joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000edb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], 0x7243
mov dword [ebp - 6], 0x656c6946
mov word [ebp - 9], 0x7461
mov byte [ebp - 7], 0x65
mov word [ebp - 2], 0x57
mov byte [ebp - 0xa], 0x65
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ee06
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000ee10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xf], 0x656c7564
mov dword [ebp - 0x13], 0x6f4d7465
mov dword [ebp - 8], 0x6d614e65
mov word [ebp - 0xb], 0x6946
mov byte [ebp - 0x14], 0x47
mov word [ebp - 4], 0x5765
mov byte [ebp - 2], 0
mov byte [ebp - 9], 0x6c
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ee66
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000ee70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor esi, esi
call fcn.1000ea10
mov edi, eax
test edi, edi
je 0x1000eebe
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 4], 0x577374
mov dword [ebp - 0x10], 0x68746150
mov dword [ebp - 0xc], 0x656c6946
mov dword [ebp - 8], 0x73697845
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000eeb7
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000eed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], 0x65727275
mov word [ebp - 4], 0x73
mov dword [ebp - 9], 0x65636f72
mov word [ebp - 0xb], 0x5074
mov dword [ebp - 0x14], 0x43746547
mov byte [ebp - 5], 0x73
mov byte [ebp - 0xc], 0x6e
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ef19
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000ef20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], 0x7243
mov word [ebp - 0xa], 0x7645
mov dword [ebp - 7], 0x57746e
mov word [ebp - 0xd], 0x7461
mov byte [ebp - 8], 0x65
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xe], 0x65
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ef71
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x1000ef80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 7], 0x657a69
mov dword [ebp - 0x1c], 0x50746553
mov word [ebp - 0x12], 0x6f57
mov dword [ebp - 0xd], 0x6553676e
mov dword [ebp - 0x17], 0x7365636f
mov word [ebp - 0xf], 0x696b
mov word [ebp - 9], 0x5374
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x10], 0x72
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000efe3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000eff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call fcn.1000ea60
mov esi, eax
test esi, esi
je 0x1000f03e
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 5], 0x657a69
mov dword [ebp - 0xe], 0x6e696e55
mov word [ebp - 7], 0x6c61
mov word [ebp - 0xa], 0x7469
mov word [ebp - 0x10], 0x6f43
mov byte [ebp - 8], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f037
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, 1
call fcn.1000ea60
mov edi, eax
test edi, edi
je 0x1000f0aa
lea eax, [ebp - 0x10]
push eax
push edi
mov word [ebp - 0xd], 0x696e
mov dword [ebp - 7], 0x657a69
mov word [ebp - 0x10], 0x6f43
mov word [ebp - 0xa], 0x6169
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 8], 0x6c
mov byte [ebp - 0xe], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f0a3
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, 1
call fcn.1000ea60
mov esi, eax
test esi, esi
je 0x1000f12d
lea eax, [ebp - 0x14]
push eax
push esi
mov word [ebp - 0x14], 0x6f43
mov dword [ebp - 0xe], 0x6e496574
mov dword [ebp - 9], 0x636e6174
mov word [ebp - 5], 0x65
mov word [ebp - 0x11], 0x6572
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0xf], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f126
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000f140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
xor esi, esi
call fcn.1000eaa0
mov edi, eax
test edi, edi
je 0x1000f1c2
lea eax, [ebp - 0x20]
push eax
push edi
mov word [ebp - 0x15], 0x6365
mov word [ebp - 5], 0x72
mov dword [ebp - 0xc], 0x69726373
mov word [ebp - 0x1b], 0x6c61
mov word [ebp - 0x18], 0x657a
mov dword [ebp - 0x12], 0x79746972
mov word [ebp - 0xe], 0x6544
mov dword [ebp - 0x20], 0x74696e49
mov word [ebp - 8], 0x7470
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x16], 0x53
mov byte [ebp - 0x13], 0x75
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f1bb
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
call fcn.1000eb00
mov edi, eax
test edi, edi
je 0x1000f21f
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [ebp - 6], 0x776f646e
mov dword [ebp - 0xc], 0x6d756e45
mov word [ebp - 2], 0x73
mov word [ebp - 8], 0x6957
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f218
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 2], 0x57
mov dword [ebp - 7], 0x6c694665
mov dword [ebp - 0xc], 0x656c6544
mov byte [ebp - 3], 0x65
mov byte [ebp - 8], 0x74
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f26f
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
call fcn.1000eaa0
mov esi, eax
test esi, esi
je 0x1000f2f1
lea eax, [ebp - 0x10]
push eax
push esi
mov word [ebp - 0xd], 0x6553
mov word [ebp - 0x10], 0x6553
mov dword [ebp - 4], 0x6f666e
mov word [ebp - 8], 0x7469
mov byte [ebp - 0xe], 0x74
mov word [ebp - 0xb], 0x7563
mov word [ebp - 6], 0x4979
mov byte [ebp - 9], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f2ea
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000f350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 3], 0x74
mov dword [ebp - 0xc], 0x65736552
mov dword [ebp - 8], 0x65764574
mov byte [ebp - 4], 0x6e
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f38b
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 8], 0x64496e6f
mov dword [ebp - 0xe], 0x73655365
mov word [ebp - 0x13], 0x6e6f
mov dword [ebp - 0x1e], 0x74654753
mov word [ebp - 0x20], 0x5457
mov dword [ebp - 0x1a], 0x69746341
mov word [ebp - 0x10], 0x6c6f
mov word [ebp - 0x16], 0x6576
mov byte [ebp - 4], 0
mov word [ebp - 0xa], 0x6973
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x11], 0x73
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f456
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x646e6946
mov dword [ebp - 6], 0x57656c
mov dword [ebp - 0xb], 0x46747865
mov byte [ebp - 0xc], 0x4e
mov byte [ebp - 7], 0x69
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f4d3
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
call fcn.1000eb00
mov esi, eax
test esi, esi
je 0x1000f544
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x10], 0x57746553
mov dword [ebp - 0xb], 0x776f646e
mov byte [ebp - 0xc], 0x69
mov word [ebp - 6], 0x736f
mov byte [ebp - 4], 0
mov byte [ebp - 7], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f53d
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xf], 0x74616572
mov dword [ebp - 0xa], 0x6574754d
mov word [ebp - 6], 0x5778
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 4], 0
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f599
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000f5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0xa], 0x6854
mov word [ebp - 5], 0x64
mov word [ebp - 0xd], 0x7461
mov byte [ebp - 0xb], 0x65
mov word [ebp - 8], 0x6572
mov word [ebp - 0x10], 0x7243
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 6], 0x61
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f5fc
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 8], 0x746f6873
mov word [ebp - 0xb], 0x616e
mov word [ebp - 0x11], 0x6c65
mov word [ebp - 0x1b], 0x6572
mov word [ebp - 0x18], 0x6574
mov dword [ebp - 0x15], 0x686c6f6f
mov word [ebp - 0xe], 0x3233
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 4], 0
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 9], 0x70
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f67e
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000f690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 9], 0x3233
mov dword [ebp - 0xe], 0x7365636f
mov dword [ebp - 4], 0x577473
mov word [ebp - 6], 0x7269
mov word [ebp - 0x10], 0x7250
mov byte [ebp - 7], 0x46
mov byte [ebp - 0xa], 0x73
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f6de
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f6f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x636f7250
mov dword [ebp - 5], 0x577478
mov word [ebp - 0xc], 0x7365
mov dword [ebp - 9], 0x654e3233
mov byte [ebp - 0xa], 0x73
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f735
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 0xa], 0x7463
mov word [ebp - 0xd], 0x7269
mov dword [ebp - 8], 0x5779726f
mov word [ebp - 0x13], 0x6d65
mov byte [ebp - 4], 0
mov word [ebp - 0x10], 0x6576
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 0xe], 0x44
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f796
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000f7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 4], 0x5765
mov word [ebp - 0xa], 0x7372
mov word [ebp - 7], 0x6946
mov word [ebp - 0xd], 0x4664
mov word [ebp - 0x10], 0x6946
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 8], 0x74
mov byte [ebp - 2], 0
mov byte [ebp - 5], 0x6c
mov byte [ebp - 0xe], 0x6e
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f7f8
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000f800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 5], 0x657a6953
mov dword [ebp - 0xb], 0x69467465
mov word [ebp - 7], 0x656c
mov byte [ebp - 0xc], 0x47
mov byte [ebp - 1], 0
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f842
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1000f850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 5], 0x73736563
mov dword [ebp - 0xa], 0x72506e65
mov word [ebp - 0xc], 0x704f
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x6f
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f895
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 9], 0x636f
mov word [ebp - 6], 0x7373
mov dword [ebp - 0x13], 0x696d7265
mov dword [ebp - 0xd], 0x72506574
mov byte [ebp - 7], 0x65
mov word [ebp - 0xf], 0x616e
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 4], 0
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f8f2
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000f900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], 0x43746978
mov dword [ebp - 5], 0x737365
mov dword [ebp - 0xa], 0x6f725065
mov dword [ebp - 0x14], 0x45746547
mov word [ebp - 0xc], 0x646f
mov byte [ebp - 6], 0x63
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f94c
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000f960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
lea eax, [ebp - 0x38]
push eax
xor edi, edi
mov word [ebp - 0x2a], 0x616d
mov word [ebp - 0x2d], 0x7373
mov dword [ebp - 0x20], 0x57656d
mov word [ebp - 0x23], 0x4e65
mov dword [ebp - 0x34], 0x72507465
mov dword [ebp - 0x28], 0x69466567
mov dword [ebp - 0x38], 0x4732334b
mov byte [ebp - 0x24], 0x6c
mov word [ebp - 0x30], 0x636f
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2b], 0x49
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f9d1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
call fcn.1000eb50
mov esi, eax
test esi, esi
je 0x1000fa46
lea eax, [ebp - 0x1c]
push eax
push esi
mov dword [ebp - 0x17], 0x7365636f
mov word [ebp - 0xc], 0x6c69
mov word [ebp - 0xf], 0x6567
mov dword [ebp - 8], 0x57656d61
mov word [ebp - 0x1c], 0x6547
mov word [ebp - 0xa], 0x4e65
mov word [ebp - 0x12], 0x6d49
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x10], 0x61
mov word [ebp - 0x19], 0x7250
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 4], 0
mov byte [ebp - 0xd], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fa3f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000fa50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 5], 0x656c
mov word [ebp - 8], 0x4665
mov word [ebp - 0xb], 0x6972
mov byte [ebp - 3], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 9], 0x74
mov byte [ebp - 0xc], 0x57
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000faa1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x15], 0x6d695465
mov word [ebp - 0xd], 0x7379
mov word [ebp - 0x10], 0x6f54
mov byte [ebp - 0x11], 0x65
mov dword [ebp - 9], 0x6d69546d
mov word [ebp - 0x17], 0x6c69
mov word [ebp - 5], 0x65
mov byte [ebp - 0xe], 0x53
mov word [ebp - 0xb], 0x6574
mov byte [ebp - 0x18], 0x46
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fb0e
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000fb20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 6], 0x57747372
mov word [ebp - 0xc], 0x656c
mov dword [ebp - 0xa], 0x69463233
mov word [ebp - 0xf], 0x646f
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xd], 0x75
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fb6c
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fb80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0xb], 0x3365
mov dword [ebp - 8], 0x7478654e
mov dword [ebp - 0x10], 0x75646f4d
mov byte [ebp - 9], 0x32
mov byte [ebp - 0xc], 0x6c
mov word [ebp - 4], 0x57
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fbc8
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fbd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 7], 0x6974
mov dword [ebp - 4], 0x657479
mov dword [ebp - 0x12], 0x68436564
mov dword [ebp - 0xc], 0x754d6f54
mov word [ebp - 0xe], 0x7261
mov byte [ebp - 5], 0x42
mov word [ebp - 0x14], 0x6957
mov byte [ebp - 8], 0x6c
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fc37
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x6e65704f
mov word [ebp - 3], 0x57
mov dword [ebp - 8], 0x6574754d
mov byte [ebp - 4], 0x78
call fcn.1000e9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fc81
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fc90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, 1
call fcn.1000ea60
mov edi, eax
test edi, edi
je 0x1000fceb
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0xc], 0x6f724644
mov dword [ebp - 0x10], 0x49534c43
mov dword [ebp - 7], 0x69727453
mov word [ebp - 3], 0x676e
mov byte [ebp - 8], 0x6d
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fce4
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret