joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10068f77
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10068fc1
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10068f68
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10068f77
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1046ec1a
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10068fc8
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1004fe3e
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10069067
add edi, 4
add eax, 2
dec ecx
jne 0x10068fad
call 0x10069014
loope 0x1006900a
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10069064
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10069075
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10069028
cmp eax, ecx
ja 0x10069028
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100690b2
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100690a8
lea edi, [ebp - 0x100]
push pe_nt_image_headers32
push edi
push esi
call fcn.1005031d
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0xa94058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa941a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9406a
add dl, dl
jne 0xa94089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa940dc
xor eax, eax
add dl, dl
jne 0xa94096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9417d
add dl, dl
jne 0xa940a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa940b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa940bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa940c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa940d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa94075
mov eax, 1
add dl, dl
jne 0xa940ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa940f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa940e1
sub eax, ebx
mov ebx, 1
jne 0xa94128
mov ecx, 1
add dl, dl
jne 0xa9410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa94119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa94105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa94075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa94136
cmp eax, 0x7d00
jae 0xa9416d
cmp eax, 0x500
jb 0xa94168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa94075
cmp eax, 0x7f
ja 0xa94170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa94075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa94075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1002f4c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0xc], 0x2e
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0xc], 0x64
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0xc], 0x69
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0xc], 0x61
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0xc], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0xc], 0x70
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0xc], 0x77
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0xc], 0x53
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0xc], 0x68
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x1002f55c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
call fcn.1002f658
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002f651
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x78
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x45
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x4e
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x48
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x43
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x78
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x6b
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002f648
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002f658
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0xc], 0
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0xc], 0x72
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0xc], 0x32
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0xc], 0x33
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0xc], 0x2e
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0xc], 0x73
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0xc], 0x65
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0xc], 0x64
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0xc], 0x55
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x1002f6e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 1
and dword [ebp - 4], 0
call fcn.1002f9cb
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002f7b2
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x43
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x67
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x6f
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x73
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x52
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x4b
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x79
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x6c
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002f7a9
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002f7b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 1
and dword [ebp - 4], 0
call fcn.1002f9cb
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002f8a9
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x4b
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x41
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x67
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x52
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x79
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x78
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x4f
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x70
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x45
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002f8a0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002f8b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 1
and dword [ebp - 4], 0
call fcn.1002f9cb
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002f9c4
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x45
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x56
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x67
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x52
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x78
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x51
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x79
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002f9bb
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1002f9cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x70
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x61
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x69
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x2e
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x76
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x33
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x32
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x41
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x10], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret
Function at 0x1002fa6d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x45
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x78
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x50
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x56
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x63
lea eax, [ebp - 0x1c]
push eax
call fcn.1003015a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002fb63
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1002fb6a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
and dword [ebp - 4], 0
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x6f
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x63
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x56
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x41
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x69
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x6c
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x61
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x72
lea eax, [ebp - 0x18]
push eax
call fcn.1003015a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002fc31
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002fc38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x47
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x4d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x6d
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x46
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x4e
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x64
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x1c], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x6c
lea eax, [ebp - 0x1c]
push eax
call fcn.1003015a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002fd3e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002fd45
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 8], 0
and dword [ebp - 4], 0
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x73
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0x43
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x68
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x73
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x46
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x49
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x20], 0x68
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0x15
mov byte [ebp + eax - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call fcn.1003015a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002fe6c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002fe73
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
and dword [ebp - 4], 0
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x61
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x4e
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x32
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x33
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x72
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x68
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x78
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x54
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0
lea eax, [ebp - 0x18]
push eax
call fcn.1003015a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002ff34
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1002ff3b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
and dword [ebp - 4], 0
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x73
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x72
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x54
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x61
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x46
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x64
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x33
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x69
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x32
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x72
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x68
lea eax, [ebp - 0x18]
push eax
call fcn.1003015a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10030007
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret