joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov ebx, ecx
push esi
push edi
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x418ec8
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x63697672
push eax
push edi
mov word [esp + 0x18], 0x6553
mov word [esp + 0x26], 0x7463
mov dword [esp + 0x22], 0x656a624f
mov dword [esp + 0x2d], 0x797469
mov dword [esp + 0x29], 0x72756365
mov word [esp + 0x1b], 0x6553
mov byte [esp + 0x21], 0x65
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x28], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418ec1
push ebp
push 4
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x20
ret

Function at 0x418ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ebx, edx
push esi
push edi
mov esi, 1
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x418f4b
lea eax, [esp + 0x10]
mov word [esp + 0x14], 0x6570
push eax
push edi
mov dword [esp + 0x1f], 0x4179654b
mov dword [esp + 0x18], 0x4f676552
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418f44
push ebp
push ebx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret

Function at 0x418f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
mov dword [esp + 0x10], eax
mov ebx, edx
mov eax, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
push esi
mov dword [esp + 0x10], eax
xor esi, esi
mov eax, dword [esp + 0x48]
push edi
mov dword [esp + 0x10], eax
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x419013
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0x6e756f63
push eax
push edi
mov dword [esp + 0x35], 0x41646953
mov dword [esp + 0x2a], 0x70756b6f
mov byte [esp + 0x39], 0
mov word [esp + 0x28], 0x6f4c
mov word [esp + 0x2e], 0x6341
mov byte [esp + 0x34], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41900c
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebp
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x28
ret
Function at 0x419030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x10], eax
mov esi, 1
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x4190b3
lea eax, [esp + 0x14]
mov dword [esp + 0x21], 0x79746972
push eax
push edi
mov dword [esp + 0x1f], 0x4b746547
mov dword [esp + 0x25], 0x75636553
mov word [esp + 0x23], 0x7965
mov word [esp + 0x1c], 0x6552
mov byte [esp + 0x2d], 0
mov byte [esp + 0x1e], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4190ac
push dword [esp + 0x10]
push ebp
push 4
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x1c
ret

Function at 0x4190d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x419138
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x72655365
push eax
push edi
mov dword [esp + 0x1c], 0x65636976
mov dword [esp + 0x20], 0x646e6148
mov word [esp + 0x24], 0x656c
mov dword [esp + 0x14], 0x736f6c43
mov byte [esp + 0x26], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419131
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret

Function at 0x419150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x4191b6
lea eax, [esp + 8]
mov dword [esp + 0xe], 0x616e614d
push eax
push edi
mov dword [esp + 0x12], 0x43536e65
mov word [esp + 0x10], 0x704f
mov word [esp + 0x1d], 0x41
mov word [esp + 0x1a], 0x6567
mov byte [esp + 0x1c], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4191af
push 1
push esi
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
Function at 0x4191d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x419241
lea eax, [esp + 0x10]
mov word [esp + 0x11], 0x6570
push eax
push edi
mov word [esp + 0x1c], 0x6553
mov dword [esp + 0x1f], 0x65636976
mov byte [esp + 0x1e], 0x72
mov word [esp + 0x23], 0x41
mov byte [esp + 0x18], 0x4f
mov byte [esp + 0x1b], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41923a
push 0x60000
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x419260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
lea eax, [esp + 4]
mov word [esp + 6], 0x7472
push eax
mov esi, edx
mov dword [esp + 0x10], 0x636f6c6c
mov word [esp + 0xd], 0x6c61
mov word [esp + 8], 0x6956
mov byte [esp + 0xf], 0x41
mov byte [esp + 0x14], 0
mov byte [esp + 0xc], 0x75
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4192ce
push 4
push 0x1000
push esi
push 0
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x4192e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
push eax
mov edi, edx
mov word [esp + 0x17], 0x7574
mov esi, ecx
mov word [esp + 0x14], 0x6956
mov dword [esp + 0x1e], 0x7845636f
mov word [esp + 0x19], 0x6c61
mov byte [esp + 0x22], 0
mov word [esp + 0x1c], 0x6c6c
mov byte [esp + 0x1b], 0x41
mov byte [esp + 0x16], 0x72
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419364
push ebp
push 0x3000
push ebx
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
Function at 0x419450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x10], eax
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x4194e9
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x72657551
push eax
push edi
mov dword [esp + 0x30], 0x69727563
mov dword [esp + 0x24], 0x65636976
mov dword [esp + 0x20], 0x72655379
mov dword [esp + 0x29], 0x63656a62
mov word [esp + 0x35], 0x79
mov word [esp + 0x2d], 0x5374
mov byte [esp + 0x28], 0x4f
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x34], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4194e2
push dword [esp + 0x10]
push dword [esp + 0x40]
push ebp
push 4
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x24
ret

Function at 0x419500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov ebx, edx
push esi
push edi
mov esi, 1
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x419581
lea eax, [esp + 0x10]
mov dword [esp + 0x1a], 0x577845
push eax
push edi
mov word [esp + 0x19], 0x6765
mov byte [esp + 0x18], 0x52
mov word [esp + 0x1c], 0x6570
mov word [esp + 0x1f], 0x654b
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1b], 0x4f
mov byte [esp + 0x21], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41957a
push ebp
push dword [esp + 0x30]
push 0
push ebx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x4195a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov dword [esp + 0x10], eax
mov ebp, edx
mov eax, dword [esp + 0x38]
mov ebx, ecx
push esi
mov dword [esp + 0x10], eax
mov esi, 1
mov eax, dword [esp + 0x40]
push edi
mov dword [esp + 0x10], eax
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x419634
lea eax, [esp + 0x1c]
mov word [esp + 0x2b], 0x57
push eax
push edi
mov dword [esp + 0x2e], 0x4565756c
mov dword [esp + 0x2a], 0x61567972
mov dword [esp + 0x24], 0x51676552
mov word [esp + 0x28], 0x6575
mov byte [esp + 0x32], 0x78
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41962d
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x20]
push 0
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x24
ret
Function at 0x419650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 1
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x4196bf
lea eax, [esp + 0xc]
mov word [esp + 0x15], 0x7965
push eax
push edi
mov word [esp + 0x14], 0x6552
mov word [esp + 0x17], 0x6c43
mov byte [esp + 0x1f], 0
mov word [esp + 0x1a], 0x6573
mov byte [esp + 0x16], 0x67
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1c], 0x4b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4196b8
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret

Function at 0x4196e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x419763
lea eax, [esp + 0x10]
mov dword [esp + 0x23], 0x416469
push eax
push edi
mov dword [esp + 0x1a], 0x7265766e
mov dword [esp + 0x22], 0x74536f54
mov word [esp + 0x1f], 0x6953
mov word [esp + 0x26], 0x6972
mov word [esp + 0x29], 0x5367
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x21], 0x64
mov word [esp + 0x18], 0x6f43
mov byte [esp + 0x28], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41975c
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x1c
ret

Function at 0x419780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov dword [esp + 0x10], eax
mov esi, 1
mov eax, dword [esp + 0x3c]
push edi
mov dword [esp + 0x10], eax
call fcn.00416c70
mov edi, eax
test edi, edi
je 0x419822
lea eax, [esp + 0x18]
mov dword [esp + 0x1a], 0x51636f73
push eax
push edi
mov word [esp + 0x2a], 0x7453
mov word [esp + 0x2d], 0x6e69
mov word [esp + 0x20], 0x7341
mov word [esp + 0x30], 0x41
mov word [esp + 0x27], 0x7265
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2f], 0x67
mov byte [esp + 0x26], 0x75
mov byte [esp + 0x29], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41981b
push dword [esp + 0x10]
push dword [esp + 0x18]
push ebp
push ebx
push 2
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x20
ret
Function at 0x4198c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x20], eax
lea eax, [esp]
mov dword [esp + 8], 0x65766974
push eax
mov dword [esp + 0x18], 0x69737365
mov dword [esp + 0x12], 0x6c6f736e
mov word [esp + 0x1c], 0x6e6f
mov word [esp + 0x1f], 0x64
mov dword [esp + 7], 0x41746547
mov byte [esp + 0x1e], 0x49
mov byte [esp + 0xb], 0x63
mov word [esp + 0x16], 0x5365
mov word [esp + 5], 0x5354
mov word [esp + 0x10], 0x6f43
mov byte [esp + 4], 0x57
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419945
call eax
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0041c13e
add esp, 0x24
ret
mov ecx, dword [esp + 0x20]
or eax, 0xffffffff
xor ecx, esp
call fcn.0041c13e
add esp, 0x24
ret

Function at 0x419960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [0x4b0e38]
lea eax, [esp + 4]
push eax
mov dword [esp + 0x14], 0x6a624f65
mov dword [esp + 0x18], 0x746365
mov word [esp + 9], 0x6961
mov dword [esp + 0xf], 0x676e6953
mov word [esp + 0xc], 0x6f46
mov byte [esp + 0xb], 0x74
mov byte [esp + 0xe], 0x72
mov byte [esp + 8], 0x57
mov byte [esp + 0x13], 0x6c
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4199d9
push 0xffffffffffffffff
push esi
call eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret

Function at 0x419a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x419af9
lea eax, [esp + 0xc]
mov dword [esp + 0x12], 0x65537265
push eax
push edi
mov word [esp + 0x26], 0x486c
mov dword [esp + 0x2e], 0x417845
mov dword [esp + 0x20], 0x43656369
mov word [esp + 0x29], 0x646e
mov word [esp + 0x2c], 0x7265
mov word [esp + 0x1e], 0x7672
mov dword [esp + 0x15], 0x73696765
mov byte [esp + 0x14], 0x52
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x28], 0x61
mov word [esp + 0x24], 0x7274
mov byte [esp + 0x2b], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419af2
push esi
push 0x40fb00
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x24
ret
Function at 0x419b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov word [esp + 4], 0x6574
push eax
mov word [esp + 0xd], 0x746e
mov word [esp + 5], 0x6572
mov word [esp + 0xa], 0x7645
mov byte [esp + 7], 0x61
mov word [esp + 0xf], 0x41
mov byte [esp + 0xc], 0x65
mov byte [esp + 4], 0x43
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419b7d
push 0
push 0
push 1
push 0
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x419b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 4]
mov dword [esp + 0xb], 0x6f567473
push eax
mov esi, ecx
mov dword [esp + 0x13], 0x656d756c
mov dword [esp + 0xa], 0x6946646e
mov word [esp + 8], 0x6946
mov word [esp + 0x17], 0x57
mov byte [esp + 0xe], 0x72
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419bf9
push 0x104
push esi
call eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret

Function at 0x419c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xf], 0x77656956
push eax
mov edi, edx
mov dword [esp + 0xe], 0x616d6e55
mov esi, ecx
mov dword [esp + 0x17], 0x6553664f
mov byte [esp + 0x12], 0x70
mov dword [esp + 0x1d], 0x6e6f69
mov word [esp + 0xc], 0x744e
mov word [esp + 0x1b], 0x7463
call fcn.00416bd0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419c81
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0041c13e
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
mov eax, 0xc0000022
pop edi
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x1c
ret

Function at 0x419ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x34]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
push eax
mov edi, edx
mov dword [esp + 0x16], 0x65746165
mov esi, ecx
mov word [esp + 0x1e], 0x7365
mov word [esp + 0x1b], 0x6f72
mov byte [esp + 0x1a], 0x50
mov byte [esp + 0x1d], 0x63
mov word [esp + 0x14], 0x7243
mov word [esp + 0x20], 0x4173
mov byte [esp + 0x22], 0
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419d2e
push ebp
push ebx
push 0
push 0
push 0x8000004
push 0
push 0
push 0
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
Function at 0x419d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
push eax
mov edi, edx
mov word [esp + 0x14], 0x7243
mov esi, ecx
mov word [esp + 0x17], 0x7461
mov word [esp + 0x1a], 0x6946
mov word [esp + 0x1d], 0x4165
mov byte [esp + 0x1f], 0
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1c], 0x6c
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419dd2
push 0
push ebp
push ebx
push 0
push 0
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret

Function at 0x419df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 4]
push esi
push edi
push eax
mov edi, edx
mov dword [esp + 0x13], 0x69466574
mov esi, ecx
mov word [esp + 0x11], 0x6972
mov word [esp + 0x17], 0x656c
mov byte [esp + 0x10], 0x57
mov byte [esp + 0x19], 0
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419e5b
push 0
push ebx
push dword [esp + 0x28]
push edi
push esi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret

Function at 0x419fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 0xa], 0x70616548
push eax
mov dword [esp + 9], 0x7365636f
mov dword [esp + 5], 0x72507465
mov byte [esp + 0x12], 0
mov byte [esp + 4], 0x47
mov byte [esp + 0xd], 0x73
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a02a
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x41a040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 1], 0x614c7465
push eax
mov word [esp + 0xb], 0x7245
mov word [esp + 0xe], 0x726f
mov word [esp + 9], 0x7473
mov byte [esp + 0xd], 0x72
mov byte [esp + 4], 0x47
mov byte [esp + 0x10], 0
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a09f
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
mov eax, 1
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret