joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c350
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
push 6
push 1
push 2
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x2c], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002c524
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [ebp - 0xc], xmm0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
xor eax, eax
push 4
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x2c]
push eax
push 4
push 0xffff
push esi
mov dword [edi + 4], 0xffffffff
mov dword [edi], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1002c512
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1002c512
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1002c512
cmp dword [ebp - 0x28], 0x10
jl 0x1002c512
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1002c512
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x1002c512
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1002c512
mov edx, 1
mov ecx, esi
call fcn.10027820
test eax, eax
js 0x1002c512
push 0
push 0x2710
mov edx, 1
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x30], 0x300
call fcn.10022190
add esp, 8
push 0
push 0
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x1002c512
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1002c512
cmp dword [ebp - 0x28], 0x10
jl 0x1002c512
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x1002c512
cmp dword [ebp - 0x28], 0x10
jl 0x1002c512
mov ax, word [ebp - 0x14]
cmp ax, word [ebp - 0x24]
jne 0x1002c512
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jne 0x1002c512
mov ax, word [ebp - 0x12]
cmp ax, word [ebp - 0x22]
jne 0x1002c512
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi]
call esi
push dword [edi + 4]
call esi
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
Function at 0x10032930
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10032962
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10032a40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x3c
mov edi, edx
call dword [0x100939a0]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10032a66
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0xc]
mov dword [esi], fcn.10032930
lea eax, [ecx + 8]
mov dword [esi + 4], ecx
push ecx
mov dword [esi + 8], eax
call fcn.10032930
cmp ebx, 0x40
jbe 0x10032ab9
push ebx
push edi
push dword [esi + 4]
call fcn.10032970
mov edi, dword [esi + 8]
push dword [esi + 4]
add edi, 8
push edi
call fcn.10032990
push dword [esi + 4]
mov ebx, 0x20
mov dword [ebp + 8], ebx
call fcn.10032930
push dword [esi + 8]
call fcn.10032930
add esp, 0x20
jmp 0x10032aca
push dword [esi + 8]
call fcn.10032930
add esp, 8
xor eax, eax
test ebx, ebx
je 0x10032b10
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
movzx eax, byte [edi]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
call fcn.10032970
movzx eax, byte [edi]
lea edi, [edi + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
call fcn.10032970
add esp, 0x18
sub ebx, 1
jne 0x10032ad0
cmp dword [ebp + 8], 0x40
jae 0x10032b46
mov eax, dword [ebp - 0xc]
mov edi, 0x40
sub edi, eax
nop word [eax + eax]
push 1
push 0x10089ca3
push dword [esi + 4]
call fcn.10032970
push 1
push 0x10089ca2
push dword [esi + 8]
call fcn.10032970
add esp, 0x18
sub edi, 1
jne 0x10032b20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x10], 0x73
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x10], 0x63
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x10], 0x6f
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x10], 0x6d
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x10], 0x73
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x10], 0x70
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x10], 0x6d
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x10], 0x61
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x10], 0x2e
mov eax, 1
imul ecx, eax, 0xa
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xb
jae 0x1003a4ce
jmp 0x1003a4d3
call fcn.1004f3f2
mov edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x10], 0
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x10], 0x6f
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10034080
mov edx, dword [ebp - 0x18]
or edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
Function at 0x1003afa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10079b10
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x154], 0
push 0x100899b5
lea ecx, [ebp - 0x140]
call fcn.10034080
mov dword [ebp - 4], 0
push 0x104
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.100520d0
add esp, 0xc
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x24], 0x63
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x24], 0x54
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x24], 0x6b
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x24], 0x4f
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x24], 0x53
mov eax, 1
imul ecx, eax, 0xa
mov dword [ebp - 0x148], ecx
cmp dword [ebp - 0x148], 0xb
jae 0x1003b05b
jmp 0x1003b060
call fcn.1004f3f2
mov edx, dword [ebp - 0x148]
mov byte [ebp + edx - 0x24], 0
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x24], 0x74
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x24], 0x69
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x24], 0x5f
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x24], 0x53
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x24], 0x65
push 0xffffffffffffffff
push str.b245e97e097f47369ceb062663743d4b
push 0x104
lea edx, [ebp - 0x128]
push edx
call fcn.1005495c
add esp, 0x10
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
push 0x104
lea ecx, [ebp - 0x128]
push ecx
call fcn.1005489e
add esp, 0x10
push 0x104
lea edx, [ebp - 0x128]
push edx
call fcn.10042750
add esp, 8
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.100368c0
add esp, 8
mov dword [ebp - 0x158], eax
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x18], 0x25
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x38
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x18], 0x30
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], 0x25
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x18], 0x78
mov edx, 1
imul eax, edx, 6
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 7
jae 0x1003b164
jmp 0x1003b169
call fcn.1004f3f2
mov ecx, dword [ebp - 0x14c]
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x144], 0x5f
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x144], 0x74
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x144], 0x74
mov edx, 1
imul eax, edx, 3
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jae 0x1003b1c9
jmp 0x1003b1ce
call fcn.1004f3f2
mov ecx, dword [ebp - 0x150]
mov byte [ebp + ecx - 0x144], 0
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x140]
call fcn.100357b0
lea edx, [ebp - 0x140]
push edx
mov ecx, dword [ebp + 8]
call fcn.10034e40
mov eax, dword [ebp - 0x154]
or eax, 1
mov dword [ebp - 0x154], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.10034940
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
Function at 0x1003b250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 0
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x10], 0x65
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x10], 0x65
mov edx, 1
shl edx, 3
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 9
jae 0x1003b294
jmp 0x1003b299
call fcn.1004f3f2
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x10], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x10], 0x6e
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x10], 0x33
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x10], 0x72
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x10], 0x6c
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x10], 0x32
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x10], 0x6b
mov eax, 1
imul ecx, eax, 0xe
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xf
jae 0x1003b301
jmp 0x1003b306
call fcn.1004f3f2
mov edx, dword [ebp - 0x28]
mov byte [ebp + edx - 0x20], 0
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x20], 0x73
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x20], 0x57
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x20], 0x36
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x63
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x20], 0x49
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x20], 0x77
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x20], 0x6f
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x20], 0x6f
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x20], 0x72
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x20], 0x50
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x20], 0x34
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x20], 0x65
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1003b3ef
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
Function at 0x1003fd10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x10093c20], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x10093c24], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10093c28], edx
mov dword [ebp - 0x2c], 1
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x20], 0x49
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x20], 0x6f
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x20], 0x61
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x54
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x5c
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x53
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x77
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x66
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x20], 0x41
mov eax, 1
imul ecx, eax, 0xc
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0xd
jae 0x1003fde2
jmp 0x1003fde7
call fcn.1004f3f2
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x20], 0
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x20], 0x72
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x10], 0x45
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x10], 0x61
mov edx, 1
imul eax, edx, 0xb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xc
jae 0x1003fe29
jmp 0x1003fe2e
call fcn.1004f3f2
mov ecx, dword [ebp - 0x28]
mov byte [ebp + ecx - 0x10], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x10], 0x73
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x10], 0x64
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x10], 0x74
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x10], 0x49
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x10], 0x49
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x10], 0x65
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x10], 0x6e
push 4
lea edx, [ebp - 0x2c]
push edx
push 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
push ecx
push reloc.WS2_32.dll_bind
call fcn.10047860
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
Function at 0x10043c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x1c], 0x28
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x1c], 0x4e
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x1c], 0x4d
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x1c], 0x29
mov edx, 1
imul eax, edx, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x15
jae 0x10043cde
jmp 0x10043ce3
call fcn.1004f3f2
mov ecx, dword [ebp - 0x20]
mov byte [ebp + ecx - 0x1c], 0
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x1c], 0x65
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x1c], 0x63
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x49
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x1c], 0x5f
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x1c], 0x6c
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x49
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x1c], 0x20
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x1c], 0x6e
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x1c], 0x74
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x1c], 0x53
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x1c], 0x7a
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x1c], 0x61
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x1c], 0x69
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x1c], 0x53
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 8]
call fcn.10035220
mov eax, dword [ebp - 0x24]
or eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret

Function at 0x10043e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x14], 0x33
mov edx, 1
imul eax, edx, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xd
jae 0x10043eb0
jmp 0x10043eb5
call fcn.1004f3f2
mov ecx, dword [ebp - 0x18]
mov byte [ebp + ecx - 0x14], 0
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x14], 0x32
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x76
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x14], 0x6c
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x14], 0x64
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x14], 0x69
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x14], 0x41
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x14], 0x61
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x14], 0x70
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x14], 0x64
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x14], 0x6c
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x2e
lea edx, [ebp - 0x14]
push edx
call fcn.100462c0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
Function at 0x100442b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x10], 0x6c
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x10], 0x65
mov eax, 1
imul ecx, eax, 0xb
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xc
jae 0x100442ec
jmp 0x100442f1
call fcn.1004f3f2
mov edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x10], 0
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x10], 0x32
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x10], 0x53
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x10], 0x33
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x10], 0x6c
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x10], 0x64
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x10], 0x68
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x10], 0x2e
lea eax, [ebp - 0x10]
push eax
call fcn.100462c0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret

Function at 0x10044540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x10], 0x64
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x10], 0x6f
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x10], 0x69
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x10], 0x56
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x10], 0x65
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x10], 0x6c
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x10], 0x72
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x10], 0x2e
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x10], 0x6c
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x10], 0x6e
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x10], 0x73
mov eax, 1
imul ecx, eax, 0xb
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xc
jae 0x100445f1
jmp 0x100445f6
call fcn.1004f3f2
mov edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x10], 0
lea eax, [ebp - 0x10]
push eax
call fcn.100462c0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
Function at 0x10044620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 1
call fcn.10044390
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10044786
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x72
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x18], 0x67
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x18], 0x69
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x18], 0x41
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x73
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x18], 0x72
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x73
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x18], 0x6e
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x18], 0x79
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x18], 0x63
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], 0x41
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x18], 0x74
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x18], 0x51
mov ecx, 1
imul edx, ecx, 0x11
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0x12
jae 0x1004471e
jmp 0x10044723
call fcn.1004f3f2
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0x53
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x18], 0x75
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1004477a
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10045070
add esp, 4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret
Function at 0x100447a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10093034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0
call fcn.10043e80
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1004492e
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x1c], 0x43
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x1c], 0x68
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x69
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x1c], 0x67
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x1c], 0x53
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x1c], 0x65
mov ecx, 1
imul edx, ecx, 0x12
mov byte [ebp + edx - 0x1c], 0x67
mov eax, 1
imul ecx, eax, 0x14
mov byte [ebp + ecx - 0x1c], 0x41
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x1c], 0x76
mov ecx, 1
imul edx, ecx, 0x15
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x16
jae 0x10044851
jmp 0x10044856
call fcn.1004f3f2
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x1c], 0
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x1c], 0x6e
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x72
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x1c], 0x63
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x1c], 0x6e
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x1c], 0x61
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx - 0x1c], 0x69
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x65
mov ecx, 1
imul edx, ecx, 0x13
mov byte [ebp + edx - 0x1c], 0x32
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x1c], 0x66
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x1c], 0x43
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x10044922
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.10045070
add esp, 4
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f6b2
mov esp, ebp
pop ebp
ret