joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100154cd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
call fcn.10015014
mov esi, eax
test esi, esi
je 0x10015533
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0x776f64
push eax
push esi
mov dword [ebp - 0x16], 0x726f4674
mov dword [ebp - 0x12], 0x6f726765
mov dword [ebp - 0xc], 0x6e695764
mov word [ebp - 0xe], 0x6e75
mov word [ebp - 0x18], 0x6553
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001552c
push edi
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015546
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x2c], eax
mov esi, 0x80004005
lea eax, [ebp - 0x10]
mov word [ebp - 7], 0x6c6c
push edi
push eax
mov dword [ebp - 0xc], 0x2e32336c
mov dword [ebp - 0x10], 0x6c656853
mov byte [ebp - 5], 0
mov byte [ebp - 8], 0x64
call fcn.10016b99
mov edi, eax
pop ecx
test edi, edi
je 0x100155e7
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 0x41687461
push eax
push edi
mov dword [ebp - 0x1f], 0x646c6f46
mov word [ebp - 0x1a], 0x5072
mov dword [ebp - 0x24], 0x65474853
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100155e0
push dword [ebp - 0x2c]
push dword [ebp + 0x14]
push dword [ebp - 0x28]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x100155fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
or esi, 0xffffffff
push eax
mov dword [ebp - 0x10], 0x73726946
mov word [ebp - 0x13], 0x6e69
mov word [ebp - 0xb], 0x6946
mov word [ebp - 8], 0x4165
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x14], 0x46
mov byte [ebp - 6], 0
call fcn.10015054
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001565d
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x10015670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0xd], 0x6c694674
mov dword [ebp - 0x13], 0x4e646e69
mov byte [ebp - 0x14], 0x46
mov word [ebp - 9], 0x4165
mov word [ebp - 0xf], 0x7865
mov byte [ebp - 7], bl
call fcn.10015054
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100156c6
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x100156d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0xd], 0x6f6c4364
push eax
mov word [ebp - 9], 0x6573
mov byte [ebp - 7], bl
mov word [ebp - 0xf], 0x6e69
mov byte [ebp - 0x10], 0x46
call fcn.10015054
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015723
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x1001579b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
push esi
push edi
mov dword [ebp - 0x28], eax
xor edi, edi
mov eax, dword [ebp + 0x28]
inc edi
mov dword [ebp - 0x24], eax
call fcn.10015095
mov esi, eax
test esi, esi
je 0x10015838
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe], 0x4b657461
push eax
push esi
mov word [ebp - 0x11], 0x7243
mov dword [ebp - 8], 0x417845
mov word [ebp - 0x14], 0x6552
mov word [ebp - 0xa], 0x7965
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x12], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015831
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 0x1c]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push ebx
call eax
mov edi, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1001584b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x18], eax
xor edi, edi
mov eax, dword [ebp + 0x18]
inc edi
mov dword [ebp - 0x1c], eax
call fcn.10015095
mov esi, eax
test esi, esi
je 0x100158d0
lea eax, [ebp - 0x14]
mov dword [ebp - 9], 0x417845
push eax
push esi
mov word [ebp - 0x12], 0x5367
mov word [ebp - 0xf], 0x5674
mov word [ebp - 0x14], 0x6552
mov word [ebp - 0xc], 0x756c
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xa], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100158c9
push dword [ebp + 0x1c]
push dword [ebp - 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push ebx
call eax
mov edi, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x100158e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.10015014
mov esi, eax
test esi, esi
je 0x1001594a
lea eax, [ebp - 0x18]
mov word [ebp - 0xb], 0x6957
push eax
push esi
mov dword [ebp - 9], 0x776f646e
mov dword [ebp - 0x10], 0x6e756f72
mov dword [ebp - 0x16], 0x726f4674
mov word [ebp - 0x18], 0x6547
mov byte [ebp - 5], bl
mov word [ebp - 0x12], 0x6765
mov byte [ebp - 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015943
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x100159bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x24], eax
call fcn.10015014
mov esi, eax
test esi, esi
je 0x10015a45
lea eax, [ebp - 0x20]
mov dword [ebp - 0xd], 0x49737365
push eax
push esi
mov word [ebp - 9], 0x64
mov dword [ebp - 0x13], 0x72506461
mov word [ebp - 0x1c], 0x6e69
mov word [ebp - 0x1f], 0x7465
mov byte [ebp - 0x20], 0x47
mov dword [ebp - 0x17], 0x65726854
mov word [ebp - 0x1a], 0x6f64
mov word [ebp - 0xf], 0x636f
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x1d], 0x57
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015a3e
push dword [ebp - 0x24]
push edi
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x10015a58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.10015014
mov esi, eax
test esi, esi
je 0x10015aca
lea eax, [ebp - 0x18]
mov dword [ebp - 0xf], 0x49646165
push eax
push esi
mov word [ebp - 0x15], 0x6361
mov word [ebp - 0x18], 0x7441
mov word [ebp - 0x12], 0x6854
mov dword [ebp - 0xa], 0x747570
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 0x10], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015ac3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015adc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
call fcn.10015014
mov esi, eax
test esi, esi
je 0x10015b59
lea eax, [ebp - 0x1c]
mov word [ebp - 0x17], 0x506d
push eax
push esi
mov dword [ebp - 0x1c], 0x74737953
mov dword [ebp - 0xd], 0x666e4973
mov word [ebp - 0xf], 0x7265
mov byte [ebp - 0x18], 0x65
mov dword [ebp - 0x14], 0x656d6172
mov word [ebp - 9], 0x416f
mov byte [ebp - 7], bl
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x10], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015b52
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0xe], 0x416c6163
mov word [ebp - 0xa], 0x6c6c
mov word [ebp - 0x10], 0x6f4c
mov word [ebp - 7], 0x63
mov byte [ebp - 8], 0x6f
call fcn.10015054
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015d32
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x10015d45
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], eax
call fcn.100150dd
mov esi, eax
test esi, esi
je 0x10015dbc
lea eax, [ebp - 0x14]
mov dword [ebp - 0xa], 0x4165756c
push eax
push esi
mov dword [ebp - 0x12], 0x65755172
mov dword [ebp - 0xe], 0x61567972
mov byte [ebp - 6], bl
mov word [ebp - 0x14], 0x6556
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015db5
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015dcf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
call fcn.100150dd
mov esi, eax
test esi, esi
je 0x10015e52
lea eax, [ebp - 0x18]
mov word [ebp - 9], 0x666e
push eax
push esi
mov word [ebp - 0x18], 0x6547
mov dword [ebp - 0x15], 0x656c6946
mov word [ebp - 6], 0x41
mov word [ebp - 0xb], 0x496e
mov dword [ebp - 0x10], 0x69737265
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 7], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015e4b
push dword [ebp - 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015e65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x20], eax
call fcn.100150dd
mov esi, eax
test esi, esi
je 0x10015ee4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x12], 0x6e6f6973
push eax
push esi
mov dword [ebp - 0x1c], 0x46746547
mov dword [ebp - 8], 0x41657a
mov dword [ebp - 0xd], 0x536f666e
mov word [ebp - 0x18], 0x6c69
mov word [ebp - 0x15], 0x6556
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 9], 0x69
mov byte [ebp - 0x16], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015edd
push dword [ebp - 0x20]
push edi
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x10015ef7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
call fcn.10015095
mov esi, eax
test esi, esi
je 0x10015f8c
lea eax, [ebp - 0x1c]
mov word [ebp - 0x15], 0x7571
push eax
push esi
mov word [ebp - 0x12], 0x6572
mov word [ebp - 0xf], 0x6e6f
mov dword [ebp - 0x1c], 0x70797243
mov byte [ebp - 0x10], 0x43
mov word [ebp - 9], 0x41
mov word [ebp - 0xc], 0x7865
mov word [ebp - 0x17], 0x6341
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0x18], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015f85
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push edi
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015f9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x18], eax
call fcn.10015095
mov esi, eax
test esi, esi
je 0x1001601d
lea eax, [ebp - 0x14]
mov word [ebp - 0x13], 0x7972
push eax
push esi
mov word [ebp - 0x10], 0x4974
mov dword [ebp - 0xb], 0x654b7472
mov word [ebp - 0xd], 0x6f70
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x43
mov word [ebp - 7], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10016016
push dword [ebp - 0x18]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10016030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
call fcn.10015095
mov esi, eax
test esi, esi
je 0x100160a3
lea eax, [ebp - 0x18]
mov dword [ebp - 0x12], 0x654b7465
push eax
push esi
mov word [ebp - 0x18], 0x7243
mov word [ebp - 0x15], 0x7470
mov word [ebp - 0xe], 0x5079
mov dword [ebp - 0xb], 0x6d6172
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0x13], 0x53
mov byte [ebp - 0x16], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001609c
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x100160b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
call fcn.10015095
mov esi, eax
test esi, esi
je 0x1001612c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x17], 0x74707972
push eax
push esi
mov dword [ebp - 0xc], 0x6d617261
mov dword [ebp - 0x12], 0x654b7465
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 8], bl
mov word [ebp - 0xe], 0x5079
mov byte [ebp - 0x13], 0x47
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10016125
push dword [ebp + 0x18]
push dword [ebp - 0x1c]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x1001613f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 0x18], eax
call fcn.10015095
mov esi, eax
test esi, esi
je 0x100161b1
lea eax, [ebp - 0x14]
mov word [ebp - 0xa], 0x7470
push eax
push esi
mov dword [ebp - 0x14], 0x70797243
mov dword [ebp - 0xf], 0x72636544
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 8], bl
mov byte [ebp - 0x10], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100161aa
push dword [ebp - 0x18]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x100161c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.10015095
mov esi, eax
test esi, esi
je 0x10016228
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x79654b
push eax
push esi
mov word [ebp - 0x14], 0x7243
mov word [ebp - 0xa], 0x796f
mov dword [ebp - 0xf], 0x74736544
mov word [ebp - 0x11], 0x7470
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0x12], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10016221
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1001623a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.10015095
mov esi, eax
test esi, esi
je 0x100162ae
lea eax, [ebp - 0x18]
mov word [ebp - 0x11], 0x656c
push eax
push esi
mov dword [ebp - 0x15], 0x65527470
mov dword [ebp - 0xe], 0x6f436573
mov word [ebp - 7], 0x7478
mov byte [ebp - 0xf], 0x61
mov word [ebp - 0xa], 0x746e
mov byte [ebp - 8], 0x65
mov word [ebp - 0x17], 0x7972
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 5], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100162a7
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x100162c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 0x18], eax
call fcn.10015095
mov esi, eax
test esi, esi
je 0x10016340
lea eax, [ebp - 0x14]
mov word [ebp - 9], 0x74
push eax
push esi
mov word [ebp - 0xf], 0x6e45
mov word [ebp - 0xc], 0x7972
mov word [ebp - 0x11], 0x7470
mov word [ebp - 0x14], 0x7243
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0xd], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10016339
push dword [ebp + 0x20]
push dword [ebp - 0x18]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10016353
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, dword [ebp + 0x1c]
inc edi
mov dword [ebp - 0x28], eax
call fcn.10015095
mov esi, eax
test esi, esi
je 0x100163e4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x15], 0x72657551
push eax
push esi
mov dword [ebp - 0xd], 0x78456575
mov dword [ebp - 0x11], 0x6c615679
mov word [ebp - 0x18], 0x6552
mov word [ebp - 9], 0x41
mov byte [ebp - 0x16], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100163dd
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push ebx
call eax
mov edi, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret