joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0xf], 0x70617664
push eax
mov word [ebp - 6], 0x6c6c
mov byte [ebp - 0x10], 0x41
mov dword [ebp - 0xb], 0x2e323369
mov byte [ebp - 4], 0
mov byte [ebp - 7], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0xf], 0x656e7265
push eax
mov dword [ebp - 7], 0x6c6c64
mov dword [ebp - 0xb], 0x2e32336c
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret

Function at 0x100095b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 6], 0x2e69
push eax
mov dword [ebp - 0xc], 0x776c6853
mov word [ebp - 3], 0x6c6c
mov word [ebp - 8], 0x7061
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x100095f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x72657355
push eax
mov word [ebp - 5], 0x6c64
mov word [ebp - 8], 0x3233
mov byte [ebp - 6], 0x2e
mov word [ebp - 3], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1000968b
lea ecx, [ebp - 0x10]
mov word [ebp - 8], 0x6f48
push ecx
push eax
mov word [ebp - 0xd], 0x4e6c
mov word [ebp - 0x10], 0x6143
mov dword [ebp - 5], 0x78456b
mov word [ebp - 0xb], 0x7865
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 9], 0x74
mov byte [ebp - 6], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000968b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100096a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 3], 0x656c
push eax
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 0xc], 0x736f6c43
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100096df
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100096f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xf], 0x53323370
push eax
mov dword [ebp - 0x13], 0x6c65686c
mov dword [ebp - 0x1c], 0x61657243
mov dword [ebp - 0xa], 0x68737061
mov dword [ebp - 0x17], 0x6f6f5465
mov word [ebp - 5], 0x74
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0xb], 0x6e
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000974b
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x10009760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
mov word [ebp - 7], 0x6f69
push eax
mov word [ebp - 0xd], 0x6c61
mov dword [ebp - 0x11], 0x63697469
mov word [ebp - 0xa], 0x6365
mov word [ebp - 0x15], 0x7265
mov word [ebp - 5], 0x6e
mov word [ebp - 0x18], 0x6e45
mov byte [ebp - 0x16], 0x74
mov word [ebp - 0x13], 0x7243
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 8], 0x74
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100097bc
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x100097c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
mov dword [ebp - 0x13], 0x74736e49
push eax
mov word [ebp - 0xe], 0x6375
mov word [ebp - 7], 0x6361
mov word [ebp - 4], 0x65
mov dword [ebp - 0xb], 0x436e6f69
mov byte [ebp - 0xc], 0x74
mov word [ebp - 0x18], 0x6c46
mov byte [ebp - 5], 0x68
mov word [ebp - 0x15], 0x6873
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0x16], 0x75
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009825
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10009830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x7250746e
push eax
mov dword [ebp - 0x14], 0x43746547
mov word [ebp - 5], 0x7373
mov dword [ebp - 0x10], 0x65727275
mov word [ebp - 8], 0x636f
mov byte [ebp - 3], 0
mov byte [ebp - 6], 0x65
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009879
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x10009880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov word [ebp - 6], 0x7365
push eax
mov dword [ebp - 0x13], 0x75437465
mov dword [ebp - 0xd], 0x50746e65
mov word [ebp - 3], 0x6449
mov word [ebp - 9], 0x6f72
mov byte [ebp - 4], 0x73
mov byte [ebp - 7], 0x63
mov byte [ebp - 1], 0
mov word [ebp - 0xf], 0x7272
mov byte [ebp - 0x14], 0x47
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100098d6
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100098e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe], 0x746e6572
push eax
mov dword [ebp - 0x13], 0x75437465
mov word [ebp - 5], 0x64
mov dword [ebp - 0xa], 0x65726854
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 6], 0x61
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009927
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10009930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 5], 0x644964
push eax
mov word [ebp - 0xc], 0x746e
mov word [ebp - 0x12], 0x4374
mov word [ebp - 0xf], 0x7272
mov word [ebp - 0x14], 0x6547
mov dword [ebp - 9], 0x61657268
mov byte [ebp - 0xa], 0x54
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x10], 0x75
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009982
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10009990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 6], 0x41656d61
push eax
mov dword [ebp - 0x14], 0x4d746547
mov dword [ebp - 0xe], 0x46656c75
mov dword [ebp - 0xa], 0x4e656c69
mov byte [ebp - 2], 0
mov word [ebp - 0x10], 0x646f
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100099df
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100099f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x666e496d
push eax
mov dword [ebp - 0xc], 0x65747379
mov word [ebp - 4], 0x6f
mov dword [ebp - 0x10], 0x53746547
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009a2a
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x10009a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x54746547
push eax
mov word [ebp - 8], 0x6574
mov word [ebp - 0xe], 0x6165
mov word [ebp - 0xb], 0x6f43
mov word [ebp - 6], 0x7478
mov byte [ebp - 9], 0x6e
mov word [ebp - 0x10], 0x7268
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 4], 0
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009a87
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10009a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 6], 0x797469
push eax
mov dword [ebp - 0x14], 0x54746547
mov dword [ebp - 0xa], 0x726f6972
mov dword [ebp - 0x10], 0x61657268
mov word [ebp - 0xc], 0x5064
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009ad5
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
mov eax, 0x7fffffff
mov esp, ebp
pop ebp
ret

Function at 0x10009ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x74696e49
push eax
mov dword [ebp - 8], 0x6f697463
mov dword [ebp - 0x12], 0x74697243
mov word [ebp - 0x15], 0x7a69
mov word [ebp - 0x18], 0x6169
mov word [ebp - 4], 0x6e
mov dword [ebp - 0xc], 0x65536c61
mov byte [ebp - 0x13], 0x65
mov word [ebp - 0xe], 0x6369
mov byte [ebp - 0x16], 0x6c
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009b3b
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x10009b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
mov dword [ebp - 0xf], 0x6c616369
push eax
mov dword [ebp - 0x13], 0x74697243
mov dword [ebp - 0x18], 0x7661654c
mov word [ebp - 8], 0x6974
mov word [ebp - 0xb], 0x6553
mov word [ebp - 5], 0x6e
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 9], 0x63
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009b92
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x10009ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 3], 0x64
push eax
mov word [ebp - 6], 0x6572
mov word [ebp - 9], 0x546e
mov word [ebp - 0xc], 0x704f
mov byte [ebp - 7], 0x68
mov byte [ebp - 4], 0x61
mov byte [ebp - 0xa], 0x65
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009bed
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10009c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10009540
test eax, eax
je 0x10009c43
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xb], 0x6c436765
push ecx
push eax
mov dword [ebp - 5], 0x79654b65
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x52
mov word [ebp - 7], 0x736f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009c43
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10009c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009540
test eax, eax
je 0x10009ca5
lea ecx, [ebp - 0x10]
mov word [ebp - 0xb], 0x6e65
push ecx
push eax
mov dword [ebp - 8], 0x78457965
mov dword [ebp - 0xf], 0x704f6765
mov word [ebp - 4], 0x41
mov byte [ebp - 9], 0x4b
mov byte [ebp - 0x10], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009ca5
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10009cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009540
test eax, eax
je 0x10009d0b
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xd], 0x6c615679
push ecx
push eax
mov dword [ebp - 0x14], 0x51676552
mov dword [ebp - 9], 0x78456575
mov word [ebp - 0x10], 0x6575
mov word [ebp - 5], 0x41
mov byte [ebp - 0xe], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009d0b
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10009d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x75736552
push eax
mov dword [ebp - 0xc], 0x6854656d
mov dword [ebp - 8], 0x64616572
mov byte [ebp - 4], 0
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009d5c
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x10009d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov word [ebp - 4], 0x79
push eax
mov dword [ebp - 0xf], 0x655a6c74
mov word [ebp - 0xa], 0x4d6f
mov word [ebp - 7], 0x6f6d
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 8], 0x65
mov byte [ebp - 5], 0x72
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009dbb
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x10009dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov word [ebp - 9], 0x6f69
push eax
mov dword [ebp - 7], 0x79746972
mov dword [ebp - 0xe], 0x50646165
mov dword [ebp - 0x12], 0x72685474
mov word [ebp - 0x14], 0x6553
mov byte [ebp - 3], 0
mov byte [ebp - 0xa], 0x72
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009e0f
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10009eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x54646e65
push eax
mov dword [ebp - 6], 0x646165
mov word [ebp - 0xf], 0x7375
mov word [ebp - 8], 0x7268
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0x10], 0x53
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009ef5
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x10009f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x65726854
push eax
mov word [ebp - 4], 0x74
mov dword [ebp - 0xc], 0x32336461
mov word [ebp - 7], 0x7269
mov byte [ebp - 5], 0x73
mov byte [ebp - 8], 0x46
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009f48
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10009f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x7478654e
push eax
mov word [ebp - 0xe], 0x6572
mov word [ebp - 0xb], 0x3364
mov byte [ebp - 4], 0
mov word [ebp - 0x10], 0x6854
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 9], 0x32
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009f9b
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10009fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov word [ebp - 8], 0x6c6c
push eax
mov dword [ebp - 0xd], 0x6c617574
mov word [ebp - 0xf], 0x7269
mov word [ebp - 5], 0x63
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0x10], 0x56
mov byte [ebp - 9], 0x41
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a001
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 6], 0x6572466c
push eax
mov dword [ebp - 0xc], 0x74726956
mov word [ebp - 8], 0x6175
mov word [ebp - 2], 0x65
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a053
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x506c6175
push eax
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0xb], 0x6365746f
mov byte [ebp - 0xc], 0x72
mov dword [ebp - 7], 0x784574
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a0af
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x6956
push eax
mov dword [ebp - 0xd], 0x6c617574
mov dword [ebp - 7], 0x797265
mov word [ebp - 9], 0x7551
mov byte [ebp - 0xe], 0x72
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a107
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0x104
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x10], 0
push 0
push eax
call fcn.1000cb00
lea eax, [ebp - 0x28]
mov word [ebp - 2], 0x73
push eax
mov dword [ebp - 0xb], 0x5754464f
mov dword [ebp - 7], 0x5c455241
mov byte [ebp - 3], 0x25
mov byte [ebp - 0xc], 0x53
call fcn.1000b420
add esp, 0x10
mov ecx, eax
call fcn.1000ba50
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.1000bbe0
add esp, 0x14
lea ecx, [ebp - 0x28]
call fcn.1000b400
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x12c]
push eax
call fcn.1000b3d0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x1000a290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1000a2d3
lea ecx, [ebp - 0x14]
mov word [ebp - 0xb], 0x776f
push ecx
push eax
mov dword [ebp - 0x10], 0x6e695767
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 9], 0x6f546f54
mov word [ebp - 5], 0x70
mov byte [ebp - 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1000a326
lea ecx, [ebp - 0x14]
mov dword [ebp - 6], 0x6f646e69
push ecx
push eax
mov dword [ebp - 0x14], 0x46746553
mov word [ebp - 2], 0x77
mov dword [ebp - 0xc], 0x6e756f72
mov dword [ebp - 0x10], 0x6765726f
mov word [ebp - 8], 0x5764
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1000a373
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xb], 0x776f646e
push ecx
push eax
mov word [ebp - 0x10], 0x6553
mov word [ebp - 6], 0x736f
mov word [ebp - 0xd], 0x6957
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 4], 0
mov byte [ebp - 7], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000ac30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1000ac71
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xa], 0x57657669
push ecx
push eax
mov dword [ebp - 0x10], 0x41746553
mov dword [ebp - 5], 0x776f646e
mov word [ebp - 0xc], 0x7463
mov byte [ebp - 6], 0x69
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000ac80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x114
cmp eax, 1
jne 0x1000ad45
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.10009990
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x70707573
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0xd], 0x746e6174
push eax
mov dword [ebp - 4], 0x74726f
mov byte [ebp - 9], 0x20
mov word [ebp - 0x10], 0x6e69
mov byte [ebp - 0xe], 0x73
call fcn.10009e60
add esp, 0x14
test eax, eax
jne 0x1000ad74
push sym.drvhlp.dll_knv2fr
push 0x1004a078
call fcn.1000a610
add esp, 8
test eax, eax
je 0x1000ad74
push sym.drvhlp.dll_sxexzs
push 0x1004a028
call fcn.1000a610
add esp, 8
test eax, eax
je 0x1000ad74
push sym.drvhlp.dll_syla9b
push 0x1004a050
call fcn.1000a610
add esp, 8
test eax, eax
je 0x1000ad74
push sym.drvhlp.dll_z566ab
push 0x1004a04c
call fcn.1000a610
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1000ad74
push 0x1004a078
call fcn.1000b0e0
push 0x1004a028
call fcn.1000b0e0
push 0x1004a050
call fcn.1000b0e0
push 0x1004a04c
call fcn.1000b0e0
add esp, 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc