joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140104004
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1401040d6
test rbx, rbx
je 0x1401040dc
test r9, r9
je 0x1401040e2
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401040bf
cmp dword [rsp + 0x48], 3
jne 0x1401040bf
test eax, eax
jne 0x1401040bf
cmp dword [rdi], eax
je 0x1401040bf
mov ecx, dword [rdi]
call fcn.140003d98
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401040b3
cmp dword [rsp + 0x48], 3
jne 0x1401040b3
test eax, eax
jne 0x1401040b3
mov eax, 1
jmp 0x1401040c1
mov rcx, qword [rbx]
call fcn.140003da0
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.14002665c
int3
call fcn.14002665c
int3
call fcn.14002665c
int3

Function at 0x140104514
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140104525
xor eax, eax
jmp 0x140104553
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14010455c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14010456d
xor eax, eax
jmp 0x140104591
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14015acf0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402a9558]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402a0e70]
test eax, eax
je 0x14015ad3b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402a0e70]
test eax, eax
jne 0x14015ad44
call fcn.1400132e0
test eax, eax
je 0x14015ad60
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14029a120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14015ad68
xor eax, eax
jmp 0x14015adcd
test rbx, rbx
jne 0x14015ad88
lea rcx, str.ChooseColorW
call fcn.1400c37e0
mov rbx, rax
test rax, rax
je 0x14015ad9b
mov qword [0x1402a9558], rax
mov rcx, rbx
call fcn.1401b6804
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14015adb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14015adb2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14015adcb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401650d8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402a9908]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402a0e70]
test eax, eax
je 0x140165123
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402a0e70]
test eax, eax
jne 0x14016512c
call fcn.1400132e0
test eax, eax
je 0x140165148
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14029a120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140165150
xor eax, eax
jmp 0x1401651b5
test rbx, rbx
jne 0x140165170
lea rcx, str.GetOpenFileNameW
call fcn.1400c37e0
mov rbx, rax
test rax, rax
je 0x140165183
mov qword [0x1402a9908], rax
mov rcx, rbx
call fcn.1401b6804
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140165198
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14016519a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401651b3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1401651cc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402a9910]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402a0e70]
test eax, eax
je 0x140165217
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402a0e70]
test eax, eax
jne 0x140165220
call fcn.1400132e0
test eax, eax
je 0x14016523c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14029a120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140165244
xor eax, eax
jmp 0x1401652a9
test rbx, rbx
jne 0x140165264
lea rcx, str.GetSaveFileNameW
call fcn.1400c37e0
mov rbx, rax
test rax, rax
je 0x140165277
mov qword [0x1402a9910], rax
mov rcx, rbx
call fcn.1401b6804
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14016528c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14016528e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401652a7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401b5bec
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402aabd8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402a0e70]
test eax, eax
je 0x1401b5c37
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402a0e70]
test eax, eax
jne 0x1401b5c40
call fcn.1400132e0
test eax, eax
je 0x1401b5c5c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14029a120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401b5c64
xor eax, eax
jmp 0x1401b5cc9
test rbx, rbx
jne 0x1401b5c84
lea rcx, str.PrintDlgW
call fcn.1400c37e0
mov rbx, rax
test rax, rax
je 0x1401b5c97
mov qword [0x1402aabd8], rax
mov rcx, rbx
call fcn.1401b6804
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401b5cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401b5cae
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401b5cc7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1401ca5ec
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1401ca3c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401ca3c0
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401ca3c0
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401ca3c0
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401ca3c0
cmp dword [rcx + 0x84], 0xe
jbe 0x1401ca3c0
cmp dword [rcx + 0xf8], esi
je 0x1401ca3c0
mov ecx, r14d
call fcn.1401ca508
mov ecx, 2
call fcn.1401cf518
nop
cmp byte [0x1402ab6b0], 0
jne 0x1401ca48a
mov r15d, 1
mov eax, r15d
xchg dword [0x1402ab6a4], eax
test ebx, ebx
jne 0x1401ca433
mov rdi, qword [0x14029b8f8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1402ab6a8]
cmp rcx, rax
je 0x1401ca42a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x1401e9400]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1402ab6c0]
jmp 0x1401ca43f
cmp ebx, r15d
jne 0x1401ca445
lea rcx, [0x1402ab6d8]
call fcn.1401caafc
nop
test ebx, ebx
jne 0x1401ca45c
lea rdx, [0x1401e9b10]
lea rcx, [0x1401e9af0]
call fcn.1401ca280
lea rdx, [0x1401e9b20]
lea rcx, [0x1401e9b18]
call fcn.1401ca280
movzx eax, byte [0x1402ab6b0]
test esi, esi
cmove eax, r15d
mov byte [0x1402ab6b0], al
jmp 0x1401ca48a
mov ecx, 2
call fcn.1401cf56c
test esi, esi
jne 0x1401ca4a1
mov ecx, r14d
call fcn.1401ca4bc
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1401ca350
Function at 0x1401d76b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 1
call fcn.1401d70c0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d77ea
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 0xc
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xd
jae 0x1401d770c
jmp 0x1401d7711
call fcn.1401b6334
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x7a
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x49
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x6c
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x65
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d77df
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d7810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 1
call fcn.1401d70c0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d79b9
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x50], 0x63
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x50], 0x61
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x50], 0x49
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x50], 0x73
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x50], 0x61
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x50], 0x43
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x50], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x50], 0x74
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x50], 0x65
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x50], 0x43
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x50], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x50], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x50], VarBstrFromDisp
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x50], 0x74
mov eax, 1
imul rax, rax, 0x10
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0x11
jae 0x1401d7931
jmp 0x1401d7936
call fcn.1401b6334
mov rax, qword [rsp + 0x40]
mov byte [rsp + rax + 0x50], 0
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x50], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x50], VarBstrFromDisp
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1401d79ae
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x78
ret
Function at 0x1401d79e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.1401d70c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401d7b20
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x43
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x7a
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], reloc.SHELL32.dll_OpenRegStream
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xe
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xf
jae 0x1401d7aad
jmp 0x1401d7ab2
call fcn.1401b6334
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x6c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401d7b15
call qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x58
ret
Function at 0x1401d7cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
call fcn.1401d7320
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d7e50
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], OpenRegStream
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 0xe
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xf
jae 0x1401d7d5f
jmp 0x1401d7d64
call fcn.1401b6334
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x78
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x77
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], OpenRegStream
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x64
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d7e45
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d7e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
call fcn.1401d7320
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d8036
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x77
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], OpenRegStream
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x67
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0x16
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x17
jae 0x1401d7f74
jmp 0x1401d7f79
call fcn.1401b6334
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x40], 0x67
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x64
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], 0x4d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d802b
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d8060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
call fcn.1401d7560
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d820a
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x6d
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x40], 0x45
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x49
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x40], 0x6c
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x40], 0x78
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x6d
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x14
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x15
jae 0x1401d81c6
jmp 0x1401d81cb
call fcn.1401b6334
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d81ff
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d8230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], 0
call fcn.1401d6f90
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401d83ca
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], OpenRegStream
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x64
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x6d
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x6d
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x4c
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], 0x67
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x40], 0x76
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x41
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x12
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x13
jae 0x1401d8380
jmp 0x1401d8385
call fcn.1401b6334
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401d83bf
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret