joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
call fcn.10022be0
mov ecx, eax
call fcn.10022f80
test eax, eax
je 0x1001c67c
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x74536f54
push ecx
push eax
mov dword [esp + 0x1a], 0x41676e
mov dword [esp + 0x10], 0x64697555
mov word [esp + 0x18], 0x6972
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c67c
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
mov eax, 0xe
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001c6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
call fcn.10022be0
mov ecx, eax
call fcn.10022d90
test eax, eax
je 0x1001c725
lea ecx, [esp + 4]
mov word [esp + 0x11], 0x6d61
push ecx
push eax
mov word [esp + 0x10], 0x6946
mov word [esp + 0xd], 0x7461
mov word [esp + 0x1c], 0x41
mov byte [esp + 0xf], 0x68
mov dword [esp + 0x12], 0x6946646e
mov byte [esp + 0xc], 0x50
mov word [esp + 0x17], 0x4e65
mov byte [esp + 0x16], 0x6c
mov byte [esp + 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c725
push esi
call eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x1001c740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
call fcn.10022be0
mov ecx, eax
call fcn.10022fe0
test eax, eax
je 0x1001c7d4
lea ecx, [esp + 0x10]
mov word [esp + 0x13], 0x7551
push ecx
push eax
mov word [esp + 0x23], 0x6575
mov word [esp + 0x20], 0x6156
mov word [esp + 0x18], 0x6556
mov word [esp + 0x1d], 0x7265
mov word [esp + 0x25], 0x41
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1f], 0x79
mov byte [esp + 0x22], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c7d4
push ebp
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
Function at 0x1001c7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x28]
push eax
mov dword [esp + 0xe], 0x6946646e
mov dword [esp + 0x13], 0x6f567473
mov dword [esp + 0x19], 0x57656d
mov word [esp + 0x17], 0x756c
mov byte [esp + 0x12], 0x72
mov word [esp + 0xc], 0x6946
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c864
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x1001c880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001c8fb
lea ecx, [esp + 4]
mov word [esp + 0x14], 0x656c
push ecx
push eax
mov dword [esp + 0xe], 0x5365736f
mov dword [esp + 0x13], 0x63697672
mov dword [esp + 0x17], 0x6e614865
mov word [esp + 0xc], 0x6c43
mov byte [esp + 0x1b], 0x64
mov byte [esp + 0x1e], 0
mov byte [esp + 0x12], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c8fb
push esi
call eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x1001c910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
call fcn.10022be0
mov ecx, eax
call fcn.10022f80
test eax, eax
je 0x1001c983
lea ecx, [esp + 4]
mov dword [esp + 5], 0x74536370
push ecx
push eax
mov word [esp + 0x14], 0x4667
mov word [esp + 0x11], 0x6972
mov dword [esp + 0x16], 0x41656572
mov byte [esp + 0xc], 0x52
mov byte [esp + 0x1a], 0
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c983
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov eax, 0xe
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
Function at 0x1001c9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x30]
call fcn.10022be0
mov ecx, eax
call fcn.10022fe0
test eax, eax
je 0x1001ca3e
lea ecx, [esp + 8]
mov word [esp + 8], 0x6547
push ecx
push eax
mov word [esp + 0x18], 0x7265
mov dword [esp + 0x13], 0x656c6946
mov word [esp + 0x1e], 0x6e49
mov word [esp + 0x1b], 0x6f69
mov word [esp + 0x21], 0x416f
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x23], 0
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x20], 0x66
mov byte [esp + 0x17], 0x56
mov byte [esp + 0x1d], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001ca3e
push edi
push dword [esp + 0x30]
push dword [esp + 0x30]
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x1001ca60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x20]
push eax
mov word [esp + 0x13], 0x6c6c
mov word [esp + 0x16], 0x63
mov word [esp + 0x11], 0x416c
mov dword [esp + 0xc], 0x626f6c47
mov byte [esp + 0x10], 0x61
mov byte [esp + 0x15], 0x6f
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001cad0
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret

Function at 0x1001caf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x28]
push eax
mov word [esp + 0xd], 0x7465
mov dword [esp + 0x1a], 0x41656d61
mov dword [esp + 0x16], 0x4e656c69
mov dword [esp + 0x10], 0x6c75646f
mov byte [esp + 0x1e], 0
mov word [esp + 0x14], 0x4665
mov byte [esp + 0xf], 0x4d
mov byte [esp + 0xc], 0x47
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001cb72
push dword [esp + 0x2c]
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
Function at 0x1001cb90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x30]
push eax
mov word [esp + 0x19], 0x7061
mov dword [esp + 0x22], 0x656c69
mov dword [esp + 0x1e], 0x46664f77
mov word [esp + 0x1c], 0x6569
mov byte [esp + 0x18], 0x4d
mov byte [esp + 0x1b], 0x56
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001cc1b
push dword [esp + 0x10]
push ebp
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x1001cc30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001ccd1
lea ecx, [esp + 8]
mov word [esp + 0x14], 0x4365
push ecx
push eax
mov dword [esp + 0x11], 0x676e6168
mov word [esp + 0x19], 0x6976
mov word [esp + 0x16], 0x6553
mov word [esp + 0x21], 0x6769
mov word [esp + 0x24], 0x41
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x1b], 0x63
mov word [esp + 0x1f], 0x666e
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x10], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001ccd1
push edi
push dword [esp + 0x30]
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret

Function at 0x1001cdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x28]
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001ce3a
lea ecx, [esp + 0xc]
mov word [esp + 0xf], 0x704f
push ecx
push eax
mov dword [esp + 0x1e], 0x417845
mov word [esp + 0x14], 0x6552
mov word [esp + 0x1c], 0x7965
mov word [esp + 0x19], 0x6e65
mov byte [esp + 0x16], 0x67
mov byte [esp + 0x1b], 0x4b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001ce3a
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
Function at 0x1001cf00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x28]
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001cf87
lea ecx, [esp + 0xc]
mov dword [esp + 0x12], 0x616e614d
push ecx
push eax
mov word [esp + 0x1e], 0x6567
mov word [esp + 0x21], 0x41
mov word [esp + 0x15], 0x6570
mov word [esp + 0x18], 0x4353
mov byte [esp + 0x14], 0x4f
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x20], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001cf87
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001cfa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x2c]
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001d02b
lea ecx, [esp + 8]
mov word [esp + 0xc], 0x7250
push ecx
push eax
mov word [esp + 0x1d], 0x656b
mov dword [esp + 0x10], 0x6e65704f
mov word [esp + 0x17], 0x6563
mov word [esp + 0x1a], 0x5473
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x16], 0x6f
mov byte [esp + 0x1c], 0x6f
mov word [esp + 0x1f], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d02b
push edi
push dword [esp + 0x2c]
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x1001d040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x28]
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001d0ba
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x41656369
push ecx
push eax
mov word [esp + 0x14], 0x704f
mov dword [esp + 0x17], 0x7265536e
mov byte [esp + 0x20], 0
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x1b], 0x76
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d0ba
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
Function at 0x1001d0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
mov word [esp + 8], 0x6547
mov dword [esp + 0xe], 0x6e6f6973
mov dword [esp + 0x12], 0x417845
mov word [esp + 0xb], 0x6556
mov byte [esp + 0xd], 0x72
mov byte [esp + 0xa], 0x74
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d13a
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001d150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001d1c6
lea ecx, [esp + 4]
mov word [esp + 0xb], 0x4b65
push ecx
push eax
mov word [esp + 0x16], 0x79
mov word [esp + 0x10], 0x6f6c
mov word [esp + 0xd], 0x6765
mov byte [esp + 0xc], 0x52
mov byte [esp + 0xf], 0x43
mov byte [esp + 0x12], 0x73
mov byte [esp + 0x15], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d1c6
push esi
call eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
mov eax, 1
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret

Function at 0x1001d1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push eax
mov word [esp + 0x11], 0x65
mov dword [esp + 0xa], 0x6c61626f
mov word [esp + 8], 0x6c47
mov word [esp + 0xe], 0x7246
mov byte [esp + 0x10], 0x65
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d244
push esi
call eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret

Function at 0x1001d370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x64616f4c
mov dword [esp + 0x11], 0x417972
mov dword [esp + 0xd], 0x61726269
mov byte [esp + 0xc], 0x4c
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d3cf
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
Function at 0x1001d460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x28]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
push eax
mov dword [esp + 0x17], 0x70614d65
mov word [esp + 0x1c], 0x6e69
mov word [esp + 0x10], 0x704f
mov dword [esp + 0x13], 0x6c69466e
mov word [esp + 0x1f], 0x41
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x12], 0x65
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d4e4
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x1001d500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
mov dword [esp + 0xd], 0x77656956
mov word [esp + 0xb], 0x7061
mov dword [esp + 0x12], 0x6c694666
mov word [esp + 8], 0x6e55
mov word [esp + 0x16], 0x65
mov byte [esp + 0x11], 0x4f
mov byte [esp + 0xa], 0x6d
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d571
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001d590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x34]
push eax
mov word [esp + 0x27], 0x6c69
mov word [esp + 0x2a], 0x41
mov dword [esp + 0x20], 0x61657243
mov word [esp + 0x25], 0x4665
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x24], 0x74
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d632
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x20]
push ebp
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret
mov ecx, dword [esp + 0x28]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret
Function at 0x1001d760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 6], 0x756f436b
push eax
mov word [esp + 0xe], 0x746e
mov dword [esp + 6], 0x63695474
mov byte [esp + 0x10], 0
mov word [esp + 4], 0x6547
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d7bd
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001d7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
mov word [esp + 0x25], 0x656d
mov dword [esp + 0x20], 0x54656c69
mov dword [esp + 0x1c], 0x46734165
mov dword [esp + 0x10], 0x53746547
mov word [esp + 0x1a], 0x6d69
mov word [esp + 0x14], 0x7379
mov word [esp + 0x17], 0x6d65
mov byte [esp + 0x27], 0
mov byte [esp + 0x19], 0x54
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x16], 0x74
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d84e
lea ecx, [esp + 4]
push ecx
call eax
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
sub ecx, 0xd53e8000
push 0
push 0x989680
sbb eax, 0x19db1de
push eax
push ecx
call fcn.1002cd00
test esi, esi
je 0x1001d878
mov dword [esi], eax
mov dword [esi + 4], edx
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x24
ret
Function at 0x1001fde0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1001fe1b
xor edx, edx
cmp dword [esi + 0x3cc], edx
jle 0x1001fe14
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x1001fe01
pop edi
pop esi
add esp, 0xc
ret 8
push dword [0x1012e73c]
lea ecx, [esp + 8]
call fcn.1001fd70
push 0x1005dccc
lea eax, [esp + 8]
push eax
call fcn.1002e455
int3