joyce8/EMBER2024-capa huggingface dataset:
Function at 0xeb0f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xec59fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xeb1002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00eb4dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xeb1002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00eac6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00eb520b
push 0x10
call fcn.00eb51d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xeb0fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00ea11c0
jmp 0xeb0fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00eb0b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xeb0ff0
mov ecx, edi
call fcn.00ea12c0
push edi
call fcn.00eb51c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xeb1021
inc ebx
cmp ebx, 0x20
jb 0xeb0f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xeb2250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xec6808
push 0xeb6288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xeb2329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xeb2329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00eb51d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xeb2329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xeb2329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xeb232c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00eb2351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xeb3000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xeb3131
push esi
call fcn.00eb6145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00ea5080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xeb3131
push 0
push ebp
call fcn.00ea53a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00ea5260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xeb308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00ea52f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xeb3121
push 0xecb918
push edi
call fcn.00eb43f0
push eax
push ebx
push esi
call fcn.00eb2f60
push 0xecb8f8
push edi
call fcn.00eb43f0
push eax
push ebx
push esi
call fcn.00eb2f60
push 0xecb8d8
push edi
call fcn.00eb43f0
push eax
push ebx
push esi
call fcn.00eb2f60
push 0xecb8c0
push edi
call fcn.00eb43f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00eb2f60
push 0xecb8a0
push edi
call fcn.00eb43f0
push eax
push ebx
push esi
call fcn.00eb2f60
push 0xecb888
push edi
call fcn.00eb43f0
push eax
push ebx
push esi
call fcn.00eb2f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xeb41b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00eb4140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00eb4140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00eb4140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00eb4140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xeb4bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xeb4c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xec687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xeb4c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xeb4c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x480920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6b000]
push edi
jmp 0x48093a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x480941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x480930
mov eax, 1
add ebx, ebx
jne 0x480953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x480948
jne 0x480964
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x480948
xor ecx, ecx
sub eax, 3
jb 0x480978
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4809ea
mov ebp, eax
add ebx, ebx
jne 0x480983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x480990
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4809b4
inc ecx
add ebx, ebx
jne 0x4809a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x480995
jne 0x4809b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x480995
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4809d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4809c5
jmp 0x480936
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4809d4
add edi, ecx
jmp 0x480936
pop esi
mov edi, esi
mov ecx, 0x104c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4809f2
cmp byte [edi], 9
jne 0x4809f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4809f7
lea edi, [esi + 0x7d000]
mov eax, dword [edi]
or eax, eax
je 0x480a6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x80c04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x80cb8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x480a24
mov ecx, edi
jns 0x480a53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x80cbc]
or eax, eax
je 0x480a69
mov dword [ebx], eax
add ebx, 4
jmp 0x480a41
call dword [esi + 0x80ccc]
mov ebp, dword [esi + 0x80cc0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x480aa3
sub esp, 0xffffff80
jmp 0x40fcc2
Function at 0x1000a1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov word [esp + 1], 0x73
mov byte [esp], 0x65
mov word [esp + 4], 0x7363
mov byte [esp + 6], 0
mov word [esp + 8], 0x7373
mov byte [esp + 0xa], 0
mov word [esp + 0xc], 0x7364
mov byte [esp + 0xe], 0
mov word [esp + 0x11], 0x73
mov byte [esp + 0x10], 0x66
mov word [esp + 0x15], 0x73
mov byte [esp + 0x14], 0x67
mov word [esp + 0x1b], 0x524f
mov word [esp + 0x18], 0x5245
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1d], 0
mov dword [esp + 0x22], 0x524f52
mov word [esp + 0x20], 0x5245
cmp ecx, 7
ja case.default.0x1000a25a
jmp dword [ecx*4 + 0x1000a318]
lea eax, [esp]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x28
ret
lea eax, [esp + 4]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x28
ret
lea eax, [esp + 8]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x28
ret
lea eax, [esp + 0xc]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x28
ret
lea eax, [esp + 0x10]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x28
ret
lea eax, [esp + 0x14]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x28
ret
lea eax, [esp + 0x18]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x28
ret
lea eax, [esp + 0x20]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x28
ret
Function at 0x1000a340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x6c
mov word [esp + 6], 0x7274
mov dword [esp + 1], 0x20657479
mov byte [esp + 8], 0
mov byte [esp], 0x62
mov byte [esp + 5], 0x70
mov word [esp + 0xf], 0x2064
mov word [esp + 0x12], 0x7274
mov byte [esp + 0x11], 0x70
mov byte [esp + 0x14], 0
mov word [esp + 0xd], 0x726f
mov byte [esp + 0xc], 0x77
mov dword [esp + 0x1a], 0x2064726f
mov word [esp + 0x1f], 0x7274
mov byte [esp + 0x21], 0
mov word [esp + 0x18], 0x7764
mov byte [esp + 0x1e], 0x70
mov dword [esp + 0x43], 0x727470
mov word [esp + 0x40], 0x6574
mov word [esp + 0x3d], 0x625f
mov byte [esp + 0x42], 0x20
mov byte [esp + 0x3c], 0x36
mov byte [esp + 0x3f], 0x79
mov word [esp + 0x2a], 0x7470
mov word [esp + 0x27], 0x6472
mov word [esp + 0x24], 0x7771
mov word [esp + 0x2c], 0x72
mov byte [esp + 0x29], 0x20
mov byte [esp + 0x26], 0x6f
mov dword [esp + 0x4b], 0x65747962
mov dword [esp + 0x4f], 0x72747020
mov word [esp + 0x49], 0x5f30
mov byte [esp + 0x53], 0
mov byte [esp + 0x48], 0x31
mov word [esp + 0x5a], 0x2044
mov dword [esp + 0x54], 0x41564e49
mov word [esp + 0x5d], 0x5254
mov byte [esp + 0x5f], 0
mov word [esp + 0x58], 0x494c
mov byte [esp + 0x5c], 0x50
mov dword [esp + 0x66], 0x54502044
mov dword [esp + 0x60], 0x41564e49
mov word [esp + 0x64], 0x494c
mov word [esp + 0x6a], 0x52
mov dword [esp + 0x36], 0x727470
mov word [esp + 0x31], 0x6f77
mov word [esp + 0x34], 0x2064
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x33], 0x72
cmp ecx, 8
ja case.default.0x1000a47e
jmp dword [ecx*4 + 0x1000a554]
lea eax, [esp]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret
lea eax, [esp + 0xc]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret
lea eax, [esp + 0x18]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret
lea eax, [esp + 0x3c]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret
lea eax, [esp + 0x24]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret
lea eax, [esp + 0x48]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret
lea eax, [esp + 0x54]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret
lea eax, [esp + 0x60]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret
lea eax, [esp + 0x30]
push eax
push 0x104
push edx
call fcn.1000db66
add esp, 0xc
add esp, 0x6c
ret

