joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007d9d6
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x24c], esi
call fcn.10001640
mov ecx, eax
test ecx, ecx
je 0x1002bf6b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24c], eax
push 0x1008441c
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 0
call fcn.10003080
test al, al
jne 0x1002be33
push 0x1008441c
lea ecx, [ebp - 0x24c]
call fcn.10002330
push 0x208
lea eax, [ebp - 0x248]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.10008270
add esp, 0xc
mov dword [ebp - 0x32], 0x6946646e
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2d], 0x6f567473
mov dword [ebp - 0x27], 0x57656d
mov word [ebp - 0x29], 0x756c
push eax
mov byte [ebp - 0x2e], 0x72
mov word [ebp - 0x34], 0x6946
mov word [ebp - 0x1c], 0x6c65
mov dword [ebp - 0x19], 0x6c642e32
mov byte [ebp - 0x1a], 0x33
mov word [ebp - 0x15], 0x6c
mov dword [ebp - 0x20], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002bf1b
push 0x104
lea ecx, [ebp - 0x248]
push ecx
call eax
cmp eax, 0xffffffff
je 0x1002bf1b
xor eax, eax
mov dword [ebp - 0x3c], 0x730025
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.10003b70
add esp, 0xc
lea eax, [ebp - 0x24c]
mov ecx, esi
push eax
call fcn.10002560
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x24c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002bf4e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1002bf4e
lea eax, [ebp - 0x24c]
mov ecx, esi
push eax
call fcn.10002560
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edi, dword [ebp - 0x24c]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1002bf4e
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10006166
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001300
int3
Function at 0x1002d1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x13], 0x4d282063
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], esi
lea edx, [ecx + 1]
mov dword [ebp - 0x1c], 0x5349534e
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov word [ebp - 9], 0x29
mov dword [ebp - 0x18], 0x656e495f
mov word [ebp - 0xf], 0x7a6f
mov word [ebp - 0xc], 0x6c6c
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 0xd], 0x69
mov byte [esi], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d250
sub ecx, edx
lea eax, [ebp - 0x1c]
push ecx
push eax
mov ecx, esi
call fcn.10003410
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002d700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0x28], eax
mov ebx, edx
push edi
lea eax, [ebp - 0x14]
mov word [ebp - 0xe], 0x3233
push eax
mov esi, 1
mov dword [ebp - 0xb], 0x6c6c64
mov dword [ebp - 0x12], 0x69706176
mov word [ebp - 0x14], 0x6441
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002d791
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1e], 0x79654b6e
push eax
push edi
mov dword [ebp - 0x22], 0x65704f67
mov dword [ebp - 0x1a], 0x577845
mov word [ebp - 0x24], 0x6552
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d78a
push dword [ebp - 0x28]
push dword [ebp + 0xc]
push 0
push ebx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002d850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x642e6970
push eax
mov esi, ecx
mov dword [ebp - 0xf], 0x61776c68
mov word [ebp - 6], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0x10], 0x53
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002d8e0
lea eax, [ebp - 0x24]
mov word [ebp - 0x17], 0x6d61
push eax
push edi
mov word [ebp - 0x20], 0x6946
mov word [ebp - 0x23], 0x7461
mov word [ebp - 0x14], 0x41
mov byte [ebp - 0x21], 0x68
mov dword [ebp - 0x1e], 0x6946646e
mov byte [ebp - 0x24], 0x50
mov word [ebp - 0x19], 0x4e65
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x15], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d8d9
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10006166
mov esp, ebp
pop ebp
ret
Function at 0x1002db70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x21], 0x7473614c
push eax
mov dword [ebp - 0x1c], 0x726f7272
mov word [ebp - 0x24], 0x6547
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x1d], 0x45
mov word [ebp - 0x10], 0x6c65
mov dword [ebp - 0xd], 0x6c642e32
mov byte [ebp - 0xe], 0x33
mov word [ebp - 9], 0x6c
mov dword [ebp - 0x14], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002dbe7
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006166
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002de20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x24], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov esi, 1
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0xb], 0x642e6970
mov dword [ebp - 0xf], 0x61776c68
mov word [ebp - 6], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0x10], 0x53
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002debb
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x416575
push eax
push edi
mov word [ebp - 0x1b], 0x5348
mov dword [ebp - 0x18], 0x6c615674
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x19], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002deb4
push dword [ebp + 0x14]
push dword [ebp - 0x20]
push dword [ebp + 0xc]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002ded0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x20]
mov word [ebp - 9], 0x6c6c
push eax
mov edi, edx
mov word [ebp - 6], 0x63
mov esi, ecx
mov word [ebp - 0xb], 0x416c
mov dword [ebp - 0x10], 0x626f6c47
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 7], 0x6f
mov word [ebp - 0x1c], 0x6c65
mov dword [ebp - 0x19], 0x6c642e32
mov byte [ebp - 0x1a], 0x33
mov word [ebp - 0x15], 0x6c
mov dword [ebp - 0x20], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002df52
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006166
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10006166
mov esp, ebp
pop ebp
ret
Function at 0x1002e0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x34], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x30], eax
mov esi, 1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x38], edx
mov word [ebp - 0xe], 0x3233
mov dword [ebp - 0xb], 0x6c6c64
mov dword [ebp - 0x12], 0x69706176
mov word [ebp - 0x14], 0x6441
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002e162
lea eax, [ebp - 0x28]
mov word [ebp - 0x25], 0x7551
push eax
push edi
mov dword [ebp - 0x22], 0x61567972
mov dword [ebp - 0x1d], 0x78456575
mov word [ebp - 0x19], 0x57
mov word [ebp - 0x28], 0x6552
mov byte [ebp - 0x26], 0x67
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x23], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002e15b
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0
push dword [ebp - 0x38]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002e180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
mov word [ebp - 0x1a], 0x3233
push eax
mov ebx, ecx
mov dword [ebp - 0x17], 0x6c6c64
mov esi, 1
mov dword [ebp - 0x1e], 0x69706176
mov word [ebp - 0x20], 0x6441
mov byte [ebp - 0x18], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002e20b
lea eax, [ebp - 0x10]
mov word [ebp - 9], 0x4b65
push eax
push edi
mov word [ebp - 6], 0x79
mov word [ebp - 0xc], 0x6f6c
mov word [ebp - 0xf], 0x6765
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xd], 0x43
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 7], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002e204
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret
Function at 0x1002e350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x30], eax
mov ebx, edx
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x34], ecx
push eax
xor esi, esi
mov word [ebp - 0xe], 0x3233
mov dword [ebp - 0xb], 0x6c6c64
mov dword [ebp - 0x12], 0x69706176
mov word [ebp - 0x14], 0x6441
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002e402
lea eax, [ebp - 0x2c]
mov word [ebp - 0x20], 0x4365
push eax
push edi
mov dword [ebp - 0x2b], 0x676e6168
mov word [ebp - 0x23], 0x6976
mov word [ebp - 0x26], 0x6553
mov word [ebp - 0x1b], 0x6769
mov word [ebp - 0x18], 0x41
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x21], 0x63
mov word [ebp - 0x1d], 0x666e
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x2c], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002e3fb
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x34]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002e420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0xf], 0x65736f6c
push eax
mov esi, ecx
mov word [ebp - 6], 0x65
mov dword [ebp - 0xb], 0x646e6148
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 7], 0x6c
mov word [ebp - 0x1c], 0x6c65
mov dword [ebp - 0x19], 0x6c642e32
mov byte [ebp - 0x1a], 0x33
mov word [ebp - 0x15], 0x6c
mov dword [ebp - 0x20], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002e498
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006166
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10006166
mov esp, ebp
pop ebp
ret
Function at 0x1002e6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
xor esi, esi
mov word [ebp - 0xe], 0x3233
mov dword [ebp - 0xb], 0x6c6c64
mov dword [ebp - 0x12], 0x69706176
mov word [ebp - 0x14], 0x6441
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002e75e
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1e], 0x616e614d
push eax
push edi
mov word [ebp - 0x1a], 0x6567
mov word [ebp - 0x17], 0x41
mov word [ebp - 0x23], 0x6570
mov word [ebp - 0x20], 0x4353
mov byte [ebp - 0x24], 0x4f
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x18], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002e757
push ebx
push esi
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002e780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
mov word [ebp - 7], 0x65
push eax
mov esi, ecx
mov dword [ebp - 0xe], 0x6c61626f
mov word [ebp - 0x10], 0x6c47
mov word [ebp - 0xa], 0x7246
mov byte [ebp - 8], 0x65
mov word [ebp - 0x1c], 0x6c65
mov dword [ebp - 0x19], 0x6c642e32
mov byte [ebp - 0x1a], 0x33
mov word [ebp - 0x15], 0x6c
mov dword [ebp - 0x20], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002e7f9
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006166
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002ea10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x642e6970
push eax
mov ebx, ecx
mov dword [ebp - 0xf], 0x61776c68
xor esi, esi
mov word [ebp - 6], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0x10], 0x53
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002ea98
lea eax, [ebp - 0x20]
mov dword [ebp - 0x15], 0x41737473
push eax
push edi
mov word [ebp - 0x1b], 0x6c69
mov dword [ebp - 0x20], 0x68746150
mov word [ebp - 0x18], 0x7845
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x1c], 0x46
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0x19], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002ea91
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret
Function at 0x1002ecc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov word [ebp - 0xe], 0x3233
push eax
mov ebx, ecx
mov dword [ebp - 0xb], 0x6c6c64
xor esi, esi
mov dword [ebp - 0x12], 0x69706176
mov word [ebp - 0x14], 0x6441
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002ed4d
lea eax, [ebp - 0x28]
mov word [ebp - 0x18], 0x656c
push eax
push edi
mov dword [ebp - 0x26], 0x5365736f
mov dword [ebp - 0x21], 0x63697672
mov dword [ebp - 0x1d], 0x6e614865
mov word [ebp - 0x28], 0x6c43
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x22], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002ed46
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret

Function at 0x1002ed60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x28], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x24], eax
mov esi, 1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xb], 0x642e6970
mov dword [ebp - 0xf], 0x61776c68
mov word [ebp - 6], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0x10], 0x53
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002ee07
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x416575
push eax
push edi
mov dword [ebp - 0x19], 0x61567465
mov word [ebp - 0x1b], 0x4748
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x1c], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002ee00
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006166
mov esp, ebp
pop ebp
ret
Function at 0x1003b30f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x51
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
imul eax, eax, 0x17
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0x16
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x20], 0x71
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x79
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x66
xor eax, eax
inc eax
imul eax, eax, 0x15
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x19
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1a
jae 0x1003b40f
jmp 0x1003b414
call fcn.10006480
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x50
xor eax, eax
inc eax
imul eax, eax, 0x18
mov byte [ebp + eax - 0x20], 0x79
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0x46
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x72
lea eax, [ebp - 0x20]
push eax
call fcn.1003b835
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1003b475
push dword [ebp + 8]
call dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006166
leave
ret
Function at 0x1003b484
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x6f
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x53
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x69
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x43
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x18], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x18], 0x73
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x18], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x18], 0x6b
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x18], 0x4d
xor eax, eax
inc eax
imul eax, eax, 0x13
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x14
jae 0x1003b540
jmp 0x1003b545
call fcn.10006480
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x18], 0x6f
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0x69
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x72
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x56
lea eax, [ebp - 0x18]
push eax
call fcn.1003b835
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1003b5bc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006166
leave
ret