joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x100375ec]
test eax, eax
jne 0x10001d9a
mov al, 0x6c
mov cl, 0x74
mov byte [esp + 0xd], cl
mov byte [esp + 0x14], cl
mov byte [esp + 0x19], cl
mov byte [esp + 1], cl
mov cl, 0x64
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x1c], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 7], al
mov byte [esp + 8], al
lea eax, [esp + 0xc]
mov byte [esp + 2], cl
mov byte [esp + 6], cl
mov dl, 0x72
push eax
lea ecx, [esp + 4]
push ecx
mov byte [esp + 0x14], 0x4e
mov byte [esp + 0x16], 0x41
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x63
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x56
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], dl
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x25], 0x4d
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x6d
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x79
mov byte [esp + 0x2b], 0
mov byte [esp + 8], 0x6e
mov byte [esp + 0xd], 0x2e
mov byte [esp + 0x11], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100375ec], eax
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push ebx
push edx
push edi
push esi
call eax
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10019cd6
add esp, 0x28
ret 0xc
Function at 0x10001fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [0x100375e8]
test eax, eax
push ebp
mov ebp, dword [esp + 0x3c]
push esi
jne 0x100020f8
mov al, 0x6c
mov cl, 0x74
mov byte [esp + 0x15], cl
mov byte [esp + 0x1c], cl
mov byte [esp + 0x21], cl
mov byte [esp + 9], cl
mov cl, 0x64
mov byte [esp + 0x17], al
mov byte [esp + 0x18], al
mov byte [esp + 0x24], al
mov byte [esp + 0xb], al
mov byte [esp + 0xc], al
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
lea eax, [esp + 0x14]
mov byte [esp + 0xa], cl
mov byte [esp + 0xe], cl
mov dl, 0x72
push eax
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x1c], 0x4e
mov byte [esp + 0x1e], 0x41
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x56
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], dl
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2d], 0x4d
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x6d
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x31], dl
mov byte [esp + 0x32], 0x79
mov byte [esp + 0x33], 0
mov byte [esp + 0x10], 0x6e
mov byte [esp + 0x15], 0x2e
mov byte [esp + 0x19], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
mov esi, eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x10]
push eax
push esi
call fcn.100194a0
add esp, 0x10
test eax, eax
je 0x100020ef
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x41], 0x68
mov dword [esp + 0x42], esi
mov byte [esp + 0x46], 0xc3
call fcn.10001dc0
test eax, eax
mov dword [0x100375e8], eax
je 0x10002123
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov cx, word [esp + 0x34]
mov word [eax + 8], cx
mov dl, byte [esp + 0x36]
mov byte [eax + 0xa], dl
jmp 0x100020f4
mov eax, dword [0x100375e8]
test eax, eax
je 0x10002123
test edi, edi
je 0x10002123
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push ebx
push ecx
push ebp
push edi
call eax
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10019cd6
add esp, 0x34
ret 0x10
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.10019cd6
add esp, 0x34
ret 0x10
Function at 0x10002200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
mov edi, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.100016b0
mov eax, dword [0x100375c8]
test eax, eax
jne 0x1000237b
mov al, 0x6c
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov al, 0x65
mov cl, 0x74
mov dl, 0x64
mov byte [esp + 0x2b], al
mov byte [esp + 0x30], al
lea eax, [esp + 0x24]
mov byte [esp + 0x19], cl
mov byte [esp + 0x25], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1e], dl
mov dl, 0x69
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x25], 0x2e
mov byte [esp + 0x29], 0
mov byte [esp + 0x2c], 0x4e
mov byte [esp + 0x2e], 0x4d
mov byte [esp + 0x2f], 0x61
mov byte [esp + 0x30], 0x70
mov byte [esp + 0x31], 0x56
mov byte [esp + 0x32], dl
mov byte [esp + 0x34], 0x77
mov byte [esp + 0x35], 0x4f
mov byte [esp + 0x36], 0x66
mov byte [esp + 0x37], 0x53
mov byte [esp + 0x39], 0x63
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3c], 0x6f
mov byte [esp + 0x3d], 0x6e
mov byte [esp + 0x3e], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
mov esi, eax
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x20]
push eax
push esi
call fcn.100194a0
add esp, 0x10
test eax, eax
je 0x1000235b
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x4d], 0x68
mov dword [esp + 0x4e], esi
mov byte [esp + 0x52], 0xc3
call fcn.100021b0
test eax, eax
mov dword [0x100375c8], eax
je 0x10002364
mov ecx, dword [esp + 0x38]
mov dword [eax], ecx
mov edx, dword [esp + 0x3c]
mov eax, dword [0x100375c8]
mov dword [eax + 4], edx
mov cx, word [esp + 0x40]
mov edx, dword [0x100375c8]
mov word [edx + 8], cx
mov al, byte [esp + 0x42]
mov ecx, dword [0x100375c8]
mov byte [ecx + 0xa], al
mov eax, dword [0x100375c8]
test eax, eax
jne 0x1000237b
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10019cd6
add esp, 0x3c
ret 0x28
test edi, edi
je 0x10002364
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
push edx
mov edx, dword [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x6c]
push edx
mov edx, dword [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push edi
push ecx
push ebp
call eax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10019cd6
add esp, 0x3c
ret 0x28
Function at 0x100023c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
mov edi, dword [esp + 0x44]
call fcn.100016b0
mov eax, dword [0x100375cc]
test eax, eax
jne 0x1000252c
mov al, 0x6c
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
mov al, 0x65
mov cl, 0x74
mov byte [esp + 0x21], al
mov byte [esp + 0x26], al
lea eax, [esp + 0x18]
mov dl, 0x6e
mov byte [esp + 0xd], cl
mov byte [esp + 0x19], cl
mov byte [esp + 0x28], cl
push eax
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x14], dl
mov byte [esp + 0x16], 0x64
mov byte [esp + 0x19], 0x2e
mov byte [esp + 0x1a], 0x64
mov byte [esp + 0x1d], 0
mov byte [esp + 0x20], 0x4e
mov byte [esp + 0x22], 0x55
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x6d
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x70
mov byte [esp + 0x27], 0x56
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x2a], 0x77
mov byte [esp + 0x2b], 0x4f
mov byte [esp + 0x2c], 0x66
mov byte [esp + 0x2d], 0x53
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x32], 0x6f
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
mov esi, eax
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x14]
push eax
push esi
call fcn.100194a0
add esp, 0x10
test eax, eax
je 0x1000250c
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x45], 0x68
mov dword [esp + 0x46], esi
mov byte [esp + 0x4a], 0xc3
call fcn.100021b0
test eax, eax
mov dword [0x100375cc], eax
je 0x10002515
mov ecx, dword [esp + 0x30]
mov dword [eax], ecx
mov edx, dword [esp + 0x34]
mov eax, dword [0x100375cc]
mov dword [eax + 4], edx
mov cx, word [esp + 0x38]
mov edx, dword [0x100375cc]
mov word [edx + 8], cx
mov al, byte [esp + 0x3a]
mov ecx, dword [0x100375cc]
mov byte [ecx + 0xa], al
mov eax, dword [0x100375cc]
test eax, eax
jne 0x1000252c
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10019cd6
add esp, 0x34
ret 8
test edi, edi
je 0x10002515
push ebp
push edi
call eax
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10019cd6
add esp, 0x34
ret 8
Function at 0x10002550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
mov edi, dword [esp + 0x3c]
call fcn.100016b0
mov eax, dword [0x100375d0]
test eax, eax
jne 0x10002699
mov al, 0x6c
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
mov al, 0x65
mov cl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
lea eax, [esp + 0x18]
mov dl, 0x6e
mov byte [esp + 0xd], cl
mov byte [esp + 0x19], cl
mov byte [esp + 0x21], cl
push eax
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x14], dl
mov byte [esp + 0x16], 0x64
mov byte [esp + 0x19], 0x2e
mov byte [esp + 0x1a], 0x64
mov byte [esp + 0x1d], 0
mov byte [esp + 0x20], 0x4e
mov byte [esp + 0x22], 0x4f
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x53
mov byte [esp + 0x28], 0x63
mov byte [esp + 0x2a], 0x69
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
mov esi, eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x14]
push eax
push esi
call fcn.100194a0
add esp, 0x10
test eax, eax
je 0x10002679
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x3d], 0x68
mov dword [esp + 0x3e], esi
mov byte [esp + 0x42], 0xc3
call fcn.100021b0
test eax, eax
mov dword [0x100375d0], eax
je 0x10002682
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov edx, dword [esp + 0x2c]
mov eax, dword [0x100375d0]
mov dword [eax + 4], edx
mov cx, word [esp + 0x30]
mov edx, dword [0x100375d0]
mov word [edx + 8], cx
mov al, byte [esp + 0x32]
mov ecx, dword [0x100375d0]
mov byte [ecx + 0xa], al
mov eax, dword [0x100375d0]
test eax, eax
jne 0x10002699
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.10019cd6
add esp, 0x2c
ret 0xc
test edi, edi
je 0x10002682
mov edx, dword [esp + 0x40]
push ebp
push edx
push edi
call eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10019cd6
add esp, 0x2c
ret 0xc
Function at 0x10002760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x10], eax
mov al, 0x78
mov byte [esp + 3], al
mov byte [esp + 7], al
mov al, 0x6c
push esi
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x10], al
mov byte [esp + 0x11], al
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 0x56
mov byte [esp + 9], 0x42
mov byte [esp + 0xa], 0x6f
mov byte [esp + 0xc], 0x52
mov byte [esp + 0xd], 0x54
mov byte [esp + 0xe], 0x2d
mov byte [esp + 0x10], 0x38
mov byte [esp + 0x11], 0x36
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100027fa
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10019cd6
add esp, 0x14
ret 0x14
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
push esi
call fcn.100026c0
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.10019cd6
add esp, 0x14
ret 0x14

Function at 0x10002830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x10], eax
mov al, 0x78
mov byte [esp + 3], al
mov byte [esp + 7], al
mov al, 0x6c
push edi
mov edi, dword [esp + 0x1c]
mov byte [esp + 0x10], al
mov byte [esp + 0x11], al
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 0x56
mov byte [esp + 9], 0x42
mov byte [esp + 0xa], 0x6f
mov byte [esp + 0xc], 0x52
mov byte [esp + 0xd], 0x54
mov byte [esp + 0xe], 0x2d
mov byte [esp + 0x10], 0x38
mov byte [esp + 0x11], 0x36
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100028b6
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10019cd6
add esp, 0x14
ret 4
push esi
push edi
push 0xffffffffffffffff
call fcn.100023c0
mov esi, eax
test esi, esi
jge 0x10002902
cmp esi, 0xc0000045
jne 0x100028e7
push 0
push edi
call fcn.100018c0
test al, al
je 0x100028e7
push edi
push 0xffffffffffffffff
call fcn.100023c0
mov esi, eax
test esi, esi
jge 0x10002902
push esi
call fcn.100017d0
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10019cd6
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x18]
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.10019cd6
add esp, 0x14
ret 4
Function at 0x10002920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x248
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
mov esi, dword [esp + 0x25c]
push edi
xor ebx, ebx
push 0x1fe
lea eax, [esp + 0x56]
push ebx
push eax
mov word [esp + 0x5c], bx
call fcn.10019d20
mov al, 0x78
add esp, 0xc
mov byte [esp + 0x43], al
mov byte [esp + 0x47], al
mov al, 0x6c
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x10], ebx
xor edi, edi
mov byte [esp + 0x44], 0x56
mov byte [esp + 0x45], 0x42
mov byte [esp + 0x46], 0x6f
mov byte [esp + 0x48], 0x52
mov byte [esp + 0x49], 0x54
mov byte [esp + 0x4a], 0x2d
mov byte [esp + 0x4c], 0x38
mov byte [esp + 0x4d], 0x36
mov byte [esp + 0x4e], 0x2e
mov byte [esp + 0x4f], 0x64
mov byte [esp + 0x50], al
mov byte [esp + 0x51], al
mov byte [esp + 0x52], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100029d3
mov edx, dword [esp + 0x25c]
mov eax, dword [esp + 0x258]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x10002a83
cmp esi, ebx
jne 0x100029e6
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10002a83
push 0x100
lea ecx, [esp + 0x54]
push ecx
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.100019d0
cmp dword [esp + 0x25c], ebx
je 0x10002a2b
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 1
lea edi, [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push edi
lea eax, [esp + 0x34]
push eax
call fcn.10001ac0
cmp eax, ebx
jge 0x10002a4e
push eax
call fcn.100017d0
xor eax, eax
jmp 0x10002a83
mov eax, dword [esp + 0x258]
cmp eax, 1
jne 0x10002a61
mov eax, 4
jmp 0x10002a6b
test al, 0x20
je 0x10002a6b
and eax, 0xffffffdf
or eax, 8
mov ecx, dword [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
call fcn.10002550
cmp eax, ebx
jl 0x10002a44
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10019cd6
add esp, 0x248
ret 0xc
Function at 0x10002aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x50]
push ebp
mov ebp, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [0x100375e4]
test eax, eax
push esi
push edi
mov edi, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
jne 0x10002bf8
mov dl, 0x64
mov byte [esp + 0x16], dl
mov al, 0x6c
mov byte [esp + 0x1a], dl
mov dl, 0x72
mov cl, 0x74
mov byte [esp + 0x23], dl
mov byte [esp + 0x2b], dl
mov byte [esp + 0x34], dl
lea edx, [esp + 0x20]
mov byte [esp + 0x17], al
mov byte [esp + 0x18], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x2f], al
push edx
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], cl
mov byte [esp + 0x21], 0x2e
mov byte [esp + 0x25], 0
mov byte [esp + 0x28], 0x4e
mov byte [esp + 0x29], cl
mov byte [esp + 0x2a], 0x50
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x30], cl
mov byte [esp + 0x31], 0x56
mov byte [esp + 0x32], 0x69
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0x75
mov byte [esp + 0x36], 0x61
mov byte [esp + 0x38], 0x4d
mov byte [esp + 0x39], 0x65
mov byte [esp + 0x3a], 0x6d
mov byte [esp + 0x3b], 0x6f
mov byte [esp + 0x3d], 0x79
mov byte [esp + 0x3e], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1c]
mov esi, eax
push edx
push esi
call fcn.100194a0
add esp, 0x10
test eax, eax
je 0x10002bef
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x4d], 0x68
mov dword [esp + 0x4e], esi
mov byte [esp + 0x52], 0xc3
call fcn.100021b0
test eax, eax
mov dword [0x100375e4], eax
je 0x10002c23
mov ecx, dword [esp + 0x38]
mov dword [eax], ecx
mov edx, dword [esp + 0x3c]
mov dword [eax + 4], edx
mov cx, word [esp + 0x40]
mov word [eax + 8], cx
mov dl, byte [esp + 0x42]
mov byte [eax + 0xa], dl
jmp 0x10002bf4
mov eax, dword [0x100375e4]
test eax, eax
je 0x10002c23
test edi, edi
je 0x10002c23
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push ecx
push ebp
push edi
call eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10019cd6
add esp, 0x3c
ret 0x14
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.10019cd6
add esp, 0x3c
ret 0x14
Function at 0x10007120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x20], eax
cmp dword [0x10037608], 0
jne 0x1000725d
cmp dword [0x1003760c], 0
jne 0x1000725d
mov al, 0x6c
mov byte [esp + 8], al
mov byte [esp + 9], al
mov al, 0x72
mov dl, 0x65
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov cl, 0x73
mov byte [esp + 0x15], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x14], dl
mov byte [esp + 0x17], dl
mov dl, 0x6f
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 0x77
mov byte [esp + 9], 0x69
mov byte [esp + 0xa], 0x6e
mov byte [esp + 0xb], 0x33
mov byte [esp + 0xc], 0x32
mov byte [esp + 0xd], 0x75
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x4e
mov byte [esp + 0x15], 0x74
mov byte [esp + 0x16], 0x55
mov byte [esp + 0x17], cl
mov byte [esp + 0x1a], 0x53
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x43
mov byte [esp + 0x1e], 0x75
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x50
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], 0
call esi
test eax, eax
je 0x10007239
push edi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc]
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x10007238
cmp byte [eax + 0xd], 0xc
jne 0x10007224
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
call esi
push eax
call edi
mov dword [0x10037608], eax
jmp 0x10007238
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
call esi
push eax
call edi
mov dword [0x1003760c], eax
pop edi
cmp dword [0x10037608], 0
pop esi
jne 0x1000725d
cmp dword [0x1003760c], 0
jne 0x1000725d
xor eax, eax
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10019cd6
add esp, 0x24
ret
mov ecx, dword [esp + 0x20]
xor ecx, esp
mov eax, 1
call fcn.10019cd6
add esp, 0x24
ret
Function at 0x10007280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [0x10037628], 0
je 0x100072ab
mov eax, 1
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10019cd6
add esp, 0x28
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push 0x14
push 0
mov eax, esi
call fcn.10006da0
mov dword [0x10037628], eax
push 3
push 5
mov eax, esi
call fcn.10006e30
add esp, 0x10
mov dword [0x1003761c], eax
call fcn.10007120
test eax, eax
pop esi
jne 0x100073bd
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
push 3
push 5
call fcn.10006e30
mov cl, 0x6c
mov dword [0x10037620], eax
mov al, 0x73
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], cl
mov byte [esp + 0x1e], cl
mov cl, 0x6f
add esp, 8
mov byte [esp + 1], al
mov byte [esp + 0x12], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1f], al
lea eax, [esp + 0xc]
mov dl, 0x72
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1e], cl
push eax
lea ecx, [esp + 4]
push ecx
mov byte [esp + 8], 0x75
mov byte [esp + 0xa], 0x65
mov byte [esp + 0xb], dl
mov byte [esp + 0xc], 0x33
mov byte [esp + 0xd], 0x32
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x50
mov byte [esp + 0x18], 0x68
mov byte [esp + 0x19], 0x79
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1f], 0x43
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x21], dl
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], 0x50
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 3
push 5
call fcn.10006e30
add esp, 8
mov dword [0x10037624], eax
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp dword [0x10037628], eax
setne al
xor ecx, esp
call fcn.10019cd6
add esp, 0x28
ret
Function at 0x100073e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x10031708]
xor eax, esp
mov dword [esp + 0x20], eax
cmp dword [0x10037614], 0
je 0x1000740b
mov eax, 1
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10019cd6
add esp, 0x24
ret
mov al, 0x6c
mov byte [esp + 8], al
mov byte [esp + 9], al
mov al, 0x72
mov dl, 0x65
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov cl, 0x73
mov byte [esp + 0x15], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x14], dl
mov byte [esp + 0x17], dl
mov dl, 0x6f
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 0x77
mov byte [esp + 9], 0x69
mov byte [esp + 0xa], 0x6e
mov byte [esp + 0xb], 0x33
mov byte [esp + 0xc], 0x32
mov byte [esp + 0xd], 0x75
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x4e
mov byte [esp + 0x15], 0x74
mov byte [esp + 0x16], 0x55
mov byte [esp + 0x17], cl
mov byte [esp + 0x1a], 0x47
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x43
mov byte [esp + 0x1e], 0x75
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x50
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], 0
call esi
test eax, eax
je 0x100074c9
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 8]
push edx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10037614], eax
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp dword [0x10037614], eax
pop esi
setne al
xor ecx, esp
call fcn.10019cd6
add esp, 0x24
ret