joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 5], 0x642e6970
push eax
mov dword [esp + 5], 0x61776c68
mov word [esp + 0xe], 0x6c
mov byte [esp + 0xd], 0x6c
mov byte [esp + 4], 0x53
call fcn.1000d1c0
mov ecx, dword [esp + 0x10]
add esp, 4
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret

Function at 0x1000c450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 6], 0x6c6c642e
push eax
mov word [esp + 5], 0x6573
mov word [esp + 8], 0x3233
mov byte [esp + 0xe], 0
mov byte [esp + 7], 0x72
mov byte [esp + 4], 0x55
call fcn.1000d1c0
mov ecx, dword [esp + 0x10]
add esp, 4
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret

Function at 0x1000c4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 6], 0x6c642e6e
push eax
mov dword [esp + 6], 0x6f697372
mov word [esp + 4], 0x6556
mov word [esp + 0xe], 0x6c
call fcn.1000d1c0
mov ecx, dword [esp + 0x10]
add esp, 4
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret

Function at 0x1000c4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov dword [esp + 0x10], eax
mov esi, 1
mov eax, dword [esp + 0x44]
push edi
mov dword [esp + 0x10], eax
call fcn.1000c400
mov edi, eax
test edi, edi
je 0x1000c592
lea eax, [esp + 0x18]
mov dword [esp + 0x1f], 0x53797265
push eax
push edi
mov word [esp + 0x2f], 0x4167
mov word [esp + 0x2c], 0x6972
mov dword [esp + 0x21], 0x636f7373
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x20], 0x41
mov byte [esp + 0x2b], 0x74
mov word [esp + 0x25], 0x7551
mov byte [esp + 0x31], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c589
push dword [esp + 0x10]
push dword [esp + 0x18]
push ebp
push ebx
push dword [esp + 0x48]
push dword [esp + 0x48]
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x20
ret
Function at 0x1000c5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
xor esi, esi
call fcn.1000c220
mov edi, eax
test edi, edi
je 0x1000c64a
lea eax, [esp + 0x10]
mov word [esp + 0x1c], 0x4365
push eax
push edi
mov dword [esp + 0x19], 0x676e6168
mov word [esp + 0x21], 0x6976
mov word [esp + 0x1e], 0x6553
mov word [esp + 0x29], 0x6769
mov word [esp + 0x2c], 0x41
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x23], 0x63
mov word [esp + 0x27], 0x666e
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x26], 0x6f
mov byte [esp + 0x18], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c641
push ebp
push dword [esp + 0x38]
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x1c
ret

Function at 0x1000c660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push eax
mov dword [esp + 9], 0x65736f6c
mov word [esp + 0x12], 0x65
mov dword [esp + 0xd], 0x646e6148
mov byte [esp + 8], 0x43
mov byte [esp + 0x11], 0x6c
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c6bc
push esi
call eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret

Function at 0x1000c6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push esi
push edi
xor esi, esi
call fcn.1000c220
mov edi, eax
test edi, edi
je 0x1000c745
lea eax, [esp + 0xc]
mov word [esp + 0x1c], 0x656c
push eax
push edi
mov dword [esp + 0x16], 0x5365736f
mov dword [esp + 0x1b], 0x63697672
mov dword [esp + 0x1f], 0x6e614865
mov word [esp + 0x14], 0x6c43
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x26], 0
mov byte [esp + 0x1a], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c73c
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret
Function at 0x1000c760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
mov esi, 1
call fcn.1000c310
mov edi, eax
test edi, edi
je 0x1000c7c9
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x74616572
push eax
push edi
mov dword [esp + 0x1c], 0x64697547
mov word [esp + 0x14], 0x6f43
mov byte [esp + 0x16], 0x43
mov byte [esp + 0x20], 0
mov byte [esp + 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c7c0
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret

Function at 0x1000c7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, dword [esp + 0x20]
call fcn.1000c310
mov esi, eax
test esi, esi
je 0x1000c852
lea eax, [esp + 8]
mov word [esp + 0x14], 0x65
push eax
push esi
mov word [esp + 0x13], 0x7361
mov word [esp + 0x10], 0x6f43
mov word [esp + 0x19], 0x7246
mov word [esp + 0x16], 0x654d
mov byte [esp + 0x15], 0x6b
mov byte [esp + 0x12], 0x54
mov byte [esp + 0x18], 0x6d
mov byte [esp + 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c849
push edi
call eax
push esi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret

Function at 0x1000c870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x34]
push eax
mov word [esp + 0x27], 0x6c69
mov word [esp + 0x2a], 0x41
mov dword [esp + 0x20], 0x61657243
mov word [esp + 0x25], 0x4665
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x24], 0x74
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c90b
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x20]
push ebp
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10013577
add esp, 0x1c
ret
mov ecx, dword [esp + 0x28]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x1c
ret
Function at 0x1000c930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x28]
push eax
mov dword [esp + 0xe], 0x6946646e
mov dword [esp + 0x13], 0x6f567473
mov dword [esp + 0x19], 0x57656d
mov word [esp + 0x17], 0x756c
mov byte [esp + 0x12], 0x72
mov word [esp + 0xc], 0x6946
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c99d
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret

Function at 0x1000ca30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x24]
push eax
mov dword [esp + 0x10], 0x72616e69
mov word [esp + 0x17], 0x6570
mov dword [esp + 0xc], 0x42746547
mov word [esp + 0x14], 0x5479
mov word [esp + 0x19], 0x41
mov byte [esp + 0x16], 0x79
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ca9c
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret

Function at 0x1000cb20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
mov esi, 0x60
call fcn.1000c270
mov edi, eax
test edi, edi
je 0x1000cb98
lea eax, [esp + 0xc]
mov word [esp + 0xd], 0x7465
push eax
push edi
mov word [esp + 0x20], 0x73
mov dword [esp + 0x1b], 0x61436563
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x1f], 0x70
mov word [esp + 0x18], 0x7665
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x17], 0x44
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cb8f
push dword [esp + 0x28]
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret
Function at 0x1000cc30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
xor esi, esi
call fcn.1000c4a0
mov edi, eax
test edi, edi
je 0x1000ccc7
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0x6547
push eax
push edi
mov word [esp + 0x20], 0x7265
mov dword [esp + 0x1b], 0x656c6946
mov word [esp + 0x26], 0x6e49
mov word [esp + 0x23], 0x6f69
mov word [esp + 0x29], 0x416f
mov byte [esp + 0x22], 0x73
mov byte [esp + 0x2b], 0
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x28], 0x66
mov byte [esp + 0x1f], 0x56
mov byte [esp + 0x25], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ccbe
push ebp
push dword [esp + 0x38]
push dword [esp + 0x38]
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret

Function at 0x1000cce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
xor esi, esi
call fcn.1000c4a0
mov edi, eax
test edi, edi
je 0x1000cd68
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x6556656c
push eax
push edi
mov dword [esp + 0x22], 0x6e6f6973
mov dword [esp + 0x27], 0x536f666e
mov dword [esp + 0x2c], 0x41657a
mov word [esp + 0x1b], 0x6946
mov word [esp + 0x18], 0x6547
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x26], 0x49
mov byte [esp + 0x21], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cd5f
push ebp
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x1c
ret

Function at 0x1000cd80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 3], 0x7473614c
push eax
mov dword [esp + 0xc], 0x726f7272
mov word [esp + 4], 0x6547
mov byte [esp + 0x10], 0
mov byte [esp + 6], 0x74
mov byte [esp + 0xb], 0x45
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cdd9
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret
Function at 0x1000cdf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x28]
push eax
mov word [esp + 0xd], 0x7465
mov dword [esp + 0x1a], 0x41656d61
mov dword [esp + 0x16], 0x4e656c69
mov dword [esp + 0x10], 0x6c75646f
mov byte [esp + 0x1e], 0
mov word [esp + 0x14], 0x4665
mov byte [esp + 0xf], 0x4d
mov byte [esp + 0xc], 0x47
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ce6b
push dword [esp + 0x2c]
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret

Function at 0x1000ce80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push eax
mov word [esp + 0x1d], 0x656d
mov dword [esp + 0x18], 0x54656c69
mov dword [esp + 0x14], 0x46734165
mov dword [esp + 8], 0x53746547
mov word [esp + 0x12], 0x6d69
mov word [esp + 0xc], 0x7379
mov word [esp + 0xf], 0x6d65
mov byte [esp + 0x1f], 0
mov byte [esp + 0x11], 0x54
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0xe], 0x74
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cef3
push esi
call eax
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x1c
ret

Function at 0x1000cf10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 6], 0x756f436b
push eax
mov word [esp + 0xe], 0x746e
mov dword [esp + 6], 0x63695474
mov byte [esp + 0x10], 0
mov word [esp + 4], 0x6547
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cf66
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret

Function at 0x1000cf80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
mov word [esp + 8], 0x6547
mov dword [esp + 0xe], 0x6e6f6973
mov dword [esp + 0x12], 0x417845
mov word [esp + 0xb], 0x6556
mov byte [esp + 0xd], 0x72
mov byte [esp + 0xa], 0x74
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cfe3
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret
Function at 0x1000d000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
push esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14]
push edi
mov edi, dword [esp + 0x3c]
push eax
mov dword [esp + 0x27], 0x6d726f66
mov word [esp + 0x2e], 0x6e6f
mov word [esp + 0x21], 0x756c
mov dword [esp + 0x1c], 0x56746547
mov word [esp + 0x24], 0x4965
mov word [esp + 0x2b], 0x7461
mov byte [esp + 0x20], 0x6f
mov byte [esp + 0x23], 0x6d
mov word [esp + 0x30], 0x57
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x26], 0x6e
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d0b7
push dword [esp + 0x54]
push dword [esp + 0x14]
push dword [esp + 0x1c]
push ebp
push ebx
push dword [esp + 0x54]
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10013577
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x24
ret

Function at 0x1000d0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x20]
push eax
mov word [esp + 0x13], 0x6c6c
mov word [esp + 0x16], 0x63
mov word [esp + 0x11], 0x416c
mov dword [esp + 0xc], 0x626f6c47
mov byte [esp + 0x10], 0x61
mov byte [esp + 0x15], 0x6f
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d139
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret

Function at 0x1000d150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push eax
mov word [esp + 0x11], 0x65
mov dword [esp + 0xa], 0x6c61626f
mov word [esp + 8], 0x6c47
mov word [esp + 0xe], 0x7246
mov byte [esp + 0x10], 0x65
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d1ad
push esi
call eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x10
ret
Function at 0x1000d1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x64616f4c
mov dword [esp + 0x11], 0x417972
mov dword [esp + 0xd], 0x61726269
mov byte [esp + 0xc], 0x4c
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d218
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret

Function at 0x1000d230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x30]
push eax
mov word [esp + 0x19], 0x7061
mov dword [esp + 0x22], 0x656c69
mov dword [esp + 0x1e], 0x46664f77
mov word [esp + 0x1c], 0x6569
mov byte [esp + 0x18], 0x4d
mov byte [esp + 0x1b], 0x56
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d2b4
push dword [esp + 0x10]
push ebp
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret

Function at 0x1000d2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x28]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
push eax
mov dword [esp + 0x17], 0x70614d65
mov word [esp + 0x1c], 0x6e69
mov word [esp + 0x10], 0x704f
mov dword [esp + 0x13], 0x6c69466e
mov word [esp + 0x1f], 0x41
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x12], 0x65
call fcn.1000c2c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d34d
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret
Function at 0x1000d370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov dword [esp + 0x10], eax
xor esi, esi
call fcn.1000c220
mov edi, eax
test edi, edi
je 0x1000d3f5
lea eax, [esp + 0x14]
mov dword [esp + 0x1a], 0x616e614d
push eax
push edi
mov word [esp + 0x26], 0x6567
mov word [esp + 0x29], 0x41
mov word [esp + 0x1d], 0x6570
mov word [esp + 0x20], 0x4353
mov byte [esp + 0x1c], 0x4f
mov byte [esp + 0x1f], 0x6e
mov byte [esp + 0x28], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d3ec
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret

Function at 0x1000d410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov dword [esp + 0x10], eax
xor esi, esi
call fcn.1000c220
mov edi, eax
test edi, edi
je 0x1000d488
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 0x41656369
push eax
push edi
mov word [esp + 0x1c], 0x704f
mov dword [esp + 0x1f], 0x7265536e
mov byte [esp + 0x28], 0
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x23], 0x76
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d47f
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x18
ret

Function at 0x1000d4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
call fcn.1000c400
mov edi, eax
test edi, edi
je 0x1000d512
lea eax, [esp + 0xc]
mov dword [esp + 0x17], 0x41737473
push eax
push edi
mov word [esp + 0x19], 0x6c69
mov dword [esp + 0x14], 0x68746150
mov word [esp + 0x1c], 0x7845
mov byte [esp + 0x23], 0
mov byte [esp + 0x18], 0x46
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d509
push ebx
call eax
mov esi, eax
push edi
call fcn.1000c9c0
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10013577
add esp, 0x14
ret