joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4164c4
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x1c], 0xa09599a8
mov dword [esp + 0x20], 0x9c90a699
pushfd
mov dword [esp + 0x24], 0x97a4a8a8
mov dword [esp + 0x28], 0xa2999da0
mov dword [esp + 0x2c], 0xa49762a8
mov byte [esp + 0x30], 0xa4
mov al, byte [esp + ecx + 0x18]
sub al, 0x34
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 0x19
jl 0x4164e3
mov byte [esp + 0xed], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x44405463
mov word [esp + 0x14], 0x4254
mov byte [esp + 0x16], 0x45
mov al, byte [esp + ecx + 0x10]
xor al, 0x31
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 7
jl 0x416513
mov byte [esp + 0x93], bl
mov ecx, ebx
mov dword [esp + 0x64], 0xf5f1f1cd
mov dword [esp + 0x68], 0xf7e0f0d4
mov dword [esp + 0x6c], 0xe3ebccfc
mov dword [esp + 0x70], 0xe4e3a5ea
mov dword [esp + 0x74], 0xbef6e9ec
jmp 0x4509244f
and al, 0x78
movsd dword es:[edi], dword [esi]
jmp 0x45095c45
and al, 0x7c
int1
movsd dword es:[edi], dword [esi]
loopne 0x41655e
mov dword [esp + 0x80], 0xbff7eaf7
mov dword [esp + 0x84], 0x8ffda0a5
mov al, byte [esp + ecx + 0x64]
xor al, 0x85
mov byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 0x24
jl 0x41657d
or dword [ebp + 0x18], 0xffffffff
mov byte [esp + 0x58], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0xe0]
push 0x34
push eax
call 0x4280c4
add esp, 0x14
mov dword [esp + 0x5c], ebx
jmp 0x41661c
pop ebx
lea eax, [esp + 0x60]
mov edx, 0xa7abc4a5
push eax
push 0x400
lea eax, [esp + 0x250]
push eax
push edi
push 2

Function at 0x416565
Capabilities:
Encode data using xor

Disassembly:
test bh, 0x44
and al, 0x7c
int1
movsd dword es:[edi], dword [esi]
loopne 0x41655e

Function at 0x41670b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x38], 0x18130639
mov dword [esp + 0x3c], 0x3071324
mov dword [esp + 0x40], 0x56020513
mov dword [esp + 0x44], 0x1a1f1710
mov dword [esp + 0x48], 0x1a564d05
mov dword [esp + 0x4c], 0x56020517
mov dword [esp + 0x50], 0x19040413
mov dword [esp + 0x54], 0x53564c04
mov word [esp + 0x58], 0x7c0e
mov al, byte [esp + ecx + 0x34]
xor al, 0x76
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x26
jl 0x416752
mov byte [esp + 0x8a], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0xe0]
push 0x4e
push eax
call 0x428298
add esp, 0x14

Function at 0x416866
Capabilities:
Encode data using xor

Disassembly:
and al, 0x4c
fmul st(2)
int 0x99
mov dword [esp + 0x50], 0xd6cbcbdc
mov dword [esp + 0x54], 0x9c9983cb
mov word [esp + 0x58], 0xb3c1
mov al, byte [esp + ecx + 0x34]
xor al, 0xb9
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x26
jl 0x416883
mov byte [esp + 0x8a], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x94]
push eax
push 0x53
jmp 0x4169b9
Function at 0x4168f4
Capabilities:
Encode data using xor

Disassembly:
or al, 0xd4
add byte [eax], al
add byte [ecx - 0x7d], al
stc
sbb dword [ebp + ebp*8 - 0x78], edi
pushfd
and al, 0xed
add byte [eax], al
add byte [ebx + 0x2444c7cb], cl
adc ah, dl
jecxz 0x416906
mov ecx, ebx
mov dword [esp + 0x10], 0xf3f7e3d4
mov word [esp + 0x14], 0xf5e3
mov word [esp + 0x14], 0xf5e3
mov byte [esp + 0x16], 0xf2
mov al, byte [esp + ecx + 0x10]
xor al, 0x86
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 7
jl 0x41691c
mov byte [esp + 0x93], bl
mov ecx, ebx
mov dword [esp + 0x34], 0x8796906b
mov dword [esp + 0x38], 0x96879094
mov dword [esp + 0x3c], 0x85839465
mov dword [esp + 0x40], 0x8e94778d
mov dword [esp + 0x44], 0x8b838842
mov dword [esp + 0x48], 0x425d958e
inc edx
mov dword [esp + 0x4c], 0x9695838e
mov dword [esp + 0x50], 0x94948742
xchg dword [esp + edx*4 + 0x542444c7], edx
xchg ecx, eax
xchg esp, eax
pop esp
inc edx

Function at 0x416b24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x30]
or al, 0x30
xor al, 0xe7
mov byte [esp + ecx + 0x144], al
add byte [eax], al
inc ecx
cmp ecx, 3
jl 0x416b22
mov byte [esp + 0x147], 0
xor ecx, ecx
mov dword [esp + 0xa0], 0xc3c0cecb
mov word [esp + 0xa4], 0xd1c4

Function at 0x416b2d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x30]
or al, 0x30
xor al, 0xe7
mov byte [esp + ecx + 0x144], al
add byte [eax], al
inc ecx
cmp ecx, 3
jl 0x416b22
mov byte [esp + 0x147], 0
xor ecx, ecx
mov dword [esp + 0xa0], 0xc3c0cecb
mov word [esp + 0xa4], 0xd1c4

Function at 0x416b39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x30]
or al, 0x30
xor al, 0xe7
mov byte [esp + ecx + 0x144], al
add byte [eax], al
inc ecx
cmp ecx, 3
jl 0x416b22
mov byte [esp + 0x147], 0
xor ecx, ecx
mov dword [esp + 0xa0], 0xc3c0cecb
mov word [esp + 0xa4], 0xd1c4

Function at 0x416b65
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0xa0]
sub al, 0x5f
mov byte [esp + ecx + 0x154], al
inc ecx
cmp ecx, 6
jl 0x416b54
lea edx, [esp + 0x154]
mov byte [esp + 0x15a], 0
lea ecx, [esp + 0x144]
call 0x42e3af
mov ebx, eax
mov dword [esp + 0xa0], ebx
test ebx, ebx

Function at 0x416b6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0xa0]
sub al, 0x5f
mov byte [esp + ecx + 0x154], al
inc ecx
cmp ecx, 6
jl 0x416b54
lea edx, [esp + 0x154]
mov byte [esp + 0x15a], 0
lea ecx, [esp + 0x144]
call 0x42e3af
mov ebx, eax
mov dword [esp + 0xa0], ebx
test ebx, ebx

Function at 0x416b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x4174bd
push 0x1000
call fcn.0041b6a6
mov edi, eax
pop ecx
test edi, edi
je 0x4174b6
and dword [esp + 0xb0], 0
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
mov word [esp + 0x14], 0x7c
push eax
push ebx
Function at 0x416bb1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x4174bd
push 0x1000
call fcn.0041b6a6
mov edi, eax
pop ecx
test edi, edi
je 0x4174b6
and dword [esp + 0xb0], 0
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
mov word [esp + 0x14], 0x7c
push eax
push ebx

Function at 0x416bcf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 0xc
test esi, esi
je 0x4174af
push 0x23
pop ebx

Function at 0x416bea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
xchg edi, eax
mov ebx, es
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call 0x4286a7
pop ecx
lea eax, [esp + 0x30]
and al, 0x30
xor ebp, ebp
push eax
push esi
call 0x41bcc1
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call 0x431623
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call 0x4286d2
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call 0x41be8e
add esp, 0x14
lea eax, [esp + 0xb0]
add byte [eax], al
add byte [eax - 0x73], dl
inc esp
and al, 0x14
push eax
push 0
call 0x41bea5
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call 0x41bc5c
pop ecx
mov edx, eax
mov ecx, esi
call 0x4258a6
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
cmp eax, dword [edx - 0x7b72e5ae]
and al, 0x60
add dword [eax], eax
add byte [ecx + 0x57], al
push eax
call 0x428e30
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
test byte [esp + ebp*4], ah
add byte [eax], al
invalid
wait
ror ch, 1
invalid
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax
Function at 0x416c0a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
xchg edi, eax
mov ebx, es
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call 0x4286a7
pop ecx
lea eax, [esp + 0x30]
and al, 0x30
xor ebp, ebp
push eax
push esi
call 0x41bcc1
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call 0x431623
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call 0x4286d2
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call 0x41be8e
add esp, 0x14
lea eax, [esp + 0xb0]
add byte [eax], al
add byte [eax - 0x73], dl
inc esp
and al, 0x14
push eax
push 0
call 0x41bea5
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call 0x41bc5c
pop ecx
mov edx, eax
mov ecx, esi
call 0x4258a6
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
cmp eax, dword [edx - 0x7b72e5ae]
and al, 0x60
add dword [eax], eax
add byte [ecx + 0x57], al
push eax
call 0x428e30
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
test byte [esp + ebp*4], ah
add byte [eax], al
invalid
wait
ror ch, 1
invalid
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax
Function at 0x416cbb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
xchg edi, eax
mov ebx, es
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call 0x4286a7
pop ecx
lea eax, [esp + 0x30]
and al, 0x30
xor ebp, ebp
push eax
push esi
call 0x41bcc1
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call 0x431623
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call 0x4286d2
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call 0x41be8e
add esp, 0x14
lea eax, [esp + 0xb0]
add byte [eax], al
add byte [eax - 0x73], dl
inc esp
and al, 0x14
push eax
push 0
call 0x41bea5
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call 0x41bc5c
pop ecx
mov edx, eax
mov ecx, esi
call 0x4258a6
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
cmp eax, dword [edx - 0x7b72e5ae]
and al, 0x60
add dword [eax], eax
add byte [ecx + 0x57], al
push eax
call 0x428e30
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
test byte [esp + ebp*4], ah
add byte [eax], al
invalid
wait
ror ch, 1
invalid
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax
Function at 0x416cfe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
xchg edi, eax
mov ebx, es
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call 0x4286a7
pop ecx
lea eax, [esp + 0x30]
and al, 0x30
xor ebp, ebp
push eax
push esi
call 0x41bcc1
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call 0x431623
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call 0x4286d2
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call 0x41be8e
add esp, 0x14
lea eax, [esp + 0xb0]
add byte [eax], al
add byte [eax - 0x73], dl
inc esp
and al, 0x14
push eax
push 0
call 0x41bea5
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call 0x41bc5c
pop ecx
mov edx, eax
mov ecx, esi
call 0x4258a6
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
cmp eax, dword [edx - 0x7b72e5ae]
and al, 0x60
add dword [eax], eax
add byte [ecx + 0x57], al
push eax
call 0x428e30
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
test byte [esp + ebp*4], ah
add byte [eax], al
invalid
wait
ror ch, 1
invalid
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax
Function at 0x416d41
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
xchg edi, eax
mov ebx, es
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call 0x4286a7
pop ecx
lea eax, [esp + 0x30]
and al, 0x30
xor ebp, ebp
push eax
push esi
call 0x41bcc1
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call 0x431623
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call 0x4286d2
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call 0x41be8e
add esp, 0x14
lea eax, [esp + 0xb0]
add byte [eax], al
add byte [eax - 0x73], dl
inc esp
and al, 0x14
push eax
push 0
call 0x41bea5
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call 0x41bc5c
pop ecx
mov edx, eax
mov ecx, esi
call 0x4258a6
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
cmp eax, dword [edx - 0x7b72e5ae]
and al, 0x60
add dword [eax], eax
add byte [ecx + 0x57], al
push eax
call 0x428e30
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
test byte [esp + ebp*4], ah
add byte [eax], al
invalid
wait
ror ch, 1
invalid
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax
Function at 0x416d7b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
xchg edi, eax
mov ebx, es
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call 0x4286a7
pop ecx
lea eax, [esp + 0x30]
and al, 0x30
xor ebp, ebp
push eax
push esi
call 0x41bcc1
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call 0x431623
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call 0x4286d2
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call 0x41be8e
add esp, 0x14
lea eax, [esp + 0xb0]
add byte [eax], al
add byte [eax - 0x73], dl
inc esp
and al, 0x14
push eax
push 0
call 0x41bea5
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call 0x41bc5c
pop ecx
mov edx, eax
mov ecx, esi
call 0x4258a6
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
cmp eax, dword [edx - 0x7b72e5ae]
and al, 0x60
add dword [eax], eax
add byte [ecx + 0x57], al
push eax
call 0x428e30
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
test byte [esp + ebp*4], ah
add byte [eax], al
invalid
wait
ror ch, 1
invalid
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax
Function at 0x416db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
xchg edi, eax
mov ebx, es
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call 0x4286a7
pop ecx
lea eax, [esp + 0x30]
and al, 0x30
xor ebp, ebp
push eax
push esi
call 0x41bcc1
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call 0x431623
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call 0x4286d2
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call 0x41be8e
add esp, 0x14
lea eax, [esp + 0xb0]
add byte [eax], al
add byte [eax - 0x73], dl
inc esp
and al, 0x14
push eax
push 0
call 0x41bea5
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call 0x41bc5c
pop ecx
mov edx, eax
mov ecx, esi
call 0x4258a6
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
cmp eax, dword [edx - 0x7b72e5ae]
and al, 0x60
add dword [eax], eax
add byte [ecx + 0x57], al
push eax
call 0x428e30
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
test byte [esp + ebp*4], ah
add byte [eax], al
invalid
wait
ror ch, 1
invalid
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax