joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400035b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor r8d, r8d
mov dword [rbp + 0x1b], 0x38002d
mov eax, 0x41
mov dword [rbp + 7], 0x38002d
mov word [rbp + 5], ax
mov rbx, rcx
mov eax, 0x30
mov dword [rbp + 0x21], 0x460043
mov word [rbp + 0xb], ax
lea r10d, [r8 + 0x2d]
mov word [rbp + 0x15], ax
lea edi, [r8 + 0x34]
mov eax, 0x35
mov dword [rbp + 0x11], 0x34002d
mov word [rbp - 9], ax
lea r11d, [r8 + 0x46]
mov dword [rbp + 0x31], 0x430039
mov dword [rbp + 0x27], 0x320046
mov dword [rbp - 7], 0x320034
mov word [rbp + 0x25], r10w
mov dword [rbp + 1], 0x330046
mov dword [rbp + 0xd], 0x390042
mov dword [rbp + 0x17], 0x450041
mov dword [rbp - 3], 0x370037
mov dword [rbp + 0x35], 0x440036
mov dword [rbp + 0x39], 0x440042
mov word [rbp + 0x1f], di
mov dword [rbp + 0x2b], 0x370036
mov dword [rbp + 0x3d], 0x35
mov word [rbp + 0x2f], r11w
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r8
mov word [rcx], r8w
mov dword [rbp - 0x19], r8d
cmp word [rbp - 9], r8w
je 0x1400036ab
lea rax, [rbp - 9]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400036a0
lea rdx, [rbp - 9]
call fcn.1400042f0
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140281d90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140004670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor r8d, r8d
mov dword [rbp + 0x1b], 0x38002d
mov eax, 0x41
mov dword [rbp + 7], 0x38002d
mov word [rbp + 5], ax
mov rbx, rcx
mov eax, 0x30
mov dword [rbp + 0x21], 0x460043
mov word [rbp + 0xb], ax
lea r10d, [r8 + 0x2d]
mov word [rbp + 0x15], ax
lea edi, [r8 + 0x34]
mov eax, 0x35
mov dword [rbp + 0x11], 0x34002d
mov word [rbp - 9], ax
lea r11d, [r8 + 0x46]
mov dword [rbp + 0x31], 0x430039
mov dword [rbp + 0x27], 0x320046
mov dword [rbp - 7], 0x320034
mov word [rbp + 0x25], r10w
mov dword [rbp + 1], 0x330046
mov dword [rbp + 0xd], 0x390042
mov dword [rbp + 0x17], 0x450041
mov dword [rbp - 3], 0x370037
mov dword [rbp + 0x35], 0x440036
mov dword [rbp + 0x39], 0x440042
mov word [rbp + 0x1f], di
mov dword [rbp + 0x2b], 0x370036
mov dword [rbp + 0x3d], 0x35
mov word [rbp + 0x2f], r11w
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r8
mov word [rcx], r8w
mov dword [rbp - 0x19], r8d
cmp word [rbp - 9], r8w
je 0x14000476b
lea rax, [rbp - 9]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140004760
lea rdx, [rbp - 9]
call fcn.1400042f0
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140281d90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140004b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [rcx], 0
mov rbx, rcx
jne 0x140004bf9
mov eax, 0x2e
mov dword [rsp + 0x36], VarBstrFromDate
lea rcx, [rsp + 0x20]
mov word [rsp + 0x30], ax
mov dword [rsp + 0x2c], 0x320033
mov dword [rsp + 0x24], 0x6e0072
mov dword [rsp + 0x28], 0x6c0065
mov dword [rsp + 0x20], 0x65004b
mov dword [rsp + 0x32], 0x6c0064
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbx], rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x50
pop rbx
ret
mov rax, qword [rcx]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x50
pop rbx
ret

Function at 0x140004d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x140004dba
xor eax, eax
mov dword [rsp + 0x32], 0x6c006c
mov word [rsp + 0x36], ax
lea rcx, [rsp + 0x20]
mov eax, VarCyFromDisp
mov dword [rsp + 0x24], 0x6c0065
mov word [rsp + 0x30], ax
mov dword [rsp + 0x2c], 0x2e0032
mov dword [rsp + 0x28], 0x33006c
mov dword [rsp + 0x20], 0x680053
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x18], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
mov rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret

Function at 0x140004de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 8], 0
mov rbx, rcx
jne 0x140004e5a
mov eax, 0x61
mov dword [rsp + 0x32], 0x6c006c
mov word [rsp + 0x28], ax
lea rcx, [rsp + 0x20]
xor eax, eax
mov dword [rsp + 0x24], 0x77006c
mov word [rsp + 0x36], ax
mov dword [rsp + 0x2e], 0x64002e
mov dword [rsp + 0x2a], 0x690070
mov dword [rsp + 0x20], 0x680053
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
mov rax, qword [rcx + 8]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
Function at 0x1400056c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov rbp, r9
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004cb0
test rax, rax
je 0x140005753
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x72436f43
mov rcx, rax
mov dword [rsp + 0x3d], 0x65636e
mov dword [rsp + 0x34], 0x65746165
mov word [rsp + 0x38], 0x6e49
mov word [rsp + 0x3b], 0x6174
mov byte [rsp + 0x3a], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005753
mov r9, rbp
mov qword [rsp + 0x20], r14
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140005758
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140005770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004cb0
test rax, rax
je 0x1400057e8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x6e496f43
mov rcx, rax
mov word [rsp + 0x2b], VarCyFromDisp
mov dword [rsp + 0x24], 0x61697469
mov word [rsp + 0x28], 0x696c
mov byte [rsp + 0x2a], 0x7a
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400057e8
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret

Function at 0x140005800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.140004f20
mov rcx, rax
call fcn.140004cb0
test rax, rax
je 0x14000586d
lea rdx, [rsp + 0x20]
mov word [rsp + 0x26], 0x7469
mov rcx, rax
mov dword [rsp + 0x20], 0x6e556f43
mov word [rsp + 0x2c], 0x657a
mov word [rsp + 0x29], 0x6c61
mov byte [rsp + 0x2e], 0
mov word [rsp + 0x24], 0x6e69
mov byte [rsp + 0x28], 0x69
mov byte [rsp + 0x2b], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000586d
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x48
ret

Function at 0x140005880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004d40
test rax, rax
je 0x140005900
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2a], 0x5465
mov rcx, rax
mov dword [rsp + 0x2d], 0x76677241
mov dword [rsp + 0x26], 0x6e694c64
mov dword [rsp + 0x20], 0x6d6d6f43
mov byte [rsp + 0x2c], VarBstrFromDate
mov word [rsp + 0x31], 0x57
mov word [rsp + 0x24], 0x6e61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005900
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140005902
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140005990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x1400059ff
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x57776f64
mov rcx, rax
mov dword [rsp + 0x20], 0x646e6946
mov byte [rsp + 0x2b], 0
mov word [rsp + 0x24], 0x6957
mov byte [rsp + 0x26], VarBstrFromDate
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400059ff
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140005a01
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140005a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x25], 0x6e616d6d
mov dword [rsp + 0x29], 0x6e694c64
mov dword [rsp + 0x21], 0x6f437465
mov word [rsp + 0x2e], 0x57
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x2d], VarCyFromDisp
call fcn.140004f20
mov rcx, rax
call fcn.140004b80
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005a90
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x48
ret

Function at 0x140005ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x4c746547
mov dword [rsp + 0x28], 0x726f7272
mov dword [rsp + 0x24], 0x45747361
mov byte [rsp + 0x2c], 0
call fcn.140004f20
mov rcx, rax
call fcn.140004b80
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005b14
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x48
ret

Function at 0x140005b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, r8d
mov dword [rsp + 0x23], 0x75646f4d
mov rdi, rdx
mov word [rsp + 0x21], 0x7465
mov rbx, rcx
mov dword [rsp + 0x27], 0x6946656c
mov dword [rsp + 0x2f], 0x57656d
mov dword [rsp + 0x2b], 0x614e656c
mov byte [rsp + 0x20], 0x47
call fcn.140004f20
mov rcx, rax
call fcn.140004b80
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005ba7
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004ae0
test rax, rax
je 0x140005c51
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x6d6d6f43
mov rcx, rax
mov dword [rsp + 0x2c], 0x6f72746e
mov word [rsp + 0x30], 0x736c
mov dword [rsp + 0x20], 0x74696e49
mov word [rsp + 0x29], 0x436e
mov byte [rsp + 0x2b], VarBstrFromDate
mov word [rsp + 0x33], 0x78
mov byte [rsp + 0x28], VarBstrFromDate
mov byte [rsp + 0x32], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005c51
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret

Function at 0x140005c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004de0
test rax, rax
je 0x140005ce5
lea rdx, [rsp + 0x20]
mov word [rsp + 0x27], 0x6e65
mov rcx, rax
mov dword [rsp + 0x21], 0x41687461
mov word [rsp + 0x2a], 0x57
mov word [rsp + 0x25], 0x7070
mov byte [rsp + 0x29], VarCyFromDisp
mov byte [rsp + 0x20], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005ce5
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140005ce7
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140005d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004de0
test rax, rax
je 0x140005d7e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x22], 0x69466874
mov rcx, rax
mov dword [rsp + 0x2b], 0x57737473
mov dword [rsp + 0x27], 0x69784565
mov word [rsp + 0x20], 0x6150
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005d7e
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
Function at 0x140005da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004de0
test rax, rax
je 0x140005e2f
lea rdx, [rsp + 0x20]
mov word [rsp + 0x25], 0x6d65
mov rcx, rax
mov word [rsp + 0x28], 0x6576
mov dword [rsp + 0x2b], 0x53656c69
mov dword [rsp + 0x21], 0x52687461
mov dword [rsp + 0x2f], 0x57636570
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x27], VarBstrFromDate
mov byte [rsp + 0x2a], 0x46
mov byte [rsp + 0x20], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005e2f
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret

Function at 0x140005e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbp, r9
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x140005ec4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x74736f50
mov rcx, rax
mov dword [rsp + 0x24], 0x7373654d
mov dword [rsp + 0x29], 0x576567
mov byte [rsp + 0x28], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005ec4
mov r9, rbp
mov r8, rsi
mov edx, edi
mov rcx, rbx
call rax
jmp 0x140005ec6
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140005ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x140005f5d
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x11], 0x61737365
mov rcx, rax
mov dword [rbp - 0x16], 0x776f646e
mov dword [rbp - 0x20], 0x69676552
mov word [rbp - 0x1c], 0x7473
mov dword [rbp - 0xd], 0x576567
mov word [rbp - 0x19], 0x5772
mov byte [rbp - 0x12], 0x4d
mov byte [rbp - 0x17], 0x69
mov byte [rbp - 0x1a], VarCyFromDisp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005f5d
mov rcx, rbx
call rax
jmp 0x140005f5f
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140281d90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x140005f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebp, r9d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x140006024
lea rdx, [rsp + 0x40]
mov word [rsp + 0x4a], 0x736f
mov rcx, rax
mov dword [rsp + 0x41], 0x69577465
mov dword [rsp + 0x45], 0x776f646e
mov byte [rsp + 0x4c], 0
mov byte [rsp + 0x49], 0x50
mov byte [rsp + 0x40], 0x53
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140006024
mov eax, dword [rsp + 0xc0]
mov r9d, ebp
mov dword [rsp + 0x30], eax
mov r8d, esi
mov eax, dword [rsp + 0xb8]
mov rdx, rdi
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
call r10
jmp 0x140006026
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400060e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebp, r9d
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
call fcn.140004f20
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x14000615e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x78456b6f
mov rcx, rax
mov dword [rsp + 0x20], 0x57746553
mov dword [rsp + 0x24], 0x6f646e69
mov dword [rsp + 0x28], 0x6f487377
mov word [rsp + 0x30], 0x57
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000615e
mov r9d, ebp
mov r8, rsi
mov rdx, rdi
mov ecx, ebx
call rax
jmp 0x140006160
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400061f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x14000627c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x576b6f6f
mov rcx, rax
mov word [rsp + 0x21], 0x686e
mov byte [rsp + 0x20], 0x55
mov dword [rsp + 0x27], 0x6f646e69
mov dword [rsp + 0x2d], 0x6b6f6f48
mov word [rsp + 0x32], 0x78
mov word [rsp + 0x2b], 0x7377
mov byte [rsp + 0x31], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000627c
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x40
pop rbx
ret
Function at 0x1400062a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140413920]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x58]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.140004f20
mov rcx, rax
call fcn.140004c10
test rax, rax
je 0x14000636c
lea rdx, [rbp - 0x38]
mov word [rbp - 0x21], 0x616c
mov rcx, rax
mov word [rbp - 0x2f], 0x6576
mov word [rbp - 0x1e], 0x6544
mov dword [rbp - 0x1b], 0x73656369
mov dword [rbp - 0x2d], 0x726f4672
mov word [rbp - 0x35], 0x7461
mov word [rbp - 0x38], 0x7055
mov dword [rbp - 0x26], 0x646e4167
mov word [rbp - 0x17], 0x57
mov word [rbp - 0x32], 0x7244
mov byte [rbp - 0x1f], 0x79
mov byte [rbp - 0x30], 0x69
mov byte [rbp - 0x22], 0x50
mov word [rbp - 0x29], 0x6c50
mov byte [rbp - 0x33], VarCyFromDisp
mov byte [rbp - 0x1c], 0x76
mov byte [rbp - 0x27], 0x75
mov byte [rbp - 0x36], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000636c
mov r9d, r14d
mov qword [rsp + 0x20], r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x14000636e
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140281d90
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400075ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x1400075eb
cmp dword [rcx + 0xe8], 0
jne 0x1400075eb
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.1400309c8
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400079a4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007648
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.1400309c8
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400076a4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.1400076dc
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400085e4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14041c4f4]
test eax, eax
je 0x140008636
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14041c4f4]
test eax, eax
jne 0x14000863f
call fcn.14000874c
test eax, eax
je 0x14000865b
lea rdx, [rsp + 0x30]
mov rcx, qword [0x140412040]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140008663
xor eax, eax
jmp 0x1400086bb
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x14000869d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000869f
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400086b8
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x14000e688
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14000e702
xor r8d, r8d
call fcn.14000e948
mov rsi, rax
test rax, rax
jne 0x14000e6be
mov eax, edi
jmp 0x14000e718
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14000e6ba
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret