joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0xc], 0
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0xc], 0x6c
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0xc], 0x47
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0xc], 0x2e
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0xc], 0x69
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0xc], 0x32
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0xc], 0x64
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0xc], 0x64
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0xc], 0x33
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0xc], 0x6c
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x1002a0a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call fcn.100046e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002a1f1
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x43
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x20], 0x6e
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x20], 0x61
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x20], 0x73
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 0x12
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x20], 0x6c
mov edx, 1
imul eax, edx, 0x11
mov byte [ebp + eax - 0x20], 0x78
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x20], 0x79
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x20], 0x74
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x20], 0x43
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x52
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x20], 0x70
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x20], 0x72
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x20], 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002a1e7
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002a200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0xffffffff
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x1c], 0x64
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x1c], 0x57
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x1c], 0x6f
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x1c], 0x46
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x1c], 0x46
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x1c], 0x72
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x1c], 0x74
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x1c], 0
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x1c], 0x75
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x69
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x1c], 0x73
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x1c], 0x6d
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x1c], 0x69
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x1c], 0x6e
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x56
lea edx, [ebp - 0x1c]
push edx
call fcn.10004350
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002a310
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1002b110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
call fcn.10005680
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002b201
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x67
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x18], 0x6f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x18], 0x61
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x65
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x18], 0x78
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x18], 0x42
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x18], 0x41
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], 0x4d
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x18], 0x73
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002b1f7
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002b9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call fcn.100046e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002bb1e
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x20], 0x4f
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x20], 0x70
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x20], 0x54
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x20], 0x63
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x20], 0x6b
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x50
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x20], 0x6e
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x20], 0x72
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x20], 0x6e
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x20], 0x73
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x65
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002bb14
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1002bb80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x14], 0x61
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x14], 0x63
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x6c
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x41
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x14], 0x6f
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x14], 0x6c
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x14], 0x6f
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x6c
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x14], 0x6c
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x14], 0x47
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x14], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x14], 0x62
lea edx, [ebp - 0x14]
push edx
call fcn.10004350
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002bc4f
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002bc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0xc], 0
call fcn.100046e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002bdca
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx - 0x24], 0x78
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x24], 0x6f
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x24], 0x79
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x24], 0x74
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x24], 0x74
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x24], 0x43
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x24], 0x41
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x24], 0x70
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x24], 0x65
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x24], 0x74
mov eax, 1
imul ecx, eax, 0x14
mov byte [ebp + ecx - 0x24], 0
mov edx, 1
imul eax, edx, 0x13
mov byte [ebp + eax - 0x24], 0x41
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x24], 0x72
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x24], 0x72
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x24], 0x43
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x24], 0x65
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x24], 0x71
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x24], 0x69
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x24], 0x75
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x24], 0x63
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002bdc0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002c360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call fcn.100046e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002c486
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x79
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x44
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x43
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x20], 0x72
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x72
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x20], 0x6f
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x20], 0x48
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x20], 0x70
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x20], 0
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x20], 0x61
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x20], 0x68
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x20], 0x73
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x73
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x20], 0x79
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x74
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002c47c
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1002c490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x14], 0x74
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x14], 0x6c
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x41
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x14], 0
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x6e
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x14], 0x70
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x14], 0x73
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x14], 0x63
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x14], 0x79
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x14], 0x72
lea ecx, [ebp - 0x14]
push ecx
call fcn.10004350
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002c549
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002c550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
call fcn.10005680
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002c62c
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x69
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x57
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x18], 0x6e
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x18], 0x64
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x18], 0x77
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x18], 0x77
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x68
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x53
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x6f
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002c622
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1002c850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x50
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x65
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x18], 0x32
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x33
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x18], 0x74
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0x78
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x18], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x18], 0x63
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0x65
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x4e
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x72
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x73
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x6f
lea eax, [ebp - 0x18]
push eax
call fcn.10004350
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002c939
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002c940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x74
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x73
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x18], 0x61
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x72
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x18], 0x45
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x18], 0x6f
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x18], 0x4c
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x72
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x74
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x47
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0x72
lea ecx, [ebp - 0x18]
push ecx
call fcn.10004350
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002ca14
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1002caf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 1
call fcn.100046e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002cbd5
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x65
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x6c
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x52
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x4b
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x18], 0x79
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x65
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x18], 0x67
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x18], 0x43
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x6f
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002cbcb
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002cd40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x50
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x63
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x18], 0x69
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x72
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x18], 0x46
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x18], 0x72
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x73
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x18], 0x74
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x18], 0x33
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x32
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x18], 0
lea edx, [ebp - 0x18]
push edx
call fcn.10004350
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002ce36
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6a
nop
nop
sub eax, 0x403d10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4f8b3324
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x66964d40
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10005baf
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1074
call fcn.100588e0
mov eax, dword [0x1011ca44]
xor eax, esp
mov dword [esp + 0x1070], eax
push esi
mov esi, dword [esp + 0x107c]
push edi
mov edi, dword [esp + 0x1084]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
push 0
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0x58
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0x5a
push dword [esp + 0x1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x1c], xmm0
call esi
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x100c4ef4]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x100c4f18]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x108c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x100c4f18]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
mov ecx, 0x800
cvtdq2pd xmm0, xmm0
push ecx
andps xmm0, xmmword [0x100c4f30]
divsd xmm0, qword [0x100c4f00]
addsd xmm0, qword [0x100c4ef8]
cvttsd2si eax, xmm0
xorps xmm0, xmm0
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x7c]
push eax
push 0x1002
push ecx
movups xmmword [esp + 0x30], xmm0
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
push 5
lea eax, [esp + 0x7c]
push 0x100c2e18
push eax
call fcn.10075920
test eax, eax
mov ecx, 0x100c2e24
lea eax, [esp + 0x44]
cmovne ecx, edi
push ecx
push 0x20
push eax
call fcn.10075920
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push dword [esp + 0x10]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp + 0x1078]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.100587af
add esp, 0x1074
ret 0xc