joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100016d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
xor ebx, ebx
cmp dword [0x1003857c], ebx
je 0x100016fe
mov eax, dword [0x10038580]
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1001a846
add esp, 0x24
ret
cmp dword [0x10038584], ebx
jne 0x100017a8
mov al, 0x73
mov cl, 0x65
mov byte [esp + 0x15], al
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
lea eax, [esp + 0x14]
mov byte [esp + 9], cl
mov byte [esp + 0xc], cl
mov byte [esp + 0x1f], cl
mov dl, 0x6f
push eax
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x10], 0x6b
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x13], 0x6e
mov byte [esp + 0x15], 0x6c
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], bl
mov byte [esp + 0x1c], 0x49
mov byte [esp + 0x1e], 0x57
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], 0x77
mov byte [esp + 0x21], 0x36
mov byte [esp + 0x22], 0x34
mov byte [esp + 0x23], 0x50
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x63
mov byte [esp + 0x2a], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x10038584], eax
jne 0x100017a8
mov dword [0x10038580], ebx
xor eax, eax
jmp 0x100017c7
lea edx, [esp + 4]
push edx
mov dword [esp + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10038584]
mov eax, dword [esp + 4]
mov dword [0x10038580], eax
mov ecx, dword [esp + 0x24]
pop ebx
xor ecx, esp
mov dword [0x1003857c], 1
call fcn.1001a846
add esp, 0x24
ret

Function at 0x100017f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x10038594]
test eax, eax
jne 0x100018c2
mov cl, 0x65
mov al, 0x72
mov byte [esp + 1], cl
mov byte [esp + 4], cl
mov dl, 0x6c
mov byte [esp + 0x13], cl
mov byte [esp + 0x15], cl
mov cl, 0x74
mov byte [esp + 2], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
lea eax, [esp + 0x10]
mov byte [esp + 0x16], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 5], dl
mov byte [esp + 0xa], dl
mov byte [esp + 0xb], dl
mov dl, 0x73
push eax
lea ecx, [esp + 4]
push ecx
mov byte [esp + 8], 0x6b
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xe], 0x33
mov byte [esp + 0xf], 0x32
mov byte [esp + 0x10], 0x2e
mov byte [esp + 0x11], 0x64
mov byte [esp + 0x14], 0
mov byte [esp + 0x18], 0x42
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1f], 0x4c
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x4e
mov byte [esp + 0x24], 0x54
mov byte [esp + 0x25], 0x45
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10038594], eax
mov edx, dword [esp + 0x2c]
push edx
call eax
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1001a846
add esp, 0x28
ret 4
Function at 0x100018e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [0x10038598]
test eax, eax
push esi
mov esi, dword [esp + 0x34]
jne 0x100019ca
mov al, 0x6c
mov cl, 0x64
mov byte [esp + 6], cl
mov byte [esp + 0xa], cl
mov cl, 0x75
mov byte [esp + 7], al
mov byte [esp + 8], al
mov byte [esp + 0xb], al
mov byte [esp + 0xc], al
mov byte [esp + 0x12], al
mov byte [esp + 0x14], al
mov al, 0x65
mov byte [esp + 0x15], cl
mov byte [esp + 0x1b], cl
mov dl, 0x74
mov cl, 0x72
mov byte [esp + 0x19], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x28], al
lea eax, [esp + 0x10]
mov byte [esp + 0x1c], cl
mov byte [esp + 0x22], cl
mov byte [esp + 5], dl
mov byte [esp + 0x11], dl
mov dl, 0x63
push eax
lea ecx, [esp + 8]
push ecx
mov byte [esp + 0xc], 0x6e
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x1b], 0x46
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], 0x68
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x22], dl
mov byte [esp + 0x26], 0x4d
mov byte [esp + 0x28], 0x6d
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2b], 0x79
mov byte [esp + 0x2c], 0x43
mov byte [esp + 0x2d], 0x61
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0x68
mov byte [esp + 0x31], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10038598], eax
mov edx, dword [esp + 0x38]
push edx
push esi
call eax
mov ecx, dword [esp + 0x2c]
pop esi
xor ecx, esp
call fcn.1001a846
add esp, 0x2c
ret 8

Function at 0x100019f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x1003859c]
test eax, eax
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
jne 0x10001ac4
mov al, 0x6c
mov byte [esp + 0xb], al
mov byte [esp + 0xc], al
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x16], al
mov al, 0x69
mov cl, 0x74
mov byte [esp + 0x19], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x25], al
mov dl, 0x6e
lea eax, [esp + 0x14]
mov byte [esp + 9], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x23], cl
push eax
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x10], dl
mov byte [esp + 0x12], 0x64
mov byte [esp + 0x15], 0x2e
mov byte [esp + 0x16], 0x64
mov byte [esp + 0x19], 0
mov byte [esp + 0x1c], 0x52
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], dl
mov byte [esp + 0x23], 0x55
mov byte [esp + 0x24], dl
mov byte [esp + 0x26], 0x63
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], 0x53
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0x67
mov byte [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003859c], eax
push edi
push esi
call eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.1001a846
add esp, 0x28
ret 8
Function at 0x10001ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x50
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x4c], eax
cmp dword [0x100385a0], 0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
push ebp
mov ebp, dword [esp + 0x58]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
jne 0x10001cb2
push ebx
mov al, 0x74
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov cl, 0x73
push edi
mov bl, 0x65
mov byte [esp + 0x49], al
mov byte [esp + 0x4f], al
mov byte [esp + 0x51], al
mov byte [esp + 0x52], al
mov byte [esp + 0x57], al
lea eax, [esp + 0x40]
mov dl, 0x62
mov byte [esp + 0x24], cl
mov byte [esp + 0x42], cl
mov byte [esp + 0x59], cl
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x24], 0x6b
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x2e
mov byte [esp + 0x2f], 0x64
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0
mov byte [esp + 0x48], 0x42
mov byte [esp + 0x49], 0x61
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], 0x46
mov byte [esp + 0x4d], 0x6f
mov byte [esp + 0x4e], 0x72
mov byte [esp + 0x4f], 0x6d
mov byte [esp + 0x50], 0x61
mov byte [esp + 0x52], 0x4f
mov byte [esp + 0x53], dl
mov byte [esp + 0x54], 0x6a
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], 0x63
mov byte [esp + 0x58], 0x41
mov byte [esp + 0x5b], 0x72
mov byte [esp + 0x5c], 0x69
mov byte [esp + 0x5d], dl
mov byte [esp + 0x5e], 0x75
mov byte [esp + 0x60], bl
mov byte [esp + 0x62], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
mov dword [0x100385a0], eax
jne 0x10001caf
lea edx, [esp + 0x2c]
mov byte [esp + 0x3c], al
push edx
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x34], 0x4f
mov byte [esp + 0x35], 0x70
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x46
mov byte [esp + 0x39], 0x69
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x4d
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x3e], 0x70
mov byte [esp + 0x3f], 0x70
mov byte [esp + 0x40], 0x69
mov byte [esp + 0x41], 0x6e
mov byte [esp + 0x42], 0x67
mov byte [esp + 0x43], 0x57
call esi
push eax
call edi
xor ecx, ecx
mov dl, 0x15
cmp byte [ecx + eax], 0xff
jne 0x10001c7d
cmp byte [ecx + eax + 1], dl
je 0x10001c87
add ecx, 1
cmp ecx, 0x70
jl 0x10001c71
jmp 0x10001caf
add eax, ecx
xor ecx, ecx
jmp 0x10001c90
cmp byte [ecx + eax], 0xe8
je 0x10001ca0
add ecx, 1
cmp ecx, 0x70
jl 0x10001c90
jmp 0x10001caf
mov edx, dword [ecx + eax + 1]
add edx, ecx
lea eax, [edx + eax + 5]
mov dword [0x100385a0], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ecx
push edx
push eax
push ebp
call dword [0x100385a0]
mov ecx, dword [esp + 0x50]
pop ebp
xor ecx, esp
call fcn.1001a846
add esp, 0x50
ret 0x10
Function at 0x10001ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x100385ac]
test eax, eax
jne 0x10001dba
mov al, 0x6c
mov cl, 0x74
mov byte [esp + 0xd], cl
mov byte [esp + 0x14], cl
mov byte [esp + 0x19], cl
mov byte [esp + 1], cl
mov cl, 0x64
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x1c], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 7], al
mov byte [esp + 8], al
lea eax, [esp + 0xc]
mov byte [esp + 2], cl
mov byte [esp + 6], cl
mov dl, 0x72
push eax
lea ecx, [esp + 4]
push ecx
mov byte [esp + 0x14], 0x4e
mov byte [esp + 0x16], 0x41
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x63
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x56
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], dl
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x25], 0x4d
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x6d
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x79
mov byte [esp + 0x2b], 0
mov byte [esp + 8], 0x6e
mov byte [esp + 0xd], 0x2e
mov byte [esp + 0x11], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100385ac], eax
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push ebx
push edx
push edi
push esi
call eax
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1001a846
add esp, 0x28
ret 0xc
Function at 0x10001f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [0x100385a8]
test eax, eax
push ebp
mov ebp, dword [esp + 0x3c]
push esi
jne 0x100020b8
mov al, 0x6c
mov cl, 0x74
mov byte [esp + 0x15], cl
mov byte [esp + 0x1c], cl
mov byte [esp + 0x21], cl
mov byte [esp + 9], cl
mov cl, 0x64
mov byte [esp + 0x17], al
mov byte [esp + 0x18], al
mov byte [esp + 0x24], al
mov byte [esp + 0xb], al
mov byte [esp + 0xc], al
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
lea eax, [esp + 0x14]
mov byte [esp + 0xa], cl
mov byte [esp + 0xe], cl
mov dl, 0x72
push eax
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x1c], 0x4e
mov byte [esp + 0x1e], 0x41
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x56
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], dl
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2d], 0x4d
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x6d
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x31], dl
mov byte [esp + 0x32], 0x79
mov byte [esp + 0x33], 0
mov byte [esp + 0x10], 0x6e
mov byte [esp + 0x15], 0x2e
mov byte [esp + 0x19], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
mov esi, eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1001a560
add esp, 0x10
test eax, eax
je 0x100020af
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x41], 0x68
mov dword [esp + 0x42], esi
mov byte [esp + 0x46], 0xc3
call fcn.10001de0
test eax, eax
mov dword [0x100385a8], eax
je 0x100020e3
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov cx, word [esp + 0x34]
mov word [eax + 8], cx
mov dl, byte [esp + 0x36]
mov byte [eax + 0xa], dl
jmp 0x100020b4
mov eax, dword [0x100385a8]
test eax, eax
je 0x100020e3
test edi, edi
je 0x100020e3
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push ebx
push ecx
push ebp
push edi
call eax
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1001a846
add esp, 0x34
ret 0x10
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.1001a846
add esp, 0x34
ret 0x10
Function at 0x10002260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
mov edi, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.100016d0
mov eax, dword [0x10038588]
test eax, eax
jne 0x100023db
mov al, 0x6c
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov al, 0x65
mov cl, 0x74
mov dl, 0x64
mov byte [esp + 0x2b], al
mov byte [esp + 0x30], al
lea eax, [esp + 0x24]
mov byte [esp + 0x19], cl
mov byte [esp + 0x25], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1e], dl
mov dl, 0x69
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x25], 0x2e
mov byte [esp + 0x29], 0
mov byte [esp + 0x2c], 0x4e
mov byte [esp + 0x2e], 0x4d
mov byte [esp + 0x2f], 0x61
mov byte [esp + 0x30], 0x70
mov byte [esp + 0x31], 0x56
mov byte [esp + 0x32], dl
mov byte [esp + 0x34], 0x77
mov byte [esp + 0x35], 0x4f
mov byte [esp + 0x36], 0x66
mov byte [esp + 0x37], 0x53
mov byte [esp + 0x39], 0x63
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3c], 0x6f
mov byte [esp + 0x3d], 0x6e
mov byte [esp + 0x3e], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
mov esi, eax
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x20]
push eax
push esi
call fcn.1001a560
add esp, 0x10
test eax, eax
je 0x100023bb
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x4d], 0x68
mov dword [esp + 0x4e], esi
mov byte [esp + 0x52], 0xc3
call fcn.10002170
test eax, eax
mov dword [0x10038588], eax
je 0x100023c4
mov ecx, dword [esp + 0x38]
mov dword [eax], ecx
mov edx, dword [esp + 0x3c]
mov eax, dword [0x10038588]
mov dword [eax + 4], edx
mov cx, word [esp + 0x40]
mov edx, dword [0x10038588]
mov word [edx + 8], cx
mov al, byte [esp + 0x42]
mov ecx, dword [0x10038588]
mov byte [ecx + 0xa], al
mov eax, dword [0x10038588]
test eax, eax
jne 0x100023db
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1001a846
add esp, 0x3c
ret 0x28
test edi, edi
je 0x100023c4
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
push edx
mov edx, dword [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x6c]
push edx
mov edx, dword [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push edi
push ecx
push ebp
call eax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1001a846
add esp, 0x3c
ret 0x28
Function at 0x10002420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
mov edi, dword [esp + 0x44]
call fcn.100016d0
mov eax, dword [0x1003858c]
test eax, eax
jne 0x1000258c
mov al, 0x6c
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
mov al, 0x65
mov cl, 0x74
mov byte [esp + 0x21], al
mov byte [esp + 0x26], al
lea eax, [esp + 0x18]
mov dl, 0x6e
mov byte [esp + 0xd], cl
mov byte [esp + 0x19], cl
mov byte [esp + 0x28], cl
push eax
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x14], dl
mov byte [esp + 0x16], 0x64
mov byte [esp + 0x19], 0x2e
mov byte [esp + 0x1a], 0x64
mov byte [esp + 0x1d], 0
mov byte [esp + 0x20], 0x4e
mov byte [esp + 0x22], 0x55
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x6d
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x70
mov byte [esp + 0x27], 0x56
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x2a], 0x77
mov byte [esp + 0x2b], 0x4f
mov byte [esp + 0x2c], 0x66
mov byte [esp + 0x2d], 0x53
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x32], 0x6f
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
mov esi, eax
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x14]
push eax
push esi
call fcn.1001a560
add esp, 0x10
test eax, eax
je 0x1000256c
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x45], 0x68
mov dword [esp + 0x46], esi
mov byte [esp + 0x4a], 0xc3
call fcn.10002170
test eax, eax
mov dword [0x1003858c], eax
je 0x10002575
mov ecx, dword [esp + 0x30]
mov dword [eax], ecx
mov edx, dword [esp + 0x34]
mov eax, dword [0x1003858c]
mov dword [eax + 4], edx
mov cx, word [esp + 0x38]
mov edx, dword [0x1003858c]
mov word [edx + 8], cx
mov al, byte [esp + 0x3a]
mov ecx, dword [0x1003858c]
mov byte [ecx + 0xa], al
mov eax, dword [0x1003858c]
test eax, eax
jne 0x1000258c
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1001a846
add esp, 0x34
ret 8
test edi, edi
je 0x10002575
push ebp
push edi
call eax
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1001a846
add esp, 0x34
ret 8
Function at 0x100025b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
mov edi, dword [esp + 0x3c]
call fcn.100016d0
mov eax, dword [0x10038590]
test eax, eax
jne 0x100026f9
mov al, 0x6c
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
mov al, 0x65
mov cl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
lea eax, [esp + 0x18]
mov dl, 0x6e
mov byte [esp + 0xd], cl
mov byte [esp + 0x19], cl
mov byte [esp + 0x21], cl
push eax
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x14], dl
mov byte [esp + 0x16], 0x64
mov byte [esp + 0x19], 0x2e
mov byte [esp + 0x1a], 0x64
mov byte [esp + 0x1d], 0
mov byte [esp + 0x20], 0x4e
mov byte [esp + 0x22], 0x4f
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x53
mov byte [esp + 0x28], 0x63
mov byte [esp + 0x2a], 0x69
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 5
mov esi, eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x14]
push eax
push esi
call fcn.1001a560
add esp, 0x10
test eax, eax
je 0x100026d9
push 0x40
push 0x3000
push 0xb
add esi, 5
push 0
mov byte [esp + 0x3d], 0x68
mov dword [esp + 0x3e], esi
mov byte [esp + 0x42], 0xc3
call fcn.10002170
test eax, eax
mov dword [0x10038590], eax
je 0x100026e2
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov edx, dword [esp + 0x2c]
mov eax, dword [0x10038590]
mov dword [eax + 4], edx
mov cx, word [esp + 0x30]
mov edx, dword [0x10038590]
mov word [edx + 8], cx
mov al, byte [esp + 0x32]
mov ecx, dword [0x10038590]
mov byte [ecx + 0xa], al
mov eax, dword [0x10038590]
test eax, eax
jne 0x100026f9
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1001a846
add esp, 0x2c
ret 0xc
test edi, edi
je 0x100026e2
mov edx, dword [esp + 0x40]
push ebp
push edx
push edi
call eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1001a846
add esp, 0x2c
ret 0xc
Function at 0x100027c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x10], eax
mov al, 0x78
mov byte [esp + 3], al
mov byte [esp + 7], al
mov al, 0x6c
push esi
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x10], al
mov byte [esp + 0x11], al
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 0x56
mov byte [esp + 9], 0x42
mov byte [esp + 0xa], 0x6f
mov byte [esp + 0xc], 0x52
mov byte [esp + 0xd], 0x54
mov byte [esp + 0xe], 0x2d
mov byte [esp + 0x10], 0x38
mov byte [esp + 0x11], 0x36
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000285a
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1001a846
add esp, 0x14
ret 0x14
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
push esi
call fcn.10002720
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.1001a846
add esp, 0x14
ret 0x14

Function at 0x10002890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10032644]
xor eax, esp
mov dword [esp + 0x10], eax
mov al, 0x78
mov byte [esp + 3], al
mov byte [esp + 7], al
mov al, 0x6c
push edi
mov edi, dword [esp + 0x1c]
mov byte [esp + 0x10], al
mov byte [esp + 0x11], al
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 0x56
mov byte [esp + 9], 0x42
mov byte [esp + 0xa], 0x6f
mov byte [esp + 0xc], 0x52
mov byte [esp + 0xd], 0x54
mov byte [esp + 0xe], 0x2d
mov byte [esp + 0x10], 0x38
mov byte [esp + 0x11], 0x36
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10002916
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1001a846
add esp, 0x14
ret 4
push esi
push edi
push 0xffffffffffffffff
call fcn.10002420
mov esi, eax
test esi, esi
jge 0x10002962
cmp esi, 0xc0000045
jne 0x10002947
push 0
push edi
call fcn.100018e0
test al, al
je 0x10002947
push edi
push 0xffffffffffffffff
call fcn.10002420
mov esi, eax
test esi, esi
jge 0x10002962
push esi
call fcn.100017f0
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1001a846
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x18]
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.1001a846
add esp, 0x14
ret 4