joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b5ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
xor ebx, ebx
mov byte [ebp - 0x20], 0x2a
mov byte [ebp - 0x10], 0x67
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x22
mov byte [ebp - 0x18], 0x40
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], bl
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], bl
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 5], bl
mov byte [ebp - 0x14], 0xaa
mov byte [ebp - 4], bl
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], bl
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], bl
call fcn.10001ffa
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x44]
push ecx
call eax
mov ax, word [ebp - 0x44]
xor ecx, ecx
mov cl, ah
mov byte [ebp - 7], al
mov ax, word [ebp - 0x42]
mov byte [ebp - 6], cl
xor ecx, ecx
mov byte [ebp - 4], al
mov cl, ah
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 5], 0x2d
mov byte [ebp - 3], cl
call fcn.10009175
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.1000919d
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 8]
call fcn.1000924c
push 0x1f
push ebx
lea eax, [ebp - 0x20]
push eax
call fcn.10001fcb
add esp, 0x24
pop ebx
leave
ret
Function at 0x1000b6d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
lea eax, [ebp - 0x9c]
mov byte [ebp - 0x20], 0x2a
push eax
mov byte [ebp - 0x10], 0x67
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x22
mov byte [ebp - 0x18], 0x40
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], 0x11
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], 0x2b
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 5], 0x3c
mov byte [ebp - 0x14], 0xaa
mov byte [ebp - 4], 0x46
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], 0x5e
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
call fcn.10009175
lea eax, [ebp - 0x20]
push 0x1c
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.1000919d
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 8]
call fcn.1000924c
and byte [ebp - 0x27], 0
add esp, 0x18
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
call fcn.10001ffa
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x44]
push ecx
call eax
mov cx, word [ebp - 0x44]
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dl, ch
mov byte [eax], cl
mov cx, word [ebp - 0x42]
mov byte [eax + 1], dl
xor edx, edx
mov byte [eax + 2], cl
mov dl, ch
mov byte [eax + 3], dl
leave
ret
Function at 0x1000bf82
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
and byte [ebp - 8], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x72
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x72
call fcn.10001ffa
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000bfe2
leave
ret
push esi
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000c0f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x65
call fcn.10001ffa
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000c14b
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000c168
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x6f
call fcn.10001ffa
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000c1c4
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x1000c1e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 8], 0x4c
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 5], 0x74
call fcn.1000c297
test eax, eax
je 0x1000c276
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000c27a
xor eax, eax
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000c297
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x10010058], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x1000c2f9
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10010058], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
mov eax, dword [0x10010058]
add esp, 0xc
leave
ret
Function at 0x1000c310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 1], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 3], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 2], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 5], 0x61
call fcn.1000c297
test eax, eax
je 0x1000c39e
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000c3a2
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000c3cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 4], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x11], 0x47
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 9], 0x44
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 7], 0x76
call fcn.1000c297
test eax, eax
je 0x1000c442
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, fcn.1000c3cb
test ecx, ecx
jne 0x1000c446
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x15
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x1000c503
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 4], 0
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 8], 0x61
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xd], 0x63
call fcn.1000c297
test eax, eax
je 0x1000c5a5
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000c5a9
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x21
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x1000c8d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
mov byte [ebp - 0x20], 0x5c
mov byte [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1e], 0x2e
mov byte [ebp - 0x1d], 0x5c
mov byte [ebp - 0x1c], 0x4c
mov byte [ebp - 0x1b], 0x50
mov byte [ebp - 0x1a], 0x54
mov byte [ebp - 0x19], 0x4d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.1000cb6a
test eax, eax
jne 0x1000c931
mov eax, 0x753c
jmp 0x1000ca44
mov cl, byte [0x1001006c]
cmp cl, 4
jae 0x1000ca1e
mov edi, 0x80
push 0x1388
add cl, 0x30
push dword [0x10010068]
mov byte [ebp - 0x17], cl
call fcn.1000cadb
pop ecx
cmp eax, ebx
pop ecx
jne 0x1000ca49
push ebx
push edi
push 3
push ebx
push 7
lea eax, [ebp - 0x20]
push 0xc0000000
push eax
call fcn.1000210b
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x1000c9ef
lea eax, [ebp - 4]
push ebx
push eax
push 0x120
push dword [ebp + 0x10]
push 0x130
push dword [ebp + 0xc]
push 0x860021b4
push esi
call fcn.10002196
add esp, 0x20
test eax, eax
je 0x1000ca56
call fcn.1000bf82
cmp eax, 0x57
push esi
je 0x1000ca57
call fcn.10002234
push dword [0x10010068]
call fcn.1000ca6e
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.1000b7f8
add esp, 0x10
cmp eax, ebx
je 0x1000ca52
mov cl, byte [0x1001006c]
movzx edx, cl
mov dword [ebp + edx*4 - 0x14], eax
jmp 0x1000ca0d
call fcn.1000bf82
push dword [0x10010068]
mov esi, eax
call fcn.1000ca6e
cmp esi, 2
pop ecx
jne 0x1000ca2a
mov cl, byte [0x1001006c]
inc cl
cmp cl, 4
mov byte [0x1001006c], cl
jb 0x1000c945
cmp cl, 3
jbe 0x1000ca2a
mov byte [0x1001006c], 1
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x1000ca44
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x1000ca44
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x1000ca44
mov eax, 0x4f1a
pop edi
pop esi
pop ebx
leave
ret
cmp eax, edi
mov eax, 0x4f1b
jmp 0x1000ca44
xor eax, eax
jmp 0x1000ca44
push esi
call fcn.10002234
push dword [0x10010068]
call fcn.1000ca6e
pop ecx
pop ecx
jmp 0x1000c927

Function at 0x1000ca6e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 7], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 9], 0x4d
mov byte [ebp - 6], 0x65
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 8], 0x75
mov byte [ebp - 5], 0x78
call fcn.10001ffa
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000cabe
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x1000cadb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and byte [ebp - 1], 0
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xa], 0x67
mov byte [ebp - 5], 0x6a
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 9], 0x6c
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 8], 0x65
mov byte [ebp - 3], 0x63
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 7], 0x4f
mov byte [ebp - 2], 0x74
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 6], 0x62
call fcn.10001ffa
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000cb4a
or eax, 0xffffffff
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000cb6a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [0x10010064], 1
push esi
mov byte [ebp - 0x20], 0x4d
mov byte [ebp - 0x1f], 0x75
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x78
mov byte [ebp - 0x1b], 0x4f
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x19], 0x4d
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x67
mov byte [ebp - 0x11], 0x50
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], bl
jne 0x1000cc44
push 0x14
push 0x40
call fcn.1000ccbc
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x1000cc36
push 1
push esi
call fcn.1000cda7
pop ecx
test eax, eax
pop ecx
je 0x1000cbfc
push ebx
push ebx
push 1
push esi
call fcn.1000ceb1
add esp, 0x10
test eax, eax
jne 0x1000cc05
push esi
call fcn.1000cc4b
pop ecx
jmp 0x1000cc36
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
call fcn.1000cd34
push esi
mov dword [0x10010068], eax
call fcn.1000cc4b
add esp, 0x10
cmp dword [0x10010068], ebx
jne 0x1000cc3a
xor eax, eax
jmp 0x1000cc47
mov dword [0x10010064], 2
push 1
pop eax
pop esi
pop ebx
leave
ret
Function at 0x1000cc4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
and byte [ebp - 0xb], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x6c
call fcn.10001ffa
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000cc9f
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000ccbc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xb], 0x63
call fcn.10001ffa
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000cd14
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000cd34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 7], 0x65
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 9], 0x75
mov byte [ebp - 6], 0x78
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 5], 0x41
call fcn.10001ffa
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000cd84
leave
ret
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x1000cda7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x53
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xe], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x70
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x72
call fcn.1000ce5c
lea ecx, [ebp - 0x20]
mov dword [0x1001005c], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000ce3c
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000ceb1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 7], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x53
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x6c
call fcn.1000ce5c
lea ecx, [ebp - 0x20]
mov dword [0x1001005c], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000cf3a
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.10001fcb
add esp, 0xc
mov eax, esi
pop esi
leave
ret