joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
xor eax, eax
push ebx
mov word [ebp - 0x1a], ax
mov ebx, ecx
push esi
mov eax, 0x64
mov dword [ebp - 0x2c], 0x6c004f
mov word [ebp - 0x20], ax
mov esi, 1
push edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x330065
push eax
mov dword [ebp - 0x24], 0x2e0032
mov dword [ebp - 0x1e], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000f4cb
lea eax, [ebp - 0x18]
mov dword [ebp - 0xf], 0x6174736e
push eax
push edi
mov dword [ebp - 0x13], 0x49657461
mov word [ebp - 0x15], 0x6572
mov word [ebp - 0x18], 0x6f43
mov dword [ebp - 0xb], 0x65636e
mov byte [ebp - 0x16], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f4c4
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push 0x15
push 0
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x33
mov dword [ebp - 0x2a], 0x6c
mov word [ebp - 0x34], ax
mov ebx, ecx
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x640041
push eax
xor esi, esi
mov dword [ebp - 0x2e], 0x6c0064
mov dword [ebp - 0x32], 0x2e0032
mov dword [ebp - 0x38], 0x690070
mov dword [ebp - 0x3c], 0x610076
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000f59a
lea eax, [ebp - 0x24]
mov dword [ebp - 0xb], 0x726f74
push eax
push edi
mov dword [ebp - 0x24], 0x74696e49
mov word [ebp - 0x15], 0x7469
mov dword [ebp - 0x1f], 0x7a696c61
mov dword [ebp - 0x1a], 0x75636553
mov dword [ebp - 0x10], 0x69726373
mov word [ebp - 0x12], 0x6544
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x13], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f593
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000f5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov word [ebp - 0xb], 0x4665
push esi
mov word [ebp - 0x28], ax
mov esi, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 8], 0x57656c
push eax
mov dword [ebp - 0x10], 0x656c6544
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 9], 0x69
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f63d
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x34], eax
mov ebx, ecx
push esi
mov eax, 0x33
mov dword [ebp - 0x1a], 0x6c
mov word [ebp - 0x24], ax
xor esi, esi
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x640041
push eax
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x28], 0x690070
mov dword [ebp - 0x2c], 0x610076
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000f6f8
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x53746553
push eax
push edi
mov word [ebp - 6], 0x6f
mov dword [ebp - 0xf], 0x69727563
mov byte [ebp - 0x10], 0x65
mov dword [ebp - 0xb], 0x6e497974
mov byte [ebp - 7], 0x66
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f6f1
push esi
push dword [ebp - 0x34]
push esi
push esi
push 4
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x33
mov dword [ebp - 0x12], 0x6c
mov word [ebp - 0x1c], ax
mov esi, ecx
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x640041
push eax
mov dword [ebp - 0x16], 0x6c0064
mov dword [ebp - 0x1a], 0x2e0032
mov dword [ebp - 0x20], 0x690070
mov dword [ebp - 0x24], 0x610076
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000f797
lea eax, [ebp - 0xc]
mov word [ebp - 7], 0x6469
push eax
push edi
mov dword [ebp - 0xc], 0x65657246
mov byte [ebp - 5], 0
mov byte [ebp - 8], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f790
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000f7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 9], 0x746e65
push esi
mov word [ebp - 0x28], ax
mov esi, ecx
lea eax, [ebp - 0x2c]
mov word [ebp - 0xe], 0x6573
push eax
mov word [ebp - 0xb], 0x7645
mov word [ebp - 0x10], 0x6552
mov byte [ebp - 0xc], 0x74
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f83e
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov word [ebp - 0x10], 0x6553
push esi
mov word [ebp - 0x28], ax
mov esi, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xb], 0x746e65
push eax
mov word [ebp - 0xd], 0x7645
mov byte [ebp - 0xe], 0x74
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f8d8
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f8f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov word [ebp - 0x21], 0x6547
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x40]
push eax
mov word [ebp - 0x24], 0x5457
mov dword [ebp - 0x1b], 0x43657669
mov dword [ebp - 0xb], 0x64496e
mov dword [ebp - 0x1f], 0x74634174
mov word [ebp - 0xe], 0x6973
mov dword [ebp - 0x13], 0x6553656c
mov word [ebp - 0x16], 0x736e
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x14], 0x6f
mov dword [ebp - 0x32], 0x2e0032
mov dword [ebp - 0x2a], 0x6c
mov dword [ebp - 0x40], 0x65004b
mov dword [ebp - 0x36], 0x33006c
mov dword [ebp - 0x2e], 0x6c0064
mov dword [ebp - 0x3a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f9a4
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000f9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0xa], 0x706565
push esi
mov word [ebp - 0x24], ax
mov esi, ecx
lea eax, [ebp - 0x28]
mov word [ebp - 0xc], 0x6c53
push eax
mov dword [ebp - 0x1a], 0x2e0032
mov dword [ebp - 0x12], 0x6c
mov dword [ebp - 0x28], 0x65004b
mov dword [ebp - 0x1e], 0x33006c
mov dword [ebp - 0x16], 0x6c0064
mov dword [ebp - 0x22], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fa2f
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000fa40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x1a], 0x6c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], 0x320033
mov ecx, 0x6c
mov dword [ebp - 0x20], 0x64002e
push eax
xor esi, esi
mov word [ebp - 0x1c], cx
mov dword [ebp - 0x2c], 0x730055
mov dword [ebp - 0x28], 0x720065
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000fadd
lea eax, [ebp - 0x14]
mov word [ebp - 0x14], 0x6553
push eax
push edi
mov dword [ebp - 0x11], 0x646e6957
mov dword [ebp - 0xd], 0x6f50776f
mov byte [ebp - 0x12], 0x74
mov word [ebp - 9], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fad6
push esi
push 1
push 1
push 0xffffd8f0
push 0xffffd8f0
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000faf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 0x10], 0x754d6574
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x14], 0x61657243
mov word [ebp - 0xc], 0x6574
mov word [ebp - 9], 0x57
mov byte [ebp - 0xa], 0x78
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fb87
push edi
push 0
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000fba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x72
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0xd], 0x61657268
mov word [ebp - 0xf], 0x5465
mov dword [ebp - 0x14], 0x61657243
mov word [ebp - 9], 0x64
mov byte [ebp - 0x10], 0x74
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fc3e
push 0
push 0
push edi
push esi
push 0
push 0
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000fc50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 0xf], 0x7370616e
push edi
mov word [ebp - 0x38], ax
mov edi, edx
lea eax, [ebp - 0x3c]
mov word [ebp - 0x18], 0x6c6f
push eax
mov esi, ecx
mov dword [ebp - 0xb], 0x746f68
mov dword [ebp - 0x20], 0x61657243
mov word [ebp - 0x1b], 0x5465
mov dword [ebp - 0x14], 0x3233706c
mov word [ebp - 0x16], 0x6568
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x19], 0x6f
mov dword [ebp - 0x2e], 0x2e0032
mov dword [ebp - 0x26], 0x6c
mov dword [ebp - 0x3c], 0x65004b
mov dword [ebp - 0x32], 0x33006c
mov dword [ebp - 0x2a], 0x6c0064
mov dword [ebp - 0x36], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fd00
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000fd20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 0xd], 0x69463233
push edi
mov word [ebp - 0x2c], ax
mov edi, edx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], 0x636f7250
push eax
mov esi, ecx
mov word [ebp - 9], 0x7372
mov word [ebp - 0xf], 0x7373
mov word [ebp - 6], 0x57
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 7], 0x74
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fdbe
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000fdd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0xc], 0x5779726f
push esi
mov word [ebp - 0x30], ax
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], 0x6f6d6552
push eax
mov dword [ebp - 0x10], 0x74636572
mov dword [ebp - 0x14], 0x69446576
mov byte [ebp - 8], 0
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x2a], 0x33006c
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x2e], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fe61
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000fe80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 0x10], 0x73726946
push edi
mov word [ebp - 0x2c], ax
mov edi, edx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], 0x646e6946
push eax
mov esi, ecx
mov dword [ebp - 9], 0x57656c
mov word [ebp - 0xb], 0x6946
mov byte [ebp - 0xc], 0x74
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ff15
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000ff30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov word [ebp - 0xd], 0x6946
push edi
mov word [ebp - 0x28], ax
mov edi, edx
lea eax, [ebp - 0x2c]
mov dword [ebp - 8], 0x657a69
push eax
mov esi, ecx
mov word [ebp - 0xa], 0x5365
mov word [ebp - 0x10], 0x6547
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x6c
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ffc7
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000ffe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov word [ebp - 0xc], 0x7250
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x2c]
push eax
mov word [ebp - 0xf], 0x6570
mov word [ebp - 7], 0x7373
mov byte [ebp - 5], 0
mov word [ebp - 0xa], 0x636f
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 8], 0x65
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010081
push edi
push 0
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x100100a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0xe], 0x65636f72
push esi
mov word [ebp - 0x30], ax
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x16], 0x6e696d72
push eax
mov word [ebp - 0x18], 0x6554
mov dword [ebp - 0x12], 0x50657461
mov word [ebp - 9], 0x73
mov byte [ebp - 0xa], 0x73
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x2a], 0x33006c
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x2e], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010138
push 0
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x10010150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 0xd], 0x636f7250
push edi
mov word [ebp - 0x30], ax
mov edi, edx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], 0x43746978
push eax
mov esi, ecx
mov dword [ebp - 0x18], 0x45746547
mov dword [ebp - 9], 0x737365
mov word [ebp - 0xf], 0x6564
mov byte [ebp - 0x10], 0x6f
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x2a], 0x33006c
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x2e], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100101ec
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x10010200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x72
mov dword [ebp - 0x2d], 0x46656761
push edi
mov word [ebp - 0x1c], ax
mov edi, edx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x54], edi
push eax
mov ebx, ecx
mov dword [ebp - 0x33], 0x73736563
xor esi, esi
mov dword [ebp - 0x25], 0x57656d61
mov word [ebp - 0x36], 0x7250
mov dword [ebp - 0x3b], 0x65473233
mov dword [ebp - 0x29], 0x4e656c69
mov byte [ebp - 0x3c], 0x4b
mov word [ebp - 0x2f], 0x6d49
mov byte [ebp - 0x37], 0x74
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x34], 0x6f
mov dword [ebp - 0x12], 0x2e0032
mov dword [ebp - 0xa], 0x6c
mov dword [ebp - 0x20], 0x65004b
mov dword [ebp - 0x16], 0x33006c
mov dword [ebp - 0xe], 0x6c0064
mov dword [ebp - 0x1a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100102bf
push dword [ebp + 8]
push edi
push ebx
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x42], 0x6c006c
mov word [ebp - 0x3e], ax
mov eax, 0x50
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x4e], 0x610073
mov dword [ebp - 0x4a], 0x690070
mov dword [ebp - 0x46], 0x64002e
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10010355
lea eax, [ebp - 0x20]
mov word [ebp - 0x1f], 0x7465
push eax
push edi
mov dword [ebp - 0x1a], 0x73736563
mov dword [ebp - 0x13], 0x69466567
mov dword [ebp - 0xb], 0x57656d
mov dword [ebp - 0xf], 0x614e656c
mov word [ebp - 0x1c], 0x6f72
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1d], 0x50
mov word [ebp - 0x16], 0x6d49
mov byte [ebp - 0x14], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001034e
push dword [ebp + 8]
push dword [ebp - 0x54]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret