joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bb2b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov word [rbp - 3], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp - 0xc], 0x65636f72
mov dword [rbp - 8], 0x65487373
mov dword [rbp - 0x10], 0x50746547
mov byte [rbp - 4], 0x61
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bb2fe
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400bb384
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov esi, edx
mov r14, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x1400bb41d
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x74696e49
mov rcx, rax
mov word [rbp - 6], 0x726f
mov dword [rbp - 0x10], 0x65447974
mov dword [rbp - 0x1c], 0x696c6169
mov dword [rbp - 0x14], 0x69727563
mov word [rbp - 0x17], 0x5365
mov word [rbp - 9], 0x7069
mov byte [rbp - 7], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 4], bl
mov word [rbp - 0xc], 0x6373
mov byte [rbp - 0x18], 0x7a
mov byte [rbp - 0xa], WSAStartup
mov byte [rbp - 0x15], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bb415
mov edx, esi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400bb4f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x1400bb589
lea rdx, [rbp - 0x20]
mov word [rbp - 0x17], 0x6976
mov rcx, rax
mov dword [rbp - 0xf], 0x4165756c
mov word [rbp - 0x11], 0x6156
mov dword [rbp - 0x1e], 0x70756b6f
mov word [rbp - 0x14], 0x6765
mov byte [rbp - 0xb], bl
mov byte [rbp - 0x12], 0x65
mov word [rbp - 0x20], 0x6f4c
mov word [rbp - 0x1a], 0x7250
mov byte [rbp - 0x18], 0x69
mov byte [rbp - 0x15], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bb581
mov r8, rsi
mov rdx, r14
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400bb5a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov esi, r9d
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.14000dde0
mov rdi, rax
test rax, rax
je 0x1400bb623
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xb], 0x6f426567
mov rcx, rax
mov dword [rbp - 0x10], 0x7373654d
mov byte [rbp - 0xc], 0x61
mov word [rbp - 7], 0x4178
mov byte [rbp - 5], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bb61b
mov r9d, esi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x1400bb644
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x1400bb6c9
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x6e656b6f
mov rcx, rax
mov word [rbp - 0x1c], 0x7250
mov word [rbp - 0x19], 0x6563
mov dword [rbp - 0x20], 0x6e65704f
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1a], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x10], bl
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bb6c1
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400bb6e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov esi, r8d
mov r14, rdx
mov r15, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x1400bb75d
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x614d4353
mov rcx, rax
mov dword [rbp - 8], 0x6567616e
mov word [rbp - 4], 0x4172
mov dword [rbp - 0x10], 0x6e65704f
mov byte [rbp - 2], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bb755
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rbx, rax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x1400bb808
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.14000dd68
mov rdi, rax
test rax, rax
je 0x1400bb87c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x6f6d6552
mov rcx, rax
mov dword [rbp - 0x17], 0x6c694665
mov dword [rbp - 0x20], 0x68746150
mov dword [rbp - 0x13], 0x65705365
mov word [rbp - 0xe], 0x41
mov byte [rbp - 0x18], 0x76
mov byte [rbp - 0xf], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bb874
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400bb894
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov word [rbp - 5], 0x7478
mov byte [rbp - 3], bl
mov rdi, rdx
mov rsi, rcx
mov dword [rbp - 0xf], 0x65636f72
mov dword [rbp - 0xa], 0x4e323373
mov byte [rbp - 0x10], 0x50
mov byte [rbp - 0xb], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 6], 0x65
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bb8f7
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400bb9a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
mov edi, 1
call fcn.1400bac9c
mov rbx, rax
test rax, rax
je 0x1400bba59
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xf], 0x6e456765
mov rcx, rax
mov word [rbp - 4], 0x41
mov dword [rbp - 9], 0x4579654b
mov byte [rbp - 0x10], 0x52
mov word [rbp - 0xb], 0x6d75
mov byte [rbp - 5], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400bba51
mov rax, qword [rbp + 0x58]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov r8, r14
mov rax, qword [rbp + 0x50]
mov edx, r15d
mov qword [rsp + 0x30], rax
mov rcx, r12
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400bba7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.1400bac9c
mov rbx, rax
test rax, rax
je 0x1400bbb01
lea rdx, [rbp - 0x10]
mov word [rbp - 0xa], 0x4b6e
mov rcx, rax
mov word [rbp - 0xd], 0x704f
mov word [rbp - 7], 0x4179
mov word [rbp - 0x10], 0x6552
mov byte [rbp - 0xe], 0x67
mov byte [rbp - 5], 0
mov byte [rbp - 0xb], 0x65
mov byte [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bbaf9
mov r8, rsi
mov rdx, r14
mov rcx, r15
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x1400bbb1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov edi, 1
call fcn.1400bac9c
mov rbx, rax
test rax, rax
je 0x1400bbbc5
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x4565756c
mov rcx, rax
mov dword [rbp - 0x20], 0x51676552
mov word [rbp - 0x11], 0x57
mov word [rbp - 0x19], 0x5679
mov word [rbp - 0x1c], 0x6575
mov byte [rbp - 0x12], 0x78
mov byte [rbp - 0x17], 0x61
mov byte [rbp - 0x1a], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400bbbbd
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r14
mov rax, qword [rbp + 0x40]
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400bbbe8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, recv
call fcn.14000dcf0
mov rbx, rax
test rax, rax
je 0x1400bbc54
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x53637052
mov rcx, rax
mov dword [rbp - 8], 0x65724667
mov word [rbp - 4], 0x4165
mov dword [rbp - 0xc], 0x6e697274
mov byte [rbp - 2], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bbc4c
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
Function at 0x1400bbc6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
mov edi, 0x80004005
call fcn.1400badb8
mov rbx, rax
test rax, rax
je 0x1400bbd07
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x50726564
mov rcx, rax
mov dword [rbp - 0x13], 0x416874
mov dword [rbp - 0x20], 0x65474853
mov word [rbp - 0x1b], 0x6f46
mov byte [rbp - 0x19], WSAGetLastError
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x14], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400bbcff
mov rax, qword [rbp + 0x40]
mov r9d, esi
mov r8, r14
mov qword [rsp + 0x20], rax
mov edx, r15d
mov rcx, r12
call r10
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400bbe3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x1400bbede
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x72637365
mov rcx, rax
mov dword [rbp - 0x1b], 0x69727563
mov dword [rbp - 0x20], 0x53746553
mov dword [rbp - 0xa], 0x6c6361
mov word [rbp - 0xf], 0x7470
mov word [rbp - 0xc], 0x4472
mov word [rbp - 0x16], 0x4479
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x10], 0x69
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xd], reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bbed6
mov r9d, esi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400bbfe4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rdx
mov r14, rcx
mov edi, recv
call fcn.14000dcf0
mov rbx, rax
test rax, rax
je 0x1400bc056
lea rdx, [rbp - 0x10]
mov dword [rbp - 6], 0x41676e
mov rcx, rax
mov dword [rbp - 0xa], 0x69727453
mov dword [rbp - 0x10], 0x64697555
mov word [rbp - 0xc], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bc04e
mov rdx, rsi
mov rcx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x1400bc074
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400badf8
mov rdi, rax
test rax, rax
je 0x1400bc0f7
lea rdx, [rbp - 0x10]
mov dword [rbp - 5], 0x416575
mov rcx, rax
mov dword [rbp - 0x10], 0x51726556
mov dword [rbp - 0xa], 0x61567972
mov word [rbp - 0xc], 0x6575
mov byte [rbp - 6], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bc0ef
mov r9, rsi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x1400bc118
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov edi, r9d
mov dword [rbp - 0xf], 0x75747269
mov rsi, r8
mov dword [rbp - 9], 0x6f6c6c41
mov r14, rdx
mov dword [rbp - 5], 0x784563
mov r15, rcx
mov byte [rbp - 0x10], 0x56
xor ebx, ebx
mov word [rbp - 0xb], 0x6c61
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400bc193
mov eax, dword [rbp + 0x40]
mov r9d, edi
mov r8, rsi
mov dword [rsp + 0x20], eax
mov rdx, r14
mov rcx, r15
call r10
mov rbx, rax
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400bc1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
call fcn.14000de1c
mov rbx, rax
test rax, rax
je 0x1400bc213
lea rdx, [rbp - 0x10]
mov dword [rbp - 6], 0x79726f
mov rcx, rax
mov word [rbp - 0xd], 0x7246
mov word [rbp - 0x10], 0x5457
mov dword [rbp - 0xb], 0x654d6565
mov byte [rbp - 0xe], 0x53
mov byte [rbp - 7], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bc20b
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
Function at 0x1400bc224
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r14d, ecx
mov dword [rbp - 0x30], 0x61737457
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2b], 0x2e323369
mov rsi, rdx
mov dword [rbp - 0x27], 0x6c6c64
xor ebx, ebx
mov byte [rbp - 0x2c], reloc.WS2_32.dll_WSASetLastError
call fcn.1400bb43c
mov rdi, rax
test rax, rax
je 0x1400bc2b7
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x51535457
mov rcx, rax
mov dword [rbp - 0x18], 0x72657355
mov dword [rbp - 0x1c], 0x79726575
mov dword [rbp - 0x14], 0x656b6f54
mov word [rbp - 0x10], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bc2af
mov rdx, rsi
mov ecx, r14d
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x1400bc2d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov dword [rbp - 0x13], 0x656a624f
mov rsi, rcx
mov word [rbp - 0x1c], 0x6f46
or ebx, 0xffffffff
mov word [rbp - 0x15], 0x656c
mov word [rbp - 0x1f], 0x6961
mov dword [rbp - 0x1a], 0x6e695372
mov byte [rbp - 0x20], 0x57
mov word [rbp - 0xf], 0x7463
mov byte [rbp - 0xd], 0
mov byte [rbp - 0x16], 0x67
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSACleanup
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bc349
mov edx, edi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x1400060a0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005ecc
Function at 0x180011393
Capabilities:
Create thread

Disassembly:
jmp 0x1800187b0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x1800340be]
call fcn.1800116c7
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x1800187ef
jmp 0x18001881d
call fcn.180011249
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xf0]
lea r8, [0x180011271]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x1800113e3
Capabilities:
Terminate process

Disassembly:
jmp 0x18001efb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1800199e0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [0x18002d580]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 4
call fcn.180011361
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
je 0x180019c35
mov dword [rsp + 0x48], 0x1c
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call fcn.180011465
test eax, eax
je 0x180019c2a
mov dword [rsp + 0x28], 1
mov eax, dword [rsp + 0x48]
cmp rax, 0x10
jb 0x180019bb3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x54], eax
jne 0x180019bb3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x50], eax
je 0x180019bb3
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
jne 0x180019afb
mov rax, qword [rsp + 0xa0]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x18002da60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0xa0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
jne 0x180019af6
mov dword [rsp + 0x28], 0
jmp 0x180019bd2
jmp 0x180019b7e
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x180019b7e
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0xa0]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 8]
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0xa0]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18002da60]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x180019b6e
mov dword [rsp + 0x28], 0
jmp 0x180019bd2
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x50]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0xa0]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x48], 0x1c
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call fcn.1800110dc
test eax, eax
jne 0x180019a64
cmp dword [rsp + 0x28], 0
je 0x180019bec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180019bec
mov dword [rsp + 0x28], 0
cmp dword [rsp + 0x28], 0
jne 0x180019c2a
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
je 0x180019c2a
mov rax, qword [rsp + 0xa0]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18002da60]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0xa0]
mov qword [rax], 0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1800284a0]
call fcn.1800115b9
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180011375
add rsp, 0x90
pop rdi
ret