joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cb7b2
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x278], 0
mov ecx, 0x5c
mov word [ebp - 0x2a], ax
mov dword [ebp - 4], 0
lea edx, [eax + 0x72]
mov dword [ebp - 0x27c], esi
mov word [ebp - 0x34], dx
mov eax, 0x74
lea edx, [ecx + 0xd]
mov dword [ebp - 0x4c], 0x6f0073
mov dword [ebp - 0x2e], 0x790068
mov dword [ebp - 0x3e], 0x700079
mov dword [ebp - 0x64], 0x540046
mov dword [ebp - 0x48], 0x740066
mov dword [ebp - 0x5c], 0x450052
mov dword [ebp - 0x68], 0x4f0053
mov dword [ebp - 0x60], 0x410057
mov dword [ebp - 0x38], 0x67006f
mov dword [ebp - 0x32], 0x700061
mov dword [ebp - 0x42], 0x720043
mov dword [ebp - 0x58], 0x4d005c
mov word [ebp - 0x44], cx
mov dword [ebp - 0x50], 0x6f0072
mov dword [ebp - 0x54], 0x630069
mov word [ebp - 0x3a], ax
mov dword [ebp - 0x1e], 0x65006e
mov dword [ebp - 0x28], 0x61004d
mov dword [ebp - 0x24], 0x680063
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 0x1a], 0x750047
mov word [ebp - 0x16], dx
mov word [ebp - 0x20], dx
mov dword [esi], 0
call fcn.100024b5
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x10009df9
push 0x80004005
call fcn.10002d1a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x1ff
lea eax, [ebp - 0x267]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x278], 1
mov byte [ebp - 0x268], 0
call fcn.1003e130
lea eax, [ebp - 0x274]
mov dword [ebp - 0x26c], 0x200
push eax
push 0x20019
push 0
lea eax, [ebp - 0x68]
push eax
push reloc.WS2_32.dll_bind
call fcn.10018330
add esp, 0x20
test eax, eax
jne 0x10009ef8
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x274]
call fcn.100183c0
add esp, 0x18
test eax, eax
je 0x10009edc
lea eax, [ebp - 0x274]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x68]
push eax
push reloc.WS2_32.dll_bind
call fcn.10018330
add esp, 0x14
test eax, eax
jne 0x10009ef8
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x270]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x274]
call fcn.100183c0
add esp, 0x18
test eax, eax
jne 0x10009ef8
lea eax, [ebp - 0x268]
mov ecx, esi
push eax
call fcn.100066a0
push dword [ebp - 0x274]
call fcn.10018120
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x1000acd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cb992
mov eax, dword fs:[0]
push eax
sub esp, 0xc9c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0xca4], 0
push 0x100dd804
mov dword [ebp - 4], 0
mov dword [ebp - 0xca8], edi
mov dword [edi], 0
call fcn.10005500
mov eax, 0x43
mov dword [ebp - 4], 0
mov word [ebp - 0x5c], ax
mov ecx, 0x72
mov eax, 0x52
mov dword [ebp - 0xca4], 1
mov word [ebp - 0x8c], ax
mov esi, 0x6f
mov eax, 0x4d
mov dword [ebp - 0x5a], 0x720075
mov word [ebp - 0x86], ax
mov eax, 0x65
mov word [ebp - 0x4c], ax
mov eax, ecx
push 0x7fc
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0xc94]
push 0
push eax
mov dword [ebp - 0x72], 0x690057
mov dword [ebp - 0x84], 0x630069
mov dword [ebp - 0x90], 0x410057
mov dword [ebp - 0x8a], 0x5c0045
mov dword [ebp - 0x98], 0x4f0053
mov dword [ebp - 0x7e], 0x73006f
mov dword [ebp - 0x7a], 0x66006f
mov dword [ebp - 0x4a], 0x730072
mov dword [ebp - 0x94], 0x540046
mov dword [ebp - 0x64], 0x4e0020
mov dword [ebp - 0x54], 0x6e0065
mov dword [ebp - 0x46], 0x6f0069
mov dword [ebp - 0x76], 0x5c0074
mov dword [ebp - 0x60], 0x5c0054
mov dword [ebp - 0x50], 0x560074
mov dword [ebp - 0x68], 0x730077
mov dword [ebp - 0x6e], 0x64006e
mov word [ebp - 0x56], cx
mov word [ebp - 0x80], cx
mov dword [ebp - 0x42], 0x6e
mov word [ebp - 0x6a], si
mov dword [ebp - 0x2a], 0x64006f
mov dword [ebp - 0x26], 0x630075
mov dword [ebp - 0x30], 0x50006c
mov dword [ebp - 0x34], 0x610074
mov dword [ebp - 0x22], 0x490074
mov dword [ebp - 0x38], 0x690067
mov dword [ebp - 0x1e], 0x64
mov dword [ebp - 0x3c], 0x690044
mov dword [ebp - 0xc98], 0
call fcn.1003e130
lea eax, [ebp - 0xca0]
mov dword [ebp - 0xc9c], 0x800
push eax
push 0x101
push 0
lea eax, [ebp - 0x98]
push eax
push reloc.WS2_32.dll_bind
call fcn.10018330
add esp, 0x20
test eax, eax
jne 0x1000af65
lea eax, [ebp - 0xc9c]
push eax
lea eax, [ebp - 0xc98]
push eax
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0xca0]
call fcn.100183c0
add esp, 0x18
test eax, eax
jne 0x1000af57
push 0x3ff
push eax
mov byte [ebp - 0x498], al
lea eax, [ebp - 0x497]
push eax
call fcn.1003e130
push dword [ebp - 0xc9c]
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0xc98]
push eax
call fcn.100073f0
mov eax, 0x25
mov dword [ebp - 0x16], 0x73
mov word [ebp - 0x18], ax
add esp, 0x18
lea eax, [ebp - 0x498]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000af17
sub eax, edx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x1000af2f
xor eax, eax
jmp 0x1000af49
lea eax, [esi + esi]
call fcn.1003da80
mov eax, esp
lea ecx, [ebp - 0x498]
push 3
push esi
push ecx
push eax
call fcn.10007320
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.10008630
add esp, 0xc
push dword [ebp - 0xca0]
call fcn.10018120
add esp, 4
mov eax, edi
lea esp, [ebp - 0xcb8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x1000afc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x38], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x32336c65
push eax
mov byte [ebp - 8], 0
mov dword [ebp - 0x10], 0x6e72656b
mov word [ebp - 0x17], 0x636f
mov word [ebp - 0x14], 0x7373
mov dword [ebp - 0x1d], 0x3436776f
mov word [ebp - 0x19], 0x7250
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x12], 0
mov word [ebp - 0x20], 0x7349
mov byte [ebp - 0x1e], 0x57
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000b07b
lea eax, [ebp - 0x34]
mov dword [ebp - 0x33], 0x75437465
push eax
lea eax, [ebp - 0x10]
mov word [ebp - 0x24], 0x73
push eax
mov dword [ebp - 0x29], 0x65636f72
mov dword [ebp - 0x2d], 0x50746e65
mov word [ebp - 0x2f], 0x7272
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x25], 0x73
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000b07b
lea ecx, [ebp - 0x38]
push ecx
call eax
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
xor ecx, ebp
pop esi
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x1000c990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
mov dword [ebp - 0x48], eax
xor esi, esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], 1
push eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 0x64
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], 0x64
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0x64
mov word [ebp - 0x10], 0x6970
mov dword [ebp - 0xd], 0x6c642e32
mov word [ebp - 9], 0x6c
mov dword [ebp - 0x14], 0x61766441
mov byte [ebp - 0xe], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000ca72
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x27], 0x72655365
push eax
push edi
mov dword [ebp - 0x22], 0x43656369
mov word [ebp - 0x18], 0x41
mov dword [ebp - 0x2b], 0x676e6168
mov word [ebp - 0x1b], 0x6769
mov byte [ebp - 0x2c], 0x43
mov word [ebp - 0x1e], 0x6e6f
mov byte [ebp - 0x23], 0x76
mov byte [ebp - 0x1c], 0x66
mov byte [ebp - 0x19], 0x32
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ca6b
lea ecx, [ebp - 0x58]
push ecx
push 2
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x1000cb90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xd], 0x6c642e32
push eax
mov dword [ebp - 0x14], 0x61766441
mov word [ebp - 0x10], 0x6970
mov word [ebp - 9], 0x6c
mov byte [ebp - 0xe], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x1000d060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x2c], eax
mov esi, 1
mov eax, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x28], eax
call fcn.1000cb90
mov edi, eax
test edi, edi
je 0x1000d0ff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x17], 0x75516765
push eax
push edi
mov word [ebp - 0xb], 0x7845
mov word [ebp - 0x11], 0x5679
mov word [ebp - 0xe], 0x756c
mov word [ebp - 9], 0x41
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x18], 0x52
mov word [ebp - 0x13], 0x7265
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d0f8
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100136f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x100f484c], eax
mov eax, dword [ebp + 0x10]
mov dword [0x100f4850], eax
mov eax, dword [ebp + 0xc]
mov dword [0x100f4854], eax
lea eax, [ebp - 0x24]
push 4
push eax
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], 1
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x19], 0x54495c65
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x20], 0x74666f53
mov word [ebp - 0x1c], 0x6177
mov word [ebp - 0x15], 0x41
mov byte [ebp - 0x1a], 0x72
mov dword [ebp - 8], 0x454964
mov dword [ebp - 0xf], 0x6174736e
mov byte [ebp - 0x10], 0x49
mov word [ebp - 0xb], 0x6c6c
mov byte [ebp - 9], 0x65
call fcn.100187e0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100149d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1424
call fcn.1003dab0
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x100f484c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [0x100f4850], eax
mov eax, dword [ebp + 0xc]
push 0x3ff
mov dword [0x100f4854], eax
lea eax, [ebp - 0x81b]
push 0
push eax
mov byte [ebp - 0x81c], 0
call fcn.1003e130
lea eax, [ebp - 0x81c]
push eax
call fcn.10010f40
push 0x3ff
lea eax, [ebp - 0x101b]
mov byte [ebp - 0x101c], 0
push 0
push eax
call fcn.1003e130
lea eax, [ebp - 0x101c]
push eax
call fcn.10010f40
push 0x3ff
lea eax, [ebp - 0x141b]
mov byte [ebp - 0x141c], 0
push 0
push eax
call fcn.1003e130
lea eax, [ebp - 0x141c]
push eax
call fcn.10010f40
push 0x3ff
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x41c], 0
push 0
push eax
call fcn.1003e130
lea eax, [ebp - 0x41c]
push eax
call fcn.10010f40
add esp, 0x40
mov byte [ebp - 0xc1c], 0
lea eax, [ebp - 0xc1b]
push 0x3ff
push 0
push eax
call fcn.1003e130
lea eax, [ebp - 0xc1c]
push eax
call fcn.10010f40
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x13], 0x55434b
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x48
push eax
xor esi, esi
call fcn.1003cff6
test eax, eax
mov word [ebp - 0xc], 0x4b48
lea eax, [ebp - 0x81c]
mov word [ebp - 9], 0x4d
push eax
lea eax, [ebp - 0xc]
mov byte [ebp - 0xa], 0x4c
mov ecx, reloc.WS2_32.dll_accept
push eax
cmove esi, ecx
call fcn.1003cff6
test eax, eax
mov word [ebp - 0x1420], 0x5a53
mov ecx, reloc.WS2_32.dll_bind
mov byte [ebp - 0x141e], 0
cmove esi, ecx
mov word [ebp - 0x1b], 0x4f57
mov byte [ebp - 0x1c], 0x44
mov word [ebp - 0x18], 0x44
mov byte [ebp - 0x19], 0x52
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.1003cff6
add esp, 0x28
test eax, eax
jne 0x10014b99
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014b60
sub eax, edx
push eax
lea eax, [ebp - 0x41c]
push eax
push 1
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x101c]
push eax
push esi
call fcn.100187e0
add esp, 0x18
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003cff6
add esp, 8
test eax, eax
jne 0x10014be4
lea eax, [ebp - 0x41c]
push eax
call fcn.1003b60f
mov dword [ebp - 0x1424], eax
lea eax, [ebp - 0x1424]
push 4
push eax
push 4
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x101c]
push eax
push esi
call fcn.100187e0
add esp, 0x1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100150e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc090
mov eax, dword fs:[0]
push eax
sub esp, 0xcc0
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xccc], ebx
mov dword [ebp - 0xcbc], 0
push 0x3ff
lea eax, [ebp - 0x443]
mov dword [ebp - 4], 1
push 0
push eax
mov byte [ebp - 0x444], 0
call fcn.1003e130
mov edx, dword [ebp + 0x1c]
add esp, 0xc
xor ecx, ecx
test edx, edx
je 0x1001516c
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0xc]
cmp esi, 0x10
lea eax, [ebp + 0xc]
cmovae eax, edi
mov al, byte [eax + ecx]
mov byte [ebp + ecx - 0x444], al
inc ecx
cmp ecx, edx
jb 0x10015154
push 0x3ff
lea eax, [ebp - 0x843]
mov byte [ebp - 0x844], 0
xorps xmm0, xmm0
push 0
push eax
movdqu xmmword [ebp - 0x44], xmm0
call fcn.1003e130
lea eax, [ebp - 0x34]
mov dword [ebp - 0x26], 0x32443646
push eax
lea eax, [ebp - 0x844]
mov dword [ebp - 0x31], 0x32344437
push 0x400
push eax
mov dword [ebp - 0x2a], 0x39453741
mov dword [ebp - 0x17], 0x393946
mov dword [ebp - 0x1b], 0x38364643
mov word [ebp - 0x2d], 0x4443
mov dword [ebp - 0x21], 0x42413436
mov word [ebp - 0x34], 0x3843
mov byte [ebp - 0x22], 0x42
mov word [ebp - 0x1d], 0x4243
mov byte [ebp - 0x2b], 0x32
mov byte [ebp - 0x32], 0x38
call fcn.1003e6ed
add esp, 0x18
lea ecx, [ebp - 0xcb8]
call fcn.1001a0f0
push 0x10
push 0x20
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0xcb8]
call fcn.1001b190
push dword [ebp + 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0xcc0], 0
lea ecx, [ebp - 0xcc8]
movq qword [ebp - 0xcc8], xmm0
call fcn.10014d80
mov eax, dword [ebp - 0xcc4]
lea ecx, [ebp - 0xcb8]
mov esi, dword [ebp - 0xcc8]
sub eax, esi
push 1
push eax
push esi
lea eax, [ebp - 0x444]
mov byte [ebp - 4], 3
push eax
call fcn.1001ad40
push dword [ebp + 0x1c]
push esi
push ebx
call fcn.10015970
add esp, 0xc
mov dword [ebp - 0xcbc], 1
test esi, esi
je 0x10015286
push esi
call fcn.1003a126
add esp, 4
lea ecx, [ebp - 0xcb8]
mov byte [ebp - 4], 1
call fcn.1001a100
cmp dword [ebp + 0x20], 0x10
jb 0x100152a6
push dword [ebp + 0xc]
call fcn.1003a126
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x10017020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov byte [ebp - 0x1c], 0x4e
mov dword [ebp - 0x13], 0x4d282063
mov dword [ebp - 0xb], 0x29616c
mov word [ebp - 0x1b], 0x4953
mov word [ebp - 0x18], 0x495f
mov dword [ebp - 0xf], 0x6c697a6f
mov word [ebp - 0x15], 0x7465
mov byte [ebp - 0x19], 0x53
mov byte [ebp - 0x16], 0x6e
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
jne 0x10017089
xor ecx, ecx
jmp 0x10017099
lea ecx, [ebp - 0x1c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017090
sub ecx, edx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.10002052
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0xa], 0x6c6c
push eax
mov word [ebp - 0x10], 0x6970
mov word [ebp - 0xd], 0x2e32
mov byte [ebp - 8], 0
mov dword [ebp - 0x14], 0x61766441
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xe], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x13], 0x7265
push eax
mov dword [ebp - 0x10], 0x32336c65
mov word [ebp - 0xc], 0x642e
mov word [ebp - 9], 0x6c
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x14], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100171a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xb], 0x6c6c64
push eax
mov dword [ebp - 0x14], 0x6174654e
mov dword [ebp - 0x10], 0x32336970
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov word [ebp - 7], 0x6c6c
push eax
mov word [ebp - 0xf], 0x6568
mov dword [ebp - 0xc], 0x2e32336c
mov byte [ebp - 5], 0
mov byte [ebp - 8], 0x64
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x10], 0x53
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100172c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x2e697061
push eax
mov dword [ebp - 0x10], 0x776c6853
mov word [ebp - 7], 0x6c6c
mov byte [ebp - 5], 0
mov byte [ebp - 8], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x20], eax
xor esi, esi
mov eax, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x28], eax
call fcn.10017100
mov edi, eax
test edi, edi
je 0x100173f6
lea eax, [ebp - 0x1c]
mov word [ebp - 0x1b], 0x6a64
push eax
push edi
mov word [ebp - 0xc], 0x656c
mov dword [ebp - 0x18], 0x6f547473
mov word [ebp - 0xf], 0x7669
mov dword [ebp - 0xa], 0x736567
mov dword [ebp - 0x14], 0x506e656b
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x1c], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100173ef
push dword [ebp - 0x28]
push dword [ebp - 0x20]
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x10017410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x1c], eax
mov esi, 1
mov eax, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x24], eax
call fcn.100172c0
mov edi, eax
test edi, edi
je 0x1001749b
lea eax, [ebp - 0x18]
mov dword [ebp - 0xa], 0x41676e
push eax
push edi
mov word [ebp - 0x17], 0x7373
mov dword [ebp - 0x10], 0x74537972
mov word [ebp - 0xc], 0x6972
mov dword [ebp - 0x14], 0x65755163
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x18], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017494
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret