joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 3], 0x74
mov dword [ebp - 0xc], 0x65736552
mov dword [ebp - 8], 0x65764574
mov byte [ebp - 4], 0x6e
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f2fb
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 8], 0x64496e6f
mov dword [ebp - 0xe], 0x73655365
mov word [ebp - 0x13], 0x6e6f
mov dword [ebp - 0x1e], 0x74654753
mov word [ebp - 0x20], 0x5457
mov dword [ebp - 0x1a], 0x69746341
mov word [ebp - 0x10], 0x6c6f
mov word [ebp - 0x16], 0x6576
mov byte [ebp - 4], 0
mov word [ebp - 0xa], 0x6973
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x11], 0x73
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f3c6
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x646e6946
mov dword [ebp - 6], 0x57656c
mov dword [ebp - 0xb], 0x46747865
mov byte [ebp - 0xc], 0x4e
mov byte [ebp - 7], 0x69
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f443
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
call fcn.1000ea70
mov esi, eax
test esi, esi
je 0x1000f4b4
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x10], 0x57746553
mov dword [ebp - 0xb], 0x776f646e
mov byte [ebp - 0xc], 0x69
mov word [ebp - 6], 0x736f
mov byte [ebp - 4], 0
mov byte [ebp - 7], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f4ad
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f4c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xf], 0x74616572
mov dword [ebp - 0xa], 0x6574754d
mov word [ebp - 6], 0x5778
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 4], 0
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f509
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000f510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0xa], 0x6854
mov word [ebp - 5], 0x64
mov word [ebp - 0xd], 0x7461
mov byte [ebp - 0xb], 0x65
mov word [ebp - 8], 0x6572
mov word [ebp - 0x10], 0x7243
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 6], 0x61
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f56c
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 8], 0x746f6873
mov word [ebp - 0xb], 0x616e
mov word [ebp - 0x11], 0x6c65
mov word [ebp - 0x1b], 0x6572
mov word [ebp - 0x18], 0x6574
mov dword [ebp - 0x15], 0x686c6f6f
mov word [ebp - 0xe], 0x3233
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 4], 0
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 9], 0x70
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f5ee
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000f600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 9], 0x3233
mov dword [ebp - 0xe], 0x7365636f
mov dword [ebp - 4], 0x577473
mov word [ebp - 6], 0x7269
mov word [ebp - 0x10], 0x7250
mov byte [ebp - 7], 0x46
mov byte [ebp - 0xa], 0x73
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f64e
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x636f7250
mov dword [ebp - 5], 0x577478
mov word [ebp - 0xc], 0x7365
mov dword [ebp - 9], 0x654e3233
mov byte [ebp - 0xa], 0x73
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f6a5
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 0xa], 0x7463
mov word [ebp - 0xd], 0x7269
mov dword [ebp - 8], 0x5779726f
mov word [ebp - 0x13], 0x6d65
mov byte [ebp - 4], 0
mov word [ebp - 0x10], 0x6576
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 0xe], 0x44
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f706
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000f710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 4], 0x5765
mov word [ebp - 0xa], 0x7372
mov word [ebp - 7], 0x6946
mov word [ebp - 0xd], 0x4664
mov word [ebp - 0x10], 0x6946
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 8], 0x74
mov byte [ebp - 2], 0
mov byte [ebp - 5], 0x6c
mov byte [ebp - 0xe], 0x6e
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f768
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000f770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 5], 0x657a6953
mov dword [ebp - 0xb], 0x69467465
mov word [ebp - 7], 0x656c
mov byte [ebp - 0xc], 0x47
mov byte [ebp - 1], 0
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f7b2
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000f7c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 5], 0x73736563
mov dword [ebp - 0xa], 0x72506e65
mov word [ebp - 0xc], 0x704f
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x6f
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f805
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 9], 0x636f
mov word [ebp - 6], 0x7373
mov dword [ebp - 0x13], 0x696d7265
mov dword [ebp - 0xd], 0x72506574
mov byte [ebp - 7], 0x65
mov word [ebp - 0xf], 0x616e
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 4], 0
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f862
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], 0x43746978
mov dword [ebp - 5], 0x737365
mov dword [ebp - 0xa], 0x6f725065
mov dword [ebp - 0x14], 0x45746547
mov word [ebp - 0xc], 0x646f
mov byte [ebp - 6], 0x63
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f8bc
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000f8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
lea eax, [ebp - 0x38]
push eax
xor edi, edi
mov word [ebp - 0x2a], 0x616d
mov word [ebp - 0x2d], 0x7373
mov dword [ebp - 0x20], 0x57656d
mov word [ebp - 0x23], 0x4e65
mov dword [ebp - 0x34], 0x72507465
mov dword [ebp - 0x28], 0x69466567
mov dword [ebp - 0x38], 0x4732334b
mov byte [ebp - 0x24], 0x6c
mov word [ebp - 0x30], 0x636f
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2b], 0x49
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f941
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
call fcn.1000eac0
mov esi, eax
test esi, esi
je 0x1000f9b6
lea eax, [ebp - 0x1c]
push eax
push esi
mov dword [ebp - 0x17], 0x7365636f
mov word [ebp - 0xc], 0x6c69
mov word [ebp - 0xf], 0x6567
mov dword [ebp - 8], 0x57656d61
mov word [ebp - 0x1c], 0x6547
mov word [ebp - 0xa], 0x4e65
mov word [ebp - 0x12], 0x6d49
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x10], 0x61
mov word [ebp - 0x19], 0x7250
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 4], 0
mov byte [ebp - 0xd], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f9af
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000f9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 5], 0x656c
mov word [ebp - 8], 0x4665
mov word [ebp - 0xb], 0x6972
mov byte [ebp - 3], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 9], 0x74
mov byte [ebp - 0xc], 0x57
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fa11
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fa20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x15], 0x6d695465
mov word [ebp - 0xd], 0x7379
mov word [ebp - 0x10], 0x6f54
mov byte [ebp - 0x11], 0x65
mov dword [ebp - 9], 0x6d69546d
mov word [ebp - 0x17], 0x6c69
mov word [ebp - 5], 0x65
mov byte [ebp - 0xe], 0x53
mov word [ebp - 0xb], 0x6574
mov byte [ebp - 0x18], 0x46
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fa7e
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000fa90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 6], 0x57747372
mov word [ebp - 0xc], 0x656c
mov dword [ebp - 0xa], 0x69463233
mov word [ebp - 0xf], 0x646f
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xd], 0x75
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fadc
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000faf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0xb], 0x3365
mov dword [ebp - 8], 0x7478654e
mov dword [ebp - 0x10], 0x75646f4d
mov byte [ebp - 9], 0x32
mov byte [ebp - 0xc], 0x6c
mov word [ebp - 4], 0x57
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fb38
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fb40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 7], 0x6974
mov dword [ebp - 4], 0x657479
mov dword [ebp - 0x12], 0x68436564
mov dword [ebp - 0xc], 0x754d6f54
mov word [ebp - 0xe], 0x7261
mov byte [ebp - 5], 0x42
mov word [ebp - 0x14], 0x6957
mov byte [ebp - 8], 0x6c
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fba7
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fbb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x6e65704f
mov word [ebp - 3], 0x57
mov dword [ebp - 8], 0x6574754d
mov byte [ebp - 4], 0x78
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fbf1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fc00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, 1
call fcn.1000e9d0
mov edi, eax
test edi, edi
je 0x1000fc5b
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0xc], 0x6f724644
mov dword [ebp - 0x10], 0x49534c43
mov dword [ebp - 7], 0x69727453
mov word [ebp - 3], 0x676e
mov byte [ebp - 8], 0x6d
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fc54
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000fc70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, 1
call fcn.1000e9d0
mov edi, eax
test edi, edi
je 0x1000fcca
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 6], 0x676e69
mov word [ebp - 0xc], 0x6f72
mov word [ebp - 9], 0x7453
mov byte [ebp - 7], 0x72
mov byte [ebp - 0xa], 0x6d
mov dword [ebp - 0x10], 0x46444949
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fcc3
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000fce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x15], 0x726f4674
mov word [ebp - 6], 0x6365
mov dword [ebp - 0x11], 0x746c754d
mov word [ebp - 0x17], 0x6961
mov word [ebp - 0xa], 0x4f65
mov word [ebp - 0xd], 0x7069
mov word [ebp - 3], 0x73
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 4], 0x74
mov word [ebp - 8], 0x6a62
mov byte [ebp - 0xb], 0x6c
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fd4a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000fd60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 5], 0x6565
mov dword [ebp - 0xa], 0x466c6163
mov byte [ebp - 3], 0
mov word [ebp - 0xc], 0x6f4c
mov byte [ebp - 6], 0x72
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fd9e
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x1000fdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xa], 0x72724574
mov word [ebp - 0xf], 0x7465
mov word [ebp - 0xc], 0x7361
mov word [ebp - 6], 0x726f
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xd], 0x4c
mov byte [ebp - 4], 0
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fdf5
call eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1000fe00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 7], 0x577972
mov dword [ebp - 0xb], 0x6f746365
mov dword [ebp - 0x13], 0x74616572
mov dword [ebp - 0xf], 0x72694465
mov byte [ebp - 0x14], 0x43
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fe46
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000fe50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], 0x7365636f
mov word [ebp - 0xd], 0x7461
mov word [ebp - 4], 0x5773
mov byte [ebp - 2], 0
mov word [ebp - 0x10], 0x7243
mov word [ebp - 0xb], 0x5065
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x72
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000feb9
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000ffa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
call fcn.1000eb10
mov esi, eax
test esi, esi
je 0x10010018
lea eax, [ebp - 0x18]
push eax
push esi
mov word [ebp - 0x10], 0x6963
mov word [ebp - 2], 0x57
mov dword [ebp - 0xd], 0x6c6f466c
mov word [ebp - 5], 0x7461
mov dword [ebp - 0x18], 0x65474853
mov word [ebp - 8], 0x7265
mov byte [ebp - 6], 0x50
mov dword [ebp - 0x14], 0x65705374
mov byte [ebp - 3], 0x68
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 9], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010011
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10010070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor esi, esi
call fcn.1000e980
mov edi, eax
test edi, edi
je 0x100100d8
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 6], 0x63657053
mov word [ebp - 0x13], 0x7461
mov dword [ebp - 0xb], 0x6c694665
mov word [ebp - 0x10], 0x6552
mov word [ebp - 0xd], 0x766f
mov word [ebp - 2], 0x57
mov byte [ebp - 0x11], 0x68
mov byte [ebp - 7], 0x65
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xe], 0x6d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100100d1
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10010140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x64616f4c
mov dword [ebp - 0xc], 0x7262694c
mov dword [ebp - 7], 0x577972
mov byte [ebp - 8], 0x61
call fcn.1000e930
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001017c
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10029f0e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1001c3a6
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10029f46
xor eax, eax
jmp 0x10029f72
cmp esi, dword [ebp - 4]
je 0x10029f6f
cmp dword [ebp + 0xc], 0
je 0x10029f6f
push dword [edi + 0x9c]
call fcn.10029b1c
push dword [edi + 0x9c]
mov esi, eax
call fcn.1002912d
pop ecx
pop ecx
cmp esi, eax
je 0x10029f42
xor eax, eax
inc eax
pop edi
pop esi
leave
ret