joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b3578
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rcx, [rbp - 0x10]
mov word [rbp - 0xf], 0x6568
mov byte [rbp - 0x10], 0x53
mov word [rbp - 6], WSASetLastError
mov word [rbp - 0xc], 0x336c
mov word [rbp - 9], 0x642e
mov byte [rbp - 7], WSAGetLastError
mov byte [rbp - 0xd], WSAGetLastError
mov byte [rbp - 0xa], 0x32
call fcn.1400b3448
add rsp, 0x30
pop rbp
ret

Function at 0x1400b35b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rcx, [rbp - 0x10]
mov word [rbp - 0xa], 0x642e
mov word [rbp - 0xd], 0x3372
mov word [rbp - 0x10], 0x7355
mov word [rbp - 7], WSASetLastError
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 0xb], 0x32
mov byte [rbp - 8], WSAGetLastError
call fcn.1400b3448
add rsp, 0x30
pop rbp
ret

Function at 0x1400b35f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov word [rbp - 0x11], 0x5332
mov dword [rbp - 0xb], 0x746f68
mov dword [rbp - 0x20], 0x61657243
mov dword [rbp - 0x1c], 0x6f546574
mov dword [rbp - 0x16], 0x706c6568
mov word [rbp - 0x18], 0x6c6f
mov dword [rbp - 0xf], 0x7370616e
mov byte [rbp - 0x12], 0x33
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b3659
xor edx, edx
lea ecx, [rbx + 3]
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400b3668
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r14, rcx
mov word [rbp - 0x27], 0x6c6c
xor ebx, ebx
mov dword [rbp - 0x30], 0x72657355
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
mov rsi, rdx
mov dword [rbp - 0x2c], 0x2e766e65
mov byte [rbp - 0x28], 0x64
call fcn.1400b3448
mov rdi, rax
test rax, rax
je 0x1400b3716
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1e], 0x65746165
mov rcx, rax
mov dword [rbp - 0x10], 0x6f6c4274
mov word [rbp - 0x15], 0x6e6f
mov word [rbp - 0x12], 0x6e65
mov word [rbp - 0xc], 0x6b63
mov byte [rbp - 0x13], WSASetLastError
mov dword [rbp - 0x19], 0x7269766e
mov word [rbp - 0x20], 0x7243
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0xa], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b370e
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400b3734
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
call fcn.1400b909c
mov rbx, rax
test rax, rax
je 0x1400b3797
lea rdx, [rbp - 0x10]
mov dword [rbp - 6], 0x79726f
mov rcx, rax
mov word [rbp - 0xd], 0x7246
mov word [rbp - 0x10], 0x5457
mov dword [rbp - 0xb], 0x654d6565
mov byte [rbp - 0xe], 0x53
mov byte [rbp - 7], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b378f
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x1400b37a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x1400b3839
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x53746553
mov rcx, rax
mov word [rbp - 0xc], 0x6972
mov word [rbp - 0x17], 0x4f65
mov dword [rbp - 0x11], 0x63655374
mov word [rbp - 9], 0x79
mov dword [rbp - 0x1c], 0x69767265
mov dword [rbp - 0x15], 0x63656a62
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xd], 0x75
mov byte [rbp - 0x18], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b3831
mov r8, rsi
lea edx, [rbx + 4]
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400b3858
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, recv
call fcn.1400b3500
mov rbx, rax
test rax, rax
je 0x1400b38c4
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x53637052
mov rcx, rax
mov dword [rbp - 8], 0x65724667
mov word [rbp - 4], 0x4165
mov dword [rbp - 0xc], 0x6e697274
mov byte [rbp - 2], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b38bc
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
Function at 0x1400b3968
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.14000b2f4
mov rbx, rax
test rax, rax
je 0x1400b3a11
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x61567972
mov rcx, rax
mov word [rbp - 0x12], 0x4178
mov word [rbp - 0x1c], 0x6575
mov word [rbp - 0x1f], 0x6765
mov word [rbp - 0x15], 0x6575
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x13], 0x45
mov byte [rbp - 0x1d], 0x51
mov byte [rbp - 0x16], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400b3a09
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [rbp + 0x40]
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400b90d4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400b3a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x1400b3a96
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x614d4353
mov rcx, rax
mov dword [rbp - 8], 0x6567616e
mov word [rbp - 4], 0x4172
mov dword [rbp - 0x10], 0x6e65704f
mov byte [rbp - 2], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b3a8e
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400b90d4
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400b3aac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0xf], 0x75747269
mov byte [rbp - 4], bl
mov rdi, rdx
mov byte [rbp - 0x10], 0x56
mov dword [rbp - 0xb], 0x6c416c61
mov word [rbp - 6], 0x636f
mov byte [rbp - 7], WSAGetLastError
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b3b0d
lea r9d, [rbx + 4]
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x1400b3b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x1e], 0x72685474
mov rsi, rcx
mov word [rbp - 0x20], 0x6547
xor ebx, ebx
mov dword [rbp - 0x17], 0x746e6f43
mov dword [rbp - 0x13], 0x747865
mov word [rbp - 0x19], 0x6461
mov byte [rbp - 0x1a], 0x65
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b3b85
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400b3b9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x1400b3c62
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x74616572
mov rcx, rax
mov dword [rbp - 0x14], 0x55734173
mov dword [rbp - 0x19], 0x65636f72
mov dword [rbp - 0xf], 0x417265
mov byte [rbp - 0x20], 0x43
mov word [rbp - 0x1b], 0x5065
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400b3c5a
mov rax, qword [rbp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rsi
mov rax, qword [rbp + 0x68]
mov rdx, r14
mov qword [rsp + 0x48], rax
mov rcx, r15
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x50]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400b3c84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14, rdx
mov edi, 1
call fcn.14000b2f4
mov rbx, rax
test rax, rax
je 0x1400b3d14
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x4f676552
mov rcx, rax
mov word [rbp - 0xc], 0x6570
mov dword [rbp - 9], 0x4579654b
mov word [rbp - 4], 0x57
mov byte [rbp - 0xa], WSASetLastError
mov byte [rbp - 5], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400b3d0c
mov rax, qword [rbp + 0x30]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000002
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400b3d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
xor ebx, ebx
call fcn.1400b35b8
mov rdi, rax
test rax, rax
je 0x1400b3da5
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xb], 0x6f426567
mov rcx, rax
mov dword [rbp - 0x10], 0x7373654d
mov byte [rbp - 0xc], 0x61
mov word [rbp - 7], 0x4178
mov byte [rbp - 5], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b3d9d
lea r9d, [rbx + 0x10]
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x1400b3e28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x4c746547
mov byte [rbp - 4], bl
mov dword [rbp - 0xb], 0x72457473
mov word [rbp - 6], 0x726f
mov byte [rbp - 7], WSACleanup
mov byte [rbp - 0xc], 0x61
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b3e71
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x1400b909c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xb], 0x2e323369
mov dword [rbp - 7], 0x6c6c64
mov word [rbp - 0x10], 0x7457
mov word [rbp - 0xd], 0x7061
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSAStartup
call fcn.1400b3448
add rsp, 0x30
pop rbp
ret

Function at 0x1400b9138
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x1400b91d7
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x11], 0x6e6f6974
mov word [rbp - 0x16], 0x6f66
mov dword [rbp - 0x20], 0x54746547
mov byte [rbp - 0xd], bl
mov word [rbp - 0x13], 0x616d
mov word [rbp - 0x18], 0x6e49
mov byte [rbp - 0x14], WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400b91cf
mov rax, qword [rbp + 0x40]
mov r9d, esi
mov r8, r14
mov qword [rsp + 0x20], rax
mov edx, r15d
mov rcx, r12
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400b91f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov word [rbp - 5], 0x7478
mov byte [rbp - 3], bl
mov rdi, rdx
mov rsi, rcx
mov dword [rbp - 0xf], 0x65636f72
mov dword [rbp - 0xa], 0x4e323373
mov byte [rbp - 0x10], 0x50
mov byte [rbp - 0xb], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 6], 0x65
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b925b
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400b9274
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
mov word [rbp - 0x19], 0x6d65
mov word [rbp - 0x16], 0x6d69
mov dword [rbp - 0xe], 0x6d695465
mov word [rbp - 0xa], 0x65
mov word [rbp - 0x1b], 0x7473
mov dword [rbp - 0x20], 0x53746547
mov dword [rbp - 0x13], 0x69467341
mov byte [rbp - 0x14], 0x65
mov byte [rbp - 0x17], 0x54
mov byte [rbp - 0x1c], 0x79
mov byte [rbp - 0xf], WSAGetLastError
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b92dd
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400b9340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x1400b93ea
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x72657551
mov rcx, rax
mov dword [rbp - 0x14], 0x656a624f
mov word [rbp - 7], 0x79
mov word [rbp - 0x1c], 0x5379
mov dword [rbp - 0x10], 0x65537463
mov word [rbp - 0x19], 0x7672
mov dword [rbp - 0xc], 0x69727563
mov byte [rbp - 0x1a], 0x65
mov word [rbp - 0x16], 0x6563
mov byte [rbp - 8], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x17], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400b93e2
mov rax, qword [rbp + 0x40]
lea edx, [rbx + 4]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, r14
mov rcx, r15
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400b9470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x1400b9508
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x72637365
mov rcx, rax
mov dword [rbp - 0x1b], 0x69727563
mov dword [rbp - 0x20], 0x53746553
mov dword [rbp - 0xa], 0x6c6361
mov word [rbp - 0xf], 0x7470
mov word [rbp - 0xc], 0x4472
mov word [rbp - 0x16], 0x4479
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x10], 0x69
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xd], reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b9500
xor r9d, r9d
lea edx, [rbx + 1]
mov r8, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400b9524
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x27], 0x6c6c64
mov rsi, r9
mov word [rbp - 0x2a], 0x3233
xor ebx, ebx
mov byte [rbp - 0x28], 0x2e
mov dword [rbp - 0x2f], 0x70617374
mov byte [rbp - 0x30], 0x57
mov byte [rbp - 0x2b], 0x69
call fcn.1400b3448
mov rdi, rax
test rax, rax
je 0x1400b95dd
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xf], 0x41736e6f
mov rcx, rax
mov dword [rbp - 0x15], 0x73655365
mov dword [rbp - 0x1d], 0x6d756e45
mov word [rbp - 0x20], 0x5457
mov word [rbp - 0x18], 0x6172
mov word [rbp - 0x11], 0x6973
mov byte [rbp - 0xb], bl
mov byte [rbp - 0x1e], 0x53
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x19], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400b95d5
mov rax, qword [rbp + 0x30]
lea r8d, [rbx + 1]
mov r9, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400b95f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
xor ebx, ebx
call fcn.1400b3578
mov rdi, rax
test rax, rax
je 0x1400b968d
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x69636570
mov rcx, rax
mov word [rbp - 0x1c], 0x5374
mov word [rbp - 0x1f], 0x4748
mov word [rbp - 0x10], 0x7265
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x16], 0x6f466c61
mov word [rbp - 0xd], 0x7461
mov word [rbp - 0xa], 0x57
mov word [rbp - 0x12], 0x646c
mov byte [rbp - 0xb], 0x68
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0xe], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b9685
xor r9d, r9d
lea r8d, [rbx + 0x25]
mov rdx, rsi
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400b96a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
call fcn.1400b8ff8
mov rbx, rax
test rax, rax
je 0x1400b9718
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x68746150
mov rcx, rax
mov word [rbp - 0x1c], 0x6552
mov word [rbp - 0x12], 0x736e
mov dword [rbp - 0x17], 0x74784565
mov dword [rbp - 0x10], 0x416e6f69
mov word [rbp - 0x19], 0x766f
mov byte [rbp - 0xc], 0
mov byte [rbp - 0x13], 0x65
mov byte [rbp - 0x1a], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b9710
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x1400b9728
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rcx
mov edi, 1
call fcn.14000b2f4
mov rbx, rax
test rax, rax
je 0x1400b97bd
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x6547
mov rcx, rax
mov dword [rbp - 0x1a], 0x5379654b
mov word [rbp - 0x20], 0x6552
mov word [rbp - 0x16], 0x6365
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x13], 0x6972
mov byte [rbp - 0x14], 0x75
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x11], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b97b5
mov r9, rsi
lea edx, [rdi + 3]
mov r8, r14
mov rcx, r15
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400b98d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov word [rbp - 0xa], 0x7261
mov rsi, rcx
mov dword [rbp - 7], 0x65707954
xor ebx, ebx
mov word [rbp - 3], 0x41
mov word [rbp - 0xd], 0x6942
mov word [rbp - 0x10], 0x6547
mov byte [rbp - 0xb], WSASetLastError
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 8], 0x79
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b993f
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400b9a7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov edi, r8d
mov word [rbp - 0xf], 0x6570
or rbx, 0xffffffffffffffff
mov word [rbp - 6], reloc.WS2_32.dll_WSAStartup
mov word [rbp - 9], 0x6563
mov word [rbp - 0xc], 0x7250
mov byte [rbp - 0xd], WSASetLastError
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 7], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], 0x4f
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b9ae3
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret