joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ac36880
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x4c
mov eax, dword [edx + 0xc]
mov edx, dword [edx + 0x38]
test edx, edx
je 0x7ac36a30
cmp dword [ebx + 0x48], eax
jl 0x7ac369d0
mov eax, dword [ebx]
mov dword [esp], esi
lea edi, [ebx + 0x2c]
mov dword [esp + 4], eax
call fcn.7ac2dfa0
lea eax, [ebx + 0x30]
mov dword [ebp - 0x20], eax
jmp 0x7ac368df
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x34]
lea ecx, [ecx + ecx*4]
add ecx, ecx
cmp eax, ecx
jg 0x7ac369bc
add eax, eax
mov dword [ebx + 0x34], eax
mov eax, ebx
call fcn.7ac36800
mov eax, dword [ebp - 0x20]
mov edx, dword [ebx + 8]
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x4c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
lea eax, [eax + edx*2]
mov dword [esp + 8], eax
mov eax, dword [ebx]
add eax, 0xb8
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.usp10.dll_ScriptShape
sub esp, 0x28
mov edx, eax
cmp eax, 0x8007000e
je 0x7ac368c0
test eax, eax
js 0x7ac369bc
mov eax, dword [ebx + 0x44]
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 8], eax
mov eax, dword [ebx]
add eax, 0xb8
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.usp10.dll_ScriptPlace
sub esp, 0x24
mov edx, eax
test eax, eax
js 0x7ac369bc
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x10], 0
test ecx, ecx
jle 0x7ac369bc
mov eax, dword [ebx + 0x40]
lea esi, [eax + ecx*4]
xor ecx, ecx
nop
add ecx, dword [eax]
add eax, 4
mov dword [ebx + 0x10], ecx
cmp esi, eax
jne 0x7ac369b0
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x4c]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0xc]
sub esp, 0xc
lea edx, [eax + eax]
shl eax, 2
mov dword [esp + 4], 0
mov dword [ebx + 0x48], edx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x4c], eax
sub esp, 0xc
jmp 0x7ac368a4
fnstcw word [ebp - 0x1a]
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fmul dword [0x7ac4d46c]
fadd dword [0x7ac4d470]
movzx eax, word [ebp - 0x1a]
or ah, 0xc
mov word [ebp - 0x1c], ax
fldcw word [ebp - 0x1c]
fistp dword [ebp - 0x20]
fldcw word [ebp - 0x1a]
mov eax, dword [ebp - 0x20]
add eax, 7
and eax, 0xfffffff8
mov dword [ebx + 0x34], eax
mov eax, ebx
call fcn.7ac36800
mov eax, dword [ebx + 0xc]
jmp 0x7ac3689b
Function at 0x7ac39530
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x23c
test dl, 0x20
je 0x7ac39628
shr edx, 0x10
cmp edx, 1
je 0x7ac39660
cmp edx, 0xfde9
je 0x7ac395b8
test edx, edx
je 0x7ac39628
cmp edx, 2
mov eax, 0x4e4
mov esi, 0x2710
mov dword [esp], edx
cmovne esi, eax
mov edi, 0x7ac4d4ca
mov eax, str.ansi
mov dword [esp + 4], 0
cmovne edi, eax
lea eax, [ebp - 0x238]
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_GetCPInfoExW]
sub esp, 0xc
test eax, eax
cmovne esi, dword [ebp - 0x224]
cmp esi, 0xfde9
jne 0x7ac39641
lea esi, [esi]
nop
mov dword [esp + 4], str.urtf
mov esi, 0xfde9
mov dword [esp], ebx
call fcn.7ac394c0
test eax, eax
jne 0x7ac395e0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 0x1201c], esi
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
mov dword [esp + 4], str.deff0deflang_udeflangfe_u
movzx eax, ax
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
call fcn.7ac394c0
test eax, eax
je 0x7ac395d1
mov dword [ebx + 0x12018], 0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetACP]
mov edi, str.ansi
mov esi, eax
cmp esi, 0xfde9
je 0x7ac395b8
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], str._rtf1_s_ansicpg_uuc1
mov dword [esp], ebx
call fcn.7ac394c0
jmp 0x7ac395cd
call dword [sym.imp.kernel32.dll_GetOEMCP]
mov edi, 0x7ac4d4d3
mov esi, eax
cmp eax, 0x1b5
je 0x7ac39641
mov edi, str.ansi
cmp eax, 0x352
jne 0x7ac39635
mov edi, 0x7ac4d4d6
jmp 0x7ac39641
Function at 0x100079bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002c150]
jne 0x100079c5
repz ret
jmp fcn.1000d40c

Function at 0x1001c2fd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000cd43
and dword [ebp - 4], 0
cmp dword [0x1002f630], 0
mov ebx, eax
jne 0x1001c3ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001c45f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001c45f
push eax
call fcn.1000ccd1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1002f630], eax
call esi
push eax
call fcn.1000ccd1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1002f634], eax
call esi
push eax
call fcn.1000ccd1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1002f638], eax
call esi
push eax
call fcn.1000ccd1
pop ecx
mov dword [0x1002f640], eax
test eax, eax
je 0x1001c3ae
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000ccd1
pop ecx
mov dword [0x1002f63c], eax
mov eax, dword [0x1002f63c]
cmp eax, ebx
je 0x1001c406
cmp dword [0x1002f640], ebx
je 0x1001c406
push eax
call fcn.1000cd4c
push dword [0x1002f640]
mov esi, eax
call fcn.1000cd4c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001c406
test edi, edi
je 0x1001c406
call esi
test eax, eax
je 0x1001c3fd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001c3fd
test byte [ebp - 0xc], 1
jne 0x1001c406
or dword [ebp + 0x10], 0x200000
jmp 0x1001c43f
mov eax, dword [0x1002f634]
cmp eax, ebx
je 0x1001c43f
push eax
call fcn.1000cd4c
pop ecx
test eax, eax
je 0x1001c43f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001c43f
mov eax, dword [0x1002f638]
cmp eax, ebx
je 0x1001c43f
push eax
call fcn.1000cd4c
pop ecx
test eax, eax
je 0x1001c43f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002f630]
call fcn.1000cd4c
pop ecx
test eax, eax
je 0x1001c45f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001c461
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001f2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov al, 0x65
push esi
mov esi, dword [esp + 0x24]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], al
mov byte [esp + 0x18], al
mov byte [esp + 9], al
push edi
mov edi, dword [esp + 0x2c]
mov cl, 0x6c
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x13], 0x4d
mov byte [esp + 0x17], cl
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x16], 0x75
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x21], 0x41
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x22], bl
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x1f], 0x6d
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1d], 0x4e
call fcn.1001f580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1001f377
mov ecx, dword [esp + 0x30]
push ecx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100079bb
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.100079bb
add esp, 0x18
ret

Function at 0x1001f420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x1c], eax
mov al, 0x6f
mov byte [esp + 0x16], al
mov byte [esp + 8], al
mov byte [esp + 7], al
mov dl, 0x68
mov al, 0x6c
mov cl, 0x65
mov byte [esp + 9], al
mov byte [esp + 0xc], al
push esi
mov byte [esp + 0x19], dl
mov byte [esp + 0xe], dl
mov dl, 0x70
lea eax, [esp + 4]
push eax
or esi, 0xffffffff
mov byte [esp + 0x20], 0
mov byte [esp + 0x1c], 0x73
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0xe], 0x54
mov byte [esp + 0xb], 0x61
mov byte [esp + 0xa], cl
mov byte [esp + 0x1a], 0x61
mov byte [esp + 9], 0x72
mov byte [esp + 0x16], 0x33
mov byte [esp + 8], 0x43
mov byte [esp + 0x13], cl
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x1b], dl
mov byte [esp + 0xd], cl
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0xc], 0x74
mov byte [esp + 0x15], dl
call fcn.1001f580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001f4de
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
call eax
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100079bb
add esp, 0x20
ret
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100079bb
add esp, 0x20
ret
Function at 0x1001f4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
push edi
lea eax, [esp + 8]
push eax
xor edi, edi
mov byte [esp + 0x13], 0x73
mov byte [esp + 0x15], 0
mov byte [esp + 0xc], 0x46
mov byte [esp + 0x14], 0x65
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0x10], 0x43
mov byte [esp + 0xf], 0x64
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0x12], 0x6f
mov byte [esp + 0xd], 0x69
call fcn.1001f580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001f561
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.100079bb
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100079bb
add esp, 0x10
ret
Function at 0x10020210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10023981
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1002c150]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebx
mov eax, 0xf
mov ecx, 1
lea ebp, [esi + 4]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov dword [esp + 0x70], ecx
mov byte [ebp], bl
cmp dword [esp + 0x90], ebx
mov dword [esp + 0x18], ecx
jle 0x10020373
push 0xffffffffffffffff
mov dword [esp + 0x48], eax
push ebx
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.10003660
mov eax, dword [esp + 0x40]
cmp eax, ebx
mov byte [esp + 0x70], 2
mov dword [esp + 0x1c], eax
jle 0x1002035f
push 2
push ebx
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x38]
call fcn.10003e20
cmp dword [esp + 0x60], 0x10
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x70], 3
jae 0x100202d5
lea eax, [esp + 0x4c]
push 0x10
push 0
push eax
call fcn.10022ee0
mov ecx, dword [esi + 0x18]
add esp, 0xc
mov byte [esp + 0x14], al
cmp ecx, 0x10
jb 0x100202f3
mov eax, dword [ebp]
jmp 0x100202f5
mov eax, ebp
mov edx, dword [esi + 0x14]
lea edi, [edx + eax]
test edi, edi
je 0x10020321
cmp ecx, 0x10
jb 0x10020309
mov eax, dword [ebp]
jmp 0x1002030b
mov eax, ebp
cmp eax, edi
ja 0x10020321
cmp ecx, 0x10
jb 0x10020319
mov eax, dword [ebp]
jmp 0x1002031b
mov eax, ebp
add edx, eax
cmp edi, edx
jbe 0x10020326
call fcn.10007d7d
mov edx, dword [esp + 0x14]
push edx
push edi
push esi
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.10003a00
cmp dword [esp + 0x60], 0x10
mov byte [esp + 0x70], 2
jb 0x10020352
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.10006e74
add esp, 4
add ebx, 2
cmp ebx, dword [esp + 0x1c]
jl 0x100202b0
cmp dword [esp + 0x44], 0x10
jb 0x10020373
mov edx, dword [esp + 0x30]
push edx
call fcn.10006e74
add esp, 4
cmp dword [esp + 0x94], 0x10
jb 0x1002038d
mov eax, dword [esp + 0x80]
push eax
call fcn.10006e74
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.100079bb
add esp, 0x60
ret
Function at 0x100204d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov dword [esp + 0x10], eax
mov edi, 1
call fcn.1001f5f0
mov esi, eax
test esi, esi
je 0x10020575
lea ecx, [esp + 0x14]
mov al, 0x65
push ecx
push esi
mov byte [esp + 0x25], 0x79
mov byte [esp + 0x27], 0x78
mov byte [esp + 0x28], 0x41
mov byte [esp + 0x24], al
mov byte [esp + 0x1f], 0x4f
mov byte [esp + 0x23], 0x4b
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x29], 0
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x21], al
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x1c], 0x52
mov byte [esp + 0x1d], al
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002056c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push ecx
push edx
push ebp
push ebx
call eax
mov edi, eax
push esi
call fcn.1001f210
add esp, 4
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100079bb
add esp, 0x18
ret

Function at 0x10020590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov byte [esp + 0x11], 0x73
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x10], 0x6c
mov byte [esp + 0x13], 0x72
mov byte [esp + 0x19], bl
mov byte [esp + 0x15], 0x70
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x14], 0x63
mov byte [esp + 0x17], 0x6e
call fcn.1001f580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1002060c
mov ecx, dword [esp + 0x28]
push ecx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.100079bb
add esp, 0x10
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.100079bb
add esp, 0x10
ret
Function at 0x10020620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x14], eax
mov cl, 0x74
mov al, 0x65
push esi
mov esi, dword [esp + 0x20]
mov byte [esp + 0x10], al
mov byte [esp + 5], al
mov byte [esp + 0xb], al
push edi
mov byte [esp + 0x16], cl
mov dl, 0x72
mov byte [esp + 0xe], cl
mov byte [esp + 0xa], cl
mov cl, 0x79
lea eax, [esp + 8]
push eax
xor edi, edi
mov byte [esp + 0x19], 0x63
mov byte [esp + 0x15], 0x44
mov byte [esp + 0x17], dl
mov byte [esp + 0x14], 0x6d
mov byte [esp + 0x10], cl
mov byte [esp + 0xf], 0x53
mov byte [esp + 0x1c], dl
mov byte [esp + 0xc], 0x47
mov byte [esp + 0x1e], 0x41
mov byte [esp + 0x1f], 0
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x11], 0x73
mov byte [esp + 0x1b], 0x6f
mov byte [esp + 0x1d], cl
call fcn.1001f580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100206c6
mov ecx, dword [esp + 0x28]
push ecx
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100079bb
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100079bb
add esp, 0x18
ret

Function at 0x10020800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
push esi
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
mov edi, 1
call fcn.1001f5f0
mov esi, eax
test esi, esi
je 0x100208d5
mov al, 0x75
lea ecx, [esp + 0x20]
mov byte [esp + 0x2b], al
mov byte [esp + 0x24], al
mov al, 0x65
push ecx
push esi
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x2f], 0x79
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x35], 0x45
mov byte [esp + 0x2a], 0x67
mov byte [esp + 0x36], 0x78
mov byte [esp + 0x38], 0
mov byte [esp + 0x34], al
mov byte [esp + 0x37], 0x41
mov byte [esp + 0x28], 0x52
mov byte [esp + 0x30], 0x56
mov byte [esp + 0x2d], al
mov byte [esp + 0x2b], 0x51
mov byte [esp + 0x29], al
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100208cc
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ecx
push ebp
push ebx
call eax
mov edi, eax
push esi
call fcn.1001f210
add esp, 4
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100079bb
add esp, 0x28
ret
Function at 0x10022710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov edi, dword [esp + 0x24]
call fcn.1001fd30
mov esi, eax
test esi, esi
je 0x100227a7
mov al, 0x61
mov byte [esp + 0x15], al
mov byte [esp + 9], al
mov al, 0x65
mov cl, 0x46
mov byte [esp + 0x17], al
mov byte [esp + 0x13], al
lea eax, [esp + 8]
mov byte [esp + 0xc], cl
mov byte [esp + 0x10], cl
mov cl, 0x69
push eax
push esi
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x19], cl
mov byte [esp + 0x1e], 0x6d
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x1c], 0x4e
mov byte [esp + 0x10], 0x50
mov byte [esp + 0x15], cl
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x13], 0x68
mov byte [esp + 0x21], 0
mov byte [esp + 0x20], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002279e
push edi
call eax
mov edi, eax
push esi
call fcn.1001f210
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100079bb
add esp, 0x18
ret

Function at 0x10022810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x14], eax
mov al, 0x72
mov cl, 0x65
mov byte [esp + 5], al
mov byte [esp + 0xb], al
mov byte [esp + 6], al
push esi
mov dl, 0x73
lea eax, [esp + 4]
push eax
or esi, 0xffffffff
mov byte [esp + 0x11], 0x74
mov byte [esp + 0x15], 0x63
mov byte [esp + 0x14], 0x6f
mov byte [esp + 9], cl
mov byte [esp + 0x17], dl
mov byte [esp + 0xb], 0x43
mov byte [esp + 0x16], cl
mov byte [esp + 0x10], 0x6e
mov byte [esp + 0xc], 0x75
mov byte [esp + 8], 0x47
mov byte [esp + 0xf], cl
mov byte [esp + 0x18], dl
mov byte [esp + 0xa], 0x74
mov byte [esp + 0x12], 0x50
mov byte [esp + 0x19], 0
call fcn.1001f580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100228a1
call eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100079bb
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100079bb
add esp, 0x18
ret

Function at 0x10022970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
xor edi, edi
call fcn.1001f5f0
mov esi, eax
test esi, esi
je 0x100229f6
mov al, 0x65
mov byte [esp + 0x1a], al
mov byte [esp + 0x11], al
mov byte [esp + 0x15], al
lea eax, [esp + 0x10]
push eax
push esi
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x1f], 0x4e
mov byte [esp + 0x24], 0
mov byte [esp + 0x21], 0x6d
mov byte [esp + 0x1c], 0x73
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1e], 0x72
mov byte [esp + 0x18], 0x47
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x1b], 0x55
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100229ed
push ebp
push ebx
call eax
mov edi, eax
push esi
call fcn.1001f210
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100079bb
add esp, 0x14
ret
Function at 0x10022a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10023cb1
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x1002c150]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1002c150]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebx
mov eax, 0xf
mov ecx, 1
lea ebp, [esi + 4]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov dword [esp + 0x70], ecx
mov byte [ebp], bl
cmp dword [esp + 0x90], ebx
mov dword [esp + 0x18], ecx
jle 0x10022b73
push 0xffffffffffffffff
mov dword [esp + 0x48], eax
push ebx
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.10003660
mov eax, dword [esp + 0x40]
cmp eax, ebx
mov byte [esp + 0x70], 2
mov dword [esp + 0x1c], eax
jle 0x10022b5f
push 2
push ebx
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x38]
call fcn.10003e20
cmp dword [esp + 0x60], 0x10
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x70], 3
jae 0x10022ad5
lea eax, [esp + 0x4c]
push 0x10
push 0
push eax
call fcn.10022ee0
mov ecx, dword [esi + 0x18]
add esp, 0xc
mov byte [esp + 0x14], al
cmp ecx, 0x10
jb 0x10022af3
mov eax, dword [ebp]
jmp 0x10022af5
mov eax, ebp
mov edx, dword [esi + 0x14]
lea edi, [edx + eax]
test edi, edi
je 0x10022b21
cmp ecx, 0x10
jb 0x10022b09
mov eax, dword [ebp]
jmp 0x10022b0b
mov eax, ebp
cmp eax, edi
ja 0x10022b21
cmp ecx, 0x10
jb 0x10022b19
mov eax, dword [ebp]
jmp 0x10022b1b
mov eax, ebp
add edx, eax
cmp edi, edx
jbe 0x10022b26
call fcn.10007d7d
mov edx, dword [esp + 0x14]
push edx
push edi
push esi
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.10003a00
cmp dword [esp + 0x60], 0x10
mov byte [esp + 0x70], 2
jb 0x10022b52
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.10006e74
add esp, 4
add ebx, 2
cmp ebx, dword [esp + 0x1c]
jl 0x10022ab0
cmp dword [esp + 0x44], 0x10
jb 0x10022b73
mov edx, dword [esp + 0x30]
push edx
call fcn.10006e74
add esp, 4
cmp dword [esp + 0x94], 0x10
jb 0x10022b8d
mov eax, dword [esp + 0x80]
push eax
call fcn.10006e74
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.100079bb
add esp, 0x60
ret 0x20