joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400355c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x22], 0x63695474
mov word [rsp + 0x2b], reloc.WS2_32.dll_WSACleanup
mov dword [rsp + 0x26], 0x756f436b
mov word [rsp + 0x20], 0x6547
mov byte [rsp + 0x2a], WSAGetLastError
call fcn.140033c50
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035622
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x48
ret

Function at 0x140035640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov rsi, rcx
lea rcx, [rbp - 0x38]
mov r12d, r9d
mov r15, r8
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x35], 0x33697061
mov dword [rbp - 0x2f], 0x6c6c64
mov word [rbp - 0x37], 0x7664
mov word [rbp - 0x31], 0x2e32
mov byte [rbp - 0x38], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140035708
lea rdx, [rbp - 0x28]
mov rcx, rax
mov word [rbp - 0x25], 0x6f54
mov word [rbp - 0x28], 0x6547
mov word [rbp - 0x1d], 0x726f
mov dword [rbp - 0x18], 0x6e6f69
mov dword [rbp - 0x23], 0x496e656b
mov word [rbp - 0x1a], 0x7461
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x26], reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x1f], 0x666e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400356ff
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140035730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r12, r9
mov r15, r8
mov r14, rdx
mov ebx, 0x80004005
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x2a], 0x2e69
mov word [rbp - 0x30], 0x6853
mov word [rbp - 0x2d], 0x6177
mov byte [rbp - 0x2b], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x2e], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140035809
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0xf], 0x65636976
mov dword [rbp - 0x14], 0x65537972
mov word [rbp - 0x1e], 0x6b6e
mov word [rbp - 0x1b], 0x776f
mov dword [rbp - 0x18], 0x6575515f
mov byte [rbp - 0x1c], WSAGetLastError
mov word [rbp - 0x20], 0x5549
mov byte [rbp - 0x10], WSAStartup
mov byte [rbp - 0x19], WSAGetLastError
mov byte [rbp - 0xb], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400357f0
mov edx, 0xb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035800
mov r9, r12
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140035830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x3d], 0x33697061
mov dword [rbp - 0x37], 0x6c6c64
mov word [rbp - 0x3f], 0x7664
mov word [rbp - 0x39], 0x2e32
mov byte [rbp - 0x40], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400358f8
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x17], 0x726f74
mov dword [rbp - 0x30], 0x74696e49
mov word [rbp - 0x2b], 0x6c61
mov dword [rbp - 0x28], 0x6553657a
mov word [rbp - 0x1e], 0x6544
mov word [rbp - 0x21], 0x7469
mov word [rbp - 0x24], 0x7563
mov dword [rbp - 0x1b], 0x70697263
mov byte [rbp - 0x22], WSAStartup
mov byte [rbp - 0x1f], 0x79
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x29], 0x69
mov byte [rbp - 0x2c], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400358ef
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140035920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov dword [rsp + 0x22], 0x466c6163
mov word [rsp + 0x27], 0x6565
mov word [rsp + 0x20], 0x6f4c
mov byte [rsp + 0x26], WSAStartup
mov byte [rsp + 0x29], 0
call fcn.140033c50
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035988
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x40
pop rbx
ret
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x40
pop rbx
ret

Function at 0x1400359a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x88
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x77]
mov r13, qword [rbp + 0x6f]
mov rsi, rcx
mov qword [rbp - 0x41], rax
mov rax, qword [rbp + 0x7f]
lea rcx, [rbp - 0x31]
mov r12, r9
mov r15, r8
mov r14, rdx
mov qword [rbp - 0x39], rax
xor ebx, ebx
mov dword [rbp - 0x2e], 0x33697061
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x30], 0x7664
mov word [rbp - 0x2a], 0x2e32
mov byte [rbp - 0x31], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140035a83
lea rdx, [rbp - 0x21]
mov rcx, rax
mov dword [rbp - 0x19], 0x6e756f63
mov dword [rbp - 0x14], 0x41646953
mov dword [rbp - 0x1f], 0x70756b6f
mov byte [rbp - 0x10], bl
mov word [rbp - 0x21], 0x6f4c
mov word [rbp - 0x1b], 0x6341
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035a7a
mov rcx, qword [rbp - 0x39]
mov r9, r12
mov r8, r15
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp - 0x41]
mov rdx, r14
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140035ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r15, r8
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x2d], 0x33697061
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2f], 0x7664
mov word [rbp - 0x29], 0x2e32
mov byte [rbp - 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140035b5d
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x16], 0x67656c69
mov dword [rbp - 0xe], 0x416575
mov dword [rbp - 0x12], 0x6c615665
mov dword [rbp - 0x1e], 0x70756b6f
mov dword [rbp - 0x1a], 0x76697250
mov word [rbp - 0x20], 0x6f4c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035b54
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140035c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, ecx
lea rcx, [rbp - 0x40]
mov r12d, r9d
mov r15d, r8d
mov r14, rdx
or ebx, 0xffffffff
mov dword [rbp - 0x3f], 0x33726573
mov byte [rbp - 0x40], 0x55
mov word [rbp - 0x38], 0x6c6c
mov word [rbp - 0x3b], 0x2e32
mov byte [rbp - 0x39], 0x64
mov byte [rbp - 0x36], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140035cd2
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x30], 0x5767734d
mov word [rbp - 0x21], 0x6c70
mov dword [rbp - 0x1b], 0x73746365
mov dword [rbp - 0x29], 0x4d726f46
mov word [rbp - 0x2c], 0x6961
mov word [rbp - 0x1e], 0x624f
mov dword [rbp - 0x25], 0x69746c75
mov byte [rbp - 0x2a], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x1c], 0x6a
mov byte [rbp - 0x17], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140035cc9
mov eax, dword [rbp + 0x60]
mov r9d, r12d
mov r8d, r15d
mov rdx, r14
mov ecx, esi
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140035cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r8
mov edi, edx
mov ebx, ecx
mov dword [rsp + 0x21], 0x4d6e6570
mov word [rsp + 0x26], 0x6574
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_79
mov word [rsp + 0x29], 0x41
mov byte [rsp + 0x28], 0x78
call fcn.140033c50
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035d54
mov r8, rsi
mov edx, edi
mov ecx, ebx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140035d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov esi, r8d
mov edi, edx
mov ebx, ecx
mov dword [rsp + 0x27], 0x73736563
mov dword [rsp + 0x20], 0x6e65704f
mov word [rsp + 0x25], 0x6f72
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x24], 0x50
call fcn.140033c50
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035dd2
mov r8d, esi
mov edx, edi
mov ecx, ebx
call rax
jmp 0x140035dd6
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140035df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r15, r8
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x2d], 0x33697061
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2f], 0x7664
mov word [rbp - 0x29], 0x2e32
mov byte [rbp - 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140035e9f
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x14], 0x6e656b6f
mov word [rbp - 0x18], 0x7365
mov dword [rbp - 0x20], 0x6e65704f
mov byte [rbp - 0x10], bl
mov word [rbp - 0x1b], 0x6f72
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1c], 0x50
mov byte [rbp - 0x19], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035e96
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140035ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r15d, r8d
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x2d], 0x33697061
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2f], 0x7664
mov word [rbp - 0x29], 0x2e32
mov byte [rbp - 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140035f79
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x1a], 0x616e614d
mov dword [rbp - 0x1e], 0x43536e65
mov word [rbp - 0x20], 0x704f
mov word [rbp - 0x13], 0x41
mov word [rbp - 0x16], 0x6567
mov byte [rbp - 0x14], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140035f70
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140035fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r15d, r8d
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x2d], 0x33697061
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2f], 0x7664
mov word [rbp - 0x29], 0x2e32
mov byte [rbp - 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003604a
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x1f], 0x6570
mov word [rbp - 0x1c], 0x6553
mov dword [rbp - 0x19], 0x65636976
mov byte [rbp - 0x1a], WSAStartup
mov word [rbp - 0x15], 0x41
mov byte [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x1d], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140036041
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140036070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x2a], 0x2e69
mov word [rbp - 0x30], 0x6853
mov word [rbp - 0x2d], 0x6177
mov byte [rbp - 0x2b], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x2e], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140036114
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x16], 0x41
mov dword [rbp - 0x1d], 0x70704168
mov word [rbp - 0x19], 0x6e65
mov word [rbp - 0x20], 0x6150
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x17], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003610b
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140036140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x2a], 0x2e69
mov word [rbp - 0x30], 0x6853
mov word [rbp - 0x2d], 0x6177
mov byte [rbp - 0x2b], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x2e], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400361e1
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x15], 0x41737473
mov word [rbp - 0x20], 0x6150
mov dword [rbp - 0x19], 0x69784565
mov dword [rbp - 0x1d], 0x6c694668
mov byte [rbp - 0x11], bl
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400361d8
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140036210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x2a], 0x2e69
mov word [rbp - 0x30], 0x6853
mov word [rbp - 0x2d], 0x6177
mov byte [rbp - 0x2b], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x2e], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400362b2
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x12], 0x41656d
mov dword [rbp - 0x1d], 0x6e694668
mov dword [rbp - 0x16], 0x614e656c
mov word [rbp - 0x20], 0x6150
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x19], 0x4664
mov byte [rbp - 0x17], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400362a9
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x1400362e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x2a], 0x2e69
mov word [rbp - 0x30], 0x6853
mov word [rbp - 0x2d], 0x6177
mov byte [rbp - 0x2b], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x2e], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140036389
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x1a], 0x6f6d
mov dword [rbp - 0x15], 0x6e657478
mov dword [rbp - 0x1f], 0x52687461
mov dword [rbp - 0xf], 0x416e6f
mov byte [rbp - 0x1b], 0x65
mov word [rbp - 0x11], 0x6973
mov word [rbp - 0x17], 0x4565
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x18], 0x76
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140036380
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x1400363b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x2a], 0x2e69
mov word [rbp - 0x30], 0x6853
mov word [rbp - 0x2d], 0x6177
mov byte [rbp - 0x2b], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x2e], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140036458
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x1b], 0x766f6d65
mov dword [rbp - 0x17], 0x6c694665
mov dword [rbp - 0x20], 0x68746150
mov dword [rbp - 0x11], 0x41636570
mov byte [rbp - 0x1c], 0x52
mov word [rbp - 0x13], 0x5365
mov byte [rbp - 0xd], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003644f
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140036480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140158280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov r12d, r9d
mov r15d, r8d
mov r14, rdx
mov dword [rbp - 0x2f], 0x33726573
mov byte [rbp - 0x30], 0x55
mov word [rbp - 0x28], 0x6c6c
mov word [rbp - 0x2b], 0x2e32
mov byte [rbp - 0x29], 0x64
mov byte [rbp - 0x26], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140036532
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x19], 0x65676173
mov dword [rbp - 0x20], 0x6b656550
mov word [rbp - 0x15], 0x41
mov word [rbp - 0x1b], 0x7365
mov byte [rbp - 0x1c], Ordinal_79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140036529
mov eax, dword [rbp + 0x60]
mov r9d, r12d
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret