joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11174
Capabilities:
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor edi, edi
cmp byte [0x0001a840], dil
jne 0x112ec
mov byte [0x0001a840], 1
mov dword [rsp + 0x30], edi
lea rdx, [0x00015fa0]
lea rcx, [0x0001a6e8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00015fc0]
lea rcx, [0x0001a700]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00015fe0]
lea rcx, [0x0001a718]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00016000]
lea rcx, [0x0001a730]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00016030]
lea rcx, [0x0001a748]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00016070]
lea rcx, [0x0001a760]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call fcn.00013ba0
call fcn.000153b8
xor edx, edx
mov r8d, 0x1af40
lea rsi, [0x0001a930]
mov rcx, rsi
call fcn.00015d50
mov r11d, edi
mov dword [rsp + 0x30], edi
cmp r11d, 0x64
jae 0x1125f
mov eax, r11d
imul rax, rax, 0x450
mov dword [rax + rsi + 4], r11d
inc r11d
mov dword [rsp + 0x30], r11d
jmp 0x11240
xor edx, edx
lea rcx, [0x000150e8]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine]
mov byte [0x0001a86b], 1
lea rdx, [0x00015f50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov qword [rsp + 0x28], rdi
lea rax, [0x000369b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [0x00014234]
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallbackEx]
movzx ecx, byte [0x0001a86b]
cmp eax, edi
cmovl ecx, edi
mov byte [0x0001a86b], cl
mov rcx, qword [0x00035998]
cmp rcx, rdi
je 0x112ea
call sub.FLTMGR.SYS_FltStartFiltering
cmp eax, edi
jge 0x112ea
mov rcx, qword [0x00035998]
call sub.FLTMGR.SYS_FltUnregisterFilter
mov byte [0x0001a86b], dil
jmp 0x112ec
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14f78
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x38], rsp
mov r8, rdx
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov rax, cr8
test al, al
je 0x14fa9
mov eax, 0xc0000229
jmp 0x150d4
lea rdx, [rsp + 0x78]
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14fcf
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.00014f10
mov rbx, qword [rsp + 0x30]
test eax, eax
jns 0x14fdd
mov eax, 0xc0000229
jmp 0x150d4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea r12d, [r9 + 0x1b]
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov dword [rsp + 0x78], eax
cmp eax, 0xc0000004
je 0x15024
lea rdx, [0x0001501b]
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe__local_unwind
nop
nop
mov eax, dword [rsp + 0x78]
jmp 0x150d4
mov edx, dword [rsp + 0x70]
lea rcx, [rdx - 0x10]
mov dword [rsp + 0x78], ecx
movzx eax, word [rdi + 2]
cmp eax, ecx
jae 0x15055
mov word [rdi], cx
lea rdx, [0x0001504e]
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe__local_unwind
nop
nop
mov eax, 0x80000005
jmp 0x150d4
mov ecx, 1
mov r8d, 0x69706744
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x15088
lea rdx, [0x00015081]
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe__local_unwind
nop
nop
mov eax, 0xc000009a
jmp 0x150d4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x70]
mov r8, rsi
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov r12d, eax
test eax, eax
js 0x150b9
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov edx, 0x69706744
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
nop
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, r12d
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x39008
Capabilities:
Create device object

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
mov qword [rax + 0x18], rsi
call qword [sym.imp.ntoskrnl.exe_KeQueryTimeIncrement]
mov dword [0x0001a774], eax
call fcn.000149e8
mov word [rsp + 0x30], si
lea rcx, [0x0001a7c0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x34365453
mov qword [rsp + 0x20], 0x10010
call qword [sym.imp.ntoskrnl.exe_ExInitializePagedLookasideList]
lea rdx, [0x00039290]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x80]
lea r9d, [rsi + 0x22]
mov qword [rsp + 0x30], r11
lea r8, [rsp + 0x40]
mov edx, 0x4c0
mov rcx, rdi
mov byte [rsp + 0x28], sil
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, esi
jl 0x391f4
lea rdx, [0x000392c0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, esi
mov ebx, eax
jge 0x390e5
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
jmp 0x391f4
mov rax, qword [rsp + 0x80]
lea rcx, [0x0001a8b0]
xor edx, edx
mov qword [0x0001a860], rax
mov rax, qword [rax + 0x40]
mov qword [rax], rdi
lea rax, [0x00038090]
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x80], rax
lea rax, [0x000380d8]
mov qword [rdi + 0xe0], rax
lea rax, [0x00038068]
mov qword [rdi + 0x100], rax
lea rax, [0x00038a70]
mov qword [rdi + 0x68], rax
mov rax, qword [rsp + 0x80]
or dword [rax + 0x30], 4
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
lea rcx, [0x0001a8e8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
lea rcx, [0x00035870]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
movabs rax, 0xfffff78000000008
lea rcx, [0x00035920]
mov rax, qword [rax]
xor edx, edx
mov qword [0x0001a920], rax
mov rax, qword [0x0001a860]
mov rbx, qword [rax + 0x40]
add rbx, 0x28
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
mov rax, qword [0x0001a860]
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov rbx, qword [rax + 0x40]
lea rcx, [0x00035960]
xor edx, edx
add rbx, 0x58
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
lea r8, [0x00035998]
lea rdx, [0x00018790]
mov rcx, rdi
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov dword [0x0001a86c], esi
call sub.FLTMGR.SYS_FltRegisterFilter
mov rcx, qword [rsp + 0x80]
btr dword [rcx + 0x30], 7
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0003920c
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x39008
Function at 0x39268
Capabilities:
Create device object
Register minifilter driver

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
mov qword [rax + 0x18], rsi
call qword [sym.imp.ntoskrnl.exe_KeQueryTimeIncrement]
mov dword [0x0001a774], eax
call fcn.000149e8
mov word [rsp + 0x30], si
lea rcx, [0x0001a7c0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x34365453
mov qword [rsp + 0x20], 0x10010
call qword [sym.imp.ntoskrnl.exe_ExInitializePagedLookasideList]
lea rdx, [0x00039290]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x80]
lea r9d, [rsi + 0x22]
mov qword [rsp + 0x30], r11
lea r8, [rsp + 0x40]
mov edx, 0x4c0
mov rcx, rdi
mov byte [rsp + 0x28], sil
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, esi
jl 0x391f4
lea rdx, [0x000392c0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, esi
mov ebx, eax
jge 0x390e5
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
jmp 0x391f4
mov rax, qword [rsp + 0x80]
lea rcx, [0x0001a8b0]
xor edx, edx
mov qword [0x0001a860], rax
mov rax, qword [rax + 0x40]
mov qword [rax], rdi
lea rax, [0x00038090]
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x80], rax
lea rax, [0x000380d8]
mov qword [rdi + 0xe0], rax
lea rax, [0x00038068]
mov qword [rdi + 0x100], rax
lea rax, [0x00038a70]
mov qword [rdi + 0x68], rax
mov rax, qword [rsp + 0x80]
or dword [rax + 0x30], 4
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
lea rcx, [0x0001a8e8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
lea rcx, [0x00035870]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
movabs rax, 0xfffff78000000008
lea rcx, [0x00035920]
mov rax, qword [rax]
xor edx, edx
mov qword [0x0001a920], rax
mov rax, qword [0x0001a860]
mov rbx, qword [rax + 0x40]
add rbx, 0x28
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
mov rax, qword [0x0001a860]
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov rbx, qword [rax + 0x40]
lea rcx, [0x00035960]
xor edx, edx
add rbx, 0x58
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
lea r8, [0x00035998]
lea rdx, [0x00018790]
mov rcx, rdi
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov dword [0x0001a86c], esi
call sub.FLTMGR.SYS_FltRegisterFilter
mov rcx, qword [rsp + 0x80]
btr dword [rcx + 0x30], 7
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0003920c
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x39008
Function at 0x1400050e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1402779a0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 1
call fcn.140004e44
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140005289
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x50], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x50], 0x61
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x50], 0x49
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x50], reloc.WSOCK32.dll_WSAStartup
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x50], 0x61
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x50], 0x43
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x50], WSAGetLastError
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x50], reloc.WSOCK32.dll_WSACleanup
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x50], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x50], 0x43
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x50], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x50], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x50], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x50], reloc.WSOCK32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0x10
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0x11
jae 0x140005201
jmp 0x140005206
call fcn.1401acfd4
mov rax, qword [rsp + 0x40]
mov byte [rsp + rax + 0x50], 0
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x50], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x50], WSAGetLastError
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000527e
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401ad280
add rsp, 0x78
ret
Function at 0x1400052a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1402779a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 1
call fcn.140004e44
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400053da
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 0xc
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xd
jae 0x1400052fc
jmp 0x140005301
call fcn.1401acfd4
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x7a
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSACleanup
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x49
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSACancelAsyncRequest
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], WSAAsyncGetHostByAddr
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400053cf
mov rcx, qword [rsp + 0x70]
call qword [rsp + gethostname]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ad280
add rsp, 0x68
ret
Function at 0x1400053f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1402779a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140004e44
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140005530
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x43
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x7a
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], reloc.WSOCK32.dll_WSACleanup
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x55
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 0xe
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xf
jae 0x1400054bd
jmp 0x1400054c2
call fcn.1401acfd4
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], reloc.WSOCK32.dll_WSACancelAsyncRequest
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140005525
call qword [rsp + gethostbyaddr]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401ad280
add rsp, 0x58
ret
Function at 0x140005544
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1402779a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], 0
call fcn.140004f48
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14000567c
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 0xb
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xc
jae 0x1400055a6
jmp 0x1400055ab
call fcn.1401acfd4
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x46
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x77
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], WSAAsyncGetServByPort
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140005671
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + gethostbyaddr]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ad280
add rsp, 0x68
ret
Function at 0x140005694
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1402779a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x43
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x47
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], reloc.WSOCK32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x4c
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x57
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], WSAGetLastError
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0xf
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x10
jae 0x14000578c
jmp 0x140005791
call fcn.1401acfd4
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], WSAAsyncGetServByPort
call fcn.140004bec
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400057d2
call qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401ad280
add rsp, 0x58
ret
Function at 0x1400057ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1402779a0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
call fcn.140004a3c
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140005996
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x40], 0x45
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAStartup
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x49
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSACancelAsyncRequest
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x40], 0x78
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSACleanup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], WSAGetLastError
mov eax, 1
imul rax, rax, 0x14
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x15
jae 0x140005952
jmp 0x140005957
call fcn.1401acfd4
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000598b
mov rcx, qword [rsp + 0x70]
call qword [rsp + gethostname]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ad280
add rsp, 0x68
ret
Function at 0x1400059ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1402779a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
call fcn.140004f48
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140005b08
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], WSAAsyncGetServByPort
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAStartup
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAStartup
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], WSAAsyncGetHostByAddr
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x50
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], reloc.WSOCK32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x4d
mov eax, 1
imul rax, rax, 0xc
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xd
jae 0x140005ab0
jmp 0x140005ab5
call fcn.1401acfd4
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140005afd
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + gethostname]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ad280
add rsp, 0x68
ret