joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 1], 0x656e7265
push eax
mov word [esp + 0xc], 0x642e
mov word [esp + 9], 0x336c
mov word [esp + 0xe], 0x6c6c
mov byte [esp + 0xb], 0x32
mov byte [esp + 4], 0x4b
mov byte [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x416bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 3], 0x642e6c6c
push eax
mov word [esp + 5], 0x6474
mov word [esp + 0xc], 0x6c
mov byte [esp + 4], 0x6e
mov byte [esp + 0xb], 0x6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret

Function at 0x416c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 5], 0x2e323369
push eax
mov word [esp + 4], 0x7457
mov dword [esp + 0xd], 0x6c6c64
mov word [esp + 7], 0x7061
mov byte [esp + 6], 0x73
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x416cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 3], 0x33697061
push eax
mov dword [esp + 0xd], 0x6c6c64
mov word [esp + 5], 0x7664
mov word [esp + 0xb], 0x2e32
mov byte [esp + 4], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x416d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov word [esp + 7], 0x6c6c
push eax
mov dword [esp + 6], 0x2e323365
mov byte [esp + 0xa], 0x64
mov byte [esp + 0xd], 0
mov word [esp + 4], 0x6c4f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret

Function at 0x416db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 1], 0x33726573
push eax
mov byte [esp + 4], 0x55
mov word [esp + 0xc], 0x6c6c
mov word [esp + 9], 0x2e32
mov byte [esp + 0xb], 0x64
mov byte [esp + 0xe], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret
Function at 0x416e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 6], 0x6c642e76
push eax
mov word [esp + 0xe], 0x6c
mov dword [esp + 4], 0x72657355
mov word [esp + 8], 0x6e65
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret

Function at 0x416e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00416c70
mov edi, eax
test edi, edi
je 0x416ebd
lea eax, [esp + 0xc]
mov dword [esp + 0x11], 0x766f6d65
push eax
push edi
mov dword [esp + 0x1d], 0x6c694665
mov dword [esp + 0x14], 0x68746150
mov dword [esp + 0x23], 0x41636570
mov byte [esp + 0x18], 0x52
mov word [esp + 0x21], 0x5365
mov byte [esp + 0x27], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416eb6
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret

Function at 0x416ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
mov ebx, edx
mov eax, dword [esp + 0x38]
mov ebp, ecx
push edi
mov dword [esp + 0x10], eax
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x416f79
lea eax, [esp + 0x18]
mov word [esp + 0x1b], 0x6f54
push eax
push edi
mov word [esp + 0x20], 0x6547
mov word [esp + 0x2b], 0x726f
mov dword [esp + 0x30], 0x6e6f69
mov dword [esp + 0x25], 0x496e656b
mov word [esp + 0x2e], 0x7461
mov byte [esp + 0x2d], 0x6d
mov byte [esp + 0x22], 0x74
mov word [esp + 0x29], 0x666e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416f72
push dword [esp + 0x10]
push dword [esp + 0x3c]
push dword [esp + 0x1c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x20
ret

Function at 0x416f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.00416c20
mov edi, eax
test edi, edi
je 0x417006
lea eax, [esp + 0x10]
mov word [esp + 0x1c], 0x6f54
push eax
push edi
mov dword [esp + 0x1a], 0x65755153
mov word [esp + 0x18], 0x5457
mov dword [esp + 0x26], 0x6e656b
mov word [esp + 0x21], 0x6573
mov word [esp + 0x1e], 0x7972
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x20], 0x55
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416fff
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret
Function at 0x417020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.00416c70
mov edi, eax
test edi, edi
je 0x417087
lea eax, [esp + 0x10]
mov word [esp + 0x1a], 0x41
push eax
push edi
mov dword [esp + 0x1b], 0x70704168
mov word [esp + 0x1f], 0x6e65
mov word [esp + 0x18], 0x6150
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x21], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417080
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x10
ret

Function at 0x4170a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.00416d10
mov edi, eax
test edi, edi
je 0x417105
lea eax, [esp + 0xc]
mov dword [esp + 0xd], 0x6572436f
push eax
push edi
mov dword [esp + 0x1c], 0x64697547
mov byte [esp + 0x14], 0x43
mov word [esp + 0x19], 0x7461
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4170fe
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x417120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x6c6c64
push eax
mov ebp, edx
mov word [esp + 0x17], 0x6973
mov ebx, ecx
mov word [esp + 0x1a], 0x2e6e
xor esi, esi
mov word [esp + 0x14], 0x6576
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x19], 0x6f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4171cf
lea eax, [esp + 0x1c]
mov dword [esp + 0x29], 0x666e496e
push eax
push edi
mov word [esp + 0x3a], 0x41
mov word [esp + 0x2e], 0x6973
mov dword [esp + 0x24], 0x46746547
mov dword [esp + 0x35], 0x7a69536f
mov dword [esp + 0x29], 0x6556656c
mov byte [esp + 0x39], 0x65
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x2d], 0x72
mov byte [esp + 0x30], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4171c8
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x28
ret
Function at 0x4171f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], eax
mov ebx, edx
push edi
lea eax, [esp + 0x14]
mov word [esp + 0x14], 0x6576
push eax
mov ebp, ecx
mov dword [esp + 0x1f], 0x6c6c642e
xor esi, esi
mov dword [esp + 0x1b], 0x6e6f6973
mov byte [esp + 0x23], 0
mov byte [esp + 0x1a], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41729e
lea eax, [esp + 0x20]
mov dword [esp + 0x2e], 0x6f666e49
push eax
push edi
mov word [esp + 0x3a], 0x41
mov dword [esp + 0x2f], 0x73726556
mov dword [esp + 0x28], 0x46746547
mov word [esp + 0x2d], 0x656c
mov word [esp + 0x33], 0x6f69
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x35], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417297
push dword [esp + 0x10]
push dword [esp + 0x40]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x28
ret

Function at 0x4172c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov ebx, ecx
push esi
mov dword [esp + 0xc], eax
xor esi, esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x1b], 0x6c6c642e
push eax
mov dword [esp + 0x18], 0x73726576
mov word [esp + 0x1d], 0x6e6f
mov byte [esp + 0x23], 0
mov byte [esp + 0x1c], 0x69
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417373
lea eax, [esp + 0x20]
mov word [esp + 0x27], 0x5679
push eax
push edi
mov word [esp + 0x32], 0x756c
mov word [esp + 0x2a], 0x5172
mov word [esp + 0x2d], 0x7265
mov word [esp + 0x35], 0x41
mov byte [esp + 0x31], 0x61
mov word [esp + 0x28], 0x6556
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x34], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41736c
push dword [esp + 0x10]
push ebp
push 0x4a5850
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x24
ret
Function at 0x417390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0x7052
push eax
mov ebp, edx
mov dword [esp + 0x17], 0x2e347472
mov ebx, ecx
mov dword [esp + 0x1b], 0x6c6c64
mov esi, 0xe
mov byte [esp + 0x16], 0x63
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417423
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x676e6972
push eax
push edi
mov word [esp + 0x24], 0x7555
mov word [esp + 0x27], 0x5464
mov word [esp + 0x2a], 0x7453
mov byte [esp + 0x26], 0x69
mov word [esp + 0x30], 0x41
mov byte [esp + 0x29], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41741c
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x20
ret

Function at 0x417440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov word [esp + 0xd], 0x6370
push eax
mov ebx, ecx
mov dword [esp + 0x17], 0x6c6c64
mov esi, 0xe
mov word [esp + 0x14], 0x3474
mov byte [esp + 0x13], 0x72
mov byte [esp + 0x10], 0x52
mov byte [esp + 0x16], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4174d4
lea eax, [esp + 0x18]
mov dword [esp + 0x21], 0x65657246
push eax
push edi
mov dword [esp + 0x23], 0x69727453
mov word [esp + 0x20], 0x7052
mov word [esp + 0x2d], 0x41
mov word [esp + 0x27], 0x676e
mov byte [esp + 0x22], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4174cd
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x20
ret

Function at 0x4174f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov ebx, ecx
push esi
push edi
xor esi, esi
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x417570
lea eax, [esp + 0x10]
mov dword [esp + 0x12], 0x63696c70
push eax
push edi
mov word [esp + 0x18], 0x7544
mov word [esp + 0x23], 0x656b
mov word [esp + 0x26], 0x7845
mov byte [esp + 0x28], 0
mov dword [esp + 0x1f], 0x6f546574
mov byte [esp + 0x25], 0x6e
mov byte [esp + 0x1e], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417569
push ebp
push 1
push 2
push esi
push 0x2000000
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret
Function at 0x417590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.00416e00
mov edi, eax
test edi, edi
je 0x417614
lea eax, [esp + 0x10]
mov dword [esp + 0x21], 0x636f6c42
push eax
push edi
mov word [esp + 0x18], 0x7243
mov word [esp + 0x1b], 0x7461
mov word [esp + 0x1e], 0x6e45
mov dword [esp + 0x25], 0x746e656d
mov dword [esp + 0x21], 0x6e6f7269
mov byte [esp + 0x20], 0x76
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1d], 0x65
mov word [esp + 0x2d], 0x6b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41760d
push esi
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x1c
ret

Function at 0x417630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push ebx
mov dword [esp + 0x10], eax
mov ebx, ecx
mov eax, dword [esp + 0x48]
push ebp
mov dword [esp + 0x10], eax
mov ebp, edx
mov eax, dword [esp + 0x54]
push esi
mov dword [esp + 0x10], eax
xor esi, esi
mov eax, dword [esp + 0x5c]
push edi
mov dword [esp + 0x10], eax
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x4176e4
lea eax, [esp + 0x20]
mov dword [esp + 0x31], 0x417265
push eax
push edi
mov dword [esp + 0x2e], 0x636f7250
mov dword [esp + 0x28], 0x61657243
mov word [esp + 0x36], 0x5573
mov word [esp + 0x33], 0x7373
mov byte [esp + 0x35], 0x41
mov word [esp + 0x2c], 0x6574
mov byte [esp + 0x38], 0x73
mov byte [esp + 0x32], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4176dd
push dword [esp + 0x10]
push dword [esp + 0x18]
push esi
push dword [esp + 0x24]
push dword [esp + 0x60]
push esi
push esi
push esi
push dword [esp + 0x3c]
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x38]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x2c
ret

Function at 0x417700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0x42746547
push eax
mov edi, edx
mov dword [esp + 0x14], 0x70795479
mov esi, ecx
mov word [esp + 0x19], 0x41
mov dword [esp + 0x10], 0x72616e69
mov byte [esp + 0x18], 0x65
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417762
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
Function at 0x417830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0xd], 0x7373
push eax
mov edi, edx
mov dword [esp + 0xc], 0x636f7250
mov esi, ecx
mov word [esp + 0x18], 0x74
mov dword [esp + 0x13], 0x654e3233
mov byte [esp + 0x17], 0x78
mov byte [esp + 0x10], 0x65
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417896
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x4178b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x10], 0x72694632
push eax
mov edi, edx
mov dword [esp + 0xf], 0x73736563
mov esi, ecx
mov word [esp + 0xd], 0x6f72
mov word [esp + 0x19], 0x74
mov byte [esp + 0x18], 0x73
mov byte [esp + 0xc], 0x50
mov byte [esp + 0x13], 0x33
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41791b
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x14
ret

Function at 0x417930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
mov word [esp + 0xc], 0x706c
push eax
mov dword [esp + 6], 0x65746165
mov word [esp + 0x17], 0x7370
mov dword [esp + 0x13], 0x616e5332
mov word [esp + 0x1a], 0x746f
mov dword [esp + 0xc], 0x65686c6f
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x1c], 0
mov word [esp + 4], 0x7243
mov word [esp + 0xa], 0x6f54
mov byte [esp + 0x19], 0x68
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4179b1
push 0
push 2
call eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041c13e
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor ecx, esp
call fcn.0041c13e
add esp, 0x20
ret

Function at 0x4179d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov esi, ecx
call fcn.00416c70
mov edi, eax
test edi, edi
je 0x417a39
lea eax, [esp + 8]
mov dword [esp + 0x16], 0x41656d
push eax
push edi
mov dword [esp + 0x13], 0x6e694668
mov dword [esp + 0x1a], 0x614e656c
mov word [esp + 0x10], 0x6150
mov byte [esp + 0x12], 0x74
mov word [esp + 0x17], 0x4664
mov byte [esp + 0x19], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417a32
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x18
ret
Function at 0x417a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
mov ebx, edx
mov eax, dword [esp + 0x30]
mov ebp, ecx
push edi
mov dword [esp + 0x10], eax
mov esi, 1
call fcn.00416cc0
mov edi, eax
test edi, edi
je 0x417ae1
lea eax, [esp + 0x18]
mov word [esp + 0x24], 0x41
push eax
push edi
mov dword [esp + 0x22], 0x756e4567
mov word [esp + 0x20], 0x6552
mov word [esp + 0x26], 0x4b6d
mov word [esp + 0x29], 0x4579
mov byte [esp + 0x2b], 0x78
mov byte [esp + 0x28], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417ada
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x1c
ret

Function at 0x417b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
lea eax, [esp + 4]
mov dword [esp + 0xe], 0x41656d69
push eax
mov esi, ecx
mov dword [esp + 0x1b], 0x656d6954
mov dword [esp + 9], 0x79537465
mov dword [esp + 0x17], 0x656c6946
mov byte [esp + 0x1f], 0
mov dword [esp + 0xd], 0x6d657473
mov byte [esp + 0x16], 0x73
mov byte [esp + 8], 0x47
mov byte [esp + 0x11], 0x54
call fcn.00416b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417b65
push esi
call eax
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x1c
ret

Function at 0x417bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
xor esi, esi
call fcn.00416c20
mov edi, eax
test edi, edi
je 0x417c56
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0x73736553
push eax
push edi
mov dword [esp + 0x28], 0x736e6f69
mov word [esp + 0x20], 0x6172
mov word [esp + 0x1d], 0x6d75
mov word [esp + 0x22], 0x6574
mov dword [esp + 0x18], 0x45535457
mov byte [esp + 0x1f], 0x65
mov word [esp + 0x2c], 0x41
mov byte [esp + 0x1c], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417c4f
push ebp
push ebx
push 1
push esi
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c13e
add esp, 0x1c
ret