joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x72
push esi
push edi
mov word [ebp - 0x28], ax
mov edi, edx
lea eax, [ebp - 0x2c]
mov word [ebp - 0xb], 0x6946
push eax
mov esi, ecx
mov dword [ebp - 0x10], 0x74697257
mov word [ebp - 8], 0x65
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0xc], 0x65
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001040c
push 0
push ebx
push dword [ebp + 8]
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x10010420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 0x14], 0x79536f54
push edi
mov word [ebp - 0x34], ax
mov edi, edx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x1b], 0x54656c69
push eax
mov esi, ecx
mov dword [ebp - 0x10], 0x6d657473
mov dword [ebp - 0xc], 0x656d6954
mov word [ebp - 0x17], 0x6d69
mov byte [ebp - 0x1c], 0x46
mov byte [ebp - 8], 0
mov byte [ebp - 0x15], 0x65
mov dword [ebp - 0x2a], 0x2e0032
mov dword [ebp - 0x22], 0x6c
mov dword [ebp - 0x38], 0x65004b
mov dword [ebp - 0x2e], 0x33006c
mov dword [ebp - 0x26], 0x6c0064
mov dword [ebp - 0x32], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100104c4
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x100104e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 9], 0x577473
push edi
mov word [ebp - 0x2c], ax
mov edi, edx
lea eax, [ebp - 0x30]
mov dword [ebp - 0xe], 0x69463233
push eax
mov esi, ecx
mov byte [ebp - 0xa], 0x72
mov dword [ebp - 0x12], 0x656c7564
mov word [ebp - 0x14], 0x6f4d
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010575
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x10010590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 0x72
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x17], 0x43656469
mov word [ebp - 0xd], 0x6c75
mov word [ebp - 0x10], 0x6f54
mov dword [ebp - 0xb], 0x79426974
mov word [ebp - 6], 0x65
mov word [ebp - 0x13], 0x6168
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0xe], 0x4d
mov byte [ebp - 7], 0x74
mov byte [ebp - 0x18], 0x57
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x2a], 0x33006c
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x2e], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010650
push 0
push 0
push 0xfff
push ebx
push 0xffffffffffffffff
push edi
push 0
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x10010670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 0xe], 0x754d6e65
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 9], 0x577865
mov word [ebp - 0x10], 0x704f
mov byte [ebp - 0xa], 0x74
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010701
push edi
push 0
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x10010720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], edx
push ebx
mov word [ebp - 0x16], ax
mov ebx, ecx
push esi
mov eax, 0x64
mov dword [ebp - 0x28], 0x6c004f
mov word [ebp - 0x1c], ax
mov esi, 1
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x330065
push eax
mov dword [ebp - 0x20], 0x2e0032
mov dword [ebp - 0x1a], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100107be
lea eax, [ebp - 0x14]
mov word [ebp - 0xb], 0x7453
push eax
push edi
mov dword [ebp - 8], 0x676e69
mov word [ebp - 0x11], 0x4449
mov word [ebp - 0x14], 0x4c43
mov dword [ebp - 0xf], 0x6d6f7246
mov byte [ebp - 0x12], 0x53
mov byte [ebp - 9], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100107b7
push dword [ebp - 0x2c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x100107e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], edx
push ebx
mov word [ebp - 0x16], ax
mov ebx, ecx
push esi
mov eax, 0x64
mov dword [ebp - 0x28], 0x6c004f
mov word [ebp - 0x1c], ax
mov esi, 1
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x330065
push eax
mov dword [ebp - 0x20], 0x2e0032
mov dword [ebp - 0x1a], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10010871
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x46444949
push eax
push edi
mov dword [ebp - 0xc], 0x6e697274
mov dword [ebp - 0x10], 0x536d6f72
mov word [ebp - 8], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001086a
push dword [ebp - 0x2c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x10010890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0x1b], 0x46746961
push esi
mov word [ebp - 0x34], ax
mov esi, edx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x15], 0x746c754d
push eax
mov dword [ebp - 0xa], 0x73746365
mov word [ebp - 0xc], 0x6a62
mov dword [ebp - 0x11], 0x656c7069
mov byte [ebp - 6], 0
mov word [ebp - 0x17], 0x726f
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0xd], 0x4f
mov dword [ebp - 0x2a], 0x2e0032
mov dword [ebp - 0x22], 0x6c
mov dword [ebp - 0x38], 0x65004b
mov dword [ebp - 0x2e], 0x33006c
mov dword [ebp - 0x26], 0x6c0064
mov dword [ebp - 0x32], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001093e
push 0xdbba00
push 0
push esi
push 2
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x10010950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0x10], 0x61636f4c
push esi
mov word [ebp - 0x28], ax
mov esi, ecx
lea eax, [ebp - 0x2c]
mov word [ebp - 0xb], 0x7246
push eax
mov word [ebp - 8], 0x65
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 9], 0x65
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100109dc
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x100109f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0x12], 0x73614c74
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0xd], 0x7245
mov word [ebp - 0xa], 0x726f
mov byte [ebp - 0xe], 0x74
mov word [ebp - 0x14], 0x6547
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 8], 0
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010a81
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x10010aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov word [ebp - 0xe], 0x7463
push esi
mov word [ebp - 0x30], ax
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x13], 0x72694465
push eax
mov dword [ebp - 0xb], 0x577972
mov byte [ebp - 0xc], 0x6f
mov dword [ebp - 0x18], 0x61657243
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0xf], 0x65
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x2a], 0x33006c
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x2e], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010b3a
push 0
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x10010b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, 0x72
push esi
push edi
mov word [ebp - 0x2c], ax
mov edi, edx
lea eax, [ebp - 0x30]
mov word [ebp - 8], 0x5773
push eax
mov esi, ecx
mov word [ebp - 0xe], 0x7250
mov word [ebp - 0xb], 0x6563
mov byte [ebp - 6], 0
mov dword [ebp - 0x12], 0x65746165
mov byte [ebp - 0xc], 0x6f
mov word [ebp - 0x14], 0x7243
mov byte [ebp - 9], 0x73
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010c14
push dword [ebp - 0x38]
push dword [ebp - 0x34]
push ebx
push 0
push dword [ebp + 0x14]
push 1
push 0
push 0
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x10010c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2c], eax
mov ebx, edx
mov eax, dword [ebp + 0x10]
mov esi, 1
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push edi
push eax
mov dword [ebp - 0x1c], 0x2e0069
mov dword [ebp - 0x18], 0x6c0064
mov dword [ebp - 0x28], 0x680053
mov dword [ebp - 0x24], 0x77006c
mov dword [ebp - 0x20], 0x700061
mov dword [ebp - 0x14], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10010cd8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x65534853
push eax
push edi
mov dword [ebp - 9], 0x5765756c
mov byte [ebp - 5], 0
mov word [ebp - 0xb], 0x6156
mov byte [ebp - 0xc], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010cd1
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push ebx
push 0x80000001
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x10010cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x2c], eax
mov ebx, edx
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x30], eax
mov esi, 1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x28]
push edi
push eax
mov dword [ebp - 0x1c], 0x2e0069
mov dword [ebp - 0x18], 0x6c0064
mov dword [ebp - 0x28], 0x680053
mov dword [ebp - 0x24], 0x77006c
mov dword [ebp - 0x20], 0x700061
mov dword [ebp - 0x14], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10010da4
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x61567465
push eax
push edi
mov word [ebp - 0xf], 0x4748
mov dword [ebp - 9], 0x5765756c
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010d9d
push dword [ebp - 0x38]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
push ebx
push 0x80000001
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x10010dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, 0x53
mov dword [ebp - 0x32], 0x650068
mov word [ebp - 0x34], ax
mov ebx, edx
push esi
mov eax, 0x2e
mov dword [ebp - 0x20], 0x6c
mov word [ebp - 0x26], ax
xor esi, esi
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2a], 0x320033
push eax
mov dword [ebp - 0x24], 0x6c0064
mov dword [ebp - 0x2e], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10010e80
lea eax, [ebp - 0x1c]
mov word [ebp - 0x16], 0x6570
push eax
push edi
mov dword [ebp - 0xc], 0x61507265
mov word [ebp - 0x19], 0x7465
mov word [ebp - 7], 0x5768
mov dword [ebp - 0x11], 0x6c6f466c
mov word [ebp - 0x1c], 0x4853
mov word [ebp - 0x14], 0x6963
mov byte [ebp - 0x1a], 0x47
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010e79
push esi
push dword [ebp + 8]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x10010ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1c], 0x2e0069
push eax
mov ebx, ecx
mov dword [ebp - 0x18], 0x6c0064
xor esi, esi
mov dword [ebp - 0x28], 0x680053
mov dword [ebp - 0x24], 0x77006c
mov dword [ebp - 0x20], 0x700061
mov dword [ebp - 0x14], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10010f22
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x57746e49
push eax
push edi
mov dword [ebp - 0x10], 0x54727453
mov byte [ebp - 7], 0
mov byte [ebp - 0xc], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010f1b
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7ecd50ab
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3353490a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x8ccba9
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x8cc92e
sub esi, esi
call fcn.008ccbf8
and esi, esi
push eax
mov eax, dword [esp]
add esp, 4
xor dword [ecx], ebx
sub esi, esi
add eax, 0x7c0bff04
add ecx, 1
add eax, esi
add esi, 0xd825eafd
mov eax, eax
cmp ecx, edx
jne fcn.008ccba9
and esi, eax
sub eax, 1
sub esi, 1
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x78666828
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x329f324e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x5f96cf
Capabilities:
Encode data using xor

Disassembly:
inc ecx
js 0x5f96d0
jge 0x5f96c8
mov edi, 0x4f075fc2
daa
mov bl, 0x3f
out dx, eax
pop es
movhps qword [0x267be96b], xmm7
adc edi, ebx
pop ebx
mov al, byte [0xa8017542]
inc edx
jne 0x5f9694
test al, 0x43
inc ebx
adc ebx, dword [ecx - 0xc]
and eax, 0x7fff77c
jp 0x5f96dc
movntps xmmword [edi + 0x327d767], xmm7
xchg edi, eax
sub dword [ecx + 0x47e3b6c4], 0xffffffda
cmp eax, dword [edi]
out 0x90, eax
jmp 0x5f96de
sbb ecx, dword [edi]
in eax, dx
mov ch, 0x47
invalid
das
add esi, dword [ebx]
xor eax, 0xff0a8723
enter 0xffffffffffffb66f, 0xfffffffffffffffb
mov byte [0x4d977892], al
xchg edx, eax
js 0x5f9676
xchg edi, eax
dec ebp
push esi
scasd eax, dword es:[edi]
mov byte [0x260971dd], al
fbstp tbyte [esi + ebp*8 + 0x77]
lahf
sub ch, dh
push ebp
mov dword [ecx - 0x79808bd0], 0x376c7709
jns 0x5f9690
imul esi, edi, 0xfffffff2
mov dl, 6
ja 0x5f972d
xor al, 0xf9
xor dword [eax + 0x50], ebp
cmpsd dword [esi], dword es:[edi]
mov ch, 0x2c
jne 0x5f9789
out dx, al
cwde
invalid
adc al, 0x6d
je 0x5f9700
pop ecx
int3
or al, 0x86
cwde
imul byte [ebx - 0x23]
dec edx
mov cl, 0x1e
int1
lodsd eax, dword [esi]
add al, 8
lahf
dec eax
movsd dword es:[edi], dword [esi]
outsb dx, byte [esi]
out dx, eax
js 0x5f9774
test eax, 0x4ff7acd6
add eax, dword [edi - 0x124833b0]
ficomp dword [edi + 0x66]
or al, 0x96
mov cl, 0xf8
dec ebx
jno 0x5f971e
xchg edx, eax
mov dh, 0x8e
invalid
xchg dword [esi], edi
aam 0xc8
mov dh, 0x2a
ja 0x5f97fa
cmpsb byte [esi], byte es:[edi]
pop edi
invalid
cmp al, 0x8a
frstor dword [edi + 0x23]
pop eax
cmp dword [ebx - 0x6edf1804], edx
jecxz 0x5f97eb
int3
dec edi
jecxz 0x5f97ff
pop ebx
or byte [edi], al
aas
mov ebx, 0x981b78e6
dec edi
daa
pop es
or ecx, dword [edi]
mov bl, 0xd7
inc edx
fidivr word [edi - 0x66447909]
invalid

Function at 0x770cdf
Capabilities:
Encode data using xor

Disassembly:
pop edx
xor byte [ebx + 0x2f], ah
jle 0x770d1f
lds eax, fs:[edi - 0x16b518d6]
xchg ebp, eax
sub ecx, ecx
invalid
mov edx, 0x5a35d2e2
iretd