joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x38], ecx
mov byte [0x100364a0], 0
lea esi, [edi + 0x6c]
jmp 0x10006850
inc edi
cmp edi, 0x1e
jg 0x1000693b
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1e], 0x6c
push eax
mov dword [ebp - 0x28], 0x320033
mov dword [ebp - 0x24], 0x64002e
mov word [ebp - 0x20], si
mov dword [ebp - 0x30], 0x730055
mov dword [ebp - 0x2c], 0x720065
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100068c7
lea eax, [ebp - 0x18]
mov dword [ebp - 0x12], 0x776f646e
push eax
push esi
mov dword [ebp - 0x16], 0x69576d75
mov word [ebp - 0x18], 0x6e45
mov word [ebp - 0xe], 0x73
call ebx
test eax, eax
je 0x100068c0
push dword [ebp - 0x38]
push 0x100067b0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [0x100364a0], 0
jne 0x1000693b
mov eax, 0x72
mov dword [ebp - 0xa], 0x706565
mov word [ebp - 0x30], ax
mov esi, 0x6c
lea eax, [ebp - 0x34]
mov word [ebp - 0xc], 0x6c53
push eax
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x2a], 0x33006c
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x2e], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0xc]
push ecx
push eax
call ebx
test eax, eax
je 0x1000692e
push 0x64
call eax
cmp byte [0x100364a0], 0
je 0x10006850
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x100097c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x10036738]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x44
lea eax, [ebx + 0x40e0]
mov dword [ebp - 0x34], esi
push 0
push eax
mov dword [ebp - 0x38], ebx
call fcn.10012940
add esp, 0xc
call fcn.1000daa0
lea ecx, [ebx + 0x407c]
mov byte [ebx + 0x40dd], 0
mov byte [ebx + 0x40da], 0
mov byte [ebx + 0x29], 0
call fcn.1000be40
lea ecx, [ebx + 0x4130]
mov dword [ebx + 0x40a4], 0
mov dword [ebx + 0x416c], 0
call fcn.1000b570
lea eax, [ebx + 0x413c]
mov ecx, eax
mov dword [ebp - 0x3c], eax
call fcn.1000b570
mov byte [ebx + 0x40dc], 1
mov eax, 0x2aaaaaab
mov ecx, dword [esi + 4]
mov edi, dword [esi]
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x100098a5
xor esi, esi
xor ebx, ebx
jmp 0x10009870
mov ecx, dword [ebp - 0x3c]
lea eax, [esi + edi]
push eax
call fcn.1000b490
mov eax, dword [ebp - 0x34]
lea esi, [esi + 0x18]
inc ebx
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ebx, ecx
jb 0x10009870
mov ebx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov ecx, dword [esi + 4]
mov eax, 0x2aaaaaab
sub ecx, dword [esi]
xor esi, esi
imul ecx
mov dword [ebp - 0xd], 0x61657268
sar edx, 2
mov eax, edx
mov word [ebp - 0xf], 0x5465
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14], 0x61657243
mov dword [ebx + 0x40fc], eax
mov eax, 0x72
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 9], 0x64
mov byte [ebp - 0x10], 0x74
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000993b
push esi
push esi
push ebx
push 0x100040b0
push esi
push esi
call eax
mov esi, eax
mov dword [ebx + 0x416c], esi
call fcn.1000d9f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret 4
Function at 0x10009960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x10036738]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x44
lea eax, [ebx + 0x40e0]
mov dword [ebp - 0x34], esi
push 0
push eax
mov dword [ebp - 0x3c], ebx
call fcn.10012940
add esp, 0xc
call fcn.1000daa0
lea ecx, [ebx + 0x407c]
mov byte [ebx + 0x40dd], 0
mov byte [ebx + 0x40da], 0
mov byte [ebx + 0x29], 0
call fcn.1000be40
lea eax, [ebx + 0x4130]
mov dword [ebx + 0x40a4], 0
mov ecx, eax
mov dword [ebx + 0x416c], 0
mov dword [ebp - 0x38], eax
call fcn.1000b570
lea ecx, [ebx + 0x413c]
call fcn.1000b570
mov byte [ebx + 0x40dc], 1
xor edi, edi
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x40], eax
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10009a43
mov ebx, dword [ebp - 0x40]
xor esi, esi
mov ecx, dword [ebp - 0x38]
lea eax, [esi + ebx]
push eax
call fcn.1000b490
mov eax, dword [ebp - 0x34]
lea esi, [esi + 0x18]
inc edi
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10009a11
mov ebx, dword [ebp - 0x3c]
mov eax, 0x72
mov dword [ebp - 0xd], 0x61657268
mov word [ebp - 0x2c], ax
xor esi, esi
lea eax, [ebp - 0x30]
mov word [ebp - 0xf], 0x5465
push eax
mov dword [ebp - 0x14], 0x61657243
mov word [ebp - 9], 0x64
mov byte [ebp - 0x10], 0x74
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009abd
push esi
push esi
push ebx
push 0x100040b0
push esi
push esi
call eax
mov esi, eax
mov dword [ebx + 0x416c], esi
call fcn.1000d9f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x2e
mov word [ebp - 0xe], 0x6365
mov word [ebp - 0x28], ax
mov edx, 0x6c
mov eax, 0x4b
mov dword [ebp - 0x1c], 0x7661654c
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0xc], 0x6e6f6974
mov dword [ebp - 0x18], 0x69724365
mov byte [ebp - 8], 0
mov word [ebp - 0x14], 0x6974
mov word [ebp - 0x11], 0x6c61
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0xf], 0x53
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x36], 0x720065
mov dword [ebp - 0x26], 0x6c0064
mov dword [ebp - 0x32], 0x65006e
mov dword [ebp - 0x22], edx
mov word [ebp - 0x2e], dx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000da8d
push 0x10036750
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000daa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x2e
mov dword [ebp - 0xc], 0x6e6f6974
mov word [ebp - 0x28], ax
mov edx, 0x6c
mov eax, 0x4b
mov dword [ebp - 0x19], 0x72437265
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x38]
push eax
mov word [ebp - 0xe], 0x6365
mov dword [ebp - 0x13], 0x6c616369
mov word [ebp - 0x1c], 0x6e45
mov word [ebp - 0x15], 0x7469
mov byte [ebp - 8], 0
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0xf], 0x53
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x36], 0x720065
mov dword [ebp - 0x26], 0x6c0064
mov dword [ebp - 0x32], 0x65006e
mov dword [ebp - 0x22], edx
mov word [ebp - 0x2e], dx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000db3d
push 0x10036750
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000e7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x2e
mov word [ebp - 0x18], 0x657a
mov word [ebp - 0x2c], ax
mov edx, 0x6c
mov eax, 0x4b
mov word [ebp - 0x20], 0x6e49
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0xc], 0x6f697463
mov dword [ebp - 0x1d], 0x6c616974
mov dword [ebp - 0x11], 0x536c6163
mov dword [ebp - 0x16], 0x74697243
mov byte [ebp - 0x19], 0x69
mov word [ebp - 8], 0x6e
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x12], 0x69
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x3a], 0x720065
mov dword [ebp - 0x2a], 0x6c0064
mov dword [ebp - 0x36], 0x65006e
mov dword [ebp - 0x26], edx
mov word [ebp - 0x32], dx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e898
push 0x10036750
call eax
mov ecx, dword [ebp - 4]
mov eax, 0x10036750
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000eb70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, 0x72
push esi
push edi
mov word [ebp - 0x2c], ax
mov edi, edx
lea eax, [ebp - 0x30]
mov word [ebp - 0x10], 0x614e
push eax
mov esi, ecx
mov dword [ebp - 0xd], 0x69506465
mov word [ebp - 0x13], 0x6565
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xe], 0x6d
mov word [ebp - 8], 0x65
mov byte [ebp - 9], 0x70
mov byte [ebp - 0x11], 0x6b
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ec25
push 0
push dword [ebp - 0x34]
push ebx
push 0x3ff
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000ec40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov word [ebp - 6], 0x57
push esi
mov word [ebp - 0x2c], ax
mov esi, ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0xb], 0x666e4970
push eax
mov word [ebp - 0x14], 0x6547
mov word [ebp - 0x11], 0x7453
mov word [ebp - 0xe], 0x7472
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ecd1
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000ece0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 0x72
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0xe], 0x65746165
mov dword [ebp - 0xa], 0x65706950
mov word [ebp - 0x10], 0x7243
mov byte [ebp - 6], 0
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ed79
push dword [ebp + 0x14]
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000ed90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov word [ebp - 7], 0x656c
push esi
mov word [ebp - 0x28], ax
mov esi, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xc], 0x6e614865
push eax
mov dword [ebp - 0x10], 0x736f6c43
mov byte [ebp - 8], 0x64
mov byte [ebp - 5], 0
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ee1d
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000ee30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x72
mov dword [ebp - 0x12], 0x6e6f6974
push edi
mov word [ebp - 0x38], ax
mov edi, edx
lea eax, [ebp - 0x3c]
mov word [ebp - 0x1a], 0x4965
push eax
mov esi, ecx
mov word [ebp - 0x17], 0x6f66
mov word [ebp - 0xa], 0x646e
mov dword [ebp - 0xe], 0x61487942
mov byte [ebp - 0x18], 0x6e
mov word [ebp - 7], 0x65
mov word [ebp - 0x20], 0x6547
mov word [ebp - 0x1d], 0x6946
mov word [ebp - 0x14], 0x616d
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 8], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov dword [ebp - 0x2e], 0x2e0032
mov dword [ebp - 0x26], 0x6c
mov dword [ebp - 0x3c], 0x65004b
mov dword [ebp - 0x32], 0x33006c
mov dword [ebp - 0x2a], 0x6c0064
mov dword [ebp - 0x36], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000eef2
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000ef10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, 0x72
push esi
push edi
mov word [ebp - 0x28], ax
mov edi, edx
lea eax, [ebp - 0x2c]
mov word [ebp - 0xd], 0x7461
push eax
mov esi, ecx
mov word [ebp - 0xa], 0x6946
mov word [ebp - 7], 0x5765
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 8], 0x6c
mov word [ebp - 0x10], 0x7243
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x65
mov dword [ebp - 0x1e], 0x2e0032
mov dword [ebp - 0x16], 0x6c
mov dword [ebp - 0x2c], 0x65004b
mov dword [ebp - 0x22], 0x33006c
mov dword [ebp - 0x1a], 0x6c0064
mov dword [ebp - 0x26], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000efca
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push 0
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000efe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov word [ebp - 0xe], 0x6c69
push esi
mov word [ebp - 0x30], ax
mov esi, edx
lea eax, [ebp - 0x34]
mov dword [ebp - 9], 0x57656d
push eax
mov word [ebp - 0xb], 0x614e
mov dword [ebp - 0x14], 0x6c75646f
mov dword [ebp - 0x18], 0x4d746547
mov byte [ebp - 0xc], 0x65
mov word [ebp - 0x10], 0x4665
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x2a], 0x33006c
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x2e], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f083
push 0x104
push esi
push 0
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f0a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x20], 0x2e0069
push eax
mov ebx, ecx
mov dword [ebp - 0x1c], 0x6c0064
xor esi, esi
mov dword [ebp - 0x2c], 0x680053
mov dword [ebp - 0x28], 0x77006c
mov dword [ebp - 0x24], 0x700061
mov dword [ebp - 0x18], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000f12f
lea eax, [ebp - 0x14]
mov word [ebp - 0xf], 0x6c69
push eax
push edi
mov dword [ebp - 0xc], 0x73697845
mov dword [ebp - 8], 0x577374
mov dword [ebp - 0x14], 0x68746150
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xd], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f128
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0x11], 0x50746e65
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x34]
push eax
mov word [ebp - 8], 0x73
mov dword [ebp - 0xd], 0x65636f72
mov word [ebp - 0x16], 0x4374
mov word [ebp - 0x13], 0x7272
mov byte [ebp - 0x14], 0x75
mov word [ebp - 0x18], 0x6547
mov byte [ebp - 9], 0x73
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x1e], 0x6c
mov dword [ebp - 0x34], 0x65004b
mov dword [ebp - 0x2a], 0x33006c
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x2e], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f1ea
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
Function at 0x1000f200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0xb], 0x57746e
push esi
mov word [ebp - 0x2c], ax
mov esi, edx
lea eax, [ebp - 0x30]
mov word [ebp - 0x14], 0x7243
push eax
mov dword [ebp - 0xf], 0x65764565
mov word [ebp - 0x11], 0x7461
mov byte [ebp - 0x12], 0x65
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x26], 0x33006c
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f295
push 0
push 0
push esi
push 0
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f2b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x72
mov dword [ebp - 0x20], 0x50746553
push esi
mov word [ebp - 0x38], ax
mov esi, ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x13], 0x676e696b
push eax
mov dword [ebp - 0x1c], 0x65636f72
mov word [ebp - 0xf], 0x6553
mov word [ebp - 9], 0x65
mov dword [ebp - 0x18], 0x6f577373
mov word [ebp - 0xc], 0x6953
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0x14], 0x72
mov dword [ebp - 0x2e], 0x2e0032
mov dword [ebp - 0x26], 0x6c
mov dword [ebp - 0x3c], 0x65004b
mov dword [ebp - 0x32], 0x33006c
mov dword [ebp - 0x2a], 0x6c0064
mov dword [ebp - 0x36], 0x65006e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f365
push 0x4000000
push 0x4000000
push esi
call eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011e54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret

Function at 0x1000f380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10034008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x6c004f
mov word [ebp - 0x16], ax
mov eax, 0x64
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x28]
push esi
push eax
mov dword [ebp - 0x24], 0x330065
mov dword [ebp - 0x20], 0x2e0032
mov dword [ebp - 0x1a], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000f403
lea eax, [ebp - 0x14]
mov dword [ebp - 0xa], 0x657a696c
push eax
push esi
mov dword [ebp - 0x14], 0x6e556f43
mov dword [ebp - 0xe], 0x61697469
mov word [ebp - 0x10], 0x6e69
mov byte [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f3fc
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10011e54
mov esp, ebp
pop ebp
ret