joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ec58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0xf], 0x576e6f69
mov byte [rbp - 0xb], bl
mov rdi, r9
mov esi, r8d
mov dword [rbp - 0x19], 0x6e49656d
mov r14, rdx
mov word [rbp - 0x15], 0x6f66
mov r15, rcx
mov word [rbp - 0x1d], 0x6f56
mov word [rbp - 0x20], 0x6547
mov word [rbp - 0x12], 0x616d
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x1b], 0x756c
mov byte [rbp - 0x13], WSAStartup
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000ed09
mov eax, dword [rbp + 0x58]
mov r9, rdi
mov dword [rsp + 0x38], eax
mov r8d, esi
mov rax, qword [rbp + 0x50]
mov rdx, r14
mov qword [rsp + 0x30], rax
mov rcx, r15
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000ede8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000ee93
lea rdx, [rbp - 0x20]
mov word [rbp - 0x11], 0x4164
mov rcx, rax
mov byte [rbp - 0xf], bl
mov dword [rbp - 0x16], 0x53746e75
mov dword [rbp - 0x1a], 0x6f636341
mov dword [rbp - 0x20], 0x6b6f6f4c
mov word [rbp - 0x1c], 0x7075
mov byte [rbp - 0x12], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000ee8b
mov rax, qword [rbp + 0x50]
mov r9, rsi
mov qword [rsp + 0x30], rax
mov r8, r14
mov rax, qword [rbp + 0x48]
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r12
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000eeb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov edi, r8d
mov word [rbp - 0xf], 0x6570
mov esi, edx
mov word [rbp - 6], reloc.WS2_32.dll_WSAStartup
mov r14d, ecx
mov word [rbp - 9], 0x6563
or rbx, 0xffffffffffffffff
mov word [rbp - 0xc], 0x7250
mov byte [rbp - 0xd], WSASetLastError
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 7], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x10], 0x4f
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ef27
mov r8d, edi
mov edx, esi
mov ecx, r14d
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x14000ef44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov esi, r8d
mov r14, rdx
mov r15, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000efbf
lea rdx, [rbp - 0x10]
mov dword [rbp - 7], 0x416563
mov rcx, rax
mov dword [rbp - 0xf], 0x536e6570
mov word [rbp - 0xa], 0x7672
mov byte [rbp - 0xb], 0x65
mov byte [rbp - 0x10], 0x4f
mov byte [rbp - 8], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000efb7
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rbx, rax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x14000efdc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
call fcn.14000dd68
mov rdi, rax
test rax, rax
je 0x14000f047
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xa], 0x7845656c
mov rcx, rax
mov dword [rbp - 6], 0x73747369
mov word [rbp - 2], 0x41
mov dword [rbp - 0x10], 0x68746150
mov word [rbp - 0xc], 0x6946
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f03f
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x14000f060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
call fcn.14000dd68
mov rdi, rax
test rax, rax
je 0x14000f0d4
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1d], 0x6e694668
mov rcx, rax
mov word [rbp - 0x1f], 0x7461
mov word [rbp - 0x11], 0x4165
mov byte [rbp - 0xf], 0
mov dword [rbp - 0x18], 0x656c6946
mov word [rbp - 0x14], 0x614e
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x12], WSASetLastError
mov byte [rbp - 0x19], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f0cc
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.14000e5c4
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000f0e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
call fcn.14000dd68
mov rbx, rax
test rax, rax
je 0x14000f15c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x68746150
mov rcx, rax
mov word [rbp - 0x1c], 0x6552
mov word [rbp - 0x12], 0x736e
mov dword [rbp - 0x17], 0x74784565
mov dword [rbp - 0x10], 0x416e6f69
mov word [rbp - 0x19], 0x766f
mov byte [rbp - 0xc], 0
mov byte [rbp - 0x13], 0x65
mov byte [rbp - 0x1a], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f154
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x14000f16c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov word [rbp - 0xc], 0x7365
mov byte [rbp - 2], bl
mov rdi, rdx
mov rsi, rcx
mov word [rbp - 9], 0x3233
mov dword [rbp - 0x10], 0x636f7250
mov dword [rbp - 6], 0x74737269
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 7], 0x46
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f1d1
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x14000f1e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000f299
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x72657551
mov rcx, rax
mov dword [rbp - 0x14], 0x656a624f
mov word [rbp - 7], 0x79
mov word [rbp - 0x1c], 0x5379
mov dword [rbp - 0x10], 0x65537463
mov word [rbp - 0x19], 0x7672
mov dword [rbp - 0xc], 0x69727563
mov byte [rbp - 0x1a], 0x65
mov word [rbp - 0x16], 0x6563
mov byte [rbp - 8], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x17], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000f291
mov rax, qword [rbp + 0x40]
mov r9d, esi
mov r8, r14
mov qword [rsp + 0x20], rax
mov edx, r15d
mov rcx, r12
call r10
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000f33c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
mov edi, 1
call fcn.1400bac9c
mov rbx, rax
test rax, rax
je 0x14000f3d8
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x6547
mov rcx, rax
mov dword [rbp - 0x1a], 0x5379654b
mov word [rbp - 0x20], 0x6552
mov word [rbp - 0x16], 0x6365
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x13], 0x6972
mov byte [rbp - 0x14], 0x75
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x11], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f3d0
mov r9, rsi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14000f500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14d, r8d
mov r15, rdx
mov r12, rcx
mov edi, 1
call fcn.1400bac9c
mov rbx, rax
test rax, rax
je 0x14000f596
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x4f676552
mov rcx, rax
mov word [rbp - 0xc], 0x6570
mov dword [rbp - 9], 0x4579654b
mov word [rbp - 4], 0x57
mov byte [rbp - 0xa], WSASetLastError
mov byte [rbp - 5], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000f58e
mov rax, qword [rbp + 0x40]
mov r9d, esi
mov r8d, r14d
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, r12
call r10
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x14000f5b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov edi, 1
call fcn.1400bac9c
mov rbx, rax
test rax, rax
je 0x14000f668
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x61567972
mov rcx, rax
mov word [rbp - 0x12], 0x4178
mov word [rbp - 0x1c], 0x6575
mov word [rbp - 0x1f], 0x6765
mov word [rbp - 0x15], 0x6575
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x13], 0x45
mov byte [rbp - 0x1d], 0x51
mov byte [rbp - 0x16], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000f660
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r14
mov rax, qword [rbp + 0x40]
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000f688
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14d, edx
mov r15, rcx
mov edi, 1
call fcn.1400bac9c
mov rbx, rax
test rax, rax
je 0x14000f713
lea rdx, [rbp - 0x20]
mov word [rbp - 0x13], 0x6972
mov rcx, rax
mov word [rbp - 0x19], 0x7965
mov dword [rbp - 0x1e], 0x74655367
mov dword [rbp - 0x17], 0x75636553
mov word [rbp - 0x10], 0x79
mov byte [rbp - 0x1a], 0x4b
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x11], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f70b
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14000f730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
mov edi, 0x80004005
call fcn.1400badb8
mov rbx, rax
test rax, rax
je 0x14000f7ca
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x6f466e77
mov rcx, rax
mov dword [rbp - 0x1d], 0x6e4b7465
mov byte [rbp - 0x19], reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp - 0x12], 0x61507265
mov word [rbp - 0x1f], 0x4748
mov word [rbp - 0xe], 0x6874
mov word [rbp - 0x14], 0x646c
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0xc], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f7c2
mov r9, rsi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x14000f7ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14d, r8d
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400badb8
mov rdi, rax
test rax, rax
je 0x14000f892
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x69636570
mov rcx, rax
mov word [rbp - 0x1c], 0x5374
mov word [rbp - 0x1f], 0x4748
mov word [rbp - 0x10], 0x7265
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x16], 0x6f466c61
mov word [rbp - 0xd], 0x7461
mov word [rbp - 0xa], 0x57
mov word [rbp - 0x12], 0x646c
mov byte [rbp - 0xb], 0x68
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0xe], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f88a
mov r9d, esi
mov r8d, r14d
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14000f9c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12d, ecx
mov edi, 1
call fcn.1400bac9c
mov rbx, rax
test rax, rax
je 0x14000fa5d
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x49736569
mov rcx, rax
mov dword [rbp - 0x14], 0x416c6341
mov word [rbp - 0x1f], 0x7465
mov word [rbp - 0x1c], 0x746e
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x15], WSASetLastError
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x1a], WSAStartup
mov byte [rbp - 0x1d], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000fa55
mov r9, rsi
mov r8, r14
mov rdx, r15
mov ecx, r12d
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000e5c4
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x14000fa80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000fb14
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x53746553
mov rcx, rax
mov word [rbp - 0xc], 0x6972
mov word [rbp - 0x17], 0x4f65
mov dword [rbp - 0x11], 0x63655374
mov word [rbp - 9], 0x79
mov dword [rbp - 0x1c], 0x69767265
mov dword [rbp - 0x15], 0x63656a62
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xd], 0x75
mov byte [rbp - 0x18], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000fb0c
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x14000fb70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400bac9c
mov rdi, rax
test rax, rax
je 0x14000fbf7
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xc], 0x68637461
mov rcx, rax
mov word [rbp - 0x1b], 0x6553
mov dword [rbp - 0x18], 0x65636976
mov dword [rbp - 0x12], 0x69446c72
mov dword [rbp - 8], 0x417265
mov word [rbp - 0x14], 0x7443
mov dword [rbp - 0x20], 0x72617453
mov word [rbp - 0xe], 0x7073
mov byte [rbp - 0x19], WSAStartup
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000fbef
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x14000fc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov dword [rbp - 0x1a], 0x50657461
mov rsi, rcx
mov dword [rbp - 0x13], 0x737365
xor ebx, ebx
mov dword [rbp - 0x20], 0x6d726554
mov word [rbp - 0x1c], 0x6e69
mov word [rbp - 0x15], 0x636f
mov byte [rbp - 0x16], WSAStartup
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000fc73
mov edx, edi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x14000fc8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0xf], 0x75747269
mov byte [rbp - 4], bl
mov edi, r9d
mov esi, r8d
mov byte [rbp - 0x10], 0x56
mov r14, rdx
mov dword [rbp - 0xb], 0x6c416c61
mov r15, rcx
mov word [rbp - 6], 0x636f
mov byte [rbp - 7], WSAGetLastError
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000fcfc
mov r9d, edi
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x14000fd18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, rcx
mov dword [rbp - 0x27], 0x6c6c64
lea rcx, [rbp - 0x30]
mov word [rbp - 0x2a], 0x3233
mov rsi, r9
mov byte [rbp - 0x28], 0x2e
mov r14d, r8d
mov dword [rbp - 0x2f], 0x70617374
mov r15d, edx
mov byte [rbp - 0x30], 0x57
xor ebx, ebx
mov byte [rbp - 0x2b], 0x69
call fcn.1400bb43c
mov rdi, rax
test rax, rax
je 0x14000fde3
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xf], 0x41736e6f
mov rcx, rax
mov dword [rbp - 0x15], 0x73655365
mov dword [rbp - 0x1d], 0x6d756e45
mov word [rbp - 0x20], 0x5457
mov word [rbp - 0x18], 0x6172
mov word [rbp - 0x11], 0x6973
mov byte [rbp - 0xb], bl
mov byte [rbp - 0x1e], 0x53
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x19], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000fddb
mov rax, qword [rbp + 0x40]
mov r9, rsi
mov r8d, r14d
mov qword [rsp + 0x20], rax
mov edx, r15d
mov rcx, r12
call r10
mov ebx, eax
mov rcx, rdi
call fcn.14000e5c4
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000fe04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or ebx, 0xffffffff
mov dword [rbp - 9], 0x496e6f69
mov dword [rbp - 0xd], 0x73736553
mov dword [rbp - 0x16], 0x6f436576
mov dword [rbp - 0x20], 0x47535457
mov dword [rbp - 0x11], 0x656c6f73
mov dword [rbp - 0x1a], 0x69746341
mov word [rbp - 5], 0x64
mov word [rbp - 0x1c], 0x7465
mov byte [rbp - 0x12], WSASetLastError
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000fe69
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ff0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov word [rbp - 0x17], 0x7365
mov byte [rbp - 0xe], bl
mov rdi, r9
mov rsi, r8
mov dword [rbp - 0x12], 0x79726f6d
mov r14, rdx
mov dword [rbp - 0x20], 0x74697257
mov r15, rcx
mov dword [rbp - 0x1c], 0x6f725065
mov word [rbp - 0x14], 0x654d
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x18], 0x63
call fcn.1400bad14
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000ff95
mov rax, qword [rbp + 0x40]
mov r9, rdi
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, r15
call r10
mov ebx, eax
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret