joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001290
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x14000133c
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x1400012a3
not eax
ret

Function at 0x140003530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x1010]
mov eax, 0x1110
call fcn.14007a920
sub rsp, rax
mov rbx, rcx
lea rcx, [rsp + 0x70]
call fcn.14000bb50
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140008960
nop
lea rcx, [rsp + 0x70]
call fcn.14000bc70
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x390]
call fcn.14007c9b0
lea rcx, [rsp + 0x58]
call fcn.140010d90
mov r10, rax
xor r8d, r8d
test rax, rax
je 0x1400035c5
mov edx, r8d
lea r9, [rbp + 0x390]
lea rcx, [rsp + 0x58]
call fcn.140010d80
movzx ecx, byte [rax]
mov byte [r9], cl
inc r8d
lea r9, [r9 + 1]
movsxd rdx, r8d
cmp rdx, r10
jb 0x1400035a6
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x790]
call fcn.14007c9b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x70]
call fcn.14007c9b0
mov word [rsp + 0x4e], 0x3939
mov dword [rsp + 0x30], 0x37383843
mov dword [rsp + 0x3f], 0x42324436
mov dword [rsp + 0x35], 0x44433234
mov word [rsp + 0x48], 0x4342
mov dword [rsp + 0x43], 0x42413436
mov word [rsp + 0x3c], 0x3945
mov word [rsp + 0x39], 0x4132
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x3b], 0x37
mov byte [rsp + 0x34], 0x44
mov word [rsp + 0x4b], 0x3836
mov byte [rsp + 0x4a], 0x46
mov byte [rsp + 0x47], 0x43
mov byte [rsp + 0x3e], 0x46
mov byte [rsp + 0x4d], 0x46
lea r8, [rsp + 0x30]
mov edx, 0x400
lea rcx, [rbp - 0x70]
call fcn.140080890
lea rcx, [rbp + 0xb90]
call fcn.1400aa900
nop
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xb90]
call fcn.1400aa920
lea rcx, [rsp + 0x58]
call fcn.140010d90
mov r9, rax
lea r8, [rbp + 0x790]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0xb90]
call fcn.1400ab140
lea rdx, [rbp + 0x7a0]
mov rcx, rbx
call fcn.14000bb50
nop
lea rcx, [rsp + 0x58]
call fcn.140010e20
mov rax, rbx
mov rbx, qword [rsp + 0x1120]
add rsp, 0x1110
pop rbp
ret
Function at 0x140003bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov word [rbp - 0x11], 0x5332
mov dword [rbp - 0xb], 0x746f68
mov dword [rbp - 0x20], 0x61657243
mov dword [rbp - 0x1c], 0x6f546574
mov dword [rbp - 0x16], 0x706c6568
mov word [rbp - 0x18], 0x6c6f
mov dword [rbp - 0xf], 0x7370616e
mov byte [rbp - 0x12], 0x33
call fcn.140003ad0
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003c20
xor edx, edx
lea ecx, [rdx + 2]
call rax
add rsp, 0x40
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x40
pop rbp
ret

Function at 0x140003c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r14, rcx
mov word [rbp - 0x27], 0x6c6c
xor ebx, ebx
mov dword [rbp - 0x30], 0x72657355
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
mov rsi, rdx
mov dword [rbp - 0x2c], 0x2e766e65
mov byte [rbp - 0x28], 0x64
call fcn.140003a20
mov rdi, rax
test rax, rax
je 0x140003cdf
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1e], 0x65746165
mov rcx, rax
mov dword [rbp - 0x10], 0x6f6c4274
mov word [rbp - 0x15], 0x6e6f
mov word [rbp - 0x12], 0x6e65
mov word [rbp - 0xc], 0x6b63
mov byte [rbp - 0x13], WSASetLastError
mov dword [rbp - 0x19], 0x7269766e
mov word [rbp - 0x20], 0x7243
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0xa], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003cd7
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140003d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x27], 0x6c6c64
mov rsi, r9
mov word [rbp - 0x2a], 0x3233
xor ebx, ebx
mov byte [rbp - 0x28], 0x2e
mov dword [rbp - 0x2f], 0x70617374
mov byte [rbp - 0x30], 0x57
mov byte [rbp - 0x2b], 0x69
call fcn.140003a20
mov rdi, rax
test rax, rax
je 0x140003e29
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xf], 0x41736e6f
mov rcx, rax
mov dword [rbp - 0x15], 0x73655365
mov dword [rbp - 0x1d], 0x6d756e45
mov word [rbp - 0x20], 0x5457
mov word [rbp - 0x18], 0x6172
mov word [rbp - 0x11], 0x6973
mov byte [rbp - 0xb], bl
mov byte [rbp - 0x1e], 0x53
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x19], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140003e21
mov rax, qword [rbp + 0x30]
lea r8d, [rbx + 1]
mov r9, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x140003e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
xor ebx, ebx
call fcn.1400b11d0
mov rdi, rax
test rax, rax
je 0x140003ee5
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x69636570
mov rcx, rax
mov word [rbp - 0x1c], 0x5374
mov word [rbp - 0x1f], 0x4748
mov word [rbp - 0x10], 0x7265
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x16], 0x6f466c61
mov word [rbp - 0xd], 0x7461
mov word [rbp - 0xa], 0x57
mov word [rbp - 0x12], 0x646c
mov byte [rbp - 0xb], 0x68
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0xe], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003edd
xor r9d, r9d
lea r8d, [rbx + 0x25]
mov rdx, rsi
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140003f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x140003f92
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x53746553
mov rcx, rax
mov word [rbp - 0xc], 0x6972
mov word [rbp - 0x17], 0x4f65
mov dword [rbp - 0x11], 0x63655374
mov word [rbp - 9], 0x79
mov dword [rbp - 0x1c], 0x69767265
mov dword [rbp - 0x15], 0x63656a62
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xd], 0x75
mov byte [rbp - 0x18], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003f8a
mov r8, rsi
lea edx, [rbx + 4]
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140004060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rsi, r9
mov rbp, rdx
mov r14, rcx
mov ebx, 1
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x14000411f
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x36], 0x61567972
mov rcx, rax
mov word [rsp + 0x3e], 0x4178
mov word [rsp + 0x34], 0x6575
mov word [rsp + 0x31], 0x6765
mov word [rsp + 0x3b], 0x6575
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x3d], 0x45
mov byte [rsp + 0x33], 0x51
mov byte [rsp + 0x3a], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140004117
mov rax, qword [rsp + 0x88]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140004140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov ebx, 0x80004005
call fcn.1400b11d0
mov rdi, rax
test rax, rax
je 0x1400041ce
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x38], 0x50726564
mov rcx, rax
mov dword [rsp + 0x3d], 0x416874
mov dword [rsp + 0x30], 0x65474853
mov word [rsp + 0x35], 0x6f46
mov byte [rsp + 0x37], WSASetLastError
mov byte [rsp + 0x34], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x3c], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400041c6
mov rax, qword [rsp + 0x80]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1c]
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1400041e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov word [rsp + 0x28], 0x65
mov dword [rsp + 0x21], 0x6c61636f
mov word [rsp + 0x25], 0x7246
mov byte [rsp + 0x20], 0x4c
mov byte [rsp + 0x27], 0x65
call fcn.140003ad0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000422c
mov rcx, rbx
call rax
add rsp, 0x30
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140004240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rbp, rcx
mov ebx, 1
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400042ca
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2d], 0x6972
mov rcx, rax
mov word [rsp + 0x27], 0x7965
mov dword [rsp + 0x22], 0x74655367
mov dword [rsp + 0x29], 0x75636553
mov word [rsp + 0x30], 0x79
mov byte [rsp + 0x26], 0x4b
mov word [rsp + 0x20], 0x6552
mov byte [rsp + 0x2f], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400042c2
mov r8, rsi
lea edx, [rbx + 3]
mov rcx, rbp
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400042f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x140004368
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x72655365
mov rcx, rax
mov dword [rsp + 0x2d], 0x6c646e61
mov dword [rsp + 0x29], 0x48656369
mov word [rsp + 0x21], 0x6f6c
mov word [rsp + 0x31], 0x65
mov byte [rsp + 0x20], 0x43
mov byte [rsp + 0x28], 0x76
mov byte [rsp + 0x23], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004360
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140004380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400043e4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x614d4353
mov rcx, rax
mov dword [rsp + 0x28], 0x6567616e
mov word [rsp + 0x2c], 0x4172
mov dword [rsp + 0x20], 0x6e65704f
mov byte [rsp + 0x2e], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400043dc
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400ab270
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140004400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x21], 0x75747269
mov byte [rsp + 0x20], 0x56
mov dword [rsp + 0x25], 0x6c416c61
mov word [rsp + 0x2a], 0x636f
mov byte [rsp + 0x29], WSASetLastError
mov byte [rsp + 0x2c], 0
call fcn.140003ad0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004460
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call rax
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret

Function at 0x140004470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov esi, r9d
mov rbp, rdx
mov ebx, 1
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x140004501
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x4f676552
mov rcx, rax
mov word [rsp + 0x34], 0x6570
mov dword [rsp + 0x37], 0x4579654b
mov word [rsp + 0x3c], 0x57
mov byte [rsp + 0x36], WSASetLastError
mov byte [rsp + 0x3b], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400044f9
mov rax, qword [rsp + 0x70]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, 0xffffffff80000002
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140004520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rsi, r9
mov rbp, r8
mov r14d, edx
mov r15, rcx
mov ebx, 1
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400045bf
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x41], 0x6e456765
mov rcx, rax
mov word [rsp + 0x4c], 0x41
mov dword [rsp + 0x47], 0x4579654b
mov byte [rsp + 0x40], 0x52
mov word [rsp + 0x45], 0x6d75
mov byte [rsp + 0x4b], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400045b7
xor ecx, ecx
mov r9, rsi
mov qword [rsp + 0x38], rcx
mov r8, rbp
mov qword [rsp + 0x30], rcx
mov edx, r14d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x1400046f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r9
mov rbp, rcx
mov ebx, 0x80004005
call fcn.1400b11d0
mov rdi, rax
test rax, rax
je 0x140004782
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6f466e77
mov rcx, rax
mov dword [rsp + 0x23], 0x6e4b7465
mov byte [rsp + 0x27], reloc.WS2_32.dll_WSAGetLastError
mov dword [rsp + 0x2e], 0x61507265
mov word [rsp + 0x21], 0x4748
mov word [rsp + 0x32], 0x6874
mov word [rsp + 0x2c], 0x646c
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000477a
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400047a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x20], 0x4c746547
mov dword [rsp + 0x25], 0x72457473
mov word [rsp + 0x2a], 0x726f
mov byte [rsp + 0x29], WSAStartup
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x24], 0x61
call fcn.140003ad0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400047e9
call rax
add rsp, 0x38
ret
add rsp, 0x38
ret
Function at 0x140009080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, rdx
xor edi, edi
mov dword [rbp - 0x30], edi
lea rdx, [rbp - 0x28]
call fcn.140009160
mov rcx, rsi
call fcn.14000bb90
mov dword [rbp - 0x30], 1
lea edx, [rdi + 0x20]
mov rcx, rsi
call fcn.140010440
nop word [rax + rax]
mov word [rbp - 0x15], 0x3433
mov word [rbp - 0x18], 0x3130
mov word [rbp - 0xa], 0x6665
mov word [rbp - 0x13], 0x3635
mov word [rbp - 0xd], 0x6362
mov word [rbp - 0x10], 0x3938
mov byte [rbp - 0xb], 0x64
mov byte [rbp - 0x16], 0x32
mov byte [rbp - 8], 0
mov byte [rbp - 0x11], 0x37
mov byte [rbp - 0xe], 0x61
movzx ebx, byte [rbp + rdi - 0x28]
mov eax, ebx
shr rax, 4
movzx edx, byte [rbp + rax - 0x18]
mov rcx, rsi
call fcn.140010e60
and ebx, 0xf
movzx edx, byte [rbp + rbx - 0x18]
mov rcx, rsi
call fcn.140010e60
inc rdi
cmp rdi, 0x10
jl 0x1400090d0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400097a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov esi, r9d
mov rbp, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x140009845
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6e656b6f
mov rcx, rax
mov dword [rsp + 0x3f], 0x6e6f6974
mov word [rsp + 0x3a], 0x6f66
mov dword [rsp + 0x30], 0x54746547
mov byte [rsp + 0x43], bl
mov word [rsp + 0x3d], 0x616d
mov word [rsp + 0x38], 0x6e49
mov byte [rsp + 0x3c], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000983d
mov rax, qword [rsp + 0x90]
mov r9d, esi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, r14d
mov rcx, r15
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret

Function at 0x140009870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r14d, ecx
mov dword [rbp - 0x30], 0x61737457
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2b], 0x2e323369
mov rsi, rdx
mov dword [rbp - 0x27], 0x6c6c64
xor ebx, ebx
mov byte [rbp - 0x2c], reloc.WS2_32.dll_WSASetLastError
call fcn.140003a20
mov rdi, rax
test rax, rax
je 0x140009904
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x51535457
mov rcx, rax
mov dword [rbp - 0x18], 0x72657355
mov dword [rbp - 0x1c], 0x79726575
mov dword [rbp - 0x14], 0x656b6f54
mov word [rbp - 0x10], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400098fc
mov rdx, rsi
mov ecx, r14d
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140009920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400099b4
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x74696e49
mov rcx, rax
mov word [rbp - 6], 0x726f
mov dword [rbp - 0x10], 0x65447974
mov dword [rbp - 0x1c], 0x696c6169
mov dword [rbp - 0x14], 0x69727563
mov word [rbp - 0x17], 0x5365
mov word [rbp - 9], 0x7069
mov byte [rbp - 7], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 4], bl
mov word [rbp - 0xc], 0x6373
mov byte [rbp - 0x18], 0x7a
mov byte [rbp - 0xa], WSAStartup
mov byte [rbp - 0x15], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400099ac
lea edx, [rbx + 1]
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x1400099d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call fcn.1400b1210
mov rbx, rax
test rax, rax
je 0x140009a32
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x79726f
mov rcx, rax
mov word [rsp + 0x23], 0x7246
mov word [rsp + 0x20], 0x5457
mov dword [rsp + 0x25], 0x654d6565
mov byte [rsp + 0x22], 0x53
mov byte [rsp + 0x29], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009a2a
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400ab270
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140009a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, r8
mov ebp, edx
mov r14, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x140009acb
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x6e656b6f
mov rcx, rax
mov word [rsp + 0x24], 0x7250
mov word [rsp + 0x27], 0x6563
mov dword [rsp + 0x20], 0x6e65704f
mov word [rsp + 0x2a], 0x5473
mov byte [rsp + 0x26], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x30], bl
mov byte [rsp + 0x29], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009ac3
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140009af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x140009b77
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xc], 0x68637461
mov rcx, rax
mov word [rbp - 0x1b], 0x6553
mov dword [rbp - 0x18], 0x65636976
mov dword [rbp - 0x12], 0x69446c72
mov dword [rbp - 8], 0x417265
mov word [rbp - 0x14], 0x7443
mov dword [rbp - 0x20], 0x72617453
mov word [rbp - 0xe], 0x7073
mov byte [rbp - 0x19], WSAStartup
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009b6f
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret