joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049870
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10075b98
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, 0x100aa321
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], ebx
call fcn.10066665
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100498c6
mov dword [eax], 0
mov dword [ebx], 0
cmp dword [edi], 0xffffffff
je 0x10049a1b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
nop dword [eax]
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x100499e6
test eax, eax
je 0x100499e6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x100499e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x28], eax
cmp ecx, 0xffffffff
je 0x1004996b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1004995f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1004996b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x10049979
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x28]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.100035d0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x100499e6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x10049924
jmp 0x100499e9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
add dword [ecx], edx
test eax, eax
jne 0x10049a12
test edx, edx
je 0x10049a0e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x100498e0
mov al, 1
jmp 0x10049a1d
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x10049a1b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001240
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x20
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call fcn.10004110
push eax
call fcn.10004760
add esp, 0xc
test eax, eax
je 0x100012be
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call fcn.100045a0
add esp, 0xc
test eax, eax
je 0x100012be
mov eax, dword [esp + 4]
push 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push 0x10
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
call fcn.10003ce0
add esp, 0x18
push dword [esp]
call fcn.10003e30
mov ecx, dword [esp + 0x20]
add esp, 4
xor ecx, esp
call fcn.100093ed
add esp, 0x20
ret
Function at 0x100016f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x268
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x278]
lea eax, [esp + 0x71]
push edi
push 0x1ff
push 0
push eax
mov byte [esp + 0x80], 0
call fcn.10009f00
mov eax, 0x54
mov dword [esp + 0x20], 0x200
mov word [esp + 0x46], ax
mov dword [esp + 0x48], 0x410057
mov dword [esp + 0x42], 0x46004f
lea ebp, [eax + 0x15]
mov dword [esp + 0x64], 0x43005c
mov eax, 0x53
mov dword [esp + 0x50], 0x4d005c
mov word [esp + 0x40], ax
mov eax, 0x65
mov word [esp + 0x34], ax
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
lea eax, [esp + 0x4c]
mov dword [esp + 0x74], 0x790072
push eax
push 0x80000002
mov dword [esp + 0x88], 0x610072
mov dword [esp + 0x90], 0x79
mov dword [esp + 0x6c], 0x6f0072
mov dword [esp + 0x74], 0x740066
mov dword [esp + 0x8c], 0x680070
mov dword [esp + 0x68], 0x630069
mov dword [esp + 0x60], 0x450052
mov dword [esp + 0x84], 0x67006f
mov dword [esp + 0x80], 0x740070
mov dword [esp + 0x70], 0x6f0073
mov dword [esp + 0x50], 0x64
mov dword [esp + 0x40], 0x680063
mov dword [esp + 0x44], 0x6e0069
mov dword [esp + 0x4a], 0x750047
mov dword [esp + 0x3c], 0x61004d
mov word [esp + 0x4e], bp
call fcn.10004a00
add esp, 0x20
test eax, eax
jne 0x100018b9
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x24]
call fcn.10004aa0
add esp, 0x18
test eax, eax
je 0x10001899
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
lea eax, [esp + 0x40]
push eax
push 0x80000002
call fcn.10004a00
add esp, 0x14
test eax, eax
jne 0x100018b9
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x24]
call fcn.10004aa0
add esp, 0x18
test eax, eax
jne 0x100018b9
push 0xffffffffffffffff
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x288]
push esi
call fcn.1000932f
push dword [esp + 0x20]
call fcn.10004980
add esp, 0x14
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100093ed
add esp, 0x268
ret
Function at 0x10001a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xc94
mov eax, dword [0x1001f020]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, 0x43
mov dword [ebp + 0x22], 0x720075
mov word [ebp + 0x20], ax
mov ecx, 0x72
mov eax, 0x52
mov dword [ebp + 0xa], 0x690057
mov word [ebp - 0x10], ax
mov eax, 0x4d
push ebx
push esi
mov word [ebp - 0xa], ax
mov esi, 0x6f
push edi
mov edi, dword [ebp + 0x78]
mov eax, 0x65
mov word [ebp + 0x30], ax
mov eax, ecx
push 0x7fc
mov word [ebp + 0x50], ax
lea eax, [ebp - 0xc18]
push 0
push eax
mov dword [ebp - 8], 0x630069
mov dword [ebp - 0x14], 0x410057
mov dword [ebp - 0xe], 0x5c0045
mov dword [ebp - 0x1c], 0x4f0053
mov dword [ebp - 2], 0x73006f
mov dword [ebp + 2], 0x66006f
mov dword [ebp + 0x32], 0x730072
mov dword [ebp - 0x18], 0x540046
mov dword [ebp + 0x18], 0x4e0020
mov dword [ebp + 0x28], 0x6e0065
mov dword [ebp + 0x36], 0x6f0069
mov dword [ebp + 6], 0x5c0074
mov dword [ebp + 0x1c], 0x5c0054
mov dword [ebp + 0x2c], 0x560074
mov dword [ebp + 0x14], 0x730077
mov dword [ebp + 0xe], 0x64006e
mov word [ebp + 0x26], cx
mov word [ebp - 4], cx
mov dword [ebp + 0x3a], 0x6e
mov word [ebp + 0x12], si
mov dword [ebp + 0x52], 0x64006f
mov dword [ebp + 0x56], 0x630075
mov dword [ebp + 0x4c], 0x50006c
mov dword [ebp + 0x48], 0x610074
mov dword [ebp + 0x5a], 0x490074
mov dword [ebp + 0x44], 0x690067
mov dword [ebp + 0x5e], 0x64
mov dword [ebp + 0x40], 0x690044
mov dword [ebp - 0xc1c], 0
call fcn.10009f00
lea eax, [ebp - 0xc24]
mov dword [ebp - 0xc20], 0x800
push eax
push 0x101
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x80000002
call fcn.10004a00
add esp, 0x20
test eax, eax
jne 0x10001c53
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0xc1c]
push eax
push 0
push 0
lea eax, [ebp + 0x40]
push eax
push dword [ebp - 0xc24]
call fcn.10004aa0
add esp, 0x18
test eax, eax
jne 0x10001c45
push 0x3ff
push eax
mov byte [ebp - 0x41c], al
lea eax, [ebp - 0x41b]
push eax
call fcn.10009f00
push dword [ebp - 0xc20]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0xc1c]
push eax
call fcn.100011d0
add esp, 0x18
mov dword [ebp + 0x64], 0x730025
xor eax, eax
mov word [ebp + 0x68], ax
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001c00
sub eax, edx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x10001c18
xor eax, eax
jmp 0x10001c32
lea eax, [esi + esi]
call fcn.10009850
mov eax, esp
lea ecx, [ebp - 0x41c]
push 3
push esi
push ecx
push eax
call fcn.10007c90
push eax
lea eax, [ebp + 0x64]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x7c]
push edi
call fcn.10008ad1
add esp, 0x14
push dword [ebp - 0xc24]
call fcn.10004980
add esp, 4
lea esp, [ebp - 0xc30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6c]
xor ecx, ebp
call fcn.100093ed
lea esp, [ebp + 0x70]
pop ebp
ret
Function at 0x10002ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x868
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x864], eax
mov eax, dword [esp + 0x878]
mov dword [0x1002036c], eax
mov eax, dword [esp + 0x874]
mov dword [0x10020370], eax
mov eax, dword [esp + 0x870]
push 0x3ff
mov dword [0x10020374], eax
lea eax, [esp + 0x469]
push 0
push eax
mov byte [esp + 0x470], 0
call fcn.10009f00
push 0x3ff
lea eax, [esp + 0x75]
mov byte [esp + 0x74], 0
push 0
push eax
call fcn.10009f00
lea eax, [esp + 0x47c]
push eax
call fcn.10001c70
lea eax, [esp + 0x68]
mov word [esp + 0x68], 0x4f5c
push eax
lea eax, [esp + 0x484]
mov dword [esp + 0x7e], 0x6674742e
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x73], 0x61536e65
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x90]
mov word [esp + 0x85], 0x6269
push 0x400
push eax
mov word [esp + 0x90], 0x646c
mov word [esp + 0x8b], 0x6d65
mov word [esp + 0x88], 0x2d73
mov byte [esp + 0x8f], 0x6f
mov byte [esp + 0x87], 0x6e
mov byte [esp + 0x8a], 0x53
mov byte [esp + 0x96], 0
mov byte [esp + 0x82], 0x70
mov dword [esp + 0x73], 0x6c756765
mov dword [esp + 0x6f], 0x522d736e
mov word [esp + 0x79], 0x742e
mov dword [esp + 0x6a], 0x536e6570
mov word [esp + 0x7c], 0x66
mov word [esp + 0x68], 0x4f5c
mov byte [esp + 0x6e], 0x61
mov word [esp + 0x77], 0x7261
mov byte [esp + 0x7b], 0x74
mov word [esp + 0x50], 0x4f5c
mov word [esp + 0x60], 0x742e
mov dword [esp + 0x5b], 0x696c6174
mov word [esp + 0x53], 0x6e65
mov byte [esp + 0x52], 0x70
mov word [esp + 0x63], 0x66
mov word [esp + 0x56], 0x6e61
mov byte [esp + 0x55], 0x53
mov word [esp + 0x59], 0x492d
mov byte [esp + 0x58], 0x73
mov byte [esp + 0x5f], 0x63
mov byte [esp + 0x62], 0x74
mov dword [esp + 0x3e], 0x536e6570
mov dword [esp + 0x4a], 0x6674742e
mov dword [esp + 0x45], 0x6c6f422d
mov word [esp + 0x3c], 0x4f5c
mov word [esp + 0x43], 0x736e
mov byte [esp + 0x42], 0x61
mov byte [esp + 0x49], 0x64
mov byte [esp + 0x4e], 0
mov dword [esp + 0x35], 0x732573
mov byte [esp + 0x34], 0x25
call fcn.10008a96
lea eax, [esp + 0x98]
push eax
call fcn.10004b60
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x4a0]
push eax
lea eax, [esp + 0x40]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xac]
push 0x400
push eax
call fcn.10008a96
add esp, 0x50
lea eax, [esp + 0x64]
push eax
call fcn.10004b60
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x46c]
push eax
lea eax, [esp + 0xc]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x78]
push 0x400
push eax
call fcn.10008a96
lea eax, [esp + 0x80]
push eax
call fcn.10004b60
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x488]
push eax
lea eax, [esp + 0x28]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x94]
push 0x400
push eax
call fcn.10008a96
lea eax, [esp + 0x9c]
push eax
call fcn.10004b60
mov ecx, dword [esp + 0x8a0]
add esp, 0x3c
xor ecx, esp
call fcn.100093ed
add esp, 0x868
ret
Function at 0x10003a70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
or eax, 0xffffffff
mov cl, byte [edx]
test cl, cl
je 0x10003b17
movzx ecx, cl
lea edx, [edx + 1]
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10003a81
not eax
ret

Function at 0x10003b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp], 0x61766441
push eax
mov dword [esp + 0xd], 0x6c6c64
mov word [esp + 0xb], 0x2e32
mov word [esp + 8], 0x6970
mov byte [esp + 0xa], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100093ed
add esp, 0x14
ret

Function at 0x10003bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov word [esp + 6], 0x3233
push eax
mov dword [esp + 5], 0x656e7265
mov byte [esp + 9], 0x6c
mov dword [esp + 0xd], 0x6c6c64
mov byte [esp + 0xc], 0x2e
mov byte [esp + 4], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100093ed
add esp, 0x14
ret

Function at 0x10003ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov dword [esp + 0xc], eax
xor esi, esi
mov eax, dword [esp + 0x48]
push edi
mov dword [esp + 0x14], eax
call fcn.10003b20
mov edi, eax
test edi, edi
je 0x10003d85
lea eax, [esp + 0x18]
mov word [esp + 0x28], 0x656c
push eax
push edi
mov dword [esp + 0x21], 0x73756a64
mov dword [esp + 0x29], 0x72506e65
mov byte [esp + 0x20], 0x41
mov word [esp + 0x33], 0x7365
mov byte [esp + 0x32], 0x67
mov word [esp + 0x2d], 0x7669
mov dword [esp + 0x25], 0x6b6f5474
mov byte [esp + 0x35], 0
mov byte [esp + 0x2f], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003d7e
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x4c]
push ebp
push dword [esp + 0x4c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100093ed
add esp, 0x24
ret
Function at 0x10003da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
call fcn.10003c90
mov edi, eax
test edi, edi
je 0x10003e15
lea eax, [esp + 0xc]
mov word [esp + 0x15], 0x7542
push eax
push edi
mov dword [esp + 0x17], 0x776f4c72
mov word [esp + 0x15], 0x6168
mov word [esp + 0x20], 0x4166
mov byte [esp + 0x1f], 0x66
mov byte [esp + 0x14], 0x43
mov word [esp + 0x1b], 0x7265
mov byte [esp + 0x22], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003e0e
push dword [esp + 0x28]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100093ed
add esp, 0x14
ret

Function at 0x10003eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [esp + 0x28]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x30]
push eax
mov dword [esp + 0x20], 0x746f6873
mov dword [esp + 0x13], 0x686c6f6f
mov dword [esp + 0xc], 0x61657243
mov word [esp + 0x18], 0x706c
mov word [esp + 0x1b], 0x5332
mov word [esp + 0x1e], 0x7061
mov word [esp + 0x10], 0x6574
mov byte [esp + 0x17], 0x65
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x24], 0
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x12], 0x54
call fcn.10003bb0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003f3f
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100093ed
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.100093ed
add esp, 0x20
ret

Function at 0x10003f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x28]
push eax
mov word [esp + 0xf], 0x4664
mov word [esp + 0x1b], 0x57
mov dword [esp + 0x16], 0x6d756c6f
mov word [esp + 0xc], 0x6946
mov dword [esp + 0x11], 0x74737269
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0x15], 0x56
call fcn.10003bb0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003fd6
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100093ed
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.100093ed
add esp, 0x18
ret
Function at 0x10003ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor esi, esi
call fcn.10003c90
mov edi, eax
test edi, edi
je 0x10004055
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x6f646e69
push eax
push edi
mov word [esp + 0x22], 0x41
mov dword [esp + 0x18], 0x646e6946
mov byte [esp + 0x1c], 0x57
mov byte [esp + 0x21], 0x77
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000404e
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100093ed
add esp, 0x10
ret

Function at 0x10004070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov dword [esp + 0xc], eax
xor esi, esi
mov eax, dword [esp + 0x38]
push edi
mov dword [esp + 0x14], eax
call fcn.10003c90
mov edi, eax
test edi, edi
je 0x100040ee
lea eax, [esp + 0x18]
mov dword [esp + 0x21], 0x41784577
push eax
push edi
mov dword [esp + 0x20], 0x646e6946
mov dword [esp + 0x24], 0x646e6957
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x2d], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100040e7
push dword [esp + 0x14]
push dword [esp + 0x14]
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100093ed
add esp, 0x1c
ret

Function at 0x10004110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x14], eax
lea eax, [esp]
mov word [esp], 0x6547
push eax
mov dword [esp + 0xb], 0x50746e65
mov word [esp + 0xf], 0x6f72
mov dword [esp + 0x12], 0x737365
mov dword [esp + 7], 0x72727543
mov byte [esp + 0x11], 0x63
mov byte [esp + 6], 0x74
call fcn.10003bb0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10004172
call eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100093ed
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
or eax, 0xffffffff
xor ecx, esp
call fcn.100093ed
add esp, 0x18
ret
Function at 0x10004190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x28]
push eax
mov word [esp + 0xf], 0x6f4d
mov dword [esp + 0x12], 0x46656c75
mov dword [esp + 0x1b], 0x41656d
mov word [esp + 0xc], 0x6547
mov dword [esp + 0x17], 0x614e656c
mov byte [esp + 0x11], 0x64
mov byte [esp + 0xe], 0x74
mov byte [esp + 0x16], 0x69
call fcn.10003bb0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000420b
push dword [esp + 0x2c]
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100093ed
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.100093ed
add esp, 0x18
ret

Function at 0x10004220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 2], 0x63695474
push eax
mov word [esp + 0xb], 0x6f43
mov word [esp + 0xe], 0x746e
mov byte [esp + 0xd], 0x75
mov byte [esp + 0x10], 0
mov word [esp + 4], 0x6547
mov byte [esp + 0xa], 0x6b
call fcn.10003bb0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000427f
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100093ed
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
xor ecx, esp
call fcn.100093ed
add esp, 0x14
ret

Function at 0x10004290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1001f020]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x48]
push esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push edi
mov edi, dword [esp + 0x3c]
push eax
mov word [esp + 0x23], 0x656d
mov dword [esp + 0x2c], 0x6e6f6974
mov dword [esp + 0x1e], 0x6c6f5674
mov dword [esp + 0x26], 0x726f666e
mov word [esp + 0x2a], 0x616d
mov word [esp + 0x1c], 0x6547
mov word [esp + 0x30], 0x57
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x25], 0x49
call fcn.10003bb0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000433e
push dword [esp + 0x54]
push dword [esp + 0x18]
push dword [esp + 0x18]
push ebp
push ebx
push dword [esp + 0x54]
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100093ed
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100093ed
add esp, 0x24
ret