Function at 0x1000a580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov word [esp + 0xe], 0x6461
push eax
mov word [esp + 0x15], 0x64
mov dword [esp + 7], 0x72727543
mov dword [esp + 0xb], 0x54746e65
mov word [esp + 0x10], 0x6572
mov word [esp + 4], 0x6547
mov byte [esp + 0x14], 0x49
mov byte [esp + 6], 0x74
mov byte [esp + 0xf], 0x68
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a5d8
call eax
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret
Function at 0x1000a5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov dword [esp + 4], 0x65727275
push eax
mov dword [esp + 0xc], 0x7250746e
mov dword [esp + 0x12], 0x49737365
mov word [esp + 0x10], 0x636f
mov dword [esp + 4], 0x43746547
mov word [esp + 0x16], 0x64
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a62b
call eax
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret

Function at 0x1000a640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov word [esp + 7], 0x6e65
push eax
mov word [esp + 0x11], 0x6563
mov dword [esp + 5], 0x75437465
mov word [esp + 0x14], 0x73
mov word [esp + 0xe], 0x7250
mov byte [esp + 0x13], 0x73
mov byte [esp + 4], 0x47
mov byte [esp + 0xd], 0x74
mov word [esp + 9], 0x7272
mov byte [esp + 0x10], 0x6f
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a69c
call eax
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x1000a6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov dword [esp + 0xd], 0x417972
push eax
mov esi, ecx
mov dword [esp + 0xc], 0x7262694c
mov byte [esp + 0x10], 0x61
mov word [esp + 9], 0x616f
mov byte [esp + 0xb], 0x64
mov byte [esp + 8], 0x4c
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a6f9
push esi
call eax
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x1000a810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 5], 0x68547465
push eax
mov esi, ecx
mov dword [esp + 0x15], 0x79746972
mov dword [esp + 0xe], 0x50646165
mov word [esp + 0x12], 0x6972
mov byte [esp + 0x19], 0
mov byte [esp + 8], 0x47
mov byte [esp + 0xd], 0x72
mov byte [esp + 0x14], 0x6f
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a866
push esi
call eax
pop esi
add esp, 0x14
ret
mov eax, 0x7fffffff
pop esi
add esp, 0x14
ret

Function at 0x1000a870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov word [esp + 0x10], 0x64
push eax
mov esi, ecx
mov word [esp + 0xe], 0x5464
mov dword [esp + 9], 0x65707375
mov word [esp + 0x11], 0x6572
mov byte [esp + 8], 0x53
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x10], 0x68
mov byte [esp + 0xd], 0x6e
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a8c4
push esi
call eax
pop esi
add esp, 0x10
ret
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
Function at 0x1000a8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov dword [esp + 0xb], 0x6f6c6c41
push eax
mov esi, ecx
mov word [esp + 8], 0x6956
mov dword [esp + 0xb], 0x6c617574
mov word [esp + 0x13], 0x63
mov byte [esp + 0xa], 0x72
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a91f
push 0x20
push 0x3000
push 0x6c
push esi
call eax
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x1000a930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x516c6175
push eax
mov esi, edx
mov dword [esp + 0xc], 0x74726956
mov edi, ecx
mov dword [esp + 0x15], 0x797265
mov byte [esp + 0x14], 0x75
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a977
push 0x1c
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x1000a980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 9], 0x68547465
push eax
mov esi, edx
mov word [esp + 0x17], 0x6f69
mov edi, ecx
mov word [esp + 0x14], 0x5064
mov word [esp + 0x11], 0x6572
mov word [esp + 0x1c], 0x79
mov word [esp + 0x19], 0x6972
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0xc], 0x53
mov byte [esp + 0x16], 0x72
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a9e7
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x1000a9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov word [esp + 4], 0x6547
push eax
mov esi, ecx
mov dword [esp + 0xb], 0x74737953
mov dword [esp + 0x12], 0x6f666e
mov word [esp + 0xf], 0x6d65
mov byte [esp + 0xa], 0x74
mov byte [esp + 0x11], 0x49
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000aa36
push esi
call eax
pop esi
add esp, 0x10
ret

Function at 0x1000aa90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x14], 0x74786574
push eax
mov esi, edx
mov word [esp + 0xf], 0x6854
mov edi, ecx
mov word [esp + 0xc], 0x6547
mov byte [esp + 0x1c], 0
mov word [esp + 0x12], 0x6165
mov byte [esp + 0xe], 0x74
mov word [esp + 0x15], 0x6f43
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x14], 0x64
mov byte [esp + 0x11], 0x72
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000aaf5
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x1000ab00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0x14], 0x7463
push eax
mov esi, edx
mov word [esp + 0x1b], 0x78
mov edi, ecx
mov word [esp + 0x10], 0x6175
mov word [esp + 0xd], 0x7269
mov byte [esp + 0xf], 0x74
mov dword [esp + 0x14], 0x65746f72
mov byte [esp + 0x1a], 0x45
mov byte [esp + 0xc], 0x56
mov word [esp + 0x12], 0x506c
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ab6e
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x1000ab80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov dword [esp + 8], 0x6854656d
push eax
mov esi, ecx
mov dword [esp + 8], 0x75736552
mov dword [esp + 0x11], 0x646165
mov byte [esp + 0x10], 0x72
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000abc0
push esi
call eax
pop esi
add esp, 0x10
ret
or eax, 0xffffffff
pop esi
add esp, 0x10
ret

Function at 0x1000abd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp]
mov word [esp + 0x15], 0x6974
push eax
mov dword [esp + 4], 0x74696e49
mov dword [esp + 0x11], 0x61636974
mov word [esp + 0x1c], 0x6e
mov word [esp + 0x16], 0x6553
mov dword [esp + 9], 0x7a696c61
mov byte [esp + 0x15], 0x6c
mov byte [esp + 8], 0x69
mov byte [esp + 0x1b], 0x6f
mov dword [esp + 0xd], 0x69724365
mov byte [esp + 0x18], 0x63
call fcn.1000b020
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ac36
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret

Function at 0x1000ac40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov word [esp + 0xb], 0x4b65
mov word [esp + 6], 0x4367
mov word [esp + 0xe], 0x79
mov word [esp + 9], 0x736f
mov word [esp + 4], 0x6552
mov byte [esp + 8], 0x6c
mov byte [esp + 0xd], 0x65
call fcn.1000afe0
test eax, eax
je 0x1000ac94
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ac94
push esi
call eax
pop esi
add esp, 0xc
ret
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x1000aca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov esi, edx
mov dword [esp + 0xd], 0x41784579
mov dword [esp + 9], 0x654b6e65
mov word [esp + 7], 0x704f
mov byte [esp + 0x11], 0
mov word [esp + 4], 0x6552
mov byte [esp + 6], 0x67
call fcn.1000afe0
test eax, eax
je 0x1000acff
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000acff
push dword [esp + 0x20]
push 0x20019
push 0
push esi
push 0x80000001
call eax
pop esi
add esp, 0x10
ret
mov eax, 1
pop esi
add esp, 0x10
ret