joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e9f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov word [rbp - 6], 0x7275
mov rsi, rcx
mov dword [rbp - 0xd], 0x52666f65
xor ebx, ebx
mov word [rbp - 3], 0x65
mov word [rbp - 0x10], 0x6953
mov word [rbp - 8], 0x6f73
mov byte [rbp - 0xe], 0x7a
mov byte [rbp - 9], 0x65
mov byte [rbp - 4], 0x63
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400ea198
test rax, rax
je 0x1400e9f8a
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e9fa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 8], 0x65637275
mov byte [rbp - 4], bl
mov rdi, rcx
mov dword [rbp - 0xf], 0x526b636f
mov byte [rbp - 0x10], 0x4c
mov word [rbp - 0xb], 0x7365
mov byte [rbp - 9], reloc.WS2_32.dll_WSAGetLastError
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400ea198
test rax, rax
je 0x1400e9ffc
mov rcx, rdi
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400ea018
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 7], 0x656372
mov rsi, rcx
mov dword [rbp - 0x10], 0x64616f4c
xor ebx, ebx
mov dword [rbp - 0xb], 0x756f7365
mov byte [rbp - 0xc], 0x52
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400ea198
test rax, rax
je 0x1400ea071
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400ea090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 6], 0x576563
mov rsi, rcx
mov dword [rbp - 0xb], 0x756f7365
xor ebx, ebx
mov dword [rbp - 0xf], 0x52646e69
mov byte [rbp - 0x10], 0x46
mov byte [rbp - 7], WSACleanup
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400ea198
test rax, rax
je 0x1400ea0f1
lea r8d, [rbx + 6]
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x1400ea110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, r8
mov dword [rbp - 0x10], 0x646e6946
mov rsi, rcx
mov dword [rbp - 7], 0x45656372
xor ebx, ebx
mov dword [rbp - 0xc], 0x6f736552
mov word [rbp - 2], 0x57
mov byte [rbp - 3], 0x78
mov byte [rbp - 8], 0x75
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400ea198
test rax, rax
je 0x1400ea179
xor r9d, r9d
lea edx, [rbx + 6]
mov r8, rdi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400ea198
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14011c9c8]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x1400ea229
lea rcx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x656e
mov dword [rbp - 0x17], 0x6c6c64
mov word [rbp - 0x20], 0x654b
mov dword [rbp - 0x1b], 0x2e32336c
mov byte [rbp - 0x1e], WSACleanup
mov word [rbp - 4], 0x7373
mov dword [rbp - 0xd], 0x636f7250
mov dword [rbp - 9], 0x72646441
mov byte [rbp - 5], 0x65
mov byte [rbp - 2], bl
mov word [rbp - 0xf], 0x7465
mov byte [rbp - 0x10], 0x47
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011c9c8], rax
test rax, rax
je 0x1400ea234
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ea254
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14011c9c0]
xor ebx, ebx
mov rdi, rcx
test rax, rax
jne 0x1400ea2d7
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6e72654b
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x28], 0x6c6c642e
mov byte [rbp - 0x24], bl
mov dword [rbp - 0x19], 0x6148656c
mov dword [rbp - 0x15], 0x656c646e
mov dword [rbp - 0x20], 0x4d746547
mov word [rbp - 0x11], 0x41
mov word [rbp - 0x1c], 0x646f
mov byte [rbp - 0x1a], 0x75
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011c9c0], rax
test rax, rax
je 0x1400ea2df
mov rcx, rdi
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400ea2f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov word [rbp - 0x14], 0x706c
mov dword [rbp - 0x1e], 0x65746165
mov word [rbp - 0xd], 0x7370
mov dword [rbp - 0x11], 0x616e5332
mov word [rbp - 0xa], 0x746f
mov dword [rbp - 0x18], 0x65686c6f
mov byte [rbp - 0x12], 0x33
mov byte [rbp - 8], 0
mov word [rbp - 0x20], 0x7243
mov word [rbp - 0x1a], 0x6f54
mov byte [rbp - 0xb], 0x68
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400ea198
test rax, rax
je 0x1400ea368
xor edx, edx
lea ecx, [rbx + 3]
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ea37c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 8], 0x72694632
mov rsi, rcx
mov dword [rbp - 0xd], 0x73736563
xor ebx, ebx
mov word [rbp - 0xf], 0x6f72
mov word [rbp - 3], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 4], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], 0x50
mov byte [rbp - 9], 0x33
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400ea198
test rax, rax
je 0x1400ea3e1
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400ea468
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rbx, rcx
call fcn.1400e9be4
mov rdi, rax
test rax, rax
je 0x1400ea4c3
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x65776f4c
mov rcx, rax
mov dword [rbp - 0x10], 0x72616843
mov word [rbp - 8], 0x4172
mov byte [rbp - 6], 0
call fcn.1400ea198
test rax, rax
je 0x1400ea4bb
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400eb038
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400ea4dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov word [rbp - 0xb], 0x7373
mov rsi, rcx
mov dword [rbp - 0x10], 0x636f7250
xor ebx, ebx
mov word [rbp - 4], reloc.WS2_32.dll_WSACleanup
mov dword [rbp - 9], 0x654e3233
mov byte [rbp - 5], 0x78
mov byte [rbp - 0xc], 0x65
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400ea198
test rax, rax
je 0x1400ea53d
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x1400ea858
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.1400e9c98
mov rbx, rax
test rax, rax
je 0x1400ea8e8
lea rdx, [rbp - 0x10]
mov dword [rbp - 7], 0x41784579
mov rcx, rax
mov word [rbp - 0xf], 0x6765
mov dword [rbp - 0xc], 0x4b6e6570
mov byte [rbp - 0x10], 0x52
mov byte [rbp - 3], 0
mov byte [rbp - 0xd], 0x4f
mov byte [rbp - 8], 0x65
call fcn.1400ea198
mov r10, rax
test rax, rax
je 0x1400ea8e0
mov rax, qword [rbp + 0x40]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, r15
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400eb038
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400eab38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, 1
call fcn.1400e9c98
mov rbx, rax
test rax, rax
je 0x1400eabac
lea rdx, [rbp - 0x10]
mov word [rbp - 7], 0x7965
mov rcx, rax
mov word [rbp - 0x10], 0x6552
mov word [rbp - 0xd], 0x6c43
mov byte [rbp - 5], 0
mov word [rbp - 0xa], 0x6573
mov byte [rbp - 0xe], 0x67
mov byte [rbp - 0xb], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 8], 0x4b
call fcn.1400ea198
test rax, rax
je 0x1400eaba4
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400eb038
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x1400eabcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x1f], 0x6f4d7465
xor ebx, ebx
mov dword [rbp - 0x13], 0x656d614e
mov word [rbp - 0xf], 0x41
mov dword [rbp - 0x19], 0x6946656c
mov word [rbp - 0x1b], 0x7564
mov word [rbp - 0x15], 0x656c
mov byte [rbp - 0x20], 0x47
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400ea198
test rax, rax
je 0x1400eac33
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400eac4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
call fcn.1400e9ce0
mov rdi, rax
test rax, rax
je 0x1400eacb8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x12], 0x41656d
mov rcx, rax
mov dword [rbp - 0x1d], 0x6e694668
mov dword [rbp - 0x16], 0x614e656c
mov word [rbp - 0x20], 0x6150
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x19], 0x4664
mov byte [rbp - 0x17], 0x69
call fcn.1400ea198
test rax, rax
je 0x1400eacb0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400eb038
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400eacd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
call fcn.1400e9ce0
mov rbx, rax
test rax, rax
je 0x1400ead47
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x6f6d
mov rcx, rax
mov dword [rbp - 0x15], 0x6e657478
mov dword [rbp - 0x1f], 0x52687461
mov dword [rbp - 0xf], 0x416e6f
mov byte [rbp - 0x1b], 0x65
mov word [rbp - 0x11], 0x6973
mov word [rbp - 0x17], 0x4565
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x18], 0x76
call fcn.1400ea198
test rax, rax
je 0x1400ead3f
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400eb038
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ead60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x17], 0x6f725074
mov dword [rbp - 0x20], 0x43746547
mov dword [rbp - 0x13], 0x73736563
mov word [rbp - 0x1c], 0x7275
mov word [rbp - 0x19], 0x6e65
mov byte [rbp - 0x1a], WSACleanup
mov byte [rbp - 0xf], 0
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400ea198
test rax, rax
je 0x1400eadb5
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400eaf4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
mov word [rbp - 0xc], 0x694c
xor ebx, ebx
mov dword [rbp - 7], 0x417972
mov word [rbp - 9], 0x6172
mov dword [rbp - 0x10], 0x64616f4c
mov byte [rbp - 0xa], 0x62
call fcn.1400e9d94
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400ea198
test rax, rax
je 0x1400eaf9f
mov rcx, rdi
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400eb538
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.1400e9c98
mov rdi, rax
test rax, rax
je 0x1400eb5bc
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x6e656b6f
mov rcx, rax
mov word [rbp - 0x18], 0x7365
mov dword [rbp - 0x20], 0x6e65704f
mov byte [rbp - 0x10], bl
mov word [rbp - 0x1b], 0x6f72
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1c], 0x50
mov byte [rbp - 0x19], 0x63
call fcn.1400ea198
test rax, rax
je 0x1400eb5b4
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400eb038
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400eb878
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rcx
mov edi, 1
call fcn.1400e9c98
mov rbx, rax
test rax, rax
je 0x1400eb900
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x13], 0x79746972
mov rcx, rax
mov dword [rbp - 0x1d], 0x4b746547
mov dword [rbp - 0x17], 0x75636553
mov word [rbp - 0x19], 0x7965
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0xf], 0
mov byte [rbp - 0x1e], 0x67
call fcn.1400ea198
test rax, rax
je 0x1400eb8f8
mov r9, rsi
lea edx, [rdi + 3]
mov r8, r14
mov rcx, r15
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400eb038
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400eb9d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.1400e9c98
mov rdi, rax
test rax, rax
je 0x1400eba60
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x10], 0x69536f54
mov rcx, rax
mov dword [rbp - 0x1e], 0x7265766e
mov word [rbp - 0xb], 0x41
mov word [rbp - 0x20], 0x6f43
mov dword [rbp - 0x15], 0x6953676e
mov word [rbp - 0x17], 0x6972
mov word [rbp - 0x1a], 0x5374
mov byte [rbp - 0x18], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x11], 0x64
mov byte [rbp - 0xc], 0x64
call fcn.1400ea198
test rax, rax
je 0x1400eba58
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400eb038
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400eba84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, r9
mov r14, r8
mov r15, rdx
xor ebx, ebx
call fcn.1400e9c98
mov rdi, rax
test rax, rax
je 0x1400ebb26
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x6e756f63
mov rcx, rax
mov dword [rbp - 0x13], 0x41646953
mov dword [rbp - 0x1e], 0x70756b6f
mov byte [rbp - 0xf], bl
mov word [rbp - 0x20], 0x6f4c
mov word [rbp - 0x1a], 0x6341
mov byte [rbp - 0x14], reloc.WS2_32.dll_WSACleanup
call fcn.1400ea198
mov r10, rax
test rax, rax
je 0x1400ebb1e
mov rax, qword [rbp + 0x50]
mov r9, rsi
mov qword [rsp + 0x30], rax
mov r8, r14
mov rax, qword [rbp + 0x48]
mov rdx, r15
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400eb038
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400ebb48
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edi, r9d
mov esi, r8d
mov r14, rdx
mov r15, rcx
call fcn.1400e9c98
mov rbx, rax
test rax, rax
je 0x1400ebbe4
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xd], 0x68746957
mov rcx, rax
mov dword [rbp - 0x1f], 0x646c6975
mov dword [rbp - 0x16], 0x41746963
mov dword [rbp - 7], 0x41656d
mov dword [rbp - 0x12], 0x73656363
mov byte [rbp - 0x20], 0x42
mov dword [rbp - 0x1b], 0x6c707845
mov word [rbp - 9], 0x614e
mov byte [rbp - 0x17], 0x69
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSAStartup
call fcn.1400ea198
test rax, rax
je 0x1400ebbdc
and dword [rsp + 0x20], 0
mov r9d, edi
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rcx, rbx
call fcn.1400eb038
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400ebcb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400e9c98
mov rdi, rax
test rax, rax
je 0x1400ebd44
lea rdx, [rbp - 0x20]
mov dword [rbp - 7], 0x726f74
mov rcx, rax
mov dword [rbp - 0x20], 0x74696e49
mov word [rbp - 0x1b], 0x6c61
mov dword [rbp - 0x18], 0x6553657a
mov word [rbp - 0xe], 0x6544
mov word [rbp - 0x11], 0x7469
mov word [rbp - 0x14], 0x7563
mov dword [rbp - 0xb], 0x70697263
mov byte [rbp - 0x12], WSACleanup
mov byte [rbp - 0xf], 0x79
mov byte [rbp - 0xc], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x19], 0x69
mov byte [rbp - 0x1c], 0x69
call fcn.1400ea198
test rax, rax
je 0x1400ebd3c
lea edx, [rbx + 1]
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400eb038
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ebd64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.1400e9c98
mov rdi, rax
test rax, rax
je 0x1400ebdee
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x72756365
mov rcx, rax
mov dword [rbp - 0x18], 0x44797469
mov dword [rbp - 0xb], 0x6c636144
mov dword [rbp - 0x14], 0x72637365
mov dword [rbp - 0x10], 0x6f747069
mov dword [rbp - 0x20], 0x53746553
mov byte [rbp - 7], bl
mov byte [rbp - 0xc], WSACleanup
call fcn.1400ea198
test rax, rax
je 0x1400ebde6
xor r9d, r9d
lea edx, [rbx + 1]
mov r8, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400eb038
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400ebe10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
mov edi, 1
call fcn.1400e9c98
mov rbx, rax
test rax, rax
je 0x1400ebe9e
lea rdx, [rbp - 0x20]
mov word [rbp - 0x14], 0x7275
mov rcx, rax
mov word [rbp - 0x1f], 0x6765
mov dword [rbp - 0x1a], 0x5379654b
mov word [rbp - 0x11], 0x7974
mov word [rbp - 0x1c], 0x7465
mov word [rbp - 0x16], 0x6365
mov byte [rbp - 0x1d], 0x53
mov byte [rbp - 0x12], 0x69
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0xf], 0
call fcn.1400ea198
test rax, rax
je 0x1400ebe96
mov r8, rsi
lea edx, [rdi + 3]
mov rcx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400eb038
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ebec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov edi, 1
call fcn.1400e9c98
mov rbx, rax
test rax, rax
je 0x1400ebf39
lea rdx, [rbp - 0x10]
mov word [rbp - 0xc], 0x6570
mov rcx, rax
mov dword [rbp - 9], 0x4179654b
mov dword [rbp - 0x10], 0x4f676552
mov byte [rbp - 0xa], WSASetLastError
mov byte [rbp - 5], 0
call fcn.1400ea198
test rax, rax
je 0x1400ebf31
mov r8, rsi
mov rdx, r14
mov rcx, 0xffffffff80000002
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400eb038
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x1400ebf5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
call fcn.1400e9c98
mov rdi, rax
test rax, rax
je 0x1400ebfc7
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xa], 0x616e614d
mov rcx, rax
mov dword [rbp - 0xe], 0x43536e65
mov word [rbp - 0x10], 0x704f
mov word [rbp - 3], 0x41
mov word [rbp - 6], 0x6567
mov byte [rbp - 4], WSACleanup
call fcn.1400ea198
test rax, rax
je 0x1400ebfbf
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400eb038
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret