joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000646c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x70]
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x14000650f
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x1e], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x27], 0x696c7075
mov dword [rbp - 0x23], 0x65746163
mov word [rbp - 0x19], 0x78
mov byte [rbp - 0x1f], 0x54
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0x28], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140006506
mov eax, dword [rbp + 0x68]
mov r9d, r12d
mov qword [rsp + 0x28], r13
mov r8, r15
mov edx, r14d
mov dword [rsp + 0x20], eax
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140006a74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x13], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp - 0x1c], 0x65636f72
mov dword [rbp - 0x18], 0x65487373
mov dword [rbp - 0x20], 0x50746547
mov byte [rbp - 0x14], 0x61
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006acc
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000729c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, r8d
mov word [rbp - 0x1f], 0x6570
mov esi, edx
mov word [rbp - 0x16], reloc.WS2_32.dll_WSAStartup
mov edi, ecx
mov word [rbp - 0x19], 0x6563
or rbx, 0xffffffffffffffff
mov word [rbp - 0x1c], 0x7250
mov byte [rbp - 0x1d], WSAGetLastError
mov byte [rbp - 0x1a], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_79
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000730e
mov r8d, r14d
mov edx, esi
mov ecx, edi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140007328
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x1400073c3
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x53746553
mov rcx, rax
mov word [rbp - 0x1c], 0x6972
mov word [rbp - 0x27], 0x4f65
mov dword [rbp - 0x21], 0x63655374
mov word [rbp - 0x19], 0x79
mov dword [rbp - 0x2c], 0x69767265
mov dword [rbp - 0x25], 0x63656a62
mov byte [rbp - 0x1a], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1d], 0x75
mov byte [rbp - 0x28], SHCoCreateInstance
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400073ba
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007d60
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x78]
sub rsp, 0x170
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rsi, rcx
mov edi, 0x104
mov r8d, edi
lea rcx, [rsp + 0x50]
xor edx, edx
xor ebx, ebx
call fcn.140054ae0
mov r8d, edi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.1401478fc
lea rcx, [rsp + 0x50]
call fcn.14000da04
lea rdx, [rsp + 0x44]
mov word [rsp + 0x48], 0x7461
lea rcx, [rsp + 0x50]
mov word [rsp + 0x45], 0x2e6d
mov byte [rsp + 0x4a], bl
mov byte [rsp + 0x47], SHCoCreateInstance
mov byte [rsp + 0x44], reloc.WS2_32.dll_WSACleanup
call fcn.1400084f4
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call fcn.14000d8b8
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140007e41
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 4]
mov qword [rsp + 0x20], rbx
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov rcx, rdi
setne bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140051d60
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140008470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x30]
mov word [rbp - 0x2c], 0x4157
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x22], 0x2a5c7365
mov word [rbp - 0x2f], 0x464f
mov word [rbp - 0x1d], 0x6873
mov byte [rbp - 0x1e], 0x5c
mov word [rbp - 0x29], 0x5c45
mov dword [rbp - 0x26], 0x7373616c
mov word [rbp - 0x1a], 0x6c6c
mov byte [rbp - 0x30], 0x53
mov byte [rbp - 0x1b], SHCoCreateInstance
mov byte [rbp - 0x2a], 0x52
mov byte [rbp - 0x2d], 0x54
mov byte [rbp - 0x18], 0
mov byte [rbp - 0x27], 0x43
call fcn.140012aa8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x50
pop rbp
ret
Function at 0x140008fdc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, edx
mov dword [rbp - 0x16], 0x6d756c6f
mov rdi, rcx
mov word [rbp - 0x1d], 0x4664
or rbx, 0xffffffffffffffff
mov word [rbp - 0x20], 0x6946
mov dword [rbp - 0x1b], 0x74737269
mov word [rbp - 0x12], 0x5765
mov byte [rbp - 0x1e], WSAGetLastError
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x17], 0x56
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000904f
mov edx, esi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400090a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [rcx]
mov r8, rcx
or edx, 0xffffffff
jmp 0x1400090da
movzx eax, al
mov r9d, 7
xor edx, eax
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r9d, 1
jns 0x1400090b9
inc r8
mov al, byte [r8]
test al, al
jne 0x1400090ae
not edx
mov eax, edx
ret

Function at 0x1400090e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov ebx, 1
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x140009176
lea rdx, [rbp - 0x20]
mov word [rbp - 0x13], 0x6972
mov rcx, rax
mov word [rbp - 0x19], 0x7965
mov dword [rbp - 0x1e], 0x74655367
mov dword [rbp - 0x17], 0x75636553
mov word [rbp - 0x10], 0x79
mov byte [rbp - 0x1a], 0x4b
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x11], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000916d
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009198
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
xor ebx, ebx
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x14000921e
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x72655365
mov rcx, rax
mov dword [rbp - 0x13], 0x6c646e61
mov dword [rbp - 0x17], 0x48656369
mov word [rbp - 0x1f], 0x6f6c
mov word [rbp - 0xf], SHCoCreateInstance
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x18], 0x76
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009215
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140009bbc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x642e
mov word [rbp - 0x1d], 0x3372
mov word [rbp - 0x20], 0x7355
mov word [rbp - 0x17], WSAGetLastError
mov byte [rbp - 0x1e], SHCoCreateInstance
mov byte [rbp - 0x1b], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x18], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x40
pop rbp
ret

Function at 0x14000a2cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14000a2e5
xor eax, eax
jmp 0x14000a356
lea rdi, [0x14015bdb0]
not r9d
cmp r8d, 8
jb 0x14000a32b
mov r11d, r8d
shr r11, 3
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x14000a301
add r8d, 0xfffffff8
sub r11, 1
jne 0x14000a2fc
test r8d, r8d
je 0x14000a350
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r8d, 0xffffffff
jne 0x14000a330
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14000a840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x14000a8c2
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x17], 0x416563
mov rcx, rax
mov dword [rbp - 0x1f], 0x536e6570
mov word [rbp - 0x1a], 0x7672
mov byte [rbp - 0x1b], SHCoCreateInstance
mov byte [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x18], VarBstrFromUI1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000a8b9
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000ad94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r13, qword [rbp + 0x68]
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x14000ae45
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x38], 0x72657551
mov rcx, rax
mov dword [rbp - 0x2c], 0x656a624f
mov word [rbp - 0x1f], 0x79
mov word [rbp - 0x34], 0x5379
mov dword [rbp - 0x28], 0x65537463
mov word [rbp - 0x31], 0x7672
mov dword [rbp - 0x24], 0x69727563
mov byte [rbp - 0x32], SHCoCreateInstance
mov word [rbp - 0x2e], 0x6563
mov byte [rbp - 0x20], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x2f], VarBstrFromUI1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ae3c
mov r9d, r12d
mov qword [rsp + 0x20], r13
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000af28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x6c6c642e
mov word [rbp - 0x1c], 0x6970
mov word [rbp - 0x1f], 0x7664
mov byte [rbp - 0x14], 0
mov word [rbp - 0x1a], 0x3233
mov byte [rbp - 0x20], 0x41
mov byte [rbp - 0x1d], 0x61
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x40
pop rbp
ret
Function at 0x14000af90
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
and qword [rsp + 0x30], 0
call fcn.1400153e0
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14014665c
test eax, eax
je 0x14000b023
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call fcn.140147c5c
test eax, eax
je 0x14000b018
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
mov r9d, reloc.WS2_32.dll_recv
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
call fcn.1400106e0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x68
ret
Function at 0x14000b7b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov rsi, rcx
mov edi, reloc.WS2_32.dll_ntohl
call fcn.1400160c8
mov rbx, rax
test rax, rax
je 0x14000b833
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x41676e
mov rcx, rax
mov dword [rbp - 0x1a], 0x69727453
mov dword [rbp - 0x20], 0x64697555
mov word [rbp - 0x1c], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b82a
mov rdx, r14
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x14000c494
Capabilities:
Create thread
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x50
cmp byte [r8], 0
mov ebx, 1
je 0x14000c51c
and qword [rax - 0x30], 0
lea r9, [rax - 0x28]
or dword [rax - 0x28], 0xffffffff
lea r8, [0x140018cf4]
and dword [rax - 0x38], 0
mov qword [rax - 0x20], rcx
xor ecx, ecx
mov qword [rax - 0x18], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000c523
mov edx, 0x7530
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000c4f9
mov ebx, dword [rsp + 0x30]
jmp 0x14000c511
cmp eax, 0x102
jne 0x14000c511
mov ebx, 2
mov rcx, rdi
lea edx, [rbx - 1]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000c523
call fcn.14000c938
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14000c824
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov qword [rbp - 0x30], rdx
xor r14d, r14d
mov rsi, rdx
lea ecx, [r14 + 3]
call fcn.1400c0be0
call fcn.1400c0a60
mov r8, qword [rsi]
mov edx, 0x2712
mov rcx, rax
mov rdi, rax
call fcn.1400c0d00
lea r8, [0x140019b60]
mov edx, 0x4e2b
mov rcx, rdi
call fcn.1400c0d00
mov r8, rbx
mov edx, 0x2711
mov rcx, rdi
call fcn.1400c0d00
lea r8, [rbp - 0x28]
mov dword [rbp - 0x1a], 0x302e31
mov edx, 0x2722
mov dword [rbp - 0x24], 0x2d6c7275
mov rcx, rdi
mov dword [rbp - 0x28], 0x6362696c
mov dword [rbp - 0x20], 0x6e656761
mov word [rbp - 0x1c], 0x2f74
call fcn.1400c0d00
mov rcx, rdi
call fcn.1400c0750
test eax, eax
movzx ebx, r14b
lea ecx, [r14 + 1]
cmove ebx, ecx
mov rcx, rdi
call fcn.1400c0710
mov rdx, qword [rsi]
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000c907
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14000cc84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x19], 0x642e
mov dword [rbp - 0x1f], 0x61776c68
mov word [rbp - 0x16], WSAGetLastError
mov word [rbp - 0x1b], 0x6970
mov byte [rbp - 0x17], WSAGetLastError
mov byte [rbp - 0x20], 0x53
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x40
pop rbp
ret

Function at 0x14000d378
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15d, r9d
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
call fcn.14000af28
mov rbx, rax
test rax, rax
je 0x14000d42c
lea rdx, [rbp - 0x38]
mov word [rbp - 0x21], 0x614e
mov rcx, rax
mov word [rbp - 0x1e], 0x4165
mov dword [rbp - 0x2c], 0x63634174
mov word [rbp - 0x26], 0x5773
mov byte [rbp - 0x1c], 0
mov dword [rbp - 0x38], 0x6c697542
mov dword [rbp - 0x32], 0x696c7078
mov byte [rbp - 0x1f], WSAGetLastError
mov word [rbp - 0x23], 0x6874
mov byte [rbp - 0x24], VarBstrFromUI1
mov word [rbp - 0x28], 0x7365
mov word [rbp - 0x2e], 0x6963
mov word [rbp - 0x34], 0x4564
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d423
mov r10d, dword [rbp + 0x58]
mov r9d, r15d
mov r8d, r14d
mov dword [rsp + 0x20], r10d
mov rdx, rsi
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000d448
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, ecx
mov dword [rbp - 0x30], 0x61737457
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2b], 0x2e323369
mov r14, rdx
mov dword [rbp - 0x27], 0x6c6c64
xor ebx, ebx
mov byte [rbp - 0x2c], reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000d4e3
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x51535457
mov rcx, rax
mov dword [rbp - 0x18], 0x72657355
mov dword [rbp - 0x1c], 0x79726575
mov dword [rbp - 0x14], 0x656b6f54
mov word [rbp - 0x10], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d4da
mov rdx, r14
mov ecx, esi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14000d6b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
mov word [rsp + 0x28], SHCoCreateInstance
xor ebx, ebx
mov dword [rsp + 0x23], 0x6f6c4364
mov word [rsp + 0x20], 0x6946
mov byte [rsp + 0x27], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x22], WSAGetLastError
call fcn.140002838
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d715
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14000d754
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov word [rbp - 0x27], 0x6c6c
xor ebx, ebx
mov dword [rbp - 0x30], 0x72657355
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
mov r15d, r8d
mov dword [rbp - 0x2c], 0x2e766e65
mov r14, rdx
mov byte [rbp - 0x28], SHCoCreateInstance
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000d80d
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1e], 0x65746165
mov rcx, rax
mov dword [rbp - 0x10], 0x6f6c4274
mov word [rbp - 0x15], 0x6e6f
mov word [rbp - 0x12], 0x6e65
mov word [rbp - 0xc], 0x6b63
mov byte [rbp - 0x13], WSAGetLastError
mov dword [rbp - 0x19], 0x7269766e
mov word [rbp - 0x20], 0x7243
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0xa], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d804
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret