joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov r12d, r9d
mov r15, r8
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x3d], 0x33697061
mov dword [rbp - 0x37], 0x6c6c64
mov word [rbp - 0x3f], 0x7664
mov word [rbp - 0x39], 0x2e32
mov byte [rbp - 0x40], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400377fa
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x2c], 0x72756365
mov dword [rbp - 0x28], 0x44797469
mov dword [rbp - 0x1b], 0x6c636144
mov dword [rbp - 0x24], 0x72637365
mov dword [rbp - 0x20], 0x6f747069
mov dword [rbp - 0x30], 0x53746553
mov byte [rbp - 0x17], bl
mov byte [rbp - 0x1c], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400377f1
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140037820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov r15, r8
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x3d], 0x33697061
mov dword [rbp - 0x37], 0x6c6c64
mov word [rbp - 0x3f], 0x7664
mov word [rbp - 0x39], 0x2e32
mov byte [rbp - 0x40], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400378de
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x2b], 0x63697672
mov word [rbp - 0x30], 0x6553
mov word [rbp - 0x22], 0x7463
mov dword [rbp - 0x26], 0x656a624f
mov dword [rbp - 0x1b], 0x797469
mov dword [rbp - 0x1f], 0x72756365
mov word [rbp - 0x2d], 0x6553
mov byte [rbp - 0x27], 0x65
mov byte [rbp - 0x2e], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x20], 0x53
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400378d5
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140037960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x40]
xor ebx, ebx
mov dword [rbp - 0x3d], 0x33697061
mov dword [rbp - 0x37], 0x6c6c64
mov word [rbp - 0x3f], 0x7664
mov word [rbp - 0x39], 0x2e32
mov byte [rbp - 0x40], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140037a24
lea rdx, [rbp - 0x30]
mov rcx, rax
mov word [rbp - 0x2a], 0x7265
mov word [rbp - 0x1d], 0x6170
mov dword [rbp - 0x22], 0x69446c72
mov dword [rbp - 0x1b], 0x65686374
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSAStartup
mov word [rbp - 0x17], 0x4172
mov word [rbp - 0x27], 0x6369
mov dword [rbp - 0x2e], 0x53747261
mov word [rbp - 0x24], 0x7443
mov word [rbp - 0x30], 0x7453
mov byte [rbp - 0x25], 0x65
mov byte [rbp - 0x28], 0x76
mov byte [rbp - 0x15], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037a1b
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140037a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov dword [rbp - 0x16], 0x41656d69
mov dword [rbp - 0xd], 0x656d6954
mov dword [rbp - 0x1f], 0x79537465
mov dword [rbp - 0x11], 0x656c6946
mov byte [rbp - 9], 0
mov dword [rbp - 0x1b], 0x6d657473
mov byte [rbp - 0x12], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x17], 0x54
call fcn.140033c50
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037abe
lea rcx, [rbp - 0x28]
call rax
mov eax, dword [rbp - 0x28]
movabs rcx, 0xfe624e212ac18000
mov dword [rbp - 0x30], eax
mov eax, dword [rbp - 0x24]
mov dword [rbp - 0x2c], eax
movabs rax, 0xd6bf94d5e57a42bd
add rcx, qword [rbp - 0x30]
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rax, rdx
test rbx, rbx
je 0x140037b01
mov qword [rbx], rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140037b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r14, rdx
mov ebx, reloc.WS2_32.dll_ntohl
mov word [rbp - 0x30], 0x7052
mov dword [rbp - 0x2d], 0x2e347472
mov dword [rbp - 0x29], 0x6c6c64
mov byte [rbp - 0x2e], 0x63
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140037bc4
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x18], 0x676e6972
mov word [rbp - 0x20], 0x7555
mov word [rbp - 0x1d], 0x5464
mov word [rbp - 0x1a], 0x7453
mov byte [rbp - 0x1e], 0x69
mov word [rbp - 0x14], 0x41
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037bbb
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140037bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x41656c4f
mov dword [rbp - 0x2a], 0x642e3233
mov word [rbp - 0x25], WSAGetLastError
mov word [rbp - 0x2c], 0x7475
mov byte [rbp - 0x26], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140037c83
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x1c], 0x43746e61
mov dword [rbp - 0x17], 0x726165
mov word [rbp - 0x1f], 0x7261
mov byte [rbp - 0x18], WSAGetLastError
mov byte [rbp - 0x20], 0x56
mov byte [rbp - 0x1d], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037c7a
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140037ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x41656c4f
mov dword [rbp - 0x1a], 0x642e3233
mov word [rbp - 0x15], WSAGetLastError
mov word [rbp - 0x1c], 0x7475
mov byte [rbp - 0x16], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140037d2f
lea rdx, [rbp - 0x30]
mov rcx, rax
mov word [rbp - 0x30], 0x6156
mov dword [rbp - 0x2d], 0x746e6169
mov dword [rbp - 0x28], 0x74696e
mov byte [rbp - 0x29], 0x49
mov byte [rbp - 0x2e], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037d26
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x140037d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov r12, r9
mov r15, r8
mov r14, rdx
mov dword [rbp - 0x29], 0x6c6c642e
mov dword [rbp - 0x30], 0x73726576
mov word [rbp - 0x2b], 0x6e6f
mov byte [rbp - 0x25], bl
mov byte [rbp - 0x2c], 0x69
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140037e06
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x19], 0x5679
mov word [rbp - 0x16], 0x756c
mov word [rbp - 0x1e], 0x5172
mov word [rbp - 0x1b], 0x7265
mov word [rbp - 0x13], 0x41
mov byte [rbp - 0x17], reloc.OLEAUT32.dll_VarCyFromUI1
mov word [rbp - 0x20], 0x6556
mov byte [rbp - 0x1c], 0x75
mov byte [rbp - 0x14], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037dfd
mov r9, r12
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140037e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebp, r9d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov word [rsp + 0x22], 0x7472
mov dword [rsp + 0x28], 0x636f6c6c
mov word [rsp + 0x25], 0x6c61
mov word [rsp + 0x20], 0x6956
mov byte [rsp + 0x27], 0x41
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x24], 0x75
call fcn.140033c50
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037ea6
mov r9d, ebp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140037ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14d, dword [rsp + 0xa0]
mov ebp, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov word [rsp + 0x33], 0x7574
mov word [rsp + 0x30], 0x6956
mov dword [rsp + 0x3a], 0x7845636f
mov word [rsp + 0x35], 0x6c61
mov byte [rsp + 0x3e], 0
mov word [rsp + 0x38], 0x6c6c
mov byte [rsp + 0x37], 0x41
mov byte [rsp + 0x32], WSAStartup
call fcn.140033c50
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037f4c
mov r9d, ebp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140037f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov rsi, rcx
lea rcx, [rbp - 0x38]
mov r12, r9
mov r15d, r8d
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x33], 0x2e323369
mov word [rbp - 0x38], 0x7457
mov dword [rbp - 0x2f], 0x6c6c64
mov word [rbp - 0x35], 0x7061
mov byte [rbp - 0x36], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140038039
lea rdx, [rbp - 0x28]
mov rcx, rax
mov dword [rbp - 0x1c], 0x73736553
mov dword [rbp - 0x18], 0x736e6f69
mov word [rbp - 0x20], 0x6172
mov word [rbp - 0x23], 0x6d75
mov word [rbp - 0x1e], 0x6574
mov dword [rbp - 0x28], 0x45535457
mov byte [rbp - 0x21], 0x65
mov word [rbp - 0x14], 0x41
mov byte [rbp - 0x24], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140038030
mov r9, r12
mov r8d, r15d
mov edx, r14d
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140038060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2b], 0x2e323369
mov word [rbp - 0x30], 0x7457
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2d], 0x7061
mov byte [rbp - 0x2e], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400380f0
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x17], 0x79726f6d
mov dword [rbp - 0x1b], 0x654d6565
mov dword [rbp - 0x1f], 0x72465354
mov byte [rbp - 0x20], 0x57
mov byte [rbp - 0x13], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400380e7
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x140038110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, ecx
lea rcx, [rbp - 0x30]
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x2b], 0x2e323369
mov word [rbp - 0x30], 0x7457
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2d], 0x7061
mov byte [rbp - 0x2e], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400381bc
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x14], 0x6f54
mov dword [rbp - 0x1e], 0x65755153
mov word [rbp - 0x20], 0x5457
mov dword [rbp - 0x12], 0x6e656b
mov word [rbp - 0x17], 0x6573
mov word [rbp - 0x1a], 0x7972
mov byte [rbp - 0x15], WSAStartup
mov byte [rbp - 0x18], 0x55
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400381b3
mov rdx, r14
mov ecx, esi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140038260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x3b], 0x6d654d73
mov dword [rsp + 0x33], 0x72506574
mov word [rsp + 0x38], 0x6563
mov dword [rsp + 0x3f], 0x79726f
mov byte [rsp + 0x37], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x3a], reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x30], 0x7257
mov byte [rsp + 0x32], 0x69
call fcn.140033c50
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400382ee
mov r9, rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r14
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140038600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov byte [rsp + 0x20], r9b
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, r8
mov rdi, rdx
mov rsi, rcx
call fcn.140075588
mov rcx, rdi
mov rbx, rax
call fcn.140075588
mov edx, 1
lea rcx, [rax + 3]
add rcx, rbx
call fcn.140075610
mov rbp, rax
test rax, rax
je 0x1400386bf
mov rcx, rsi
call fcn.140075588
mov rcx, rdi
mov rbx, rax
call fcn.140075588
or r9, 0xffffffffffffffff
add rax, 3
mov r8, rsi
mov rcx, rbp
add rbx, rax
mov rdx, rbx
call fcn.1400755fc
lea r8, [0x140124db0]
or r9, 0xffffffffffffffff
mov rdx, rbx
mov rcx, rbp
call fcn.1400755fc
or r9, 0xffffffffffffffff
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call fcn.1400755fc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbp
cmp eax, 0xffffffff
setne bl
call fcn.14007084c
test bl, bl
jne 0x1400386bf
mov eax, 4
jmp 0x1400386e4
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x20]
lea rcx, [0x140038700]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
call fcn.140039c10
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140038b00
Capabilities:
Contain obfuscated stackstrings
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, rdx
mov rbx, rcx
lea rdx, [rbp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x140038b4e
xor al, al
jmp 0x140038c9a
lea rax, [rbp + 0x80]
lea r9, [rsp + 0x60]
lea rcx, [rsp + 0x70]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov dword [rsp + 0x65], 0x75637472
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 0x68537325
mov dword [rsp + 0x69], 0x6e6c2e74
mov word [rsp + 0x6d], WSAGetLastError
mov byte [rsp + 0x64], reloc.WS2_32.dll_WSAGetLastError
call fcn.1400702f0
lea r9, [0x140123920]
lea r8, [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.140038cc0
test al, al
je 0x140038b47
cmp byte [rbx], 0
je 0x140038bce
lea rdx, [rsp + 0x70]
mov r8, rdi
mov rcx, rbx
call fcn.140039570
movzx ebx, al
jmp 0x140038c8c
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x35], 0x69707261
mov dword [rsp + 0x30], 0x6b736174
mov word [rsp + 0x39], WSAStartup
mov byte [rsp + 0x34], 0x62
xor ebx, ebx
mov dword [rsp + 0x40], 0x6c656853
mov dword [rsp + 0x44], 0x2e32336c
mov dword [rsp + 0x48], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140038c85
lea rdx, [rsp + 0x50]
mov rcx, rax
mov dword [rsp + 0x5a], 0x416574
mov word [rsp + 0x52], 0x6c65
mov word [rsp + 0x55], 0x7845
mov byte [rsp + 0x54], WSAGetLastError
mov word [rsp + 0x50], 0x6853
mov word [rsp + 0x58], 0x7563
mov byte [rsp + 0x57], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140167368], rax
test rax, rax
je 0x140038c7c
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp rbx, 0x20
setg bl
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movzx eax, bl
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140038de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x25], 0x65737361
mov word [rbp - 0x1e], 0x735c
mov dword [rbp - 0x1b], 0x6c6c65
mov word [rbp - 0x2d], 0x5754
mov byte [rbp - 0x1c], 0x68
mov word [rbp - 0x30], 0x4f53
mov word [rbp - 0x21], 0x5c73
mov dword [rbp - 0x2a], 0x435c4552
mov byte [rbp - 0x2e], 0x46
mov byte [rbp - 0x2b], 0x41
mov byte [rbp - 0x1f], Ordinal_45
mov byte [rbp - 0x26], WSAGetLastError
call fcn.140037210
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x50
pop rbp
ret
Function at 0x140039a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x70]
mov r12, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x30], eax
mov r15, r9
mov r14, r8
mov rsi, rdx
xor ebx, ebx
mov dword [rbp - 0x28], 0x6c656853
mov dword [rbp - 0x24], 0x2e32336c
mov dword [rbp - 0x20], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140039b5b
lea rdx, [rbp - 0x18]
mov rcx, rax
mov dword [rbp - 0xe], 0x416574
mov word [rbp - 0x16], 0x6c65
mov word [rbp - 0x13], 0x7845
mov byte [rbp - 0x14], WSAGetLastError
mov word [rbp - 0x18], 0x6853
mov word [rbp - 0x10], 0x7563
mov byte [rbp - 0x11], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140167368], rax
test rax, rax
je 0x140039b52
mov ecx, dword [rbp - 0x30]
mov r9, r12
mov r8, r15
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov rdx, r14
mov qword [rsp + 0x20], r13
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret