joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435c08
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcb8
xor eax, eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x435def
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x338]
call fcn.00435950
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 4]
mov ecx, 0x435e08
call fcn.004061c0
xor ecx, ecx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2e0]
call fcn.004043d0
call fcn.00403d30
lea eax, [ebp - 0x2e0]
call fcn.00404090
call fcn.00403d30
mov edx, 0x435e30
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
push 0x435e48
lea edx, [ebp - 0x340]
xor eax, eax
call fcn.00403f9c
push dword [ebp - 0x340]
push 0x435e60
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00406248
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
push 0x435e70
lea edx, [ebp - 0x348]
xor eax, eax
call fcn.00403f9c
push dword [ebp - 0x348]
push 0x435e60
push 0x435e94
lea eax, [ebp - 0x344]
mov edx, 4
call fcn.00406248
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
mov edx, 0x435eb4
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
lea eax, [ebp - 0x2e0]
call fcn.004044d0
call fcn.00403d30
lea eax, [ebp - 0x334]
xor ecx, ecx
mov edx, 0x44
call fcn.00404528
mov dword [ebp - 0x308], 1
mov word [ebp - 0x304], 0
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405ffc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x435dc9
mov eax, dword [ebp - 0x2ec]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x2f0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435df6
lea eax, [ebp - 0x348]
mov edx, 5
call fcn.00405b14
lea eax, [ebp - 4]
call fcn.00405ab4
ret
Function at 0x436064
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x436154
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x443ee8]
call fcn.00405ffc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00406054
mov eax, dword [ebp - 8]
mov edx, 0x40
call fcn.00414e48
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x436132
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
mov eax, ecx
sub eax, 0x13f
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00414f5c
mov edx, 0x443f00
mov ecx, 0x13f
mov eax, dword [ebp - 4]
call fcn.00414f04
cmp byte [0x44403c], 0
je 0x43610b
lea edx, [ebp - 0xc]
mov eax, dword [0x443ee8]
call fcn.004152b8
mov edx, dword [ebp - 0xc]
mov eax, 0x443ef4
mov ecx, 0x43616c
call fcn.004061c0
jmp 0x43611b
mov eax, 0x443ef4
mov edx, dword [0x443ee8]
call fcn.00405d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436139
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428004]
jne 0x40100a
repz ret
jmp fcn.0040190d

Function at 0x409e3b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402636
and dword [ebp - 4], 0
cmp dword [0x42e1d4], 0
mov ebx, eax
jne 0x409eec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409f9d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409f9d
push eax
call fcn.004025c4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42e1d4], eax
call esi
push eax
call fcn.004025c4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42e1d8], eax
call esi
push eax
call fcn.004025c4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42e1dc], eax
call esi
push eax
call fcn.004025c4
pop ecx
mov dword [0x42e1e4], eax
test eax, eax
je 0x409eec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025c4
pop ecx
mov dword [0x42e1e0], eax
mov eax, dword [0x42e1e0]
cmp eax, ebx
je 0x409f44
cmp dword [0x42e1e4], ebx
je 0x409f44
push eax
call fcn.0040263f
push dword [0x42e1e4]
mov esi, eax
call fcn.0040263f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409f44
test edi, edi
je 0x409f44
call esi
test eax, eax
je 0x409f3b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409f3b
test byte [ebp - 0xc], 1
jne 0x409f44
or dword [ebp + 0x10], 0x200000
jmp 0x409f7d
mov eax, dword [0x42e1d8]
cmp eax, ebx
je 0x409f7d
push eax
call fcn.0040263f
pop ecx
test eax, eax
je 0x409f7d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409f7d
mov eax, dword [0x42e1dc]
cmp eax, ebx
je 0x409f7d
push eax
call fcn.0040263f
pop ecx
test eax, eax
je 0x409f7d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42e1d4]
call fcn.0040263f
pop ecx
test eax, eax
je 0x409f9d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409f9f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000186f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000188e
xor eax, eax
jmp 0x10001909
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100018a4
xor eax, eax
jmp 0x10001909
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x100018ec
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jae 0x100018ec
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
jmp 0x100018c5
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jb 0x100018f8
xor eax, eax
jmp 0x10001909
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x10001906
xor eax, eax
jmp 0x10001909
mov eax, dword [ebp - 4]
leave
ret

Function at 0x10002092
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x73
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x63
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x6f
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x6d
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x73
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x70
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x6d
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x61
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x2e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xb
jae 0x10002119
jmp 0x1000211e
call fcn.1000814a
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x6f
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002aaa
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret

Function at 0x100063f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x6970
push eax
mov dword [ebp - 0xb], 0x6c6c64
mov word [ebp - 0xd], 0x2e32
mov dword [ebp - 0x14], 0x61766441
mov byte [ebp - 0xe], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret
Function at 0x10006438
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x6c65
push eax
mov dword [ebp - 0xd], 0x6c642e32
mov byte [ebp - 0xe], 0x33
mov word [ebp - 9], 0x6c
mov dword [ebp - 0x14], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret

Function at 0x1000647c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c6c642e
push eax
mov dword [ebp - 0xd], 0x69706177
mov word [ebp - 0xf], 0x6c68
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret

Function at 0x100064be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x6c642e6e
push eax
mov dword [ebp - 0xe], 0x6f697372
mov word [ebp - 0x10], 0x6556
mov word [ebp - 6], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret

Function at 0x100064fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
call fcn.100063f4
mov esi, eax
test esi, esi
je 0x1000658f
lea eax, [esp + 0x14]
mov word [esp + 0x17], 0x7470
push eax
push esi
mov dword [esp + 0x2b], 0x74786574
mov dword [esp + 0x25], 0x43657269
mov dword [esp + 0x21], 0x75716341
mov word [esp + 0x29], 0x6e6f
mov word [esp + 0x1c], 0x7243
mov byte [esp + 0x1e], 0x79
mov word [esp + 0x2f], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006588
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x18]
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x20
ret
Function at 0x100065a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100063f4
mov esi, eax
test esi, esi
je 0x10006614
lea eax, [ebp - 0x14]
mov word [ebp - 9], 0x4b79
push eax
push esi
mov word [ebp - 0x14], 0x7243
mov word [ebp - 0xe], 0x7365
mov word [ebp - 0x11], 0x7470
mov word [ebp - 0xc], 0x7274
mov word [ebp - 6], 0x79
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 7], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000660d
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10007e30
leave
ret

Function at 0x10006624
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x34]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x38]
call fcn.100063f4
mov esi, eax
test esi, esi
je 0x100066a2
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x636e4574
push eax
push esi
mov word [esp + 0x19], 0x7972
mov dword [esp + 0x21], 0x747079
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x1b], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000669b
push dword [esp + 0x40]
push ebp
push edi
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x14
ret

Function at 0x100066b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x34]
call fcn.100063f4
mov esi, eax
test esi, esi
je 0x1000673b
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x5079654b
push eax
push esi
mov word [esp + 0x1c], 0x4774
mov dword [esp + 0x25], 0x6d6172
mov word [esp + 0x19], 0x7972
mov byte [esp + 0x1b], 0x70
mov word [esp + 0x1e], 0x7465
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x24], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006734
push dword [esp + 0x3c]
push ebp
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x18
ret
Function at 0x10006750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x34]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
call fcn.100063f4
mov esi, eax
test esi, esi
je 0x100067c8
lea eax, [esp + 0x10]
mov dword [esp + 0x16], 0x726f706d
push eax
push esi
mov dword [esp + 0x23], 0x79654b
mov dword [esp + 0x1a], 0x49747079
mov word [esp + 0x18], 0x7243
mov byte [esp + 0x22], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100067c1
push ebp
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push dword [esp + 0x3c]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x14
ret

Function at 0x100067dd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100063f4
mov esi, eax
test esi, esi
je 0x10006857
lea eax, [ebp - 0x18]
mov word [ebp - 0xf], 0x7361
push eax
push esi
mov dword [ebp - 0x16], 0x52747079
mov word [ebp - 9], 0x6574
mov word [ebp - 0x18], 0x7243
mov word [ebp - 6], 0x74
mov word [ebp - 0xc], 0x6f43
mov word [ebp - 0x12], 0x6c65
mov byte [ebp - 7], 0x78
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x10], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006850
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10007e30
leave
ret

Function at 0x10006867
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
call fcn.100063f4
mov esi, eax
test esi, esi
je 0x100068cd
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0x6d617261
push eax
push esi
mov dword [ebp - 0x14], 0x74655374
mov dword [ebp - 0x18], 0x70797243
mov dword [ebp - 0x10], 0x5079654b
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100068c6
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007e30
leave
ret
Function at 0x100068de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
call fcn.100064be
mov esi, eax
test esi, esi
je 0x10006961
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0x416f66
push eax
push esi
mov dword [esp + 0x1e], 0x72655665
mov word [esp + 0x22], 0x6973
mov dword [esp + 0x18], 0x46746547
mov word [esp + 0x25], 0x496e
mov word [esp + 0x1c], 0x6c69
mov byte [esp + 0x24], 0x6f
mov byte [esp + 0x27], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000695a
push ebp
push dword [esp + 0x38]
push dword [esp + 0x38]
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x18
ret

Function at 0x10006976
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x30]
call fcn.100064be
mov esi, eax
test esi, esi
je 0x10006a02
lea eax, [esp + 0x10]
mov dword [esp + 0x21], 0x7a69536f
push eax
push esi
mov word [esp + 0x1b], 0x6946
mov dword [esp + 0x1d], 0x6556656c
mov word [esp + 0x18], 0x6547
mov dword [esp + 0x22], 0x6e6f6973
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x1a], 0x74
mov word [esp + 0x26], 0x6e49
mov word [esp + 0x2e], 0x41
mov byte [esp + 0x28], 0x66
mov byte [esp + 0x2d], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100069fb
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x1c
ret

Function at 0x10006a17
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4c746547
xor ebx, ebx
mov dword [ebp - 0xc], 0x726f7272
push eax
mov dword [ebp - 0x10], 0x45747361
mov byte [ebp - 8], bl
call fcn.10006438
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006a5a
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10007e30
leave
ret
Function at 0x10006a69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0x10], 0x61636f4c
mov dword [ebp - 0xb], 0x6f6c6c41
mov word [ebp - 7], 0x63
mov byte [ebp - 0xc], 0x6c
call fcn.10006438
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006ab6
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007e30
leave
ret

Function at 0x10006ac7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0xe], 0x6163
mov word [ebp - 0xb], 0x7246
mov word [ebp - 0x10], 0x6f4c
mov byte [ebp - 0xc], 0x6c
mov word [ebp - 8], 0x65
mov byte [ebp - 9], 0x65
call fcn.10006438
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006b14
push esi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10007e30
leave
ret

Function at 0x10006bac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], eax
inc edi
call fcn.100063f4
mov esi, eax
test esi, esi
je 0x10006c2d
lea eax, [esp + 0x14]
mov dword [esp + 0x1e], 0x417845
push eax
push esi
mov word [esp + 0x20], 0x6570
mov word [esp + 0x1d], 0x6765
mov byte [esp + 0x1c], 0x52
mov dword [esp + 0x22], 0x79654b6e
mov byte [esp + 0x1f], 0x4f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006c26
push dword [esp + 0x10]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push ebp
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x18
ret
Function at 0x10006c42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
push esi
push edi
mov dword [esp + 0x14], eax
xor edi, edi
mov eax, dword [esp + 0x48]
inc edi
mov dword [esp + 0x10], eax
call fcn.1000647c
mov esi, eax
test esi, esi
je 0x10006cde
lea eax, [esp + 0x20]
mov word [esp + 0x21], 0x4748
push eax
push esi
mov dword [esp + 0x2e], 0x65756c61
mov word [esp + 0x2c], 0x5674
mov byte [esp + 0x28], 0x53
mov word [esp + 0x32], 0x41
mov byte [esp + 0x2b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006cd7
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebp
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x20
ret

Function at 0x10006cf3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1009700c]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
push esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x10], eax
call fcn.100064be
mov esi, eax
test esi, esi
je 0x10006d72
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 0x79726575
push eax
push esi
mov dword [esp + 0x28], 0x756c6156
mov dword [esp + 0x20], 0x51726556
mov word [esp + 0x2c], 0x4165
mov byte [esp + 0x2e], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10006d6b
push dword [esp + 0x10]
push dword [esp + 0x18]
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007e30
add esp, 0x1c
ret