joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ee808
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rax + 8]
call fcn.140006f84
nop
cmp rbx, 0xffffffff80000000
jne 0x1400ee898
call fcn.140031d60
cmp eax, 1
jne 0x1400ee898
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.140018560
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000778c
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ee891
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006078e.0]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400ee8d4
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14006078e.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ee8e8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rax + 8]
call fcn.140006f84
nop
cmp rbx, 0xffffffff80000000
jne 0x1400ee978
call fcn.140031d60
cmp eax, 1
jne 0x1400ee978
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.140018560
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000778c
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ee971
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006078e.0]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400ee9bc
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14006078e.0]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401363f4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140136405
xor eax, eax
jmp 0x140136429
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1401bf540
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
and dword [rax - 0x20], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPreviewHandlers
and qword [rax - 0x18], 0
mov rdi, rcx
mov rdx, 0xffffffff80000002
lea rcx, [rax - 0x28]
mov r9d, 0x2001f
mov qword [rax - 0x28], rdx
call fcn.14003d630
test eax, eax
jne 0x1401bf5a5
mov rcx, qword [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp qword [rsp + 0x20], 0
je 0x1401bf5a0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x20], 0
and dword [rsp + 0x28], 0
mov r9d, 0x2001f
lea r8, str.CLSID
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x20]
call fcn.14003d630
test eax, eax
jne 0x1401bf5e8
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140135f48
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1401bf5f8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
jmp 0x1401bf5ed
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1401bf5f8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x40
pop rdi
ret

Function at 0x1401c1294
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x18], 0
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1402a07a8
test eax, eax
jne 0x1401c12f8
mov eax, dword [rsp + 0x30]
lea r8, str._s_s_X.tmp
mov dword [rsp + 0x28], eax
mov r9, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.14002042c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401c130a
jmp 0x1401c12b8
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1402067ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x14020689f
test rbx, rbx
je 0x14020689f
test r9, r9
jne 0x14020682e
call fcn.140031cec
mov r9, qword [rax + 0x18]
test r9, r9
je 0x14020689f
mov r8, rbx
mov qword [rdi + 0x10], r9
mov rdx, rsi
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14020689f
mov rcx, qword [rdi + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x14020689f
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14020689f
mov rbx, qword [rdi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, ebp
mov rcx, rdi
mov rdx, rax
mov rax, qword [rbx + 8]
call qword [case.0x14006078e.0]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
jmp 0x1402068a1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1402a860c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1402a82d4
Function at 0x1402b5acc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1402b56f4
call fcn.14026e2cc
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.14026e0d8
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402b56dc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1402b56dc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1402b5726
lock or dword [rax + 0x14], 0x10
jmp 0x1402b56dc
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1402b5743
mov rcx, qword [rbp + 0x10]
call fcn.1402c125c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1402a2c8c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1402b512c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1402b579a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1402b56dc
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1402b5806
mov rcx, qword [rbp + 0x10]
call fcn.1402a2c8c
cmp eax, 0xffffffff
je 0x1402b57ed
mov rcx, qword [rbp + 0x10]
call fcn.1402a2c8c
cmp eax, 0xfffffffe
je 0x1402b57ed
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1402a2c8c
movsxd rdi, eax
lea rsi, [0x1403f63b0]
mov rcx, rbx
sar rdi, 6
call fcn.1402a2c8c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1402b57f4
lea rax, [0x1403e6bb0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1402b5806
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1402b583c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1402b5838
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1402b5838
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1402b56df
jmp 0x1402b56ac
Function at 0x1402b5ad4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1402b58a6
call fcn.14026e2cc
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.14026e0d8
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402b5888
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1402b5888
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1402b58d8
lock or dword [rax + 0x14], 0x10
jmp 0x1402b5888
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1402b58f5
mov rcx, qword [rbp + 0x20]
call fcn.1402c125c
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1402b590a
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1402b5910
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1402a2c8c
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1402b512c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1402b5963
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1402b5888
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1402b59cf
mov rcx, qword [rbp + 0x20]
call fcn.1402a2c8c
cmp eax, 0xffffffff
je 0x1402b59b6
mov rcx, qword [rbp + 0x20]
call fcn.1402a2c8c
cmp eax, 0xfffffffe
je 0x1402b59b6
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1402a2c8c
movsxd rdi, eax
lea r15, [0x1403f63b0]
mov rcx, rbx
sar rdi, 6
call fcn.1402a2c8c
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1402b59bd
lea rax, [0x1403e6bb0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1402b59cf
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1402b5a05
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1402b5a01
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1402b5a01
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1402b5a23
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1402b5a2e
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1402b588d
jmp 0x1402b5854
Function at 0x1402c36c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov r9d, 0x2d
mov dword [rbp - 0x2c], 0x38002d
mov eax, 0x41
mov dword [rbp - 0x40], 0x38002d
mov word [rbp - 0x42], ax
lea rdx, [rbp - 0x50]
mov eax, 0x30
mov dword [rbp - 0x26], 0x460043
mov word [rbp - 0x3c], ax
lea r11d, [r9 + 7]
mov word [rbp - 0x32], ax
lea r10d, [r9 + 0x19]
mov eax, 0x35
mov dword [rbp - 0x36], 0x34002d
mov word [rbp - 0x50], ax
mov rbx, rcx
mov dword [rbp - 0x16], 0x430039
mov dword [rbp - 0x20], 0x320046
mov dword [rbp - 0x4e], 0x320034
mov word [rbp - 0x22], r9w
mov dword [rbp - 0x46], 0x330046
mov dword [rbp - 0x3a], 0x390042
mov dword [rbp - 0x30], 0x450041
mov dword [rbp - 0x4a], 0x370037
mov dword [rbp - 0x12], 0x440036
mov dword [rbp - 0xe], 0x440042
mov word [rbp - 0x28], r11w
mov dword [rbp - 0x1c], 0x370036
mov dword [rbp - 0xa], 0x35
mov word [rbp - 0x18], r10w
call fcn.140005dd0
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1402c3f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov r9d, 0x2d
mov dword [rbp - 0x2c], 0x38002d
mov eax, 0x41
mov dword [rbp - 0x40], 0x38002d
mov word [rbp - 0x42], ax
lea rdx, [rbp - 0x50]
mov eax, 0x30
mov dword [rbp - 0x26], 0x460043
mov word [rbp - 0x3c], ax
lea r11d, [r9 + 7]
mov word [rbp - 0x32], ax
lea r10d, [r9 + 0x19]
mov eax, 0x35
mov dword [rbp - 0x36], 0x34002d
mov word [rbp - 0x50], ax
mov rbx, rcx
mov dword [rbp - 0x16], 0x430039
mov dword [rbp - 0x20], 0x320046
mov dword [rbp - 0x4e], 0x320034
mov word [rbp - 0x22], r9w
mov dword [rbp - 0x46], 0x330046
mov dword [rbp - 0x3a], 0x390042
mov dword [rbp - 0x30], 0x450041
mov dword [rbp - 0x4a], 0x370037
mov dword [rbp - 0x12], 0x440036
mov dword [rbp - 0xe], 0x440042
mov word [rbp - 0x28], r11w
mov dword [rbp - 0x1c], 0x370036
mov dword [rbp - 0xa], 0x35
mov word [rbp - 0x18], r10w
call fcn.140005dd0
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1402c4390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
mov dword [rsp + 0x20], 0x65004b
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], ax
mov dword [rsp + 0x26], 0x65006e
mov dword [rsp + 0x36], VarBstrFromDisp
mov dword [rsp + 0x2a], 0x33006c
mov dword [rsp + 0x32], 0x6c0064
mov dword [rsp + 0x2e], 0x2e0032
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rsp, 0x48
ret

Function at 0x1402c4440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rsp + 0x24], 0x640077
lea rcx, [rsp + 0x20]
mov word [rsp + 0x34], ax
mov dword [rsp + 0x30], 0x6c006c
mov dword [rsp + 0x2c], 0x64002e
mov dword [rsp + 0x20], 0x65004e
mov dword [rsp + 0x28], 0x760065
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add rsp, 0x48
ret
Function at 0x1402c4490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rsp + 0x34], 0x6c006c
lea rcx, [rsp + 0x20]
mov word [rsp + 0x38], ax
mov dword [rsp + 0x24], 0x63006d
mov dword [rsp + 0x30], 0x64002e
mov dword [rsp + 0x28], 0x6c0074
mov dword [rsp + 0x2c], 0x320033
mov dword [rsp + 0x20], 0x6f0043
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add rsp, 0x48
ret

Function at 0x1402c44f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, 1
call fcn.1402c4340
mov rdi, rax
test rax, rax
je 0x1402c454b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x29], 0x657a69
mov rcx, rax
mov dword [rsp + 0x24], 0x61697469
mov dword [rsp + 0x20], 0x6e496f43
mov byte [rsp + 0x28], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402c4542
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1402c4560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ebx, 1
call fcn.1402c4340
mov rdi, rax
test rax, rax
je 0x1402c45f5
lea rdx, [rsp + 0x30]
mov word [rsp + 0x3e], 0x6563
mov rcx, rax
mov word [rsp + 0x3b], 0x6174
mov dword [rsp + 0x36], 0x6e496574
mov byte [rsp + 0x3a], 0x73
mov dword [rsp + 0x32], 0x61657243
mov word [rsp + 0x30], 0x6f43
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x3d], VarBstrFromDisp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1402c45ec
mov rax, qword [rsp + 0x80]
lea r9, [0x140356f48]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 0x14]
lea rcx, [0x140357708]
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1402c4610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
call fcn.1402c4340
mov rbx, rax
test rax, rax
je 0x1402c4665
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x657a696c
mov rcx, rax
mov dword [rsp + 0x20], 0x6e556f43
mov dword [rsp + 0x26], 0x61697469
mov word [rsp + 0x24], 0x6e69
mov byte [rsp + 0x2e], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402c465c
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x30
pop rbx
ret
Function at 0x1402c4680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
xor ebx, ebx
call fcn.1402c43f0
mov rdi, rax
test rax, rax
je 0x1402c4707
lea rdx, [rsp + 0x40]
mov word [rsp + 0x47], 0x776f
mov rcx, rax
mov dword [rsp + 0x49], 0x736f50
mov dword [rsp + 0x42], 0x6e695774
mov word [rsp + 0x40], 0x6553
mov byte [rsp + 0x46], VarCyFromDisp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402c46fe
mov r9d, 0xffffd8f0
mov dword [rsp + 0x30], ebx
mov r8d, r9d
mov dword [rsp + 0x28], 1
lea edx, [rbx + 1]
mov dword [rsp + 0x20], 1
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1402c4720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
call fcn.1402c43f0
mov rdi, rax
test rax, rax
je 0x1402c4796
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x54776f64
mov rcx, rax
mov dword [rsp + 0x21], 0x69577465
mov dword [rsp + 0x2b], 0x577478
mov byte [rsp + 0x2a], VarCyFromDisp
mov byte [rsp + 0x25], VarBstrFromDisp
mov byte [rsp + 0x20], 0x53
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402c478d
mov rdx, rsi
mov rcx, rbp
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1402c47c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1402c43f0
mov rdi, rax
test rax, rax
je 0x1402c4844
lea rdx, [rbp - 0x20]
mov word [rbp - 0x14], 0x776f
mov rcx, rax
mov dword [rbp - 0x19], 0x6e695772
mov word [rbp - 0x1e], 0x6967
mov word [rbp - 0x1b], 0x6574
mov dword [rbp - 0x11], 0x61737365
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x1c], 0x73
mov dword [rbp - 0xd], 0x576567
mov byte [rbp - 0x15], 0x64
mov byte [rbp - 0x12], 0x4d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402c483b
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x1402c4870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1402c4490
mov rdi, rax
test rax, rax
je 0x1402c48f0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x6d6d6f43
mov rcx, rax
mov word [rsp + 0x31], 0x4573
mov dword [rsp + 0x20], 0x74696e49
mov dword [rsp + 0x29], 0x6e6f436e
mov word [rsp + 0x2e], 0x6f72
mov byte [rsp + 0x30], 0x6c
mov word [rsp + 0x33], 0x78
mov byte [rsp + 0x28], VarBstrFromDisp
mov byte [rsp + 0x2d], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402c48e7
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1402c4910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
call fcn.1402c42e0
mov rdi, rax
test rax, rax
je 0x1402c4994
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2b], 0x6f54
mov rcx, rax
mov word [rsp + 0x25], 0x646e
mov dword [rsp + 0x20], 0x6d6d6f43
mov dword [rsp + 0x2e], 0x57766772
mov dword [rsp + 0x27], 0x656e694c
mov byte [rsp + 0x2d], 0x41
mov byte [rsp + 0x24], 0x61
mov byte [rsp + 0x32], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402c498b
mov rdx, rsi
mov rcx, rbp
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1402c4a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rsi, r8
mov r14, rdx
xor ebx, ebx
call fcn.1402c4440
mov rdi, rax
test rax, rax
je 0x1402c4b1b
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x1b], 0x616c5064
mov rcx, rax
mov word [rbp - 0x28], 0x7669
mov dword [rbp - 0x21], 0x67756c50
mov dword [rbp - 0x13], 0x73656369
mov dword [rbp - 0x30], 0x61647055
mov dword [rbp - 0x2c], 0x72446574
mov dword [rbp - 0x25], 0x726f4672
mov word [rbp - 0x1d], 0x6e41
mov word [rbp - 0xf], 0x57
mov word [rbp - 0x16], 0x6544
mov byte [rbp - 0x17], 0x79
mov byte [rbp - 0x14], 0x76
mov byte [rbp - 0x26], VarCyFromDisp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1402c4b12
mov rax, qword [rbp + 0x30]
lea r9d, [rbx + 1]
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, r14
xor ecx, ecx
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret