joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b110
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1000b258
push 0
push 0x2000000
push 3
push 0
push 0
push 0x60000
push esi
call fcn.1000fb50
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x1000b258
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x221
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
movlpd qword [ebp - 0x30], xmm0
push eax
push 1
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x3c], 0x10000000
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
call dword [0x1007e240]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000b216
push 0
push eax
push 0
push 0
push 4
push 1
push esi
call dword [0x1007e244]
push dword [ebp - 0x10]
call dword [0x1007e248]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000b22d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000b23b
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call fcn.1000f9e0
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x1000d990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c062
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], 0
mov dword [ebp - 4], 0
mov dword [esi], 0
call fcn.1000d860
mov ecx, eax
test ecx, ecx
je 0x1000dbd4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x1004d4d0
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.1000d3c0
test al, al
jne 0x1000da1c
push 0
push 0x1004d4d0
mov ecx, esi
call fcn.1000e220
push 0x208
lea eax, [ebp - 0x26c]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x270], 1
call fcn.100158a0
xor eax, eax
mov dword [ebp - 0x54], 0x64002e
add esp, 0xc
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x64], 0x65004b
mov dword [ebp - 0x5c], 0x6c0065
mov dword [ebp - 0x50], 0x6c006c
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x58], 0x320033
push eax
mov dword [ebp - 0x60], 0x6e0072
mov word [ebp - 0x16], 0x6d61
mov dword [ebp - 0x21], 0x75646f4d
mov word [ebp - 0x1c], 0x4665
mov word [ebp - 0x23], 0x7465
mov word [ebp - 0x13], 0x57
mov word [ebp - 0x19], 0x656c
mov byte [ebp - 0x17], 0x4e
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x14], 0x65
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x1000dad7
push 0x104
lea ecx, [ebp - 0x26c]
push ecx
push 0
call eax
xor eax, eax
mov dword [ebp - 0x3e], 0x690070
mov word [ebp - 0x32], ax
mov eax, 0x61
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x36], 0x6c006c
mov dword [ebp - 0x3a], 0x64002e
mov dword [ebp - 0x44], 0x77006c
mov dword [ebp - 0x48], 0x680053
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000dbb6
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x68746150
push eax
push edi
mov word [ebp - 0x15], 0x5765
mov byte [ebp - 0x13], 0
mov dword [ebp - 0x20], 0x646e6946
mov dword [ebp - 0x1a], 0x614e656c
mov byte [ebp - 0x16], 0x6d
mov word [ebp - 0x1c], 0x6946
call ebx
test eax, eax
je 0x1000dbaf
lea ecx, [ebp - 0x26c]
push ecx
call eax
mov edx, eax
test edx, edx
jne 0x1000db64
xor ecx, ecx
jmp 0x1000db7f
mov ecx, edx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000db70
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.1000e220
mov eax, 0x78
mov dword [ebp - 0x30], 0x65002e
mov word [ebp - 0x2c], ax
mov ecx, esi
push 0x1004d4d0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2a], 0x65
push eax
call fcn.1000df80
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000d3a0
int3
Function at 0x1000dc00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x64
mov word [ebp - 0x12], 0x6163
mov word [ebp - 0x26], ax
mov edx, 0x65
xor eax, eax
mov dword [ebp - 0xf], 0x74636553
push esi
mov word [ebp - 0x20], ax
mov esi, ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x16], 0x69746972
push eax
mov dword [ebp - 0x1c], 0x65746e45
mov dword [ebp - 0xb], 0x6e6f69
mov byte [ebp - 0x10], 0x6c
mov word [ebp - 0x18], 0x4372
mov dword [ebp - 0x2a], 0x2e0032
mov dword [ebp - 0x34], 0x6e0072
mov dword [ebp - 0x2e], 0x33006c
mov word [ebp - 0x30], dx
mov dword [ebp - 0x24], 0x6c006c
mov dword [ebp - 0x38], 0x65004b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000dc96
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x1000e480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x64
mov dword [ebp - 0xc], 0x6e6f6974
mov word [ebp - 0x26], ax
mov edx, 0x65
xor eax, eax
mov word [ebp - 0x12], 0x6163
push esi
mov word [ebp - 0x20], ax
mov esi, ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x17], 0x74697243
push eax
mov dword [ebp - 0x10], 0x6365536c
mov word [ebp - 0x19], 0x6576
mov byte [ebp - 8], 0
mov word [ebp - 0x1c], 0x654c
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x1a], 0x61
mov dword [ebp - 0x2a], 0x2e0032
mov dword [ebp - 0x34], 0x6e0072
mov dword [ebp - 0x2e], 0x33006c
mov word [ebp - 0x30], dx
mov dword [ebp - 0x24], 0x6c006c
mov dword [ebp - 0x38], 0x65004b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e51d
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x1000e530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000e589
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000e589
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000e57a
cmp esi, edx
jae 0x1000e589
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000e568
cmp esi, edx
jae 0x1000e589
cmp word [esi], 0
je 0x1000e589
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000f7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, 0x2e
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x14], 0x6550
mov dword [ebp - 0xa], 0x657069
mov dword [ebp - 0x11], 0x6d614e6b
mov word [ebp - 0xc], 0x5064
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x65
mov dword [ebp - 0x28], 0x6c0065
mov dword [ebp - 0x24], 0x320033
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x2c], 0x6e0072
mov dword [ebp - 0x1e], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f865
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
push dword [ebp + 0x10]
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x1000f880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x2e
mov word [ebp - 0xf], 0x7261
push esi
mov esi, dword [ebp + 8]
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x14], 0x53746547
mov dword [ebp - 0xa], 0x6f666e49
mov byte [ebp - 0x10], 0x74
mov word [ebp - 6], 0x57
mov word [ebp - 0xc], 0x7075
mov byte [ebp - 0xd], 0x74
mov dword [ebp - 0x28], 0x6c0065
mov dword [ebp - 0x24], 0x320033
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x2c], 0x6e0072
mov dword [ebp - 0x1e], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f90b
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x1000f920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 0x2e
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x2c]
push eax
mov word [ebp - 8], 0x6570
mov dword [ebp - 0x10], 0x61657243
mov byte [ebp - 6], 0
mov word [ebp - 0xb], 0x5065
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 9], 0x69
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x320033
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x28], 0x6e0072
mov dword [ebp - 0x1a], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f9c0
push dword [ebp + 0x14]
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x1000f9e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x2e
mov dword [ebp - 9], 0x656c646e
push esi
mov esi, dword [ebp + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0xd], 0x61486573
mov word [ebp - 0x10], 0x6c43
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6f
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x320033
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x28], 0x6e0072
mov dword [ebp - 0x1a], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fa6e
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x1000fa80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x2e
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x14], 0x6974616d
mov dword [ebp - 0x1e], 0x6c694674
mov dword [ebp - 9], 0x656c64
mov dword [ebp - 0x10], 0x79426e6f
mov word [ebp - 0x20], 0x6547
mov word [ebp - 0x19], 0x6e49
mov word [ebp - 0xb], 0x6e61
mov byte [ebp - 0xc], 0x48
mov word [ebp - 0x16], 0x726f
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x17], 0x66
mov dword [ebp - 0x34], 0x6c0065
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x3c], 0x65004b
mov dword [ebp - 0x26], 0x6c
mov dword [ebp - 0x38], 0x6e0072
mov dword [ebp - 0x2a], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fb38
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x1000fb50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, 0x2e
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x2c]
push eax
mov word [ebp - 0xe], 0x6165
mov dword [ebp - 9], 0x57656c69
mov word [ebp - 0xb], 0x4665
mov word [ebp - 0x10], 0x7243
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x74
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x320033
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x28], 0x6e0072
mov dword [ebp - 0x1a], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fc13
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x1000fc30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x2e
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 9], 0x57656d
mov word [ebp - 0x16], 0x4d74
mov dword [ebp - 0xe], 0x4e656c69
mov byte [ebp - 0xa], 0x61
mov word [ebp - 0x10], 0x4665
mov word [ebp - 0x13], 0x7564
mov word [ebp - 0x18], 0x6547
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x14], 0x6f
mov dword [ebp - 0x2c], 0x6c0065
mov dword [ebp - 0x28], 0x320033
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x30], 0x6e0072
mov dword [ebp - 0x22], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fcdd
push dword [ebp + 0x10]
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x1000fcf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x64
mov word [ebp - 0x1c], ax
xor eax, eax
push esi
mov word [ebp - 0x16], ax
mov esi, 0x80004005
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x330065
push eax
mov dword [ebp - 0x1a], 0x6c006c
mov dword [ebp - 0x20], 0x2e0032
mov dword [ebp - 0x28], 0x6c004f
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000fd86
lea eax, [ebp - 0x14]
mov word [ebp - 0xa], 0x657a
push eax
push edi
mov dword [ebp - 0x14], 0x6e496f43
mov word [ebp - 0xd], 0x6c61
mov byte [ebp - 0xb], 0x69
mov word [ebp - 0x10], 0x7469
mov byte [ebp - 8], 0
mov byte [ebp - 0xe], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fd7f
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x1000fda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, 0x64
push ebx
mov ebx, dword [ebp + 8]
mov word [ebp - 0x20], ax
xor eax, eax
push esi
mov word [ebp - 0x1a], ax
mov esi, 0x80004005
push edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x330065
push eax
mov dword [ebp - 0x1e], 0x6c006c
mov dword [ebp - 0x24], 0x2e0032
mov dword [ebp - 0x2c], 0x6c004f
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000fe5b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x13], 0x49657461
push eax
push edi
mov dword [ebp - 0xc], 0x65636e61
mov word [ebp - 0x18], 0x6f43
mov word [ebp - 0xe], 0x7473
mov byte [ebp - 0xf], 0x6e
mov word [ebp - 0x15], 0x6572
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fe54
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp + 0x10]
push dword [ebp - 0x38]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x1000fe70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x64
mov dword [ebp - 0x24], 0x330065
mov word [ebp - 0x1c], ax
xor eax, eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x28]
push esi
push eax
mov dword [ebp - 0x1a], 0x6c006c
mov dword [ebp - 0x20], 0x2e0032
mov dword [ebp - 0x28], 0x6c004f
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000feff
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x696c6169
push eax
push esi
mov word [ebp - 0x10], 0x6e69
mov word [ebp - 0x13], 0x556f
mov word [ebp - 8], 0x657a
mov byte [ebp - 0x14], 0x43
mov word [ebp - 0xe], 0x7469
mov byte [ebp - 6], 0
mov byte [ebp - 0x11], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fef8
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x1000ff10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x2e
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1b], 0x65747379
mov word [ebp - 0xc], 0x6954
mov word [ebp - 0x16], 0x6954
mov byte [ebp - 0x17], 0x6d
mov dword [ebp - 0x13], 0x466f5465
mov word [ebp - 0xf], 0x6c69
mov byte [ebp - 0x14], 0x6d
mov byte [ebp - 0x1c], 0x53
mov word [ebp - 9], 0x65
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xa], 0x6d
mov dword [ebp - 0x30], 0x6c0065
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x38], 0x65004b
mov dword [ebp - 0x22], 0x6c
mov dword [ebp - 0x34], 0x6e0072
mov dword [ebp - 0x26], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ffc2
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x1000ffe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x2e
mov word [ebp - 0xc], 0x6e6f
push esi
mov esi, dword [ebp + 0xc]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], 0x636f7250
mov word [ebp - 0x13], 0x6f54
mov dword [ebp - 0x18], 0x49737365
mov word [ebp - 9], 0x64
mov dword [ebp - 0x11], 0x73736553
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x49
mov dword [ebp - 0x30], 0x6c0065
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x38], 0x65004b
mov dword [ebp - 0x22], 0x6c
mov dword [ebp - 0x34], 0x6e0072
mov dword [ebp - 0x26], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010088
push esi
push dword [ebp + 8]
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret