joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49390e
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x40], ebx
push eax
mov dword [ebp - 0x3c], 0
call fcn.00413fb0
mov ecx, ebx
call fcn.00402d40
push ecx
mov dword [ebp - 4], 0
mov ecx, ebx
mov dword [ebp - 0x3c], 1
call fcn.00414060
xor edi, edi
movzx esi, byte [ebp + edi - 0x24]
mov ecx, ebx
mov eax, esi
mov dword [ebp - 0x2d], 0x65646362
shr eax, 4
mov dword [ebp - 0x38], 0x33323130
mov word [ebp - 0x29], 0x66
mov word [ebp - 0x30], 0x3938
mov word [ebp - 0x33], 0x3635
mov byte [ebp - 0x31], 0x37
mov byte [ebp - 0x2e], 0x61
mov byte [ebp - 0x34], 0x34
movzx eax, byte [ebp + eax - 0x38]
push eax
call fcn.00403e00
and esi, 0xf
movzx ecx, byte [ebp + esi - 0x38]
push ecx
mov ecx, ebx
call fcn.00403e00
inc edi
cmp edi, 0x10
jl 0x413f30
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret 4

Function at 0x414190
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x4141cb
xor edx, edx
cmp dword [esi + 0x3cc], edx
jle 0x4141c4
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x4141b1
pop edi
pop esi
add esp, 0xc
ret 8
push str.Object_not_Initialized
lea ecx, [esp + 8]
call fcn.00403660
push 0x4a7a3c
lea eax, [esp + 8]
push eax
call fcn.0041e2ea
int3
Function at 0x414ef0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret
Function at 0x4169a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 1], 0x656e7265
push eax
mov word [esp + 0xc], 0x642e
mov word [esp + 9], 0x336c
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0xb], 0x32
mov byte [esp + 4], 0x4b
mov byte [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret

Function at 0x416a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 3], 0x642e6c6c
push eax
mov word [esp + 5], 0x6474
mov word [esp + 0xc], 0x6c
mov byte [esp + 4], 0x6e
mov byte [esp + 0xb], 0x6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x10
ret

Function at 0x416a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 5], 0x2e323369
push eax
mov word [esp + 4], 0x7457
mov dword [esp + 0xd], 0x6c6c64
mov word [esp + 7], 0x7061
mov byte [esp + 6], 0x73
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret

Function at 0x416af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 3], 0x33697061
push eax
mov dword [esp + 0xd], 0x6c6c64
mov word [esp + 5], 0x7664
mov word [esp + 0xb], 0x2e32
mov byte [esp + 4], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret

Function at 0x416b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov word [esp + 7], 0x6c6c
push eax
mov dword [esp + 6], 0x2e323365
mov byte [esp + 0xa], 0x64
mov byte [esp + 0xd], 0
mov word [esp + 4], 0x6c4f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x10
ret

Function at 0x416be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 1], 0x33726573
push eax
mov byte [esp + 4], 0x55
mov word [esp + 0xc], 0x6c6c
mov word [esp + 9], 0x2e32
mov byte [esp + 0xb], 0x64
mov byte [esp + 0xe], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x10
ret
Function at 0x416c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 6], 0x6c642e76
push eax
mov word [esp + 0xe], 0x6c
mov dword [esp + 4], 0x72657355
mov word [esp + 8], 0x6e65
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x10
ret

Function at 0x416c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00416aa0
mov edi, eax
test edi, edi
je 0x416ced
lea eax, [esp + 0xc]
mov dword [esp + 0x11], 0x766f6d65
push eax
push edi
mov dword [esp + 0x1d], 0x6c694665
mov dword [esp + 0x14], 0x68746150
mov dword [esp + 0x23], 0x41636570
mov byte [esp + 0x18], 0x52
mov word [esp + 0x21], 0x5365
mov byte [esp + 0x27], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416ce6
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x18
ret

Function at 0x416d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
mov ebx, edx
mov eax, dword [esp + 0x38]
mov ebp, ecx
push edi
mov dword [esp + 0x10], eax
xor esi, esi
call fcn.00416af0
mov edi, eax
test edi, edi
je 0x416da9
lea eax, [esp + 0x18]
mov word [esp + 0x1b], 0x6f54
push eax
push edi
mov word [esp + 0x20], 0x6547
mov word [esp + 0x2b], 0x726f
mov dword [esp + 0x30], 0x6e6f69
mov dword [esp + 0x25], 0x496e656b
mov word [esp + 0x2e], 0x7461
mov byte [esp + 0x2d], 0x6d
mov byte [esp + 0x22], 0x74
mov word [esp + 0x29], 0x666e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416da2
push dword [esp + 0x10]
push dword [esp + 0x3c]
push dword [esp + 0x1c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x20
ret

Function at 0x416dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.00416a50
mov edi, eax
test edi, edi
je 0x416e36
lea eax, [esp + 0x10]
mov word [esp + 0x1c], 0x6f54
push eax
push edi
mov dword [esp + 0x1a], 0x65755153
mov word [esp + 0x18], 0x5457
mov dword [esp + 0x26], 0x6e656b
mov word [esp + 0x21], 0x6573
mov word [esp + 0x1e], 0x7972
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x20], 0x55
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416e2f
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x18
ret
Function at 0x416e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.00416aa0
mov edi, eax
test edi, edi
je 0x416eb7
lea eax, [esp + 0x10]
mov word [esp + 0x1a], 0x41
push eax
push edi
mov dword [esp + 0x1b], 0x70704168
mov word [esp + 0x1f], 0x6e65
mov word [esp + 0x18], 0x6150
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x21], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416eb0
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x10
ret

Function at 0x416ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.00416b40
mov edi, eax
test edi, edi
je 0x416f35
lea eax, [esp + 0xc]
mov dword [esp + 0xd], 0x6572436f
push eax
push edi
mov dword [esp + 0x1c], 0x64697547
mov byte [esp + 0x14], 0x43
mov word [esp + 0x19], 0x7461
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416f2e
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret

Function at 0x416f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x6c6c64
push eax
mov ebp, edx
mov word [esp + 0x17], 0x6973
mov ebx, ecx
mov word [esp + 0x1a], 0x2e6e
xor esi, esi
mov word [esp + 0x14], 0x6576
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x19], 0x6f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416fff
lea eax, [esp + 0x1c]
mov dword [esp + 0x29], 0x666e496e
push eax
push edi
mov word [esp + 0x3a], 0x41
mov word [esp + 0x2e], 0x6973
mov dword [esp + 0x24], 0x46746547
mov dword [esp + 0x35], 0x7a69536f
mov dword [esp + 0x29], 0x6556656c
mov byte [esp + 0x39], 0x65
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x2d], 0x72
mov byte [esp + 0x30], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416ff8
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x28
ret
Function at 0x417020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], eax
mov ebx, edx
push edi
lea eax, [esp + 0x14]
mov word [esp + 0x14], 0x6576
push eax
mov ebp, ecx
mov dword [esp + 0x1f], 0x6c6c642e
xor esi, esi
mov dword [esp + 0x1b], 0x6e6f6973
mov byte [esp + 0x23], 0
mov byte [esp + 0x1a], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4170ce
lea eax, [esp + 0x20]
mov dword [esp + 0x2e], 0x6f666e49
push eax
push edi
mov word [esp + 0x3a], 0x41
mov dword [esp + 0x2f], 0x73726556
mov dword [esp + 0x28], 0x46746547
mov word [esp + 0x2d], 0x656c
mov word [esp + 0x33], 0x6f69
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x35], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4170c7
push dword [esp + 0x10]
push dword [esp + 0x40]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x28
ret

Function at 0x4170f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov ebx, ecx
push esi
mov dword [esp + 0xc], eax
xor esi, esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x1b], 0x6c6c642e
push eax
mov dword [esp + 0x18], 0x73726576
mov word [esp + 0x1d], 0x6e6f
mov byte [esp + 0x23], 0
mov byte [esp + 0x1c], 0x69
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4171a3
lea eax, [esp + 0x20]
mov word [esp + 0x27], 0x5679
push eax
push edi
mov word [esp + 0x32], 0x756c
mov word [esp + 0x2a], 0x5172
mov word [esp + 0x2d], 0x7265
mov word [esp + 0x35], 0x41
mov byte [esp + 0x31], 0x61
mov word [esp + 0x28], 0x6556
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x34], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41719c
push dword [esp + 0x10]
push ebp
push 0x4a5210
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x24
ret
Function at 0x4171c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0x7052
push eax
mov ebp, edx
mov dword [esp + 0x17], 0x2e347472
mov ebx, ecx
mov dword [esp + 0x1b], 0x6c6c64
mov esi, 0xe
mov byte [esp + 0x16], 0x63
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417253
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x676e6972
push eax
push edi
mov word [esp + 0x24], 0x7555
mov word [esp + 0x27], 0x5464
mov word [esp + 0x2a], 0x7453
mov byte [esp + 0x26], 0x69
mov word [esp + 0x30], 0x41
mov byte [esp + 0x29], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41724c
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x20
ret

Function at 0x417270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov word [esp + 0xd], 0x6370
push eax
mov ebx, ecx
mov dword [esp + 0x17], 0x6c6c64
mov esi, 0xe
mov word [esp + 0x14], 0x3474
mov byte [esp + 0x13], 0x72
mov byte [esp + 0x10], 0x52
mov byte [esp + 0x16], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417304
lea eax, [esp + 0x18]
mov dword [esp + 0x21], 0x65657246
push eax
push edi
mov dword [esp + 0x23], 0x69727453
mov word [esp + 0x20], 0x7052
mov word [esp + 0x2d], 0x41
mov word [esp + 0x27], 0x676e
mov byte [esp + 0x22], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4172fd
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x20
ret

Function at 0x417320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov ebx, ecx
push esi
push edi
xor esi, esi
call fcn.00416af0
mov edi, eax
test edi, edi
je 0x4173a0
lea eax, [esp + 0x10]
mov dword [esp + 0x12], 0x63696c70
push eax
push edi
mov word [esp + 0x18], 0x7544
mov word [esp + 0x23], 0x656b
mov word [esp + 0x26], 0x7845
mov byte [esp + 0x28], 0
mov dword [esp + 0x1f], 0x6f546574
mov byte [esp + 0x25], 0x6e
mov byte [esp + 0x1e], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417399
push ebp
push 1
push 2
push esi
push 0x2000000
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x18
ret
Function at 0x4173c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.00416c30
mov edi, eax
test edi, edi
je 0x417444
lea eax, [esp + 0x10]
mov dword [esp + 0x21], 0x636f6c42
push eax
push edi
mov word [esp + 0x18], 0x7243
mov word [esp + 0x1b], 0x7461
mov word [esp + 0x1e], 0x6e45
mov dword [esp + 0x25], 0x746e656d
mov dword [esp + 0x21], 0x6e6f7269
mov byte [esp + 0x20], 0x76
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1d], 0x65
mov word [esp + 0x2d], 0x6b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41743d
push esi
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x1c
ret

Function at 0x417460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push ebx
mov dword [esp + 0x10], eax
mov ebx, ecx
mov eax, dword [esp + 0x48]
push ebp
mov dword [esp + 0x10], eax
mov ebp, edx
mov eax, dword [esp + 0x54]
push esi
mov dword [esp + 0x10], eax
xor esi, esi
mov eax, dword [esp + 0x5c]
push edi
mov dword [esp + 0x10], eax
call fcn.00416af0
mov edi, eax
test edi, edi
je 0x417514
lea eax, [esp + 0x20]
mov dword [esp + 0x31], 0x417265
push eax
push edi
mov dword [esp + 0x2e], 0x636f7250
mov dword [esp + 0x28], 0x61657243
mov word [esp + 0x36], 0x5573
mov word [esp + 0x33], 0x7373
mov byte [esp + 0x35], 0x41
mov word [esp + 0x2c], 0x6574
mov byte [esp + 0x38], 0x73
mov byte [esp + 0x32], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41750d
push dword [esp + 0x10]
push dword [esp + 0x18]
push esi
push dword [esp + 0x24]
push dword [esp + 0x60]
push esi
push esi
push esi
push dword [esp + 0x3c]
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x38]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c0d2
add esp, 0x2c
ret

Function at 0x417530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0x42746547
push eax
mov edi, edx
mov dword [esp + 0x14], 0x70795479
mov esi, ecx
mov word [esp + 0x19], 0x41
mov dword [esp + 0x10], 0x72616e69
mov byte [esp + 0x18], 0x65
call fcn.004169a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417592
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret
Function at 0x417660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0xd], 0x7373
push eax
mov edi, edx
mov dword [esp + 0xc], 0x636f7250
mov esi, ecx
mov word [esp + 0x18], 0x74
mov dword [esp + 0x13], 0x654e3233
mov byte [esp + 0x17], 0x78
mov byte [esp + 0x10], 0x65
call fcn.004169a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4176c6
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret

Function at 0x4176e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x10], 0x72694632
push eax
mov edi, edx
mov dword [esp + 0xf], 0x73736563
mov esi, ecx
mov word [esp + 0xd], 0x6f72
mov word [esp + 0x19], 0x74
mov byte [esp + 0x18], 0x73
mov byte [esp + 0xc], 0x50
mov byte [esp + 0x13], 0x33
call fcn.004169a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41774b
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041c0d2
add esp, 0x14
ret

Function at 0x417760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
mov word [esp + 0xc], 0x706c
push eax
mov dword [esp + 6], 0x65746165
mov word [esp + 0x17], 0x7370
mov dword [esp + 0x13], 0x616e5332
mov word [esp + 0x1a], 0x746f
mov dword [esp + 0xc], 0x65686c6f
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x1c], 0
mov word [esp + 4], 0x7243
mov word [esp + 0xa], 0x6f54
mov byte [esp + 0x19], 0x68
call fcn.004169a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4177e1
push 0
push 2
call eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor ecx, esp
call fcn.0041c0d2
add esp, 0x20
ret

Function at 0x417800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov esi, ecx
call fcn.00416aa0
mov edi, eax
test edi, edi
je 0x417869
lea eax, [esp + 8]
mov dword [esp + 0x16], 0x41656d
push eax
push edi
mov dword [esp + 0x13], 0x6e694668
mov dword [esp + 0x1a], 0x614e656c
mov word [esp + 0x10], 0x6150
mov byte [esp + 0x12], 0x74
mov word [esp + 0x17], 0x4664
mov byte [esp + 0x19], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417862
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0041c0d2
add esp, 0x18
ret