joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006b93
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x258
mov eax, 0x10022dfd
call fcn.1000ebec
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x260], ebx
push 0x10024220
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x264], esi
mov dword [esi], ebx
call fcn.1000202b
xor eax, eax
push 0x206
mov word [ebp - 0x25c], ax
lea eax, [ebp - 0x25a]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x260], 1
call fcn.10012fa0
push 0x104
lea eax, [ebp - 0x25c]
push eax
push ebx
call fcn.10005453
add esp, 0x18
push 0x53
pop eax
push 0x69
mov word [ebp - 0x54], ax
pop eax
push 0x61
mov word [ebp - 0x48], ax
pop eax
push 0x68
mov word [ebp - 0x4c], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x52], ax
pop eax
push 0x70
mov word [ebp - 0x46], ax
pop eax
push 0x64
mov word [ebp - 0x4a], ax
pop eax
mov word [ebp - 0x44], ax
push 0x77
pop eax
mov word [ebp - 0x4e], ax
xor eax, eax
mov word [ebp - 0x3e], ax
lea eax, [ebp - 0x54]
push eax
mov word [ebp - 0x50], cx
mov word [ebp - 0x42], cx
mov word [ebp - 0x40], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10006d02
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x24]
push eax
push edi
mov dword [ebp - 0x1b], 0x4e656c69
mov dword [ebp - 0x24], 0x68746150
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov word [ebp - 0x17], 0x6d61
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x1c], 0x46
call ebx
test eax, eax
je 0x10006cfb
lea ecx, [ebp - 0x25c]
push ecx
call eax
push eax
mov ecx, esi
call fcn.10004987
lea eax, [ebp - 0x3c]
push eax
push edi
mov word [ebp - 0x37], 0x6d65
mov dword [ebp - 0x30], 0x736e6574
mov dword [ebp - 0x3c], 0x68746150
mov dword [ebp - 0x34], 0x78456576
mov dword [ebp - 0x2b], 0x576e6f
mov byte [ebp - 0x38], 0x52
mov byte [ebp - 0x35], 0x6f
mov byte [ebp - 0x2c], 0x69
call ebx
mov ebx, eax
test ebx, ebx
je 0x10006cfb
mov ecx, esi
call fcn.10006745
push eax
call ebx
push 0xffffffffffffffff
mov ecx, esi
call fcn.100077fa
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
call fcn.1000eb9b
ret
Function at 0x10006ed4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x1a8]
push eax
push 0x101
mov edi, ecx
call dword [0x1004c51c]
push 6
push 1
push 2
pop ebx
push ebx
call dword [0x1004c50c]
mov dword [edi + 0x78], eax
cmp eax, 0xffffffff
jne 0x10006f20
call dword [0x1004c510]
xor al, al
jmp 0x10006fb1
push esi
lea eax, [ebp - 0x18]
lea esi, [edi + 0x40c0]
push eax
mov dword [ebp - 0xb], 0x474e49
mov byte [ebp - 0xc], 0x50
mov word [esi], bx
mov word [ebp - 0x13], 0x302e
mov dword [ebp - 0x18], 0x2e373231
mov word [ebp - 0x10], 0x31
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x11], 0x2e
call dword [0x1004c514]
mov dword [edi + 0x40c4], eax
mov eax, 0xcee
add ax, word [edi + 0x4170]
movzx eax, ax
push eax
call dword [0x1004c518]
mov word [edi + 0x40c2], ax
push 0x10
push esi
push dword [edi + 0x78]
call dword [0x1004c520]
pop esi
cmp eax, 0xffffffff
jne 0x10006f9d
push dword [edi + 0x78]
call dword [0x1004c52c]
jmp 0x10006f13
lea ecx, [ebp - 0xc]
push ecx
mov ecx, edi
call fcn.1000b4f7
mov ecx, edi
call fcn.1000ae06
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret
Function at 0x100075b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1c]
push eax
mov esi, ecx
mov dword [ebp - 0xc], 0x6e6f6974
mov dword [ebp - 0x19], 0x72437265
mov word [ebp - 0xe], 0x6365
mov dword [ebp - 0x13], 0x6c616369
mov word [ebp - 0x1c], 0x6e45
mov word [ebp - 0x15], 0x7469
mov byte [ebp - 8], 0
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0xf], 0x53
call fcn.1000ab54
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000760f
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000eb1d
leave
ret

Function at 0x1000775e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], 0x2e373231
push dword [edi + 0x78]
mov dword [ebp - 0xb], 0x312e302e
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 7], 0
call dword [0x1004c52c]
push 6
push 1
push 2
pop ebx
push ebx
call dword [0x1004c50c]
mov dword [edi + 0x78], eax
lea eax, [ebp - 0x10]
lea esi, [edi + 0x40c0]
push eax
mov word [esi], bx
call dword [0x1004c514]
mov dword [edi + 0x40c4], eax
mov eax, 0xcee
add ax, word [edi + 0x4170]
movzx eax, ax
push eax
call dword [0x1004c518]
mov word [edi + 0x40c2], ax
push 0x10
push esi
push dword [edi + 0x78]
call dword [0x1004c520]
mov ecx, dword [ebp - 4]
cmp eax, 0xffffffff
pop edi
setne al
pop esi
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret

Function at 0x100082c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1c]
push eax
mov esi, ecx
mov word [ebp - 0xe], 0x6365
mov dword [ebp - 0x1c], 0x7661654c
mov dword [ebp - 0xc], 0x6e6f6974
mov dword [ebp - 0x18], 0x69724365
mov byte [ebp - 8], 0
mov word [ebp - 0x14], 0x6974
mov word [ebp - 0x11], 0x6c61
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0xf], 0x53
call fcn.1000ab54
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000831e
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000eb1d
leave
ret
Function at 0x1000832b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002e0e1], 0
push esi
mov esi, ecx
je 0x100083ed
push edi
push 0x70
pop eax
push 0x55
mov word [ebp - 0xe], ax
pop eax
push 0x6d
mov word [ebp - 0x10], ax
pop eax
push 0x54
mov word [ebp - 8], ax
pop eax
push 0x64
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x10]
push eax
mov edi, 0x5a0
push edi
call fcn.10004c3f
test eax, eax
je 0x100083ec
push edi
mov ecx, esi
call fcn.100052af
test eax, eax
je 0x100083ec
push str.GlobalChronoSpeedupUpdMutex
xor edi, edi
push edi
push 0x100000
call fcn.1000c609
add esp, 0xc
test eax, eax
je 0x100083b6
push eax
call fcn.1000ba3d
pop ecx
jmp 0x100083ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100083ec
cmp dword [0x1002e0ec], edi
je 0x100083d5
push dword [0x1002e0ec]
call fcn.1000ba3d
pop ecx
push edi
push edi
push esi
push 0x10009f53
push edi
push edi
call fcn.1000bd78
add esp, 0x18
mov dword [0x1002e0ec], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000eb1d
leave
ret

Function at 0x1000ba3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov word [ebp - 7], 0x656c
mov dword [ebp - 0xc], 0x6e614865
mov dword [ebp - 0x10], 0x736f6c43
mov byte [ebp - 8], 0x64
mov byte [ebp - 5], bl
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ba88
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret

Function at 0x1000ba98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
inc edi
call fcn.1000b88e
mov esi, eax
test esi, esi
je 0x1000baf0
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0xc], 0x657a696c
mov dword [ebp - 0x10], 0x61697469
mov dword [ebp - 0x14], 0x6e496f43
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bae9
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret
Function at 0x1000bb01
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.1000b88e
mov esi, eax
test esi, esi
je 0x1000bb54
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0xa], 0x657a696c
mov dword [ebp - 0x14], 0x6e556f43
mov dword [ebp - 0xe], 0x61697469
mov word [ebp - 0x10], 0x6e69
mov byte [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bb4d
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000eb1d
leave
ret

Function at 0x1000bb61
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002d14c]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov dword [esp + 0xc], eax
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
or esi, 0xffffffff
mov dword [esp + 0x21], 0x57746e
mov word [esp + 0x18], 0x7243
mov dword [esp + 0x1d], 0x65764565
mov word [esp + 0x1b], 0x7461
mov byte [esp + 0x1a], 0x65
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bbcd
push dword [esp + 0x10]
push ebp
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000eb1d
add esp, 0x18
ret

Function at 0x1000bbe2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1002d14c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
push esi
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x20]
push eax
or esi, 0xffffffff
mov word [esp + 0x27], 0x7461
mov word [esp + 0x2a], 0x6946
mov word [esp + 0x2d], 0x5765
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2c], 0x6c
mov word [esp + 0x24], 0x7243
mov byte [esp + 0x2f], 0
mov byte [esp + 0x26], 0x65
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bc7f
push dword [esp + 0x14]
push dword [esp + 0x20]
push dword [esp + 0x18]
push dword [esp + 0x24]
push ebp
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000eb1d
add esp, 0x20
ret
Function at 0x1000bc94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1002d14c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
mov dword [esp + 0x18], 0x754d6574
mov dword [esp + 0x14], 0x61657243
mov word [esp + 0x1c], 0x6574
mov word [esp + 0x1f], 0x57
mov byte [esp + 0x1e], 0x78
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bcf3
push ebp
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1000eb1d
add esp, 0x14
ret

Function at 0x1000bd08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1002d14c]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x16], 0x65746165
mov dword [esp + 0x1a], 0x65706950
mov word [esp + 0x14], 0x7243
mov byte [esp + 0x1e], bl
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bd63
push dword [esp + 0x30]
push ebp
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1000eb1d
add esp, 0x10
ret

Function at 0x1000bd78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1002d14c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
push ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x1c]
push eax
xor ebx, ebx
mov dword [esp + 0x27], 0x61657268
mov word [esp + 0x25], 0x5465
mov dword [esp + 0x20], 0x61657243
mov word [esp + 0x2b], 0x64
mov byte [esp + 0x24], 0x74
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bdfb
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x1c]
push ebp
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1000eb1d
add esp, 0x20
ret
Function at 0x1000be10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
or esi, 0xffffffff
mov dword [ebp - 0xf], 0x7370616e
mov word [ebp - 0x18], 0x6c6f
mov dword [ebp - 0xb], 0x746f68
mov dword [ebp - 0x20], 0x61657243
mov word [ebp - 0x1b], 0x5465
mov dword [ebp - 0x14], 0x3233706c
mov word [ebp - 0x16], 0x6568
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x19], 0x6f
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000be80
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret

Function at 0x1000beed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
call fcn.1000b9ce
mov esi, eax
test esi, esi
je 0x1000bf48
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0xa], 0x776f646e
mov dword [ebp - 0xe], 0x69576d75
mov word [ebp - 0x10], 0x6e45
mov word [ebp - 6], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bf41
push dword [ebp + 0xc]
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret

Function at 0x1000bf59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], 0x79536f54
mov dword [ebp - 0x1b], 0x54656c69
mov dword [ebp - 0x10], 0x6d657473
mov dword [ebp - 0xc], 0x656d6954
mov word [ebp - 0x17], 0x6d69
mov byte [ebp - 0x1c], 0x46
mov byte [ebp - 8], bl
mov byte [ebp - 0x15], 0x65
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000bfbb
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret

Function at 0x1000bfcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x10], 0x73726946
mov dword [ebp - 0x14], 0x646e6946
mov dword [ebp - 9], 0x57656c
mov word [ebp - 0xb], 0x6946
mov byte [ebp - 0xc], 0x74
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c021
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret
Function at 0x1000c032
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov word [ebp - 0xe], 0x7478
mov dword [ebp - 0xb], 0x57656c69
mov dword [ebp - 0x12], 0x654e646e
mov word [ebp - 0x14], 0x6946
mov byte [ebp - 7], bl
mov byte [ebp - 0xc], 0x46
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c088
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret

Function at 0x1000c0f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x11], 0x50746e65
mov word [ebp - 8], 0x73
mov dword [ebp - 0xd], 0x65636f72
mov word [ebp - 0x16], 0x4374
mov word [ebp - 0x13], 0x7272
mov byte [ebp - 0x14], 0x75
mov word [ebp - 0x18], 0x6547
mov byte [ebp - 9], 0x73
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c153
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000eb1d
leave
ret

Function at 0x1000c162
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
xor ebx, ebx
mov dword [ebp - 0xd], 0x636f7250
mov dword [ebp - 0x14], 0x43746978
mov dword [ebp - 0x18], 0x45746547
mov dword [ebp - 9], 0x737365
mov word [ebp - 0xf], 0x6564
mov byte [ebp - 0x10], 0x6f
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c1bd
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret

Function at 0x1000c1ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
xor ebx, ebx
mov dword [ebp - 0x12], 0x6e6f6974
mov word [ebp - 0x1a], 0x4965
mov word [ebp - 0x17], 0x6f66
mov word [ebp - 0xa], 0x646e
mov dword [ebp - 0xe], 0x61487942
mov byte [ebp - 0x18], 0x6e
mov word [ebp - 7], 0x65
mov word [ebp - 0x20], 0x6547
mov word [ebp - 0x1d], 0x6946
mov word [ebp - 0x14], 0x616d
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 8], 0x6c
mov byte [ebp - 0x1b], 0x6c
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c24f
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret
Function at 0x1000c2c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
xor ebx, ebx
mov word [ebp - 0xe], 0x6c69
mov dword [ebp - 9], 0x57656d
mov word [ebp - 0xb], 0x614e
mov dword [ebp - 0x14], 0x6c75646f
mov dword [ebp - 0x18], 0x4d746547
mov byte [ebp - 0xc], 0x65
mov word [ebp - 0x10], 0x4665
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c32b
push dword [ebp + 0x10]
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000eb1d
leave
ret

Function at 0x1000c33c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x1002d14c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x50]
lea eax, [esp + 0x28]
xor ebx, ebx
push eax
mov dword [esp + 0x3b], 0x46656761
mov dword [esp + 0x35], 0x73736563
mov dword [esp + 0x43], 0x57656d61
mov word [esp + 0x32], 0x7250
mov dword [esp + 0x2d], 0x65473233
mov dword [esp + 0x3f], 0x4e656c69
mov byte [esp + 0x2c], 0x4b
mov word [esp + 0x39], 0x6d49
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x47], bl
mov byte [esp + 0x34], 0x6f
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c3c1
push dword [esp + 0x54]
push edi
push esi
call eax
mov ebx, eax
jmp 0x1000c433
push ebp
call fcn.1000b8f3
mov ebp, eax
test ebp, ebp
je 0x1000c432
lea eax, [esp + 0x10]
push eax
push ebp
mov word [esp + 0x19], 0x7465
mov dword [esp + 0x1e], 0x73736563
mov dword [esp + 0x25], 0x69466567
mov dword [esp + 0x2d], 0x57656d
mov dword [esp + 0x29], 0x614e656c
mov word [esp + 0x1c], 0x6f72
mov byte [esp + 0x18], 0x47
mov byte [esp + 0x1b], 0x50
mov word [esp + 0x22], 0x6d49
mov byte [esp + 0x24], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c42b
push dword [esp + 0x58]
push edi
push esi
call eax
mov ebx, eax
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebp
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1000eb1d
add esp, 0x3c
ret

Function at 0x1000c447
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002d14c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 6], 0x57
mov dword [ebp - 0xb], 0x666e4970
mov word [ebp - 0x14], 0x6547
mov word [ebp - 0x11], 0x7453
mov word [ebp - 0xe], 0x7472
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
call fcn.1000b817
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c4a1
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000eb1d
leave
ret