joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47a05b
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a56f0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x5c]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x2b
call fcn.00426e78
xor ebx, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.00423352
mov ecx, dword [eax + 8]
push 0x7f00
push ebx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
call dword [0x480434]
push ebx
mov dword [esp + 0x40], eax
call dword [0x4800a4]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0x4814c0
call fcn.00428df0
mov eax, dword [esi]
mov dword [edi + 0x54], eax
mov ecx, dword [esi + 4]
mov dword [edi + 0x58], ecx
mov edx, dword [esi + 8]
push ebx
mov dword [edi + 0x5c], edx
mov eax, dword [esi + 0xc]
mov edx, dword [edi]
mov edx, dword [edx + 0x58]
push ebx
mov dword [edi + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x40000000
push ebx
push 0x4814c0
push 8
mov ecx, edi
call edx
push 0x8c
call fcn.004222a8
add esp, 4
mov dword [esp + 0x5c], eax
cmp eax, ebx
mov dword [esp + 0x54], ebx
je 0x4212ff
mov ecx, eax
call 0x46c8e0
jmp 0x421301
xor eax, eax
mov dword [edi + 0x64], eax
mov ecx, dword [esi]
mov ebp, dword [eax]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edx + 8], ecx
mov ecx, dword [esi + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [edi + 0x20]
push ebx
mov ecx, eax
mov eax, dword [ebp + 4]
push edx
mov dword [esp + 0x6c], 0xffffffff
call eax
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8
Function at 0x100014fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1007a0c4]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x34]
call fcn.1005e9b8
mov esi, eax
test esi, esi
je 0x10001595
lea eax, [esp + 0x10]
mov word [esp + 0x16], 0x6f64
push eax
push esi
mov word [esp + 0x2c], 0x7373
mov dword [esp + 0x21], 0x65726854
mov dword [esp + 0x27], 0x636f7250
mov word [esp + 0x18], 0x6547
mov word [esp + 0x1b], 0x6957
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x1d], 0x6e
mov word [esp + 0x25], 0x6461
mov word [esp + 0x2f], 0x64
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x20], 0x77
mov byte [esp + 0x2e], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000158e
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002261a
add esp, 0x20
ret
Function at 0x10001fb3
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x61766441
push eax
xor ebx, ebx
mov dword [ebp - 0x1c], 0x32336970
mov dword [ebp - 0x17], 0x6c6c64
mov byte [ebp - 0x18], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100021a6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp + 0x5c]
push eax
push edi
mov word [ebp + 0x6d], 0x7478
mov dword [ebp + 0x5c], 0x70797243
mov word [ebp + 0x61], 0x6341
mov word [ebp + 0x67], 0x4365
mov word [ebp + 0x6a], 0x746e
mov word [ebp + 0x64], 0x6975
mov word [ebp + 0x6f], 0x41
mov byte [ebp + 0x60], 0x74
mov byte [ebp + 0x6c], 0x65
mov byte [ebp + 0x69], 0x6f
mov byte [ebp + 0x66], 0x72
mov byte [ebp + 0x63], 0x71
call esi
mov dword [0x1007c3f0], eax
lea eax, [ebp + 4]
push eax
push edi
mov dword [ebp + 0xe], 0x73614865
mov word [ebp + 0xa], 0x6572
mov word [ebp + 0x12], 0x68
mov word [ebp + 7], 0x7470
mov byte [ebp + 9], 0x43
mov word [ebp + 4], 0x7243
mov word [ebp + 0xc], 0x7461
mov byte [ebp + 6], 0x79
call esi
mov dword [0x1007c3f4], eax
lea eax, [ebp + 0x44]
push eax
push edi
mov word [ebp + 0x56], 0x74
mov dword [ebp + 0x51], 0x65746e6f
mov word [ebp + 0x45], 0x7972
mov dword [ebp + 0x4a], 0x61656c65
mov word [ebp + 0x48], 0x5274
mov byte [ebp + 0x44], 0x43
mov word [ebp + 0x4f], 0x4365
mov byte [ebp + 0x4e], 0x73
mov byte [ebp + 0x47], 0x70
mov byte [ebp + 0x55], 0x78
call esi
mov dword [0x1007c3f8], eax
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0xb], 0x68736148
mov dword [ebp - 6], 0x617461
mov dword [ebp - 0xf], 0x74707972
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 7], 0x44
call esi
mov dword [0x1007c3fc], eax
lea eax, [ebp + 0x18]
push eax
push edi
mov word [ebp + 0x24], 0x6148
mov word [ebp + 0x27], 0x68
mov word [ebp + 0x1c], 0x4474
mov word [ebp + 0x19], 0x7972
mov word [ebp + 0x21], 0x6f72
mov byte [ebp + 0x18], 0x43
mov byte [ebp + 0x26], 0x73
mov word [ebp + 0x1e], 0x7365
mov byte [ebp + 0x23], 0x79
mov byte [ebp + 0x20], 0x74
mov byte [ebp + 0x1b], 0x70
call esi
mov dword [0x1007c400], eax
mov word [ebp + 0x31], 0x6547
mov word [ebp + 0x39], 0x7261
mov dword [ebp + 0x34], 0x68736148
mov dword [ebp + 0x2c], 0x70797243
mov word [ebp + 0x3c], 0x6d
mov byte [ebp + 0x30], 0x74
mov byte [ebp + 0x33], 0x74
mov byte [ebp + 0x3b], 0x61
lea eax, [ebp + 0x2c]
mov byte [ebp + 0x38], 0x50
push eax
push edi
call esi
mov ecx, eax
mov dword [0x1007c404], ecx
pop esi
cmp dword [0x1007c3f0], ebx
je 0x100021a6
cmp dword [0x1007c3f4], ebx
je 0x100021a6
cmp dword [0x1007c3f8], ebx
je 0x100021a6
cmp dword [0x1007c3fc], ebx
je 0x100021a6
cmp dword [0x1007c400], ebx
je 0x100021a6
xor edx, edx
movzx ebx, bl
inc edx
test ecx, ecx
cmovne ebx, edx
mov ecx, dword [ebp + 0x74]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.1002261a
lea esp, [ebp + 0x78]
pop ebp
ret
Function at 0x100021b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0xe], 0x3233
push eax
mov dword [ebp - 0x13], 0x656e7265
mov byte [ebp - 0xf], 0x6c
mov dword [ebp - 0xb], 0x6c6c64
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0x14], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002261a
mov esp, ebp
pop ebp
ret

Function at 0x10002201
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1007a0c4]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
call fcn.1005dc54
mov esi, eax
test esi, esi
je 0x10002266
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x6e65704f
push eax
push esi
mov dword [esp + 0x21], 0x57676f4c
mov dword [esp + 0x1d], 0x746e6576
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x25], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000225f
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002261a
add esp, 0x18
ret

Function at 0x10002422
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1007a0c4]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x34]
call fcn.10001eed
mov esi, eax
test esi, esi
je 0x100024af
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0x61507265
push eax
push esi
mov word [esp + 0x22], 0x6c61
mov dword [esp + 0x1d], 0x63657053
mov dword [esp + 0x24], 0x646c6f46
mov dword [esp + 0x18], 0x65474853
mov word [esp + 0x2d], 0x5768
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x2f], bl
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x2c], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100024a8
push dword [esp + 0x40]
push dword [esp + 0x40]
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002261a
add esp, 0x20
ret
Function at 0x100039a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x61706c68
push eax
mov dword [ebp - 0xb], 0x6c6c64
mov word [ebp - 0xe], 0x6970
mov word [ebp - 0x14], 0x7049
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002261a
mov esp, ebp
pop ebp
ret

Function at 0x10051794
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10051021

Function at 0x1005179f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005125c

Function at 0x1005cc3a
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005ca78

Function at 0x1005d69b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1007a0c4]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
call fcn.1005e9b8
mov esi, eax
test esi, esi
je 0x1005d718
lea eax, [esp + 0x18]
mov dword [esp + 0x21], 0x41784577
push eax
push esi
mov dword [esp + 0x20], 0x646e6946
mov dword [esp + 0x24], 0x646e6957
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x2d], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005d711
push dword [esp + 0x10]
push dword [esp + 0x18]
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002261a
add esp, 0x20
ret

Function at 0x1005d7fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push esi
push edi
mov edi, dword [ebp + 8]
or esi, 0xffffffff
push eax
mov dword [ebp - 0xc], 0x746f6873
mov dword [ebp - 0x19], 0x686c6f6f
mov dword [ebp - 0x20], 0x61657243
mov word [ebp - 0x14], 0x706c
mov word [ebp - 0x11], 0x5332
mov word [ebp - 0xe], 0x7061
mov word [ebp - 0x1c], 0x6574
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 8], 0
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x54
call fcn.100021b9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005d875
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002261a
mov esp, ebp
pop ebp
ret
Function at 0x1005d8d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x54
mov eax, 0x1005ecc8
call fcn.10022696
xor ebx, ebx
push ebx
call fcn.10062b4e
pop ecx
mov edi, 0x1007c220
mov word [ebp - 0x19], 0x652e
mov esi, ebx
mov word [ebp - 0x22], 0x6d61
mov ecx, edi
mov word [ebp - 0x1f], 0x7265
mov word [ebp - 0x1c], 0x6369
mov word [ebp - 0x17], 0x6578
mov byte [ebp - 0x15], bl
mov word [ebp - 0x24], 0x626d
mov byte [ebp - 0x20], 0x73
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x1d], 0x76
mov dword [ebp - 0x34], 0x6d61626d
mov dword [ebp - 0x2c], 0x6578652e
mov dword [ebp - 0x30], 0x79617274
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x38], esi
call fcn.10006457
test eax, eax
je 0x1005da00
push esi
mov ecx, edi
call fcn.1000468f
push eax
lea ecx, [ebp - 0x50]
call fcn.10004301
lea eax, [ebp - 0x54]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x50]
call fcn.10005dba
mov edi, eax
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x58]
push eax
call fcn.10005e6f
mov esi, eax
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x5c]
push eax
call fcn.10005dba
push fcn.1003acad
push dword [edi]
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x60]
push eax
call fcn.10004115
add esp, 0x14
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x50]
push eax
call fcn.10005deb
push eax
call fcn.1003a760
pop ecx
pop ecx
lea ecx, [ebp - 0x50]
test eax, eax
je 0x1005d9f8
lea eax, [ebp - 0x34]
push eax
call fcn.10005deb
push eax
call fcn.1003a760
pop ecx
pop ecx
lea ecx, [ebp - 0x50]
test eax, eax
je 0x1005d9f8
or dword [ebp - 4], 0xffffffff
call fcn.100044a1
mov esi, dword [ebp - 0x38]
mov edi, 0x1007c220
inc esi
mov ecx, edi
mov dword [ebp - 0x38], esi
call fcn.10006457
cmp esi, eax
jb 0x1005d94c
jmp 0x1005da00
xor ebx, ebx
inc ebx
call fcn.100044a1
mov eax, ebx
call fcn.10022640
ret

Function at 0x1005dbdc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1007a0c4]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x24]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x2c]
push eax
mov word [esp + 0x14], 0x704f
mov dword [esp + 0x1a], 0x7365636f
mov word [esp + 0x17], 0x506e
mov byte [esp + 0x16], 0x65
mov word [esp + 0x1e], 0x73
mov byte [esp + 0x19], 0x72
call fcn.100021b9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005dc3f
push ebp
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002261a
add esp, 0x14
ret

Function at 0x1005dc54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x61766441
push eax
mov dword [ebp - 0xb], 0x6c6c64
mov word [ebp - 0xd], 0x2e32
mov word [ebp - 0x10], 0x6970
mov byte [ebp - 0xe], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002261a
mov esp, ebp
pop ebp
ret
Function at 0x1005dcf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1c]
mov word [ebp - 0x1c], 0x6547
push eax
or esi, 0xffffffff
mov dword [ebp - 0x15], 0x50746e65
mov word [ebp - 0x11], 0x6f72
mov dword [ebp - 0xe], 0x737365
mov dword [ebp - 0x19], 0x72727543
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0x1a], 0x74
call fcn.100021b9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005dd49
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002261a
mov esp, ebp
pop ebp
ret
Function at 0x1005e87e
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0xd
mov dword [ebp - 0x20], ebx
call fcn.10021fee
mov esi, eax
pop ecx
push esi
mov dword [esi], 0x61766441
mov dword [esi + 8], 0x6c6c642e
mov byte [esi + 0xc], bl
mov word [esi + 5], 0x3369
mov byte [esi + 4], 0x70
mov byte [esi + 7], 0x32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov edi, eax
call fcn.10021ff7
pop ecx
test edi, edi
je 0x1005e98f
lea eax, [ebp - 0x20]
push eax
push 0x20
call fcn.1005dcf4
push eax
call fcn.10061000
add esp, 0xc
test eax, eax
je 0x1005e986
push 0x16
call fcn.10021fee
mov esi, eax
pop ecx
push esi
push edi
mov dword [esi], 0x6b6f6f4c
mov dword [esi + 5], 0x69725070
mov dword [esi + 9], 0x656c6976
mov word [esi + 0x14], 0x41
mov dword [esi + 0xf], 0x756c6156
mov word [esi + 0xd], 0x6567
mov byte [esi + 4], 0x75
mov byte [esi + 0x13], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [0x1007b930], eax
call fcn.10021ff7
mov eax, dword [0x1007b930]
pop ecx
test eax, eax
je 0x1005e986
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push ebx
call eax
test eax, eax
je 0x1005e986
mov eax, dword [ebp - 0xc]
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push 0x10
push eax
push ebx
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call fcn.100624af
add esp, 0x18
push dword [ebp - 0x20]
call fcn.10061589
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002261a
mov esp, ebp
pop ebp
ret

Function at 0x1005ebb5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
call fcn.10003c3f
mov esi, eax
test esi, esi
je 0x1005ec23
lea eax, [ebp - 0x1c]
mov word [ebp - 0xb], 0x4165
push eax
push esi
mov dword [ebp - 0x10], 0x72756f73
mov dword [ebp - 0x17], 0x6e6f4665
mov word [ebp - 0x13], 0x5274
mov dword [ebp - 0x1b], 0x766f6d65
mov byte [ebp - 9], bl
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x11], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005ec1c
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002261a
mov esp, ebp
pop ebp
ret
Function at 0x10061000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1007a0c4]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
call fcn.1005dc54
mov esi, eax
test esi, esi
je 0x10061073
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x636f7250
push eax
push esi
mov dword [esp + 0x18], 0x6e65704f
mov dword [esp + 0x23], 0x656b6f54
mov word [esp + 0x20], 0x7365
mov word [esp + 0x27], 0x6e
mov byte [esp + 0x22], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006106c
push ebp
push dword [esp + 0x34]
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002261a
add esp, 0x18
ret
Function at 0x10061201
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
lea eax, [ebp + 0x18]
mov word [ebp + 0x1c], 0x7061
xor ebx, ebx
mov word [ebp + 0x22], 0x6c
push eax
mov dword [0x1007a044], ebx
mov word [ebp + 0x1f], 0x642e
mov byte [ebp + 0x1e], 0x69
mov dword [ebp + 0x18], 0x74766577
mov byte [ebp + 0x21], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x100613e1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp + 0x3c]
push eax
push esi
mov dword [ebp + 0x3e], 0x65724374
mov word [ebp + 0x51], 0x74
mov dword [ebp + 0x4c], 0x65746e6f
mov dword [ebp + 0x42], 0x52657461
mov dword [ebp + 0x47], 0x7265646e
mov word [ebp + 0x3c], 0x7645
mov byte [ebp + 0x4b], 0x43
mov byte [ebp + 0x46], 0x65
mov byte [ebp + 0x50], 0x78
call edi
mov dword [0x1007c360], eax
test eax, eax
je 0x100613da
lea eax, [ebp - 4]
mov dword [ebp], 0x79726575
push eax
push esi
mov byte [ebp + 4], bl
mov dword [ebp - 4], 0x51747645
call edi
mov dword [0x1007c364], eax
test eax, eax
je 0x100613da
lea eax, [ebp - 0x1c]
mov word [ebp - 0x1b], 0x7476
push eax
push esi
mov dword [ebp - 0x18], 0x747865
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x1c], 0x45
call edi
mov dword [0x1007c368], eax
test eax, eax
je 0x100613da
lea eax, [ebp + 8]
mov dword [ebp + 0xe], 0x726564
push eax
push esi
mov word [ebp + 0xc], 0x6e65
mov word [ebp + 9], 0x7476
mov byte [ebp + 0xb], 0x52
mov byte [ebp + 8], 0x45
call edi
mov dword [0x1007c36c], eax
test eax, eax
je 0x100613da
lea eax, [ebp + 0x58]
mov dword [ebp + 0x63], 0x65687369
push eax
push esi
mov word [ebp + 0x68], 0x654d
mov word [ebp + 0x6b], 0x6461
mov dword [ebp + 0x5b], 0x6e65704f
mov word [ebp + 0x58], 0x7645
mov word [ebp + 0x6e], 0x6174
mov byte [ebp + 0x6a], 0x74
mov word [ebp + 0x60], 0x6275
mov byte [ebp + 0x70], bl
mov byte [ebp + 0x6d], 0x61
mov byte [ebp + 0x5f], 0x50
mov byte [ebp + 0x5a], 0x74
mov byte [ebp + 0x62], 0x6c
mov byte [ebp + 0x67], 0x72
call edi
mov dword [0x1007c370], eax
test eax, eax
je 0x100613da
lea eax, [ebp + 0x28]
mov dword [ebp + 0x28], 0x46747645
push eax
push esi
mov dword [ebp + 0x31], 0x7373654d
mov dword [ebp + 0x35], 0x656761
mov dword [ebp + 0x2d], 0x74616d72
mov byte [ebp + 0x2c], 0x6f
call edi
mov dword [0x1007c374], eax
test eax, eax
je 0x100613da
lea eax, [ebp - 0x10]
mov dword [ebp - 0xf], 0x6c437476
push eax
push esi
mov word [ebp - 0xa], 0x6573
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 8], bl
mov byte [ebp - 0xb], 0x6f
call edi
mov dword [0x1007c378], eax
test eax, eax
je 0x100613da
xor eax, eax
inc eax
mov dword [0x1007c37c], eax
jmp 0x100613e3
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002261a
lea esp, [ebp + 0x78]
pop ebp
ret
Function at 0x100613f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1007a0c4]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
xor ebx, ebx
push esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
call fcn.1005dc54
mov esi, eax
test esi, esi
je 0x10061484
lea eax, [esp + 0x18]
mov dword [esp + 0x21], 0x57676f4c
push eax
push esi
mov dword [esp + 0x22], 0x76456461
mov word [esp + 0x26], 0x6e65
mov word [esp + 0x20], 0x6552
mov byte [esp + 0x2d], bl
mov byte [esp + 0x28], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006147d
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x4c]
push ebp
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002261a
add esp, 0x20
ret

Function at 0x1006150f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
call fcn.1005e9b8
mov esi, eax
test esi, esi
je 0x10061576
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], 0x7349
push eax
push esi
mov dword [ebp - 0x12], 0x6956776f
mov word [ebp - 0x15], 0x6e69
mov dword [ebp - 0xd], 0x656c6269
mov byte [ebp - 0x16], 0x57
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 9], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006156f
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002261a
mov esp, ebp
pop ebp
ret

Function at 0x100615ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0x18], 0x636f7250
mov dword [ebp - 0xf], 0x73726946
mov dword [ebp - 0x13], 0x32337373
mov word [ebp - 0xb], 0x74
mov byte [ebp - 0x14], 0x65
call fcn.100021b9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10061640
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002261a
mov esp, ebp
pop ebp
ret