joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 1
call fcn.100171f0
mov edi, eax
test edi, edi
je 0x1001758f
lea eax, [ebp - 0x14]
mov word [ebp - 0xc], 0x7547
push eax
push edi
mov word [ebp - 9], 0x64
mov dword [ebp - 0x10], 0x65746165
mov dword [ebp - 0x14], 0x72436f43
mov byte [ebp - 0xa], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017588
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100175b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x30]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x44], eax
xor esi, esi
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x30], eax
call fcn.10017100
mov edi, eax
test edi, edi
je 0x10017679
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x61657243
push eax
push edi
mov dword [ebp - 0xf], 0x72655365
mov dword [ebp - 9], 0x416563
mov word [ebp - 0xb], 0x6976
mov byte [ebp - 0x10], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017672
push dword [ebp - 0x30]
push dword [ebp - 0x44]
push dword [ebp - 0x20]
push dword [ebp - 0x40]
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
push dword [ebp - 0x3c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x10017690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0xc], 0x6873
mov word [ebp - 0x17], 0x686c
mov word [ebp - 9], 0x74
mov dword [ebp - 0x1c], 0x6f546574
mov dword [ebp - 0x15], 0x33706c65
mov dword [ebp - 0x20], 0x61657243
mov byte [ebp - 0x18], 0x6f
mov dword [ebp - 0x10], 0x70616e53
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0xa], 0x6f
call fcn.10017150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001770a
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x1c], eax
or esi, 0xffffffff
call fcn.10017150
mov edi, eax
test edi, edi
je 0x10017799
lea eax, [ebp - 0x18]
mov word [ebp - 0xf], 0x6f56
push eax
push edi
mov word [ebp - 0x15], 0x4664
mov word [ebp - 0x12], 0x7372
mov dword [ebp - 0xd], 0x656d756c
mov word [ebp - 0x17], 0x6e69
mov word [ebp - 9], 0x57
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0x18], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017792
push dword [ebp - 0x1c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100177b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
call fcn.10017310
mov edi, eax
test edi, edi
je 0x1001782c
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0x416f66
push eax
push edi
mov dword [ebp - 0xe], 0x6e6f6973
mov word [ebp - 0x10], 0x7265
mov dword [ebp - 0x15], 0x656c6946
mov word [ebp - 0x17], 0x7465
mov word [ebp - 0xa], 0x6e49
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x11], 0x56
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017825
push dword [ebp - 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x10017840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x20], eax
xor esi, esi
call fcn.10017310
mov edi, eax
test edi, edi
je 0x100178bf
lea eax, [ebp - 0x1c]
mov word [ebp - 0xb], 0x536f
push eax
push edi
mov word [ebp - 0x12], 0x6973
mov dword [ebp - 0x17], 0x6556656c
mov dword [ebp - 0x1b], 0x69467465
mov dword [ebp - 8], 0x41657a
mov dword [ebp - 0xf], 0x666e496e
mov byte [ebp - 9], 0x69
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x10], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100178b8
push dword [ebp - 0x20]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100178e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0xa], 0x41656d61
mov word [ebp - 0x18], 0x6547
mov dword [ebp - 0xe], 0x4e656c69
mov word [ebp - 0x15], 0x6f4d
mov dword [ebp - 0x12], 0x46656c75
mov byte [ebp - 6], 0
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x16], 0x74
call fcn.10017150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017950
push dword [ebp + 0x10]
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 0xb], 0x456e
mov word [ebp - 8], 0x41
mov word [ebp - 0xe], 0x6973
mov dword [ebp - 0x13], 0x65567465
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 9], 0x78
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0x14], 0x47
call fcn.10017150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100179d3
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100179f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov word [ebp - 0x16], 0x6d75
mov dword [ebp - 0x11], 0x6d726f66
mov word [ebp - 0x1c], 0x6547
mov word [ebp - 0x19], 0x6f56
mov dword [ebp - 0xd], 0x6f697461
mov word [ebp - 9], 0x576e
mov word [ebp - 0x13], 0x6e49
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 7], 0
call fcn.10017150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017a93
push dword [ebp + 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push ebx
push dword [ebp + 0x10]
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x20], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x24], eax
call fcn.10017100
mov edi, eax
test edi, edi
je 0x10017b32
lea eax, [ebp - 0x1c]
mov word [ebp - 0x1c], 0x6f4c
push eax
push edi
mov dword [ebp - 0x19], 0x5070756b
mov dword [ebp - 0x10], 0x56656765
mov dword [ebp - 0xb], 0x4165756c
mov dword [ebp - 0x14], 0x6c697669
mov byte [ebp - 7], 0
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x15], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017b2b
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x10017b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x14], 0x5670614d
mov dword [ebp - 0xf], 0x664f7765
mov word [ebp - 8], 0x65
mov word [ebp - 0xb], 0x6946
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 9], 0x6c
call fcn.10017150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017bca
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 1
call fcn.100171a0
mov edi, eax
test edi, edi
je 0x10017c4d
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], 0x654e
push eax
push edi
mov word [ebp - 0x11], 0x6675
mov word [ebp - 0xe], 0x7265
mov dword [ebp - 0xb], 0x656572
mov dword [ebp - 0x15], 0x42697041
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0xc], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017c46
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
call fcn.10017100
mov edi, eax
test edi, edi
je 0x10017ccf
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], 0x704f
push eax
push edi
mov dword [ebp - 0xf], 0x6f547373
mov dword [ebp - 0xb], 0x6e656b
mov dword [ebp - 0x15], 0x6f72506e
mov byte [ebp - 0x16], 0x65
mov word [ebp - 0x11], 0x6563
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017cc8
push dword [ebp - 0x1c]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x10017cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x18], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x1c], eax
call fcn.10017100
mov edi, eax
test edi, edi
je 0x10017d5f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x614d4353
push eax
push edi
mov dword [ebp - 0xb], 0x72656761
mov dword [ebp - 0x14], 0x6e65704f
mov word [ebp - 7], 0x41
mov byte [ebp - 0xc], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017d58
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x18], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x1c], eax
call fcn.10017100
mov edi, eax
test edi, edi
je 0x10017df5
lea eax, [ebp - 0x14]
mov word [ebp - 9], 0x41
push eax
push edi
mov dword [ebp - 0xe], 0x63697672
mov word [ebp - 0x11], 0x536e
mov word [ebp - 0x14], 0x704f
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017dee
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x14], eax
xor esi, esi
call fcn.100172c0
mov edi, eax
test edi, edi
je 0x10017e78
lea eax, [ebp - 0x10]
mov word [ebp - 0xd], 0x4168
push eax
push edi
mov word [ebp - 0x10], 0x6150
mov dword [ebp - 0xa], 0x646e6570
mov byte [ebp - 0xb], 0x70
mov word [ebp - 6], 0x41
mov byte [ebp - 0xe], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017e71
push dword [ebp - 0x14]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x10017e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
call fcn.100172c0
mov edi, eax
test edi, edi
je 0x10017ef6
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x417374
push eax
push edi
mov dword [ebp - 0x14], 0x68746150
mov word [ebp - 0xe], 0x656c
mov word [ebp - 0xb], 0x6978
mov word [ebp - 0x10], 0x6946
mov byte [ebp - 9], 0x73
mov byte [ebp - 0xc], 0x45
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017eef
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.100172c0
mov edi, eax
test edi, edi
je 0x10017f74
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x68746150
push eax
push edi
mov word [ebp - 0xb], 0x6d61
mov dword [ebp - 0x10], 0x656c6946
mov byte [ebp - 0xc], 0x4e
mov dword [ebp - 0x14], 0x646e6946
mov word [ebp - 8], 0x41
mov byte [ebp - 9], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017f6d
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.100172c0
mov esi, eax
test esi, esi
je 0x10017ffc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xd], 0x6e6f6973
push eax
push esi
mov dword [ebp - 0x12], 0x65747845
mov dword [ebp - 0x19], 0x6d655268
mov word [ebp - 9], 0x41
mov word [ebp - 0x15], 0x766f
mov word [ebp - 0x1b], 0x7461
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017ff5
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x10018010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push eax
mov dword [ebp - 0xf], 0x32337373
mov dword [ebp - 0x13], 0x65636f72
mov dword [ebp - 0xb], 0x73726946
mov byte [ebp - 0x14], 0x50
mov word [ebp - 7], 0x74
call fcn.10017150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001807b
push edi
push esi
call eax
test eax, eax
pop edi
setne al
pop esi
movzx eax, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
movzx eax, bl
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10018090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push eax
mov word [ebp - 0x13], 0x6f72
mov dword [ebp - 0x10], 0x33737365
mov dword [ebp - 0xc], 0x78654e32
mov word [ebp - 8], 0x74
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0x11], 0x63
call fcn.10017150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100180fe
push edi
push esi
call eax
test eax, eax
pop edi
setne al
pop esi
movzx eax, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
movzx eax, bl
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10018190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x18], eax
mov esi, 1
call fcn.10017100
mov edi, eax
test edi, edi
je 0x100181fc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x44676552
push eax
push edi
mov dword [ebp - 0xf], 0x6574656c
mov byte [ebp - 0x10], 0x65
mov word [ebp - 8], 0x41
mov word [ebp - 0xb], 0x654b
mov byte [ebp - 9], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100181f5
push dword [ebp - 0x18]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x10018210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x18], eax
mov esi, 1
call fcn.10017100
mov edi, eax
test edi, edi
je 0x1001827d
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x44676552
push eax
push edi
mov word [ebp - 0xb], 0x6156
mov dword [ebp - 8], 0x416575
mov dword [ebp - 0x10], 0x74656c65
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0xc], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018276
push dword [ebp - 0x18]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10018290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x18], eax
mov esi, 1
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x1c], eax
call fcn.10017100
mov edi, eax
test edi, edi
je 0x10018310
lea eax, [ebp - 0x14]
mov word [ebp - 0x11], 0x704f
push eax
push edi
mov word [ebp - 0x14], 0x6552
mov dword [ebp - 0xd], 0x4579654b
mov word [ebp - 8], 0x41
mov word [ebp - 0xf], 0x6e65
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018309
push dword [ebp - 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10018330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x18], eax
mov esi, 1
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x1c], eax
call fcn.10017100
mov edi, eax
test edi, edi
je 0x100183ab
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4f676552
push eax
push edi
mov word [ebp - 0xf], 0x6e65
mov dword [ebp - 0xa], 0x577845
mov word [ebp - 0xc], 0x7965
mov byte [ebp - 0xd], 0x4b
mov byte [ebp - 0x10], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100183a4
push dword [ebp - 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret