joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004adc0
Capabilities:
Query or enumerate registry value
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x101b9578]
push esi
push edi
mov dword [esp + 0x11c], eax
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwarePubwin
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004af11
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.DeCenterIP
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x18]
cmp al, 0x30
jl 0x1004aeb2
cmp al, 0x39
jg 0x1004aeb2
lea eax, [esp + 0x18]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004ae60
sub eax, edx
cmp eax, 0x28
jae 0x1004ae91
xor eax, eax
mov cl, byte [esp + eax + 0x18]
mov byte [eax + 0x101cfa6c], cl
inc eax
test cl, cl
jne 0x1004ae70
mov ecx, dword [esp + 0x11c]
call fcn.1010122d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.ip_len_err
push 2
call fcn.1001b560
add esp, 8
mov ecx, dword [esp + 0x11c]
call fcn.1010122d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1004aecd
lea ecx, [esp + 0x18]
push ecx
push str._s_:unkown_host
jmp 0x1004af17
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1004aee0
sub ecx, esi
cmp ecx, 0x28
jae 0x1004af21
mov edx, 0x101cfa6c
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1004aef5
mov ecx, dword [esp + 0x11c]
call fcn.1010122d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
push str.RegOpenKeyEx:_d
push 2
call fcn.1001b560
add esp, 0xc
mov ecx, dword [esp + 0x11c]
call fcn.1010122d
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004af40
Capabilities:
Query or enumerate registry value
Resolve dns

Disassembly:
call fcn.1004adc0
jmp fcn.1004ac40
Function at 0x1004ddd0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162c18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
mov eax, dword [0x101b9578]
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 4], 1
cmp dword [0x101ed67c], 0
jne 0x1004de27
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.1003efa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.1003efa0
jmp 0x1004e004
mov eax, dword [0x101cfd7c]
add eax, 1
mov dword [0x101cfd7c], eax
mov byte [ebp - 0x24], 0
xor ecx, ecx
mov dword [ebp - 0x23], ecx
mov dword [ebp - 0x1f], ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov word [ebp - 0x13], cx
mov byte [ebp - 0x11], cl
lea edx, [ebp - 0x74]
push edx
call fcn.100151e0
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x74]
call fcn.100153c0
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
mov edx, dword [ecx]
push edx
push 0x10167f04
lea eax, [ebp - 0x24]
push eax
call fcn.10101c69
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.1003efa0
mov byte [ebp - 0x64], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x63]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x6c], 0x3f
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x68]
call fcn.10001290
mov byte [ebp - 4], 2
cmp dword [0x101cf008], 0
je 0x1004df56
je 0x1004dedd
jne 0x1004dedd
call fcn.100c62f0
add byte [eax], al
je 0x1004deea
jne 0x1004deea
jmp 0x60a1247b
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x101cf1d2
push 0x101cf1a0
mov eax, dword [0x101cf19c]
push eax
push 0x101cf18a
push 0x101cf162
push 0x101cf13a
push 0x101cf126
lea ecx, [ebp - 0x24]
push ecx
push 0x101cf0e0
mov edx, dword [0x101cf0dc]
push edx
push 0x101cf078
mov eax, dword [0x101cf074]
push eax
push 0x101cf010
push 0x10
mov ecx, dword [0x101cf008]
push ecx
push 0x10174eb0
lea edx, [ebp - 0x68]
push edx
call fcn.10001360
add esp, 0x50
jmp 0x1004dfc8
je 0x1004df63
jne 0x1004df63
call 0x60a124f4
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x101cf9fa
push 0x101cf9c8
mov eax, dword [0x101cf9c4]
push eax
push 0x101cf9b2
push 0x101cf98a
push 0x101cf962
push 0x101cf94e
lea ecx, [ebp - 0x24]
push ecx
push 0x101cf908
mov edx, dword [0x101cf904]
push edx
push 0x101cf8a0
mov eax, dword [0x101cf89c]
push eax
push 0x101cf838
push 0x10
push 9
push 0x10174eb0
lea ecx, [ebp - 0x68]
push ecx
call fcn.10001360
add esp, 0x50
push 0
lea ecx, [ebp - 0x68]
call fcn.100585f0
push eax
push 0xd
call fcn.1004d660
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
call fcn.1003efa0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.1003efa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.1003efa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1010122d
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10053280
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
ret

Function at 0x10053590
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x101b9578]
push ebx
push edi
push 1
mov dword [esp + 0x128], eax
call fcn.10010aa0
add esp, 4
test eax, eax
je 0x10053665
push 0x101758d4
push 2
call fcn.1001b560
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x20], bl
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
push str.uMSxVQ44lySXTp8J5FvRUQoxB3R8gbB7YWWMEV4EyWhEtQWtxltvK60Kb_qNWqp
call fcn.1001c1f0
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [esp + 0x34]
push eax
push SysReAllocString
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10053665
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
push str.lvZXJNbGE8jpjYWzI98ieQ
call fcn.1001c1f0
mov ecx, dword [esp + 0x14]
add esp, 8
push 4
lea edx, [esp + 0x18]
push edx
push 4
push ebx
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x124]
call fcn.1010122d
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10053e20
Capabilities:
Resolve dns
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwarePubwin
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov esi, dword [esp + 0x10]
jne 0x10053e84
mov eax, dword [esi]
mov edx, dword [eax - 0xc]
inc edx
push edx
push eax
mov eax, dword [esp + 0xc]
push 1
push 0
push str.DeCenterIP
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10053e94
push eax
push str.RegCreateKeyEx:_d
push 4
call fcn.1008a780
add esp, 0xc
mov ecx, dword [esi]
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x10053ea7
push 0x80070057
call fcn.10001050
mov dl, byte [ecx]
cmp dl, 0x30
jl 0x10053ed4
cmp dl, 0x39
jg 0x10053ed4
cmp eax, 0x28
jge 0x10053f2f
mov edx, 0x101cfa6c
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x10053ec0
mov eax, 1
pop esi
add esp, 8
ret
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10053efb
mov edx, dword [esi]
push edx
push str._s_:unkown_host
push 2
call fcn.1001b560
add esp, 0xc
mov eax, 1
pop esi
add esp, 8
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, eax
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10053f10
sub ecx, esi
cmp ecx, 0x28
jae 0x10053f2f
mov edx, 0x101cfa6c
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10053f25
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x10053f40
Capabilities:
Resolve dns
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x10163198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwarePubwin
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], 0
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov esi, dword [esp + 0x1c]
jne 0x10053fbf
mov eax, dword [esi - 0xc]
mov edx, dword [esp + 4]
inc eax
push eax
push esi
push 1
push 0
push str.DeGlobalIP
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10053fcf
push eax
push str.RegCreateKeyEx:_d
push 4
call fcn.1008a780
add esp, 0xc
mov eax, dword [esi - 0xc]
test eax, eax
jge 0x10053fe0
push 0x80070057
call fcn.10001050
mov cl, byte [esi]
cmp cl, 0x30
jl 0x1005400c
cmp cl, 0x39
jg 0x1005400c
cmp eax, 0x28
jge 0x10054060
mov edx, 0x101cfa94
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10054000
jmp 0x10054060
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10054029
push esi
push str._s_:unkown_host
push 2
call fcn.1001b560
add esp, 0xc
jmp 0x10054060
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edi
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, eax
lea edi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10054040
sub ecx, edi
cmp ecx, 0x28
pop edi
jae 0x10054060
mov edx, 0x101cfa94
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10054056
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10054082
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x100543a0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101631db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2ac
mov eax, dword [0x101b9578]
push esi
mov dword [esp + 0x2a8], eax
push edi
lea eax, [esp + 0x118]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x10054402
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WSAStartup_error__d_
push 4
call fcn.1008a780
add esp, 0xc
jmp 0x1005454e
mov byte [esp + 0x18], 0
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
push 0xfe
lea ecx, [esp + 0x1c]
push ecx
stosw word es:[edi], ax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x1005452f
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1005452f
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, 0x101cfd0c
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x10054454
xor eax, eax
mov dword [esp + 0x11], eax
mov byte [esp + 0x10], cl
mov byte [esp + 0x15], al
mov dword [esp + 0xc], 6
call fcn.10152999
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 8], esi
push 0x101cfd0c
mov dword [esp + 0x2c0], 0
call dword [sym.imp.WS2_32.dll_inet_addr]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push eax
call sub.iphlpapi.dll_SendARP
test eax, eax
jne 0x1005450a
movzx eax, byte [esp + 0x15]
movzx ecx, byte [esp + 0x14]
movzx edx, byte [esp + 0x13]
push eax
movzx eax, byte [esp + 0x16]
push ecx
movzx ecx, byte [esp + 0x19]
push edx
movzx edx, byte [esp + 0x1c]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push str._02x_02x_02x_02x_02x_02x
push eax
call fcn.10001360
add esp, 0x20
lea ecx, [esp + 8]
call fcn.10016300
mov esi, dword [esp + 8]
mov edx, 0x101cfd34
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10054500
lea eax, [esi - 0x10]
mov dword [esp + 0x2bc], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1005452f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x101cfd34
push 0x101cfd0c
push str.IP:_s__Mac:_s
push 2
call fcn.1001b560
add esp, 0x10
mov ecx, dword [esp + 0x2b4]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2ac]
call fcn.1010122d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100562b0
Capabilities:
Resume thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10163418
push eax
mov eax, dword [0x101b2578]
mov dword fs:[0], esp
sub esp, 8
test eax, eax
je 0x10056481
mov eax, dword [0x101c81b4]
test eax, eax
push ebx
push esi
mov esi, 1
jne 0x100562ff
push 0
push 0
push 0
push 0
push 0
push 0x10056020
mov dword [0x101c81b4], esi
call fcn.10152763
call fcn.10152999
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
push 0x101cfac0
lea eax, [esp + 0xc]
push str._shintva.dll
push eax
mov dword [esp + 0x24], 0
call fcn.10001360
mov ecx, dword [esp + 0x14]
push 0
push ecx
call fcn.101507ae
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
add esp, 0x14
test eax, eax
jne 0x1005636c
push 0x10175e9c
push 2
call fcn.1008a780
add esp, 8
push 0
push 0
push 0
push 0
push 0
push 0x100016e0
call fcn.10152763
jmp 0x100563dc
push 0x101cfac0
lea edx, [esp + 0xc]
push str._shintsok.dll
push edx
call fcn.10001360
mov eax, dword [esp + 0x14]
push 0
push eax
call fcn.101507ae
add esp, 0x14
test eax, eax
jne 0x100563cd
mov eax, dword [0x101c7ff4]
test eax, eax
jne 0x100563cd
push 0
push 4
push 0
push 0
push 0x1016787c
mov dword [0x101c3860], esi
call fcn.101527e5
test eax, eax
mov dword [0x101c7ff4], eax
je 0x100563c3
mov ecx, dword [eax + 0x28]
push ecx
call ebx
mov dword [esp + 0x18], 0
jmp 0x100563dc
push 0x10175e98
push 4
call fcn.1008a780
add esp, 8
push 0
push 0
push 0
push 0
push 0
push 0x10001570
call fcn.10152763
push 0x101cfac0
lea edx, [esp + 0xc]
push str._smspopxy.dll
push edx
call fcn.10001360
mov esi, dword [esp + 0x14]
push 0
push esi
call fcn.101507ae
add esp, 0x14
test eax, eax
jne 0x10056441
mov eax, dword [0x101c7ff4]
test eax, eax
jne 0x10056441
push 0
push 4
push 0
push 0
push 0x1016787c
call fcn.101527e5
test eax, eax
mov dword [0x101c7ff4], eax
je 0x10056441
mov eax, dword [eax + 0x28]
push eax
call ebx
push 0
push 0
push 0
push 0
push 0
push 0x10001850
mov dword [esp + 0x30], 0
call fcn.10152763
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop esi
pop ebx
jg 0x10056481
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1006c9f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x20
push str.BEqEKPqGhmtNa3xthcYEgKRS5GeaHXhE
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x3f1
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x34]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmszmUN9RmwtLBw7q6rKz0cy
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x38]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmsH9DaRSMwlclRBIhVvpGX
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x3c]
call fcn.100025e0
push 0x2c
push str.8M6QhtBsA3ZAc1xfKYfPBiM4YlSFvvmA1iKaqeE2Hc
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0xc
push str.WmobnHXWkqw
lea ecx, [esi + 0x40]
call fcn.100025e0
push 0x20
push str.8M6QhtBsA216EGaRYEazgNYimqnhNh3
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.WmobnHXWkqw
lea ecx, [esi + 0x44]
call fcn.100025e0
push 0x20
push str.8M6QhtBsA3Wc2tHdQ8V2YaP9_9lNNUp
lea ecx, [esi + 0x30]
call fcn.100025e0
push 0xc
push str.WmobnHXWkqw
lea ecx, [esi + 0x48]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov dword [esi + 0x60], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1006cb00
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x18
push str.TWt8bYXGBIDxQ_Mpr3nTjA
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x3f3
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x34]
call fcn.100025e0
push 0xc
push str.l3aPCvyPwD8
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x38]
call fcn.100025e0
push 0x18
push str.MuprfsXnQFwUgZG6xAr5JQ
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x3c]
call fcn.100025e0
push 0x18
push str.vxJsjbemDFQm45XZBDBiQ
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x40]
call fcn.100025e0
push 0x18
push str.KZlXqZkGKp8m45XZBDBiQ
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x44]
call fcn.100025e0
push 0x18
push str.OkHf9LCrC1tmk5lmow9zcw
lea ecx, [esi + 0x30]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x48]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1006cc10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x18
push str.B48NwkuSznYA6jZkCkcDQ
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x3f4
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0xc
push str.0L4NTLPfzak
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0xc
push str.3yj9CiQRaZE
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0xc
push str.Zxy8gI0YSw4
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0xc
push str.Ya3n_rDmMD8
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.BA7ns0we55s
lea ecx, [esi + 0x30]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov dword [esi + 0x60], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1006ccd0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x20
push str.BEqEKPqGhmtNa3xthcYEgKRS5GeaHXhE
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x3f5
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x34]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmszmUN9RmwtLBw7q6rKz0cy
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x38]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmsH9DaRSMwlclRBIhVvpGX
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x3c]
call fcn.100025e0
push 0x2c
push str.8M6QhtBsA3ZAc1xfKYfPBiM4YlSFvvmA1iKaqeE2Hc
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0xc
push str.WmobnHXWkqw
lea ecx, [esi + 0x40]
call fcn.100025e0
push 0x20
push str.8M6QhtBsA216EGaRYEazgNYimqnhNh3
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.WmobnHXWkqw
lea ecx, [esi + 0x44]
call fcn.100025e0
push 0x20
push str.8M6QhtBsA3Wc2tHdQ8V2YaP9_9lNNUp
lea ecx, [esi + 0x30]
call fcn.100025e0
push 0xc
push str.WmobnHXWkqw
lea ecx, [esi + 0x48]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov dword [esi + 0x60], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1006cde0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x18
push str.B48NwkuSznYA6jZkCkcDQ
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x429
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0x18
push str.FVXnNuhJxKxEeZIAbEPDLA
lea ecx, [esi + 0x34]
call fcn.100025e0
push 0x18
push str.FVXnNuhJxKxEeZIAbEPDLA
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0x18
push str.ZpbbcijKdVwrSPh7Hdkg
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0xc
push str.Zxy8gI0YSw4
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0xc
push str.Ya3n_rDmMD8
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.BA7ns0we55s
lea ecx, [esi + 0x30]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1006cea0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x18
push str.TWt8bYXGBICICFzrMTizpg
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x41d
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x34]
call fcn.100025e0
push 0x18
push str.M5lDfUZsLSy6UTrNhReNbw
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x38]
call fcn.100025e0
push 0x18
push str.vxJsjbemDFQm45XZBDBiQ
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x40]
call fcn.100025e0
push 0x18
push str.KZlXqZkGKp8m45XZBDBiQ
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x44]
call fcn.100025e0
push 0x18
push str.OkHf9LCrC1tmk5lmow9zcw
lea ecx, [esi + 0x30]
call fcn.100025e0
push 0xc
push str.WTxELuIMxbg
lea ecx, [esi + 0x48]
call fcn.100025e0
push 0xc
push str.QvhOoTWowI
lea ecx, [esi + 0x58]
call fcn.100025e0
push 0xc
push str.6hn__TcPl1A
lea ecx, [esi + 0x5c]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret