joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ac80
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001c890
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002ad10]
lea rsi, [0x14002fd40]
mov rdi, rcx
test r11d, r11d
jne 0x14000acf3
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a600
test al, al
je 0x14000addf
lea rcx, [rsp + 0x20]
call fcn.14001124c
movsxd r11, dword [0x14002ad10]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002ad10], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ad34
mov r10, rsi
nop
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ad24
add rax, 2
test ecx, ecx
jne 0x14000ad10
test edx, edx
je 0x14000ad57
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ad00
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ad40
cmp rax, 2
jne 0x14000ad5b
cmp word [rdi + 2], 0x3a
jne 0x14000ad5b
mov al, 1
jmp 0x14000adbe
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ad88
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ad88
mov bl, 1
jmp 0x14000ad8c
test bl, bl
je 0x14000adb3
cmp dword [0x14002ad10], 0x400
jge 0x14000adb3
mov rcx, rdi
call fcn.14001124c
movsxd rdx, dword [0x14002ad10]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002ad10], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b600
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000aad0
int3
Function at 0x14000af00
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002ad18]
test rcx, rcx
je 0x14000af3b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000af2e
mov rcx, qword [0x14002ad18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002ad18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140039d70], 0
je 0x14000b02e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025930]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14002d540]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b00f
test al, 0x10
je 0x14000b00f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000afb5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000bed4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bf1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bf1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bf1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bf1e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bf1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bf20
xor al, al
add rsp, 0x28
ret

Function at 0x14000d854
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000d6e7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d6e7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d6e7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d6e7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d6e7
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d6e7
cmp dword [rcx + 0xf8], 0
je 0x14000d6e7
mov ecx, ebx
call fcn.14000d788
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000d578
cmp dword [rbp + 0x20], 0
je 0x14000d734
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d73c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d680
Function at 0x14001c7d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001c7f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001c7f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000286c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
mov rbx, rcx
mov dword [rbp - 0x2e], 0x2d0045
lea r14d, [rax + 0x35]
lea edx, [rax + 0x38]
lea edi, [rax + 0x46]
mov word [rbp - 0x50], r14w
lea r15d, [rax + 0x44]
lea r8d, [rax + 0x34]
lea ecx, [rax + 0x37]
mov dword [rbp - 0xa], r14d
mov word [rbp - 0x20], di
mov word [rbp - 0x34], r8w
mov word [rbp - 0x3e], dx
mov word [rbp - 0xc], r15w
mov word [rbp - 0x1a], cx
mov word [rbp - 0x2a], dx
mov dword [rbp - 0x18], 0x390046
mov dword [rbp - 0x46], 0x330046
mov dword [rbp - 0x24], 0x2d0046
mov dword [rbp - 0x10], 0x420044
mov dword [rbp - 0x3c], 0x420030
mov dword [rbp - 0x32], 0x410030
mov dword [rbp - 0x4e], 0x320034
mov dword [rbp - 0x1e], 0x360032
mov dword [rbp - 0x42], 0x2d0041
mov dword [rbp - 0x38], 0x2d0039
mov dword [rbp - 0x28], 0x430034
mov dword [rbp - 0x4a], 0x370037
mov dword [rbp - 0x14], 0x360043
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov word [rbx], ax
mov dword [rbp - 0x60], eax
cmp word [rbp - 0x50], ax
je 0x14000294e
lea rcx, [rbp - 0x50]
call fcn.14018cfa0
lea rdx, [rbp - 0x50]
mov r8, rax
mov rcx, rbx
call fcn.14000353c
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140002f58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
mov rbx, rcx
mov rcx, qword [rcx + 0x180]
xor edi, edi
test rcx, rcx
je 0x140002f94
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x180], rdi
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
call fcn.14018df40
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
call fcn.1400046f4
lea rcx, [rsp + 0x50]
call fcn.140004930
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x3e], VarBstrFromDisp
mov dword [rsp + 0x36], 0x2e0078
mov dword [rsp + 0x30], 0x640064
mov dword [rsp + 0x3a], 0x6c0064
mov word [rsp + 0x34], ax
call fcn.140004820
lea rcx, [rsp + 0x50]
call fcn.1400048ac
test eax, eax
je 0x140003088
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x180], rax
test rax, rax
je 0x140003088
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x6465654e
mov word [rsp + 0x27], 0x6168
mov word [rsp + 0x2a], 0x6567
mov word [rsp + 0x24], 0x6f54
mov byte [rsp + 0x2c], dil
mov byte [rsp + 0x26], 0x43
mov byte [rsp + 0x29], VarBstrFromDisp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x188], rax
test rax, rax
je 0x140003088
mov r8, qword [rbx + 0x180]
xor r9d, r9d
mov rdx, rax
lea ecx, [r9 + 3]
call fcn.140004bbc
mov qword [rbx + 0x190], rax
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140003740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.DriverInstallToolx64Wnd.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x1400073eb
cmp dword [rcx + 0xd8], 0
jne 0x1400073eb
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14002615c
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140007748
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
mov rbx, rcx
mov dword [rbp - 0x2e], 0x2d0045
lea r14d, [rax + 0x35]
lea edx, [rax + 0x38]
lea edi, [rax + 0x46]
mov word [rbp - 0x50], r14w
lea r15d, [rax + 0x44]
lea r8d, [rax + 0x34]
lea ecx, [rax + 0x37]
mov dword [rbp - 0xa], r14d
mov word [rbp - 0x20], di
mov word [rbp - 0x34], r8w
mov word [rbp - 0x3e], dx
mov word [rbp - 0xc], r15w
mov word [rbp - 0x1a], cx
mov word [rbp - 0x2a], dx
mov dword [rbp - 0x18], 0x390046
mov dword [rbp - 0x46], 0x330046
mov dword [rbp - 0x24], 0x2d0046
mov dword [rbp - 0x10], 0x420044
mov dword [rbp - 0x3c], 0x420030
mov dword [rbp - 0x32], 0x410030
mov dword [rbp - 0x4e], 0x320034
mov dword [rbp - 0x1e], 0x360032
mov dword [rbp - 0x42], 0x2d0041
mov dword [rbp - 0x38], 0x2d0039
mov dword [rbp - 0x28], 0x430034
mov dword [rbp - 0x4a], 0x370037
mov dword [rbp - 0x14], 0x360043
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov word [rbx], ax
mov dword [rbp - 0x60], eax
cmp word [rbp - 0x50], ax
je 0x140003842
lea rcx, [rbp - 0x50]
call fcn.14018cfa0
lea rdx, [rbp - 0x50]
mov r8, rax
mov rcx, rbx
call fcn.14000353c
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140003b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0xc], 0x6c006c
mov dword [rbp - 0x1c], 0x63006d
mov dword [rbp - 0x10], 0x64002e
mov dword [rbp - 0x18], 0x6c0074
mov word [rbp - 8], ax
mov dword [rbp - 0x14], 0x320033
mov dword [rbp - 0x20], 0x6f0043
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add rsp, 0x40
pop rbp
ret

Function at 0x140003bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x65004b
mov dword [rbp - 0x1a], 0x65006e
mov dword [rbp - 0xa], VarBstrFromDisp
mov dword [rbp - 0x16], 0x33006c
mov word [rbp - 0x1c], ax
mov dword [rbp - 0xe], 0x6c0064
mov dword [rbp - 0x12], 0x2e0032
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rsp, 0x40
pop rbp
ret

Function at 0x140003c1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x640077
mov dword [rbp - 0x10], 0x6c006c
mov dword [rbp - 0x14], 0x64002e
mov dword [rbp - 0x20], 0x65004e
mov word [rbp - 0xc], ax
mov dword [rbp - 0x18], 0x760065
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add rsp, 0x40
pop rbp
ret
Function at 0x140003cf8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rcx, [rbp - 0x20]
mov dword [rbp - 0xc], VarBstrFromDisp
mov dword [rbp - 0x20], 0x680053
mov dword [rbp - 0x14], 0x2e0069
mov dword [rbp - 0x1c], 0x77006c
mov dword [rbp - 0x10], 0x6c0064
mov dword [rbp - 0x18], 0x700061
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add rsp, 0x40
pop rbp
ret

Function at 0x140004368
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14d, r8d
mov r15, rdx
mov r12, rcx
mov edi, 1
call fcn.140003c60
mov rbx, rax
test rax, rax
je 0x140004409
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x12], 0x6563
mov word [rbp - 0x15], 0x6174
mov dword [rbp - 0x1a], 0x6e496574
mov byte [rbp - 0x16], 0x73
mov dword [rbp - 0x1e], 0x61657243
mov word [rbp - 0x20], 0x6f43
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x13], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140004400
mov rax, qword [rbp + 0x40]
mov r9, rsi
mov r8d, r14d
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000442c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, 1
call fcn.140003c60
mov rbx, rax
test rax, rax
je 0x140004493
lea rdx, [rbp - 0x10]
mov rcx, rax
mov dword [rbp - 7], 0x657a69
mov dword [rbp - 0xc], 0x61697469
mov dword [rbp - 0x10], 0x6e496f43
mov byte [rbp - 8], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000448a
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400044ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
call fcn.140003c60
mov rbx, rax
test rax, rax
je 0x140004502
lea rdx, [rbp - 0x10]
mov rcx, rax
mov dword [rbp - 6], 0x657a696c
mov dword [rbp - 0x10], 0x6e556f43
mov dword [rbp - 0xa], 0x61697469
mov word [rbp - 0xc], 0x6e69
mov byte [rbp - 2], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400044f9
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x140004510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140003ca8
mov rdi, rax
test rax, rax
je 0x140004592
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x15], 0x6f54
mov word [rbp - 0x1b], 0x646e
mov dword [rbp - 0x20], 0x6d6d6f43
mov dword [rbp - 0x12], 0x57766772
mov dword [rbp - 0x19], 0x656e694c
mov byte [rbp - 0x13], 0x41
mov byte [rbp - 0x1c], 0x61
mov byte [rbp - 0xe], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004589
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x43746547
mov word [rbp - 4], 0x656e
mov word [rbp - 7], 0x4c64
mov word [rbp - 2], 0x57
mov dword [rbp - 0xc], 0x616d6d6f
mov byte [rbp - 8], WSASetLastError
mov byte [rbp - 5], 0x69
call fcn.140003bd0
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004693
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400046a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0x10], 0x4c746547
mov dword [rbp - 7], 0x726f72
mov dword [rbp - 0xb], 0x72457473
mov byte [rbp - 0xc], 0x61
call fcn.140003bd0
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400046e7
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400046f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, r8d
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x20], 0x4d746547
mov word [rbp - 0x13], 0x614e
mov dword [rbp - 0x11], 0x57656d
mov word [rbp - 0x1b], 0x7564
mov dword [rbp - 0x18], 0x6c694665
mov byte [rbp - 0x19], 0x6c
mov byte [rbp - 0x14], 0x65
mov byte [rbp - 0x1c], VarBstrFromDisp
call fcn.140003bd0
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000476b
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004788
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140003b10
mov rdi, rax
test rax, rax
je 0x140004806
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x1c], 0x6d6d6f43
mov word [rbp - 0xf], 0x4573
mov dword [rbp - 0x20], 0x74696e49
mov dword [rbp - 0x17], 0x6e6f436e
mov word [rbp - 0x12], 0x6f72
mov byte [rbp - 0x10], 0x6c
mov word [rbp - 0xd], 0x78
mov byte [rbp - 0x18], VarBstrFromDisp
mov byte [rbp - 0x13], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400047fd
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140003cf8
mov rdi, rax
test rax, rax
je 0x14000488f
lea rdx, [rbp - 0x10]
mov rcx, rax
mov dword [rbp - 0x10], 0x68746150
mov dword [rbp - 0xa], 0x646e6570
mov word [rbp - 6], 0x57
mov word [rbp - 0xc], 0x7041
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004886
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400048ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
call fcn.140003cf8
mov rdi, rax
test rax, rax
je 0x140004918
lea rdx, [rbp - 0x10]
mov rcx, rax
mov dword [rbp - 8], 0x73697845
mov dword [rbp - 0xe], 0x69466874
mov dword [rbp - 4], 0x577374
mov word [rbp - 0x10], 0x6150
mov word [rbp - 0xa], 0x656c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000490f
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x140004930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140003cf8
mov rdi, rax
test rax, rax
je 0x1400049a9
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x11], 0x57636570
mov dword [rbp - 0x17], 0x6c694665
mov dword [rbp - 0x1e], 0x65526874
mov word [rbp - 0x1a], 0x6f6d
mov word [rbp - 0x13], 0x5365
mov byte [rbp - 0xd], bl
mov word [rbp - 0x20], 0x6150
mov byte [rbp - 0x18], 0x76
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400049a0
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400049c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.140003d3c
mov rdi, rax
test rax, rax
je 0x140004a43
lea rdx, [rbp - 0x10]
mov rcx, rax
mov dword [rbp - 9], 0x65676173
mov word [rbp - 0xb], 0x7365
mov dword [rbp - 0x10], 0x74736f50
mov word [rbp - 5], 0x57
mov byte [rbp - 0xc], 0x4d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004a3a
mov r9, rsi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x140004a64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140003d3c
mov rdi, rax
test rax, rax
je 0x140004ae8
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x14], 0x776f
mov dword [rbp - 0x19], 0x6e695772
mov word [rbp - 0x1e], 0x6967
mov word [rbp - 0x1b], 0x6574
mov dword [rbp - 0x11], 0x61737365
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x1c], 0x73
mov dword [rbp - 0xd], 0x576567
mov byte [rbp - 0x15], 0x64
mov byte [rbp - 0x12], 0x4d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004adf
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret