joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e84d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov word [rbp - 6], 0x7275
mov rsi, rcx
mov dword [rbp - 0xd], 0x52666f65
xor ebx, ebx
mov word [rbp - 3], 0x65
mov word [rbp - 0x10], 0x6953
mov word [rbp - 8], 0x6f73
mov byte [rbp - 0xe], 0x7a
mov byte [rbp - 9], 0x65
mov byte [rbp - 4], 0x63
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400e8748
test rax, rax
je 0x1400e853a
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e8558
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 8], 0x65637275
mov byte [rbp - 4], bl
mov rdi, rcx
mov dword [rbp - 0xf], 0x526b636f
mov byte [rbp - 0x10], 0x4c
mov word [rbp - 0xb], 0x7365
mov byte [rbp - 9], reloc.WS2_32.dll_WSAGetLastError
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400e8748
test rax, rax
je 0x1400e85ac
mov rcx, rdi
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e85c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 7], 0x656372
mov rsi, rcx
mov dword [rbp - 0x10], 0x64616f4c
xor ebx, ebx
mov dword [rbp - 0xb], 0x756f7365
mov byte [rbp - 0xc], 0x52
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400e8748
test rax, rax
je 0x1400e8621
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e8640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 6], 0x576563
mov rsi, rcx
mov dword [rbp - 0xb], 0x756f7365
xor ebx, ebx
mov dword [rbp - 0xf], 0x52646e69
mov byte [rbp - 0x10], 0x46
mov byte [rbp - 7], WSACleanup
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400e8748
test rax, rax
je 0x1400e86a1
lea r8d, [rbx + 6]
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x1400e86c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, r8
mov dword [rbp - 0x10], 0x646e6946
mov rsi, rcx
mov dword [rbp - 7], 0x45656372
xor ebx, ebx
mov dword [rbp - 0xc], 0x6f736552
mov word [rbp - 2], VarDateFromR4
mov byte [rbp - 3], 0x78
mov byte [rbp - 8], 0x75
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400e8748
test rax, rax
je 0x1400e8729
xor r9d, r9d
lea edx, [rbx + 6]
mov r8, rdi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e8748
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14011a9b8]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x1400e87d9
lea rcx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x656e
mov dword [rbp - 0x17], 0x6c6c64
mov word [rbp - 0x20], 0x654b
mov dword [rbp - 0x1b], 0x2e32336c
mov byte [rbp - 0x1e], WSACleanup
mov word [rbp - 4], 0x7373
mov dword [rbp - 0xd], 0x636f7250
mov dword [rbp - 9], 0x72646441
mov byte [rbp - 5], 0x65
mov byte [rbp - 2], bl
mov word [rbp - 0xf], 0x7465
mov byte [rbp - 0x10], 0x47
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011a9b8], rax
test rax, rax
je 0x1400e87e4
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400e8804
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14011a9b0]
xor ebx, ebx
mov rdi, rcx
test rax, rax
jne 0x1400e8887
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6e72654b
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x28], 0x6c6c642e
mov byte [rbp - 0x24], bl
mov dword [rbp - 0x19], 0x6148656c
mov dword [rbp - 0x15], 0x656c646e
mov dword [rbp - 0x20], 0x4d746547
mov word [rbp - 0x11], 0x41
mov word [rbp - 0x1c], 0x646f
mov byte [rbp - 0x1a], 0x75
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011a9b0], rax
test rax, rax
je 0x1400e888f
mov rcx, rdi
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400e88a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov word [rbp - 0x14], 0x706c
mov dword [rbp - 0x1e], 0x65746165
mov word [rbp - 0xd], 0x7370
mov dword [rbp - 0x11], 0x616e5332
mov word [rbp - 0xa], 0x746f
mov dword [rbp - 0x18], 0x65686c6f
mov byte [rbp - 0x12], 0x33
mov byte [rbp - 8], 0
mov word [rbp - 0x20], 0x7243
mov word [rbp - 0x1a], 0x6f54
mov byte [rbp - 0xb], 0x68
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400e8748
test rax, rax
je 0x1400e8918
xor edx, edx
lea ecx, [rbx + 3]
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400e892c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 8], 0x72694632
mov rsi, rcx
mov dword [rbp - 0xd], 0x73736563
xor ebx, ebx
mov word [rbp - 0xf], 0x6f72
mov word [rbp - 3], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 4], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], 0x50
mov byte [rbp - 9], 0x33
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400e8748
test rax, rax
je 0x1400e8991
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e8a18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rbx, rcx
call fcn.1400e8194
mov rdi, rax
test rax, rax
je 0x1400e8a73
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x65776f4c
mov rcx, rax
mov dword [rbp - 0x10], 0x72616843
mov word [rbp - 8], 0x4172
mov byte [rbp - 6], 0
call fcn.1400e8748
test rax, rax
je 0x1400e8a6b
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400e966c
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e8a8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov word [rbp - 0xb], 0x7373
mov rsi, rcx
mov dword [rbp - 0x10], 0x636f7250
xor ebx, ebx
mov word [rbp - 4], reloc.WS2_32.dll_WSACleanup
mov dword [rbp - 9], 0x654e3233
mov byte [rbp - 5], 0x78
mov byte [rbp - 0xc], 0x65
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400e8748
test rax, rax
je 0x1400e8aed
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x1400e8da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x1c], 0x65727275
mov byte [rbp - 0xd], bl
mov dword [rbp - 0x17], 0x6f725074
mov dword [rbp - 0x13], 0x73736563
mov dword [rbp - 0x20], 0x43746547
mov word [rbp - 0xf], 0x6449
mov byte [rbp - 0x18], WSASetLastError
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400e8748
test rax, rax
je 0x1400e8df2
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400e8e08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.1400e8248
mov rbx, rax
test rax, rax
je 0x1400e8e98
lea rdx, [rbp - 0x10]
mov dword [rbp - 7], 0x41784579
mov rcx, rax
mov word [rbp - 0xf], 0x6765
mov dword [rbp - 0xc], 0x4b6e6570
mov byte [rbp - 0x10], 0x52
mov byte [rbp - 3], 0
mov byte [rbp - 0xd], 0x4f
mov byte [rbp - 8], 0x65
call fcn.1400e8748
mov r10, rax
test rax, rax
je 0x1400e8e90
mov rax, qword [rbp + 0x40]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, r15
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400e966c
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400e90e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, 1
call fcn.1400e8248
mov rbx, rax
test rax, rax
je 0x1400e915c
lea rdx, [rbp - 0x10]
mov word [rbp - 7], 0x7965
mov rcx, rax
mov word [rbp - 0x10], 0x6552
mov word [rbp - 0xd], 0x6c43
mov byte [rbp - 5], 0
mov word [rbp - 0xa], 0x6573
mov byte [rbp - 0xe], 0x67
mov byte [rbp - 0xb], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 8], 0x4b
call fcn.1400e8748
test rax, rax
je 0x1400e9154
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400e966c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e917c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x1f], 0x6f4d7465
xor ebx, ebx
mov dword [rbp - 0x13], 0x656d614e
mov word [rbp - 0xf], 0x41
mov dword [rbp - 0x19], 0x6946656c
mov word [rbp - 0x1b], 0x7564
mov word [rbp - 0x15], 0x656c
mov byte [rbp - 0x20], 0x47
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400e8748
test rax, rax
je 0x1400e91e3
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400e91fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
call fcn.1400e8290
mov rdi, rax
test rax, rax
je 0x1400e9268
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x12], 0x41656d
mov rcx, rax
mov dword [rbp - 0x1d], 0x6e694668
