joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013c98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or ebx, 0xffffffff
mov dword [rbp - 9], 0x496e6f69
mov dword [rbp - 0xd], 0x73736553
mov dword [rbp - 0x16], 0x6f436576
mov dword [rbp - 0x20], 0x47535457
mov dword [rbp - 0x11], 0x656c6f73
mov dword [rbp - 0x1a], 0x69746341
mov word [rbp - 5], 0x64
mov word [rbp - 0x1c], 0x7465
mov byte [rbp - 0x12], WSASetLastError
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013cfd
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140013d0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rdx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x140013d9d
lea rdx, [rbp - 0x20]
mov word [rbp - 0x17], 0x6976
mov rcx, rax
mov dword [rbp - 0xf], 0x4165756c
mov word [rbp - 0x11], 0x6156
mov dword [rbp - 0x1e], 0x70756b6f
mov word [rbp - 0x14], 0x6765
mov byte [rbp - 0xb], bl
mov byte [rbp - 0x12], 0x65
mov word [rbp - 0x20], 0x6f4c
mov word [rbp - 0x1a], 0x7250
mov byte [rbp - 0x18], 0x69
mov byte [rbp - 0x15], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013d95
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140013dbc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x140013e41
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x6e656b6f
mov rcx, rax
mov word [rbp - 0x1c], 0x7250
mov word [rbp - 0x19], 0x6563
mov dword [rbp - 0x20], 0x6e65704f
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1a], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x10], bl
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013e39
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140013e5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x140013ed7
lea rdx, [rbp - 0x10]
mov dword [rbp - 7], 0x416563
mov rcx, rax
mov dword [rbp - 0xf], 0x536e6570
mov word [rbp - 0xa], 0x7672
mov byte [rbp - 0xb], 0x65
mov byte [rbp - 0x10], 0x4f
mov byte [rbp - 8], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013ecf
mov r8d, 0x60000
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x140013ef4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
call fcn.1400b8ff8
mov rdi, rax
test rax, rax
je 0x140013f5f
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xa], 0x7845656c
mov rcx, rax
mov dword [rbp - 6], 0x73747369
mov word [rbp - 2], 0x41
mov dword [rbp - 0x10], 0x68746150
mov word [rbp - 0xc], 0x6946
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013f57
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x140013f78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
call fcn.1400b8ff8
mov rdi, rax
test rax, rax
je 0x140013fec
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1d], 0x6e694668
mov rcx, rax
mov word [rbp - 0x1f], 0x7461
mov word [rbp - 0x11], 0x4165
mov byte [rbp - 0xf], 0
mov dword [rbp - 0x18], 0x656c6946
mov word [rbp - 0x14], 0x614e
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x12], WSASetLastError
mov byte [rbp - 0x19], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013fe4
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400b90d4
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140014000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
mov dword [rbp - 0x10], 0x46746547
or ebx, 0xffffffff
mov word [rbp - 6], 0x65
mov word [rbp - 0xc], 0x6c69
mov word [rbp - 9], 0x6953
mov byte [rbp - 0xa], 0x65
mov byte [rbp - 7], 0x7a
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014059
xor edx, edx
mov rcx, rdi
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x14001406c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov word [rbp - 0x17], 0x7365
mov byte [rbp - 0xe], bl
mov rdi, r9
mov rsi, r8
mov dword [rbp - 0x12], 0x79726f6d
mov r14, rdx
mov dword [rbp - 0x20], 0x74697257
mov r15, rcx
mov dword [rbp - 0x1c], 0x6f725065
mov word [rbp - 0x14], 0x654d
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x18], 0x63
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400140ed
mov r9, rdi
mov qword [rsp + 0x20], rbx
mov r8, rsi
mov rdx, r14
mov rcx, r15
call rax
mov ebx, eax
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14001410c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, 0x80004005
call fcn.1400b9070
mov rbx, rax
test rax, rax
je 0x14001417e
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xf], 0x6572436f
mov rcx, rax
mov word [rbp - 8], 0x7547
mov word [rbp - 5], 0x64
mov word [rbp - 0xa], 0x6574
mov byte [rbp - 0xb], 0x61
mov byte [rbp - 0x10], 0x43
mov byte [rbp - 6], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014176
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x140014198
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, r8
mov edi, 0x80004005
call fcn.1400b3578
mov rbx, rax
test rax, rax
je 0x140014222
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x50726564
mov rcx, rax
mov dword [rbp - 0x13], 0x416874
mov dword [rbp - 0x20], 0x65474853
mov word [rbp - 0x1b], 0x6f46
mov byte [rbp - 0x19], WSAGetLastError
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x14], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14001421a
mov rax, qword [rbp + 0x30]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1c]
call r10
mov edi, eax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14001428c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
mov edi, 1
call fcn.14000b2f4
mov rbx, rax
test rax, rax
je 0x140014314
lea rdx, [rbp - 0x20]
mov word [rbp - 0x13], 0x6972
mov rcx, rax
mov word [rbp - 0x19], 0x7965
mov dword [rbp - 0x1e], 0x74655367
mov dword [rbp - 0x17], 0x75636553
mov word [rbp - 0x10], 0x79
mov byte [rbp - 0x1a], 0x4b
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x11], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001430c
mov r8, rsi
lea edx, [rdi + 3]
mov rcx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140014330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x1400143d8
lea rdx, [rbp - 0x20]
mov word [rbp - 0x11], 0x6972
mov rcx, rax
mov dword [rbp - 0xb], 0x6c636144
mov dword [rbp - 0x16], 0x73654479
mov word [rbp - 0xe], 0x6f74
mov dword [rbp - 0x1d], 0x75636553
mov byte [rbp - 0x12], 0x63
mov byte [rbp - 7], bl
mov word [rbp - 0x19], 0x6972
mov byte [rbp - 0xf], reloc.WS2_32.dll_WSASetLastError
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0xc], WSACleanup
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400143d0
mov r9, rsi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400143f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, r8
mov dword [rbp - 0xf], 0x75747269
mov rsi, rdx
mov dword [rbp - 9], 0x6f6c6c41
mov r14, rcx
mov dword [rbp - 5], 0x784563
xor ebx, ebx
mov byte [rbp - 0x10], 0x56
mov word [rbp - 0xb], 0x6c61
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140014473
mov eax, dword [rbp + 0x30]
mov r9d, 0x3000
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdx, rsi
mov rcx, r14
call r10
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400144d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
xor ebx, ebx
call fcn.14000b2f4
mov rdi, rax
test rax, rax
je 0x140014562
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x1f], 0x696c7075
mov dword [rbp - 0x1b], 0x65746163
mov word [rbp - 0x11], 0x78
mov byte [rbp - 0x17], 0x54
mov byte [rbp - 0x12], 0x45
mov byte [rbp - 0x20], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14001455a
mov rax, qword [rbp + 0x38]
lea r9d, [rbx + 2]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x14001457c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x18], 0x6c694665
xor ebx, ebx
mov word [rbp - 0x14], 0x4e65
mov dword [rbp - 0x20], 0x4d746547
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x11], 0x41656d
mov byte [rbp - 0x12], 0x61
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400145df
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400145f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdi, rdx
mov word [rbp - 0x10], 0x7243
mov rsi, rcx
mov word [rbp - 6], 0x7365
xor ebx, ebx
mov dword [rbp - 0xd], 0x50657461
mov word [rbp - 9], 0x6f72
mov word [rbp - 3], 0x41
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 4], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 7], 0x63
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140014691
mov rax, qword [rbp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov rax, qword [rbp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov rcx, rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], ebx
call r10
mov ebx, eax
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400146ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
call fcn.1400b9070
mov rbx, rax
test rax, rax
je 0x14001470f
lea rdx, [rbp - 0x10]
mov word [rbp - 8], 0x466d
mov rcx, rax
mov dword [rbp - 0x10], 0x61546f43
mov dword [rbp - 6], 0x656572
mov word [rbp - 0xb], 0x4d6b
mov byte [rbp - 9], 0x65
mov byte [rbp - 0xc], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014707
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400b90d4
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x140014720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
mov edi, 1
call fcn.14000b2f4
mov rbx, rax
test rax, rax
je 0x1400147c1
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xf], 0x6e456765
mov rcx, rax
mov word [rbp - 4], 0x41
mov dword [rbp - 9], 0x4579654b
mov byte [rbp - 0x10], 0x52
mov word [rbp - 0xb], 0x6d75
mov byte [rbp - 5], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400147b9
and qword [rsp + 0x38], 0
mov r9, rsi
and qword [rsp + 0x30], 0
mov r8, r14
and qword [rsp + 0x28], 0
mov edx, r15d
and qword [rsp + 0x20], 0
mov rcx, r12
call rax
mov edi, eax
mov rcx, rbx
call fcn.1400b90d4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140014864
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14d, r8d
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.140013a58
mov rdi, rax
test rax, rax
je 0x1400148f4
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x69467465
mov rcx, rax
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0x10], 0x416f66
mov dword [rbp - 0x15], 0x496e6f69
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x11], WSASetLastError
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400148ec
mov r9, rsi
mov r8d, r14d
mov edx, r15d
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140014914
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140013a58
mov rdi, rax
test rax, rax
je 0x1400149a0
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e6f6973
mov rcx, rax
mov word [rbp - 0xa], 0x41
mov dword [rbp - 0x1f], 0x69467465
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0xf], 0x7a69536f
mov word [rbp - 0x11], 0x666e
mov byte [rbp - 0x12], 0x49
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0xb], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014998
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400b90d4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400149bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0xb], 0x72685465
mov byte [rbp - 4], bl
mov word [rbp - 0xd], 0x7461
mov word [rbp - 6], 0x6461
mov word [rbp - 0x10], 0x7243
mov byte [rbp - 7], 0x65
mov byte [rbp - 0xe], 0x65
call fcn.14000b36c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140014a2a
mov rax, qword [rbp + 0x38]
lea r8, [0x140010b20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call r10
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400151cc
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.140083aa0
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret
Function at 0x14003c6a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
jne 0x14003c74a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x2733
jne 0x14003c6fd
mov dword [rsp + 0x24], 1
jmp 0x14003c705
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
jne 0x14003c716
mov dword [rsp + 0x28], 0
jmp 0x14003c71e
mov dword [rsp + 0x28], 1
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14003c743
mov eax, 0x51
jmp 0x14003c759
mov eax, 0x38
jmp 0x14003c759
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x48
ret

Function at 0x14003c8f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x1400e0c68]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
test eax, eax
jne 0x14003c91c
xor eax, eax
test eax, eax
jne 0x14003c922
mov rax, qword [rsp + 0x160]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax*8 + 0x1d0]
mov qword [rsp + 0x38], rax
mov r8d, dword [rsp + 0x168]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call fcn.14003cea0
test eax, eax
je 0x14003c98b
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x1b
mov rax, 0xffffffffffffffff
jmp 0x14003ca43
xor r9d, r9d
mov r8d, dword [rsp + 0x178]
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_send]
cdqe
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x180]
mov dword [rax], 0
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14003ca3e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2733
jne 0x14003c9f3
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x51
jmp 0x14003ca3e
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, dword [rsp + 0x20]
call fcn.14006b500
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, qword [rsp + 0x160]
call fcn.14003c430
mov rax, qword [rsp + 0x160]
mov ecx, dword [rsp + 0x20]
mov dword [rax + 0xd24], ecx
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x37
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140081e90
add rsp, 0x158
ret
Function at 0x14003cd80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0xa6f]
test eax, eax
je 0x14003ce89
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x270], 0
je 0x14003ce14
mov rcx, qword [rsp + 0x50]
call fcn.1400243d0
mov byte [rsp + 0x30], al
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.140024360
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x270]
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.140024360
jmp 0x14003ce89
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14003ce33
cmp dword [rsp + 0x34], 1
je 0x14003ce33
cmp dword [rsp + 0x34], 2
je 0x14003ce33
jmp 0x14003ce89
movsxd rax, dword [rsp + 0x58]
imul rax, rax, 3
lea rcx, [0x1400bcde0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x1d0]
mov r8d, 1
mov edx, 2
mov rcx, rax
call fcn.14008d5fc
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x1d0]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.14008d5fc
add rsp, 0x48
ret