joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a552
Capabilities:
Resolve function by parsing pe exports

Disassembly:
aad 0x8a
test byte [esp + eax*4], cl
add byte [eax], al
add byte [ebx + ecx*2], al

Function at 0x41a55c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x84]
add al, 0x4b
mov byte [esp + ecx + 0x1dc], al
inc ecx
cmp ecx, 0x19
jl 0x41a553
mov byte [esp + 0x1f5], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x94b2edea
mov dword [esp + 0x18], 0x86a99582
mov dword [esp + 0x1c], 0xc7dd828a
mov al, byte [esp + ecx + 0x14]
xor al, 0xe7
mov byte [esp + ecx + 0x14c], al
inc ecx
cmp ecx, 0xc
or al, 0x7c
in eax, dx
mov dword [esp + 0x2c], 0xbbaebcbe
xorps xmm0, xmm0
mov dword [esp + 0x30], 0xaeb6aab7
xor eax, eax
movq xmm1, qword [esp + 0x2c]
mov ecx, ebx
punpcklbw xmm1, xmm0
psubw xmm1, xmmword [0x420f40]
pand xmm1, xmmword [0x420f50]
push eax
cmovb eax, dword [eax]
mov dword [esp + 0x3c], 0x4014dbde
mov dword [esp + 0x40], 0x4546413e
mov dword [esp + 0x44], 0x321f4336
mov dword [esp + 0x48], 0xf10b363e
movups xmm0, xmmword [esp + 0x3c]
mov byte [esp + 0x158], bl
movups xmmword [esp + 0x1c8], xmm1
mov word [esp + 0x1d8], ax
mov dword [esp + 0x1d8], eax
movaps xmm1, xmmword [0x420f90]
paddb xmm1, xmm0
mov byte [esp + 0x17c], bl
movups xmmword [esp + 0x16c], xmm1
mov dword [esp + 0x14], 0x6b767478
mov dword [esp + 0x18], 0x697e6f6e
mov dword [esp + 0x1c], 0x7e767a75
mov al, byte [esp + ecx + 0x14]
xor al, 0x1b
movzx eax, al
mov word [esp + ecx*2 + 0xa0], ax
inc ecx
cmp ecx, 0xc
jl 0x41a63c
xor eax, eax
mov dword [esp + 0xc0], 0x7b4f1619
mov word [esp + 0xb8], ax
mov ecx, ebx
mov dword [esp + 0xc4], 0x7e807a81
mov dword [esp + 0xc8], 0x872c4685
mov dword [esp + 0xcc], 0x7a817b6f
mov dword [esp + 0xd0], 0x89857e80
mov dword [esp + 0xd4], 0x7b581619
mov dword [esp + 0xd8], 0x75806d6f
mov dword [esp + 0xdc], 0x2c467a7b
mov dword [esp + 0xe0], 0x6f7b7887
mov dword [esp + 0xe4], 0x7b75806d
mov dword [esp + 0xe8], 0x1619897a
mov dword [esp + 0xec], 0x2c7c7566
mov dword [esp + 0xf0], 0x71707b6f
mov dword [esp + 0xf4], 0x86872c46
mov dword [esp + 0xf8], 0x7b6f7c75
mov dword [esp + 0xfc], 0x19897170
mov dword [esp + 0x100], 0x79756016
mov dword [esp + 0x104], 0x7a7b6671
mov dword [esp + 0x108], 0x872c4671
mov dword [esp + 0x10c], 0x71797580
mov dword [esp + 0x110], 0x717a7b86
mov dword [esp + 0x114], 0x54161989
mov dword [esp + 0x118], 0x46505563
mov byte [esp + 0x11c], 0x2c
mov al, byte [esp + ecx + 0xc0]
sub al, 0xc
mov byte [esp + ecx + 0x2c0], al
inc ecx
cmp ecx, 0x5d
jl 0x41a764
mov byte [esp + 0x31d], bl
mov ecx, ebx
invalid
Function at 0x41a59a
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x84]
add al, 0x4b
mov byte [esp + ecx + 0x1dc], al
inc ecx
cmp ecx, 0x19
jl 0x41a553
mov byte [esp + 0x1f5], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x94b2edea
mov dword [esp + 0x18], 0x86a99582
mov dword [esp + 0x1c], 0xc7dd828a
mov al, byte [esp + ecx + 0x14]
xor al, 0xe7
mov byte [esp + ecx + 0x14c], al
inc ecx
cmp ecx, 0xc
or al, 0x7c
in eax, dx
mov dword [esp + 0x2c], 0xbbaebcbe
xorps xmm0, xmm0
mov dword [esp + 0x30], 0xaeb6aab7
xor eax, eax
movq xmm1, qword [esp + 0x2c]
mov ecx, ebx
punpcklbw xmm1, xmm0
psubw xmm1, xmmword [0x420f40]
pand xmm1, xmmword [0x420f50]
push eax
cmovb eax, dword [eax]
mov dword [esp + 0x3c], 0x4014dbde
mov dword [esp + 0x40], 0x4546413e
mov dword [esp + 0x44], 0x321f4336
mov dword [esp + 0x48], 0xf10b363e
movups xmm0, xmmword [esp + 0x3c]
mov byte [esp + 0x158], bl
movups xmmword [esp + 0x1c8], xmm1
mov word [esp + 0x1d8], ax
mov dword [esp + 0x1d8], eax
movaps xmm1, xmmword [0x420f90]
paddb xmm1, xmm0
mov byte [esp + 0x17c], bl
movups xmmword [esp + 0x16c], xmm1
mov dword [esp + 0x14], 0x6b767478
mov dword [esp + 0x18], 0x697e6f6e
mov dword [esp + 0x1c], 0x7e767a75
mov al, byte [esp + ecx + 0x14]
xor al, 0x1b
movzx eax, al
mov word [esp + ecx*2 + 0xa0], ax
inc ecx
cmp ecx, 0xc
jl 0x41a63c
xor eax, eax
mov dword [esp + 0xc0], 0x7b4f1619
mov word [esp + 0xb8], ax
mov ecx, ebx
mov dword [esp + 0xc4], 0x7e807a81
mov dword [esp + 0xc8], 0x872c4685
mov dword [esp + 0xcc], 0x7a817b6f
mov dword [esp + 0xd0], 0x89857e80
mov dword [esp + 0xd4], 0x7b581619
mov dword [esp + 0xd8], 0x75806d6f
mov dword [esp + 0xdc], 0x2c467a7b
mov dword [esp + 0xe0], 0x6f7b7887
mov dword [esp + 0xe4], 0x7b75806d
mov dword [esp + 0xe8], 0x1619897a
mov dword [esp + 0xec], 0x2c7c7566
mov dword [esp + 0xf0], 0x71707b6f
mov dword [esp + 0xf4], 0x86872c46
mov dword [esp + 0xf8], 0x7b6f7c75
mov dword [esp + 0xfc], 0x19897170
mov dword [esp + 0x100], 0x79756016
mov dword [esp + 0x104], 0x7a7b6671
mov dword [esp + 0x108], 0x872c4671
mov dword [esp + 0x10c], 0x71797580
mov dword [esp + 0x110], 0x717a7b86
mov dword [esp + 0x114], 0x54161989
mov dword [esp + 0x118], 0x46505563
mov byte [esp + 0x11c], 0x2c
mov al, byte [esp + ecx + 0xc0]
sub al, 0xc
mov byte [esp + ecx + 0x2c0], al
inc ecx
cmp ecx, 0x5d
jl 0x41a764
mov byte [esp + 0x31d], bl
mov ecx, ebx
invalid
Function at 0x41a5a1
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x84]
add al, 0x4b
mov byte [esp + ecx + 0x1dc], al
inc ecx
cmp ecx, 0x19
jl 0x41a553
mov byte [esp + 0x1f5], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x94b2edea
mov dword [esp + 0x18], 0x86a99582
mov dword [esp + 0x1c], 0xc7dd828a
mov al, byte [esp + ecx + 0x14]
xor al, 0xe7
mov byte [esp + ecx + 0x14c], al
inc ecx
cmp ecx, 0xc
or al, 0x7c
in eax, dx
mov dword [esp + 0x2c], 0xbbaebcbe
xorps xmm0, xmm0
mov dword [esp + 0x30], 0xaeb6aab7
xor eax, eax
movq xmm1, qword [esp + 0x2c]
mov ecx, ebx
punpcklbw xmm1, xmm0
psubw xmm1, xmmword [0x420f40]
pand xmm1, xmmword [0x420f50]
push eax
cmovb eax, dword [eax]
mov dword [esp + 0x3c], 0x4014dbde
mov dword [esp + 0x40], 0x4546413e
mov dword [esp + 0x44], 0x321f4336
mov dword [esp + 0x48], 0xf10b363e
movups xmm0, xmmword [esp + 0x3c]
mov byte [esp + 0x158], bl
movups xmmword [esp + 0x1c8], xmm1
mov word [esp + 0x1d8], ax
mov dword [esp + 0x1d8], eax
movaps xmm1, xmmword [0x420f90]
paddb xmm1, xmm0
mov byte [esp + 0x17c], bl
movups xmmword [esp + 0x16c], xmm1
mov dword [esp + 0x14], 0x6b767478
mov dword [esp + 0x18], 0x697e6f6e
mov dword [esp + 0x1c], 0x7e767a75
mov al, byte [esp + ecx + 0x14]
xor al, 0x1b
movzx eax, al
mov word [esp + ecx*2 + 0xa0], ax
inc ecx
cmp ecx, 0xc
jl 0x41a63c
xor eax, eax
mov dword [esp + 0xc0], 0x7b4f1619
mov word [esp + 0xb8], ax
mov ecx, ebx
mov dword [esp + 0xc4], 0x7e807a81
mov dword [esp + 0xc8], 0x872c4685
mov dword [esp + 0xcc], 0x7a817b6f
mov dword [esp + 0xd0], 0x89857e80
mov dword [esp + 0xd4], 0x7b581619
mov dword [esp + 0xd8], 0x75806d6f
mov dword [esp + 0xdc], 0x2c467a7b
mov dword [esp + 0xe0], 0x6f7b7887
mov dword [esp + 0xe4], 0x7b75806d
mov dword [esp + 0xe8], 0x1619897a
mov dword [esp + 0xec], 0x2c7c7566
mov dword [esp + 0xf0], 0x71707b6f
mov dword [esp + 0xf4], 0x86872c46
mov dword [esp + 0xf8], 0x7b6f7c75
mov dword [esp + 0xfc], 0x19897170
mov dword [esp + 0x100], 0x79756016
mov dword [esp + 0x104], 0x7a7b6671
mov dword [esp + 0x108], 0x872c4671
mov dword [esp + 0x10c], 0x71797580
mov dword [esp + 0x110], 0x717a7b86
mov dword [esp + 0x114], 0x54161989
mov dword [esp + 0x118], 0x46505563
mov byte [esp + 0x11c], 0x2c
mov al, byte [esp + ecx + 0xc0]
sub al, 0xc
mov byte [esp + ecx + 0x2c0], al
inc ecx
cmp ecx, 0x5d
jl 0x41a764
mov byte [esp + 0x31d], bl
mov ecx, ebx
invalid
Function at 0x41a603
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x84]
add al, 0x4b
mov byte [esp + ecx + 0x1dc], al
inc ecx
cmp ecx, 0x19
jl 0x41a553
mov byte [esp + 0x1f5], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x94b2edea
mov dword [esp + 0x18], 0x86a99582
mov dword [esp + 0x1c], 0xc7dd828a
mov al, byte [esp + ecx + 0x14]
xor al, 0xe7
mov byte [esp + ecx + 0x14c], al
inc ecx
cmp ecx, 0xc
or al, 0x7c
in eax, dx
mov dword [esp + 0x2c], 0xbbaebcbe
xorps xmm0, xmm0
mov dword [esp + 0x30], 0xaeb6aab7
xor eax, eax
movq xmm1, qword [esp + 0x2c]
mov ecx, ebx
punpcklbw xmm1, xmm0
psubw xmm1, xmmword [0x420f40]
pand xmm1, xmmword [0x420f50]
push eax
cmovb eax, dword [eax]
mov dword [esp + 0x3c], 0x4014dbde
mov dword [esp + 0x40], 0x4546413e
mov dword [esp + 0x44], 0x321f4336
mov dword [esp + 0x48], 0xf10b363e
movups xmm0, xmmword [esp + 0x3c]
mov byte [esp + 0x158], bl
movups xmmword [esp + 0x1c8], xmm1
mov word [esp + 0x1d8], ax
mov dword [esp + 0x1d8], eax
movaps xmm1, xmmword [0x420f90]
paddb xmm1, xmm0
mov byte [esp + 0x17c], bl
movups xmmword [esp + 0x16c], xmm1
mov dword [esp + 0x14], 0x6b767478
mov dword [esp + 0x18], 0x697e6f6e
mov dword [esp + 0x1c], 0x7e767a75
mov al, byte [esp + ecx + 0x14]
xor al, 0x1b
movzx eax, al
mov word [esp + ecx*2 + 0xa0], ax
inc ecx
cmp ecx, 0xc
jl 0x41a63c
xor eax, eax
mov dword [esp + 0xc0], 0x7b4f1619
mov word [esp + 0xb8], ax
mov ecx, ebx
mov dword [esp + 0xc4], 0x7e807a81
mov dword [esp + 0xc8], 0x872c4685
mov dword [esp + 0xcc], 0x7a817b6f
mov dword [esp + 0xd0], 0x89857e80
mov dword [esp + 0xd4], 0x7b581619
mov dword [esp + 0xd8], 0x75806d6f
mov dword [esp + 0xdc], 0x2c467a7b
mov dword [esp + 0xe0], 0x6f7b7887
mov dword [esp + 0xe4], 0x7b75806d
mov dword [esp + 0xe8], 0x1619897a
mov dword [esp + 0xec], 0x2c7c7566
mov dword [esp + 0xf0], 0x71707b6f
mov dword [esp + 0xf4], 0x86872c46
mov dword [esp + 0xf8], 0x7b6f7c75
mov dword [esp + 0xfc], 0x19897170
mov dword [esp + 0x100], 0x79756016
mov dword [esp + 0x104], 0x7a7b6671
mov dword [esp + 0x108], 0x872c4671
mov dword [esp + 0x10c], 0x71797580
mov dword [esp + 0x110], 0x717a7b86
mov dword [esp + 0x114], 0x54161989
mov dword [esp + 0x118], 0x46505563
mov byte [esp + 0x11c], 0x2c
mov al, byte [esp + ecx + 0xc0]
sub al, 0xc
mov byte [esp + ecx + 0x2c0], al
inc ecx
cmp ecx, 0x5d
jl 0x41a764
mov byte [esp + 0x31d], bl
mov ecx, ebx
invalid
Function at 0x41a798
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc dword [ebp + 0x52], ebx
mov dword [esp + 0x48], 0x5266585f
mov dword [esp + 0x4c], 0x112b5658
mov al, byte [esp + ecx + 0x3c]
add al, 0xf
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0x14
jl 0x41a7ab
mov byte [esp + 0x194], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x9282393c
mov dword [esp + 0x40], 0x9d9494a1
mov eax, dword [0xc79d9494]
inc esp
and al, 0x44
invalid
cwde
invalid
xchg esp, eax
mov word [esp + 0x48], 0x4f69
mov al, byte [esp + ecx + 0x3c]
sub al, 0x2f
mov byte [esp + ecx + 0x15c], al
inc ecx
cmp ecx, 0xe
jl 0x41a7e6
mov byte [esp + 0x16a], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0x5a07165a
mov byte [esp + 0x30], 0x16
push ss
mov al, byte [esp + ecx + 0x2c]
xor al, 0x7f
movzx eax, al
mov word [esp + ecx*2 + 0x3c], ax
inc ecx
cmp ecx, 5
jl 0x41a80f
xor eax, eax
mov dword [esp + 0x14], 0xead59097
mov word [esp + 0x46], ax
mov edx, 0xff
mov dword [esp + 0x18], 0xeefbe8ff
call 0xcbcd973c
mov dword [esp + 0x1c], 0xbaf4f5f3
mov dword [esp + 0x20], 0xeee9e3c9
mov dword [esp + 0x24], 0xbaa0f7ff
mov al, byte [esp + ecx + 0x14]
xor al, 0x9a
mov byte [esp + ecx + 0x198], al
inc ecx
cmp ecx, 0x14
jl 0x41a859
push 0x13
mov byte [esp + 0x1b0], bl
mov al, 1
add byte [eax], al
mov ecx, ebx
mov dword [esp + 0x54], 0x67596266
push esp
bound bx, dword [ecx + 0x67]
mov dword [esp + 0x58], 0x5865546a
mov dword [esp + 0x5c], 0x767c606f
mov dword [esp + 0x60], 0x82868285
mov dword [esp + 0x64], 0x6a6f8779
xchg dword [edi + 0x6a], ebp
mov dword [esp + 0x68], 0x8277817c
mov dword [esp + 0x6c], 0x6133868a
popal
mov dword [esp + 0x70], 0x88566f67
Function at 0x41a7d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc dword [ebp + 0x52], ebx
mov dword [esp + 0x48], 0x5266585f
mov dword [esp + 0x4c], 0x112b5658
mov al, byte [esp + ecx + 0x3c]
add al, 0xf
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0x14
jl 0x41a7ab
mov byte [esp + 0x194], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x9282393c
mov dword [esp + 0x40], 0x9d9494a1
mov eax, dword [0xc79d9494]
inc esp
and al, 0x44
invalid
cwde
invalid
xchg esp, eax
mov word [esp + 0x48], 0x4f69
mov al, byte [esp + ecx + 0x3c]
sub al, 0x2f
mov byte [esp + ecx + 0x15c], al
inc ecx
cmp ecx, 0xe
jl 0x41a7e6
mov byte [esp + 0x16a], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0x5a07165a
mov byte [esp + 0x30], 0x16
push ss
mov al, byte [esp + ecx + 0x2c]
xor al, 0x7f
movzx eax, al
mov word [esp + ecx*2 + 0x3c], ax
inc ecx
cmp ecx, 5
jl 0x41a80f
xor eax, eax
mov dword [esp + 0x14], 0xead59097
mov word [esp + 0x46], ax
mov edx, 0xff
mov dword [esp + 0x18], 0xeefbe8ff
call 0xcbcd973c
mov dword [esp + 0x1c], 0xbaf4f5f3
mov dword [esp + 0x20], 0xeee9e3c9
mov dword [esp + 0x24], 0xbaa0f7ff
mov al, byte [esp + ecx + 0x14]
xor al, 0x9a
mov byte [esp + ecx + 0x198], al
inc ecx
cmp ecx, 0x14
jl 0x41a859
push 0x13
mov byte [esp + 0x1b0], bl
mov al, 1
add byte [eax], al
mov ecx, ebx
mov dword [esp + 0x54], 0x67596266
push esp
bound bx, dword [ecx + 0x67]
mov dword [esp + 0x58], 0x5865546a
mov dword [esp + 0x5c], 0x767c606f
mov dword [esp + 0x60], 0x82868285
mov dword [esp + 0x64], 0x6a6f8779
xchg dword [edi + 0x6a], ebp
mov dword [esp + 0x68], 0x8277817c
mov dword [esp + 0x6c], 0x6133868a
popal
mov dword [esp + 0x70], 0x88566f67

Function at 0x41a7db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb byte [eax - 0x38996b57], 0x44
and al, 0x48
imul ecx, dword [edi - 0x76], 0x2c3c0c44
das

Function at 0x41a7de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb byte [eax - 0x38996b57], 0x44
and al, 0x48
imul ecx, dword [edi - 0x76], 0x2c3c0c44
das
Function at 0x41a80e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc dword [ebp + 0x52], ebx
mov dword [esp + 0x48], 0x5266585f
mov dword [esp + 0x4c], 0x112b5658
mov al, byte [esp + ecx + 0x3c]
add al, 0xf
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0x14
jl 0x41a7ab
mov byte [esp + 0x194], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x9282393c
mov dword [esp + 0x40], 0x9d9494a1
mov eax, dword [0xc79d9494]
inc esp
and al, 0x44
invalid
cwde
invalid
xchg esp, eax
mov word [esp + 0x48], 0x4f69
mov al, byte [esp + ecx + 0x3c]
sub al, 0x2f
mov byte [esp + ecx + 0x15c], al
inc ecx
cmp ecx, 0xe
jl 0x41a7e6
mov byte [esp + 0x16a], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0x5a07165a
mov byte [esp + 0x30], 0x16
push ss
mov al, byte [esp + ecx + 0x2c]
xor al, 0x7f
movzx eax, al
mov word [esp + ecx*2 + 0x3c], ax
inc ecx
cmp ecx, 5
jl 0x41a80f
xor eax, eax
mov dword [esp + 0x14], 0xead59097
mov word [esp + 0x46], ax
mov edx, 0xff
mov dword [esp + 0x18], 0xeefbe8ff
call 0xcbcd973c
mov dword [esp + 0x1c], 0xbaf4f5f3
mov dword [esp + 0x20], 0xeee9e3c9
mov dword [esp + 0x24], 0xbaa0f7ff
mov al, byte [esp + ecx + 0x14]
xor al, 0x9a
mov byte [esp + ecx + 0x198], al
inc ecx
cmp ecx, 0x14
jl 0x41a859
push 0x13
mov byte [esp + 0x1b0], bl
mov al, 1
add byte [eax], al
mov ecx, ebx
mov dword [esp + 0x54], 0x67596266
push esp
bound bx, dword [ecx + 0x67]
mov dword [esp + 0x58], 0x5865546a
mov dword [esp + 0x5c], 0x767c606f
mov dword [esp + 0x60], 0x82868285
mov dword [esp + 0x64], 0x6a6f8779
xchg dword [edi + 0x6a], ebp
mov dword [esp + 0x68], 0x8277817c
mov dword [esp + 0x6c], 0x6133868a
popal
mov dword [esp + 0x70], 0x88566f67
Function at 0x41a83c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
adc dword [ebp + 0x52], ebx
mov dword [esp + 0x48], 0x5266585f
mov dword [esp + 0x4c], 0x112b5658
mov al, byte [esp + ecx + 0x3c]
add al, 0xf
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0x14
jl 0x41a7ab
mov byte [esp + 0x194], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x9282393c
mov dword [esp + 0x40], 0x9d9494a1
mov eax, dword [0xc79d9494]
inc esp
and al, 0x44
invalid
cwde
invalid
xchg esp, eax
mov word [esp + 0x48], 0x4f69
mov al, byte [esp + ecx + 0x3c]
sub al, 0x2f
mov byte [esp + ecx + 0x15c], al
inc ecx
cmp ecx, 0xe
jl 0x41a7e6
mov byte [esp + 0x16a], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0x5a07165a
mov byte [esp + 0x30], 0x16
push ss
mov al, byte [esp + ecx + 0x2c]
xor al, 0x7f
movzx eax, al
mov word [esp + ecx*2 + 0x3c], ax
inc ecx
cmp ecx, 5
jl 0x41a80f
xor eax, eax
mov dword [esp + 0x14], 0xead59097
mov word [esp + 0x46], ax
mov edx, 0xff
mov dword [esp + 0x18], 0xeefbe8ff
call 0xcbcd973c
mov dword [esp + 0x1c], 0xbaf4f5f3
mov dword [esp + 0x20], 0xeee9e3c9
mov dword [esp + 0x24], 0xbaa0f7ff
mov al, byte [esp + ecx + 0x14]
xor al, 0x9a
mov byte [esp + ecx + 0x198], al
inc ecx
cmp ecx, 0x14
jl 0x41a859
push 0x13
mov byte [esp + 0x1b0], bl
mov al, 1
add byte [eax], al
mov ecx, ebx
mov dword [esp + 0x54], 0x67596266
push esp
bound bx, dword [ecx + 0x67]
mov dword [esp + 0x58], 0x5865546a
mov dword [esp + 0x5c], 0x767c606f
mov dword [esp + 0x60], 0x82868285
mov dword [esp + 0x64], 0x6a6f8779
xchg dword [edi + 0x6a], ebp
mov dword [esp + 0x68], 0x8277817c
mov dword [esp + 0x6c], 0x6133868a
popal
mov dword [esp + 0x70], 0x88566f67
Function at 0x41a871
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc dword [ebp + 0x52], ebx
mov dword [esp + 0x48], 0x5266585f
mov dword [esp + 0x4c], 0x112b5658
mov al, byte [esp + ecx + 0x3c]
add al, 0xf
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0x14
jl 0x41a7ab
mov byte [esp + 0x194], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x9282393c
mov dword [esp + 0x40], 0x9d9494a1
mov eax, dword [0xc79d9494]
inc esp
and al, 0x44
invalid
cwde
invalid
xchg esp, eax
mov word [esp + 0x48], 0x4f69
mov al, byte [esp + ecx + 0x3c]
sub al, 0x2f
mov byte [esp + ecx + 0x15c], al
inc ecx
cmp ecx, 0xe
jl 0x41a7e6
mov byte [esp + 0x16a], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0x5a07165a
mov byte [esp + 0x30], 0x16
push ss
mov al, byte [esp + ecx + 0x2c]
xor al, 0x7f
movzx eax, al
mov word [esp + ecx*2 + 0x3c], ax
inc ecx
cmp ecx, 5
jl 0x41a80f
xor eax, eax
mov dword [esp + 0x14], 0xead59097
mov word [esp + 0x46], ax
mov edx, 0xff
mov dword [esp + 0x18], 0xeefbe8ff
call 0xcbcd973c
mov dword [esp + 0x1c], 0xbaf4f5f3
mov dword [esp + 0x20], 0xeee9e3c9
mov dword [esp + 0x24], 0xbaa0f7ff
mov al, byte [esp + ecx + 0x14]
xor al, 0x9a
mov byte [esp + ecx + 0x198], al
inc ecx
cmp ecx, 0x14
jl 0x41a859
push 0x13
mov byte [esp + 0x1b0], bl
mov al, 1
add byte [eax], al
mov ecx, ebx
mov dword [esp + 0x54], 0x67596266
push esp
bound bx, dword [ecx + 0x67]
mov dword [esp + 0x58], 0x5865546a
mov dword [esp + 0x5c], 0x767c606f
mov dword [esp + 0x60], 0x82868285
mov dword [esp + 0x64], 0x6a6f8779
xchg dword [edi + 0x6a], ebp
mov dword [esp + 0x68], 0x8277817c
mov dword [esp + 0x6c], 0x6133868a
popal
mov dword [esp + 0x70], 0x88566f67

Function at 0x41a8f4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov dword [esp + 0x74], 0x81788585
mov dword [esp + 0x78], 0x85786987
mov dword [esp + 0x7c], 0x81827c86
pop esi
movzx eax, byte [esp + ecx + 0x50]
sub ax, si
and ax, dx
mov word [esp + ecx*2 + 0xc0], ax
inc ecx
cmp ecx, 0x2c
jl 0x41a8d0
xor eax, eax
mov dword [esp + 0x2c], 0x99928fad
mov word [esp + 0x118], ax
mov dword [esp + 0x118], eax
mov ecx, ebx
mov dword [esp + 0x30], 0xb3899e88
mov word [esp + 0x34], 0x909c
mov byte [esp + 0x36], 0x98
mov al, byte [esp + ecx + 0x2c]
xor al, 0xfd
movzx eax, al
mov word [esp + ecx*2 + 0x1f8], ax
inc ecx
cmp ecx, 0xb
jl 0x41a911

Function at 0x41a959
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
inc esp
and al, 0x5e
js 0x41a9b4
dec edx
push ecx
out dx, eax
mov dh, 0x9c
mov edi, eax
inc esp
and al, 0x24
xchg byte [edi - 0x38992e34], bh
inc esp
and al, 0x28
mov dh, 0x9c
Function at 0x41acb7
Capabilities:
Encode data using xor

Disassembly:
push eax
call 0x41fbf8
add byte [ecx + 0x50], bl
lea edx, [esp + 0x160]
lea ecx, [esp + 0x18]
call 0x435946
pop ecx
push 1
mov edi, 0xa499d7b7
push 5
mov edx, edi
pop ecx
call 0x42cd83
call eax
push eax
push ebx
push 5
mov edx, edi
pop ecx
call 0x42cd91
call eax
push eax
lea eax, [esp + 0x44]
mov edx, 0xe3740fb6
push eax
push ebp
push esi
xor ecx, ecx
call 0x42cda7
call eax
add esp, 0x14
lea ecx, [esp + 0x14]
mov edx, esi
call 0x435813
lea eax, [esp + 0x198]
push eax
call 0x41fc5d
pop ecx
push eax
lea edx, [esp + 0x19c]
lea ecx, [esp + 0x18]
call 0x4359ab
mov dword [esp], 0x2000
lea eax, [esp + 0x1fc]
push esi
push eax
lea edx, [esp + 0xcc]
mov ecx, 0x80000002
call 0x4357db
add esp, 0xc
test al, al
je 0x41ae1b
mov edx, esi
lea ecx, [esp + 0x14]
call 0x435869
xor ecx, ecx
mov dword [esp + 0x2c], ebx
mov edx, 0xd226977
inc ecx
call 0x42ce1e
mov edi, eax
test edi, edi
je 0x41ad99
lea eax, [esp + 0x2c]
xor ecx, ecx
push eax
mov edx, 0x24526977
inc ecx
call 0x42ce36
call eax
push eax
call edi
mov ecx, ebx
cmp dword [esp + 0x2c], ebx
je 0x41add9
mov dword [esp + 0x38], 0xc3c507af
mov al, byte [esp + ecx + 0x38]
add al, 0x71
mov byte [esp + ecx + 0x124], al
inc ecx
cmp ecx, 4
jl 0x41ada9
lea eax, [esp + 0x124]
mov byte [esp + 0x128], bl
push eax
call 0x41fd0b
lea edx, [esp + 0x128]
jmp 0x41ae0f
mov dword [esp + 0x38], 0xe1e0abf3
mov al, byte [esp + ecx + 0x38]
xor al, 0xd3
mov byte [esp + ecx + 0x12c], al
inc ecx
cmp ecx, 4
jl 0x41ade1
lea eax, [esp + 0x12c]
mov byte [esp + 0x130], bl
push eax
call 0x41fd43
lea edx, [esp + 0x130]
pop ecx
push eax
lea ecx, [esp + 0x18]
call 0x435a91
pop ecx
lea eax, [esp + 0x210]
push eax
call 0x41fd63
pop ecx
push eax
lea edx, [esp + 0x214]
lea ecx, [esp + 0x18]
call 0x435ab1
pop ecx
push ebx
push ebx
mov ebp, 0xf2fdc9f0
push 5
mov edx, ebp
pop ecx
call 0x42ceee
call eax

Function at 0x41b02b
Capabilities:
Encode data using xor

Disassembly:
inc ebx
cmp ebx, 0xb
sti
invalid
jl 0x41b01a
push dword [esp + 0x28c]
xor eax, eax
mov edx, 0xe3740fb6
push dword [esp + 0x28c]
mov word [esp + 0xa2], ax
xor ecx, ecx
lea eax, [esp + 0x8c]
push eax
push 0x1000
push esi
call 0x42d105
call eax
add esp, 0x14
lea ecx, [esp + 0x14]
mov edx, esi
call 0x435b71