mov dword [rbp - 0x16], 0x614e656c
mov word [rbp - 0x20], 0x6150
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x19], 0x4664
mov byte [rbp - 0x17], 0x69
call fcn.1400e8748
test rax, rax
je 0x1400e9260
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400e966c
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400e9284
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
call fcn.1400e8290
mov rbx, rax
test rax, rax
je 0x1400e92f7
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x6f6d
mov rcx, rax
mov dword [rbp - 0x15], 0x6e657478
mov dword [rbp - 0x1f], 0x52687461
mov dword [rbp - 0xf], 0x416e6f
mov byte [rbp - 0x1b], 0x65
mov word [rbp - 0x11], 0x6973
mov word [rbp - 0x17], 0x4565
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x18], 0x76
call fcn.1400e8748
test rax, rax
je 0x1400e92ef
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400e966c
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x1400e9310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x17], 0x6f725074
mov dword [rbp - 0x20], 0x43746547
mov dword [rbp - 0x13], 0x73736563
mov word [rbp - 0x1c], 0x7275
mov word [rbp - 0x19], 0x6e65
mov byte [rbp - 0x1a], WSACleanup
mov byte [rbp - 0xf], 0
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400e8748
test rax, rax
je 0x1400e9365
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400e94fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x13], 0x747865
mov rsi, rcx
mov dword [rbp - 0x1d], 0x65726854
xor ebx, ebx
mov word [rbp - 0x20], 0x6547
mov dword [rbp - 0x18], 0x6e6f4364
mov byte [rbp - 0x14], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x19], 0x61
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.1400e8748
test rax, rax
je 0x1400e9562
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x1400e9580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
mov word [rbp - 0xc], 0x694c
xor ebx, ebx
mov dword [rbp - 7], 0x417972
mov word [rbp - 9], 0x6172
mov dword [rbp - 0x10], 0x64616f4c
mov byte [rbp - 0xa], 0x62
call fcn.1400e8344
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400e8748
test rax, rax
je 0x1400e95d3
mov rcx, rdi
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e9b6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.1400e8248
mov rdi, rax
test rax, rax
je 0x1400e9bf0
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x6e656b6f
mov rcx, rax
mov word [rbp - 0x18], 0x7365
mov dword [rbp - 0x20], 0x6e65704f
mov byte [rbp - 0x10], bl
mov word [rbp - 0x1b], 0x6f72
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1c], 0x50
mov byte [rbp - 0x19], 0x63
call fcn.1400e8748
test rax, rax
je 0x1400e9be8
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400e966c
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400e9eac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rcx
mov edi, 1
call fcn.1400e8248
mov rbx, rax
test rax, rax
je 0x1400e9f34
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x13], 0x79746972
mov rcx, rax
mov dword [rbp - 0x1d], 0x4b746547
mov dword [rbp - 0x17], 0x75636553
mov word [rbp - 0x19], 0x7965
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0xf], 0
mov byte [rbp - 0x1e], 0x67
call fcn.1400e8748
test rax, rax
je 0x1400e9f2c
mov r9, rsi
lea edx, [rdi + 3]
mov r8, r14
mov rcx, r15
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400e966c
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400ea008
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.1400e8248
mov rdi, rax
test rax, rax
je 0x1400ea094
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x10], 0x69536f54
mov rcx, rax
mov dword [rbp - 0x1e], 0x7265766e
mov word [rbp - 0xb], 0x41
mov word [rbp - 0x20], 0x6f43
mov dword [rbp - 0x15], 0x6953676e
mov word [rbp - 0x17], 0x6972
mov word [rbp - 0x1a], 0x5374
mov byte [rbp - 0x18], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x11], 0x64
mov byte [rbp - 0xc], 0x64
call fcn.1400e8748
test rax, rax
je 0x1400ea08c
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400e966c
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ea0b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, r9
mov r14, r8
mov r15, rdx
xor ebx, ebx
call fcn.1400e8248
mov rdi, rax
test rax, rax
je 0x1400ea15a
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x6e756f63
mov rcx, rax
mov dword [rbp - 0x13], 0x41646953
mov dword [rbp - 0x1e], 0x70756b6f
mov byte [rbp - 0xf], bl
mov word [rbp - 0x20], 0x6f4c
mov word [rbp - 0x1a], 0x6341
mov byte [rbp - 0x14], reloc.WS2_32.dll_WSACleanup
call fcn.1400e8748
mov r10, rax
test rax, rax
je 0x1400ea152
mov rax, qword [rbp + 0x50]
mov r9, rsi
mov qword [rsp + 0x30], rax
mov r8, r14
mov rax, qword [rbp + 0x48]
mov rdx, r15
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400e966c
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400ea17c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edi, r9d
mov esi, r8d
mov r14, rdx
mov r15, rcx
call fcn.1400e8248
mov rbx, rax
test rax, rax
je 0x1400ea218
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xd], 0x68746957
mov rcx, rax
mov dword [rbp - 0x1f], 0x646c6975
mov dword [rbp - 0x16], 0x41746963
mov dword [rbp - 7], 0x41656d
mov dword [rbp - 0x12], 0x73656363
mov byte [rbp - 0x20], 0x42
mov dword [rbp - 0x1b], 0x6c707845
mov word [rbp - 9], 0x614e
mov byte [rbp - 0x17], 0x69
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSAStartup
call fcn.1400e8748
test rax, rax
je 0x1400ea210
and dword [rsp + 0x20], 0
mov r9d, edi
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rcx, rbx
call fcn.1400e966c
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400ea2e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400e8248
mov rdi, rax
test rax, rax
je 0x1400ea378
lea rdx, [rbp - 0x20]
mov dword [rbp - 7], 0x726f74
mov rcx, rax
mov dword [rbp - 0x20], 0x74696e49
mov word [rbp - 0x1b], 0x6c61
mov dword [rbp - 0x18], 0x6553657a
mov word [rbp - 0xe], 0x6544
mov word [rbp - 0x11], 0x7469
mov word [rbp - 0x14], 0x7563
mov dword [rbp - 0xb], 0x70697263
mov byte [rbp - 0x12], WSACleanup
mov byte [rbp - 0xf], 0x79
mov byte [rbp - 0xc], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x19], 0x69
mov byte [rbp - 0x1c], 0x69
call fcn.1400e8748
test rax, rax
je 0x1400ea370
lea edx, [rbx + 1]
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400e966c
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ea398
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.1400e8248
mov rdi, rax
test rax, rax
je 0x1400ea422
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x72756365
mov rcx, rax
mov dword [rbp - 0x18], 0x44797469
mov dword [rbp - 0xb], 0x6c636144
mov dword [rbp - 0x14], 0x72637365
mov dword [rbp - 0x10], 0x6f747069
mov dword [rbp - 0x20], 0x53746553
mov byte [rbp - 7], bl
mov byte [rbp - 0xc], WSACleanup
call fcn.1400e8748
test rax, rax
je 0x1400ea41a
xor r9d, r9d
lea edx, [rbx + 1]
mov r8, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400e966c
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400ea444
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
mov edi, 1
call fcn.1400e8248
mov rbx, rax
test rax, rax
je 0x1400ea4d2
lea rdx, [rbp - 0x20]
mov word [rbp - 0x14], 0x7275
mov rcx, rax
mov word [rbp - 0x1f], 0x6765
mov dword [rbp - 0x1a], 0x5379654b
mov word [rbp - 0x11], 0x7974
mov word [rbp - 0x1c], 0x7465
mov word [rbp - 0x16], 0x6365
mov byte [rbp - 0x1d], 0x53
mov byte [rbp - 0x12], 0x69
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0xf], 0
call fcn.1400e8748
test rax, rax
je 0x1400ea4ca
mov r8, rsi
lea edx, [rdi + 3]
mov rcx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400e966c
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret