joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401705d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], 0x33
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], WSAGetLastError
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], WSAGetLastError
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], WSAGetLastError
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], WSAStartup
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], reloc.WLDAP32.dll_Ordinal_50
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x53
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x76
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x45
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401bd840], rax
cmp qword [0x1401bd840], 0
je 0x14017072b
mov dword [0x1401bd808], 0
mov rcx, qword [0x1401bd800]
call qword [0x1401bd840]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 1
call fcn.140151f80
add rsp, 0x58
ret
Function at 0x140170790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call fcn.140012e00
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14017098a
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 0x1b
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x38], 0x79
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 0x18
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSASetLastError
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0x19
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0x1a
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0x1c
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x38], 0x44
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x49
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x7a
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14017097f
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + Ordinal_50]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x140171450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14015a720
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140171564
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], 0x46
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], WSAGetLastError
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], 0x43
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], WSAGetLastError
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], Ordinal_79
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], 0x54
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x30], WSAStartup
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140171559
mov rcx, qword [rsp + 0x50]
call qword [rsp + Ordinal_41]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x48
ret

Function at 0x140171c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x20], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x20], WSAGetLastError
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x20], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x20], WSAGetLastError
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x20], reloc.WLDAP32.dll_Ordinal_50
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x20], 0x64
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x20], WSAGetLastError
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x20], 0x33
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x20], WSAStartup
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x20], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x20], Ordinal_79
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x20], WSAGetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x20], reloc.WLDAP32.dll_Ordinal_46
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add rsp, 0x38
ret
Function at 0x140173ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], 0x54
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x30], 0x41
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], 0x42
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], 0x47
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], WSAGetLastError
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSASetLastError
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x30], 0x79
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], 0x69
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], 0x79
call fcn.140171c70
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140173bfa
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [rsp + Ordinal_41]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140174d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x30], 0
call fcn.140012e00
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140174e84
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x48], WSAGetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x48], 0x75
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSASetLastError
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x48], WSAGetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x48], 0
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x48], 0x69
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x48], 0x78
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x48], 0x54
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x48], 0x45
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x48], 0x63
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x48], WSAGetLastError
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x48], 0x61
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x48], 0x44
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140174e79
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x30]
add rsp, 0x68
ret
Function at 0x140174e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], 0x68
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], 0x47
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], 0x43
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], WSAStartup
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x30], WSAGetLastError
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], 0x54
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x30], 0x78
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], 0x64
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], 0x65
call fcn.140171c70
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140174fc6
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [rsp + Ordinal_41]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x140175470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], reloc.WS2_32.dll_ntohl
call fcn.140163ce0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14017559a
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x67
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x55
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x41
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x54
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSAGetLastError
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14017558f
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [rsp + Ordinal_50]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x1401756c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x30], 1
call fcn.140012e00
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140175848
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x48], 0x61
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x48], 0x79
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x48], 0x41
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x48], 0x78
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x48], WSAStartup
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x48], 0x56
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x48], 0x67
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x48], 0
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x48], 0x75
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x48], 0x52
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x48], 0x45
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x48], 0x51
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x48], WSAGetLastError
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x48], 0x75
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14017583d
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x30]
add rsp, 0x68
ret
Function at 0x140176540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x40], 1
call fcn.140012e00
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1401766bc
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x58], 0x67
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x58], 0x41
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x58], 0x45
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x58], WSAGetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x58], 0x65
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x58], Ordinal_79
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x58], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x58], 0
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x58], 0x79
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x58], 0x52
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x58], 0x45
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x58], 0x75
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x58], 0x78
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x58], WSAGetLastError
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1401766b1
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [rsp + 0x50]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x40]
add rsp, 0x78
ret
Function at 0x140009c50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140013ee0], rbx
je 0x140009c9c
cmp rax, rbx
jne 0x140009c8f
mov ebx, 1
mov esi, ebx
jmp 0x140009ca1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009c74
mov ebx, 1
mov eax, dword [0x140013ee8]
cmp eax, ebx
jne 0x140009cb7
mov ecx, 0x1f
call fcn.1400a3000
jmp 0x140009d1c
mov eax, dword [0x140013ee8]
test eax, eax
jne 0x140009d16
mov dword [0x140013ee8], ebx
lea r15, [0x14000b650]
lea rdi, [0x14000b638]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140009d08
test eax, eax
jne 0x140009d0c
cmp qword [rdi], 0
je 0x140009cfd
mov rax, qword [rdi]
mov rcx, qword [0x14000b618]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x140009cde
test eax, eax
je 0x140009d1c
mov eax, 0xff
jmp 0x140009df8
mov dword [0x140013084], ebx
mov eax, dword [0x140013ee8]
cmp eax, ebx
jne 0x140009d43
lea rdx, [0x14000b630]
lea rcx, [0x14000b620]
call sub.msvcrt.dll__initterm
mov dword [0x140013ee8], 2
test esi, esi
jne 0x140009d50
xor eax, eax
xchg qword [0x140013ee0], rax
cmp qword [0x140013ef0], 0
je 0x140009d84
lea rcx, [0x140013ef0]
call fcn.14000a020
test eax, eax
je 0x140009d84
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140013ef0]
mov r9, qword [0x14000b618]
call r9
mov r8, qword [0x140013098]
mov rdx, qword [0x140013090]
mov ecx, dword [0x140013088]
call fcn.1400044dc
mov dword [0x140013080], eax
cmp dword [0x1400130a0], 0
jne 0x140009db4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140013084], 0
jne 0x140009dc9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140013080]
jmp 0x140009df8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14000a0b4
add rsp, 0x28
jmp 0x140009c50

Function at 0x140009f0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009f58
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140009f50
cmp dword [rcx + 0x3c], edx
jl 0x140009f50
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140009f50
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140009f58
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14002d48c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rax, rdx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov rbx, rcx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov qword [rbx + 0x30], rax
cmp rax, 0xffffffffffffffff
jne case.default.0x14002d4d8
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x28], 0
xor r9d, r9d
and dword [rsp + 0x20], 0
xor edx, edx
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
nop dword [rax + rax]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x14002d4d3
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
je 0x14002d4d3
mov rcx, qword [rbx + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rbx + 0x18], eax
cmp eax, 0xffffffff
je 0x14002d4d3
xor eax, eax
add rsp, 0x40
pop rbx
ret
ret
invalid
pop r14
scasd eax, dword [rdi]
jg 0x1400f5f30
vpsadbw ymm14, ymm14, ymmword [r15 + r15*8 - 0x49]
wait
invalid
invalid
invalid
loopne 0x1400f69cc
mov bh, 0xff
mov dh, 0xff
fidiv dword [rcx - 0x17]
jo 0x1400f6968
push qword [rbx - 0x4d01]
mov cl, 0xff
cmp byte [rsi + 0x195f85ff], dh
mov bl, 0xff
mov dl, 0xff
push qword [rcx - 0x49c701]
test dword [rdi + 0x19], ebx
xor ch, byte [rbp - 1]
lodsb al, byte [rsi]
jmp [rbx + 0x780a35c9]
invalid
invalid
cmp dword [rcx*2 + 0x4ce0e18a], ebx
pop rdi
cmp edi, esi
out dx, eax
mov esp, 0x56d43f55
xchg dword [rax - 0x68], edx
loop 0x1400f6a76
sub al, al
sbb esp, edi
invalid
insb byte [rdi], dx
mov eax, 0xc7ae5040
mov word [rax + 0x51], cs
jbe 0x1400f6a9c
xor eax, 0x3f9a81f4
cli
std
cwde
xor eax, 0xacfcddd9
sar ebp, 1
xor byte [0x13b1ee6a0], ah
cdq
loop 0x1400f6a14
jle 0x1400f6a09
xchg edx, eax
invalid
out dx, eax
or al, 0xe9
std
out dx, eax
pop rsp
invalid
invalid
fcomi st(0)
pop rdi
ror dh, 0xaf
invalid
invalid
push rcx
jg 0x1400f6a50
std
out dx, eax
test rax, 0xffffffff80205963
cmp ebp, esp
in al, dx
invalid
xchg ebx, eax
test byte [rbx + rdi*8 - 0x64], al
test bl, dh
xchg dword [rbp + 0x4df63f54], edx
cmp r15b, r14b
div esi
call [rcx + rdx*4 + 0x5c]
idiv bh
pop rsp
xchg ecx, eax
pop rsp
mov byte [rbp + rdx*4 + 0x75e2b2a], ch
invalid
invalid
invalid
ret
sti
pop rax
invalid
invalid
xor byte [rdi], cl
invalid
push rbp
mov esi, dword [rsi + 0x2e]
add byte [rax], bh
lodsb al, byte [rsi]
out 0x62, eax
jae 0x1400f6be4
invalid
jge 0x1400f6b44
invalid
mov esp, 0x4fff1000
wait
push rdx
fcmove st(0), st(1)
invalid