joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006d87
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x18
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push ebp
xor ebp, ebp
push esi
mov cl, byte [ebx]
mov esi, dword [esp + 0x2c]
test cl, cl
je 0x10006e9f
mov edx, dword [esp + 0x30]
mov al, cl
dec edx
mov dword [esp + 0xc], edx
push edi
cmp al, 0x24
je 0x10006df5
cmp al, 0x26
je 0x10006df5
cmp al, 0x2b
je 0x10006df5
cmp al, 0x2c
je 0x10006df5
cmp al, 0x2f
je 0x10006df5
cmp al, 0x3a
je 0x10006df5
cmp al, 0x3b
je 0x10006df5
cmp al, 0x3d
je 0x10006df5
cmp al, 0x3f
je 0x10006df5
cmp al, 0x40
je 0x10006df5
cmp al, 0x23
je 0x10006df5
cmp al, 0x20
je 0x10006df5
mov byte [esi], cl
xor eax, eax
xor ecx, ecx
inc ecx
inc eax
jmp 0x10006e89
movsx eax, al
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x23], 0x783230
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x24]
mov word [esp + 0x28], 0x2525
push 4
push eax
mov byte [esp + 0x32], 0x25
call fcn.100012e1
lea ecx, [esp + 0x2c]
add esp, 0x14
xor edi, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006e2c
sub ecx, edx
je 0x10006e5c
movsx eax, byte [esp + edi + 0x18]
push eax
call fcn.1000ef58
pop ecx
lea ecx, [esp + 0x18]
mov byte [esp + edi + 0x18], al
inc edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006e4f
sub ecx, edx
cmp edi, ecx
jb 0x10006e37
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x3c]
sub eax, ebp
push eax
push esi
call fcn.1000ec1b
lea ecx, [esp + 0x28]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006e7a
sub ecx, edx
mov edx, dword [esp + 0x10]
mov eax, ecx
add esi, eax
add ebp, ecx
inc ebx
cmp ebp, edx
jae 0x10006e9e
mov cl, byte [ebx]
mov al, cl
test cl, cl
jne 0x10006db8
pop edi
mov ecx, dword [esp + 0x20]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x18
ret
Function at 0x1001c523
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001c3a2

Function at 0x1001ec3b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e8fb
Function at 0x10026806
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002684a
cmp dword [ebp - 4], 0xffffffff
jne 0x10026854
call fcn.10030aac
jmp 0x100268ed
push 0
push dword [ebp - 4]
call fcn.10030b8f
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10026870
call fcn.10030aac
jmp 0x100268ed
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0x40
call fcn.10030ffe
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1002688e
call fcn.10030aac
jmp 0x100268ed
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100268b3
call fcn.10030aac
jmp 0x100268ed
push dword [ebp - 0xc]
push 0
push 0xc
push dword [ebp + 0xc]
call fcn.10031f1a
add esp, 0x10
and dword [ebp - 8], 0
push dword [ebp - 4]
call fcn.10031789
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100268e2
call fcn.10030aac
jmp 0x100268ed
push dword [ebp - 0xc]
call fcn.10031d49
pop ecx
xor eax, eax
leave
ret
Function at 0x1002930b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x30], 0
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
shl eax, 3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 9
jae 0x10029346
jmp 0x1002934b
call fcn.1000814a
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x6e
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x33
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x72
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x32
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x6b
xor eax, eax
inc eax
imul eax, eax, 0xe
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xf
jae 0x100293a5
jmp 0x100293aa
call fcn.1000814a
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x73
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x57
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x36
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x49
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x77
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x73
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x50
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x34
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x73
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x65
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x10029477
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x1002b56b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x1009d548], eax
mov eax, dword [ebp + 0x10]
mov dword [0x1009d554], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1009d54c], eax
mov dword [ebp - 0x2c], 1
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x49
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x54
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x5c
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x53
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x77
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x66
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xd
jae 0x1002b623
jmp 0x1002b628
call fcn.1000814a
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x10], 0x45
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xc
jae 0x1002b662
jmp 0x1002b667
call fcn.1000814a
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x73
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x74
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x49
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x49
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x6e
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x80000002
call fcn.10030ef9
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x1002f9da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x28
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x4e
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x4d
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x1c], 0x29
xor eax, eax
inc eax
imul eax, eax, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x15
jae 0x1002fa2b
jmp 0x1002fa30
call fcn.1000814a
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x63
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x49
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x5f
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x49
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x20
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x53
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x7a
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x53
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002d51
mov eax, dword [ebp - 0x24]
or eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x1002fd54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x6f
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x69
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x56
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x72
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x2e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x6e
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x73
xor eax, eax
inc eax
imul eax, eax, 0xb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xc
jae 0x1002fded
jmp 0x1002fdf2
call fcn.1000814a
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x10], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret

Function at 0x1002ff67
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xc
jae 0x1002ff9d
jmp 0x1002ffa2
call fcn.1000814a
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x32
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x53
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x33
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x68
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x2e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x1003024c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x33
xor eax, eax
inc eax
imul eax, eax, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xd
jae 0x10030278
jmp 0x1003027d
call fcn.1000814a
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x32
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x76
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x64
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x69
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x41
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x70
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x2e
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x10030313
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 1
call fcn.1003024c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1003041c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x79
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x4b
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x6e
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x67
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x70
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x45
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x52
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x4f
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xe
jae 0x100303c5
jmp 0x100303ca
call fcn.1000814a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x78
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x57
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10030413
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x1003042b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
jae 0x1003045b
jmp 0x10030460
call fcn.1000814a
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x77
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x66
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x69
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x70
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x4f
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x4d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x69
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x46
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x56
lea eax, [ebp - 0x14]
push eax
call fcn.10030185
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10030519
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x10030528
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
call fcn.100300c9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10030650
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x18], 0x6d
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x69
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x46
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x11
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x12
jae 0x10030597
jmp 0x1003059c
call fcn.1000814a
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x68
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x6e
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x64
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x50
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0x4e
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x46
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x18], 0x61
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x18], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x18], 0x65
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10030647
push dword [ebp + 8]
call dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x1003070c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
call fcn.1002fd54
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10030877
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x1c], 0x53
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x66
xor eax, eax
inc eax
imul eax, eax, 0x15
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x56
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x1c], 0x7a
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x47
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 0x17
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
jae 0x100307fd
jmp 0x10030802
call fcn.1000814a
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x73
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x46
xor eax, eax
inc eax
imul eax, eax, 0x16
mov byte [ebp + eax - 0x1c], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x49
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x65
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1003086e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret