte [rbp - 0x23]
jmp 0x1400e9eef
mov word [rbp - 9], si
mov qword [rbp + 0x1f], rsi
mov qword [rbp + 0x2f], rsi
mov qword [rbp + 0x37], 7
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x1f]
call fcn.140002cdc
lea rdx, [rbp - 1]
lea rcx, [rbp + 0x1f]
call fcn.1400e8a08
mov rbx, rax
mov rdx, qword [rbp + 0x37]
cmp rdx, 8
jb 0x1400e9f76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9f71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea00a
call fcn.140173310
mov qword [rbp + 0x2f], rsi
mov qword [rbp + 0x37], 7
mov word [rbp + 0x1f], si
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x1400e9fbd
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9fb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea004
call fcn.140173310
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], sil
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov r8d, 3
mov dword [rsp + 0x20], r8d
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call rbx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
Function at 0x1400ea1c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
movdqa xmm0, xmmword [str.f__n_t]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x23151312
mov word [rbp - 0x4c], reloc.WLDAP32.dll_Ordinal_30
xor esi, esi
mov edx, esi
mov al, byte [rbp - 0x60]
xor byte [rbp + rdx - 0x5f], al
inc rdx
cmp rdx, 0x14
jb 0x1400ea207
mov byte [rbp - 0x4b], sil
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x40]
call fcn.140005250
nop
mov al, 0x62
mov dword [rbp - 0x60], 0x290062
mov r15d, 7
mov dword [rbp - 0x5c], 0x100007
lea r12d, [r15 + 9]
lea r8d, [r15 + 5]
mov dword [rbp - 0x58], 0x7000c
mov dword [rbp - 0x54], 0x51000e
mov dword [rbp - 0x50], 0x4c0050
mov dword [rbp - 0x4c], 0xe0006
mov dword [rbp - 0x48], reloc.WS2_32.dll_ntohl
mov rcx, rsi
movsx eax, al
xor word [rbp + rcx*2 - 0x5e], ax
inc rcx
cmp rcx, r8
jae 0x1400ea296
mov al, byte [rbp - 0x60]
jmp 0x1400ea281
mov word [rbp - 0x46], si
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], r15
lea rdx, [rbp - 0x5e]
lea rcx, [rbp - 0x20]
call fcn.140002cdc
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400e8a08
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400ea2ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea2fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea379
call fcn.140173310
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], r15
mov word [rbp - 0x20], si
mov rdx, qword [rbp - 0x28]
cmp rdx, r12
jb 0x1400ea341
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea33c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea373
call fcn.140173310
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
mov rcx, rdi
call rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
int3
Function at 0x1400ea380
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x3f]
sub rsp, 0xa0
mov rdi, rcx
movdqa xmm0, xmmword [0x1401f5a40]
movdqu xmmword [rbp - 0x29], xmm0
xor esi, esi
mov byte [rbp - 0x19], sil
mov edx, esi
mov al, byte [rbp - 0x29]
xor byte [rbp + rdx - 0x28], al
inc rdx
cmp rdx, 0xf
jb 0x1400ea3b3
mov byte [rbp - 0x19], sil
mov qword [rbp - 9], rsi
mov qword [rbp + 7], rsi
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], sil
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 9]
call fcn.140005250
nop
mov al, reloc.WS2_32.dll_gethostname
mov dword [rbp - 0x29], 0x720039
mov dword [rbp - 0x25], 0x4b005c
mov dword [rbp - 0x21], 0x5c0057
mov dword [rbp - 0x1d], 0xa0055
mov dword [rbp - 0x19], 0x17000b
mov dword [rbp - 0x15], 0x55005d
mov dword [rbp - 0x11], 0x55
mov rcx, rsi
movsx eax, al
xor word [rbp + rcx*2 - 0x27], ax
inc rcx
cmp rcx, 0xc
jae 0x1400ea435
mov al, byte [rbp - 0x29]
jmp 0x1400ea41f
mov word [rbp - 0xf], si
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], 7
lea rdx, [rbp - 0x27]
lea rcx, [rbp + 0x17]
call fcn.140002cdc
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.1400e8a08
mov rbx, rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x1400ea4a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea4a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea54b
call fcn.140173310
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], si
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x1400ea4ed
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea4e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea545
call fcn.140173310
mov qword [rbp + 7], rsi
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], sil
mov qword [rsp + 0x38], rsi
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], Ordinal_27
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rdi
call rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
int3
Function at 0x1400ea554
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
movdqa xmm0, xmmword [0x1401f5bf0]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x424f4d41
mov dword [rbp - 0x4c], 0x434f604b
mov word [rbp - 0x48], Ordinal_79
xor esi, esi
mov ecx, esi
lea r14d, [rsi + 0x18]
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, r14
jb 0x1400ea59e
mov byte [rbp - 0x47], sil
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x40]
call fcn.140005250
nop
mov al, 0x2b
mov dword [rbp - 0x60], 0x60002b
mov dword [rbp - 0x5c], 0x59004e
mov dword [rbp - 0x58], 0x4e0045
mov dword [rbp - 0x54], 0x180047
mov dword [rbp - 0x50], 0x50019
mov dword [rbp - 0x4c], 0x47004f
mov dword [rbp - 0x48], 0x47
mov rcx, rsi
movsx eax, al
xor word [rbp + rcx*2 - 0x5e], ax
inc rcx
cmp rcx, 0xc
jae 0x1400ea61f
mov al, byte [rbp - 0x60]
jmp 0x1400ea609
mov word [rbp - 0x46], si
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov r15d, 7
mov qword [rbp - 8], r15
lea rdx, [rbp - 0x5e]
lea rcx, [rbp - 0x20]
call fcn.140002cdc
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400e8a08
mov rbx, rax
mov r14d, 0x1000
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400ea694
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, r14
jb 0x1400ea68f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea710
call fcn.140173310
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], r15
mov word [rbp - 0x20], si
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400ea6d3
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, r14
jb 0x1400ea6ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea70a
call fcn.140173310
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
mov edx, 0x55
mov rcx, rdi
call rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
int3
Function at 0x1400ea718
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rdi, rdx
movdqa xmm0, xmmword [0x1401f5910]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x83a32
xor esi, esi
mov ecx, esi
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x12
jb 0x1400ea751
mov byte [rbp - 0x4d], sil
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x40]
call fcn.140005250
nop
mov al, 0x49
mov dword [rbp - 0x60], 0x20049
mov dword [rbp - 0x5c], 0x3b002c
mov r12d, Ordinal_41
mov dword [rbp - 0x58], 0x2c0027
mov dword [rbp - 0x54], 0x7a0025
mov dword [rbp - 0x50], 0x67007b
mov dword [rbp - 0x4c], 0x25002d
mov dword [rbp - 0x48], Ordinal_41
mov rcx, rsi
movsx eax, al
xor word [rbp + rcx*2 - 0x5e], ax
inc rcx
cmp rcx, 0xc
jae 0x1400ea7d9
mov al, byte [rbp - 0x60]
jmp 0x1400ea7c3
mov word [rbp - 0x46], si
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
lea rdx, [rbp - 0x5e]
lea rcx, [rbp - 0x20]
call fcn.140002cdc
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400e8a08
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400ea849
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea844
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea8cf
call fcn.140173310
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
mov word [rbp - 0x20], si
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400ea88f
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ea88a
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ea8c9
call fcn.140173310
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], sil
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
int3
Function at 0x1400ec698
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc10
mov rax, qword [0x1402124a0]
xor rax, rsp
mov qword [rsp + 0xc00], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400ec6fb
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
jmp 0x1400ec708
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140035974
mov rax, rbx
mov rcx, qword [rsp + 0xc00]
xor rcx, rsp
call fcn.140173c50
mov rbx, qword [rsp + 0xc30]
add rsp, 0xc10
pop rdi
ret

Function at 0x1400ec780
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xb20]
sub rsp, 0xc20
mov rax, qword [0x1402124a0]
xor rax, rsp
mov qword [rbp + 0xb10], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
lea rdx, [rsp + 0x50]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002cdc
nop
mov rcx, qword [rsp + 0x40]
dec rcx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov word [rax + rcx*2], di
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000352c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400ec85b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ec856
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ec882
call fcn.140173310
mov rax, rbx
mov rcx, qword [rbp + 0xb10]
xor rcx, rsp
call fcn.140173c50
lea r11, [rsp + 0xc20]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14018273c
int3

Function at 0x1400ec8a4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1402124a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x28]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401d04b8]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x1400ec905
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
jmp 0x1400ec936
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140035974
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140005710
lea rcx, [rsp + 0x30]
call fcn.14000299c
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140173c50
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret