joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012fd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x77
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x56
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x46
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x69
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x55
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0xf
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x10
jae 0x10013060
jmp 0x10013065
call fcn.10020aa1
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x4f
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x66
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x69
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x70
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x14], 0x6c
lea eax, [ebp - 0x14]
push eax
call fcn.1000fcf0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100130d0
push dword [ebp + 8]
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10020d61
leave
ret
Function at 0x100134df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099e3b
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
and dword [ebp - 0x58], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.10013693
lea ecx, [ebp - 0x4c]
call fcn.1000260c
and dword [ebp - 4], 0
push 0x20
lea ecx, [ebp - 0x4c]
call fcn.10009bf4
and dword [ebp - 0x50], 0
jmp 0x1001353d
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x10
jge 0x10013656
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x24], 0x35
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x24], 0x66
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x24], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x24], 0x65
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x24], 0x39
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x24], 0x32
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x24], 0x34
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x24], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x24], 0x62
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x24], 0x31
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x24], 0x36
xor eax, eax
inc eax
shl eax, 4
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x11
jae 0x100135d0
jmp 0x100135d5
call fcn.10020aa1
mov eax, dword [ebp - 0x54]
mov byte [ebp + eax - 0x24], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x24], 0x30
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x24], 0x38
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x24], 0x33
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x24], 0x37
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x24], 0x63
mov eax, dword [ebp - 0x50]
movzx eax, byte [ebp + eax - 0x34]
sar eax, 4
and eax, 0xf
mov al, byte [ebp + eax - 0x24]
mov byte [ebp - 0x60], al
push dword [ebp - 0x60]
lea ecx, [ebp - 0x4c]
call fcn.1000e5fd
mov eax, dword [ebp - 0x50]
movzx eax, byte [ebp + eax - 0x34]
and eax, 0xf
mov al, byte [ebp + eax - 0x24]
mov byte [ebp - 0x64], al
push dword [ebp - 0x64]
lea ecx, [ebp - 0x4c]
call fcn.1000e5fd
jmp 0x10013536
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
call fcn.100023d0
mov eax, dword [ebp - 0x58]
or eax, 1
mov dword [ebp - 0x58], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10008c95
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10020d61
leave
ret 4
Function at 0x10014a96
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
xor ecx, ecx
xor edx, edx
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
and dword [eax + 8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x67452301
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0xefcdab89
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x98badcfe
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x10325476
leave
ret
Function at 0x100191d2
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
xor ecx, ecx
xor edx, edx
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
and dword [eax + 8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x6a09e667
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0xbb67ae85
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x3c6ef372
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0xa54ff53a
push 4
pop eax
shl eax, 2
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x510e527f
push 4
pop eax
imul eax, eax, 5
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x9b05688c
push 4
pop eax
imul eax, eax, 6
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x1f83d9ab
push 4
pop eax
imul eax, eax, 7
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x5be0cd19
leave
ret

Function at 0x1001ac67
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x18
mov eax, dword [0x100b0044]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push ebp
xor ebp, ebp
push esi
mov cl, byte [ebx]
mov esi, dword [esp + 0x2c]
test cl, cl
je 0x1001ad7f
mov edx, dword [esp + 0x30]
mov al, cl
dec edx
mov dword [esp + 0xc], edx
push edi
cmp al, 0x24
je 0x1001acd5
cmp al, 0x26
je 0x1001acd5
cmp al, 0x2b
je 0x1001acd5
cmp al, 0x2c
je 0x1001acd5
cmp al, 0x2f
je 0x1001acd5
cmp al, 0x3a
je 0x1001acd5
cmp al, 0x3b
je 0x1001acd5
cmp al, 0x3d
je 0x1001acd5
cmp al, 0x3f
je 0x1001acd5
cmp al, 0x40
je 0x1001acd5
cmp al, 0x23
je 0x1001acd5
cmp al, 0x20
je 0x1001acd5
mov byte [esi], cl
xor eax, eax
xor ecx, ecx
inc ecx
inc eax
jmp 0x1001ad69
movsx eax, al
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x23], 0x783230
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x24]
mov word [esp + 0x28], 0x2525
push 4
push eax
mov byte [esp + 0x32], 0x25
call fcn.1000cd10
lea ecx, [esp + 0x2c]
add esp, 0x14
xor edi, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ad0c
sub ecx, edx
je 0x1001ad3c
movsx eax, byte [esp + edi + 0x18]
push eax
call fcn.10026b1d
pop ecx
lea ecx, [esp + 0x18]
mov byte [esp + edi + 0x18], al
inc edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ad2f
sub ecx, edx
cmp edi, ecx
jb 0x1001ad17
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x3c]
sub eax, ebp
push eax
push esi
call fcn.10027215
lea ecx, [esp + 0x28]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ad5a
sub ecx, edx
mov edx, dword [esp + 0x10]
mov eax, ecx
add esi, eax
add ebp, ecx
inc ebx
cmp ebp, edx
jae 0x1001ad7e
mov cl, byte [ebx]
mov al, cl
test cl, cl
jne 0x1001ac98
pop edi
mov ecx, dword [esp + 0x20]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10020d61
add esp, 0x18
ret
Function at 0x1001ae78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x6c65
push eax
mov dword [ebp - 0xd], 0x6c642e32
mov byte [ebp - 0xe], 0x33
mov word [ebp - 9], 0x6c
mov dword [ebp - 0x14], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10020d61
leave
ret

Function at 0x1001aefa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x6970
push eax
mov dword [ebp - 0xb], 0x6c6c64
mov word [ebp - 0xd], 0x2e32
mov dword [ebp - 0x14], 0x61766441
mov byte [ebp - 0xe], 0x33
call fcn.1001c968
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10020d61
leave
ret

Function at 0x1001af85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c6c642e
push eax
mov dword [ebp - 0xd], 0x69706177
mov word [ebp - 0xf], 0x6c68
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 5], 0
call fcn.1001c968
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10020d61
leave
ret

Function at 0x1001afc7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x6c642e6e
push eax
mov dword [ebp - 0xe], 0x6f697372
mov word [ebp - 0x10], 0x6556
mov word [ebp - 6], 0x6c
call fcn.1001c968
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10020d61
leave
ret

Function at 0x1001b007
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0x10], 0x61636f4c
mov dword [ebp - 0xb], 0x6f6c6c41
mov word [ebp - 7], 0x63
mov byte [ebp - 0xc], 0x6c
call fcn.1001ae78
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b054
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret
Function at 0x1001b0d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
or esi, 0xffffffff
push eax
mov dword [ebp - 9], 0x41656c
mov word [ebp - 0x14], 0x6946
mov word [ebp - 0x11], 0x4664
mov dword [ebp - 0xe], 0x46747372
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xa], 0x69
call fcn.1001ae78
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b130
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret

Function at 0x1001b141
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov word [ebp - 0x14], 0x6946
mov word [ebp - 0xe], 0x7478
mov word [ebp - 0x11], 0x4e64
mov word [ebp - 9], 0x4165
mov word [ebp - 0xc], 0x6946
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 7], bl
mov byte [ebp - 0xa], 0x6c
call fcn.1001ae78
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b1a3
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret

Function at 0x1001b1b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov word [ebp - 8], 0x41
mov dword [ebp - 0xd], 0x6c694679
mov word [ebp - 0x10], 0x6f43
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0x65
call fcn.1001ae78
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b207
push dword [ebp + 0x10]
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret

Function at 0x1001b35f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0xd], 0x61657268
xor ebx, ebx
mov dword [ebp - 0x15], 0x72727543
push eax
mov word [ebp - 8], 0x6449
mov byte [ebp - 6], bl
mov word [ebp - 0x17], 0x7465
mov dword [ebp - 0x11], 0x54746e65
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 9], 0x64
call fcn.1001ae78
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b3b6
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret
Function at 0x1001b4dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.1001aebc
mov esi, eax
test esi, esi
je 0x1001b53f
lea eax, [ebp - 0x18]
mov word [ebp - 0xb], 0x6957
push eax
push esi
mov dword [ebp - 8], 0x776f64
mov dword [ebp - 0xf], 0x646e756f
mov dword [ebp - 0x13], 0x72676572
mov dword [ebp - 0x17], 0x6f467465
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 9], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b538
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret

Function at 0x1001b64c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.1001aebc
mov esi, eax
test esi, esi
je 0x1001b6b8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x12], 0x65726854
push eax
push esi
mov dword [ebp - 0x17], 0x63617474
mov dword [ebp - 0xe], 0x6e496461
mov byte [ebp - 0x18], 0x41
mov word [ebp - 9], 0x7475
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 7], bl
mov byte [ebp - 0xa], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b6b1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret

Function at 0x1001b6c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
call fcn.1001aebc
mov esi, eax
test esi, esi
je 0x1001b745
lea eax, [ebp - 0x1c]
mov word [ebp - 0x17], 0x506d
push eax
push esi
mov dword [ebp - 0x1c], 0x74737953
mov dword [ebp - 0xd], 0x666e4973
mov word [ebp - 0xf], 0x7265
mov byte [ebp - 0x18], 0x65
mov dword [ebp - 0x14], 0x656d6172
mov word [ebp - 9], 0x416f
mov byte [ebp - 7], bl
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x10], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b73e
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret
Function at 0x1001b756
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.1001aebc
mov esi, eax
test esi, esi
je 0x1001b7c8
lea eax, [ebp - 0x1c]
mov word [ebp - 0x19], 0x536b
push eax
push esi
mov dword [ebp - 0x16], 0x726f4674
mov dword [ebp - 0xe], 0x57646e75
mov dword [ebp - 0xa], 0x6f646e69
mov dword [ebp - 0x12], 0x6f726765
mov byte [ebp - 0x17], 0x65
mov word [ebp - 6], 0x77
mov word [ebp - 0x1c], 0x6f4c
mov byte [ebp - 0x1a], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b7c1
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret

Function at 0x1001b7d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.1001aebc
mov esi, eax
test esi, esi
je 0x1001b853
lea eax, [ebp - 0x20]
mov dword [ebp - 0xd], 0x6f646e69
push eax
push esi
mov word [ebp - 0x14], 0x7267
mov word [ebp - 0x1c], 0x5377
mov dword [ebp - 0x11], 0x57646e75
mov word [ebp - 0x1f], 0x6c6c
mov word [ebp - 9], 0x77
mov dword [ebp - 0x18], 0x65726f46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x20], 0x41
mov word [ebp - 0x1a], 0x7465
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b84c
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret

Function at 0x1001b863
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
call fcn.1001aebc
mov esi, eax
test esi, esi
je 0x1001b8c4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x46746553
push eax
push esi
mov dword [ebp - 0x10], 0x6e756f72
mov dword [ebp - 0x14], 0x6765726f
mov dword [ebp - 8], 0x776f64
mov dword [ebp - 0xc], 0x6e695764
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b8bd
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret
Function at 0x1001bf34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x100b0044]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x30]
call fcn.1001afc7
mov esi, eax
test esi, esi
je 0x1001bfc0
lea eax, [esp + 0x10]
mov dword [esp + 0x21], 0x7a69536f
push eax
push esi
mov word [esp + 0x1b], 0x6946
mov dword [esp + 0x1d], 0x6556656c
mov word [esp + 0x18], 0x6547
mov dword [esp + 0x22], 0x6e6f6973
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x1a], 0x74
mov word [esp + 0x26], 0x6e49
mov word [esp + 0x2e], 0x41
mov byte [esp + 0x28], 0x66
mov byte [esp + 0x2d], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001bfb9
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10020d61
add esp, 0x1c
ret

Function at 0x1001bfd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b0044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4c746547
xor ebx, ebx
mov dword [ebp - 0xc], 0x726f7272
push eax
mov dword [ebp - 0x10], 0x45747361
mov byte [ebp - 8], bl
call fcn.1001ae78
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c018
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10020d61
leave
ret

Function at 0x1001c0ad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x100b0044]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x34]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x38]
call fcn.1001aefa
mov esi, eax
test esi, esi
je 0x1001c12b
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x636e4574
push eax
push esi
mov word [esp + 0x19], 0x7972
mov dword [esp + 0x21], 0x747079
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x1b], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c124
push dword [esp + 0x40]
push ebp
push edi
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10020d61
add esp, 0x14
ret