joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov eax, 0x41
lea rdx, [rbp - 0x50]
mov word [rbp - 0x42], ax
mov eax, 0x30
lea r9d, [rdi + 0x2d]
lea r11d, [rdi + 0x34]
lea r10d, [rdi + 0x46]
mov word [rbp - 0x3c], ax
mov word [rbp - 0x32], ax
mov eax, 0x35
mov rbx, rcx
mov dword [rbp - 0x60], edi
mov dword [rbp - 0x2c], 0x38002d
mov dword [rbp - 0x40], 0x38002d
mov word [rbp - 0x50], ax
mov dword [rbp - 0x26], 0x460043
mov dword [rbp - 0x36], 0x34002d
mov dword [rbp - 0x16], 0x430039
mov dword [rbp - 0x20], 0x320046
mov dword [rbp - 0x4e], 0x320034
mov word [rbp - 0x22], r9w
mov dword [rbp - 0x46], 0x330046
mov dword [rbp - 0x3a], 0x390042
mov dword [rbp - 0x30], 0x450041
mov dword [rbp - 0x4a], 0x370037
mov dword [rbp - 0x12], 0x440036
mov dword [rbp - 0xe], 0x440042
mov word [rbp - 0x28], r11w
mov dword [rbp - 0x1c], 0x370036
mov dword [rbp - 0xa], VarI4FromR4
mov word [rbp - 0x18], r10w
call fcn.140001b70
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140001140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x160]
sub rsp, reloc.OLEAUT32.dll_VarI1FromDec
mov rbx, rcx
mov rcx, qword [rcx + 0x180]
xor edi, edi
test rcx, rcx
je reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140003ea0
mov qword [rbx + 0x180], rdi
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, reloc.OLEAUT32.dll_VarI1FromDec
mov word [rsp + 0x50], di
call fcn.14017ce40
lea rdx, [rsp + 0x50]
mov r8d, reloc.OLEAUT32.dll_VarI1FromDec
xor ecx, ecx
call fcn.140003d70
lea rcx, [rsp + 0x50]
call fcn.1400039f0
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x36], 0x2e0078
mov dword [rsp + 0x30], 0x640064
mov dword [rsp + 0x3e], VarBstrFromDisp
mov dword [rsp + 0x3a], 0x6c0064
mov word [rsp + 0x34], ax
call fcn.140003a90
lea rcx, [rsp + 0x50]
call fcn.140003b20
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, [rsp + 0x50]
call fcn.140003e40
mov qword [rbx + 0x180], rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x26], 0x69746163
mov word [rsp + 0x20], 0x6f4d
mov word [rsp + 0x23], 0x6669
mov dword [rsp + 0x2b], 0x44426e
mov byte [rsp + 0x2a], VarBstrFromDisp
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x25], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x188], rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov r8, qword [rbx + 0x180]
xor r9d, r9d
mov rdx, rax
lea ecx, [r9 + 3]
call fcn.140003880
mov qword [rbx + 0x190], rax
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140002570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne reloc.OLEAUT32.dll_VarI1FromDec
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe reloc.OLEAUT32.dll_VarI1FromDec
nop
cmp rbx, rcx
jae reloc.OLEAUT32.dll_VarI1FromDec
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne reloc.OLEAUT32.dll_VarI1FromDec
cmp rbx, rcx
jb reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140002c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov eax, 0x41
lea rdx, [rbp - 0x50]
mov word [rbp - 0x42], ax
mov eax, 0x30
lea r9d, [rdi + 0x2d]
lea r11d, [rdi + 0x34]
lea r10d, [rdi + 0x46]
mov word [rbp - 0x3c], ax
mov word [rbp - 0x32], ax
mov eax, 0x35
mov rbx, rcx
mov dword [rbp - 0x60], edi
mov dword [rbp - 0x2c], 0x38002d
mov dword [rbp - 0x40], 0x38002d
mov word [rbp - 0x50], ax
mov dword [rbp - 0x26], 0x460043
mov dword [rbp - 0x36], 0x34002d
mov dword [rbp - 0x16], 0x430039
mov dword [rbp - 0x20], 0x320046
mov dword [rbp - 0x4e], 0x320034
mov word [rbp - 0x22], r9w
mov dword [rbp - 0x46], 0x330046
mov dword [rbp - 0x3a], 0x390042
mov dword [rbp - 0x30], 0x450041
mov dword [rbp - 0x4a], 0x370037
mov dword [rbp - 0x12], 0x440036
mov dword [rbp - 0xe], 0x440042
mov word [rbp - 0x28], r11w
mov dword [rbp - 0x1c], 0x370036
mov dword [rbp - 0xa], VarI4FromR4
mov word [rbp - 0x18], r10w
call fcn.140001b70
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140003090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.DriverInstallToolx64Wnd.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, reloc.OLEAUT32.dll_VarI1FromDec
jne reloc.OLEAUT32.dll_VarI1FromDec
cmp dword [rcx + 0xd8], 0
jne reloc.OLEAUT32.dll_VarI1FromDec
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140024d98
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140007250
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400030c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
xor eax, eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x34], 0x6c006c
mov dword [rsp + 0x24], 0x63006d
mov dword [rsp + 0x30], 0x64002e
mov dword [rsp + 0x28], 0x6c0074
mov word [rsp + 0x38], ax
mov dword [rsp + 0x2c], 0x320033
mov dword [rsp + 0x20], 0x6f0043
call fcn.140003e40
add rsp, 0x48
ret

Function at 0x140003110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
xor eax, eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x640077
mov dword [rsp + 0x30], 0x6c006c
mov dword [rsp + 0x2c], 0x64002e
mov dword [rsp + 0x20], 0x65004e
mov word [rsp + 0x34], ax
mov dword [rsp + 0x28], 0x760065
call fcn.140003e40
add rsp, 0x48
ret

Function at 0x1400031b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x65004b
mov dword [rsp + 0x26], 0x65006e
mov dword [rsp + 0x36], VarBstrFromDisp
mov dword [rsp + 0x2a], 0x33006c
mov word [rsp + 0x24], ax
mov dword [rsp + 0x32], 0x6c0064
mov dword [rsp + 0x2e], 0x2e0032
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rsp, 0x48
ret

Function at 0x140003310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400030c0
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x24], 0x6d6d6f43
mov word [rsp + 0x31], 0x4573
mov dword [rsp + 0x20], 0x74696e49
mov dword [rsp + 0x29], 0x6e6f436e
mov word [rsp + 0x2e], 0x6f72
mov byte [rsp + 0x30], 0x6c
mov word [rsp + 0x33], 0x78
mov byte [rsp + 0x28], VarBstrFromDisp
mov byte [rsp + 0x2d], VarBoolFromUI1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400033b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov esi, r9d
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.140003110
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x1b], 0x616c5064
mov word [rbp - 0x28], 0x7669
mov dword [rbp - 0x21], 0x67756c50
mov dword [rbp - 0x13], 0x73656369
mov dword [rbp - 0x30], 0x61647055
mov dword [rbp - 0x2c], 0x72446574
mov dword [rbp - 0x25], 0x726f4672
mov word [rbp - 0x1d], 0x6e41
mov word [rbp - 0xf], 0x57
mov word [rbp - 0x16], 0x6544
mov byte [rbp - 0x17], 0x79
mov byte [rbp - 0x14], 0x76
mov byte [rbp - 0x26], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rax, qword [rbp + 0x40]
mov r9d, esi
mov r8, r14
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400034a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140003160
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x28], 0x776f646e
mov word [rsp + 0x32], 0x78
mov dword [rsp + 0x2d], 0x6b6f6f48
mov dword [rsp + 0x24], 0x69576b6f
mov byte [rsp + 0x31], 0x45
mov dword [rsp + 0x20], 0x6f686e55
mov byte [rsp + 0x2c], VarBoolFromUI1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140003530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.140003160
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x27], 0x65676173
mov word [rsp + 0x25], 0x7365
mov dword [rsp + 0x20], 0x74736f50
mov word [rsp + 0x2b], 0x57
mov byte [rsp + 0x24], 0x4d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov r9, rsi
mov r8, rbp
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140003640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
call fcn.140003210
mov rbx, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x2a], 0x657a696c
mov dword [rsp + 0x20], 0x6e556f43
mov dword [rsp + 0x26], 0x61697469
mov word [rsp + 0x24], 0x6e69
mov byte [rsp + 0x2e], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
call rax
mov rcx, rbx
call fcn.140003ea0
add rsp, 0x30
pop rbx
ret

Function at 0x1400036a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ebx, 1
call fcn.140003210
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x29], 0x657a69
mov dword [rsp + 0x24], 0x61697469
mov dword [rsp + 0x20], 0x6e496f43
mov byte [rsp + 0x28], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140003720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov r15, rcx
mov ebx, 1
call fcn.140003210
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x30]
mov rcx, rax
mov word [rsp + 0x3e], 0x6563
mov word [rsp + 0x3b], 0x6174
mov dword [rsp + 0x36], 0x6e496574
mov byte [rsp + 0x3a], VarBoolFromUI1
mov dword [rsp + 0x32], 0x61657243
mov word [rsp + 0x30], 0x6f43
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x3d], VarBstrFromDisp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rax, qword [rsp + 0x90]
mov r9, rsi
mov r8d, ebp
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x140003880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov esi, r9d
mov rbp, r8
mov r14, rdx
mov r15d, ecx
xor ebx, ebx
call fcn.140003160
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x2e], 0x577845
mov word [rsp + 0x2a], 0x6f48
mov word [rsp + 0x24], 0x6e69
mov word [rsp + 0x21], 0x7465
mov word [rsp + 0x27], 0x776f
mov byte [rsp + 0x20], 0x53
mov word [rsp + 0x2c], 0x6b6f
mov byte [rsp + 0x23], 0x57
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x29], VarBoolFromUI1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov r9d, esi
mov r8, rbp
mov rdx, r14
mov ecx, r15d
call rax
mov rbx, rax
mov rcx, rdi
call fcn.140003ea0
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x140003940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
call fcn.140003260
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov word [rsp + 0x2b], 0x6f54
mov word [rsp + 0x25], 0x646e
mov dword [rsp + 0x20], 0x6d6d6f43
mov dword [rsp + 0x2e], 0x57766772
mov dword [rsp + 0x27], 0x656e694c
mov byte [rsp + 0x2d], 0x41
mov byte [rsp + 0x24], 0x61
mov byte [rsp + 0x32], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rdx, rsi
mov rcx, rbp
call rax
mov rbx, rax
mov rcx, rdi
call fcn.140003ea0
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400039f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400032c0
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x2f], 0x57636570
mov dword [rsp + 0x29], 0x6c694665
mov dword [rsp + 0x22], 0x65526874
mov word [rsp + 0x26], 0x6f6d
mov word [rsp + 0x2d], 0x5365
mov byte [rsp + 0x33], bl
mov word [rsp + 0x20], 0x6150
mov byte [rsp + 0x28], 0x76
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140003a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
call fcn.1400032c0
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x68746150
mov dword [rsp + 0x26], 0x646e6570
mov word [rsp + 0x2a], 0x57
mov word [rsp + 0x24], 0x7041
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rdx, rsi
mov rcx, rbp
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140003b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
call fcn.1400032c0
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x28], 0x73697845
mov dword [rsp + 0x22], 0x69466874
mov dword [rsp + 0x2c], 0x577374
mov word [rsp + 0x20], 0x6150
mov word [rsp + 0x26], 0x656c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140003bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x20], 0x4c746547
mov dword [rsp + 0x29], 0x726f72
mov dword [rsp + 0x25], 0x72457473
mov byte [rsp + 0x24], 0x61
call fcn.1400031b0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
call rax
add rsp, 0x38
ret
add rsp, 0x38
ret

Function at 0x140003c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140003160
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x14], 0x776f
mov dword [rbp - 0x19], 0x6e695772
mov word [rbp - 0x1e], 0x6967
mov word [rbp - 0x1b], 0x6574
mov dword [rbp - 0x11], 0x61737365
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x1c], VarBoolFromUI1
mov dword [rbp - 0xd], 0x576567
mov byte [rbp - 0x15], 0x64
mov byte [rbp - 0x12], 0x4d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov esi, r9d
mov ebp, r8d
mov r14, rdx
mov r15, rcx
xor ebx, ebx
call fcn.140003160
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x40]
mov rcx, rax
mov word [rsp + 0x47], 0x776f
mov dword [rsp + 0x49], 0x736f50
mov dword [rsp + 0x42], 0x6e695774
mov word [rsp + 0x40], 0x6553
mov byte [rsp + 0x46], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov eax, dword [rsp + 0xa0]
mov r9d, esi
mov r8d, ebp
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov rdx, r14
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov rcx, r15
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret

Function at 0x140003e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x25], 0x61726269
mov dword [rsp + 0x21], 0x4c64616f
mov dword [rsp + 0x29], 0x577972
mov byte [rsp + 0x20], 0x4c
call fcn.1400031b0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rbx
call rax
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret

Function at 0x140003f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
call fcn.140003160
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x26], 0x54776f64
mov dword [rsp + 0x21], 0x69577465
mov dword [rsp + 0x2b], 0x577478
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x25], VarBstrFromDisp
mov byte [rsp + 0x20], 0x53
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rdx, rsi
mov rcx, rbp
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140003ea0
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140006eb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.DriverInstallToolx64Wnd.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, reloc.OLEAUT32.dll_VarI1FromDec
jne reloc.OLEAUT32.dll_VarI1FromDec
cmp dword [rcx + 0xd8], 0
jne reloc.OLEAUT32.dll_VarI1FromDec
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140024d98
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140007250
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006f50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140024d98
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140006fe4
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret