joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x52
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x71
mov byte [ebp - 6], 0x75
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x74
mov byte [ebp - 2], 0x41
mov byte [ebp - 1], 0
cmp dword [0x10030354], 0
jne 0x1000c884
lea eax, [ebp - 0x10]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030354], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10030354]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000c8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x52
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x71
mov byte [ebp - 9], 0x75
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x41
mov byte [ebp - 4], 0
cmp dword [0x1003034c], 0
jne 0x1000c908
lea eax, [ebp - 0x14]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003034c], eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x1003034c]
mov esp, ebp
pop ebp
ret 0x20

Function at 0x1000c940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x79
mov byte [ebp - 7], 0x49
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x6f
mov byte [ebp - 3], 0x41
mov byte [ebp - 2], 0
cmp dword [0x10030358], 0
jne 0x1000c9a0
lea eax, [ebp - 0x10]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030358], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x10030358]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1000c9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x52
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x71
mov byte [ebp - 9], 0x75
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x45
mov byte [ebp - 4], 0x78
mov byte [ebp - 3], 0x41
mov byte [ebp - 2], 0
cmp dword [0x10030350], 0
jne 0x1000ca30
lea eax, [ebp - 0x14]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030350], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x10030350]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1000ca50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x48
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0x65
mov byte [ebp - 1], 0
cmp dword [0x10030364], 0
jne 0x1000cac4
lea eax, [ebp - 0x14]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030364], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10030364]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000cae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x41
mov byte [ebp - 4], 0
cmp dword [0x10030344], 0
jne 0x1000cb48
lea eax, [ebp - 0x14]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030344], eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
movzx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x10030344]
mov esp, ebp
pop ebp
ret 0x20
Function at 0x1000cb80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x49
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x4f
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0x41
mov byte [ebp - 3], 0
cmp dword [0x10030340], 0
jne 0x1000cbdc
lea eax, [ebp - 0x10]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030340], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x10030340]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1000cc00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x52
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x46
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0
cmp dword [0x1003035c], 0
jne 0x1000cc68
lea eax, [ebp - 0x14]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003035c], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x1003035c]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000cc90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x4f
mov byte [ebp - 8], 0x70
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x69
mov byte [ebp - 5], 0x6f
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0x41
mov byte [ebp - 2], 0
cmp dword [0x10030360], 0
jne 0x1000cd00
lea eax, [ebp - 0x14]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030360], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10030360]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000cd20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 6], 0x69
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0
cmp dword [0x10030348], 0
jne 0x1000cd8c
lea eax, [ebp - 0x14]
push eax
call fcn.1000e460
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030348], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10030348]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000cdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 0x18], 0x4c
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x43
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0
cmp dword [0x10030334], 0
jne 0x1000ce28
lea eax, [ebp - 0x18]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030334], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10030334]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ce40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x52
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x45
mov byte [ebp - 6], 0x76
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0x74
mov byte [ebp - 2], 0
cmp dword [0x10030338], 0
jne 0x1000ce90
lea eax, [ebp - 0xc]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030338], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10030338]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000cea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0x10], 0x68
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x50
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x69
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0x79
mov byte [ebp - 3], 0
cmp dword [0x1003033c], 0
jne 0x1000cf0c
lea eax, [ebp - 0x14]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003033c], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x1003033c]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000f0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x43
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0x75
mov byte [ebp - 3], 0x70
mov byte [ebp - 2], 0
cmp dword [0x100305ac], 0
jne 0x1000f130
lea eax, [ebp - 0xc]
push eax
call fcn.1000a590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100305ac], eax
call dword [0x100305ac]
mov esp, ebp
pop ebp
ret

Function at 0x1000f140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0xd], 0x47
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x4c
mov byte [ebp - 9], 0x61
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x45
mov byte [ebp - 5], 0x72
mov byte [ebp - 4], 0x72
mov byte [ebp - 3], 0x6f
mov byte [ebp - 2], 0x72
mov byte [ebp - 1], 0
cmp dword [0x100305b0], 0
jne 0x1000f1a4
lea eax, [ebp - 0x10]
push eax
call fcn.1000a590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100305b0], eax
call dword [0x100305b0]
mov esp, ebp
pop ebp
ret

Function at 0x1000f1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0x41
mov byte [ebp - 0x15], 0x47
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x4f
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x70
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x52
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x73
mov byte [ebp - 5], 0x75
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x74
mov byte [ebp - 2], 0
cmp dword [0x100305a4], 0
jne 0x1000f230
lea eax, [ebp - 0x18]
push eax
call fcn.1000a590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100305a4], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x100305a4]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1000f3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x53
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0x75
mov byte [ebp - 3], 0x70
mov byte [ebp - 2], 0
cmp dword [0x100305a8], 0
jne 0x1000f400
lea eax, [ebp - 0xc]
push eax
call fcn.1000a590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100305a8], eax
mov ecx, dword [ebp + 0xc]
push ecx
movzx edx, word [ebp + 8]
push edx
call dword [0x100305a8]
mov esp, ebp
pop ebp
ret 8

Function at 0x1000f420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x63
mov byte [ebp - 4], 0x6b
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], 0x74
mov byte [ebp - 1], 0
cmp dword [0x10030588], 0
jne 0x1000f474
lea eax, [ebp - 0xc]
push eax
call fcn.1000a590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030588], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10030588]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x70
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0x61
mov byte [ebp - 3], 0x6d
mov byte [ebp - 2], 0x65
mov byte [ebp - 1], 0
cmp dword [0x10030590], 0
jne 0x1000f544
lea eax, [ebp - 0xc]
push eax
call fcn.1000a590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030590], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x10030590]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000f560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x6b
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0x61
mov byte [ebp - 3], 0x6d
mov byte [ebp - 2], 0x65
mov byte [ebp - 1], 0
cmp dword [0x1003058c], 0
jne 0x1000f5b4
lea eax, [ebp - 0xc]
push eax
call fcn.1000a590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003058c], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x1003058c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000f680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x6b
mov byte [ebp - 5], 0x6f
mov byte [ebp - 4], 0x70
mov byte [ebp - 3], 0x74
mov byte [ebp - 2], 0
cmp dword [0x10030580], 0
jne 0x1000f6d0
lea eax, [ebp - 0xc]
push eax
call fcn.1000a590
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030580], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x10030580]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10011540
Capabilities:
Enumerate disk volumes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x100308c0
call fcn.100112a0
add esp, 0x10
push 0x400
call fcn.100024b0
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
push 0x400
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 8], eax
mov eax, dword [str..c:]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x1002042c]
mov dword [ebp - 0x2c], ecx
mov edx, dword [0x10020430]
mov dword [ebp - 0x28], edx
mov ax, word [0x10020434]
mov word [ebp - 0x24], ax
lea ecx, [ebp - 0x30]
push ecx
call fcn.10014a20
add esp, 4
test eax, eax
jne 0x1001163d
xor edx, edx
mov word [ebp - 0x20], dx
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], ax
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x30]
cmp eax, 0x5c
jne 0x10011613
mov ecx, 2
shl ecx, 0
movzx edx, word [ebp + ecx - 0x30]
cmp edx, 0x5c
jne 0x10011613
mov eax, 2
shl eax, 2
movzx ecx, word [ebp + eax - 0x30]
push ecx
push 0x10020438
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x10011629
lea eax, [ebp - 0x30]
push eax
push 0x10020444
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.100112a0
add esp, 0x10
mov ecx, 2
shl ecx, 2
movzx edx, word [ebp + ecx - 0x30]
add edx, 1
mov eax, 2
shl eax, 2
mov word [ebp + eax - 0x30], dx
push 0x400
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x100115a7
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 4], 0
je 0x100116a1
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100024d0
add esp, 4
mov dword [ebp - 4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10011c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x57
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6f
mov byte [ebp - 3], 0x77
mov byte [ebp - 2], 0x57
mov byte [ebp - 1], 0
cmp dword [0x10030aec], 0
jne 0x10011ca4
lea eax, [ebp - 0xc]
push eax
call fcn.10005320
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030aec], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x10030aec]
mov esp, ebp
pop ebp
ret 8

Function at 0x10011d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x45
mov byte [ebp - 6], 0x78
mov byte [ebp - 5], 0x57
mov byte [ebp - 4], 0
cmp dword [0x10030ad4], 0
jne 0x10011dc8
lea eax, [ebp - 0x18]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030ad4], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x10030ad4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10011df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x67
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x44
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x76
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x53
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x69
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0x67
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], 0x57
mov byte [ebp - 1], 0
cmp dword [0x10030ae4], 0
jne 0x10011e74
lea eax, [ebp - 0x18]
push eax
call fcn.100014b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030ae4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x10030ae4]
mov esp, ebp
pop ebp
ret 8