joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
jne 0x10022cb9
mov byte [esp + 0x10], al
lea eax, [esp + 4]
push eax
mov dword [esp + 0x10], 0x6c6c642e
mov dword [esp + 8], 0x6e72654b
mov word [esp + 0xd], 0x336c
mov byte [esp + 0xc], 0x65
mov byte [esp + 0xf], 0x32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x10022d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10022dd8
mov byte [esp + 0xf], al
lea eax, [esp + 4]
push eax
mov dword [esp + 0xf], 0x6c6c642e
mov dword [esp + 0xb], 0x69706177
mov word [esp + 8], 0x6853
mov byte [esp + 0xa], 0x6c
call fcn.1001d370
add esp, 4
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret

Function at 0x10022df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x10022e44
lea eax, [esp + 4]
mov word [esp + 8], 0x6970
push eax
mov word [esp + 9], 0x7664
mov dword [esp + 0xf], 0x6c642e32
mov word [esp + 0x13], 0x6c
mov byte [esp + 8], 0x41
mov byte [esp + 0xe], 0x33
mov byte [esp + 0xb], 0x61
call fcn.1001d370
add esp, 4
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x10022e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x10022ea8
lea eax, [esp + 4]
mov word [esp + 0xc], 0x6c
push eax
mov word [esp + 8], 0x6c4f
mov dword [esp + 0xb], 0x642e3233
mov byte [esp + 0xa], 0x65
mov byte [esp + 0xf], 0x6c
call fcn.1001d370
add esp, 4
mov dword [esi + 0x10], eax
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret

Function at 0x10022ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x10022f0f
lea eax, [esp + 4]
mov word [esp + 0xb], 0x642e
push eax
mov dword [esp + 8], 0x6c656853
mov word [esp + 0x12], 0x6c
mov word [esp + 0xc], 0x336c
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0xe], 0x32
call fcn.1001d370
add esp, 4
mov dword [esi + 0x14], eax
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret
Function at 0x10022f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x10022f6c
mov byte [esp + 0xe], al
lea eax, [esp + 4]
push eax
mov dword [esp + 0xe], 0x6c6c642e
mov word [esp + 8], 0x7355
mov word [esp + 0xb], 0x3372
mov byte [esp + 0xd], 0x32
mov byte [esp + 0xa], 0x65
call fcn.1001d370
add esp, 4
mov dword [esi + 0x18], eax
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret

Function at 0x10022f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x10022fc4
lea eax, [esp + 4]
mov dword [esp + 8], 0x642e3474
push eax
mov word [esp + 0x11], 0x6c
mov dword [esp + 8], 0x72637052
mov byte [esp + 0x10], 0x6c
call fcn.1001d370
add esp, 4
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret

Function at 0x10023100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x10023148
lea eax, [esp + 4]
mov dword [esp + 7], 0x642e3233
push eax
mov word [esp + 8], 0x6447
mov word [esp + 0x10], 0x6c
mov byte [esp + 0xa], 0x69
mov byte [esp + 0xf], 0x6c
call fcn.1001d370
add esp, 4
mov dword [esi + 0x28], eax
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret
Function at 0x10027599
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push ebp
xor ebp, ebp
push esi
mov cl, byte [ebx]
mov esi, dword [esp + 0x2c]
test cl, cl
je 0x100276b1
mov edx, dword [esp + 0x30]
mov al, cl
dec edx
mov dword [esp + 0xc], edx
push edi
cmp al, 0x24
je 0x10027607
cmp al, 0x26
je 0x10027607
cmp al, 0x2b
je 0x10027607
cmp al, 0x2c
je 0x10027607
cmp al, 0x2f
je 0x10027607
cmp al, 0x3a
je 0x10027607
cmp al, 0x3b
je 0x10027607
cmp al, 0x3d
je 0x10027607
cmp al, 0x3f
je 0x10027607
cmp al, 0x40
je 0x10027607
cmp al, 0x23
je 0x10027607
cmp al, 0x20
je 0x10027607
mov byte [esi], cl
xor eax, eax
xor ecx, ecx
inc ecx
inc eax
jmp 0x1002769b
movsx eax, al
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x23], 0x783230
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x24]
mov word [esp + 0x28], 0x2525
push 4
push eax
mov byte [esp + 0x32], 0x25
call fcn.10019460
lea ecx, [esp + 0x2c]
add esp, 0x14
xor edi, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002763e
sub ecx, edx
je 0x1002766e
movsx eax, byte [esp + edi + 0x18]
push eax
call fcn.10032728
pop ecx
lea ecx, [esp + 0x18]
mov byte [esp + edi + 0x18], al
inc edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10027661
sub ecx, edx
cmp edi, ecx
jb 0x10027649
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x3c]
sub eax, ebp
push eax
push esi
call fcn.10032cf8
lea ecx, [esp + 0x28]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002768c
sub ecx, edx
mov edx, dword [esp + 0x10]
mov eax, ecx
add esi, eax
add ebp, ecx
inc ebx
cmp ebp, edx
jae 0x100276b0
mov cl, byte [ebx]
mov al, cl
test cl, cl
jne 0x100275ca
pop edi
mov ecx, dword [esp + 0x20]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x100277aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x6c65
push eax
mov dword [ebp - 0xd], 0x6c642e32
mov byte [ebp - 0xe], 0x33
mov word [ebp - 9], 0x6c
mov dword [ebp - 0x14], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ca58
leave
ret

Function at 0x1002782c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x6970
push eax
mov dword [ebp - 0xb], 0x6c6c64
mov word [ebp - 0xd], 0x2e32
mov dword [ebp - 0x14], 0x61766441
mov byte [ebp - 0xe], 0x33
call fcn.1002929a
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ca58
leave
ret
Function at 0x100278b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c6c642e
push eax
mov dword [ebp - 0xd], 0x69706177
mov word [ebp - 0xf], 0x6c68
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 5], 0
call fcn.1002929a
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ca58
leave
ret

Function at 0x100278f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x6c642e6e
push eax
mov dword [ebp - 0xe], 0x6f697372
mov word [ebp - 0x10], 0x6556
mov word [ebp - 6], 0x6c
call fcn.1002929a
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ca58
leave
ret

Function at 0x10027939
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0x10], 0x61636f4c
mov dword [ebp - 0xb], 0x6f6c6c41
mov word [ebp - 7], 0x63
mov byte [ebp - 0xc], 0x6c
call fcn.100277aa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027986
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10027a06
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
or esi, 0xffffffff
push eax
mov dword [ebp - 9], 0x41656c
mov word [ebp - 0x14], 0x6946
mov word [ebp - 0x11], 0x4664
mov dword [ebp - 0xe], 0x46747372
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xa], 0x69
call fcn.100277aa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027a62
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10027a73
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov word [ebp - 0x14], 0x6946
mov word [ebp - 0xe], 0x7478
mov word [ebp - 0x11], 0x4e64
mov word [ebp - 9], 0x4165
mov word [ebp - 0xc], 0x6946
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 7], bl
mov byte [ebp - 0xa], 0x6c
call fcn.100277aa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027ad5
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret
Function at 0x10027ae6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov word [ebp - 8], 0x41
mov dword [ebp - 0xd], 0x6c694679
mov word [ebp - 0x10], 0x6f43
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0x65
call fcn.100277aa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027b39
push dword [ebp + 0x10]
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10027c91
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0xd], 0x61657268
xor ebx, ebx
mov dword [ebp - 0x15], 0x72727543
push eax
mov word [ebp - 8], 0x6449
mov byte [ebp - 6], bl
mov word [ebp - 0x17], 0x7465
mov dword [ebp - 0x11], 0x54746e65
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 9], 0x64
call fcn.100277aa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027ce8
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10027e0e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100277ee
mov esi, eax
test esi, esi
je 0x10027e71
lea eax, [ebp - 0x18]
mov word [ebp - 0xb], 0x6957
push eax
push esi
mov dword [ebp - 8], 0x776f64
mov dword [ebp - 0xf], 0x646e756f
mov dword [ebp - 0x13], 0x72676572
mov dword [ebp - 0x17], 0x6f467465
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 9], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027e6a
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10027f7e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100277ee
mov esi, eax
test esi, esi
je 0x10027fea
lea eax, [ebp - 0x18]
mov dword [ebp - 0x12], 0x65726854
push eax
push esi
mov dword [ebp - 0x17], 0x63617474
mov dword [ebp - 0xe], 0x6e496461
mov byte [ebp - 0x18], 0x41
mov word [ebp - 9], 0x7475
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 7], bl
mov byte [ebp - 0xa], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027fe3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret
Function at 0x10027ffa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
call fcn.100277ee
mov esi, eax
test esi, esi
je 0x10028077
lea eax, [ebp - 0x1c]
mov word [ebp - 0x17], 0x506d
push eax
push esi
mov dword [ebp - 0x1c], 0x74737953
mov dword [ebp - 0xd], 0x666e4973
mov word [ebp - 0xf], 0x7265
mov byte [ebp - 0x18], 0x65
mov dword [ebp - 0x14], 0x656d6172
mov word [ebp - 9], 0x416f
mov byte [ebp - 7], bl
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x10], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028070
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10028088
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100277ee
mov esi, eax
test esi, esi
je 0x100280fa
lea eax, [ebp - 0x1c]
mov word [ebp - 0x19], 0x536b
push eax
push esi
mov dword [ebp - 0x16], 0x726f4674
mov dword [ebp - 0xe], 0x57646e75
mov dword [ebp - 0xa], 0x6f646e69
mov dword [ebp - 0x12], 0x6f726765
mov byte [ebp - 0x17], 0x65
mov word [ebp - 6], 0x77
mov word [ebp - 0x1c], 0x6f4c
mov byte [ebp - 0x1a], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100280f3
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x1002810a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100277ee
mov esi, eax
test esi, esi
je 0x10028185
lea eax, [ebp - 0x20]
mov dword [ebp - 0xd], 0x6f646e69
push eax
push esi
mov word [ebp - 0x14], 0x7267
mov word [ebp - 0x1c], 0x5377
mov dword [ebp - 0x11], 0x57646e75
mov word [ebp - 0x1f], 0x6c6c
mov word [ebp - 9], 0x77
mov dword [ebp - 0x18], 0x65726f46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x20], 0x41
mov word [ebp - 0x1a], 0x7465
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002817e
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret
Function at 0x10028195
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
call fcn.100277ee
mov esi, eax
test esi, esi
je 0x100281f6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x46746553
push eax
push esi
mov dword [ebp - 0x10], 0x6e756f72
mov dword [ebp - 0x14], 0x6765726f
mov dword [ebp - 8], 0x776f64
mov dword [ebp - 0xc], 0x6e695764
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100281ef
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10028866
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x30]
call fcn.100278f9
mov esi, eax
test esi, esi
je 0x100288f2
lea eax, [esp + 0x10]
mov dword [esp + 0x21], 0x7a69536f
push eax
push esi
mov word [esp + 0x1b], 0x6946
mov dword [esp + 0x1d], 0x6556656c
mov word [esp + 0x18], 0x6547
mov dword [esp + 0x22], 0x6e6f6973
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x1a], 0x74
mov word [esp + 0x26], 0x6e49
mov word [esp + 0x2e], 0x41
mov byte [esp + 0x28], 0x66
mov byte [esp + 0x2d], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100288eb
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret

Function at 0x10028907
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4c746547
xor ebx, ebx
mov dword [ebp - 0xc], 0x726f7272
push eax
mov dword [ebp - 0x10], 0x45747361
mov byte [ebp - 8], bl
call fcn.100277aa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002894a
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret
Function at 0x100289df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x34]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x38]
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x10028a5d
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x636e4574
push eax
push esi
mov word [esp + 0x19], 0x7972
mov dword [esp + 0x21], 0x747079
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x1b], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028a56
push dword [esp + 0x40]
push ebp
push edi
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x10028afb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
push esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x10], eax
call fcn.100278f9
mov esi, eax
test esi, esi
je 0x10028b7a
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 0x79726575
push eax
push esi
mov dword [esp + 0x28], 0x756c6156
mov dword [esp + 0x20], 0x51726556
mov word [esp + 0x2c], 0x4165
mov byte [esp + 0x2e], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028b73
push dword [esp + 0x10]
push dword [esp + 0x18]
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret

Function at 0x10028b8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x10028c09
lea eax, [ebp - 0x18]
mov word [ebp - 0xf], 0x7361
push eax
push esi
mov dword [ebp - 0x16], 0x52747079
mov word [ebp - 9], 0x6574
mov word [ebp - 0x18], 0x7243
mov word [ebp - 6], 0x74
mov word [ebp - 0xc], 0x6f43
mov word [ebp - 0x12], 0x6c65
mov byte [ebp - 7], 0x78
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x10], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028c02
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret