joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416db7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
xchg edi, eax
mov ebx, es
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call 0x4286a7
pop ecx
lea eax, [esp + 0x30]
and al, 0x30
xor ebp, ebp
push eax
push esi
call 0x41bcc1
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call 0x431623
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call 0x4286d2
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call 0x41be8e
add esp, 0x14
lea eax, [esp + 0xb0]
add byte [eax], al
add byte [eax - 0x73], dl
inc esp
and al, 0x14
push eax
push 0
call 0x41bea5
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call 0x41bc5c
pop ecx
mov edx, eax
mov ecx, esi
call 0x4258a6
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
cmp eax, dword [edx - 0x7b72e5ae]
and al, 0x60
add dword [eax], eax
add byte [ecx + 0x57], al
push eax
call 0x428e30
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
test byte [esp + ebp*4], ah
add byte [eax], al
invalid
wait
ror ch, 1
invalid
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax
Function at 0x416dd6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 0x208]
push 0xf
pop edx
mov word [esp + 0x170], ax
call 0x4315db
lea eax, [esp + 0x148]
push eax
push edi
call 0x41bdc1
lea eax, [esp + 0x210]
push eax
push edi
call 0x41bdcf
dec edi
add byte [eax], al
lea eax, [esp + 0x178]
push eax
push edi
call 0x41bddd
add bh, bh
mov ah, 0x24
push 0x8b000001
xchg esp, eax
and al, 0x68
add dword [eax], eax
add byte [ebx - 0x57191731], cl
add dword [eax], eax
add esp, 0x1c
test al, al
je 0x417342
invalid
add byte [eax], al
mov dword [esp + 0x34], 0x869b80a5
xor ecx, ecx
mov dword [esp + 0x38], 0x9b94d297
mov dword [esp + 0x3c], 0x91d2979e
mov dword [esp + 0x40], 0x97869c9d
mov dword [esp + 0x44], 0x9bd2869c
mov dword [esp + 0x48], 0x9ed7d29c
mov word [esp + 0x4c], 0xf881
mov al, byte [esp + ecx + 0x34]
xor al, 0xf2
mov byte [esp + ecx + 0xbc], al
inc ecx
cmp ecx, 0x1a
jl 0x416e70
lea eax, [esp + 0xbc]
mov byte [esp + 0xd6], 0
push edi
push eax
call 0x428888
push 0x40
lea eax, [esp + 0x1d0]
mov dword [esp + 0x1cc], 0x44
push 0
push eax
call fcn.00419c10
add esp, 0x14
xor eax, eax
mov word [esp + 0x1f0], ax
add byte [eax], al
xor ecx, ecx
lea eax, [esp + 0x1b0]
mov edx, 0x322e7433
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push ebp
push edi
call 0x428f8f
call eax
test eax, eax
je 0x41721f
mov dword [esp + 0x34], 0x2c2c3e1c
xor ecx, ecx
mov dword [esp + 0x38], 0x2f3c3c2e
mov dword [esp + 0x3c], 0x4235353e
mov dword [esp + 0x40], 0x2a3d3ce9
mov dword [esp + 0x44], 0x39e93d3b
mov dword [esp + 0x48], 0x2e2c383b
mov word [esp + 0x4c], 0x3c3c
mov byte [esp + 0x4e], 0xd3
mov al, byte [esp + ecx + 0x34]
add al, 0x37
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x1b
jl 0x416f35
mov byte [esp + 0x2f], 0
xor ecx, ecx
mov dword [esp + 0x50], 0xb5e6a5e9
mov dword [esp + 0x54], 0xa7b2aea5
mov dword [esp + 0x58], 0xe6b5adb5
mov dword [esp + 0x5c], 0xa3b4a5e9
invalid
inc esp
invalid

Function at 0x416e16
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add bh, bh
mov ah, 0x24
push 0x8b000001
xchg esp, eax
and al, 0x68
add dword [eax], eax
add byte [ebx - 0x57191731], cl
add dword [eax], eax
Function at 0x416e34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 0x208]
push 0xf
pop edx
mov word [esp + 0x170], ax
call 0x4315db
lea eax, [esp + 0x148]
push eax
push edi
call 0x41bdc1
lea eax, [esp + 0x210]
push eax
push edi
call 0x41bdcf
dec edi
add byte [eax], al
lea eax, [esp + 0x178]
push eax
push edi
call 0x41bddd
add bh, bh
mov ah, 0x24
push 0x8b000001
xchg esp, eax
and al, 0x68
add dword [eax], eax
add byte [ebx - 0x57191731], cl
add dword [eax], eax
add esp, 0x1c
test al, al
je 0x417342
invalid
add byte [eax], al
mov dword [esp + 0x34], 0x869b80a5
xor ecx, ecx
mov dword [esp + 0x38], 0x9b94d297
mov dword [esp + 0x3c], 0x91d2979e
mov dword [esp + 0x40], 0x97869c9d
mov dword [esp + 0x44], 0x9bd2869c
mov dword [esp + 0x48], 0x9ed7d29c
mov word [esp + 0x4c], 0xf881
mov al, byte [esp + ecx + 0x34]
xor al, 0xf2
mov byte [esp + ecx + 0xbc], al
inc ecx
cmp ecx, 0x1a
jl 0x416e70
lea eax, [esp + 0xbc]
mov byte [esp + 0xd6], 0
push edi
push eax
call 0x428888
push 0x40
lea eax, [esp + 0x1d0]
mov dword [esp + 0x1cc], 0x44
push 0
push eax
call fcn.00419c10
add esp, 0x14
xor eax, eax
mov word [esp + 0x1f0], ax
add byte [eax], al
xor ecx, ecx
lea eax, [esp + 0x1b0]
mov edx, 0x322e7433
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push ebp
push edi
call 0x428f8f
call eax
test eax, eax
je 0x41721f
mov dword [esp + 0x34], 0x2c2c3e1c
xor ecx, ecx
mov dword [esp + 0x38], 0x2f3c3c2e
mov dword [esp + 0x3c], 0x4235353e
mov dword [esp + 0x40], 0x2a3d3ce9
mov dword [esp + 0x44], 0x39e93d3b
mov dword [esp + 0x48], 0x2e2c383b
mov word [esp + 0x4c], 0x3c3c
mov byte [esp + 0x4e], 0xd3
mov al, byte [esp + ecx + 0x34]
add al, 0x37
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x1b
jl 0x416f35
mov byte [esp + 0x2f], 0
xor ecx, ecx
mov dword [esp + 0x50], 0xb5e6a5e9
mov dword [esp + 0x54], 0xa7b2aea5
mov dword [esp + 0x58], 0xe6b5adb5
mov dword [esp + 0x5c], 0xa3b4a5e9
invalid
inc esp
invalid
Function at 0x416e42
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 0x208]
push 0xf
pop edx
mov word [esp + 0x170], ax
call 0x4315db
lea eax, [esp + 0x148]
push eax
push edi
call 0x41bdc1
lea eax, [esp + 0x210]
push eax
push edi
call 0x41bdcf
dec edi
add byte [eax], al
lea eax, [esp + 0x178]
push eax
push edi
call 0x41bddd
add bh, bh
mov ah, 0x24
push 0x8b000001
xchg esp, eax
and al, 0x68
add dword [eax], eax
add byte [ebx - 0x57191731], cl
add dword [eax], eax
add esp, 0x1c
test al, al
je 0x417342
invalid
add byte [eax], al
mov dword [esp + 0x34], 0x869b80a5
xor ecx, ecx
mov dword [esp + 0x38], 0x9b94d297
mov dword [esp + 0x3c], 0x91d2979e
mov dword [esp + 0x40], 0x97869c9d
mov dword [esp + 0x44], 0x9bd2869c
mov dword [esp + 0x48], 0x9ed7d29c
mov word [esp + 0x4c], 0xf881
mov al, byte [esp + ecx + 0x34]
xor al, 0xf2
mov byte [esp + ecx + 0xbc], al
inc ecx
cmp ecx, 0x1a
jl 0x416e70
lea eax, [esp + 0xbc]
mov byte [esp + 0xd6], 0
push edi
push eax
call 0x428888
push 0x40
lea eax, [esp + 0x1d0]
mov dword [esp + 0x1cc], 0x44
push 0
push eax
call fcn.00419c10
add esp, 0x14
xor eax, eax
mov word [esp + 0x1f0], ax
add byte [eax], al
xor ecx, ecx
lea eax, [esp + 0x1b0]
mov edx, 0x322e7433
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push ebp
push edi
call 0x428f8f
call eax
test eax, eax
je 0x41721f
mov dword [esp + 0x34], 0x2c2c3e1c
xor ecx, ecx
mov dword [esp + 0x38], 0x2f3c3c2e
mov dword [esp + 0x3c], 0x4235353e
mov dword [esp + 0x40], 0x2a3d3ce9
mov dword [esp + 0x44], 0x39e93d3b
mov dword [esp + 0x48], 0x2e2c383b
mov word [esp + 0x4c], 0x3c3c
mov byte [esp + 0x4e], 0xd3
mov al, byte [esp + ecx + 0x34]
add al, 0x37
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x1b
jl 0x416f35
mov byte [esp + 0x2f], 0
xor ecx, ecx
mov dword [esp + 0x50], 0xb5e6a5e9
mov dword [esp + 0x54], 0xa7b2aea5
mov dword [esp + 0x58], 0xe6b5adb5
mov dword [esp + 0x5c], 0xa3b4a5e9
invalid
inc esp
invalid

Function at 0x416e6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
and al, 0x4c
cmp eax, 0x340c448a

Function at 0x416f6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
cmpsd dword [esi], dword es:[edi]
mov dl, 0xa3
out 0xc7, al
inc esp
and al, 0x64
jmp 0xc82b55fd
Function at 0x416f9f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
insb byte es:[edi], dx
scasd eax, dword es:[edi]
test al, 0xb3
mov dl, 0xc7
inc esp
and al, 0x70
mov dword [0xc7abe9e6], eax
inc esp
and al, 0x74
test eax, 0xc7f3f7e6
inc esp
and al, 0x78
js 0x416f87
jmp 0x45092458
and al, 0x7c
out 0xe4, al
jecxz 0x416f56
mov dword [esp + 0x80], 0xe9e6e4b5
mov dword [esp + 0x84], 0xe4e6a8b2
mov dword [esp + 0x88], 0xa8af919a
mov dword [esp + 0x8c], 0xb5b1a9a2
mov dword [esp + 0x90], 0x96b6b687
mov dword [esp + 0x94], 0x9aaaa9a9
mov dword [esp + 0x98], 0xe4b5aae3
js 0x416f87
jmp 0x45092458
mov al, byte [esp + ecx + 0x50]
xor al, 0xc6
movzx eax, al
mov word [esp + ecx*2 + 0x250], ax
inc ecx
cmp ecx, 0x4c
jl 0x416ff9
xor eax, eax
mov word [esp + 0x2e8], ax
lea eax, [esp + 0x14]
push eax
call 0x428a13
pop ecx
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x254]
push edi
push eax
call 0x431b6f
mov esi, eax
add esp, 0xc
test esi, esi
je 0x417473
add al, 0
invalid
mov dword [esp + 0xb4], 0xbdd7d9ad
xor ecx, ecx
mov word [esp + 0xb8], 0xcfda
mov edx, 0xff
mov byte [esp + 0xba], 0xcd
movzx eax, byte [esp + ecx + 0xb4]
sub ax, 0x6a
and ax, dx
mov word [esp + ecx*2 + 0x18c], ax
inc ecx
cmp ecx, 7
jl 0x41706c
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x19e], ax
mov edx, 0x1a52823b
lea eax, [esp + 0x190]
inc ecx
push edi
push eax
call 0x429150
call eax
rol byte [ebp + 0x5b840fc0], 1
add dword [eax], eax
invalid
push 0x44
lea eax, [esp + 0x1c4]
push 0
push eax
call fcn.00419e24
sub eax, 0xc4830000
or al, 0xc7
test byte [eax + eax*8], ah
add dword [eax], eax
add byte [eax + eax], al
add byte [ebx], dh
sal byte [ebx], 0xc9
mov word [esp + 0x1f0], ax
mov edx, 0x322e7433
lea eax, [esp + 0x1b0]
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push esi
push edi
call 0x4291ae
call eax
test eax, eax
jne 0x417213
mov dword [esp + 0x50], 0xd81f12f4
xor ecx, ecx
mov dword [esp + 0x54], 0x1512d125
mov dword [esp + 0x58], 0x1225d115
mov dword [esp + 0x5c], 0x1ad11c24
mov dword [esp + 0x60], 0x1225d11f
mov dword [esp + 0x64], 0x24d11c24
mov dword [esp + 0x68], 0x15161914
mov word [esp + 0x6c], 0x1d26
mov byte [esp + 0x6e], 0x16
mov byte [esp + 0x6f], bl
mov word [esp + 0x70], 0xd1dd
mov byte [esp + 0x72], 0xf4
mov byte [esp + 0x73], bl

Function at 0x417045
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0
add bh, al
test byte [esp + esi*4], ah
add byte [eax], al
add byte [ebp + 0x33bdd7d9], ch
leave
Function at 0x4170af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
insb byte es:[edi], dx
scasd eax, dword es:[edi]
test al, 0xb3
mov dl, 0xc7
inc esp
and al, 0x70
mov dword [0xc7abe9e6], eax
inc esp
and al, 0x74
test eax, 0xc7f3f7e6
inc esp
and al, 0x78
js 0x416f87
jmp 0x45092458
and al, 0x7c
out 0xe4, al
jecxz 0x416f56
mov dword [esp + 0x80], 0xe9e6e4b5
mov dword [esp + 0x84], 0xe4e6a8b2
mov dword [esp + 0x88], 0xa8af919a
mov dword [esp + 0x8c], 0xb5b1a9a2
mov dword [esp + 0x90], 0x96b6b687
mov dword [esp + 0x94], 0x9aaaa9a9
mov dword [esp + 0x98], 0xe4b5aae3
js 0x416f87
jmp 0x45092458
mov al, byte [esp + ecx + 0x50]
xor al, 0xc6
movzx eax, al
mov word [esp + ecx*2 + 0x250], ax
inc ecx
cmp ecx, 0x4c
jl 0x416ff9
xor eax, eax
mov word [esp + 0x2e8], ax
lea eax, [esp + 0x14]
push eax
call 0x428a13
pop ecx
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x254]
push edi
push eax
call 0x431b6f
mov esi, eax
add esp, 0xc
test esi, esi
je 0x417473
add al, 0
invalid
mov dword [esp + 0xb4], 0xbdd7d9ad
xor ecx, ecx
mov word [esp + 0xb8], 0xcfda
mov edx, 0xff
mov byte [esp + 0xba], 0xcd
movzx eax, byte [esp + ecx + 0xb4]
sub ax, 0x6a
and ax, dx
mov word [esp + ecx*2 + 0x18c], ax
inc ecx
cmp ecx, 7
jl 0x41706c
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x19e], ax
mov edx, 0x1a52823b
lea eax, [esp + 0x190]
inc ecx
push edi
push eax
call 0x429150
call eax
rol byte [ebp + 0x5b840fc0], 1
add dword [eax], eax
invalid
push 0x44
lea eax, [esp + 0x1c4]
push 0
push eax
call fcn.00419e24
sub eax, 0xc4830000
or al, 0xc7
test byte [eax + eax*8], ah
add dword [eax], eax
add byte [eax + eax], al
add byte [ebx], dh
sal byte [ebx], 0xc9
mov word [esp + 0x1f0], ax
mov edx, 0x322e7433
lea eax, [esp + 0x1b0]
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push esi
push edi
call 0x4291ae
call eax
test eax, eax
jne 0x417213
mov dword [esp + 0x50], 0xd81f12f4
xor ecx, ecx
mov dword [esp + 0x54], 0x1512d125
mov dword [esp + 0x58], 0x1225d115
mov dword [esp + 0x5c], 0x1ad11c24
mov dword [esp + 0x60], 0x1225d11f
mov dword [esp + 0x64], 0x24d11c24
mov dword [esp + 0x68], 0x15161914
mov word [esp + 0x6c], 0x1d26
mov byte [esp + 0x6e], 0x16
mov byte [esp + 0x6f], bl
mov word [esp + 0x70], 0xd1dd
mov byte [esp + 0x72], 0xf4
mov byte [esp + 0x73], bl
Function at 0x4170c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
insb byte es:[edi], dx
scasd eax, dword es:[edi]
test al, 0xb3
mov dl, 0xc7
inc esp
and al, 0x70
mov dword [0xc7abe9e6], eax
inc esp
and al, 0x74
test eax, 0xc7f3f7e6
inc esp
and al, 0x78
js 0x416f87
jmp 0x45092458
and al, 0x7c
out 0xe4, al
jecxz 0x416f56
mov dword [esp + 0x80], 0xe9e6e4b5
mov dword [esp + 0x84], 0xe4e6a8b2
mov dword [esp + 0x88], 0xa8af919a
mov dword [esp + 0x8c], 0xb5b1a9a2
mov dword [esp + 0x90], 0x96b6b687
mov dword [esp + 0x94], 0x9aaaa9a9
mov dword [esp + 0x98], 0xe4b5aae3
js 0x416f87
jmp 0x45092458
mov al, byte [esp + ecx + 0x50]
xor al, 0xc6
movzx eax, al
mov word [esp + ecx*2 + 0x250], ax
inc ecx
cmp ecx, 0x4c
jl 0x416ff9
xor eax, eax
mov word [esp + 0x2e8], ax
lea eax, [esp + 0x14]
push eax
call 0x428a13
pop ecx
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x254]
push edi
push eax
call 0x431b6f
mov esi, eax
add esp, 0xc
test esi, esi
je 0x417473
add al, 0
invalid
mov dword [esp + 0xb4], 0xbdd7d9ad
xor ecx, ecx
mov word [esp + 0xb8], 0xcfda
mov edx, 0xff
mov byte [esp + 0xba], 0xcd
movzx eax, byte [esp + ecx + 0xb4]
sub ax, 0x6a
and ax, dx
mov word [esp + ecx*2 + 0x18c], ax
inc ecx
cmp ecx, 7
jl 0x41706c
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x19e], ax
mov edx, 0x1a52823b
lea eax, [esp + 0x190]
inc ecx
push edi
push eax
call 0x429150
call eax
rol byte [ebp + 0x5b840fc0], 1
add dword [eax], eax
invalid
push 0x44
lea eax, [esp + 0x1c4]
push 0
push eax
call fcn.00419e24
sub eax, 0xc4830000
or al, 0xc7
test byte [eax + eax*8], ah
add dword [eax], eax
add byte [eax + eax], al
add byte [ebx], dh
sal byte [ebx], 0xc9
mov word [esp + 0x1f0], ax
mov edx, 0x322e7433
lea eax, [esp + 0x1b0]
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push esi
push edi
call 0x4291ae
call eax
test eax, eax
jne 0x417213
mov dword [esp + 0x50], 0xd81f12f4
xor ecx, ecx
mov dword [esp + 0x54], 0x1512d125
mov dword [esp + 0x58], 0x1225d115
mov dword [esp + 0x5c], 0x1ad11c24
mov dword [esp + 0x60], 0x1225d11f
mov dword [esp + 0x64], 0x24d11c24
mov dword [esp + 0x68], 0x15161914
mov word [esp + 0x6c], 0x1d26
mov byte [esp + 0x6e], 0x16
mov byte [esp + 0x6f], bl
mov word [esp + 0x70], 0xd1dd
mov byte [esp + 0x72], 0xf4
mov byte [esp + 0x73], bl
Function at 0x4170e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
insb byte es:[edi], dx
scasd eax, dword es:[edi]
test al, 0xb3
mov dl, 0xc7
inc esp
and al, 0x70
mov dword [0xc7abe9e6], eax
inc esp
and al, 0x74
test eax, 0xc7f3f7e6
inc esp
and al, 0x78
js 0x416f87
jmp 0x45092458
and al, 0x7c
out 0xe4, al
jecxz 0x416f56
mov dword [esp + 0x80], 0xe9e6e4b5
mov dword [esp + 0x84], 0xe4e6a8b2
mov dword [esp + 0x88], 0xa8af919a
mov dword [esp + 0x8c], 0xb5b1a9a2
mov dword [esp + 0x90], 0x96b6b687
mov dword [esp + 0x94], 0x9aaaa9a9
mov dword [esp + 0x98], 0xe4b5aae3
js 0x416f87
jmp 0x45092458
mov al, byte [esp + ecx + 0x50]
xor al, 0xc6
movzx eax, al
mov word [esp + ecx*2 + 0x250], ax
inc ecx
cmp ecx, 0x4c
jl 0x416ff9
xor eax, eax
mov word [esp + 0x2e8], ax
lea eax, [esp + 0x14]
push eax
call 0x428a13
pop ecx
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x254]
push edi
push eax
call 0x431b6f
mov esi, eax
add esp, 0xc
test esi, esi
je 0x417473
add al, 0
invalid
mov dword [esp + 0xb4], 0xbdd7d9ad
xor ecx, ecx
mov word [esp + 0xb8], 0xcfda
mov edx, 0xff
mov byte [esp + 0xba], 0xcd
movzx eax, byte [esp + ecx + 0xb4]
sub ax, 0x6a
and ax, dx
mov word [esp + ecx*2 + 0x18c], ax
inc ecx
cmp ecx, 7
jl 0x41706c
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x19e], ax
mov edx, 0x1a52823b
lea eax, [esp + 0x190]
inc ecx
push edi
push eax
call 0x429150
call eax
rol byte [ebp + 0x5b840fc0], 1
add dword [eax], eax
invalid
push 0x44
lea eax, [esp + 0x1c4]
push 0
push eax
call fcn.00419e24
sub eax, 0xc4830000
or al, 0xc7
test byte [eax + eax*8], ah
add dword [eax], eax
add byte [eax + eax], al
add byte [ebx], dh
sal byte [ebx], 0xc9
mov word [esp + 0x1f0], ax
mov edx, 0x322e7433
lea eax, [esp + 0x1b0]
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push esi
push edi
call 0x4291ae
call eax
test eax, eax
jne 0x417213
mov dword [esp + 0x50], 0xd81f12f4
xor ecx, ecx
mov dword [esp + 0x54], 0x1512d125
mov dword [esp + 0x58], 0x1225d115
mov dword [esp + 0x5c], 0x1ad11c24
mov dword [esp + 0x60], 0x1225d11f
mov dword [esp + 0x64], 0x24d11c24
mov dword [esp + 0x68], 0x15161914
mov word [esp + 0x6c], 0x1d26
mov byte [esp + 0x6e], 0x16
mov byte [esp + 0x6f], bl
mov word [esp + 0x70], 0xd1dd
mov byte [esp + 0x72], 0xf4
mov byte [esp + 0x73], bl
Function at 0x417170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, edx
mov dword [esp + 0xe0], 0x91868bb7
mov dword [esp + 0x74], 0x16251216
mov byte [esp + 0x78], 1
mov byte [esp + 0x79], bl
mov dword [esp + 0x7a], 0x24161420
and al, 0xc7
inc esp
and al, 0x7e
and al, 8
rcl dword [edi]
mov dword [esp + 0x82], 0x241d1a12
mov dword [esp + 0x86], 0x121dd1ec
add byte [eax], al
add ah, ch
rcr dword [0x2484c712], 1
mov al, byte [eax]
add byte [eax], al
and al, 0x25
rcl dword [esi]
mov byte [esp + 0x8e], bl
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], 0x20
mov byte [esp + 0x91], bl
mov dword [esp + 0x92], 0x29d6d1eb
mov byte [esp + 0x96], 0xbb
mov al, byte [esp + ecx + 0x50]
add al, 0x4f
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, 0x47
jl 0x4171e2
mov byte [esp + 0x127], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xe4]
push eax
call 0x428c00
pop ecx
pop ecx
push esi
call fcn.0041bd04
pop ecx
jmp 0x417473
push dword [esp + 0x14c]
call fcn.0041bf6a
pop ecx
push ebp
call fcn.0041bf71
pop ecx
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
push eax
push 0
call 0x41c632
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x416bdd
mov ebx, dword [esp + 0xa0]
push edi
call fcn.0041bfa0
pop ecx
push ebx
call fcn.0041bfa7
add byte [eax], al
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2e4
ret

Function at 0x417188
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, edx
mov dword [esp + 0xe0], 0x91868bb7
mov dword [esp + 0x74], 0x16251216
mov byte [esp + 0x78], 1
mov byte [esp + 0x79], bl
mov dword [esp + 0x7a], 0x24161420
and al, 0xc7
inc esp
and al, 0x7e
and al, 8
rcl dword [edi]
mov dword [esp + 0x82], 0x241d1a12
mov dword [esp + 0x86], 0x121dd1ec
add byte [eax], al
add ah, ch
rcr dword [0x2484c712], 1
mov al, byte [eax]
add byte [eax], al
and al, 0x25
rcl dword [esi]
mov byte [esp + 0x8e], bl
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], 0x20
mov byte [esp + 0x91], bl
mov dword [esp + 0x92], 0x29d6d1eb
mov byte [esp + 0x96], 0xbb
mov al, byte [esp + ecx + 0x50]
add al, 0x4f
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, 0x47
jl 0x4171e2
mov byte [esp + 0x127], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xe4]
push eax
call 0x428c00
pop ecx
pop ecx
push esi
call fcn.0041bd04
pop ecx
jmp 0x417473
push dword [esp + 0x14c]
call fcn.0041bf6a
pop ecx
push ebp
call fcn.0041bf71
pop ecx
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
push eax
push 0
call 0x41c632
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x416bdd
mov ebx, dword [esp + 0xa0]
push edi
call fcn.0041bfa0
pop ecx
push ebx
call fcn.0041bfa7
add byte [eax], al
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2e4
ret
Function at 0x4171a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, edx
mov dword [esp + 0xe0], 0x91868bb7
mov dword [esp + 0x74], 0x16251216
mov byte [esp + 0x78], 1
mov byte [esp + 0x79], bl
mov dword [esp + 0x7a], 0x24161420
and al, 0xc7
inc esp
and al, 0x7e
and al, 8
rcl dword [edi]
mov dword [esp + 0x82], 0x241d1a12
mov dword [esp + 0x86], 0x121dd1ec
add byte [eax], al
add ah, ch
rcr dword [0x2484c712], 1
mov al, byte [eax]
add byte [eax], al
and al, 0x25
rcl dword [esi]
mov byte [esp + 0x8e], bl
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], 0x20
mov byte [esp + 0x91], bl
mov dword [esp + 0x92], 0x29d6d1eb
mov byte [esp + 0x96], 0xbb
mov al, byte [esp + ecx + 0x50]
add al, 0x4f
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, 0x47
jl 0x4171e2
mov byte [esp + 0x127], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xe4]
push eax
call 0x428c00
pop ecx
pop ecx
push esi
call fcn.0041bd04
pop ecx
jmp 0x417473
push dword [esp + 0x14c]
call fcn.0041bf6a
pop ecx
push ebp
call fcn.0041bf71
pop ecx
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
push eax
push 0
call 0x41c632
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x416bdd
mov ebx, dword [esp + 0xa0]
push edi
call fcn.0041bfa0
pop ecx
push ebx
call fcn.0041bfa7
add byte [eax], al
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2e4
ret

Function at 0x4174c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
xor ecx, ecx
mov dword [ebp - 0x18], 0x97979870
mov dword [ebp - 0x14], 0x9b90498a
mov edx, ecx
mov dword [ebp - 0x10], 0x98498b8a
mov dword [ebp - 0xc], 0x98959d9e
mov word [ebp - 8], 0x9498
mov byte [ebp - 6], 0x33
mov al, byte [ebp + edx - 0x18]
sub al, 0x29
mov byte [ebp + edx - 0x30], al
inc edx
cmp edx, 0x13
jl 0x4174f8
mov byte [ebp - 0x1d], cl
mov dword [ebp - 0x1c], 0x897b8468
mov dword [ebp - 0x18], 0x7a87768c
mov dword [ebp - 0x14], 0x787e6271
bound edi, qword [esi + 0x78]