joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066660
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12, r9
xor edi, edi
and qword [r9], rdi
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
jne 0x14006679f
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14006678c
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400666b8
call fcn.140093e00
lea r14, [rax + 1]
jmp 0x1400666bb
xor r14d, r14d
cmp dword [rbx + 4], 2
jne 0x140066754
cmp qword [rbx + 0x20], 0
je 0x140066754
cmp qword [rbx + 0x10], 0x10
jb 0x140066754
lea rcx, [r14 + 0x40]
call qword [str.hM_t_]
mov rsi, rax
test rax, rax
je 0x140066762
mov ecx, dword [rbx]
mov r8d, reloc.WS2_32.dll_recv
mov dword [rax], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 0xc]
and qword [rax + 0x18], 0
and qword [rax + 0x28], 0
mov dword [rax + 0xc], ecx
lea rcx, [rax + 0x30]
mov qword [rax + 0x20], rcx
mov dword [rax + 0x10], r8d
mov rdx, qword [rbx + 0x20]
call fcn.140089fc0
test r14, r14
je 0x140066741
mov rcx, qword [rsi + 0x20]
mov r8, r14
add rcx, 0x10
mov qword [rsi + 0x18], rcx
mov rdx, qword [rbx + 0x18]
call fcn.140089fc0
test rdi, rdi
cmove rdi, rsi
test r15, r15
je 0x140066751
mov qword [r15 + 0x28], rsi
mov r15, rsi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x140066767
jmp 0x1400666a4
mov ebp, 8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140066777
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x140066787
mov rcx, rdi
call fcn.14006663c
xor edi, edi
jmp 0x140066799
test rdi, rdi
jne 0x140066799
mov ebp, 0x2af9
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov qword [r12], rdi
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x1400675a4
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x28], 0
lea r8, [0x1400502a0]
and dword [rsp + 0x20], 0
mov r9, rdx
xor edx, edx
xor ecx, ecx
call fcn.14009ed20
mov rcx, rax
test rax, rax
je 0x1400675dd
call fcn.14006759c
cmp rcx, rax
je 0x1400675dd
mov rax, rcx
jmp 0x1400675df
xor eax, eax
add rsp, 0x38
ret
Function at 0x14006968c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov rbp, r8
mov rcx, rdx
mov r12, rdx
xor esi, esi
xor edi, edi
call fcn.1400a6818
mov r14, rax
test rax, rax
jne 0x140069705
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.14006246c
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov r9, rax
mov rcx, rbp
call fcn.14004675c
mov ebx, 0x4d
jmp 0x140069840
and qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140069753
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.14006246c
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
jmp 0x1400696ed
lea rdx, [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140069796
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.14006246c
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov r9, rax
mov rcx, rbp
call fcn.14004675c
mov ebx, 0x4d
jmp 0x140069837
mov rbx, qword [rsp + 0x48]
mov eax, 0x100000
cmp rbx, rax
jle 0x1400697b9
mov r8d, eax
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, rbp
call fcn.14004675c
jmp 0x14006978c
lea rcx, [rbx + 1]
call qword [str.hM_t_]
mov rsi, rax
test rax, rax
jne 0x1400697d0
lea ebx, [rax + 0x1b]
jmp 0x140069837
test rbx, rbx
je 0x140069819
and dword [rsp + 0x40], 0
lea rdx, [rsi + rdi]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov r13d, edi
sub r8d, edi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140069883
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x140069810
mov ebx, r13d
jmp 0x140069812
add edi, eax
mov eax, edi
cmp rax, rbx
jb 0x1400697d5
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rbx
mov byte [rbx + rsi], 0
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call fcn.140069498
mov ebx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [fcn.140093ea8]
test r14, r14
je 0x140069856
mov rcx, r14
call fcn.140093ea8
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140089130
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.14006246c
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
jmp 0x14006977e
Function at 0x14006ddd0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov ecx, 0x58
mov ebp, r8d
mov r14, rdx
call qword [str.hM_t_]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x14006def0
lea rax, fcn.14006dc80
mov edi, 0x40
mov qword [rbx], rax
lea rcx, [rbx + 0x18]
mov qword [rbx + 8], rcx
lea rax, [rcx + 0x10]
mov qword [rbx + 0x10], rax
cmp ebp, edi
jbe 0x14006de5a
call fcn.14006dc80
mov rcx, qword [rbx + 8]
mov r8d, ebp
mov rdx, r14
call fcn.14006dccc
mov r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
add r14, 0x10
mov rcx, r14
call fcn.14006dcdc
mov rcx, qword [rbx + 8]
mov ebp, 0x20
call fcn.14006dc80
mov rcx, qword [rbx + 0x10]
call fcn.14006dc80
test rbp, rbp
je 0x14006deb8
mov rsi, rbp
mov al, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call fcn.14006dccc
mov al, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
mov r8d, 1
mov byte [rsp + 0x40], al
inc r14
mov rcx, qword [rbx + 0x10]
call fcn.14006dccc
sub rbp, 1
jne 0x14006de70
cmp rsi, rdi
jae 0x14006deed
sub rdi, rsi
mov rcx, qword [rbx + 8]
lea rdx, [0x1400d1bf3]
mov r8d, 1
call fcn.14006dccc
mov rcx, qword [rbx + 0x10]
lea rdx, str.6_nil_
mov r8d, 1
call fcn.14006dccc
sub rdi, 1
jne 0x14006debb
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14006e11c
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 0x5c
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.14008a770
mov rax, qword [rsp + 0x30]
mov dword [rax], 0x67452301
mov rax, qword [rsp + 0x30]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rsp + 0x30]
mov dword [rax + 0xc], 0x10325476
mov eax, 1
add rsp, 0x28
ret
Function at 0x140073ca0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x140073cdd
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140073ce4
mov al, 1
jmp 0x140073e2b
call fcn.140075a9c
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + 0x18]
mov dword [rsp + 0x38], eax
call fcn.140075a9c
mov dword [rsp + 0x3c], eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x3c]
call fcn.140075ac8
movzx eax, al
test eax, eax
je 0x140073d35
xor al, al
jmp 0x140073e2b
mov qword [rsp + 0x58], 0x20
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call fcn.140077844
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140073d9a
cmp dword [rsp + 0x30], 1
je 0x140073da6
cmp dword [rsp + 0x30], 3
je 0x140073e19
jmp 0x140073e29
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x140073df1
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.14009098c
cmp qword [rsp + 0x40], rax
je 0x140073df1
xor al, al
jmp 0x140073e2b
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140073e0b
mov dword [rsp + 0x34], 1
jmp 0x140073e13
mov dword [rsp + 0x34], 0
mov al, byte [rsp + 0x34]
jmp 0x140073e2b
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140073e2b
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140089130
add rsp, 0x98
ret
Function at 0x1400766f0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
call fcn.140075a9c
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x50]
call fcn.140075ac8
movzx eax, al
test eax, eax
je 0x140076746
lea rcx, [rsp + 0xc8]
call fcn.1400763dc
jmp 0x140076982
mov rcx, qword [rsp + 0xc0]
call fcn.140076b78
test rax, rax
je 0x1400767b1
mov rcx, qword [rsp + 0xc0]
call fcn.140076b78
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xc0]
call fcn.140075aa4
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x1400767b1
lea rcx, [rsp + 0xc8]
call fcn.14007739c
mov byte [rsp + 0x42], al
mov rcx, qword [rsp + 0xc0]
call fcn.140074ca0
mov cl, byte [rsp + 0x42]
mov byte [rax], cl
mov eax, dword [rsp + 0xc8]
jmp 0x140076982
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x80], 0
jne 0x1400767cd
call fcn.140075a9c
jmp 0x140076982
mov rcx, qword [rsp + 0xc0]
call fcn.140074cf8
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x68], 0
jne 0x140076832
lea rcx, [rsp + 0xc8]
call fcn.14007739c
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rcx + 0x80]
mov cl, al
call fcn.1400705c4
movzx eax, al
test eax, eax
je 0x140076820
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x48], eax
jmp 0x140076829
call fcn.140075a9c
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
jmp 0x140076982
mov qword [rsp + 0x78], 0x20
lea rcx, [rsp + 0xc8]
call fcn.14007739c
mov byte [rsp + 0x40], al
lea rax, [rsp + 0xa0]
lea rcx, [rsp + 0x41]
mov rdx, qword [rsp + 0xc0]
add rdx, 0x74
lea r8, [rsp + 0x68]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rcx
lea r8, [rsp + 0x40]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x68]
call fcn.140076684
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400768c6
cmp dword [rsp + 0x44], 1
je 0x1400768c6
cmp dword [rsp + 0x44], 3
je 0x140076942
jmp 0x14007697d
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14007691a
mov rax, qword [rsp + 0xc0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x58]
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.14009098c
cmp qword [rsp + 0x58], rax
je 0x14007691a
call fcn.140075a9c
jmp 0x140076982
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 1
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x70], rax
je 0x14007693b
mov eax, dword [rsp + 0xc8]
jmp 0x140076982
call fcn.140075a9c
jmp 0x140076982
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + 0x80]
mov cl, byte [rsp + 0x40]
call fcn.1400705c4
movzx eax, al
test eax, eax
je 0x14007696e
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x4c], eax
jmp 0x140076977
call fcn.140075a9c
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
jmp 0x140076982
call fcn.140075a9c
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140089130
add rsp, 0xb8
ret
Function at 0x140077a40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x70], 0
jg 0x140077a62
xor eax, eax
jmp 0x140077c05
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x68], 0
je 0x140077a87
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.140077c0c
jmp 0x140077c05
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x60]
call fcn.14007423c
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x140077b1d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140070e28
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x60]
call fcn.140075db4
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400756d4
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.140075cb8
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x80], 0
je 0x140077bf5
mov rcx, qword [rsp + 0x60]
call fcn.140074cf8
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x140077bbd
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x68]
call fcn.140090424
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x140077bbb
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x140077c05
jmp 0x140077b43
cmp qword [rsp + 0x20], 0
jbe 0x140077bf5
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x68]
call fcn.140090424
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x58
ret
Function at 0x14007cdd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0x16
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x17
jae 0x14007ce40
jmp 0x14007ce45
call fcn.140088f10
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x30], 0x4d
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], 0x62
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], 0x43
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], 0x47
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], 0x5c
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x30], 0x78
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x30], 0x75
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], 0x49
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x30], WSACleanup
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.14007b22c
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140089130
add rsp, 0x58
ret
Function at 0x14007cf7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], 0x46
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], 0x5c
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x30], 0x78
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], 0x46
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], 0x49
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x30], 0x4d
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], 0x47
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x30], 0x75
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], 0x62
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0x17
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x18
jae 0x14007d0cc
jmp 0x14007d0d1
call fcn.140088f10
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x30], WSACleanup
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.14007b22c
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140089130
add rsp, 0x58
ret
Function at 0x14007d3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], 0x49
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], 0x45
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], 0x47
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x30], 0x4d
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], 0x5c
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x30], WSACleanup
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], 0x49
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x30], 0x75
mov eax, 1
imul rax, rax, 0x17
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x18
jae 0x14007d4e4
jmp 0x14007d4e9
call fcn.140088f10
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x30], 0x78
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], 0x62
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.14007b22c
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140089130
add rsp, 0x58
ret
Function at 0x14007d584
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], 0x63
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSASetLastError
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], 0x2e
mov eax, 1
imul rax, rax, 0xa
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xb
jae 0x14007d63a
jmp 0x14007d63f
call fcn.140088f10
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAGetLastError
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.14007b22c
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140089130
add rsp, 0x58
ret