joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014500
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x218]
push esi
mov esi, dword [esp + 0x218]
test esi, esi
je 0x1001453d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001453d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x10014604
push edi
mov edi, ebx
mov ecx, ebx
nop dword [eax]
cmp al, 0x2f
je 0x10014558
cmp al, 0x5c
jne 0x1001455a
mov edi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x10014550
cmp edi, ebx
je 0x1001459f
sub edi, ebx
lea eax, [esp + 0x110]
push edi
push ebx
push eax
call fcn.1002e880
add esp, 0xc
cmp edi, 0x104
jae 0x1001461b
lea eax, [esp + 0x110]
mov byte [esp + edi + 0x110], 0
push eax
push esi
call fcn.10014500
add esp, 8
mov byte [esp + 0xc], 0
test esi, esi
je 0x100145bd
lea ecx, [esp + 0xc]
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100145b0
mov esi, ebx
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x100145c0
lea edi, [esp + 0xc]
sub ebx, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100145d0
mov ecx, ebx
lea eax, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10014603
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
mov ecx, dword [esp + 0x210]
pop esi
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x20c
ret
call fcn.1002cbbe
int3
Function at 0x10015570
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047099
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x44], edi
push 0x5c
lea esi, [edi + 4]
mov dword [ebp - 0x48], edi
push 0
push esi
call fcn.1002ee00
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [edi + 0xa0], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xb4], 0xf
mov byte [edi + 0xa0], 0
mov dword [edi + 0xb8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 0xf
mov byte [edi + 0xb8], 0
sub esp, 0xc
mov word [edi], 0x101
mov eax, esp
mov dword [ebp - 0x44], esp
mov dword [eax], 0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push 0x1004bab8
push eax
call fcn.10049230
add esp, 8
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 6
push eax
mov ecx, edi
call fcn.10015710
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100156b6
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100156ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015703
push edx
push ecx
call fcn.1002c730
add esp, 8
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x100156e6
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100156dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015703
push edx
push ecx
call fcn.1002c730
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ca58
mov esp, ebp
pop ebp
ret
call fcn.100316af
int3
Function at 0x100180d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047ab1
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x80], 1
push eax
xor edi, edi
mov dword [ebp - 0x2a], 0x642e3233
mov word [ebp - 0x26], 0x6c6c
mov dword [ebp - 0x2e], 0x6c656e72
mov byte [ebp - 0x24], 0
mov word [ebp - 0x30], 0x654b
mov word [ebp - 0x17], 0x6e75
mov word [ebp - 0x1a], 0x436b
mov word [ebp - 0x1d], 0x6954
mov word [ebp - 0x20], 0x6547
mov word [ebp - 0x15], 0x74
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1b], 0x63
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10018196
call eax
mov edi, eax
push edi
lea eax, [ebp - 0x7c]
mov word [ebp - 0x4f], 0x2525
push eax
push esi
mov word [ebp - 0x5f], 0x6576
mov dword [ebp - 0x3d], 0x26642525
mov word [ebp - 0x34], 0x6425
mov dword [ebp - 0x77], 0x732f2f3a
mov dword [ebp - 0x5a], 0x253d6e6f
mov dword [ebp - 0x4c], 0x72617626
mov word [ebp - 0x5c], 0x6973
mov dword [ebp - 0x39], 0x656d6974
mov word [ebp - 0x70], 0x6d70
mov dword [ebp - 0x6d], 0x2f6d6f63
mov byte [ebp - 0x32], 0
mov word [ebp - 0x73], 0x6f73
mov dword [ebp - 0x43], 0x756c6176
mov byte [ebp - 0x35], 0x3d
mov dword [ebp - 0x7c], 0x70747468
mov dword [ebp - 0x48], 0x7325253d
mov dword [ebp - 0x66], 0x702e6b63
mov word [ebp - 0x56], 0x2673
mov word [ebp - 0x69], 0x6266
mov byte [ebp - 0x4d], 0x73
mov byte [ebp - 0x5d], 0x72
mov dword [ebp - 0x53], 0x3d646975
mov word [ebp - 0x62], 0x7068
mov byte [ebp - 0x60], 0x3f
mov byte [ebp - 0x44], 0x26
mov byte [ebp - 0x54], 0x67
mov byte [ebp - 0x71], 0x61
mov byte [ebp - 0x78], 0x73
mov word [ebp - 0x3f], 0x3d65
mov byte [ebp - 0x6e], 0x2e
mov byte [ebp - 0x67], 0x61
call fcn.10017c20
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ca58
mov esp, ebp
pop ebp
ret
Function at 0x1001b390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x28]
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001b40b
lea ecx, [esp + 0xc]
mov dword [esp + 0x12], 0x79654b6e
push ecx
push eax
mov dword [esp + 0x16], 0x65704f67
mov dword [esp + 0x1e], 0x577845
mov word [esp + 0x14], 0x6552
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b40b
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001b430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x10], eax
call fcn.10022be0
mov ecx, eax
call fcn.10022df0
test eax, eax
je 0x1001b4d7
lea ecx, [esp + 0x18]
mov word [esp + 0x1b], 0x7551
push ecx
push eax
mov dword [esp + 0x26], 0x61567972
mov dword [esp + 0x2b], 0x78456575
mov word [esp + 0x2f], 0x57
mov word [esp + 0x20], 0x6552
mov byte [esp + 0x22], 0x67
mov byte [esp + 0x2a], 0x6c
mov byte [esp + 0x25], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b4d7
push dword [esp + 0x10]
push dword [esp + 0x18]
push ebp
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1002ca58
add esp, 0x20
ret
mov ecx, dword [esp + 0x2c]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x20
ret

Function at 0x1001b610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [esp + 0x28]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x30]
push eax
mov word [esp + 0x20], 0x6873
mov word [esp + 0x1a], 0x3233
mov dword [esp + 0xc], 0x61657243
mov dword [esp + 0x15], 0x6c65686c
mov word [esp + 0x23], 0x74
mov dword [esp + 0x10], 0x6f546574
mov dword [esp + 0x1c], 0x70616e53
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x14], 0x6f
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b69d
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1002ca58
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x20
ret
Function at 0x1001b6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x24]
push eax
mov dword [esp + 0x16], 0x74737269
mov word [esp + 0x11], 0x7373
mov dword [esp + 0xc], 0x636f7250
mov word [esp + 0x14], 0x4632
mov byte [esp + 0x13], 0x33
mov byte [esp + 0x1a], 0
mov byte [esp + 0x10], 0x65
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b736
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001b750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x24]
push eax
mov dword [esp + 0x16], 0x747865
mov dword [esp + 0xc], 0x636f7250
mov dword [esp + 0x11], 0x32337373
mov byte [esp + 0x10], 0x65
mov byte [esp + 0x15], 0x4e
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b7bb
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001b900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x24]
push eax
mov dword [esp + 0x10], 0x72616e69
mov word [esp + 0x17], 0x6570
mov dword [esp + 0xc], 0x42746547
mov word [esp + 0x14], 0x5479
mov word [esp + 0x19], 0x41
mov byte [esp + 0x16], 0x79
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b973
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001b990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
call fcn.10022be0
mov ecx, eax
call fcn.10022e60
test eax, eax
je 0x1001b9fd
lea ecx, [esp + 4]
mov word [esp + 0x10], 0x65
push ecx
push eax
mov word [esp + 0xf], 0x7361
mov word [esp + 0xc], 0x6f43
mov word [esp + 0x15], 0x7246
mov word [esp + 0x12], 0x654d
mov byte [esp + 0x11], 0x6b
mov byte [esp + 0xe], 0x54
mov byte [esp + 0x14], 0x6d
mov byte [esp + 0x17], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001b9fd
push esi
call eax
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
Function at 0x1001ba10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
call fcn.10022be0
mov ecx, eax
call fcn.10022e60
test eax, eax
je 0x1001ba7c
lea ecx, [esp + 4]
mov dword [esp + 7], 0x74616572
push ecx
push eax
mov dword [esp + 0x14], 0x64697547
mov word [esp + 0xc], 0x6f43
mov byte [esp + 0xe], 0x43
mov byte [esp + 0x18], 0
mov byte [esp + 0x13], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001ba7c
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov eax, 1
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001baa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
push esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14]
push edi
mov edi, dword [esp + 0x3c]
push eax
mov dword [esp + 0x27], 0x6d726f66
mov word [esp + 0x2e], 0x6e6f
mov word [esp + 0x21], 0x756c
mov dword [esp + 0x1c], 0x56746547
mov word [esp + 0x24], 0x4965
mov word [esp + 0x2b], 0x7461
mov byte [esp + 0x20], 0x6f
mov byte [esp + 0x23], 0x6d
mov word [esp + 0x30], 0x57
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x26], 0x6e
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001bb5e
push dword [esp + 0x54]
push dword [esp + 0x14]
push dword [esp + 0x1c]
push ebp
push ebx
push dword [esp + 0x54]
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1002ca58
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x24
ret

Function at 0x1001bc20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push eax
mov dword [esp + 9], 0x65736f6c
mov word [esp + 0x12], 0x65
mov dword [esp + 0xd], 0x646e6148
mov byte [esp + 8], 0x43
mov byte [esp + 0x11], 0x6c
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001bc83
push esi
call eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret
Function at 0x1001bdc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
call fcn.10022be0
mov ecx, eax
call fcn.10022d90
test eax, eax
je 0x1001be38
lea ecx, [esp + 4]
mov dword [esp + 0xf], 0x41737473
push ecx
push eax
mov word [esp + 0x11], 0x6c69
mov dword [esp + 0xc], 0x68746150
mov word [esp + 0x14], 0x7845
mov byte [esp + 0x1b], 0
mov byte [esp + 0x10], 0x46
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x13], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001be38
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001be50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
call fcn.10022be0
mov ecx, eax
call fcn.10022ec0
test eax, eax
je 0x1001bee1
lea ecx, [esp + 8]
mov dword [esp + 0x17], 0x50726564
push ecx
push eax
mov dword [esp + 0x23], 0x57687461
mov dword [esp + 0x16], 0x69636570
mov dword [esp + 0x11], 0x74654748
mov dword [esp + 0x1b], 0x6c6f466c
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x27], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001bee1
push dword [esp + 0x34]
push dword [esp + 0x34]
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret

Function at 0x1001bf70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
call fcn.10022be0
mov ecx, eax
call fcn.10023100
test eax, eax
je 0x1001bfeb
lea ecx, [esp + 4]
mov word [esp + 5], 0x7465
push ecx
push eax
mov word [esp + 0x18], 0x73
mov dword [esp + 0x13], 0x61436563
mov byte [esp + 0xc], 0x47
mov byte [esp + 0x17], 0x70
mov word [esp + 0x10], 0x7665
mov byte [esp + 0x12], 0x69
mov byte [esp + 0xf], 0x44
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001bfeb
push dword [esp + 0x20]
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov eax, 0x60
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
Function at 0x1001c000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
call fcn.10022be0
mov ecx, eax
call fcn.10022f20
test eax, eax
je 0x1001c06d
lea ecx, [esp + 8]
mov dword [esp + 0xb], 0x65736165
push ecx
push eax
mov word [esp + 0x18], 0x43
mov word [esp + 0x11], 0x6c65
mov byte [esp + 0x10], 0x52
mov byte [esp + 0x17], 0x44
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c06d
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x10
ret

Function at 0x1001c080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
call fcn.10022be0
mov ecx, eax
call fcn.10022f20
test eax, eax
je 0x1001c0f5
lea ecx, [esp + 4]
mov dword [esp + 6], 0x654d646e
push ecx
push eax
mov word [esp + 0x17], 0x41
mov word [esp + 0xc], 0x6553
mov dword [esp + 0x12], 0x67617373
mov byte [esp + 0x16], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c0f5
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001c110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
call fcn.10022be0
mov ecx, eax
call fcn.10022d90
test eax, eax
je 0x1001c1ac
lea ecx, [esp + 0x10]
mov dword [esp + 0x17], 0x53797265
push ecx
push eax
mov word [esp + 0x27], 0x4167
mov word [esp + 0x24], 0x6972
mov dword [esp + 0x19], 0x636f7373
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x23], 0x74
mov word [esp + 0x1d], 0x7551
mov byte [esp + 0x29], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c1ac
push ebp
push ebx
push edi
push esi
push dword [esp + 0x40]
push dword [esp + 0x40]
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
Function at 0x1001c330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
call fcn.10022be0
mov ecx, eax
call fcn.10022fe0
test eax, eax
je 0x1001c3bf
lea ecx, [esp + 8]
mov dword [esp + 0xd], 0x6556656c
push ecx
push eax
mov dword [esp + 0x1a], 0x6e6f6973
mov dword [esp + 0x1f], 0x536f666e
mov dword [esp + 0x24], 0x41657a
mov word [esp + 0x13], 0x6946
mov word [esp + 0x10], 0x6547
mov byte [esp + 0x23], 0x69
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x1e], 0x49
mov byte [esp + 0x19], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c3bf
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret

Function at 0x1001c3e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 3], 0x7473614c
push eax
mov dword [esp + 0xc], 0x726f7272
mov word [esp + 4], 0x6547
mov byte [esp + 0x10], 0
mov byte [esp + 6], 0x74
mov byte [esp + 0xb], 0x45
call fcn.10022be0
mov ecx, eax
call fcn.10022c70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c440
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret

Function at 0x1001c560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x34]
call fcn.10022be0
mov ecx, eax
call fcn.10022ec0
test eax, eax
je 0x1001c5ee
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0x7265646c
push ecx
push eax
mov dword [esp + 0x15], 0x74654748
mov word [esp + 0x19], 0x6e4b
mov dword [esp + 0x24], 0x68746150
mov dword [esp + 0x1c], 0x6f466e77
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x1b], 0x6f
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001c5ee
push ebx
push edi
push dword [esp + 0x38]
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret
mov ecx, dword [esp + 0x24]
mov eax, 0x80004005
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x1c
ret