joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000be98
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rcx], 0
mov rax, r8
and qword [rcx + 8], 0
mov rdi, rdx
mov rdx, rax
mov dword [rcx + 0x50], 0x6a09e667
mov r8, r9
mov dword [rcx + 0x54], 0xbb67ae85
mov rbx, rcx
mov dword [rcx + 0x58], 0x3c6ef372
mov dword [rcx + 0x5c], 0xa54ff53a
mov dword [rcx + 0x60], 0x510e527f
mov dword [rcx + 0x64], 0x9b05688c
mov dword [rcx + 0x68], 0x1f83d9ab
mov dword [rcx + 0x6c], 0x5be0cd19
call fcn.1400baa94
mov rdx, rdi
mov rcx, rbx
call fcn.14000bf10
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x14000bf10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
lea rsi, [rcx + 0x50]
mov word [rbp - 0x39], 0x3130
movups xmm0, xmmword [rsi]
mov rdi, rdx
mov rbx, rcx
movups xmm1, xmmword [rsi + 0x10]
mov word [rbp - 0x2a], 0x66
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp - 0x36], 0x36353433
movups xmmword [rbp + 0x47], xmm1
mov dword [rbp - 0x2f], 0x64636261
mov byte [rbp - 0x2b], 0x65
mov word [rbp - 0x32], 0x3837
mov byte [rbp - 0x37], 0x32
mov byte [rbp - 0x30], 0x39
call fcn.1400bab68
xor ecx, ecx
lea r8, [rbp + 0x37]
sub r8, rbx
lea r9d, [rcx + 8]
lea r10d, [rcx + 0xf]
mov edx, dword [rsi]
lea rcx, [rcx + 8]
mov eax, edx
shr rax, 0x1c
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x21], al
mov eax, edx
shr rax, 0x18
and rax, r10
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x20], al
mov eax, edx
shr rax, 0x14
and rax, r10
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1f], al
mov eax, edx
shr rax, 0x10
and rax, r10
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1e], al
mov eax, edx
shr rax, 0xc
and rax, r10
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1d], al
mov eax, edx
shr rax, 8
and rax, r10
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1c], al
mov eax, edx
shr rax, 4
and rdx, r10
and rax, r10
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1b], al
mov al, byte [rbp + rdx - 0x39]
mov byte [rbp + rcx - 0x1a], al
mov eax, dword [r8 + rsi - 0x50]
mov dword [rsi], eax
lea rsi, [rsi + 4]
sub r9, 1
jne 0x14000bf86
and qword [rdi], r9
lea rax, [rbp - 0x19]
and qword [rdi + 0x10], r9
mov qword [rdi + 0x18], r10
or rbx, 0xffffffffffffffff
mov byte [rbp + rcx - 0x19], r9b
mov byte [rdi], r9b
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000c03b
mov rcx, rdi
cmp rbx, r10
ja 0x14000c062
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rbp - 0x19]
call fcn.14007f340
mov byte [rbx + rdi], 0
jmp 0x14000c071
lea r9, [rbp - 0x19]
xor r8d, r8d
mov rdx, rbx
call fcn.140010f4c
lea r11, [rsp + 0xb0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000dde0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rcx, [rbp - 0x10]
mov word [rbp - 0xa], 0x642e
mov word [rbp - 0xd], 0x3372
mov word [rbp - 0x10], 0x7355
mov word [rbp - 7], WSASetLastError
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 0xb], 0x32
mov byte [rbp - 8], WSAGetLastError
call fcn.1400bb43c
add rsp, 0x30
pop rbp
ret

Function at 0x14000de1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xb], 0x2e323369
mov dword [rbp - 7], 0x6c6c64
mov word [rbp - 0x10], 0x7457
mov word [rbp - 0xd], 0x7061
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSAStartup
call fcn.1400bb43c
add rsp, 0x30
pop rbp
ret

Function at 0x14000de54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12d, ecx
mov edi, 1
call fcn.14000dd68
mov rbx, rax
test rax, rax
je 0x14000deff
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x72657551
mov rcx, rax
mov word [rbp - 0x1d], 0x636f
mov dword [rbp - 0x14], 0x676e6972
mov word [rbp - 0x20], 0x7341
mov word [rbp - 0x16], 0x7453
mov word [rbp - 0x10], 0x41
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x17], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000def7
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r14
mov rax, qword [rbp + 0x40]
mov edx, r15d
mov ecx, r12d
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000df20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000df97
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x72655365
mov rcx, rax
mov dword [rbp - 0x13], 0x6c646e61
mov dword [rbp - 0x17], 0x48656369
mov word [rbp - 0x1f], 0x6f6c
mov word [rbp - 0xf], 0x65
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x18], 0x76
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000df8f
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x14000dfb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, 0x80004005
call fcn.1400bad8c
mov rbx, rax
test rax, rax
je 0x14000e022
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xf], 0x6572436f
mov rcx, rax
mov word [rbp - 8], 0x7547
mov word [rbp - 5], 0x64
mov word [rbp - 0xa], 0x6574
mov byte [rbp - 0xb], 0x61
mov byte [rbp - 0x10], 0x43
mov byte [rbp - 6], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e01a
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x14000e03c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
call fcn.1400bad8c
mov rbx, rax
test rax, rax
je 0x14000e09f
lea rdx, [rbp - 0x10]
mov word [rbp - 8], 0x466d
mov rcx, rax
mov dword [rbp - 0x10], 0x61546f43
mov dword [rbp - 6], 0x656572
mov word [rbp - 0xb], 0x4d6b
mov byte [rbp - 9], 0x65
mov byte [rbp - 0xc], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e097
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x14000e0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000e138
lea rdx, [rbp - 0x20]
mov word [rbp - 0xf], 0x536f
mov rcx, rax
mov dword [rbp - 0x14], 0x64695367
mov dword [rbp - 0x18], 0x6e697274
mov dword [rbp - 0xd], 0x416469
mov dword [rbp - 0x1c], 0x53747265
mov word [rbp - 0x1f], 0x6e6f
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e130
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x14000e154
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, rcx
mov word [rbp - 0x27], 0x6c6c
xor ebx, ebx
mov dword [rbp - 0x30], 0x72657355
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
mov esi, r8d
mov dword [rbp - 0x2c], 0x2e766e65
mov r14, rdx
mov byte [rbp - 0x28], 0x64
call fcn.1400bb43c
mov rdi, rax
test rax, rax
je 0x14000e205
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1e], 0x65746165
mov rcx, rax
mov dword [rbp - 0x10], 0x6f6c4274
mov word [rbp - 0x15], 0x6e6f
mov word [rbp - 0x12], 0x6e65
mov word [rbp - 0xc], 0x6b63
mov byte [rbp - 0x13], WSASetLastError
mov dword [rbp - 0x19], 0x7269766e
mov word [rbp - 0x20], 0x7243
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0xa], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e1fd
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000e224
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, r9
mov word [rbp - 0x10], 0x7243
mov rsi, r8
mov word [rbp - 6], 0x7365
mov r14, rdx
mov dword [rbp - 0xd], 0x50657461
mov r15, rcx
mov word [rbp - 9], 0x6f72
xor ebx, ebx
mov word [rbp - 3], 0x41
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 4], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 7], 0x63
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000e2d5
mov rax, qword [rbp + 0x68]
mov r9, rdi
mov qword [rsp + 0x48], rax
mov r8, rsi
mov rax, qword [rbp + 0x60]
mov rdx, r14
mov qword [rsp + 0x40], rax
mov rcx, r15
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x48]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000e2f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000e3cc
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x74616572
mov rcx, rax
mov dword [rbp - 0x14], 0x55734173
mov dword [rbp - 0x19], 0x65636f72
mov dword [rbp - 0xf], 0x417265
mov byte [rbp - 0x20], 0x43
mov word [rbp - 0x1b], 0x5065
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000e3c4
mov rax, qword [rbp + 0x70]
mov r9, rsi
mov qword [rsp + 0x50], rax
mov r8, r14
mov rax, qword [rbp + 0x68]
mov rdx, r15
mov qword [rsp + 0x48], rax
mov rcx, r12
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x50]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x48]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000e3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov word [rbp - 0x11], 0x5332
mov esi, ecx
mov dword [rbp - 0xb], 0x746f68
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x20], 0x61657243
mov dword [rbp - 0x1c], 0x6f546574
mov dword [rbp - 0x16], 0x706c6568
mov word [rbp - 0x18], 0x6c6f
mov dword [rbp - 0xf], 0x7370616e
mov byte [rbp - 0x12], 0x33
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e462
mov edx, edi
mov ecx, esi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x14000e47c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000e51b
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x1f], 0x696c7075
mov dword [rbp - 0x1b], 0x65746163
mov word [rbp - 0x11], 0x78
mov byte [rbp - 0x17], 0x54
mov byte [rbp - 0x12], 0x45
mov byte [rbp - 0x20], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000e513
mov rax, qword [rbp + 0x48]
mov r9d, esi
mov qword [rsp + 0x28], rax
mov r8, r14
mov eax, dword [rbp + 0x40]
mov edx, r15d
mov rcx, r12
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000e53c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov dword [rbp - 0x16], 0x6d756c6f
mov rsi, rcx
mov word [rbp - 0x1d], 0x4664
or rbx, 0xffffffffffffffff
mov word [rbp - 0x20], 0x6946
mov dword [rbp - 0x1b], 0x74737269
mov word [rbp - 0x12], 0x5765
mov byte [rbp - 0x1e], WSASetLastError
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x17], 0x56
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e5a9
mov edx, edi
mov rcx, rsi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x14000e628
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov word [rbp - 0xa], 0x7261
mov rsi, rcx
mov dword [rbp - 7], 0x65707954
xor ebx, ebx
mov word [rbp - 3], 0x41
mov word [rbp - 0xd], 0x6942
mov word [rbp - 0x10], 0x6547
mov byte [rbp - 0xb], WSASetLastError
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 8], 0x79
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e693
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x14000e6ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x1a], 0x746e6572
mov dword [rbp - 0x1f], 0x75437465
mov dword [rbp - 0x12], 0x737365
mov dword [rbp - 0x16], 0x636f7250
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x1b], WSAStartup
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e6fd
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000e70c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 0x10], 0x46746547
mov rsi, rcx
mov word [rbp - 6], 0x65
or ebx, 0xffffffff
mov word [rbp - 0xc], 0x6c69
mov word [rbp - 9], 0x6953
mov byte [rbp - 0xa], 0x65
mov byte [rbp - 7], 0x7a
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e76e
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x14000e788
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14d, r8d
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1400badf8
mov rdi, rax
test rax, rax
je 0x14000e818
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x69467465
mov rcx, rax
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0x10], 0x416f66
mov dword [rbp - 0x15], 0x496e6f69
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x11], WSASetLastError
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e810
mov r9, rsi
mov r8d, r14d
mov edx, r15d
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14000e838
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.1400badf8
mov rdi, rax
test rax, rax
je 0x14000e8c4
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e6f6973
mov rcx, rax
mov word [rbp - 0xa], 0x41
mov dword [rbp - 0x1f], 0x69467465
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0xf], 0x7a69536f
mov word [rbp - 0x11], 0x666e
mov byte [rbp - 0x12], 0x49
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0xb], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e8bc
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x14000e8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x4c746547
mov byte [rbp - 4], bl
mov dword [rbp - 0xb], 0x72457473
mov word [rbp - 6], 0x726f
mov byte [rbp - 7], WSAStartup
mov byte [rbp - 0xc], 0x61
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e929
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x14000e938
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000e9e0
lea rdx, [rbp - 0x20]
mov word [rbp - 0x11], 0x6972
mov rcx, rax
mov dword [rbp - 0xb], 0x6c636144
mov dword [rbp - 0x16], 0x73654479
mov word [rbp - 0xe], 0x6f74
mov dword [rbp - 0x1d], 0x75636553
mov byte [rbp - 0x12], 0x63
mov byte [rbp - 7], bl
mov word [rbp - 0x19], 0x6972
mov byte [rbp - 0xf], reloc.WS2_32.dll_WSASetLastError
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0xc], WSAStartup
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e9d8
mov r9, rsi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14000ea00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
mov word [rbp - 0x19], 0x6d65
mov word [rbp - 0x16], 0x6d69
mov dword [rbp - 0xe], 0x6d695465
mov word [rbp - 0xa], 0x65
mov word [rbp - 0x1b], 0x7473
mov dword [rbp - 0x20], 0x53746547
mov dword [rbp - 0x13], 0x69467341
mov byte [rbp - 0x14], 0x65
mov byte [rbp - 0x17], 0x54
mov byte [rbp - 0x1c], 0x79
mov byte [rbp - 0xf], WSAGetLastError
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ea69
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ea74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x1e], 0x72685474
mov rsi, rcx
mov word [rbp - 0x20], 0x6547
xor ebx, ebx
mov dword [rbp - 0x17], 0x746e6f43
mov dword [rbp - 0x13], 0x747865
mov word [rbp - 0x19], 0x6461
mov byte [rbp - 0x1a], 0x65
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ead9
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x14000eb98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000ec37
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x11], 0x6e6f6974
mov word [rbp - 0x16], 0x6f66
mov dword [rbp - 0x20], 0x54746547
mov byte [rbp - 0xd], bl
mov word [rbp - 0x13], 0x616d
mov word [rbp - 0x18], 0x6e49
mov byte [rbp - 0x14], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000ec2f
mov rax, qword [rbp + 0x40]
mov r9d, esi
mov r8, r14
mov qword [rsp + 0x20], rax
mov edx, r15d
mov rcx, r12
call r10
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret