joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401465d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov word [rbp - 0x1a], 0x7261
mov rdi, rcx
mov dword [rbp - 0x17], 0x65707954
xor ebx, ebx
mov word [rbp - 0x13], 0x41
mov word [rbp - 0x1d], 0x6942
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x18], 0x79
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140146641
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14014665c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x1401466e8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x6e656b6f
mov rcx, rax
mov word [rbp - 0x1c], 0x7250
mov word [rbp - 0x19], 0x6563
mov dword [rbp - 0x20], 0x6e65704f
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1a], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x10], bl
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401466df
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140147650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, edx
mov word [rbp - 0x21], 0x5332
mov edi, ecx
mov dword [rbp - 0x1b], 0x746f68
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x30], 0x61657243
mov dword [rbp - 0x2c], 0x6f546574
mov dword [rbp - 0x26], 0x706c6568
mov word [rbp - 0x28], 0x6c6f
mov dword [rbp - 0x1f], 0x7370616e
mov byte [rbp - 0x22], 0x33
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401476c8
mov edx, esi
mov ecx, edi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140147764
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r13, qword [rbp + 0x68]
mov r12d, r9d
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.14000af28
mov rbx, rax
test rax, rax
je 0x140147806
lea rdx, [rbp - 0x28]
mov word [rbp - 0x1e], 0x7845
mov rcx, rax
mov word [rbp - 0x27], 0x6765
mov byte [rbp - 0x28], 0x52
mov word [rbp - 0x24], 0x6570
mov word [rbp - 0x21], 0x654b
mov byte [rbp - 0x25], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x22], WSAGetLastError
mov byte [rbp - 0x1f], 0x79
mov word [rbp - 0x1c], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401477fd
mov r9d, r12d
mov qword [rsp + 0x20], r13
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1401478fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14d, r8d
mov dword [rbp - 0x18], 0x6c694665
mov rsi, rdx
mov word [rbp - 0x14], 0x4e65
mov rdi, rcx
mov dword [rbp - 0x20], 0x4d746547
xor ebx, ebx
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x11], 0x41656d
mov byte [rbp - 0x12], 0x61
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014796d
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140147a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
mov word [rbp + 0x32], 0x2e45
mov dword [rbp + 0x2d], 0x4f4c5058
mov dword [rbp + 0x29], 0x45495c73
mov word [rbp + 0x1b], 0x7372
mov dword [rbp + 0x15], 0x746e6572
mov dword [rbp + 3], 0x6f736f72
mov dword [rbp + 0x24], 0x74615020
mov dword [rbp - 2], 0x694d5c45
mov word [rbp + 0x1e], 0x6e6f
mov word [rbp + 0xd], 0x6f64
mov word [rbp + 0x21], 0x7041
mov dword [rbp + 8], 0x69575c74
mov byte [rbp + 2], SHCoCreateInstance
mov word [rbp - 4], 0x5241
mov byte [rbp + 7], reloc.SHELL32.dll_SHCoCreateInstance
mov dword [rbp + 0xf], 0x435c7377
mov word [rbp + 0x19], 0x6556
mov word [rbp + 0x13], 0x7275
mov byte [rbp + 0x23], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp + 0x31], 0x52
mov dword [rbp - 9], 0x54464f53
mov dword [rbp + 0x34], 0x455845
mov byte [rbp + 0x1d], VarBstrFromUI1
mov byte [rbp + 0x28], VarBstrFromUI1
mov byte [rbp + 0xc], WSAGetLastError
mov byte [rbp - 5], 0x57
mov byte [rbp + 0x20], 0x5c
lea rax, [rbp - 0x31]
mov qword [rbp - 0x39], rax
lea rdx, [0x140156609]
lea rcx, [rbp - 0x31]
call fcn.140022164
mov rbx, rax
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.140022164
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov rcx, 0xffffffff80000002
call fcn.140017048
test al, al
jne 0x140147c2f
mov word [rbp - 0x16], 0x45
mov dword [rbp - 0x1b], 0x452e4552
mov word [rbp - 0x20], 0x5845
mov byte [rbp - 0x17], 0x58
mov word [rbp - 0x1d], 0x4f4c
mov byte [rbp - 0x21], 0x49
mov byte [rbp - 0x1e], 0x50
lea rdx, [0x140160030]
lea rcx, [rbp - 0x49]
call fcn.14014b144
nop
lea r8, [0x140156a50]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.140022b90
nop
lea r8, [rbp - 0x21]
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.140022b90
nop
mov rdx, rax
mov rcx, rdi
call fcn.140022730
nop
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140147bf2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140147c11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140147c2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140051d60
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140147c5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x140147cf8
lea rdx, [rbp - 0x20]
mov word [rbp - 0x17], 0x6976
mov rcx, rax
mov dword [rbp - 0xf], 0x4165756c
mov word [rbp - 0x11], 0x6156
mov dword [rbp - 0x1e], 0x70756b6f
mov word [rbp - 0x14], 0x6765
mov byte [rbp - 0xb], bl
mov byte [rbp - 0x12], SHCoCreateInstance
mov word [rbp - 0x20], 0x6f4c
mov word [rbp - 0x1a], 0x7250
mov byte [rbp - 0x18], VarBstrFromUI1
mov byte [rbp - 0x15], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140147cef
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140147d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.14000af28
mov rdi, rax
test rax, rax
je 0x140147dc4
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x24], 0x72637365
mov rcx, rax
mov dword [rbp - 0x2b], 0x69727563
mov dword [rbp - 0x30], 0x53746553
mov dword [rbp - 0x1a], 0x6c6361
mov word [rbp - 0x1f], 0x7470
mov word [rbp - 0x1c], 0x4472
mov word [rbp - 0x26], 0x4479
mov byte [rbp - 0x2c], SHCoCreateInstance
mov byte [rbp - 0x20], VarBstrFromUI1
mov byte [rbp - 0x27], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140147dbb
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140147df4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov dword [rbp + 0x39], 0x65727275
lea r9, [rbp - 0x11]
mov dword [rbp + 0x31], 0x4e207377
lea r8, [rbp - 9]
mov word [rbp + 0x1f], 0x5c5c
lea rdx, [rbp + 0x17]
mov word [rbp + 0x22], 0x6369
lea eax, [rbx + 4]
mov word [rbp + 0x42], 0x6973
mov dword [rbp - 0x11], eax
mov rcx, 0xffffffff80000002
mov dword [rbp - 0x19], eax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x15]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x3e], 0x72655674
mov word [rbp + 0x2a], 0x5c5c
mov word [rbp + 0x1a], 0x5754
mov dword [rbp + 0x2d], 0x6f646e69
mov word [rbp + 0x45], WSAGetLastError
mov dword [rbp + 0x25], 0x666f736f
mov byte [rbp + 0x24], WSACleanup
mov word [rbp + 0x36], 0x5c5c
mov word [rbp + 0x17], 0x4f53
mov byte [rbp + 0x3d], WSAGetLastError
mov byte [rbp + 0x35], 0x54
mov word [rbp + 0x1d], 0x4552
mov byte [rbp + 0x29], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 0x19], 0x46
mov byte [rbp + 0x21], Ordinal_79
mov byte [rbp + 0x44], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp + 0x1c], 0x41
mov byte [rbp + 0x2c], 0x57
mov byte [rbp + 0x38], 0x43
mov dword [rbp - 1], 0x726f6a61
mov word [rbp + 0xf], WSACleanup
mov word [rbp - 9], 0x7543
mov word [rbp - 6], 0x6572
mov word [rbp - 3], 0x4d74
mov word [rbp + 0xc], 0x626d
mov dword [rbp + 5], 0x6f697372
mov word [rbp + 9], 0x4e6e
mov byte [rbp - 4], WSAGetLastError
mov word [rbp + 3], 0x6556
mov byte [rbp - 7], WSACleanup
mov byte [rbp + 0xb], 0x75
mov byte [rbp + 0xe], SHCoCreateInstance
mov dword [rbp - 0x15], ebx
call fcn.14000514c
test eax, eax
movzx ecx, bl
lea edx, [rbx + 1]
cmove ecx, edx
mov al, cl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret

Function at 0x140148220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x15], 0x7478
mov byte [rbp - 0x13], bl
mov rsi, rdx
mov rdi, rcx
mov dword [rbp - 0x1f], 0x65636f72
mov dword [rbp - 0x1a], 0x4e323373
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x16], SHCoCreateInstance
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140148289
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140148574
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12d, r9d
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.140016794
mov rdi, rax
test rax, rax
je 0x14014861c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x69636570
mov rcx, rax
mov word [rbp - 0x1c], 0x5374
mov word [rbp - 0x1f], 0x4748
mov word [rbp - 0x10], 0x7265
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x16], 0x6f466c61
mov word [rbp - 0xd], 0x7461
mov word [rbp - 0xa], 0x57
mov word [rbp - 0x12], 0x646c
mov byte [rbp - 0xb], VarBstrFromUI1
mov byte [rbp - 0x1d], SHCoCreateInstance
mov byte [rbp - 0xe], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140148613
mov r9d, r12d
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401489bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rdx
mov r15, rcx
call fcn.140023a0c
mov rcx, rax
test rax, rax
je 0x140148bb8
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x21], rbx
call fcn.140012a1c
test eax, eax
setne r14b
mov dword [rbp + 0x18], 0x6c676f6f
mov byte [rbp + 0x17], 0x47
mov word [rbp + 0x23], SHCoCreateInstance
mov word [rbp + 0x1d], 0x4320
mov word [rbp + 0x20], 0x6f72
mov byte [rbp + 0x1c], SHCoCreateInstance
mov byte [rbp + 0x1f], VarBstrFromUI1
mov byte [rbp + 0x22], WSAGetLastError
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.140022164
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14014f83c
mov dil, al
test al, al
jne 0x140148ac3
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x11]
call fcn.140022164
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.14014f83c
mov dil, al
test al, al
jne 0x140148ac3
test r14b, r14b
je 0x140148ac3
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140022164
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.14014f83c
mov dil, al
mov dword [rbp + 0x11], 0x656d6f72
mov word [rbp + 0xf], 0x6843
mov byte [rbp + 0x15], 0
test dil, dil
jne 0x140148b74
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 1]
call fcn.140022164
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14014f83c
mov dil, al
test al, al
jne 0x140148b74
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 7]
call fcn.140022164
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.14014f83c
mov dil, al
test al, al
jne 0x140148b74
test r14b, r14b
je 0x140148b69
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x29]
call fcn.140022164
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.14014f83c
mov dil, al
test al, al
jne 0x140148b74
mov rcx, rsi
call fcn.1400040c0
mov dil, al
mov byte [r15], 1
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140148b92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov al, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400232a8
int3
Function at 0x140148c1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
xor ebx, ebx
call fcn.140009bbc
mov rdi, rax
test rax, rax
je 0x140148ca2
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x73654d68
mov rcx, rax
mov word [rbp - 0x14], 0x6761
mov dword [rbp - 0x1f], 0x61707369
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
mov word [rbp - 0x11], 0x41
mov word [rbp - 0x1b], 0x6374
mov byte [rbp - 0x12], SHCoCreateInstance
mov byte [rbp - 0x20], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140148c99
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140148cc8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12d, dword [rbp + 0x60]
mov r15d, r9d
mov r14, r8
mov dword [rbp - 0x1f], 0x75747269
mov rsi, rdx
mov dword [rbp - 0x19], 0x6f6c6c41
mov rdi, rcx
mov dword [rbp - 0x15], 0x784563
xor ebx, ebx
mov byte [rbp - 0x20], 0x56
mov word [rbp - 0x1b], 0x6c61
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140148d46
mov r9d, r15d
mov dword [rsp + 0x20], r12d
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14014a14c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, qword [rbp + 0x60]
xor ebx, ebx
mov byte [rbp - 0xe], bl
mov r15, r9
mov r14, r8
mov word [rbp - 0x17], 0x7365
mov rsi, rdx
mov dword [rbp - 0x12], 0x79726f6d
mov rdi, rcx
mov dword [rbp - 0x20], 0x74697257
mov dword [rbp - 0x1c], 0x6f725065
mov word [rbp - 0x14], 0x654d
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x18], SHCoCreateInstance
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014a1d6
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14014b144
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x40], rcx
and dword [rbp - 0x50], 0
call fcn.140023a0c
mov rcx, rax
test rax, rax
je 0x14014b273
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbx], rax
mov dword [rbp - 0x50], 1
and qword [rbp - 0x48], 0
mov dword [rbp - 0x31], 0x6c6c642e
mov dword [rbp - 0x38], 0x6c656873
mov word [rbp - 0x34], 0x336c
mov byte [rbp - 0x2d], 0
mov byte [rbp - reloc.WLDAP32.dll_Ordinal_50], 0x32
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14014b254
mov word [rbp - 0x22], 0x6f6e
mov dword [rbp - 0x18], 0x68746150
mov word [rbp - 0x28], 0x4853
mov word [rbp - 0x25], 0x7465
mov dword [rbp - 0x1d], 0x65646c6f
mov byte [rbp - 0x23], 0x4b
mov word [rbp - 0x20], 0x6e77
mov byte [rbp - 0x19], WSACleanup
mov byte [rbp - 0x26], 0x47
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x1e], 0x46
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401a78e0], rax
test rax, rax
je 0x14014b24b
lea r9, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call rax
test eax, eax
jne 0x14014b24b
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x14014b24b
mov rcx, rbx
call fcn.1400227b0
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400232a8
int3
Function at 0x14014f7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
or ebx, 0xffffffff
mov dword [rbp - 0x19], 0x496e6f69
mov dword [rbp - 0x1d], 0x73736553
mov dword [rbp - 0x26], 0x6f436576
mov dword [rbp - 0x30], 0x47535457
mov dword [rbp - 0x21], 0x656c6f73
mov dword [rbp - 0x2a], 0x69746341
mov word [rbp - 0x15], SHCoCreateInstance
mov word [rbp - 0x2c], 0x7465
mov byte [rbp - 0x22], WSAGetLastError
call fcn.140002838
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014f823
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1401523b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov edi, 0x80004005
call fcn.140016794
mov rbx, rax
test rax, rax
je 0x140152453
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x20], 0x50726564
mov rcx, rax
mov dword [rbp - 0x1b], 0x416874
mov dword [rbp - 0x28], 0x65474853
mov word [rbp - 0x23], 0x6f46
mov byte [rbp - 0x21], WSAGetLastError
mov byte [rbp - 0x24], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1c], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14015244a
mov r9d, r12d
mov qword [rsp + 0x20], r13
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140051d60
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret