joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4104fb
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
dec ebp
mov dword [esp + 0x24], 0x6a3f5250
mov word [esp + 0x28], 0x736d
mov byte [esp + 0x2a], 0x6c
mov al, byte [esp + ecx + 0x10]
xor al, 0x1f
mov byte [esp + ecx + 0xc4], al
inc ecx
cmp ecx, 0x1b
jl 0x410510
lea eax, [esp + 0xe0]
mov byte [esp + 0xdf], bl
add byte [eax], al
push edi
push eax
call 0x421f27

Function at 0x41052f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
mov dword [esp + 0x24], 0x6a3f5250
mov word [esp + 0x28], 0x736d
mov byte [esp + 0x2a], 0x6c
mov al, byte [esp + ecx + 0x10]
xor al, 0x1f
mov byte [esp + ecx + 0xc4], al
inc ecx
cmp ecx, 0x1b
jl 0x410510
lea eax, [esp + 0xe0]
mov byte [esp + 0xdf], bl
add byte [eax], al
push edi
push eax
call 0x421f27
Function at 0x410555
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
jne 0x410768
push dword [esp + 0x2c]
lea edi, [esp + 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4106d2
pop ebp
add dword [eax], eax
add byte [eax], al
mov dword [esp + 0x3c], 0x4b534e73
mov word [esp + 0x40], 0x1d42
mov byte [esp + 0x42], 7
mov dword [esp + 0x30], 0x593cf1f4
mov word [esp + 0x34], 0x2153
mov byte [esp + 0x36], 7
mov ecx, ebx
mov al, byte [esp + ecx + 0x3c]
xor al, 0x27
mov byte [esp + ecx + 0x88], al
inc ecx
cmp ecx, 7
jl 0x41059f
mov byte [esp + 0x8f], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x30]
add al, 0x19
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 7
jl 0x4105bb
mov byte [esp + 0x97], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x10102720
mov dword [esp + 0x14], 0x10101010
mov dword [esp + 0x18], 0x10101010
mov dword [esp + 0x1c], 0x10101010
adc byte [eax], dl
mov word [esp + 0x20], 0x2010
mov byte [esp + 0x22], 0x27
mov al, byte [esp + ecx + 0x10]
xor al, 0x2d
mov byte [esp + ecx + 0x98], al
inc ecx
cmp ecx, 0x13
jl 0x410603
lea eax, [esp + 0x88]
mov byte [esp + 0xab], bl
add byte [eax], al
add byte [eax - 0x18], dl
cmp ecx, dword [edi]
add byte [ecx + 0x50], bl
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x48]
call 0x42b2b3
lodsb al, byte [esi]
add dword [eax], eax
pop ecx
push 1
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
dec eax
call 0x42b431
add dword [eax], eax
pop ecx
lea eax, [esp + 0x90]
push eax
call fcn.004155a8
pop ecx
push eax
lea edx, [esp + 0x94]
lea ecx, [esp + 0x48]
call 0x42b2f6
pop ecx
push ebx
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call 0x42b472
pop ecx
lea eax, [esp + 0x98]
push eax
call fcn.004155e9
pop ecx
push eax
lea edx, [esp + 0x9c]
lea ecx, [esp + 0x48]
call 0x42b337
pop ecx
push dword [esp + 0x2c]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x41059d
cmp dword [esp + 0x44], ebx
je fcn.00410764
invalid
mov byte [eax], al
add byte [eax], al
mov dword [esp + 0x10], 0x47405a7b
mov dword [esp + 0x14], 0x1c4a415c
mov dword [esp + 0x18], 0x6c405f16
mov dword [esp + 0x1c], 0x1d405f16
mov word [esp + 0x20], 0x4b47
mov byte [esp + 0x22], 0x47
mov al, byte [esp + ebx + 0x10]
xor al, 0x33
movzx eax, al
mov word [esp + ebx*2 + 0x50], ax
inc ebx
cmp ebx, 0x13
jl 0x410708
push dword [esp + 0x104]
xor eax, eax
push dword [esp + 0x84]
mov word [esp + 0x7e], ax
lea eax, [esp + 0x58]
push eax
call 0x42b26f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41075a
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push edi
call 0x428732
pop ecx
push edi
call fcn.00415244
pop ecx
push dword [esp + 0x44]
call fcn.0041524e
pop ecx
Function at 0x4105d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
jne 0x410768
push dword [esp + 0x2c]
lea edi, [esp + 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4106d2
pop ebp
add dword [eax], eax
add byte [eax], al
mov dword [esp + 0x3c], 0x4b534e73
mov word [esp + 0x40], 0x1d42
mov byte [esp + 0x42], 7
mov dword [esp + 0x30], 0x593cf1f4
mov word [esp + 0x34], 0x2153
mov byte [esp + 0x36], 7
mov ecx, ebx
mov al, byte [esp + ecx + 0x3c]
xor al, 0x27
mov byte [esp + ecx + 0x88], al
inc ecx
cmp ecx, 7
jl 0x41059f
mov byte [esp + 0x8f], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x30]
add al, 0x19
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 7
jl 0x4105bb
mov byte [esp + 0x97], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x10102720
mov dword [esp + 0x14], 0x10101010
mov dword [esp + 0x18], 0x10101010
mov dword [esp + 0x1c], 0x10101010
adc byte [eax], dl
mov word [esp + 0x20], 0x2010
mov byte [esp + 0x22], 0x27
mov al, byte [esp + ecx + 0x10]
xor al, 0x2d
mov byte [esp + ecx + 0x98], al
inc ecx
cmp ecx, 0x13
jl 0x410603
lea eax, [esp + 0x88]
mov byte [esp + 0xab], bl
add byte [eax], al
add byte [eax - 0x18], dl
cmp ecx, dword [edi]
add byte [ecx + 0x50], bl
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x48]
call 0x42b2b3
lodsb al, byte [esi]
add dword [eax], eax
pop ecx
push 1
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
dec eax
call 0x42b431
add dword [eax], eax
pop ecx
lea eax, [esp + 0x90]
push eax
call fcn.004155a8
pop ecx
push eax
lea edx, [esp + 0x94]
lea ecx, [esp + 0x48]
call 0x42b2f6
pop ecx
push ebx
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call 0x42b472
pop ecx
lea eax, [esp + 0x98]
push eax
call fcn.004155e9
pop ecx
push eax
lea edx, [esp + 0x9c]
lea ecx, [esp + 0x48]
call 0x42b337
pop ecx
push dword [esp + 0x2c]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x41059d
cmp dword [esp + 0x44], ebx
je fcn.00410764
invalid
mov byte [eax], al
add byte [eax], al
mov dword [esp + 0x10], 0x47405a7b
mov dword [esp + 0x14], 0x1c4a415c
mov dword [esp + 0x18], 0x6c405f16
mov dword [esp + 0x1c], 0x1d405f16
mov word [esp + 0x20], 0x4b47
mov byte [esp + 0x22], 0x47
mov al, byte [esp + ebx + 0x10]
xor al, 0x33
movzx eax, al
mov word [esp + ebx*2 + 0x50], ax
inc ebx
cmp ebx, 0x13
jl 0x410708
push dword [esp + 0x104]
xor eax, eax
push dword [esp + 0x84]
mov word [esp + 0x7e], ax
lea eax, [esp + 0x58]
push eax
call 0x42b26f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41075a
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push edi
call 0x428732
pop ecx
push edi
call fcn.00415244
pop ecx
push dword [esp + 0x44]
call fcn.0041524e
pop ecx
Function at 0x4105f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
jne 0x410768
push dword [esp + 0x2c]
lea edi, [esp + 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4106d2
pop ebp
add dword [eax], eax
add byte [eax], al
mov dword [esp + 0x3c], 0x4b534e73
mov word [esp + 0x40], 0x1d42
mov byte [esp + 0x42], 7
mov dword [esp + 0x30], 0x593cf1f4
mov word [esp + 0x34], 0x2153
mov byte [esp + 0x36], 7
mov ecx, ebx
mov al, byte [esp + ecx + 0x3c]
xor al, 0x27
mov byte [esp + ecx + 0x88], al
inc ecx
cmp ecx, 7
jl 0x41059f
mov byte [esp + 0x8f], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x30]
add al, 0x19
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 7
jl 0x4105bb
mov byte [esp + 0x97], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x10102720
mov dword [esp + 0x14], 0x10101010
mov dword [esp + 0x18], 0x10101010
mov dword [esp + 0x1c], 0x10101010
adc byte [eax], dl
mov word [esp + 0x20], 0x2010
mov byte [esp + 0x22], 0x27
mov al, byte [esp + ecx + 0x10]
xor al, 0x2d
mov byte [esp + ecx + 0x98], al
inc ecx
cmp ecx, 0x13
jl 0x410603
lea eax, [esp + 0x88]
mov byte [esp + 0xab], bl
add byte [eax], al
add byte [eax - 0x18], dl
cmp ecx, dword [edi]
add byte [ecx + 0x50], bl
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x48]
call 0x42b2b3
lodsb al, byte [esi]
add dword [eax], eax
pop ecx
push 1
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
dec eax
call 0x42b431
add dword [eax], eax
pop ecx
lea eax, [esp + 0x90]
push eax
call fcn.004155a8
pop ecx
push eax
lea edx, [esp + 0x94]
lea ecx, [esp + 0x48]
call 0x42b2f6
pop ecx
push ebx
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call 0x42b472
pop ecx
lea eax, [esp + 0x98]
push eax
call fcn.004155e9
pop ecx
push eax
lea edx, [esp + 0x9c]
lea ecx, [esp + 0x48]
call 0x42b337
pop ecx
push dword [esp + 0x2c]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x41059d
cmp dword [esp + 0x44], ebx
je fcn.00410764
invalid
mov byte [eax], al
add byte [eax], al
mov dword [esp + 0x10], 0x47405a7b
mov dword [esp + 0x14], 0x1c4a415c
mov dword [esp + 0x18], 0x6c405f16
mov dword [esp + 0x1c], 0x1d405f16
mov word [esp + 0x20], 0x4b47
mov byte [esp + 0x22], 0x47
mov al, byte [esp + ebx + 0x10]
xor al, 0x33
movzx eax, al
mov word [esp + ebx*2 + 0x50], ax
inc ebx
cmp ebx, 0x13
jl 0x410708
push dword [esp + 0x104]
xor eax, eax
push dword [esp + 0x84]
mov word [esp + 0x7e], ax
lea eax, [esp + 0x58]
push eax
call 0x42b26f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41075a
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push edi
call 0x428732
pop ecx
push edi
call fcn.00415244
pop ecx
push dword [esp + 0x44]
call fcn.0041524e
pop ecx
Function at 0x41065d
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
test eax, eax
jne 0x410768
push dword [esp + 0x2c]
lea edi, [esp + 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4106d2
pop ebp
add dword [eax], eax
add byte [eax], al
mov dword [esp + 0x3c], 0x4b534e73
mov word [esp + 0x40], 0x1d42
mov byte [esp + 0x42], 7
mov dword [esp + 0x30], 0x593cf1f4
mov word [esp + 0x34], 0x2153
mov byte [esp + 0x36], 7
mov ecx, ebx
mov al, byte [esp + ecx + 0x3c]
xor al, 0x27
mov byte [esp + ecx + 0x88], al
inc ecx
cmp ecx, 7
jl 0x41059f
mov byte [esp + 0x8f], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x30]
add al, 0x19
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 7
jl 0x4105bb
mov byte [esp + 0x97], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x10102720
mov dword [esp + 0x14], 0x10101010
mov dword [esp + 0x18], 0x10101010
mov dword [esp + 0x1c], 0x10101010
adc byte [eax], dl
mov word [esp + 0x20], 0x2010
mov byte [esp + 0x22], 0x27
mov al, byte [esp + ecx + 0x10]
xor al, 0x2d
mov byte [esp + ecx + 0x98], al
inc ecx
cmp ecx, 0x13
jl 0x410603
lea eax, [esp + 0x88]
mov byte [esp + 0xab], bl
add byte [eax], al
add byte [eax - 0x18], dl
cmp ecx, dword [edi]
add byte [ecx + 0x50], bl
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x48]
call 0x42b2b3
lodsb al, byte [esi]
add dword [eax], eax
pop ecx
push 1
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
dec eax
call 0x42b431
add dword [eax], eax
pop ecx
lea eax, [esp + 0x90]
push eax
call fcn.004155a8
pop ecx
push eax
lea edx, [esp + 0x94]
lea ecx, [esp + 0x48]
call 0x42b2f6
pop ecx
push ebx
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call 0x42b472
pop ecx
lea eax, [esp + 0x98]
push eax
call fcn.004155e9
pop ecx
push eax
lea edx, [esp + 0x9c]
lea ecx, [esp + 0x48]
call 0x42b337
pop ecx
push dword [esp + 0x2c]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x41059d
cmp dword [esp + 0x44], ebx
je fcn.00410764
invalid
mov byte [eax], al
add byte [eax], al
mov dword [esp + 0x10], 0x47405a7b
mov dword [esp + 0x14], 0x1c4a415c
mov dword [esp + 0x18], 0x6c405f16
mov dword [esp + 0x1c], 0x1d405f16
mov word [esp + 0x20], 0x4b47
mov byte [esp + 0x22], 0x47
mov al, byte [esp + ebx + 0x10]
xor al, 0x33
movzx eax, al
mov word [esp + ebx*2 + 0x50], ax
inc ebx
cmp ebx, 0x13
jl 0x410708
push dword [esp + 0x104]
xor eax, eax
push dword [esp + 0x84]
mov word [esp + 0x7e], ax
lea eax, [esp + 0x58]
push eax
call 0x42b26f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41075a
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push edi
call 0x428732
pop ecx
push edi
call fcn.00415244
pop ecx
push dword [esp + 0x44]
call fcn.0041524e
pop ecx
Function at 0x4106d7
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
jne 0x410768
push dword [esp + 0x2c]
lea edi, [esp + 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4106d2
pop ebp
add dword [eax], eax
add byte [eax], al
mov dword [esp + 0x3c], 0x4b534e73
mov word [esp + 0x40], 0x1d42
mov byte [esp + 0x42], 7
mov dword [esp + 0x30], 0x593cf1f4
mov word [esp + 0x34], 0x2153
mov byte [esp + 0x36], 7
mov ecx, ebx
mov al, byte [esp + ecx + 0x3c]
xor al, 0x27
mov byte [esp + ecx + 0x88], al
inc ecx
cmp ecx, 7
jl 0x41059f
mov byte [esp + 0x8f], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x30]
add al, 0x19
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 7
jl 0x4105bb
mov byte [esp + 0x97], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x10102720
mov dword [esp + 0x14], 0x10101010
mov dword [esp + 0x18], 0x10101010
mov dword [esp + 0x1c], 0x10101010
adc byte [eax], dl
mov word [esp + 0x20], 0x2010
mov byte [esp + 0x22], 0x27
mov al, byte [esp + ecx + 0x10]
xor al, 0x2d
mov byte [esp + ecx + 0x98], al
inc ecx
cmp ecx, 0x13
jl 0x410603
lea eax, [esp + 0x88]
mov byte [esp + 0xab], bl
add byte [eax], al
add byte [eax - 0x18], dl
cmp ecx, dword [edi]
add byte [ecx + 0x50], bl
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x48]
call 0x42b2b3
lodsb al, byte [esi]
add dword [eax], eax
pop ecx
push 1
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
dec eax
call 0x42b431
add dword [eax], eax
pop ecx
lea eax, [esp + 0x90]
push eax
call fcn.004155a8
pop ecx
push eax
lea edx, [esp + 0x94]
lea ecx, [esp + 0x48]
call 0x42b2f6
pop ecx
push ebx
push dword [esp + 0x30]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x34]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call 0x42b472
pop ecx
lea eax, [esp + 0x98]
push eax
call fcn.004155e9
pop ecx
push eax
lea edx, [esp + 0x9c]
lea ecx, [esp + 0x48]
call 0x42b337
pop ecx
push dword [esp + 0x2c]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x41059d
cmp dword [esp + 0x44], ebx
je fcn.00410764
invalid
mov byte [eax], al
add byte [eax], al
mov dword [esp + 0x10], 0x47405a7b
mov dword [esp + 0x14], 0x1c4a415c
mov dword [esp + 0x18], 0x6c405f16
mov dword [esp + 0x1c], 0x1d405f16
mov word [esp + 0x20], 0x4b47
mov byte [esp + 0x22], 0x47
mov al, byte [esp + ebx + 0x10]
xor al, 0x33
movzx eax, al
mov word [esp + ebx*2 + 0x50], ax
inc ebx
cmp ebx, 0x13
jl 0x410708
push dword [esp + 0x104]
xor eax, eax
push dword [esp + 0x84]
mov word [esp + 0x7e], ax
lea eax, [esp + 0x58]
push eax
call 0x42b26f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41075a
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push edi
call 0x428732
pop ecx
push edi
call fcn.00415244
pop ecx
push dword [esp + 0x44]
call fcn.0041524e
pop ecx
Function at 0x4108c0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov cl, 0xf3
mov bh, 0xb2
mov al, byte [esp + ecx + 0x18]
xor al, 0xd3
mov byte [esp + ecx + 0x1b4], al
inc ecx
cmp ecx, 0x1e
jl 0x4108bd
mov byte [esp + 0x1d2], bl
mov ecx, ebx
mov dword [esp + 0x78], 0x131a1305
mov dword [esp + 0x7c], 0x33760215
jl 0x4108fb
add dh, byte [esi + 0x33]
mov dword [esp + 0x80], 0x243f262e
mov dword [esp + 0x84], 0x393f2237
and al, 0x84
add byte [eax], al
add byte [edi], dh
and bh, byte [edi]
cmp edi, eax
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [eax], bh
or dword [ebx], edi
cmp edi, dword [ecx]
mov dword [esp + 0x8c], 0x7a3e2238
mov dword [esp + 0x90], 0x262e3376
add byte [eax], al
jbe fcn.00410951
mov dword es:[esp + 0x94], 0x2237243f
mov dword [esp + 0x98], 0x938393f
test byte [eax + ebx*4], ah
add byte [eax], al
add byte [edi], bh
cmp dword [eax], edi
or edi, eax
test byte [esp + ebx*4], ah
add byte [eax], al
add byte [edi], ch
xor esi, dword [edi]
and al, 0xc7
test byte [eax], ah
add byte [eax], al
add byte [edx + 0x76], bh
cmp byte [edi], dh

Function at 0x4108d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov cl, 0xf3
mov bh, 0xb2
mov al, byte [esp + ecx + 0x18]
xor al, 0xd3
mov byte [esp + ecx + 0x1b4], al
inc ecx
cmp ecx, 0x1e
jl 0x4108bd
mov byte [esp + 0x1d2], bl
mov ecx, ebx
mov dword [esp + 0x78], 0x131a1305
mov dword [esp + 0x7c], 0x33760215
jl 0x4108fb
add dh, byte [esi + 0x33]
mov dword [esp + 0x80], 0x243f262e
mov dword [esp + 0x84], 0x393f2237
and al, 0x84
add byte [eax], al
add byte [edi], dh
and bh, byte [edi]
cmp edi, eax
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [eax], bh
or dword [ebx], edi
cmp edi, dword [ecx]
mov dword [esp + 0x8c], 0x7a3e2238
mov dword [esp + 0x90], 0x262e3376
add byte [eax], al
jbe fcn.00410951
mov dword es:[esp + 0x94], 0x2237243f
mov dword [esp + 0x98], 0x938393f
test byte [eax + ebx*4], ah
add byte [eax], al
add byte [edi], bh
cmp dword [eax], edi
or edi, eax
test byte [esp + ebx*4], ah
add byte [eax], al
add byte [edi], ch
xor esi, dword [edi]
and al, 0xc7
test byte [eax], ah
add byte [eax], al
add byte [edx + 0x76], bh
cmp byte [edi], dh

Function at 0x4108e4
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
add eax, 0xc7131a13
inc esp
and al, 0x7c
adc eax, 0xc7337602
test byte [eax + eax*4], ah
add byte [eax], al
add byte [esi], ch
aas
and al, 0xc7
test byte [esp + eax*4], ah
and al, 0x84
add byte [eax], al
add byte [edi], dh
and bh, byte [edi]
cmp edi, eax
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [eax], bh
or dword [ebx], edi
cmp edi, dword [ecx]
mov dword [esp + 0x8c], 0x7a3e2238
invalid
add byte [eax], al
cmp byte [edx], ah
jp 0x4108dd
test byte [eax + edx*4], ah
add byte [eax], al
add byte [eax], al
jbe fcn.00410951
Function at 0x4108f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 0xc7131a13
inc esp
and al, 0x7c
adc eax, 0xc7337602
test byte [eax + eax*4], ah
add byte [eax], al
add byte [esi], ch
aas
and al, 0xc7
test byte [esp + eax*4], ah
and al, 0x84
add byte [eax], al
add byte [edi], dh
and bh, byte [edi]
cmp edi, eax
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [eax], bh
or dword [ebx], edi
cmp edi, dword [ecx]
mov dword [esp + 0x8c], 0x7a3e2238
invalid
add byte [eax], al
cmp byte [edx], ah
jp 0x4108dd
test byte [eax + edx*4], ah
add byte [eax], al
add byte [eax], al
jbe fcn.00410951

Function at 0x410908
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 0xc7131a13
inc esp
and al, 0x7c
adc eax, 0xc7337602
test byte [eax + eax*4], ah
add byte [eax], al
add byte [esi], ch
aas
and al, 0xc7
test byte [esp + eax*4], ah
and al, 0x84
add byte [eax], al
add byte [edi], dh
and bh, byte [edi]
cmp edi, eax
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [eax], bh
or dword [ebx], edi
cmp edi, dword [ecx]
mov dword [esp + 0x8c], 0x7a3e2238
invalid
add byte [eax], al
cmp byte [edx], ah
jp 0x4108dd
test byte [eax + edx*4], ah
add byte [eax], al
add byte [eax], al
jbe fcn.00410951

Function at 0x41090f
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
add eax, 0xc7131a13
inc esp
and al, 0x7c
adc eax, 0xc7337602
test byte [eax + eax*4], ah
add byte [eax], al
add byte [esi], ch
aas
and al, 0xc7
test byte [esp + eax*4], ah
and al, 0x84
add byte [eax], al
add byte [edi], dh
and bh, byte [edi]
cmp edi, eax
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [eax], bh
or dword [ebx], edi
cmp edi, dword [ecx]
mov dword [esp + 0x8c], 0x7a3e2238
invalid
add byte [eax], al
cmp byte [edx], ah
jp 0x4108dd
test byte [eax + edx*4], ah
add byte [eax], al
add byte [eax], al
jbe fcn.00410951

Function at 0x41091a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
jbe fcn.00410951
mov dword es:[esp + 0x94], 0x2237243f
Function at 0x41092c
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov cl, 0xf3
mov bh, 0xb2
mov al, byte [esp + ecx + 0x18]
xor al, 0xd3
mov byte [esp + ecx + 0x1b4], al
inc ecx
cmp ecx, 0x1e
jl 0x4108bd
mov byte [esp + 0x1d2], bl
mov ecx, ebx
mov dword [esp + 0x78], 0x131a1305
mov dword [esp + 0x7c], 0x33760215
jl 0x4108fb
add dh, byte [esi + 0x33]
mov dword [esp + 0x80], 0x243f262e
mov dword [esp + 0x84], 0x393f2237
and al, 0x84
add byte [eax], al
add byte [edi], dh
and bh, byte [edi]
cmp edi, eax
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [eax], bh
or dword [ebx], edi
cmp edi, dword [ecx]
mov dword [esp + 0x8c], 0x7a3e2238
mov dword [esp + 0x90], 0x262e3376
add byte [eax], al
jbe fcn.00410951
mov dword es:[esp + 0x94], 0x2237243f
mov dword [esp + 0x98], 0x938393f
test byte [eax + ebx*4], ah
add byte [eax], al
add byte [edi], bh
cmp dword [eax], edi
or edi, eax
test byte [esp + ebx*4], ah
add byte [eax], al
add byte [edi], ch
xor esi, dword [edi]
and al, 0xc7
test byte [eax], ah
add byte [eax], al
add byte [edx + 0x76], bh
cmp byte [edi], dh

Function at 0x41093e
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov cl, 0xf3
mov bh, 0xb2
mov al, byte [esp + ecx + 0x18]
xor al, 0xd3
mov byte [esp + ecx + 0x1b4], al
inc ecx
cmp ecx, 0x1e
jl 0x4108bd
mov byte [esp + 0x1d2], bl
mov ecx, ebx
mov dword [esp + 0x78], 0x131a1305
mov dword [esp + 0x7c], 0x33760215
jl 0x4108fb
add dh, byte [esi + 0x33]
mov dword [esp + 0x80], 0x243f262e
mov dword [esp + 0x84], 0x393f2237
and al, 0x84
add byte [eax], al
add byte [edi], dh
and bh, byte [edi]
cmp edi, eax
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [eax], bh
or dword [ebx], edi
cmp edi, dword [ecx]
mov dword [esp + 0x8c], 0x7a3e2238
mov dword [esp + 0x90], 0x262e3376
add byte [eax], al
jbe fcn.00410951
mov dword es:[esp + 0x94], 0x2237243f
mov dword [esp + 0x98], 0x938393f
test byte [eax + ebx*4], ah
add byte [eax], al
add byte [edi], bh
cmp dword [eax], edi
or edi, eax
test byte [esp + ebx*4], ah
add byte [eax], al
add byte [edi], ch
xor esi, dword [edi]
and al, 0xc7
test byte [eax], ah
add byte [eax], al
add byte [edx + 0x76], bh
cmp byte [edi], dh

Function at 0x410950
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
xor esi, dword [edi]
and al, 0xc7
test byte [eax], ah
add byte [eax], al
add byte [edx + 0x76], bh
cmp byte [edi], dh
mov dword [esp + 0xa4], 0x3909333b
mov dword [esp + 0xa8], 0x37350938

Function at 0x410962
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebx], bh
xor ecx, dword [ecx]
cmp edi, eax
test byte [eax + ebp*4], ah
add byte [eax], al
add byte [eax], bh
or dword [0x2484c737], esi
mov dword [esp + 0xac], 0x767a3224
inc esp
or al, 0x78

Function at 0x410974
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xac], 0x767a3224
mov dword [esp + 0xb0], 0x32243735