joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a5570
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x28
ret

Function at 0x1400a55b0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400a5605
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400a722c
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
and qword [rsp + 0x50], 0
call fcn.140007bf4
mov rcx, rax
lea r8, [rsp + 0x50]
mov edx, 0x20
call fcn.14000e0c4
test eax, eax
je 0x1400a72af
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call fcn.14000e014
test eax, eax
je 0x1400a72a5
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
and qword [rsp + 0x28], 0
mov r9d, reloc.WS2_32.dll_recv
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call fcn.14000774c
mov rcx, qword [rsp + 0x50]
call fcn.14000d910
add rsp, 0x48
ret
Function at 0x1400a9864
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [rcx]
mov r8, rcx
or edx, 0xffffffff
jmp 0x1400a989a
movzx eax, al
mov r9d, 7
xor edx, eax
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r9d, 1
jns 0x1400a9879
inc r8
mov al, byte [r8]
test al, al
jne 0x1400a986e
not edx
mov eax, edx
ret

Function at 0x1400a9b74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x1038]
mov eax, 0x1120
call fcn.1400194c0
sub rsp, rax
movsxd r15, r8d
mov r14, rcx
lea rcx, [rbp - 0x80]
call fcn.14000f8d4
nop
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140004e50
nop
lea rcx, [rbp - 0x80]
call fcn.14000fa84
mov r12d, 0x400
mov r8d, r12d
xor edx, edx
lea rcx, [rbp + 0x820]
call fcn.14001b5f0
xor esi, esi
lea rcx, [rsp + 0x58]
call fcn.140015fb0
test rax, rax
je 0x1400a9c21
xor edi, edi
lea rbx, [rbp + 0x820]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140015d18
mov cl, byte [rax]
mov byte [rbx], cl
inc esi
inc rbx
movsxd rdi, esi
lea rcx, [rsp + 0x58]
call fcn.140015fb0
cmp rdi, rax
jb 0x1400a9bf9
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0xc20]
call fcn.14001b5f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x420]
call fcn.14001b5f0
mov word [rsp + 0x4e], 0x3939
mov dword [rsp + 0x30], 0x37383843
mov dword [rsp + 0x3f], 0x42324436
mov dword [rsp + 0x35], 0x44433234
mov word [rsp + 0x48], 0x4342
mov dword [rsp + 0x43], 0x42413436
mov word [rsp + 0x3c], 0x3945
mov word [rsp + 0x39], 0x4132
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x3b], 0x37
mov byte [rsp + 0x34], 0x44
mov word [rsp + 0x4b], 0x3836
mov byte [rsp + 0x4a], 0x46
mov byte [rsp + 0x47], 0x43
mov byte [rsp + 0x3e], 0x46
mov byte [rsp + 0x4d], 0x46
lea r8, [rsp + 0x30]
mov rdx, r12
lea rcx, [rbp + 0x420]
call fcn.140022994
lea rcx, [rbp - 0x60]
call fcn.1400054d8
nop
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9d, 0x20
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x420]
lea rcx, [rbp - 0x60]
call fcn.14000d0f4
lea rcx, [rsp + 0x58]
call fcn.140015fb0
mov r9, rax
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0xc20]
lea rdx, [rbp + 0x820]
lea rcx, [rbp - 0x60]
call fcn.1400054ec
lea rdx, [rbp + 0xc20]
add rdx, r15
mov rcx, r14
call fcn.14000f8d4
nop
lea rcx, [rbp - 0x60]
call fcn.1400aa0e0
nop
lea rcx, [rsp + 0x58]
call fcn.140015d10
mov rax, r14
lea r11, [rsp + 0x1120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400aa2ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rcx, [rbp - 0x10]
mov word [rbp - 0xf], 0x6568
mov byte [rbp - 0x10], 0x53
mov word [rbp - 6], WSASetLastError
mov word [rbp - 0xc], 0x336c
mov word [rbp - 9], 0x642e
mov byte [rbp - 7], WSAGetLastError
mov byte [rbp - 0xd], WSAGetLastError
mov byte [rbp - 0xa], 0x32
call fcn.140008014
add rsp, 0x30
pop rbp
ret
Function at 0x1400aa32c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xb], 0x2e323369
mov dword [rbp - 7], 0x6c6c64
mov word [rbp - 0x10], 0x7457
mov word [rbp - 0xd], 0x7061
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSAStartup
call fcn.140008014
add rsp, 0x30
pop rbp
ret

Function at 0x1400aa364
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x1400aa3db
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x72655365
mov rcx, rax
mov dword [rbp - 0x13], 0x6c646e61
mov dword [rbp - 0x17], 0x48656369
mov word [rbp - 0x1f], 0x6f6c
mov word [rbp - 0xf], 0x65
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x18], 0x76
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aa3d3
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400aa3f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x1400aa488
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x5374
mov rcx, rax
mov dword [rbp - 0x14], 0x69727453
mov word [rbp - 0xb], 0x41
mov word [rbp - 0x1f], 0x6e6f
mov dword [rbp - 0x10], 0x6953676e
mov byte [rbp - 0xc], 0x64
mov word [rbp - 0x17], 0x5464
mov word [rbp - 0x1c], 0x7265
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x18], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aa480
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400aa4a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x1400aa52c
lea rdx, [rbp - 0x20]
mov word [rbp - 0xf], 0x536f
mov rcx, rax
mov dword [rbp - 0x14], 0x64695367
mov dword [rbp - 0x18], 0x6e697274
mov dword [rbp - 0xd], 0x416469
mov dword [rbp - 0x1c], 0x53747265
mov word [rbp - 0x1f], 0x6e6f
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aa524
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400aa548
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, rcx
mov word [rbp - 0x27], 0x6c6c
xor ebx, ebx
mov dword [rbp - 0x30], 0x72657355
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
mov esi, r8d
mov dword [rbp - 0x2c], 0x2e766e65
mov r14, rdx
mov byte [rbp - 0x28], 0x64
call fcn.140008014
mov rdi, rax
test rax, rax
je 0x1400aa5f9
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1e], 0x65746165
mov rcx, rax
mov dword [rbp - 0x10], 0x6f6c4274
mov word [rbp - 0x15], 0x6e6f
mov word [rbp - 0x12], 0x6e65
mov word [rbp - 0xc], 0x6b63
mov byte [rbp - 0x13], WSASetLastError
mov dword [rbp - 0x19], 0x7269766e
mov word [rbp - 0x20], 0x7243
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0xa], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aa5f1
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400aa728
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
mov word [rbp - 0x19], 0x6d65
mov word [rbp - 0x16], 0x6d69
mov dword [rbp - 0xe], 0x6d695465
mov word [rbp - 0xa], 0x65
mov word [rbp - 0x1b], 0x7473
mov dword [rbp - 0x20], 0x53746547
mov dword [rbp - 0x13], 0x69467341
mov byte [rbp - 0x14], 0x65
mov byte [rbp - 0x17], 0x54
mov byte [rbp - 0x1c], 0x79
mov byte [rbp - 0xf], WSAGetLastError
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aa791
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400aa7fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov esi, r8d
mov r14, rdx
mov r15, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x1400aa875
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x614d4353
mov rcx, rax
mov dword [rbp - 8], 0x6567616e
mov word [rbp - 4], 0x4172
mov dword [rbp - 0x10], 0x6e65704f
mov byte [rbp - 2], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aa86d
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x1400aa894
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
call fcn.14000d804
mov rdi, rax
test rax, rax
je 0x1400aa8ff
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xa], 0x7845656c
mov rcx, rax
mov dword [rbp - 6], 0x73747369
mov word [rbp - 2], 0x41
mov dword [rbp - 0x10], 0x68746150
mov word [rbp - 0xc], 0x6946
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aa8f7
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400aa918
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
call fcn.14000d804
mov rdi, rax
test rax, rax
je 0x1400aa98c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1d], 0x6e694668
mov rcx, rax
mov word [rbp - 0x1f], 0x7461
mov word [rbp - 0x11], 0x4165
mov byte [rbp - 0xf], 0
mov dword [rbp - 0x18], 0x656c6946
mov word [rbp - 0x14], 0x614e
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x12], WSASetLastError
mov byte [rbp - 0x19], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aa984
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400aa6c4
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400aa9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
call fcn.14000d804
mov rbx, rax
test rax, rax
je 0x1400aaa14
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x68746150
mov rcx, rax
mov word [rbp - 0x1c], 0x6552
mov word [rbp - 0x12], 0x736e
mov dword [rbp - 0x17], 0x74784565
mov dword [rbp - 0x10], 0x416e6f69
mov word [rbp - 0x19], 0x766f
mov byte [rbp - 0xc], 0
mov byte [rbp - 0x13], 0x65
mov byte [rbp - 0x1a], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aaa0c
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400aa6c4
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x1400aaaa4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
mov edi, 1
call fcn.1400aa274
mov rbx, rax
test rax, rax
je 0x1400aab40
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x6547
mov rcx, rax
mov dword [rbp - 0x1a], 0x5379654b
mov word [rbp - 0x20], 0x6552
mov word [rbp - 0x16], 0x6365
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x13], 0x6972
mov byte [rbp - 0x14], 0x75
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x11], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aab38
mov r9, rsi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400aab60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.1400aa274
mov rbx, rax
test rax, rax
je 0x1400aabe5
lea rdx, [rbp - 0x10]
mov word [rbp - 0xa], 0x4b6e
mov rcx, rax
mov word [rbp - 0xd], 0x704f
mov word [rbp - 7], 0x4179
mov word [rbp - 0x10], 0x6552
mov byte [rbp - 0xe], 0x67
mov byte [rbp - 5], 0
mov byte [rbp - 0xb], 0x65
mov byte [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aabdd
mov r8, rsi
mov rdx, r14
mov rcx, r15
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x1400aacb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov edi, 1
call fcn.1400aa274
mov rbx, rax
test rax, rax
je 0x1400aad68
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x61567972
mov rcx, rax
mov word [rbp - 0x12], 0x4178
mov word [rbp - 0x1c], 0x6575
mov word [rbp - 0x1f], 0x6765
mov word [rbp - 0x15], 0x6575
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x13], 0x45
mov byte [rbp - 0x1d], 0x51
mov byte [rbp - 0x16], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400aad60
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r14
mov rax, qword [rbp + 0x40]
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400aad88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14d, r8d
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400aa2ec
mov rdi, rax
test rax, rax
je 0x1400aae2e
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x69636570
mov rcx, rax
mov word [rbp - 0x1c], 0x5374
mov word [rbp - 0x1f], 0x4748
mov word [rbp - 0x10], 0x7265
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x16], 0x6f466c61
mov word [rbp - 0xd], 0x7461
mov word [rbp - 0xa], 0x57
mov word [rbp - 0x12], 0x646c
mov byte [rbp - 0xb], 0x68
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0xe], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aae26
mov r9d, esi
mov r8d, r14d
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400aae50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12d, ecx
mov edi, 1
call fcn.1400aa274
mov rbx, rax
test rax, rax
je 0x1400aaee5
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x49736569
mov rcx, rax
mov dword [rbp - 0x14], 0x416c6341
mov word [rbp - 0x1f], 0x7465
mov word [rbp - 0x1c], 0x746e
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x15], WSASetLastError
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x1a], WSACleanup
mov byte [rbp - 0x1d], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aaedd
mov r9, rsi
mov r8, r14
mov rdx, r15
mov ecx, r12d
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400aa6c4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400aaf08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x1400aafaa
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x72637365
mov rcx, rax
mov dword [rbp - 0x1b], 0x69727563
mov dword [rbp - 0x20], 0x53746553
mov dword [rbp - 0xa], 0x6c6361
mov word [rbp - 0xf], 0x7470
mov word [rbp - 0xc], 0x4472
mov word [rbp - 0x16], 0x4479
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x10], 0x69
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xd], reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aafa2
mov r9d, esi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400aafcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x1400ab060
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x53746553
mov rcx, rax
mov word [rbp - 0xc], 0x6972
mov word [rbp - 0x17], 0x4f65
mov dword [rbp - 0x11], 0x63655374
mov word [rbp - 9], 0x79
mov dword [rbp - 0x1c], 0x69767265
mov dword [rbp - 0x15], 0x63656a62
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xd], 0x75
mov byte [rbp - 0x18], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab058
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400ab07c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x1400ab103
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xc], 0x68637461
mov rcx, rax
mov word [rbp - 0x1b], 0x6553
mov dword [rbp - 0x18], 0x65636976
mov dword [rbp - 0x12], 0x69446c72
mov dword [rbp - 8], 0x417265
mov word [rbp - 0x14], 0x7443
mov dword [rbp - 0x20], 0x72617453
mov word [rbp - 0xe], 0x7073
mov byte [rbp - 0x19], WSACleanup
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab0fb
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ab11c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov dword [rbp - 0x1a], 0x50657461
mov rsi, rcx
mov dword [rbp - 0x13], 0x737365
xor ebx, ebx
mov dword [rbp - 0x20], 0x6d726554
mov word [rbp - 0x1c], 0x6e69
mov word [rbp - 0x15], 0x636f
mov byte [rbp - 0x16], WSACleanup
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab17f
mov edx, edi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x1400ab198
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r14d, ecx
mov dword [rbp - 0x30], 0x61737457
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2b], 0x2e323369
mov rsi, rdx
mov dword [rbp - 0x27], 0x6c6c64
xor ebx, ebx
mov byte [rbp - 0x2c], reloc.WS2_32.dll_WSASetLastError
call fcn.140008014
mov rdi, rax
test rax, rax
je 0x1400ab22b
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x51535457
mov rcx, rax
mov dword [rbp - 0x18], 0x72657355
mov dword [rbp - 0x1c], 0x79726575
mov dword [rbp - 0x14], 0x656b6f54
mov word [rbp - 0x10], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab223
mov rdx, rsi
mov ecx, r14d
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400012b0
Capabilities:
Set current directory

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
call fcn.140002750
test eax, eax
je 0x140001310
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x28]
call fcn.140001000
call fcn.140001220
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x28]
call fcn.140001040
xor eax, eax
test eax, eax
jne 0x140001310
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x260
pop rdi
ret