joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1804a8ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
cmp byte [0x18067cb57], 0
mov r12, r9
movaps xmmword [rsp + 0x40], xmm6
mov rdi, r8
mov r13, rdx
mov rbx, rcx
jne 0x1804a8afe
cmp byte [0x18067cbb8], 0
jne 0x1804a8afe
xor al, al
jmp 0x1804a8b00
mov al, 1
movsd xmm6, qword [rsp + 0xc0]
movsxd r15, dword [rsp + 0xb0]
mov ebp, dword [rsp + 0xb8]
mov r14, r15
cvtpd2ps xmm6, xmm6
test ebp, ebp
je 0x1804a8cf7
mov qword [rsp + 0x80], rsi
mov rsi, qword [rsp + 0xa0]
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
nop dword [rax]
dec ebp
xor ecx, ecx
test al, al
je 0x1804a8c4c
lea edx, [r15 - 8]
movaps xmm5, xmm6
shufps xmm5, xmm5, 0
xorps xmm7, xmm7
test edx, edx
js 0x1804a8c4c
movdqa xmm8, xmmword [0x1805bf180]
mov r8, rbx
movdqa xmm9, xmmword [0x1805bf4c0]
mov r9, rsi
movdqa xmm10, xmmword [0x1805bf260]
sub r8, rdi
sub r9, rdi
add edx, 8
shr rdx, 3
mov r10, rdi
lea rcx, [rdx*8]
nop dword [rax + rax]
movq xmm2, qword [r8 + r10]
movq xmm4, qword [r10]
lea r10, [r10 + 8]
punpcklbw xmm4, xmm7
punpcklbw xmm2, xmm7
movdqa xmm0, xmm2
punpckhwd xmm2, xmm7
punpcklwd xmm0, xmm7
cvtdq2ps xmm1, xmm0
movdqa xmm0, xmm4
mulps xmm1, xmm5
punpcklwd xmm0, xmm7
cvtdq2ps xmm0, xmm0
divps xmm1, xmm0
movdqa xmm0, xmm4
pcmpeqw xmm4, xmm7
punpckhwd xmm0, xmm7
cvtps2dq xmm3, xmm1
cvtdq2ps xmm0, xmm0
psubd xmm3, xmm8
cvtdq2ps xmm1, xmm2
mulps xmm1, xmm5
divps xmm1, xmm0
cvtps2dq xmm1, xmm1
psubd xmm1, xmm8
packssdw xmm3, xmm1
psubw xmm3, xmm9
movdqa xmm1, xmm3
pxor xmm1, xmm7
pand xmm1, xmm4
pxor xmm1, xmm3
movdqa xmm0, xmm1
psubusw xmm0, xmm10
psubusw xmm1, xmm0
packuswb xmm1, xmm1
movq qword [r9 + r10 - 8], xmm1
sub rdx, 1
jne 0x1804a8bb0
cmp rcx, r14
jge 0x1804a8cc3
mov r10, rdi
lea r8, [rcx + rbx]
mov r11, rsi
sub r10, rbx
sub r11, rbx
mov r9, r14
sub r9, rcx
mov r15d, 0xff
nop dword [rax]
movzx edx, byte [r10 + r8]
test dl, dl
je 0x1804a8cac
movzx ecx, byte [r8]
movd xmm2, ecx
cvtdq2ps xmm2, xmm2
movzx ecx, dl
movd xmm0, ecx
mulss xmm2, xmm6
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
cvtss2si edx, xmm2
cmp edx, r15d
jbe 0x1804a8cae
xor ecx, ecx
test edx, edx
cmovg ecx, r15d
movzx edx, cl
jmp 0x1804a8cae
xor dl, dl
mov byte [r11 + r8], dl
inc r8
sub r9, 1
jne 0x1804a8c70
mov r15d, dword [rsp + 0xb0]
add rsi, qword [rsp + 0xa8]
add rbx, r13
add rdi, r12
test ebp, ebp
jne 0x1804a8b50
movaps xmm10, xmmword [rsp]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
mov rsi, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400021c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.140001580
test eax, eax
js 0x140002424
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x140002253
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop dword [rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140002200
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x140002422
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x1174e0]
movzx eax, byte [rdi + rax*4 + 0x1168e0]
xor r8d, dword [rdi + rax*4 + 0x116ce0]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0x1178e0]
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1170e0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x1168e0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1170e0]
movzx eax, byte [rdi + rcx*4 + 0x1168e0]
xor r8d, dword [rdi + rax*4 + 0x1174e0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x116ce0]
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1178e0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0x1168e0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1170e0]
movzx eax, byte [rdi + rcx*4 + 0x1168e0]
xor r8d, dword [rdi + rax*4 + 0x1174e0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x116ce0]
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1178e0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x1168e0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1170e0]
movzx eax, byte [rdi + rcx*4 + 0x1168e0]
xor r8d, dword [rdi + rax*4 + 0x1174e0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x116ce0]
movzx ecx, byte [rdi + rax*4 + 0x1168e0]
xor r8d, dword [rdi + rcx*4 + 0x1178e0]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x140002280
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400072e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r12
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a8
xor r12b, r12b
mov r14d, edx
mov r15, rcx
test edx, edx
je 0x140007574
test rcx, rcx
je 0x140007574
mov qword [rax - 0x28], rsi
mov qword [rax - 0x30], rdi
mov qword [rax - 0x38], r13
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rbp + 0x1e8], r13d
mov dword [rbp + 0x1e0], 4
call fcn.140007ef0
xor edx, edx
mov dword [rsp + 0x60], 0x130
mov esi, eax
lea ecx, [rdx + 2]
call fcn.14002d940
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140007549
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14002d8a0
cmp eax, 1
jne 0x140007541
mov qword [rsp + 0x2d0], rbx
nop dword [rax + rax]
lea rdx, [rbp - 0x74]
mov dword [rsp + 0x3f], 0x78652e72
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 0x6c707865
mov word [rsp + 0x3d], 0x6572
mov word [rsp + 0x43], 0x65
mov byte [rsp + 0x3c], reloc.WS2_32.dll_WSAGetLastError
call fcn.1400ba35c
test eax, eax
jne 0x14000745b
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call fcn.14002e8e0
mov rbx, rax
test rax, rax
je 0x14000745b
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call fcn.14002ed20
test eax, eax
je 0x140007453
mov r9d, dword [rbp + 0x1e0]
lea rax, [rbp + 0x1e0]
mov rcx, qword [rsp + 0x30]
lea r8, [rbp + 0x1e8]
mov edx, ntohs
mov qword [rsp + 0x20], rax
call fcn.14002cd60
test eax, eax
je 0x140007421
cmp esi, dword [rbp + 0x1e8]
je 0x140007476
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007435
call fcn.1400300f0
mov qword [rsp + 0x30], r13
mov rcx, rbx
call fcn.1400300f0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000745b
call fcn.1400300f0
mov qword [rsp + 0x30], r13
jmp 0x14000745b
mov rcx, rbx
call fcn.1400300f0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14002d810
cmp eax, 1
je 0x140007380
jmp 0x140007539
xor edx, edx
mov dword [rsp + 0x48], r13d
mov r8d, 0x100
lea rcx, [rbp + 0x90]
call fcn.1400abbb0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov r9d, 0x100
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x90]
mov edx, 1
call fcn.14002cd60
test eax, eax
je 0x14000751d
mov rcx, qword [rbp + 0x90]
lea rdx, [rsp + 0x50]
call fcn.14002fd60
test eax, eax
je 0x14000751d
mov rcx, qword [rsp + 0x50]
mov rdx, r14
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x1400074e0
cmp rax, rdx
jae 0x140007518
mov r9, rcx
mov word [rbp + 0x1d8], 0x7325
mov rcx, r15
mov byte [rbp + 0x1da], r12b
lea r8, [rbp + 0x1d8]
call fcn.14002a610
mov rcx, qword [rsp + 0x50]
mov r12b, 1
call fcn.14002ebd0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007531
call fcn.1400300f0
mov qword [rsp + 0x30], r13
mov rcx, rbx
call fcn.1400300f0
mov rbx, qword [rsp + 0x2d0]
mov rcx, rdi
call fcn.1400300f0
mov r13, qword [rsp + 0x290]
movzx eax, r12b
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x2a0]
add rsp, 0x2a8
pop r15
pop r14
pop r12
pop rbp
ret
xor al, al
add rsp, 0x2a8
pop r15
pop r14
pop r12
pop rbp
ret
Function at 0x140007ae0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x140007b8c
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140007af3
not eax
ret

Function at 0x140008630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
lea rbp, [rsp + 0x20]
mov r15, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rbp], r14d
call fcn.140012550
mov dword [rbp], 1
