joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456be4
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456e31
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x228]
mov eax, 2
call fcn.00456b04
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x456e44
call fcn.00404774
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402db0
lea eax, [ebp - 0x1d0]
call fcn.00402b4c
mov edx, 0x456e5c
lea eax, [ebp - 0x1d0]
call fcn.00404b10
call fcn.004031e0
mov edx, 0x456e70
lea eax, [ebp - 0x1d0]
call fcn.00404b10
call fcn.004031e0
push 0x456e80
lea edx, [ebp - 0x230]
xor eax, eax
call fcn.00402a40
push dword [ebp - 0x230]
push 0x456e90
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.004047e8
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x1d0]
call fcn.00404b10
call fcn.004031e0
push 0x456e9c
lea edx, [ebp - 0x238]
xor eax, eax
call fcn.00402a40
push dword [ebp - 0x238]
push 0x456e90
push 0x456eb0
lea eax, [ebp - 0x234]
mov edx, 4
call fcn.004047e8
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 0x1d0]
call fcn.00404b10
call fcn.004031e0
mov edx, 0x456ec4
lea eax, [ebp - 0x1d0]
call fcn.00404b10
call fcn.004031e0
lea edx, [ebp - 0x244]
xor eax, eax
call fcn.00402a40
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.00408d00
mov ecx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
mov edx, 0x456ed4
call fcn.00404774
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 0x1d0]
call fcn.00404b10
call fcn.004031e0
mov edx, 0x456ee0
lea eax, [ebp - 0x1d0]
call fcn.00404b10
call fcn.004031e0
lea eax, [ebp - 0x1d0]
call fcn.00402e78
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00402fe0
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404920
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x456e0b
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456e38
lea eax, [ebp - 0x244]
mov edx, 8
call fcn.00404494
lea eax, [ebp - 4]
call fcn.00404470
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x4070bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d468
cmp edx, dword [eax]
je 0x4070df
add eax, 8
inc ecx
cmp eax, 0x40d4f8
jl 0x4070d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d468]
jne 0x40720d
mov eax, dword [0x40e498]
cmp eax, 1
je 0x4071e7
test eax, eax
jne 0x407110
cmp dword [0x40d39c], 1
je 0x4071e7
cmp edx, 0xfc
je 0x40720d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407147
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404340
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404190
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40718a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404190
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b5ec
push edi
call fcn.00408c50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404340
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404350
lea eax, [ebp - 0xa0]
push 0x40b5cc
push eax
call fcn.00404350
push dword [esi + 0x40d46c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404350
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408bc2
add esp, 0x2c
pop edi
jmp 0x40720d
lea eax, [ebp + 8]
lea esi, [esi + 0x40d46c]
push 0
push eax
push dword [esi]
call fcn.00404190
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x401031
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403220], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403224], eax
push 0xa
push dword [0x403224]
push 0
push dword [0x403220]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, dword [ebp + 0x10]
inc eax
mov dl, byte [eax]
cmp dl, 0x20
jne 0x401044
jmp 0x401046
jmp 0x40103a
inc eax
push eax
push 0x403123
call fcn.00401110
push 0xfa
push 0x403029
push 0xffffffffffffffff
push 0x403123
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov dword [0x403228], 0x44
mov dword [0x403254], 1
mov word [0x403258], 0
push 0x40326c
push 0x403228
push 0
push 0
push 0
push 0x403029
push 0
push 0
push 0x403025
push 0
push str.mima1
call sub.advapi32.dll_CreateProcessWithLogonW
push 0xffffffffffffffff
push dword [0x40326c]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x40326c]
call sub.kernel32.dll_CloseHandle
push dword [0x403270]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x10001000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
or eax, 0xffffffff
mov cl, byte [edx]
test cl, cl
je 0x100010a7
movzx ecx, cl
lea edx, [edx + 1]
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10001011
not eax
ret

Function at 0x100026e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
lea eax, [esp]
mov word [esp + 0x14], 0x6574
push eax
mov dword [esp + 0x29], 0x746f68
mov dword [esp + 0x1b], 0x686c6f6f
mov dword [esp + 0x14], 0x61657243
mov word [esp + 0x1f], 0x6c65
mov dword [esp + 0x25], 0x7370616e
mov byte [esp + 0x1a], 0x54
mov word [esp + 0x22], 0x3233
mov byte [esp + 0x24], 0x53
mov byte [esp + 0x21], 0x70
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000277b
push dword [esp + 0x34]
push dword [esp + 0x34]
call eax
add esp, 0x2c
ret
or eax, 0xffffffff
add esp, 0x2c
ret

Function at 0x10002790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
lea eax, [esp]
mov dword [esp + 0x11], 0x65636f72
push eax
mov dword [esp + 0x1e], 0x74737269
mov dword [esp + 0x19], 0x32337373
mov byte [esp + 0x14], 0x50
mov byte [esp + 0x22], 0
mov byte [esp + 0x1d], 0x46
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000280e
push dword [esp + 0x28]
push dword [esp + 0x28]
call eax
add esp, 0x20
ret
xor eax, eax
add esp, 0x20
ret
Function at 0x10002820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
lea eax, [esp]
mov word [esp + 0x16], 0x3373
push eax
mov word [esp + 0x17], 0x6563
mov dword [esp + 0x1e], 0x747865
mov word [esp + 0x1c], 0x4e32
mov byte [esp + 0x19], 0x73
mov word [esp + 0x14], 0x7250
mov byte [esp + 0x16], 0x6f
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100028a5
push dword [esp + 0x28]
push dword [esp + 0x28]
call eax
add esp, 0x20
ret
xor eax, eax
add esp, 0x20
ret

Function at 0x100028b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov word [esp], 0x7243
push eax
mov dword [esp + 0xc], 0x41656c
mov dword [esp + 7], 0x46657461
mov byte [esp + 6], 0x65
mov byte [esp + 0xb], 0x69
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000293b
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
call eax
add esp, 0x1c
ret
or eax, 0xffffffff
add esp, 0x1c
ret

Function at 0x10002950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov word [esp + 6], 0x5365
push eax
mov word [esp + 0xd], 0x657a
mov dword [esp + 4], 0x46746547
mov word [esp + 8], 0x6c69
mov byte [esp + 0xf], 0
mov byte [esp + 0xc], 0x69
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100029ce
push dword [esp + 0x24]
push dword [esp + 0x24]
call eax
add esp, 0x1c
ret
or eax, 0xffffffff
add esp, 0x1c
ret

Function at 0x100029e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov dword [esp], 0x6e65704f
push eax
mov dword [esp + 0xa], 0x7365636f
mov word [esp + 0xe], 0x73
mov word [esp + 8], 0x7250
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002a58
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret
Function at 0x10002a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov dword [esp + 5], 0x656c69
push eax
mov word [esp + 4], 0x6552
mov word [esp + 7], 0x4664
mov byte [esp + 6], 0x61
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002ade
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x10002af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov word [esp + 3], 0x6573
push eax
mov dword [esp + 0xa], 0x6c646e61
mov word [esp + 0xe], 0x65
mov word [esp + 4], 0x6c43
mov byte [esp + 9], 0x48
mov byte [esp + 6], 0x6f
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002b6a
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x10002b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
lea eax, [esp + 4]
mov dword [esp + 5], 0x6c6c6568
push edi
push eax
xor esi, esi
mov dword [esp + 0x12], 0x6c642e32
mov word [esp + 0x16], 0x6c
mov byte [esp + 0x11], 0x33
mov byte [esp + 0xc], 0x53
call fcn.100030c0
mov edi, eax
add esp, 4
test edi, edi
je 0x10002bf9
lea eax, [esp + 0x14]
mov dword [esp + 0x1e], 0x6e696d
push eax
push edi
mov word [esp + 0x23], 0x416e
mov word [esp + 0x20], 0x7265
mov byte [esp + 0x25], 0x64
mov word [esp + 0x1d], 0x5573
mov byte [esp + 0x1c], 0x49
mov byte [esp + 0x1f], 0x73
mov byte [esp + 0x22], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002bf0
call eax
mov esi, eax
push edi
call fcn.100031d0
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 0x1c
ret
Function at 0x10002c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
lea eax, [esp]
mov dword [esp + 0x12], 0x6e696d72
push eax
mov word [esp + 0x22], 0x7373
mov word [esp + 0x1c], 0x5065
mov word [esp + 0x1f], 0x636f
mov byte [esp + 0x24], 0
mov byte [esp + 0x1e], 0x72
mov word [esp + 0x1a], 0x7461
mov word [esp + 0x14], 0x6554
mov byte [esp + 0x21], 0x65
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002ca1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call eax
add esp, 0x24
ret
xor eax, eax
add esp, 0x24
ret

Function at 0x10002cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov word [esp + 3], 0x6372
push eax
mov word [esp + 0xc], 0x41
mov word [esp + 4], 0x736c
mov byte [esp + 6], 0x74
mov word [esp + 9], 0x7970
mov byte [esp + 0xb], 0x6e
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002d31
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x10002d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov dword [esp + 2], 0x70637274
push eax
mov word [esp + 0xb], 0x41
mov word [esp + 4], 0x736c
mov byte [esp + 0xa], 0x79
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002db2
push dword [esp + 0x24]
push dword [esp + 0x24]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x10002dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov dword [esp + 6], 0x656c69
push eax
mov dword [esp + 4], 0x74697257
mov word [esp + 8], 0x4665
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002e3a
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret
Function at 0x10002e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov dword [esp + 5], 0x4169706d
push eax
mov dword [esp + 5], 0x63727473
mov byte [esp + 0xd], 0
mov byte [esp + 4], 0x6c
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002eb1
push dword [esp + 0x24]
push dword [esp + 0x24]
call eax
add esp, 0x1c
ret
or eax, 0xffffffff
add esp, 0x1c
ret

Function at 0x10002ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov word [esp + 0xa], 0x63
push eax
mov dword [esp + 9], 0x6c6c416c
mov dword [esp + 5], 0x61626f6c
mov byte [esp + 0xd], 0x6f
mov byte [esp + 4], 0x47
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002f38
push dword [esp + 0x24]
push dword [esp + 0x24]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x10002f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov word [esp + 9], 0x65
push eax
mov word [esp + 7], 0x6162
mov word [esp + 0xa], 0x7246
mov byte [esp + 0xc], 0x65
mov word [esp + 4], 0x6c47
mov byte [esp + 9], 0x6c
mov byte [esp + 6], 0x6f
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002fbe
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
mov eax, dword [esp + 0x20]
add esp, 0x1c
ret

Function at 0x10002fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
mov dword [esp + 2], 0x706565
push eax
mov word [esp + 4], 0x6c53
mov dword [esp + 0x12], 0x642e3233
mov word [esp + 0x16], 0x6c6c
mov byte [esp + 0x18], 0
mov word [esp + 0xd], 0x7265
mov word [esp + 0x10], 0x6c65
mov byte [esp + 0xc], 0x4b
mov byte [esp + 0xf], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000302e
push dword [esp + 0x1c]
call eax
add esp, 0x18
ret
Function at 0x10003040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
lea eax, [esp]
mov word [esp + 0x1a], 0x746e
push eax
mov dword [esp + 0x15], 0x69547465
mov dword [esp + 0x19], 0x6f436b63
mov byte [esp + 0x1d], 0x75
mov byte [esp + 0x20], 0
mov byte [esp + 0x14], 0x47
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100030b5
call eax
add esp, 0x20
ret
xor eax, eax
add esp, 0x20
ret

Function at 0x100030c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
lea eax, [esp]
mov dword [esp + 0x11], 0x4c64616f
push eax
mov dword [esp + 0x1d], 0x417972
mov dword [esp + 0x19], 0x61726269
mov byte [esp + 0x14], 0x4c
mov dword [esp + 0xa], 0x642e3233
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0x10], 0
mov word [esp + 5], 0x7265
mov word [esp + 8], 0x6c65
mov byte [esp + 4], 0x4b
mov byte [esp + 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003130
push dword [esp + 0x24]
call eax
add esp, 0x20
ret
xor eax, eax
add esp, 0x20
ret

Function at 0x10003140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 0x10]
mov word [esp + 0x13], 0x6177
push edi
push eax
xor esi, esi
mov word [esp + 0x20], 0x6c64
mov word [esp + 0x18], 0x6853
mov word [esp + 0x1d], 0x6970
mov word [esp + 0x22], 0x6c
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1f], 0x2e
call fcn.100030c0
mov edi, eax
add esp, 4
test edi, edi
je 0x100031c8
lea eax, [esp + 8]
mov dword [esp + 0xb], 0x6e496f54
push eax
push edi
mov word [esp + 0x17], 0x4174
mov word [esp + 0x11], 0x7274
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x19], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100031bf
push dword [esp + 0x24]
call eax
mov esi, eax
push edi
call fcn.100031d0
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret

Function at 0x100031d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
mov word [esp], 0x7246
push eax
mov dword [esp + 0xb], 0x79726172
mov byte [esp + 0xf], 0
mov dword [esp + 7], 0x62694c65
mov byte [esp + 6], 0x65
mov dword [esp + 0x16], 0x642e3233
mov word [esp + 0x1a], 0x6c6c
mov byte [esp + 0x1c], 0
mov word [esp + 0x11], 0x7265
mov word [esp + 0x14], 0x6c65
mov byte [esp + 0x10], 0x4b
mov byte [esp + 0x13], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003243
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret