joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032501
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebp - 0x24], eax
inc edi
call fcn.10034e98
mov esi, eax
test esi, esi
je 0x100325a6
lea eax, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 0xb], 0x45
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x16], 0x67
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0xa], 0x78
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 8], 0
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 9], 0x57
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x10], 0x56
mov byte [ebp - 0xd], 0x75
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003259f
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
push 0
push dword [ebp - 0x20]
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x100325b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x1c], eax
xor ebx, ebx
call fcn.100333ee
mov esi, eax
cmp esi, ebx
je 0x1003263a
lea eax, [ebp - 0x14]
push eax
push esi
mov byte [ebp - 0xb], 0x77
mov byte [ebp - 0x14], 0x46
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 8], 0x41
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 7], bl
mov byte [ebp - 0xf], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10032633
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push ebx
push ebx
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10008ddf
leave
ret
Function at 0x1003264a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
push eax
xor esi, esi
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 8], 0x73
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 9], 0x72
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 7], 0x74
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 6], 0
call fcn.100312fb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100326b3
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x100327b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
xor esi, esi
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 8], 0
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0x18], 0x54
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0xa], 0x73
call fcn.100312fb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003282a
push esi
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x10032839
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x6e
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 8], 0x64
mov byte [ebp - 0xb], 0x48
call fcn.100312fb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10032895
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret
Function at 0x100328a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x24], eax
xor edi, edi
call fcn.100333ee
mov esi, eax
test esi, esi
je 0x1003294f
lea eax, [ebp - 0x20]
push eax
push esi
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1d], 0x57
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 8], 0
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x1a], 0x64
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x11], 0x50
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xa], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10032948
push dword [ebp - 0x24]
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x10032a82
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 7], 0
mov byte [ebp - 8], 0x6c
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 9], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008ddf
leave
ret
Function at 0x10033072
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
mov dword [ebp - 0x20], eax
xor edi, edi
call fcn.10034e98
mov esi, eax
test esi, esi
je 0x10033105
lea eax, [ebp - 0x14]
push eax
push esi
mov byte [ebp - 8], 0x57
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 0xb], 0x4c
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x67
mov byte [ebp - 7], 0
mov byte [ebp - 0xc], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100330fe
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push edi
push 9
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x100333ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 8], 0x6c
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 6], 0
mov byte [ebp - 0x10], 0x55
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008ddf
leave
ret

Function at 0x1003370e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor edi, edi
call fcn.10034e98
mov esi, eax
test esi, esi
je 0x10033797
lea eax, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x18], 0x4f
mov byte [ebp - 0x17], 0x70
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xb], 0x6b
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xa], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10033790
push dword [ebp - 0x1c]
push 0x20
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret
Function at 0x10033806
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov cl, byte [edx]
or eax, 0xffffffff
test cl, cl
je 0x10033834
push esi
movzx ecx, cl
push 7
xor eax, ecx
pop ecx
mov esi, eax
and esi, 1
neg esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec ecx
jns 0x10033818
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x10033810
pop esi
not eax
ret

Function at 0x10033837
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 8], 0
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008ddf
leave
ret
Function at 0x10033dde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
call fcn.10032a82
mov esi, eax
test esi, esi
je 0x10033e68
lea eax, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 7], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 6], 0x41
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 5], 0
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 8], 0x63
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10033e61
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x10033e78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
push esi
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 9], 0x6e
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 7], 0
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x19], 0x56
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 8], 0x57
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0x1b], 0x65
call fcn.100312fb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10033f28
mov ecx, 0x105
push ecx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push ecx
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret
Function at 0x100341aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
push eax
or esi, 0xffffffff
mov byte [ebp - 9], 0x69
mov byte [ebp - 7], 0
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 8], 0x41
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xb], 0x6d
mov byte [ebp - 0x10], 0x6c
call fcn.100312fb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10034200
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x1003423e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
call fcn.100333ee
mov esi, eax
test esi, esi
je 0x100342a7
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x77
mov byte [ebp - 6], 0
mov byte [ebp - 0xd], 0x77
mov byte [ebp - 0xf], 0x68
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xe], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100342a0
push dword [ebp + 8]
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x100342b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0x14]
push eax
xor esi, esi
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 6], 0
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 7], 0x57
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 0x14], 0x46
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 9], 0x67
mov byte [ebp - 0xe], 0x4d
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x13], 0x6f
call fcn.100312fb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10034333
push dword [ebp - 0x18]
push dword [ebp + 0x10]
push ebx
push esi
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret
Function at 0x10034c3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], eax
inc edi
call fcn.10033837
mov esi, eax
test esi, esi
je 0x10034cc1
lea eax, [ebp - 0x14]
push eax
push esi
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 9], 0x49
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 5], 0
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 7], 0x66
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0xb], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10034cba
push dword [ebp - 0x18]
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret
Function at 0x10034d5e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x64], 0
push ebx
push esi
push edi
mov dword [ebp - 0x60], ecx
lea ebx, [eax + 0x4c]
push 8
pop ecx
mov esi, ebx
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x12], 0x36
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 9], 0x66
mov byte [ebp - 0xf], 0x39
mov byte [ebp - 0x10], 0x38
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x14], 0x34
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 8], 0
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x11], 0x37
call fcn.10032f4d
push 0xf
xor eax, eax
xor edx, edx
mov esi, ebx
pop edi
mov ecx, dword [esi]
mov ebx, ecx
shr ebx, 0x1c
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x5c], bl
inc eax
mov ebx, ecx
shr ebx, 0x18
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x5c], bl
mov ebx, ecx
shr ebx, 0x14
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x5b], bl
inc eax
mov ebx, ecx
shr ebx, 0x10
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x5b], bl
inc eax
mov ebx, ecx
shr ebx, 0xc
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x5b], bl
inc eax
mov ebx, ecx
shr ebx, 8
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
mov byte [ebp + eax - 0x5b], bl
inc eax
mov ebx, ecx
shr ebx, 4
and ebx, edi
mov bl, byte [ebp + ebx - 0x18]
inc eax
and ecx, edi
mov cl, byte [ebp + ecx - 0x18]
mov byte [ebp + eax - 0x5c], bl
inc eax
mov byte [ebp + eax - 0x5c], cl
mov ecx, dword [ebp + edx*4 - 0x84]
inc eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 8
jl 0x10034de2
mov ecx, dword [ebp - 0x60]
mov byte [ebp + eax - 0x5c], 0
lea eax, [ebp - 0x5c]
push eax
call fcn.10001444
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x60]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008ddf
leave
ret 4

Function at 0x10034e98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x41
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 8], 0
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0x11], 0x61
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008ddf
leave
ret
Function at 0x10035aa1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x20], eax
xor ebx, ebx
call fcn.1003684b
mov esi, eax
cmp esi, ebx
je 0x10035b4a
lea eax, [ebp - 0x1c]
push eax
push esi
mov byte [ebp - 9], 0x61
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 7], 0x68
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x1b], 0x48
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0x1a], 0x47
mov byte [ebp - 6], 0x57
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 5], bl
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0xa], 0x50
mov byte [ebp - 8], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10035b43
push ebx
push 0x25
push dword [ebp - 0x20]
push ebx
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10008ddf
leave
ret

Function at 0x10035cc9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
push eax
xor esi, esi
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 8], 0x74
mov byte [ebp - 9], 0x78
mov byte [ebp - 7], 0
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0x12], 0x6f
call fcn.100312fb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10035d2e
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret

Function at 0x10035dcd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10040344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
inc edi
call fcn.10034e98
mov esi, eax
test esi, esi
je 0x10035e38
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp - 5], 0
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 7], 0x65
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 8], 0x4b
mov byte [ebp - 6], 0x79
mov byte [ebp - 9], 0x65
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 0xd], 0x43
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10035e31
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10008ddf
leave
ret