mov qword [rbp + 0x98], r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov dword [rbp + 0xa], 0x336c6c65
mov dword [rbp + 0x10], 0x6c6c64
mov word [rbp + 8], 0x6873
mov word [rbp + 0xe], 0x2e32
lea rcx, [rbp + 8]
call fcn.140030ed0
mov rdi, rax
test rax, rax
je 0x1400087e7
mov edx, 0x2bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140144f98], rax
test rax, rax
je 0x1400086cf
mov rcx, r15
call fcn.140012e80
mov rcx, rax
lea rdx, [rbp + 0x18]
call rbx
mov word [rbp + 0x2f], 0x776f
mov dword [rbp + 0x32], 0x646c6f46
mov dword [rbp + 0x2a], 0x4b746547
mov word [rbp + 0x36], 0x7265
mov dword [rbp + 0x39], 0x687461
mov word [rbp + 0x28], 0x4853
mov byte [rbp + 0x2e], WSASetLastError
mov byte [rbp + 0x31], WSASetLastError
mov byte [rbp + 0x38], 0x50
lea rdx, [rbp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140144fa0], rax
test rax, rax
je 0x1400087de
lea r9, [rbp + 0x98]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x18]
call rax
test eax, eax
jne 0x1400087de
mov rbx, qword [rbp + 0x98]
test rbx, rbx
je 0x1400087de
mov word [rbp + 0x90], 0x7325
mov byte [rbp + 0x92], al
call fcn.140029790
mov r9d, eax
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x140008770
inc ecx
cmp ecx, 0x3fffffff
jg 0x1400087c0
lea r8d, [rcx + rcx]
movsxd rax, ecx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400087a1
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400a9250
sub rsp, rcx
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400137a0
mov r14, rax
mov r8, r14
lea rdx, [rbp + 0x90]
mov rcx, rsi
call fcn.140027fe0
mov rcx, qword [rbp + 0x98]
call fcn.14002e560
mov rcx, rdi
call fcn.140031020
nop
mov rcx, r15
call fcn.1400128c0
mov rax, rsi
lea rsp, [rbp + 0x48]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140009020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, rcx
mov word [rbp - 0x4e], 0x2e45
mov dword [rbp - 0x53], 0x4f4c5058
mov dword [rbp - 0x57], 0x45495c73
mov word [rbp - 0x65], 0x7372
mov dword [rbp - 0x6b], 0x746e6572
mov dword [rbp - 0x7d], 0x6f736f72
mov dword [rbp - 0x5c], 0x74615020
mov dword [rsp + 0x37], 0x694d5c45
mov word [rbp - 0x62], 0x6e6f
mov word [rbp - 0x73], 0x6f64
mov word [rbp - 0x5f], 0x7041
mov dword [rbp - 0x78], 0x69575c74
mov byte [rbp - 0x7e], 0x63
mov word [rsp + 0x35], 0x5241
mov byte [rbp - 0x79], 0x66
mov dword [rbp - 0x71], 0x435c7377
mov word [rbp - 0x67], 0x6556
mov word [rbp - 0x6d], 0x7275
mov byte [rbp - 0x5d], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x4f], 0x52
mov dword [rsp + 0x30], 0x54464f53
mov dword [rbp - 0x4c], 0x455845
mov byte [rbp - 0x63], 0x69
mov byte [rbp - 0x58], 0x68
mov byte [rbp - 0x74], WSASetLastError
mov byte [rsp + 0x34], 0x57
mov byte [rbp - 0x60], 0x5c
lea rax, [rbp + 0x6f]
mov qword [rbp + 0x7f], rax
lea rdx, [0x140118198]
lea rcx, [rbp + 0x6f]
call fcn.140012490
mov rbx, rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x77]
call fcn.140012490
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov rcx, 0xffffffff80000002
call fcn.140008510
test al, al
jne 0x1400091e7
mov word [rsp + 0x2b], 0x45
mov dword [rsp + 0x26], 0x452e4552
mov word [rsp + 0x21], 0x5845
mov byte [rsp + 0x2a], 0x58
mov word [rsp + 0x24], 0x4f4c
mov byte [rsp + 0x20], 0x49
mov byte [rsp + 0x23], 0x50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
mov dword [rbp + 0x3f], eax
mov word [rbp + 0x43], ax
lea rcx, [rbp - 0x31]
call fcn.1400230a0
mov rdx, rax
lea rcx, [rbp + 0x77]
call fcn.140012490
mov rdx, rax
lea rcx, [rbp + 0x6f]
call fcn.140008630
nop
lea rcx, [rbp - 0x31]
call fcn.140012be0
lea r8, [0x14011822c]
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x39]
call fcn.140012f70
nop
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rbp + 0x7f]
call fcn.140012f70
nop
mov rdx, rax
mov rcx, rdi
call fcn.140012d50
nop
lea rcx, [rbp + 0x7f]
call fcn.1400128c0
nop
lea rcx, [rbp - 0x39]
call fcn.1400128c0
nop
lea rcx, [rbp + 0x6f]
call fcn.1400128c0
add rsp, 0x100
pop rdi
pop rbx
pop rbp
ret
Function at 0x140009200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov r14, rcx
lea rcx, [rbp + 0x40]
call fcn.140012550
nop
call fcn.1400075b0
test eax, eax
setne sil
mov dword [rbp - 0xe], 0x656c676f
mov dword [rbp - 6], 0x656d6f
mov dword [rbp - 0xa], 0x72684320
mov word [rbp - 0x10], 0x6f47
mov dword [rbp + 0x30], 0x6f726843
mov word [rbp + 0x35], 0x65
mov byte [rbp + 0x34], WSASetLastError
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x48]
call fcn.140012490
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140008d00
movzx ebx, al
test al, al
jne 0x140009384
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x48]
call fcn.140012490
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.140008d00
movzx ebx, al
test al, al
jne 0x140009384
test sil, sil
je 0x1400092ed
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x48]
call fcn.140012490
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, rdi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.140008d00
movzx ebx, al
test al, al
jne 0x140009384
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x48]
call fcn.140012490
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140008d00
movzx ebx, al
test al, al
jne 0x140009384
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x48]
call fcn.140012490
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.140008d00
movzx ebx, al
test al, al
jne 0x140009384
test sil, sil
je 0x140009379
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x48]
call fcn.140012490
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, rdi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.140008d00
movzx ebx, al
test al, al
jne 0x140009384
mov rcx, rdi
call fcn.140008920
movzx ebx, al
mov byte [r14], 1
lea rcx, [rbp + 0x40]
call fcn.1400128c0
movzx eax, bl
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140009910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
mov dword [rbp - 0x19], 0x36363037
mov dword [rbp - 0x1f], 0x2e302e36
mov word [rbp - 0x1b], 0x2e35
mov byte [rbp - 0x20], 0x36
mov byte [rbp - 0x15], 0
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.140012490
nop
mov rcx, rbx
call fcn.140028b50
test al, al
jne 0x140009a29
xor eax, eax
mov dword [rbp + 0x40], eax
mov dword [rbp + 0x48], eax
mov qword [rbp - 0x28], rax
mov rcx, rbx
call fcn.140012e80
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.14002d030
mov r14d, eax
test eax, eax
je 0x140009a29
mov ecx, r14d
call fcn.1400a8a70
mov rsi, rax
mov rcx, rbx
call fcn.140012e80
mov rcx, rax
mov r9, rsi
mov r8d, r14d
mov edx, dword [rbp + 0x40]
call fcn.14002d0e0
test eax, eax
je 0x140009a21
lea r9, [rbp + 0x48]
lea r8, [rbp - 0x28]
lea rdx, [0x14011822c]
mov rcx, rsi
call fcn.14002d1b0
test eax, eax
je 0x140009a21
cmp dword [rbp + 0x48], 0
je 0x140009a21
mov rax, qword [rbp - 0x28]
cmp dword [rax], 0xfeef04bd
jne 0x140009a21
mov dword [rbp - 0xc], 0x64252e64
mov dword [rbp - 0x10], 0x252e6425
mov dword [rbp - 8], 0x64252e
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 8]
movzx eax, cx
shr ecx, 0x10
movzx r9d, r8w
shr r8d, 0x10
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.140027fe0
mov rcx, rsi
call fcn.1400a8a78
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.140012450
nop
lea rcx, [rbp - 0x30]
call fcn.1400128c0
nop
mov rcx, rbx
call fcn.1400128c0
mov rax, rdi
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000ad90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rbx, rcx
mov dword [rsp + 0x30], 0
lea rdx, [0x140118198]
call fcn.140012490
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400abbb0
mov dword [rsp + 0x24], 0x6b636954
mov dword [rsp + 0x20], 0x5f4f5353
mov word [rsp + 0x29], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x28], 0x65
mov r9, 0xffffffffffffffff
lea r8, str.4c689ff34163448994defd8858bfcaf0
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400ba18c
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x20]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400b9fd8
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14002a640
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000ad30
mov dword [rbp + 0x71], 0x25783830
mov byte [rbp + 0x70], 0x25
mov word [rbp + 0x75], reloc.WS2_32.dll_WSAStartup
mov dword [rbp + 0x68], 0x74745f
lea r9, [rbp + 0x68]
mov r8d, eax
lea rdx, [rbp + 0x70]
mov rcx, rbx
call fcn.140027fe0
mov rax, rbx
mov rbx, qword [rsp + 0x178]
add rsp, 0x150
pop rbp
ret
Function at 0x1400101e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x20]
call fcn.140012550
nop
mov dword [rbp + 0x18], 0x400
mov dword [rbp + 0x20], 0x6e65704f
mov byte [rbp + 0x24], 0
mov edx, 0x400
lea rcx, [rbp - 0x20]
call fcn.1400281d0
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
mov r8, rbx
mov ebx, 2
mov edx, ebx
xor ecx, ecx
call fcn.14002fe20
lea edx, [rbx - 3]
lea rcx, [rbp - 0x20]
call fcn.140028fc0
lea rcx, [rbp - 0x20]
call fcn.140028bf0
mov dword [rbp - 0x17], 0x46455249
mov byte [rbp - 0x18], 0x46
mov word [rbp - 0x12], 0x58
mov byte [rbp - 0x13], 0x4f
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x20]
call fcn.140027e80
test eax, eax
jns 0x14001032b
mov dword [rbp + 0x2a], 0x454c474f
mov word [rbp + 0x28], 0x4f47
mov byte [rbp + 0x2e], 0
xor r8d, r8d
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x20]
call fcn.140027e80
test eax, eax
js 0x1400102d0
mov dword [rbp - 0x2e], 0x454d4f52
mov word [rbp - 0x30], 0x4843
mov byte [rbp - 0x2a], 0
xor r8d, r8d
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.140027e80
test eax, eax
js 0x1400102d0
mov ebx, 1
jmp 0x14001032b
mov dword [rbp - 0xb], 0x45524f
mov dword [rbp - 0xf], 0x4c505845
mov byte [rbp - 0x10], 0x49
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x20]
call fcn.140027e80
test eax, eax
js 0x1400102fd
mov ebx, 3
jmp 0x14001032b
mov dword [rbp - 0x27], 0x47444553
mov byte [rbp - 0x28], 0x4d
mov word [rbp - 0x23], 0x45
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.140027e80
test eax, eax
js 0x140010329
mov ebx, 4
jmp 0x14001032b
xor ebx, ebx
lea rcx, [rbp - 0x20]
call fcn.1400128c0
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140028210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x13], 0x72656c6c
mov rbx, rcx
mov dword [rbp - 0x18], 0x74736e49
mov word [rbp - 0x1e], 0x626f
mov word [rbp - 0x1b], 0x5c6c
mov word [rbp - 0xb], 0x78
mov word [rbp - 0xe], 0x7475
mov byte [rbp - 0x19], 0x43
mov word [rbp - 0x20], 0x6c47
mov byte [rbp - 0x14], 0x61
mov byte [rbp - 0xf], 0x4d
mov byte [rbp - 0xc], 0x65
mov byte [rbp - 0x1c], 0x61
call fcn.140012490
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400282a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x736e4946
mov rbx, rcx
mov dword [rbp - 0x1f], 0x61626f6c
mov word [rbp - 0x14], 0x6174
mov word [rbp - 0xe], 0x754d
mov word [rbp - 0x11], 0x656c
mov dword [rbp - 0xc], 0x786574
mov word [rbp - 0x1a], 0x465c
mov byte [rbp - 0xf], WSACleanup
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x12], WSAGetLastError
call fcn.140012490
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400285a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x6e494549
mov rbx, rcx
mov dword [rbp - 0x20], 0x626f6c47
mov word [rbp - 0x1c], 0x6c61
mov dword [rbp - 0xc], 0x786574
mov dword [rbp - 0x12], 0x72656c6c
mov byte [rbp - 0x1a], 0x5c
mov word [rbp - 0xe], 0x754d
mov word [rbp - 0x14], 0x6174
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
call fcn.140012490
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret