joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414114
Capabilities:
Encode data using xor

Disassembly:
push 0x2e
pop eax
mov word [esp + 0x64], ax
mov ecx, ebx
lea eax, [esp + 0x138]
push eax
call fcn.00419012
pop ecx
pop ecx
test eax, eax
je 0x414257
test byte [esp + 0x108], 0xa7
je 0x414257
lea eax, [esp + 0x134]
push eax
call fcn.00418d5f
pop ecx
cmp eax, 4
jb 0x414257
push 0x73
pop eax
cmp word [esp + 0x134], ax
jne 0x414257
cmp word [esp + 0x136], ax
jne 0x414257
cmp word [esp + 0x138], 0x66
jne 0x414257
cmp word [esp + 0x13a], 0x6e
jne 0x414257
mov dword [esp + 0x38], 0xebc4db92
mov ecx, ebx
mov word [esp + 0x3c], 0xdb92
mov byte [esp + 0x3e], 0xc4
mov al, byte [esp + ecx + 0x38]
xor al, 0xb7
movzx eax, al
mov word [esp + ecx*2 + 0x24], ax
inc ecx
cmp ecx, 7
jl 0x4141a3
xor eax, eax
mov word [esp + 0x32], ax
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x35c]
push eax
lea eax, [esp + 0x2c]
push eax
call 0x42ed0c
mov edi, eax
add esp, 0xc
test edi, edi
je 0x414252
push 8
mov dword [esp + 0x14], 0x595d6c4b
mov ecx, ebx
mov dword [esp + 0x18], 0x641d2765
mov edx, 0xff
mov byte [esp + 0x1c], 0x6b
pop esi
movzx eax, byte [esp + ecx + 0x10]
add ax, si
and ax, dx
mov word [esp + ecx*2 + 0x48], ax
inc ecx
cmp ecx, 9
jl 0x414200
xor eax, eax
mov word [esp + 0x5a], ax
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x4c]
push eax
call 0x42ed63
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x414247
mov edx, esi
mov ecx, edi
call 0x42bf67
push esi
call fcn.00418d31
pop ecx
push edi
call fcn.00418d38
mov esi, dword [esp + 0x6c]
pop ecx
mov edi, 0xff
lea eax, [esp + 0x108]
push eax
push esi
call ebp
test eax, eax
jne 0x4140c4
xor ecx, ecx
mov edx, 0x83fbc401
push esi
inc ecx
call 0x42631a
call eax
mov ebp, dword [esp + 0x1c]
push ebp
call fcn.00418d6f
pop ecx
lea eax, [esp + 0x358]
push eax
lea eax, [esp + 0xac]
push eax
call 0x42edce
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x414339
push 0x2e
pop eax
push 0x37
pop edx
mov word [esp + 0x10], 0x3d1c
mov ecx, ebx
mov byte [esp + 0x12], al
and al, 0x12
mov dword [esp + 0x13], 0x2cf8362a
mov byte [esp + 0x17], 0x38
cmp byte [eax + 0x66182454], cl
mov dword [esp + 0x19], 0x44c6322f
and al, 0x1b
invalid
movzx eax, byte [esp + ecx + 0x10]
add ax, dx
and ax, di
mov word [esp + ecx*2 + 0x48], ax
inc ecx
cmp ecx, 0xc
jl 0x4142d6
xor eax, eax
mov dword [esp + 0x1c], 0xfb0dc5c1
mov word [esp + 0x60], ax
mov byte [esp + 0x20], 0xfd
movzx eax, byte [esp + ebx + 0x1c]
add ax, 0x69
and ax, di
mov word [esp + ebx*2 + 0x10], ax
inc ebx
cmp ebx, 5
jl 0x414300
xor eax, eax
lea edx, [esp + 0x48]
mov word [esp + 0x1a], ax
mov ecx, esi
lea eax, [esp + 0x10]
push 1
push eax
call 0x42bc22
push esi
call fcn.00418e21
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74c
ret

Function at 0x41455d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x18
xchg dword [edx - 0x40727f], edx
add byte [eax], al
add byte [eax], al
movq xmm0, qword [esp + 0x14]
Function at 0x414566
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
movq xmm0, qword [esp + 0x14]
mov word [esp + 0x78], ax
pxor xmm1, xmm0
push 0x2a
pop eax
xorps xmm0, xmm0
mov word [esp + 0x38], ax
xor eax, eax
punpcklbw xmm1, xmm0
mov dword [esp + 0x40], esi
xor ecx, ecx
movups xmmword [esp + 0x68], xmm1
mov word [esp + 0x3a], ax
mov dword [esp + 0x1c], 0x647b742d
mov byte [esp + 0x20], 0x32
movzx eax, byte [esp + ecx + 0x1c]
sub ax, 8
and ax, di
mov word [esp + ecx*2 + 0x4c], ax
inc ecx
cmp ecx, 5
jl 0x4145a5
xor eax, eax
lea edx, [esp + 0x68]
mov word [esp + 0x56], ax
inc esp
and al, 0x56
mov ecx, esi
lea eax, [esp + 0x38]
push 1
push eax
call 0x42bec7
lea eax, [esp + 0x54]
push esi
push eax
call 0x42f114
mov ebx, eax
add esp, 0x10
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x4147ca
lea eax, [esp + 0x98]
xor ecx, ecx
push eax
push ebx
mov edx, 0x54e1cc7b
inc ecx
call 0x4266a9
call eax
xor ecx, ecx
mov edx, 0x17299c7b
inc ecx
mov ebp, eax
call fcn.00412ca7
cmp ebp, 0xffffffff
je 0x4147c3
mov word [esp + 0x24], 0xe3e3
mov ebx, eax

Function at 0x4147dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], 0x5454557d
push edi
mov dword [ebp - 0x1c], 0x485d1a5b
xor ecx, ecx
mov dword [ebp - 0x18], 0x7d1a585b
mov dword [ebp - 0x14], 0x5551595f
mov dword [ebp - 0x10], 0x4d554878
push ebp
dec ebp
Function at 0x414806
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
dec ebp
mov dword [ebp - 0xc], 0x49485f49
mov byte [ebp - 8], 0x30
mov al, byte [ebp + ecx - 0x20]
xor al, 0x3a
mov byte [ebp + ecx - 0xbc], al
inc ecx
cmp ecx, 0x19
jl 0x414813
lea eax, [ebp - 0xbc]
mov byte [ebp - 0xa3], 0
push eax
call 0x426228
cmp byte [esi + 2], 0
pop ecx
jne 0x414861
cmp byte [esi + 1], 0
jne 0x414861
cmp byte [esi + 4], 0
jne 0x414861
cmp byte [esi + 6], 0
jne 0x414861
cmp byte [esi + 3], 0
jne 0x414861
cmp byte [esi], 0
je 0x414abb
xor ecx, ecx
inc ecx
call 0x42c887
mov ebx, eax
test ebx, ebx
je 0x4149a3
mov dword [ebp - 0x40], 0x90103e5
xor ecx, ecx
mov dword [ebp - 0x3c], 0x1000be0d
mov dword [ebp - 0x38], 0x311150d
mov dword [ebp - 0x34], 0x15be1110
mov dword [ebp - 0x30], 0xbe031003
mov dword [ebp - 0x2c], 0x10120310
mov dword [ebp - 0x28], 0x3140307
xor edx, edx
mov dword [ebp - 0x74], 0x2009dbdb
mov dword [ebp - 0x70], 0x190e1221
mov ecx, edx
mov dword [ebp - 0x6c], 0x14091f12
mov dword [ebp - 0x68], 0x1c181012
mov dword [ebp - 0x64], 0x241c1f0f
mov dword [ebp - 0x60], 0x201f1220
mov dword [ebp - 0x5c], 0x1d1d10db
mov al, byte [ebp + ecx - 0x74]
add al, 0x53
mov byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 0x1c
jl 0x4149d8
mov byte [ebp - 0x24], dl
mov ecx, edx
mov dword [ebp - 0x54], 0x6b75684f
mov dword [ebp - 0x50], 0x6c4e6c73
mov dword [ebp - 0x4c], 0x4976726a
mov dword [ebp - 0x48], 0x7a7e7679
mov word [ebp - 0x44], 0x796c
mov byte [ebp - 0x42], 0x7a
mov al, byte [ebp + ecx - 0x54]
sub al, 7
mov byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 0x13
jl 0x414a13
mov byte [ebp - 9], dl
mov ecx, edx
mov dword [ebp - 0x9c], 0x7e7b7358
mov dword [ebp - 0x98], 0x86327677
mov dword [ebp - 0x94], 0x77843281
mov dword [ebp - 0x90], 0x777b8486
mov dword [ebp - 0x8c], 0x79327788
mov dword [ebp - 0x88], 0x817d7577
mov dword [ebp - 0x84], 0x81847432
mov dword [ebp - 0x80], 0x84778589
mov dword [ebp - 0x7c], 0x73823285
mov dword [ebp - 0x78], 0x1c857a86
mov al, byte [ebp + ecx - 0x9c]
sub al, 0x12
adc cl, byte [eax - 0xe7f27c]
invalid
inc dword [ecx - 0x7d]
stc
invalid
jl 0x414a83
lea eax, [ebp - 0xe8]
mov byte [ebp - 0xc0], dl
call dword [eax - 0x73]
inc ebp
in al, 0x50

Function at 0x414cf9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x38
xchg esi, eax
xchg edx, eax
xchg dword [ecx + 0x44c7cb8b], ecx
and al, 0x3c
mov ebx, dword [ecx - 0x4566ac]
add byte [eax], al
add bh, al
inc esp
and al, 0x40
xchg edi, eax
xchg edx, eax
invalid

Function at 0x414d36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shl byte [esi - 0x77], 0x84
and al, 0xfe
add byte [eax], al
add byte [eax], al
invalid
test byte [esp + ebx*8], ah
invalid

Function at 0x414d3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
lea eax, [esp + 0xdc]
add byte [eax], al
Function at 0x414d44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
push edi
push eax
call 0x42f881
mov edi, eax
mov dword [esp + 0x70], edi
pop ecx
pop ecx
test edi, edi
je 0x4150c5
mov ecx, edi
call 0x42f8f2
mov ebp, eax
test ebp, ebp
je 0x4150be
xor edx, edx
mov ecx, ebp
call 0x42fb71
add dword [eax], eax
mov dword [esp + 0x74], eax

Function at 0x414d75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
push edi
push eax
call 0x42f881
mov edi, eax
mov dword [esp + 0x70], edi
pop ecx
pop ecx
test edi, edi
je 0x4150c5
mov ecx, edi
call 0x42f8f2
mov ebp, eax
test ebp, ebp
je 0x4150be
xor edx, edx
mov ecx, ebp
call 0x42fb71
add dword [eax], eax
mov dword [esp + 0x74], eax

Function at 0x414dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
and al, 0x2c
sub al, 0x8d
and al, 0x8a
inc esp
or al, 0x14

Function at 0x414de1
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x14]
sub al, 0x1a
mov byte [esp + ecx + 0x9c], al
inc ecx
cmp ecx, 0x1a
jl 0x414dd3
mov byte [esp + 0xb6], bl
mov ecx, ebx
mov dword [esp + 0x34], 0x343b3442
and al, 0x34
inc edx
xor al, 0x3b
xor al, 0xc7
inc esp
and al, 0x38
xor al, byte [ebx + 0xf]
arpl di, ax
inc esp
and al, 0x3c
pop eax
arpl word [ebx + 0x54], bx
mov dword [esp + 0x40], 0x61640f1b
mov dword [esp + 0x44], 0x41350f5b
mov dword [esp + 0x48], 0x5c0f3c3e
mov dword [esp + 0x4c], 0x5f4e695e
mov dword [esp + 0x50], 0x5452505b
mov byte [esp + 0x54], 0x62
mov al, byte [esp + ecx + 0x34]
add al, 0x11
mov byte [esp + ecx + 0xb8], al
inc ecx
cmp ecx, 0x21
jl 0x414e34
lea eax, [esp + 0x9c]
mov byte [esp + 0xd9], bl
push edi
push eax
call 0x42684b
push ebx
lea eax, [esp + 0x3c]
push eax
push 0xffffffffffffffff
dec dword [ebp + 0xcc2484]
add byte [eax], al
push eax
push dword [esp + 0x84]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x41508d
push dword [esp + 0x30]
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
push dword [esp + 0x30]
call dword [esi + 0x18]
pop ecx
push dword [esp + 0x6c]
call dword [esi + 0x1c]
pop ecx
push dword [esp + 0x74]
call 0x419b91
pop ecx
xor ecx, ecx
mov edx, 0x62d87b
push ebp
inc ecx
call 0x427157
call eax
push ebp
call fcn.00419ba8
pop ecx
push edi
call fcn.00419baf
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x414e63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x14]
sub al, 0x1a
mov byte [esp + ecx + 0x9c], al
inc ecx
cmp ecx, 0x1a
jl 0x414dd3
mov byte [esp + 0xb6], bl
mov ecx, ebx
mov dword [esp + 0x34], 0x343b3442
and al, 0x34
inc edx
xor al, 0x3b
xor al, 0xc7
inc esp
and al, 0x38
xor al, byte [ebx + 0xf]
arpl di, ax
inc esp
and al, 0x3c
pop eax
arpl word [ebx + 0x54], bx
mov dword [esp + 0x40], 0x61640f1b
mov dword [esp + 0x44], 0x41350f5b
mov dword [esp + 0x48], 0x5c0f3c3e
mov dword [esp + 0x4c], 0x5f4e695e
mov dword [esp + 0x50], 0x5452505b
mov byte [esp + 0x54], 0x62
mov al, byte [esp + ecx + 0x34]
add al, 0x11
mov byte [esp + ecx + 0xb8], al
inc ecx
cmp ecx, 0x21
jl 0x414e34
lea eax, [esp + 0x9c]
mov byte [esp + 0xd9], bl
push edi
push eax
call 0x42684b
push ebx
lea eax, [esp + 0x3c]
push eax
push 0xffffffffffffffff
dec dword [ebp + 0xcc2484]
add byte [eax], al
push eax
push dword [esp + 0x84]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x41508d
push dword [esp + 0x30]
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
push dword [esp + 0x30]
call dword [esi + 0x18]
pop ecx
push dword [esp + 0x6c]
call dword [esi + 0x1c]
pop ecx
push dword [esp + 0x74]
call 0x419b91
pop ecx
xor ecx, ecx
mov edx, 0x62d87b
push ebp
inc ecx
call 0x427157
call eax
push ebp
call fcn.00419ba8
pop ecx
push edi
call fcn.00419baf
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x414e8a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
push 7
pop es
pop edi
cmp eax, 0x64
jne 0x414fea
mov dword [esp + 0x58], 0x8c948974
mov word [esp + 0x5c], 0x5a85
mov byte [esp + 0x5e], 0x40
mov dword [esp + 0x60], 0x32154a4d
mov word [esp + 0x64], 0x7a2c
mov byte [esp + 0x66], 0x60
mov ecx, ebx
mov al, byte [esp + ecx + 0x58]
sub al, 0x20
mov byte [esp + ecx + 0x78], al
inc ecx
cmp ecx, edi
jl 0x414ec6
mov byte [esp + 0x7f], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x60]
xor al, 0x40
mov byte [esp + ecx + 0x80], al
inc ecx
cmp ecx, edi
jl 0x414edb
mov byte [esp + 0x87], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x33330003
mov dword [esp + 0x18], 0x33333333
mov dword [esp + 0x1c], 0x33333333
mov dword [esp + 0x20], 0x33333333
mov word [esp + 0x24], 0x333
mov byte [esp + 0x26], bl
mov al, byte [esp + ecx + 0x14]
add al, 0xa
mov byte [esp + ecx + 0x88], al
inc ecx
cmp ecx, 0x13
jl 0x414f21
lea eax, [esp + 0x78]
mov byte [esp + 0x9b], bl
push eax
call fcn.00419e80
pop ecx
push eax
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x38]
call 0x42fbcb
pop ecx
push ebx
push dword [esp + 0x34]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
cmp dword [esp + 0x34], ebx
je fcn.00415089
mov dword [esp + 0x14], 0x6d6c6241
mov ecx, 0xff
mov dword [esp + 0x18], 0x28726b68
mov dword [esp + 0x1c], 0x586c651e
mov dword [esp + 0x20], 0x276c651e
mov word [esp + 0x24], 0x716d
mov byte [esp + 0x26], 0x6d
movzx eax, byte [esp + ebx + 0x14]
add ax, di
and ax, cx
and eax, ecx
mov word [esp + ebx*2 + 0x100], ax
inc ebx
cmp ebx, 0x13
jl 0x415025
push dword [esp + 0x12c]
xor eax, eax
push dword [esp + 0x74]
mov word [esp + 0x12e], ax
lea eax, [esp + 0x108]
push eax
call 0x42fb94
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41507f
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
push edi
call 0x42d057
pop ecx
push edi
call fcn.00419b69
pop ecx
push dword [esp + 0x34]
call fcn.00419b73
pop ecx
Function at 0x414e91
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
push 7
pop es
pop edi
cmp eax, 0x64
jne 0x414fea
mov dword [esp + 0x58], 0x8c948974
mov word [esp + 0x5c], 0x5a85
mov byte [esp + 0x5e], 0x40
mov dword [esp + 0x60], 0x32154a4d
mov word [esp + 0x64], 0x7a2c
mov byte [esp + 0x66], 0x60
mov ecx, ebx
mov al, byte [esp + ecx + 0x58]
sub al, 0x20
mov byte [esp + ecx + 0x78], al
inc ecx
cmp ecx, edi
jl 0x414ec6
mov byte [esp + 0x7f], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x60]
xor al, 0x40
mov byte [esp + ecx + 0x80], al
inc ecx
cmp ecx, edi
jl 0x414edb
mov byte [esp + 0x87], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x33330003
mov dword [esp + 0x18], 0x33333333
mov dword [esp + 0x1c], 0x33333333
mov dword [esp + 0x20], 0x33333333
mov word [esp + 0x24], 0x333
mov byte [esp + 0x26], bl
mov al, byte [esp + ecx + 0x14]
add al, 0xa
mov byte [esp + ecx + 0x88], al
inc ecx
cmp ecx, 0x13
jl 0x414f21
lea eax, [esp + 0x78]
mov byte [esp + 0x9b], bl
push eax
call fcn.00419e80
pop ecx
push eax
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x38]
call 0x42fbcb
pop ecx
push ebx
push dword [esp + 0x34]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
cmp dword [esp + 0x34], ebx
je fcn.00415089
mov dword [esp + 0x14], 0x6d6c6241
mov ecx, 0xff
mov dword [esp + 0x18], 0x28726b68
mov dword [esp + 0x1c], 0x586c651e
mov dword [esp + 0x20], 0x276c651e
mov word [esp + 0x24], 0x716d
mov byte [esp + 0x26], 0x6d
movzx eax, byte [esp + ebx + 0x14]
add ax, di
and ax, cx
and eax, ecx
mov word [esp + ebx*2 + 0x100], ax
inc ebx
cmp ebx, 0x13
jl 0x415025
push dword [esp + 0x12c]
xor eax, eax
push dword [esp + 0x74]
mov word [esp + 0x12e], ax
lea eax, [esp + 0x108]
push eax
call 0x42fb94
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41507f
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
push edi
call 0x42d057
pop ecx
push edi
call fcn.00419b69
pop ecx
push dword [esp + 0x34]
call fcn.00419b73
pop ecx

Function at 0x414f61
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 0x38]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x38]
call 0x42fd47
pop ecx
lea eax, [esp + 0x80]
push eax
call fcn.00419ebe
dec edi
add byte [eax], al
pop ecx
push eax
lea edx, [esp + 0x84]
lea ecx, [esp + 0x38]
call 0x42fc0c
pop ecx
push 1
push dword [esp + 0x34]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x38]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x38]
call 0x42fd8a
pop ecx
lea eax, [esp + 0x88]
push eax
call fcn.00419f01
pop ecx
push eax
lea edx, [esp + 0x8c]
add byte [eax], al
add byte [ebp - 0x17c7dbb4], cl
ja 0x414f82
add dword [eax], eax
pop ecx
push dword [esp + 0x30]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x414ec4

Function at 0x414f86
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg esp, eax
and al, 0x84
add byte [eax], al
add byte [ebp - 0x17c7dbb4], cl
ja 0x414f3f
add dword [eax], eax
Function at 0x414fcc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x50], bl
add byte [eax], al
add byte [ebp - 0x17c7dbb4], cl
ja 0x414f82
add dword [eax], eax

Function at 0x415244
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [esi]
movhlps xmm0, xmm7
inc esp
and al, 0x6c
or eax, 0xc7130908
or dword [ebx], edx
mov dword [esp + 0x70], 0x19120f14
mov al, byte [esp + ecx + 0x48]
add al, 0x60
mov byte [esp + ecx + 0xd8], al
inc ecx
cmp ecx, 0x2c
jl 0x415258
lea eax, [esp + 0xb8]
mov byte [esp + 0x104], bl
push edi
push eax
call 0x426c6f
push ebx
lea eax, [esp + 0x3c]
push eax

Function at 0x41524e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [esi]
movhlps xmm0, xmm7
inc esp
and al, 0x6c
or eax, 0xc7130908
or dword [ebx], edx
mov dword [esp + 0x70], 0x19120f14
mov al, byte [esp + ecx + 0x48]
add al, 0x60
mov byte [esp + ecx + 0xd8], al
inc ecx
cmp ecx, 0x2c
jl 0x415258
lea eax, [esp + 0xb8]
mov byte [esp + 0x104], bl
push edi
push eax
call 0x426c6f
push ebx
lea eax, [esp + 0x3c]
push eax

Function at 0x41526f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [esi]
movhlps xmm0, xmm7
inc esp
and al, 0x6c
or eax, 0xc7130908
or dword [ebx], edx
mov dword [esp + 0x70], 0x19120f14
mov al, byte [esp + ecx + 0x48]
add al, 0x60
mov byte [esp + ecx + 0xd8], al
inc ecx
cmp ecx, 0x2c
jl 0x415258
lea eax, [esp + 0xb8]
mov byte [esp + 0x104], bl
push edi
push eax
call 0x426c6f
push ebx
lea eax, [esp + 0x3c]
push eax
Function at 0x415363
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
and al, 0xb7
add byte [eax], al
add byte [eax - 0x18], dl
cmp ecx, dword [edi]
add byte [ecx + 0x50], bl

Function at 0x415540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test esi, esi
je 0x415ab7
xor ebx, ebx
mov dword [esp + 0x20], 0x132a23dc
mov dword [esp + 0x24], 0x2226261a
and al, 0x1a
and cl, byte es:[ebx + 0x2444c7cb]
sub byte [eax], ah
sbb al, 0x2a
in eax, 0xba
inc dword [eax]
add byte [eax], al
Function at 0x415565
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
mov dword [esp + 0x2c], 0x2023282a
mov word [esp + 0x30], 0x1c2b
movzx eax, byte [esp + ecx + 0x20]
add ax, 0x49
and ax, dx
mov word [esp + ecx*2 + 0x118], ax
add byte [eax], al
inc ecx
cmp ecx, 0x12
jl 0x415553
xor eax, eax
mov word [esp + 0x13c], ax
lea eax, [esp + 0x118]
push edi
push eax
call 0x4300b9
mov edi, eax
mov dword [esp + 0xd4], edi
pop ecx
pop ecx
test edi, edi
je 0x415ab7
mov ecx, edi
call 0x43012d
mov ebp, eax
test ebp, ebp
je 0x415ab0
invalid
xor edx, edx
mov ecx, ebp
call 0x4303ac
mov dword [esp + 0xe8], eax
test eax, eax
je 0x415a99
push ebx
push 1
lea ecx, [esp + 0xd8]
push ecx
push eax
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x415a81
mov dword [esp + 0x34], 0x10b0c23
mov ecx, ebx
mov dword [esp + 0x38], 0x6000245
inc ebp
add al, byte [eax]
push es
mov dword [esp + 0x3c], 0x6450a0e
mov dword [esp + 0x40], 0xc0e0a0a
mov dword [esp + 0x44], 0x1451600
mov dword [esp + 0x48], 0x9404507
mov word [esp + 0x4c], 0x6f16
mov al, byte [esp + ecx + 0x34]
xor al, 0x65
mov byte [esp + ecx + 0xfc], al
inc ecx
cmp ecx, 0x1a
jl 0x415614
mov byte [esp + 0x116], bl
mov ecx, ebx
mov dword [esp + 0x78], 0xc1c8c1cf
mov dword [esp + 0x7c], 0xe49cd0bf
mov dword [esp + 0x80], 0xa8f0efeb
mov dword [esp + 0x84], 0xc4efe59c
mov dword [esp + 0x88], 0xcbecf0f0
mov byte [eax], al
add byte [eax], al
invalid
invalid
in al, dx
retf
mov dword [esp + 0x8c], 0xa8f5e8ea
mov dword [esp + 0x90], 0xf0ddec9c
add byte [eax], al
pushfd
in al, dx
invalid
invalid
mov dword [esp + 0x94], 0xe59ca8e4
mov dword [esp + 0x98], 0xdfe1cfef
mov dword [esp + 0x9c], 0xa8e1eef1
add byte [eax], al
add cl, dh
out dx, al
loope 0x415640
mov dword [esp + 0xa0], 0xecf4e19c
mov dword [esp + 0xa4], 0xa8f5eee5
test al, 0xc7
test byte [eax + ebp*4], ah
add byte [eax], al
add byte [edx + ebp*8 - 0x7b381623], bl
and al, 0xac
add byte [eax], al
add cl, ah
test al, 0x9c
mov dword [esp + 0xb0], 0xe1f1e8dd
mov dword [esp + 0xb4], 0xcbcec29c
mov dword [esp + 0xb8], 0xebe99cc9
mov dword [esp + 0xbc], 0xebdfdbf6
mov dword [esp + 0xc0], 0xe1e5e7eb
mov byte [esp + 0xc4], 0xef
mov al, byte [esp + ecx + 0x78]
sub al, 0x7c
mov byte [esp + ecx + 0x140], al
inc ecx
cmp ecx, 0x4d
jl 0x415703
lea eax, [esp + 0xfc]
mov byte [esp + 0x18d], bl
push edi
push eax
call 0x42711a
add dword [eax], eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x154]
push eax
push dword [esp + 0xe8]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x415a79
push dword [esp + 0x14]
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4159da
mov dword [esp + 0x58], 0xc2bfc176
mov word [esp + 0x5c], 0x76b2
mov dword [esp + 0x68], 0x5a57501f
mov word [esp + 0x6c], 0x5345
mov byte [esp + 0x6e], 0x1f
mov dword [esp + 0x60], 0x888f89d4
mov word [esp + 0x64], 0xd498
mov dword [esp + 0x70], 0x5faffc2
mov word [esp + 0x74], 0xfe0c
mov byte [esp + 0x76], 0xc2
mov word [esp + 0x50], 0x3639