joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [rcx], 0
mov rbx, rcx
jne 0x140004c39
mov eax, 0x2e
mov dword [rsp + 0x36], VarBstrFromDate
lea rcx, [rsp + 0x20]
mov word [rsp + 0x30], ax
mov dword [rsp + 0x2c], 0x320033
mov dword [rsp + 0x24], 0x6e0072
mov dword [rsp + 0x28], 0x6c0065
mov dword [rsp + 0x20], 0x65004b
mov dword [rsp + 0x32], 0x6c0064
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbx], rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x50
pop rbx
ret
mov rax, qword [rcx]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x50
pop rbx
ret

Function at 0x140004d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x140004dfa
xor eax, eax
mov dword [rsp + 0x32], 0x6c006c
mov word [rsp + 0x36], ax
lea rcx, [rsp + 0x20]
mov eax, VarCyFromDisp
mov dword [rsp + 0x24], 0x6c0065
mov word [rsp + 0x30], ax
mov dword [rsp + 0x2c], 0x2e0032
mov dword [rsp + 0x28], 0x33006c
mov dword [rsp + 0x20], 0x680053
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x18], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
mov rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret

Function at 0x140004e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 8], 0
mov rbx, rcx
jne 0x140004e9a
mov eax, 0x61
mov dword [rsp + 0x32], 0x6c006c
mov word [rsp + 0x28], ax
lea rcx, [rsp + 0x20]
xor eax, eax
mov dword [rsp + 0x24], 0x77006c
mov word [rsp + 0x36], ax
mov dword [rsp + 0x2e], 0x64002e
mov dword [rsp + 0x2a], 0x690070
mov dword [rsp + 0x20], 0x680053
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
mov rax, qword [rcx + 8]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
Function at 0x140005700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov rbp, r9
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004cf0
test rax, rax
je 0x140005793
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x72436f43
mov rcx, rax
mov dword [rsp + 0x3d], 0x65636e
mov dword [rsp + 0x34], 0x65746165
mov word [rsp + 0x38], 0x6e49
mov word [rsp + 0x3b], 0x6174
mov byte [rsp + 0x3a], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005793
mov r9, rbp
mov qword [rsp + 0x20], r14
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140005798
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400057b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004cf0
test rax, rax
je 0x140005828
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x6e496f43
mov rcx, rax
mov word [rsp + 0x2b], VarCyFromDisp
mov dword [rsp + 0x24], 0x61697469
mov word [rsp + 0x28], 0x696c
mov byte [rsp + 0x2a], 0x7a
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005828
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret

Function at 0x140005840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.140004f60
mov rcx, rax
call fcn.140004cf0
test rax, rax
je 0x1400058ad
lea rdx, [rsp + 0x20]
mov word [rsp + 0x26], 0x7469
mov rcx, rax
mov dword [rsp + 0x20], 0x6e556f43
mov word [rsp + 0x2c], 0x657a
mov word [rsp + 0x29], 0x6c61
mov byte [rsp + 0x2e], 0
mov word [rsp + 0x24], 0x6e69
mov byte [rsp + 0x28], 0x69
mov byte [rsp + 0x2b], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400058ad
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x48
ret

Function at 0x1400058c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004d80
test rax, rax
je 0x140005940
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2a], 0x5465
mov rcx, rax
mov dword [rsp + 0x2d], 0x76677241
mov dword [rsp + 0x26], 0x6e694c64
mov dword [rsp + 0x20], 0x6d6d6f43
mov byte [rsp + 0x2c], VarBstrFromDate
mov word [rsp + 0x31], 0x57
mov word [rsp + 0x24], 0x6e61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005940
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140005942
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400059d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004ec0
test rax, rax
je 0x140005a3f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x57776f64
mov rcx, rax
mov dword [rsp + 0x20], 0x646e6946
mov byte [rsp + 0x2b], 0
mov word [rsp + 0x24], 0x6957
mov byte [rsp + 0x26], VarBstrFromDate
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005a3f
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140005a41
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140005a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x25], 0x6e616d6d
mov dword [rsp + 0x29], 0x6e694c64
mov dword [rsp + 0x21], 0x6f437465
mov word [rsp + 0x2e], 0x57
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x2d], VarCyFromDisp
call fcn.140004f60
mov rcx, rax
call fcn.140004bc0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005ad0
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x48
ret

Function at 0x140005af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x4c746547
mov dword [rsp + 0x28], 0x726f7272
mov dword [rsp + 0x24], 0x45747361
mov byte [rsp + 0x2c], 0
call fcn.140004f60
mov rcx, rax
call fcn.140004bc0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005b54
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x48
ret

Function at 0x140005b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, r8d
mov dword [rsp + 0x23], 0x75646f4d
mov rdi, rdx
mov word [rsp + 0x21], 0x7465
mov rbx, rcx
mov dword [rsp + 0x27], 0x6946656c
mov dword [rsp + 0x2f], 0x57656d
mov dword [rsp + 0x2b], 0x614e656c
mov byte [rsp + 0x20], 0x47
call fcn.140004f60
mov rcx, rax
call fcn.140004bc0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005be7
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004b20
test rax, rax
je 0x140005c91
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x6d6d6f43
mov rcx, rax
mov dword [rsp + 0x2c], 0x6f72746e
mov word [rsp + 0x30], 0x736c
mov dword [rsp + 0x20], 0x74696e49
mov word [rsp + 0x29], 0x436e
mov byte [rsp + 0x2b], VarBstrFromDate
mov word [rsp + 0x33], 0x78
mov byte [rsp + 0x28], VarBstrFromDate
mov byte [rsp + 0x32], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005c91
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret

Function at 0x140005cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004e20
test rax, rax
je 0x140005d25
lea rdx, [rsp + 0x20]
mov word [rsp + 0x27], 0x6e65
mov rcx, rax
mov dword [rsp + 0x21], 0x41687461
mov word [rsp + 0x2a], 0x57
mov word [rsp + 0x25], 0x7070
mov byte [rsp + 0x29], VarCyFromDisp
mov byte [rsp + 0x20], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005d25
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140005d27
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140005d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004e20
test rax, rax
je 0x140005dbe
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x22], 0x69466874
mov rcx, rax
mov dword [rsp + 0x2b], 0x57737473
mov dword [rsp + 0x27], 0x69784565
mov word [rsp + 0x20], 0x6150
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005dbe
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
Function at 0x140005de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004e20
test rax, rax
je 0x140005e6f
lea rdx, [rsp + 0x20]
mov word [rsp + 0x25], 0x6d65
mov rcx, rax
mov word [rsp + 0x28], 0x6576
mov dword [rsp + 0x2b], 0x53656c69
mov dword [rsp + 0x21], 0x52687461
mov dword [rsp + 0x2f], 0x57636570
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x27], VarBstrFromDate
mov byte [rsp + 0x2a], 0x46
mov byte [rsp + 0x20], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005e6f
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret

Function at 0x140005e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbp, r9
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004ec0
test rax, rax
je 0x140005f04
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x74736f50
mov rcx, rax
mov dword [rsp + 0x24], 0x7373654d
mov dword [rsp + 0x29], 0x576567
mov byte [rsp + 0x28], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005f04
mov r9, rbp
mov r8, rsi
mov edx, edi
mov rcx, rbx
call rax
jmp 0x140005f06
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140005f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004ec0
test rax, rax
je 0x140005f9d
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x11], 0x61737365
mov rcx, rax
mov dword [rbp - 0x16], 0x776f646e
mov dword [rbp - 0x20], 0x69676552
mov word [rbp - 0x1c], 0x7473
mov dword [rbp - 0xd], 0x576567
mov word [rbp - 0x19], 0x5772
mov byte [rbp - 0x12], 0x4d
mov byte [rbp - 0x17], 0x69
mov byte [rbp - 0x1a], VarCyFromDisp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005f9d
mov rcx, rbx
call rax
jmp 0x140005f9f
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140281dd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x140005fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebp, r9d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004ec0
test rax, rax
je 0x140006064
lea rdx, [rsp + 0x40]
mov word [rsp + 0x4a], 0x736f
mov rcx, rax
mov dword [rsp + 0x41], 0x69577465
mov dword [rsp + 0x45], 0x776f646e
mov byte [rsp + 0x4c], 0
mov byte [rsp + 0x49], 0x50
mov byte [rsp + 0x40], 0x53
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140006064
mov eax, dword [rsp + 0xc0]
mov r9d, ebp
mov dword [rsp + 0x30], eax
mov r8d, esi
mov eax, dword [rsp + 0xb8]
mov rdx, rdi
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
call r10
jmp 0x140006066
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140006120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebp, r9d
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
call fcn.140004f60
mov rcx, rax
call fcn.140004ec0
test rax, rax
je 0x14000619e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x78456b6f
mov rcx, rax
mov dword [rsp + 0x20], 0x57746553
mov dword [rsp + 0x24], 0x6f646e69
mov dword [rsp + 0x28], 0x6f487377
mov word [rsp + 0x30], 0x57
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000619e
mov r9d, ebp
mov r8, rsi
mov rdx, rdi
mov ecx, ebx
call rax
jmp 0x1400061a0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140006230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004ec0
test rax, rax
je 0x1400062bc
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x576b6f6f
mov rcx, rax
mov word [rsp + 0x21], 0x686e
mov byte [rsp + 0x20], 0x55
mov dword [rsp + 0x27], 0x6f646e69
mov dword [rsp + 0x2d], 0x6b6f6f48
mov word [rsp + 0x32], 0x78
mov word [rsp + 0x2b], 0x7377
mov byte [rsp + 0x31], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400062bc
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x40
pop rbx
ret
Function at 0x1400062e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140413910]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x58]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.140004f60
mov rcx, rax
call fcn.140004c50
test rax, rax
je 0x1400063ac
lea rdx, [rbp - 0x38]
mov word [rbp - 0x21], 0x616c
mov rcx, rax
mov word [rbp - 0x2f], 0x6576
mov word [rbp - 0x1e], 0x6544
mov dword [rbp - 0x1b], 0x73656369
mov dword [rbp - 0x2d], 0x726f4672
mov word [rbp - 0x35], 0x7461
mov word [rbp - 0x38], 0x7055
mov dword [rbp - 0x26], 0x646e4167
mov word [rbp - 0x17], 0x57
mov word [rbp - 0x32], 0x7244
mov byte [rbp - 0x1f], 0x79
mov byte [rbp - 0x30], 0x69
mov byte [rbp - 0x22], 0x50
mov word [rbp - 0x29], 0x6c50
mov byte [rbp - 0x33], VarCyFromDisp
mov byte [rbp - 0x1c], 0x76
mov byte [rbp - 0x27], 0x75
mov byte [rbp - 0x36], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400063ac
mov r9d, r14d
mov qword [rsp + 0x20], r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x1400063ae
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140281dd0
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400075ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x14000762b
cmp dword [rcx + 0xe8], 0
jne 0x14000762b
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140030a08
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400079e4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007688
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140030a08
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400076e4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.14000771c
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140008624
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14041c504]
test eax, eax
je 0x140008676
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c504]
test eax, eax
jne 0x14000867f
call fcn.14000878c
test eax, eax
je 0x14000869b
lea rdx, [rsp + 0x30]
mov rcx, qword [0x140412028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400086a3
xor eax, eax
jmp 0x1400086fb
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x1400086dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400086df
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400086f8
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x14000e6c8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14000e742
xor r8d, r8d
call fcn.14000e988
mov rsi, rax
test rax, rax
jne 0x14000e6fe
mov eax, edi
jmp 0x14000e758
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14000e6fa
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000ee58
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x14000eeda
xor r8d, r8d
call fcn.14000e988
mov rsi, rax
test rax, rax
je 0x14000ef73
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x14000ef73
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140006430
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x14000ef3e
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x14000ef13
lea eax, [r8 + r8]
mov word [r14 + rax*2], di
mov rax, qword [rsi]
mov rbx, qword [rax + 0x110]
mov rcx, rbx
call fcn.1402821c0
mov r9, r14
mov r8, r12
mov rdx, r15
mov rcx, rsi
call rbx
mov rcx, r14
mov ebx, eax
call fcn.140006438
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x14000fe18
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x14000fe8b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fe9f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000fe9f
mov rcx, rax
call fcn.1402821c0
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x14000fea4
cmp dword [rcx + 8], 0
je 0x14000fe9f
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000fea4
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret