joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007af4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x15], 0x7478
mov byte [rbp - 0x13], bl
mov rsi, rdx
mov rdi, rcx
mov dword [rbp - 0x1f], 0x65636f72
mov dword [rbp - 0x1a], 0x4e323373
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x16], 0x65
call fcn.140012d7c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007b5d
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140007b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
or ebx, 0xffffffff
mov dword [rbp - 0x19], 0x496e6f69
mov dword [rbp - 0x1d], 0x73736553
mov dword [rbp - 0x26], 0x6f436576
mov dword [rbp - 0x30], 0x47535457
mov dword [rbp - 0x21], 0x656c6f73
mov dword [rbp - 0x2a], 0x69746341
mov word [rbp - 0x15], 0x64
mov word [rbp - 0x2c], 0x7465
mov byte [rbp - 0x22], WSASetLastError
call fcn.140012d7c
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007bf3
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140007c14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, qword [rbp + 0x40]
lea rcx, [rbp - 0x30]
mov rsi, r9
mov dword [rbp - 0x27], 0x6c6c64
xor ebx, ebx
mov word [rbp - 0x2a], 0x3233
mov byte [rbp - 0x28], 0x2e
mov dword [rbp - 0x2f], 0x70617374
mov byte [rbp - 0x30], 0x57
mov byte [rbp - 0x2b], 0x69
call fcn.140014140
mov rdi, rax
test rax, rax
je 0x140007cd5
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xf], 0x41736e6f
mov rcx, rax
mov dword [rbp - 0x15], 0x73655365
mov dword [rbp - 0x1d], 0x6d756e45
mov word [rbp - 0x20], 0x5457
mov word [rbp - 0x18], 0x6172
mov word [rbp - 0x11], 0x6973
mov byte [rbp - 0xb], bl
mov byte [rbp - 0x1e], 0x53
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x19], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007ccd
mov r9, rsi
mov qword [rsp + 0x20], r14
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140007d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov edi, 1
call fcn.140012dd8
mov rbx, rax
test rax, rax
je 0x140007da2
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x6e456765
mov rcx, rax
mov word [rbp - 0x14], 0x41
mov dword [rbp - 0x19], 0x4579654b
mov byte [rbp - 0x20], 0x52
mov word [rbp - 0x1b], 0x6d75
mov byte [rbp - 0x15], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007d9a
and qword [rsp + 0x38], 0
mov r9, r12
and qword [rsp + 0x30], 0
mov r8, r15
and qword [rsp + 0x28], 0
mov edx, r14d
and qword [rsp + 0x20], 0
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.140012c50
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140007dc8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, qword [rbp + 0x60]
mov r15, r9
mov r13, qword [rbp + 0x68]
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.140012dd8
mov rbx, rax
test rax, rax
je 0x140007e77
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x61567972
mov rcx, rax
mov word [rbp - 0x12], 0x4178
mov word [rbp - 0x1c], 0x6575
mov word [rbp - 0x1f], 0x6765
mov word [rbp - 0x15], 0x6575
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x13], 0x45
mov byte [rbp - 0x1d], 0x51
mov byte [rbp - 0x16], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007e6f
mov qword [rsp + 0x28], r13
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r14
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.140012c50
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140007ea4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov dword [rbp - 0x18], 0x6c694665
xor ebx, ebx
mov word [rbp - 0x14], 0x4e65
mov dword [rbp - 0x20], 0x4d746547
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x11], 0x41656d
mov byte [rbp - 0x12], 0x61
call fcn.140012d7c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007f15
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x140007f3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x70]
mov r12, r9
mov r13, qword [rbp + 0x68]
mov r15, r8
mov qword [rbp - 0x28], rax
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.14001f804
mov rbx, rax
test rax, rax
je 0x140007fe8
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x7465
mov rcx, rax
mov word [rbp - 0x1a], 0x6c61
mov word [rbp - 0x17], 0x4165
mov word [rbp - 0x1f], 0x4748
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x1b], 0x56
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x18], 0x75
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007fe0
mov rcx, qword [rbp - 0x28]
mov r9, r12
mov qword [rsp + 0x28], rcx
mov r8, r15
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov rdx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.140012c50
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400080bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.140007960
mov rdi, rax
test rax, rax
je 0x140008150
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e6f6973
mov rcx, rax
mov word [rbp - 0xa], 0x41
mov dword [rbp - 0x1f], 0x69467465
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0xf], 0x7a69536f
mov word [rbp - 0x11], 0x666e
mov byte [rbp - 0x12], 0x49
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0xb], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008148
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140008178
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, r9
mov r15d, r8d
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.140007960
mov rdi, rax
test rax, rax
je 0x140008209
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x69467465
mov rcx, rax
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0x10], 0x416f66
mov dword [rbp - 0x15], 0x496e6f69
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x11], WSASetLastError
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008201
mov r9, r12
mov r8d, r15d
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000822c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.140012dd8
mov rdi, rax
test rax, rax
je 0x1400082ca
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x24], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x19], 0x6e6f6974
mov word [rbp - 0x1e], 0x6f66
mov dword [rbp - 0x28], 0x54746547
mov byte [rbp - 0x15], bl
mov word [rbp - 0x1b], 0x616d
mov word [rbp - 0x20], 0x6e49
mov byte [rbp - 0x1c], WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400082c2
mov r9d, r12d
mov qword [rsp + 0x20], r13
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400082f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r9
mov r14, r8
mov rsi, rcx
mov edi, 1
call fcn.140012dd8
mov rbx, rax
test rax, rax
je 0x14000838b
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x6547
mov rcx, rax
mov dword [rbp - 0x1a], 0x5379654b
mov word [rbp - 0x20], 0x6552
mov word [rbp - 0x16], 0x6365
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x13], 0x6972
mov byte [rbp - 0x14], 0x75
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x11], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008383
mov r9, r15
lea edx, [rdi + 3]
mov r8, r14
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.140012c50
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400083b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.140012dd8
mov rdi, rax
test rax, rax
je 0x140008459
lea rdx, [rbp - 0x30]
mov word [rbp - 0x21], 0x6972
mov rcx, rax
mov dword [rbp - 0x1b], 0x6c636144
mov dword [rbp - 0x26], 0x73654479
mov word [rbp - 0x1e], 0x6f74
mov dword [rbp - 0x2d], 0x75636553
mov byte [rbp - 0x22], 0x63
mov byte [rbp - 0x17], bl
mov word [rbp - 0x29], 0x6972
mov byte [rbp - 0x1f], reloc.WS2_32.dll_WSASetLastError
mov word [rbp - 0x30], 0x6547
mov byte [rbp - 0x1c], WSACleanup
mov byte [rbp - 0x27], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x2e], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008451
mov r9, r12
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000847c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.140012dd8
mov rdi, rax
test rax, rax
je 0x14000850c
lea rdx, [rbp - 0x20]
mov word [rbp - 0xf], 0x536f
mov rcx, rax
mov dword [rbp - 0x14], 0x64695367
mov dword [rbp - 0x18], 0x6e697274
mov dword [rbp - 0xd], 0x416469
mov dword [rbp - 0x1c], 0x53747265
mov word [rbp - 0x1f], 0x6e6f
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008504
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140008534
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r9
mov r14, r8
mov rsi, rdx
mov ebx, 1
call fcn.140012dd8
mov rdi, rax
test rax, rax
je 0x1400085c7
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x49736569
mov rcx, rax
mov dword [rbp - 0x14], 0x416c6341
mov word [rbp - 0x1f], 0x7465
mov word [rbp - 0x1c], 0x746e
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x15], WSASetLastError
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x1a], WSACleanup
mov byte [rbp - 0x1d], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400085bf
mov r9, r15
mov r8, r14
mov rdx, rsi
mov ecx, ebx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140008680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov rsi, rdx
mov edi, 1
call fcn.140012dd8
mov rbx, rax
test rax, rax
je 0x14000870e
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x4b6e
mov rcx, rax
mov word [rbp - 0x1d], 0x704f
mov word [rbp - 0x17], 0x4179
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x1b], 0x65
mov byte [rbp - 0x18], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008706
mov r8, r14
mov rdx, rsi
mov rcx, 0xffffffff80000002
call rax
mov edi, eax
mov rcx, rbx
call fcn.140012c50
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x1400087ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x17], 0x746e75
mov dword [rbp - 0x1e], 0x63695474
mov word [rbp - 0x19], 0x6f43
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x1a], 0x6b
call fcn.140012d7c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008842
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140008864
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov dword [rsp + 0x32], 0x46657469
mov byte [rsp + 0x39], bl
mov r14, r9
mov ebp, r8d
mov word [rsp + 0x37], 0x656c
mov rsi, rdx
mov word [rsp + 0x30], 0x7257
mov rdi, rcx
mov byte [rsp + 0x36], 0x69
call fcn.140012d7c
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400088d8
mov r9, r14
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400088f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, qword [rbp + 0x70]
mov rsi, rdx
mov r15, qword [rbp + 0x78]
mov rdi, rcx
xor ebx, ebx
mov word [rbp - 0x20], 0x7243
mov word [rbp - 0x16], 0x7365
mov dword [rbp - 0x1d], 0x50657461
mov word [rbp - 0x19], 0x6f72
mov word [rbp - 0x13], 0x41
mov byte [rbp - 0x1e], 0x65
mov byte [rbp - 0x14], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x17], 0x63
call fcn.140012d7c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000899b
mov qword [rsp + 0x48], r15
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rdx, rsi
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], ebx
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400089c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x1f], 0x7365
mov byte [rbp - 0x16], bl
mov r15, r9
mov r14, r8
mov dword [rbp - 0x1a], 0x79726f6d
mov rsi, rdx
mov dword [rbp - 0x28], 0x74697257
mov rdi, rcx
mov dword [rbp - 0x24], 0x6f725065
mov word [rbp - 0x1c], 0x654d
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x20], 0x63
call fcn.140012d7c
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008a48
mov r9, r15
mov qword [rsp + 0x20], rbx
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140008a6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov dword [rbp - 0x1a], 0x50657461
xor ebx, ebx
mov dword [rbp - 0x13], 0x737365
mov dword [rbp - 0x20], 0x6d726554
mov word [rbp - 0x1c], 0x6e69
mov word [rbp - 0x15], 0x636f
mov byte [rbp - 0x16], WSACleanup
call fcn.140012d7c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008ad6
xor edx, edx
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140008afc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov edi, select
call fcn.140012d24
mov rbx, rax
test rax, rax
je 0x140008b76
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x53637052
mov rcx, rax
mov dword [rbp - 0x18], 0x65724667
mov word [rbp - 0x14], 0x4165
mov dword [rbp - 0x1c], 0x6e697274
mov byte [rbp - 0x12], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008b6e
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.140012c50
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140008ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, qword [rbp + 0x50]
mov r14, r9
mov r12, qword [rbp + 0x58]
mov rsi, r8
mov edi, 1
call fcn.14001f804
mov rbx, rax
test rax, rax
je 0x140008c48
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x72657551
mov rcx, rax
mov word [rbp - 0x1d], 0x636f
mov dword [rbp - 0x14], 0x676e6972
mov word [rbp - 0x20], 0x7341
mov word [rbp - 0x16], 0x7453
mov word [rbp - 0x10], 0x41
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x17], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008c40
mov qword [rsp + 0x28], r12
lea edx, [rdi + 1]
mov r9, r14
mov qword [rsp + 0x20], r15
mov r8, rsi
xor ecx, ecx
call rax
mov edi, eax
mov rcx, rbx
call fcn.140012c50
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140008c78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r8
mov rsi, rcx
xor ebx, ebx
call fcn.140012dd8
mov rdi, rax
test rax, rax
je 0x140008d16
lea rdx, [rbp - 0x20]
mov word [rbp - 0x11], 0x6c69
mov rcx, rax
mov dword [rbp - 0xe], 0x736567
mov dword [rbp - 0x1f], 0x73756a64
mov dword [rbp - 0x16], 0x6972506e
mov dword [rbp - 0x1a], 0x656b6f54
mov byte [rbp - 0x12], 0x76
mov byte [rbp - 0xf], 0x65
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x20], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008d0e
mov qword [rsp + 0x28], rbx
lea r9d, [rbx + 0x10]
mov r8, r14
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026bb0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140008d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov rsi, rdx
xor ebx, ebx
call fcn.1400079b4
mov rdi, rax
test rax, rax
je 0x140008dbd
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x6f426567
mov rcx, rax
mov dword [rbp - 0x20], 0x7373654d
mov byte [rbp - 0x1c], 0x61
mov word [rbp - 0x17], 0x4178
mov byte [rbp - 0x15], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008db5
lea r9d, [rbx + 0x10]
mov r8, r14
mov rdx, rsi
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140012c50
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140026bb0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret