joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d83f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x43
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x47
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x4c
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x57
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x6d
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x6d
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xf
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x10
jae 0x1401d84e8
jmp 0x1401d84ed
call fcn.1401b6334
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x69
call fcn.1401d71d0
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d852e
call qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x58
ret
Function at 0x1401d88f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x4c
mov eax, 1
imul rax, rax, 0xc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xd
jae 0x1401d8931
jmp 0x1401d8936
call fcn.1401b6334
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x45
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x73
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], reloc.OLEAUT32.dll_VarBstrFromDisp
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x47
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], VarBstrFromDisp
call fcn.1401d71d0
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401d8a02
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x58
ret
Function at 0x1401d8b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x47
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x38], 0x57
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x4d
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x4e
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], 0x6d
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x6c
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x46
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x6c
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x12
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x13
jae 0x1401d8c70
jmp 0x1401d8c75
call fcn.1401b6334
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x38], 0x65
call fcn.1401d71d0
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401d8cc7
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d8cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
call fcn.1401d6e60
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d8e8c
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x40], 0x63
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], 0x6c
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x68
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], OpenRegStream
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x6d
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], OpenRegStream
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0x13
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x14
jae 0x1401d8e02
jmp 0x1401d8e07
call fcn.1401b6334
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x50
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x46
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x76
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x65
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d8e81
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d9010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
call fcn.1401d6e60
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d9174
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x78
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 0xf
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x10
jae 0x1401d9096
jmp 0x1401d909b
call fcn.1401b6334
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x46
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x50
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x68
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x45
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x6c
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], 0x74
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d9169
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d9190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], 0
call fcn.1401d7320
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401d9334
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], 0x45
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x48
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], 0x78
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x77
mov eax, 1
imul rax, rax, 0x11
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x12
jae 0x1401d9279
jmp 0x1401d927e
call fcn.1401b6334
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], OpenRegStream
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x6b
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x64
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x73
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401d9329
mov r9d, dword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x70]
call qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d9360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
call fcn.1401d7320
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d94fc
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x64
mov eax, 1
imul rax, rax, 0x13
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x14
jae 0x1401d93bc
jmp 0x1401d93c1
call fcn.1401b6334
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x40], 0x45
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x40], 0x6b
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x6b
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x48
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x68
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x77
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], reloc.SHELL32.dll_OpenRegStream
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x40], 0x78
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], VarBstrFromDisp
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d94f1
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d9520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], 0
call fcn.1401d7320
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401d9658
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 0xb
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xc
jae 0x1401d9582
jmp 0x1401d9587
call fcn.1401b6334
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x46
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x64
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x77
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x64
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x69
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401d964d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x1401d9680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14029b8f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
call fcn.1401d7320
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401d97dc
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x67
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x50
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], VarBstrFromDisp
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x4d
mov eax, 1
imul rax, rax, 0xc
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xd
jae 0x1401d9784
jmp 0x1401d9789
call fcn.1401b6334
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1401d97d1
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401b5f60
add rsp, 0x68
ret
Function at 0x18000ae90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1800b0080]
xor rax, rsp
mov qword [rbp + 0x38], rax
xor edx, edx
mov dword [rsp], 0x10001
mov rax, rcx
mov qword [rbp - 0x80], rdx
or rax, 1
mov qword [rbp - 0x78], rdx
bsr rax, rax
mov r8, rcx
mov dword [rsp + 4], 0x20001
cdqe
mov r9d, 0xa
mov dword [rsp + 8], 0x20002
mov dword [rsp + 0xc], 0x30003
mov dword [rsp + 0x10], 0x40003
mov dword [rsp + 0x14], 0x40004
mov dword [rsp + 0x18], 0x50004
mov dword [rsp + 0x1c], 0x50005
mov dword [rsp + 0x20], 0x60006
mov dword [rsp + 0x24], 0x70006
mov dword [rsp + 0x28], 0x70007
mov dword [rsp + 0x2c], 0x80007
mov dword [rsp + 0x30], 0x80008
mov dword [rsp + 0x34], 0x90009
mov dword [rsp + 0x38], 0xa0009
mov dword [rsp + 0x3c], 0xa000a
mov dword [rsp + 0x40], 0xb000a
mov dword [rsp + 0x44], 0xb000b
mov dword [rsp + 0x48], 0xc000c
mov dword [rsp + 0x4c], 0xd000c
mov dword [rsp + 0x50], 0xd000d
mov dword [rsp + 0x54], 0xe000d
mov dword [rsp + 0x58], 0xe000e
mov dword [rsp + 0x5c], 0xf000f
mov dword [rsp + 0x60], 0x10000f
mov dword [rsp + 0x64], 0x100010
mov dword [rsp + 0x68], 0x110010
mov dword [rsp + 0x6c], 0x110011
mov dword [rsp + 0x70], 0x120012
mov dword [rsp + 0x74], 0x130012
mov dword [rsp + 0x78], 0x130013
mov dword [rsp + 0x7c], 0x140013
movzx ecx, word [rsp + rax*2]
movabs rax, 0x2540be400
mov qword [rbp - 0x28], rax
movabs rax, 0x174876e800
mov qword [rbp - 0x20], rax
movabs rax, 0xe8d4a51000
mov qword [rbp - 0x18], rax
movabs rax, 0x9184e72a000
mov qword [rbp - 0x10], rax
movabs rax, 0x5af3107a4000
mov qword [rbp - 8], rax
movabs rax, 0x38d7ea4c68000
mov qword [rbp], rax
movabs rax, 0x2386f26fc10000
mov qword [rbp + 8], rax
movabs rax, 0x16345785d8a0000
mov qword [rbp + 0x10], rax
movabs rax, 0xde0b6b3a7640000
mov qword [rbp + 0x18], rax
movabs rax, 0x8ac7230489e80000
mov qword [rbp + 0x20], rax
mov eax, ecx
mov qword [rbp - 0x70], r9
mov qword [rbp - 0x68], 0x64
mov qword [rbp - 0x60], 0x3e8
mov qword [rbp - 0x58], 0x2710
mov qword [rbp - 0x50], 0x186a0
mov qword [rbp - 0x48], 0xf4240
mov qword [rbp - 0x40], 0x989680
mov qword [rbp - 0x38], 0x5f5e100
mov qword [rbp - 0x30], 0x3b9aca00
cmp r8, qword [rbp + rcx*8 - 0x80]
setb dl
sub eax, edx
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.180050f70
add rsp, 0x140
pop rbp
ret
Function at 0x180014680
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1800146a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18001471c
mov rdi, r14
mov rcx, rbx
call fcn.180019b00
test rax, rax
jle 0x1800146f4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.180053250
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18001470c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180014714
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1800146b6
sub r14, rdi
jmp 0x1800147ff
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180014733
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180014735
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180014767
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180053250
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1800147fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800147a2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1800147dd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18006912c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1800147fc
cmp rbp, rax
ja 0x1800147b0
test rbp, rbp
je 0x1800147fc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18006912c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret