joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.10020275
call fcn.10020275
mov eax, dword [eax + 0xc]
push 0x100290c0
push 0x69
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x10001209
call fcn.10020275
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10001209
call fcn.10020275
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x22
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x10001209
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10001202
test ebp, ebp
je 0x10001202
mov ecx, esi
mov esi, eax
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push 1
push ecx
push edx
push ebp
call fcn.1000c540
add esp, 0x10
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x10002b60
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x10002b6e
xor eax, eax
pop esi
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x10002b7b
xor eax, eax
pop esi
ret 8
mov eax, dword [esp + 8]
lea ecx, [esi + 0x60]
push eax
call fcn.1001a1a5
mov ecx, dword [esp + 0xc]
push 0
push 4
push 0
push 0
push esi
push 0x10002cf0
mov dword [esi + 0x64], ecx
call fcn.1001a5d0
test eax, eax
mov dword [esi], eax
jne 0x10002baf
mov dword [esi + 4], eax
pop esi
ret 8
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov edx, dword [eax + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret 8

Function at 0x10002bd0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x10002c2b
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10002c2b
mov dword [esi + 8], 1
mov eax, dword [eax + 0x28]
test eax, eax
je 0x10002c10
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10002c10
cmp eax, 0x102
jne 0x10002c10
mov eax, dword [esi]
push 0
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi], 0
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10003870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10021928
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x10029440]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
xor ebx, ebx
lea edi, [esi + 4]
push ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.1000d7e1
mov dword [edi], vtable.CCriticalSection.0
add edi, 8
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x24], 0x10023428
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0x11
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0xa
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10004e40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10021b48
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x24]
push eax
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.10003440
add esp, 0x10
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], 0
push eax
mov ebx, eax
call fcn.100194b2
xor edx, edx
div dword [edi + 0x10]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x10004eb5
mov esi, dword [eax + edx*4]
test esi, esi
je 0x10004eb5
mov eax, dword [esi + 8]
push ebx
push eax
call fcn.1000e4ce
add esp, 8
test eax, eax
je 0x10004edd
mov esi, dword [esi]
test esi, esi
jne 0x10004e9e
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.1001a0ac
xor eax, eax
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
test esi, esi
je 0x10004eb5
mov esi, dword [esi + 0xc]
test esi, esi
je 0x10004eb5
mov eax, dword [esi]
test eax, eax
jle 0x10004ef1
dec eax
mov dword [esi], eax
cmp dword [esi], 0
jg 0x10004fc7
mov ecx, esi
call fcn.10003720
push esi
call fcn.1001a482
mov ecx, dword [edi + 0xc]
mov eax, dword [esp + 0x2c]
add esp, 4
mov ebp, eax
test ecx, ecx
je 0x10004fc7
push eax
call fcn.100194b2
xor edx, edx
mov ecx, dword [edi + 0xc]
div dword [edi + 0x10]
mov esi, dword [ecx + edx*4]
test esi, esi
lea ebx, [ecx + edx*4]
je 0x10004fc7
mov eax, dword [esi + 8]
push ebp
push eax
call fcn.1000e4ce
add esp, 8
test eax, eax
je 0x10004f52
mov ebx, esi
mov esi, dword [esi]
test esi, esi
jne 0x10004f37
jmp 0x10004fc7
mov edx, dword [esi]
lea eax, [esi + 8]
push 1
push eax
mov dword [ebx], edx
call fcn.1001948e
mov ecx, dword [edi + 0x18]
mov dword [esi], ecx
mov eax, dword [edi + 0x14]
dec eax
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], eax
jne 0x10004fc7
mov eax, dword [edi + 0xc]
xor ebp, ebp
cmp eax, ebp
je 0x10004fa7
mov eax, dword [edi + 0x10]
xor ebx, ebx
cmp eax, ebp
jbe 0x10004fa7
mov edx, dword [edi + 0xc]
mov esi, dword [edx + ebx*4]
cmp esi, ebp
je 0x10004f9f
lea eax, [esi + 8]
push 1
push eax
call fcn.1001948e
mov esi, dword [esi]
cmp esi, ebp
jne 0x10004f8e
mov eax, dword [edi + 0x10]
inc ebx
cmp ebx, eax
jb 0x10004f84
mov eax, dword [edi + 0xc]
push eax
call fcn.1001a482
mov ecx, dword [edi + 0x1c]
add esp, 4
mov dword [edi + 0xc], ebp
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], ebp
call fcn.100196ee
mov dword [edi + 0x1c], ebp
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.1001a0ac
mov eax, 1
jmp 0x10004ec8
Function at 0x10014f16
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1002c2d8
cmp edx, dword [eax]
je 0x10014f38
add eax, 8
inc ecx
cmp eax, 0x1002c368
jl 0x10014f29
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1002c2d8]
jne 0x10015066
mov eax, dword [0x10038eb4]
cmp eax, 1
je 0x10015040
test eax, eax
jne 0x10014f69
cmp dword [0x10038eb8], 1
je 0x10015040
cmp edx, 0xfc
je 0x10015066
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10014fa0
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10016750
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1000fb20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10014fe3
lea eax, [ebp - 0x1a4]
push eax
call fcn.1000fb20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x100247a4
push edi
call fcn.1000ed90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10016750
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10016760
lea eax, [ebp - 0xa0]
push 0x10024784
push eax
call fcn.10016760
push dword [esi + 0x1002c2dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.10016760
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.100170b1
add esp, 0x2c
pop edi
jmp 0x10015066
lea eax, [ebp + 8]
lea esi, [esi + 0x1002c2dc]
push 0
push eax
push dword [esi]
call fcn.1000fb20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x411014
Capabilities:
Terminate process

Disassembly:
jmp 0x4132f0
jmp fcn.00413330
cmp ecx, dword [0x41702c]
jne 0x4132fa
repz ret
jmp 0x411082
Function at 0x404347
Capabilities:
Get thread local storage value

Disassembly:
push 2
call fcn.0040791c
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x404366
mov ecx, esi
call dword [0x41c104]
call esi
jmp 0x40436c
invalid
invalid
pop esp
invalid
inc ecx
Function at 0x40c30a
Capabilities:
Write file on windows

Disassembly:
and ah, 0xfb
push dword [ebp - 0x3c]
mov byte [ebp - 0x20], al
mov al, byte [edx]
mov byte [ebp - 0x1f], al
mov byte [edi + ecx + 0x2d], ah

Function at 0x40c31c
Capabilities:
Write file on windows

Disassembly:
lea eax, [ebp - 0x20]
push 2
push eax
jmp 0x40c36a
lea eax, [ebp - 0x40]
push eax
call fcn.00416c0a
add esp, 0x10
cmp eax, 0xffffffff
je 0x40c4ac
mov eax, dword [ebp - 0x30]
push ebx
push ebx
inc eax
push 5
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [ebp - 0x70]
call fcn.00414f80
add esp, 0x20
mov dword [ebp - 0x38], eax
test eax, eax
je 0x40c4ac
push ebx
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c4a4
invalid
Function at 0x40c7fa
Capabilities:
Write file on windows

Disassembly:
mov esi, dword [ebp - 0x140c]
lea eax, [ebp - 0x6b0]
cmp edi, esi
jae 0x40c805
movzx ecx, word [edi]
add edi, 2
cmp ecx, 0xa
jne 0x40c7f8
push 0xd
pop edx
mov word [eax], dx
add eax, 2
mov word [eax], cx
add eax, 2
lea ecx, [ebp - 8]
cmp eax, ecx
jb 0x40c7e0
push 0
push 0
push 0xd55
lea ecx, [ebp - 0x1408]
push ecx
lea ecx, [ebp - 0x6b0]
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
push eax
push 0
push 0xfde9
call fcn.00415411
mov esi, dword [ebp + 8]
add esp, 0x20
mov dword [ebp - 0x1418], eax
test eax, eax
je 0x40c890
xor ebx, ebx
test eax, eax
je 0x40c87a
push 0
lea ecx, [ebp - 0x1414]
sub eax, ebx
push ecx
push eax
lea eax, [ebp - 0x1408]
inc dword [ebx]
ret
push eax
push dword [ebp - 0x1410]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c890
add ebx, dword [ebp - 0x1414]
mov eax, dword [ebp - 0x1418]
cmp ebx, eax
jb 0x40c845
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
cmp edi, dword [ebp - 0x140c]
jb 0x40c7d4
jmp 0x40c898
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d6d7
add cl, cl

Function at 0x40c841
Capabilities:
Write file on windows

Disassembly:
mov esi, dword [ebp - 0x140c]
lea eax, [ebp - 0x6b0]
cmp edi, esi
jae 0x40c805
movzx ecx, word [edi]
add edi, 2
cmp ecx, 0xa
jne 0x40c7f8
push 0xd
pop edx
mov word [eax], dx
add eax, 2
mov word [eax], cx
add eax, 2
lea ecx, [ebp - 8]
cmp eax, ecx
jb 0x40c7e0
push 0
push 0
push 0xd55
lea ecx, [ebp - 0x1408]
push ecx
lea ecx, [ebp - 0x6b0]
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
push eax
push 0
push 0xfde9
call fcn.00415411
mov esi, dword [ebp + 8]
add esp, 0x20
mov dword [ebp - 0x1418], eax
test eax, eax
je 0x40c890
xor ebx, ebx
test eax, eax
je 0x40c87a
push 0
lea ecx, [ebp - 0x1414]
sub eax, ebx
push ecx
push eax
lea eax, [ebp - 0x1408]
inc dword [ebx]
ret
push eax
push dword [ebp - 0x1410]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c890
add ebx, dword [ebp - 0x1414]
mov eax, dword [ebp - 0x1418]
cmp ebx, eax
jb 0x40c845
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
cmp edi, dword [ebp - 0x140c]
jb 0x40c7d4
jmp 0x40c898
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d6d7
add cl, cl

Function at 0x40f436
Capabilities:
Parse pe header

Disassembly:
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f45d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f45d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
xor eax, eax
pop ebp
ret
Function at 0x40f938
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 0x10]
movzx ecx, byte [edi - 2]
add eax, edi
shl ecx, 0x10
cmp eax, esi
jae 0x40f8f4
movzx eax, byte [edi - 1]
shl eax, 8
add ecx, eax
cmp edx, esi
jae 0x40f8fd
movzx eax, byte [edi]
add ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + 0x420ed0]
mov byte [ebp - 2], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x420ed0]
mov byte [ebp - 1], al
mov eax, dword [esp + 0x10]
add eax, edi
cmp eax, esi
jae 0x40f936
mov eax, ecx
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x420ed0]
jmp fcn.0040f938
mov al, 0x3d
mov byte [ebp], al
cmp edx, esi
jae 0x40f94a
and ecx, 0x3f
mov al, byte [ecx + 0x420ed0]
jmp 0x40f94c
mov al, 0x3d
mov byte [ebp + 1], al
add ebp, 4
push 3
pop eax
add edi, eax
add edx, eax
sub dword [esp + 0x14], 1
jne 0x40f8da

Function at 0x40fa22
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
rol byte [eax], 1
add byte [eax], al
test ebx, ebx
je 0x40fc28
push 0x2f
pop eax
push 0x5c
mov byte [esp + 0x38], al
xor ecx, ecx
pop eax
mov dword [esp + 0x35], 0x595b5e54
mov dword [esp + 0x39], 0xc596155
mov dword [esp + 0x3d], 0x635b5e4e
mov dword [esp + 0x41], 0x5f5e515f
mov byte [esp + 0x45], 0xc
mov byte [esp + 0x46], al
xor edx, edx
mov dword [esp + 0xa8], 0x4c350707
invalid
test byte [esp + ebp*4], ah
add byte [eax], al
invalid

Function at 0x40fa63
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [esp + 0x47], 0x5f54604d
mov dword [esp + 0x4b], 0x5e51630c
mov dword [esp + 0x4f], 0x515e0c51
mov dword [esp + 0x53], 0x51555e60
push ecx
mov dword [esp + 0x57], 0xf6505162
mov al, byte [esp + ecx + 0x34]
add al, 0x14
mov byte [esp + ecx + 0xa8], al
inc ecx
cmp ecx, 0x27
jl 0x40fa8b
lea eax, [esp + 0xa8]
mov byte [esp + 0xcf], 0
push eax
call 0x4214a2
xor ebp, ebp
cmp byte [esi + 6], 0
pop ecx
je 0x40fb28
mov dword [esp + 0x14], 0xccdbdfac
xor ecx, ecx
mov dword [esp + 0x18], 0xd6d0dad5
mov dword [esp + 0x1c], 0xde87dad5
mov dword [esp + 0x20], 0x87ccd9cc
xchg edi, eax
inc esp
and al, 0x24
fxch st(4)
fcmovnu st(0), st(1)

Function at 0x40fc97
Capabilities:
Encode data using xor

Disassembly:
and al, 0xd0
add byte [eax], al
add byte [edi - 0x18], dl
jmp 0x40fc63
mov dword [esp + 0xbc], 0x4c50484b
mov dword [esp + 0xc0], 0x74c4b3e
mov word [esp + 0xc4], 0x493c
mov byte [esp + 0xc6], 0x49
mov al, byte [esp + ecx + 0xa8]
add al, 0x27
mov byte [esp + ecx + 0x34], al
xor al, 0x41
cmp ecx, 0x1f
jl 0x40fc8b
mov byte [esp + 0x53], dl
mov ecx, edx
mov dword [esp + 0x8c], 0xdfd5daf3
mov dword [esp + 0x90], 0xd3f8ded7
mov dword [esp + 0x94], 0xd2d6d4c9
mov dword [esp + 0x98], 0xc9f9d6ce
mov dword [esp + 0x9c], 0xdec8ccd4
mov word [esp + 0xa0], 0xc8c9
add byte [eax], al
add cl, cl
invalid
Function at 0x40fd65
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add cl, cl
enter 0xffffffffffff848a, 0xc
mov word [eax], es
add byte [eax], al
mov al, byte [esp + ecx + 0x8c]
xor al, 0xbb
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x16
jl 0x40fce5
in eax, dx
mov byte [esp + 0x2a], dl
mov ecx, edx
mov dword [esp + 0x5c], 0xb6b3bb9c
mov dword [esp + 0x60], 0xaefabebf
mov dword [esp + 0x64], 0xbfa8fab5
mov dword [esp + 0x68], 0xbfb3a8ae
mov dword [esp + 0x6c], 0xb9fabfac
mov dword [esp + 0x70], 0xb7b5a8b2
mov dword [esp + 0x74], 0xfab7afb3
mov dword [esp + 0x78], 0xadb5a8b8
mov dword [esp + 0x7c], 0xa9a8bfa9
mov dword [esp + 0x80], 0xaebbaafa
mov word [esp + 0x84], 0xa9b2
mov byte [esp + 0x86], 0xd0
mov al, byte [esp + ecx + 0x5c]
xor al, 0xda
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 0x2b
jl 0x40fd63
lea eax, [esp + 0xf4]
mov byte [esp + 0x11f], dl
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push 0x270
push eax
call 0x4218a5
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
Function at 0x40ffe3
Capabilities:
Encode data using xor

Disassembly:
push 0x2e
pop eax
mov word [esp + 0x24], ax
xor eax, eax
mov word [esp + 0x26], ax
xor ecx, ecx
mov al, byte [esp + ecx + 0x20]
xor al, 0xef
movzx eax, al
mov word [esp + ecx*2 + 0x18], ax
inc ecx
cmp ecx, 2
jl 0x40feb2
xor eax, eax
mov word [esp + 0x1c], ax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.00414dd0
pop ecx
pop ecx
test eax, eax
je 0x410053
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.00414dec
pop ecx
pop ecx
test eax, eax
je 0x410053
test byte [esp + 0x90], 0x10
je 0x410053
lea eax, [esp + 0xbc]
push eax
call fcn.00414b39
pop ecx
cmp eax, 7
jb 0x410053
mov dword [esp + 0x28], 0xfd0609e7
xor ecx, ecx
mov word [esp + 0x2c], 0x300
mov byte [esp + 0x2e], 0xfc
movzx eax, byte [esp + ecx + 0x28]
add ax, 0x69
and ax, si
mov word [esp + ecx*2 + 0x60], ax
inc ecx
cmp ecx, 7
jl 0x40ff40
xor eax, eax
mov dword [esp + 0x30], 0x111615f4
mov word [esp + 0x6e], ax
xor ecx, ecx
mov word [esp + 0x34], 0x1c25
mov byte [esp + 0x36], 0x24
movzx eax, byte [esp + ecx + 0x30]
add ax, 0x50
and ax, si
mov word [esp + ecx*2 + 0x70], ax
inc ecx
cmp ecx, 7
jl 0x40ff74
xor eax, eax
mov word [esp + 0x7e], ax
lea eax, [esp + 0x60]
push 0xe
push eax
lea eax, [esp + 0xc4]
push eax
call fcn.00411685
add esp, 0xc
test eax, eax
je 0x40ffcc
push 0xe
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0xc4]
push eax
call fcn.004116a0
add esp, 0xc
test eax, eax
jne 0x410053
mov dword [esp + 0x38], 0xdff6efa8
xor ecx, ecx
mov word [esp + 0x3c], 0xefa8
mov byte [esp + 0x3e], 0xf6
movzx eax, byte [esp + ecx + 0x38]
add ax, 0x7d
and ax, si
mov word [esp + ecx*2 + 0x80], ax
inc ecx
cmp ecx, 7
jl 0x40ffe2
xor eax, eax
mov word [esp + 0x8e], ax
lea eax, [esp + 0xbc]
push eax
push dword [esp + 0x2ec]
lea eax, [esp + 0x88]
push eax
call 0x42ab56
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41004e
push dword [esp + 0x2ec]
lea eax, [esp + 0xc0]
mov edx, ebp
push eax
push esi
mov ecx, edi
call 0x41f4cd
add esp, 0xc
push esi
call fcn.00414b38
pop ecx
mov esi, 0xff
lea eax, [esp + 0x90]
push eax
push ebx
call dword [esp + 0x48]
test eax, eax
jne 0x40fea1
Function at 0x41036a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov dword [esp + 0x14], 0xc5eaf5bc
xor ecx, ecx
mov dword [esp + 0x18], 0xf8faf6d5
mov dword [esp + 0x1c], 0xe1dcb9f5
mov dword [esp + 0x20], 0xeaf7fced
mov dword [esp + 0x24], 0xb9f7f6f0
mov dword [esp + 0x28], 0xededfcca
mov dword [esp + 0x2c], 0xeafef7f0
mov dword [esp + 0x30], 0xeaf5bcc5
movq xmm1, qword [esp + ecx + 0x14]
movq xmm0, qword [0x421040]
pxor xmm1, xmm0
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
movups xmmword [esp + ecx*2 + 0xc0], xmm1
add ecx, 8
cmp ecx, 0x20
jl 0x4101b0
xor ecx, ecx
mov edx, 0xf89245cb
push eax
lea eax, [esp + 0x10c]
mov word [esp + 0x104], cx
push eax
inc ecx
call 0x422299
call eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x38]
push eax
push 0
call fcn.00414de1
add esp, 0xc
mov edi, eax
lea eax, [esp + 0xc0]
mov edx, 0xe3740fb6
xor ecx, ecx
push edi
push ebx
push eax
push 0x800
push esi
call 0x4222cd
call eax
add esp, 0x14
xor ecx, ecx
mov edx, 0xeeb55893
inc ecx
push esi
call 0x4222e0
call eax
cmp eax, 0xffffffff
je 0x410379
test al, 0x10
je 0x410379
push 0x7c
pop eax
mov word [esp + 0x38], 0x7754
xor ecx, ecx
mov byte [esp + 0x3a], al
mov dword [esp + 0x3b], 0x76712e72
mov dword [esp + 0x3f], 0x777b7d80
mov dword [esp + 0x43], 0x732e7b83
mov word [esp + 0x47], 0x8286
mov byte [esp + 0x49], 0x73
mov byte [esp + 0x4a], al
mov word [esp + 0x4b], 0x7781
mov byte [esp + 0x4d], 0x7d
mov byte [esp + 0x4e], al
mov dword [esp + 0x4f], 0x817a332e
mov dword [esp + 0x53], 0x8277852e
inc esp
and al, 0x53
test dword cs:[edi - 0x7e], esi
mov dword [esp + 0x57], 0x72772e76
mov dword [esp + 0x5b], 0x817a332e
mov byte [esp + 0x5f], 0x18
mov al, byte [esp + ecx + 0x38]
sub al, 0xe
mov byte [esp + ecx + 0x94], al
inc ecx
cmp ecx, 0x28
jl 0x4102be
in eax, dx
mov byte [esp + 0xbc], 0
xor ecx, ecx
leave
mov dword [esp + 0x14], 0x707fcf2
mov dword [esp + 0x18], 0xca0e0f00
mov dword [esp + 0x1c], 0xfa0e07c0
mov dword [esp + 0x20], 0xfa0e07c0
push cs
cli
mov word [esp + 0x24], 0x7c0
mov byte [esp + 0x26], 0xe
movzx eax, byte [esp + ecx + 0x14]
mov edx, 0xff
add ax, 0x65
and ax, dx
mov word [esp + ecx*2 + 0x6c], ax
inc ecx
cmp ecx, 0x13
jl 0x410307
xor eax, eax
mov word [esp + 0x92], ax
xchg edx, eax
add byte [eax], al
add byte [ebp + 0x1082484], cl
add byte [eax], al
xchg edx, eax
add byte [eax], al
add byte [ebp + 0x1082484], cl
add byte [eax], al
push edi
push eax
lea eax, [esp + 0x9c]
push eax
call 0x421d32
add esp, 0xc
lea eax, [esp + 0x108]
push dword [esp + 0x510]
push ebp
push eax
lea eax, [esp + 0x78]
push eax
call 0x42ae94
mov edi, eax
add esp, 0x10
test edi, edi
je 0x410379
mov edx, edi
mov ecx, esi
call 0x4280d4
push edi
call fcn.00414e63
pop ecx
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x38]
push eax
push 0
call fcn.00414f61
add byte [ebx - 0x3f7af33c], al
jne 0x41016e
mov ebx, dword [esp + 0x68]
push esi
call fcn.00414e8a
pop ecx
push ebx
Function at 0x4103cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test esi, esi
je 0x4107a3
xor ebx, ebx
mov dword [esp + 0x30], 0x634c531a
mov dword [esp + 0x34], 0x4b4c5677
mov ecx, ebx
mov word [esp + 0x38], 0x4d50
mov byte [esp + 0x3a], 0x46
invalid
inc esi
mov al, byte [esp + ecx + 0x30]
xor al, 0x3f
movzx eax, al
mov word [esp + ecx*2 + 0xac], ax
dec esp
lodsb al, byte [esi]
add byte [eax], al
add byte [ecx - 0x7d], al
stc
invalid
jl 0x4103f4
xor eax, eax
mov word [esp + 0xc2], ax
lea eax, [esp + 0xac]
push edi
push eax
call 0x42af57
mov edi, eax
mov dword [esp + 0x80], edi
pop ecx
pop ecx
test edi, edi
je 0x4107a3
mov ecx, edi
call 0x42afcb
mov ebp, eax
test ebp, ebp
je 0x41079c
xor edx, edx
mov ecx, ebp
call 0x42b24a
mov dword [esp + 0x84], eax

Function at 0x4103f2
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
test esi, esi
je 0x4107a3
xor ebx, ebx
mov dword [esp + 0x30], 0x634c531a
mov dword [esp + 0x34], 0x4b4c5677
mov ecx, ebx
mov word [esp + 0x38], 0x4d50
mov byte [esp + 0x3a], 0x46
invalid
inc esi
mov al, byte [esp + ecx + 0x30]
xor al, 0x3f
movzx eax, al
mov word [esp + ecx*2 + 0xac], ax
dec esp
lodsb al, byte [esi]
add byte [eax], al
add byte [ecx - 0x7d], al
stc
invalid
jl 0x4103f4
xor eax, eax
mov word [esp + 0xc2], ax
lea eax, [esp + 0xac]
push edi
push eax
call 0x42af57
mov edi, eax
mov dword [esp + 0x80], edi
pop ecx
pop ecx
test edi, edi
je 0x4107a3
mov ecx, edi
call 0x42afcb
mov ebp, eax
test ebp, ebp
je 0x41079c
xor edx, edx
mov ecx, ebp
call 0x42b24a
mov dword [esp + 0x84], eax

Function at 0x410400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test esi, esi
je 0x4107a3
xor ebx, ebx
mov dword [esp + 0x30], 0x634c531a
mov dword [esp + 0x34], 0x4b4c5677
mov ecx, ebx
mov word [esp + 0x38], 0x4d50
mov byte [esp + 0x3a], 0x46
invalid
inc esi
mov al, byte [esp + ecx + 0x30]
xor al, 0x3f
movzx eax, al
mov word [esp + ecx*2 + 0xac], ax
dec esp
lodsb al, byte [esi]
add byte [eax], al
add byte [ecx - 0x7d], al
stc
invalid
jl 0x4103f4
xor eax, eax
mov word [esp + 0xc2], ax
lea eax, [esp + 0xac]
push edi
push eax
call 0x42af57
mov edi, eax
mov dword [esp + 0x80], edi
pop ecx
pop ecx
test edi, edi
je 0x4107a3
mov ecx, edi
call 0x42afcb
mov ebp, eax
test ebp, ebp
je 0x41079c
xor edx, edx
mov ecx, ebp
call 0x42b24a
mov dword [esp + 0x84], eax

Function at 0x410457
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
je 0x410785
push ebx
push 1
lea ecx, [esp + 0x84]
push ecx
push eax
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x410770
invalid
inc esp
and al, 0x50

Function at 0x4104c4
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
add byte [ecx - 0x7d], al
stc
sbb eax, 0x9c88ed7c
and al, 0xfd
add byte [eax], al

Function at 0x4104d1
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x2444c7cb], cl
adc byte [edx + ebx*2 + 0x53], cl
pop edx
mov dword [esp + 0x14], 0x6a3f4b5c
mov dword [esp + 0x18], 0x3f33736d
mov dword [esp + 0x1c], 0x736b766b
mov dword [esp + 0x20], 0x4d593f7a
dec ebp