joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41979f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov al, byte [esp + ecx + 0x14]
xor al, 0xa
mov byte [esp + ecx + 0x30], al
inc ecx
cmp ecx, 0xd
jl 0x419795
mov byte [esp + 0x3d], bl
mov ecx, ebx
mov dword [esp + 0x40], 0x5a5f4240
mov dword [esp + 0x44], 0x6c005647
mov dword [esp + 0x48], 0x465f5c50
mov dword [esp + 0x4c], 0x516c5d5e
mov dword [esp + 0x50], 0x4056474a
mov al, byte [esp + ecx + 0x40]
xor al, 0x33
mov byte [esp + ecx + 0xec], al
inc ecx
cmp ecx, 0x14
jl 0x4197d3
push 0x24
push ebx
mov edi, 0x424300
mov byte [esp + 0x108], bl
push edi
call 0x41c556
add esp, 0xc
lea eax, [esp + 0x138]
add byte [ebx], dh
leave
mov esi, 0x779af737
mov edx, esi
inc ecx
push eax
push dword [0x424db8]
call 0x42b8bd
call eax
mov dword [0x424300], eax
inc edx
add byte [ebx], dh
leave
lea eax, [esp + 0x148]
mov edx, esi
push eax
push dword [0x424db8]
inc ecx
call 0x42b8dc
call eax
mov dword [0x424304], eax
xor ecx, ecx
lea eax, [esp + 0x16c]
mov edx, esi
push eax
push dword [0x424db8]
inc ecx
call 0x42b8fb
call eax
mov dword [0x424308], eax
xor ecx, ecx
lea eax, [esp + 0x60]
mov edx, esi
push eax
push dword [0x424db8]
inc ecx
call 0x42b917
call eax
mov dword [0x42430c], eax
xor ecx, ecx
lea eax, [esp + 0x74]
mov edx, esi
push eax
push dword [0x424db8]
inc ecx
call 0x42b933
call eax
mov dword [0x424310], eax
xor ecx, ecx
lea eax, [esp + 0x120]
mov edx, esi
push eax
push dword [0x424db8]
inc ecx
call 0x42b952
call eax
mov dword [0x424314], eax
xor ecx, ecx
lea eax, [esp + 0x158]
mov edx, esi
push eax
push dword [0x424db8]
inc ecx
call 0x42b971
call eax
mov dword [0x424318], eax
xor ecx, ecx
lea eax, [esp + 0x30]
mov edx, esi
Function at 0x419c10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
add byte [eax], al
je 0x419c1b
mov eax, 0x424300
leave
ret
call 0x4323d2
test al, al
je 0x419c99
cmp dword [0x424db8], 0
je 0x419d6f
xor ecx, ecx
mov dword [ebp - 0x38], 0xf8f80ae8
mov dword [ebp - 0x34], 0xfb0808fa
mov eax, ecx
mov dword [ebp - 0x30], 0xe01010a
mov dword [ebp - 0x2c], 0xf60401b5
mov dword [ebp - 0x28], 0xb5f9faf9
mov dword [ebp - 0x24], 0xfe010608
mov dword [ebp - 0x20], 0xc3c8fa09
mov dword [ebp - 0x1c], 0x9f0101f9
movups xmm0, xmmword [ebp + eax - 0x38]
paddb xmm0, xmmword [0x421000]
movups xmmword [ebp + eax - 0x6c], xmm0
add eax, 0x10
cmp eax, 0x20
jl 0x419c6d
lea eax, [ebp - 0x6c]
mov byte [ebp - 0x4c], cl
push eax
call 0x42b682
pop ecx
jmp 0x419c14
xor ecx, ecx
mov dword [ebp - 0x18], 0x60491b1b
mov dword [ebp - 0x14], 0x594e5261
mov edx, ecx
mov dword [ebp - 0x10], 0x60495f52
mov dword [ebp - 0xc], 0x6156595e
mov dword [ebp - 8], 0x501b2052
mov word [ebp - 4], 0x5d5d
mov al, byte [ebp + edx - 0x18]
add al, 0x13
mov byte [ebp + edx - 0x84], al
inc edx
cmp edx, 0x16
jl 0x419cc6
mov byte [ebp - 0x6e], cl
mov edx, ecx
mov dword [ebp - 0x48], 0xc3e4f5d7
mov dword [ebp - 0x44], 0xe4f9fce1
mov dword [ebp - 0x40], 0xe0d1a3f5
mov byte [ebp - 0x3c], 0xf9
mov al, byte [ebp + edx - 0x48]
xor al, 0x90
mov byte [ebp + edx - 0x10], al
inc edx
cmp edx, 0xd
jl 0x419cf7
mov byte [ebp - 3], cl
mov edx, ecx
mov dword [ebp - 0x68], 0x1d181037
mov dword [ebp - 0x64], 0x5511514
mov dword [ebp - 0x60], 0x1e1d511e
mov dword [ebp - 0x5c], 0x2511510
inc ebp
movsb byte es:[edi], byte [esi]
adc byte [0x45c70251], dl
test al, 0
sbb eax, 0x45c70518
lodsb al, byte [esi]
adc al, 0x42
pop edi
adc eax, 0xb045c766
sbb eax, 0xb245c61d
invalid
mov al, byte [ebp + edx - 0x68]
xor al, 0x71
mov byte [ebp + edx - 0x34], al
inc edx
cmp edx, 0x1b
jl 0x419d40
lea eax, [ebp - 0x34]
mov byte [ebp - 0x19], cl
push eax
lea eax, [ebp - 0x10]
push eax

Function at 0x419d22
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [eax - 0x83ea7c]
invalid
inc ebp
movsb byte es:[edi], byte [esi]
adc byte [0x45c70251], dl
test al, 0
sbb eax, 0x45c70518
lodsb al, byte [esi]
adc al, 0x42
pop edi
adc eax, 0xb045c766
sbb eax, 0xb245c61d
jnp 0x419ccb
inc esp
adc eax, 0x88713498
inc esp
adc eax, 0xfa8342cc
sbb edi, dword [eax + esi*8 - 0x73]
inc ebp
int3

Function at 0x419da4
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sbb byte [ebx + 0x20bf2e1c], cl
aaa
out dx, eax
invalid
Function at 0x419f01
Capabilities:
Encode data using xor

Disassembly:
clc
test ebx, 0x45c6f7be
cld
out dx, al
mov al, byte [ebp + ecx - 0x10]
xor al, 0x9b
mov byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0xd
jl 0x419f0a
mov edi, 0x104
mov byte [ebp - 0x27], bl
lea eax, [ebp - 0x140]
mov dword [ebp - 0x14], ebx
xor ecx, ecx
xorps xmm0, xmm0
push edi
push eax
mov edx, 0xd2fe083d
movlpd qword [ebp - 0xc], xmm0
inc ecx
call 0x42bfe4
call eax
movzx ecx, byte [ebp - 0x140]
test eax, eax
push 0x43
pop edx
push ebx
push ebx
push ebx
push ebx
cmove ecx, edx
mov word [ebp - 0xb], 0x5c3a
lea eax, [ebp - 0x14]
mov byte [ebp - 0x140], cl
push eax
mov byte [ebp - 0xc], cl
lea eax, [ebp - 0xc]
push ebx
xor ecx, ecx
mov byte [ebp - 9], bl
push ebx
push eax
mov edx, 0x980ded59
inc ecx
call 0x42c022
call eax
imul eax, dword [ebp - 0x14], 0x342167
mov ecx, 0x24cc3240
invalid
invalid
movsb byte es:[edi], byte [esi]

Function at 0x419f9b
Capabilities:
Decrypt data using tea
Resolve function by parsing pe exports

Disassembly:
imul ebp, dword [ebx], 0x4d8966c8
loop 0x41a00c
imul ecx, ecx, 0x342167
add ecx, 0x3c3a468
mov byte [ebp + ebx - 0x1c], cl
inc ebx
leave
and dword [si], esi
add byte [ecx - 0x3c5b973f], al
add ecx, dword [eax + 0x43e41d4c]
cmp ebx, 8
jl 0x419fa2
push dword [ebp - 0x1a]
movzx eax, word [ebp - 0x1e]
invalid
mov dh, 0xbf

Function at 0x41a02b
Capabilities:
Decrypt data using tea
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
add bh, al
inc esp
and al, 0x40
add eax, dword [eax]
add byte [eax], al
sub ebp, ecx
mov dword [esp + 0x8c], eax
lea edx, [ecx + 2]
mov dword [esp + 0x84], ebp
mov esi, dword [edx + ebp]
mov edi, 0xc6ef3720
mov ebx, dword [eax]
push 0x20
pop ebp
mov eax, ebx
lea ecx, [edi + ebx]
shr eax, 5
add eax, 0x8f036c0
xor ecx, eax
mov eax, ebx
shl eax, 4
add eax, 0x4c774985
xor ecx, eax
sub esi, ecx
mov eax, esi
shl eax, 4
add eax, 0x7d935554
lea ecx, [edi + esi]
xor ecx, eax
lea edi, [edi + 0x61c88647]
mov eax, esi
shr eax, 5
add eax, 0x7a3b0639
xor ecx, eax
sub ebx, ecx
sub ebp, 1
jne 0x41a054
mov ebp, dword [esp + 0x84]
mov eax, ebx
shr eax, 8
mov ecx, esi
mov byte [edx - 1], al
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
mov eax, ecx
shr eax, 8
mov byte [edx + 3], al
mov eax, ecx
shr eax, 0x10
mov byte [edx - 2], bl
mov byte [edx + 2], cl
mov byte [edx + 4], al
mov eax, dword [esp + 0x8c]
shr ebx, 0x18
add eax, 8
shr ecx, 0x18
mov byte [edx + 1], bl
mov byte [edx + 5], cl
add edx, 8
sub dword [esp + 0x40], 1
mov dword [esp + 0xc0], esi
mov dword [esp + 0x8c], eax
jne 0x41a047
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x40]
and al, 0x40
push eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
mov byte [esi + 0x18], bl
mov dword [esp + 0x48], ebx
push esi
jmp 0x41a3b6
Function at 0x41a0ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add bh, al
inc esp
and al, 0x40
add eax, dword [eax]
add byte [eax], al
sub ebp, ecx
mov dword [esp + 0x8c], eax
lea edx, [ecx + 2]
mov dword [esp + 0x84], ebp
mov esi, dword [edx + ebp]
mov edi, 0xc6ef3720
mov ebx, dword [eax]
push 0x20
pop ebp
mov eax, ebx
lea ecx, [edi + ebx]
shr eax, 5
add eax, 0x8f036c0
xor ecx, eax
mov eax, ebx
shl eax, 4
add eax, 0x4c774985
xor ecx, eax
sub esi, ecx
mov eax, esi
shl eax, 4
add eax, 0x7d935554
lea ecx, [edi + esi]
xor ecx, eax
lea edi, [edi + 0x61c88647]
mov eax, esi
shr eax, 5
add eax, 0x7a3b0639
xor ecx, eax
sub ebx, ecx
sub ebp, 1
jne 0x41a054
mov ebp, dword [esp + 0x84]
mov eax, ebx
shr eax, 8
mov ecx, esi
mov byte [edx - 1], al
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
mov eax, ecx
shr eax, 8
mov byte [edx + 3], al
mov eax, ecx
shr eax, 0x10
mov byte [edx - 2], bl
mov byte [edx + 2], cl
mov byte [edx + 4], al
mov eax, dword [esp + 0x8c]
shr ebx, 0x18
add eax, 8
shr ecx, 0x18
mov byte [edx + 1], bl
mov byte [edx + 5], cl
add edx, 8
sub dword [esp + 0x40], 1
mov dword [esp + 0xc0], esi
mov dword [esp + 0x8c], eax
jne 0x41a047
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x40]
and al, 0x40
push eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
mov byte [esi + 0x18], bl
mov dword [esp + 0x48], ebx
push esi
jmp 0x41a3b6

Function at 0x41a25a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x428fda
lea ecx, [esp + 0xb4]
call 0x42de3b
Function at 0x41a26b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x14], 0x5060593b
mov ecx, ebx
mov dword [esp + 0x18], 0x5b074e55
mov dword [esp + 0x1c], 0x564a0756
mov dword [esp + 0x20], 0x4a4c5555
mov dword [esp + 0x24], 0x565b075b
mov dword [esp + 0x28], 0xf15a0c07
mov al, byte [esp + ecx + 0x14]
add al, 0x19
mov byte [esp + ecx + 0xc4], al
inc ecx
cmp ecx, 0x18
jl 0x41a148
lea eax, [esp + 0xc4]
mov byte [esp + 0xdc], bl
push edi
push eax
call 0x42bb5f
pop ecx
pop ecx
lea edx, [esp + 0xb4]
mov ecx, edi
call 0x431426
mov ecx, ebx
test al, al
je 0x41a2c4
mov dword [esp + 0x44], 0xf0f0e6c0
mov dword [esp + 0x48], 0xf5e0e0f6
mov dword [esp + 0x4c], 0xeaffffe6
mov dword [esp + 0x50], 0xfdfcf0b3
mov dword [esp + 0x54], 0xe7f0f6fd
mov dword [esp + 0x58], 0xe7b3f7f6
mov dword [esp + 0x5c], 0xe0b6b3fc
mov byte [esp + 0x60], 0x99
mov al, byte [esp + ecx + 0x44]
xor al, 0x93
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x1d
jl 0x41a1c7
mov byte [esp + 0x81], bl
mov ecx, ebx
mov dword [esp + 0x14], 0xd07feec
mov dword [esp + 0x18], 0x805b9
mov dword [esp + 0x1c], 0x8e0b9c7
mov dword [esp + 0x20], 0xb9fa0707
mov dword [esp + 0x24], 0xfd07fe0c
mov dword [esp + 0x28], 0x708fdb9
mov dword [esp + 0x2c], 0xfe06b9fe
mov dword [esp + 0x30], 0xfa0c0c
mov word [esp + 0x34], 0xa3fe
mov al, byte [esp + ecx + 0x14]
add al, 0x67
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 0x22
jl 0x41a227
lea eax, [esp + 0x64]
mov byte [esp + 0xb2], bl
push edi
push eax
call 0x42bc3b
pop ecx
pop ecx
call 0x433ac8
lea ecx, [esp + 0xb4]
call 0x4329b7
cmp byte [esp + 0xbc], bl
je 0x41a27e
call 0x42d9bd
cmp byte [esp + 0xbd], bl
je 0x41a28c
call 0x42d4bc
cmp byte [esp + 0xbb], bl
je 0x41a29a
call 0x432418
call 0x430b62
call 0x42c91c
lea eax, [esp + 0x90]
add byte [eax], al
push eax
call 0x42bca0
pop ecx
push 5
pop ecx
call 0x4322d8
call 0x4301c4
jmp 0x41a3ab
invalid
mov dword [esp + 0x90], 0xf0dfadad
mov dword [esp + 0x94], 0xefe2e6f7
mov dword [esp + 0x98], 0xf0dff1e6
mov dword [esp + 0x9c], 0xefe2e6f7
mov dword [esp + 0xa0], 0xe0adf1e6
mov word [esp + 0xa4], 0xf3f3
mov al, byte [esp + ecx + 0x90]
xor al, 0x83
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x16
jl 0x41a305
mov byte [esp + 0x2a], bl
mov ecx, ebx
mov dword [esp + 0x38], 0xe5f6e3c4
mov byte [esp + 0x3c], 0xe3
mov al, byte [esp + ecx + 0x38]
xor al, 0x97
mov byte [esp + ecx + 0x84], al
inc ecx
cmp ecx, 5
jl 0x41a32b
mov byte [esp + 0x89], bl
mov ecx, ebx
mov dword [esp + 0x64], 0x90959dba
mov dword [esp + 0x68], 0x88dc9899
mov dword [esp + 0x6c], 0x939fdc93
mov dword [esp + 0x70], 0x9f999292
mov dword [esp + 0x74], 0x9388dc88
mov dword [esp + 0x78], 0xf68fd9dc
mov al, byte [esp + ecx + 0x64]
xor al, 0xfc
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 0x18
jl 0x41a377
push edi
lea eax, [esp + 0x48]
mov byte [esp + 0x60], bl
push eax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x20]
push 0x9c
push eax
call 0x42beb4
add esp, 0x14
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call 0x41f552
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41a116
push esi
call 0x41eeb9
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
Function at 0x41a28a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x14], 0x5060593b
mov ecx, ebx
mov dword [esp + 0x18], 0x5b074e55
mov dword [esp + 0x1c], 0x564a0756
mov dword [esp + 0x20], 0x4a4c5555
mov dword [esp + 0x24], 0x565b075b
mov dword [esp + 0x28], 0xf15a0c07
mov al, byte [esp + ecx + 0x14]
add al, 0x19
mov byte [esp + ecx + 0xc4], al
inc ecx
cmp ecx, 0x18
jl 0x41a148
lea eax, [esp + 0xc4]
mov byte [esp + 0xdc], bl
push edi
push eax
call 0x42bb5f
pop ecx
pop ecx
lea edx, [esp + 0xb4]
mov ecx, edi
call 0x431426
mov ecx, ebx
test al, al
je 0x41a2c4
mov dword [esp + 0x44], 0xf0f0e6c0
mov dword [esp + 0x48], 0xf5e0e0f6
mov dword [esp + 0x4c], 0xeaffffe6
mov dword [esp + 0x50], 0xfdfcf0b3
mov dword [esp + 0x54], 0xe7f0f6fd
mov dword [esp + 0x58], 0xe7b3f7f6
mov dword [esp + 0x5c], 0xe0b6b3fc
mov byte [esp + 0x60], 0x99
mov al, byte [esp + ecx + 0x44]
xor al, 0x93
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x1d
jl 0x41a1c7
mov byte [esp + 0x81], bl
mov ecx, ebx
mov dword [esp + 0x14], 0xd07feec
mov dword [esp + 0x18], 0x805b9
mov dword [esp + 0x1c], 0x8e0b9c7
mov dword [esp + 0x20], 0xb9fa0707
mov dword [esp + 0x24], 0xfd07fe0c
mov dword [esp + 0x28], 0x708fdb9
mov dword [esp + 0x2c], 0xfe06b9fe
mov dword [esp + 0x30], 0xfa0c0c
mov word [esp + 0x34], 0xa3fe
mov al, byte [esp + ecx + 0x14]
add al, 0x67
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 0x22
jl 0x41a227
lea eax, [esp + 0x64]
mov byte [esp + 0xb2], bl
push edi
push eax
call 0x42bc3b
pop ecx
pop ecx
call 0x433ac8
lea ecx, [esp + 0xb4]
call 0x4329b7
cmp byte [esp + 0xbc], bl
je 0x41a27e
call 0x42d9bd
cmp byte [esp + 0xbd], bl
je 0x41a28c
call 0x42d4bc
cmp byte [esp + 0xbb], bl
je 0x41a29a
call 0x432418
call 0x430b62
call 0x42c91c
lea eax, [esp + 0x90]
add byte [eax], al
push eax
call 0x42bca0
pop ecx
push 5
pop ecx
call 0x4322d8
call 0x4301c4
jmp 0x41a3ab
invalid
mov dword [esp + 0x90], 0xf0dfadad
mov dword [esp + 0x94], 0xefe2e6f7
mov dword [esp + 0x98], 0xf0dff1e6
mov dword [esp + 0x9c], 0xefe2e6f7
mov dword [esp + 0xa0], 0xe0adf1e6
mov word [esp + 0xa4], 0xf3f3
mov al, byte [esp + ecx + 0x90]
xor al, 0x83
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x16
jl 0x41a305
mov byte [esp + 0x2a], bl
mov ecx, ebx
mov dword [esp + 0x38], 0xe5f6e3c4
mov byte [esp + 0x3c], 0xe3
mov al, byte [esp + ecx + 0x38]
xor al, 0x97
mov byte [esp + ecx + 0x84], al
inc ecx
cmp ecx, 5
jl 0x41a32b
mov byte [esp + 0x89], bl
mov ecx, ebx
mov dword [esp + 0x64], 0x90959dba
mov dword [esp + 0x68], 0x88dc9899
mov dword [esp + 0x6c], 0x939fdc93
mov dword [esp + 0x70], 0x9f999292
mov dword [esp + 0x74], 0x9388dc88
mov dword [esp + 0x78], 0xf68fd9dc
mov al, byte [esp + ecx + 0x64]
xor al, 0xfc
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 0x18
jl 0x41a377
push edi
lea eax, [esp + 0x48]
mov byte [esp + 0x60], bl
push eax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x20]
push 0x9c
push eax
call 0x42beb4
add esp, 0x14
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call 0x41f552
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41a116
push esi
call 0x41eeb9
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
Function at 0x41a2a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x14], 0x5060593b
mov ecx, ebx
mov dword [esp + 0x18], 0x5b074e55
mov dword [esp + 0x1c], 0x564a0756
mov dword [esp + 0x20], 0x4a4c5555
mov dword [esp + 0x24], 0x565b075b
mov dword [esp + 0x28], 0xf15a0c07
mov al, byte [esp + ecx + 0x14]
add al, 0x19
mov byte [esp + ecx + 0xc4], al
inc ecx
cmp ecx, 0x18
jl 0x41a148
lea eax, [esp + 0xc4]
mov byte [esp + 0xdc], bl
push edi
push eax
call 0x42bb5f
pop ecx
pop ecx
lea edx, [esp + 0xb4]
mov ecx, edi
call 0x431426
mov ecx, ebx
test al, al
je 0x41a2c4
mov dword [esp + 0x44], 0xf0f0e6c0
mov dword [esp + 0x48], 0xf5e0e0f6
mov dword [esp + 0x4c], 0xeaffffe6
mov dword [esp + 0x50], 0xfdfcf0b3
mov dword [esp + 0x54], 0xe7f0f6fd
mov dword [esp + 0x58], 0xe7b3f7f6
mov dword [esp + 0x5c], 0xe0b6b3fc
mov byte [esp + 0x60], 0x99
mov al, byte [esp + ecx + 0x44]
xor al, 0x93
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x1d
jl 0x41a1c7
mov byte [esp + 0x81], bl
mov ecx, ebx
mov dword [esp + 0x14], 0xd07feec
mov dword [esp + 0x18], 0x805b9
mov dword [esp + 0x1c], 0x8e0b9c7
mov dword [esp + 0x20], 0xb9fa0707
mov dword [esp + 0x24], 0xfd07fe0c
mov dword [esp + 0x28], 0x708fdb9
mov dword [esp + 0x2c], 0xfe06b9fe
mov dword [esp + 0x30], 0xfa0c0c
mov word [esp + 0x34], 0xa3fe
mov al, byte [esp + ecx + 0x14]
add al, 0x67
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 0x22
jl 0x41a227
lea eax, [esp + 0x64]
mov byte [esp + 0xb2], bl
push edi
push eax
call 0x42bc3b
pop ecx
pop ecx
call 0x433ac8
lea ecx, [esp + 0xb4]
call 0x4329b7
cmp byte [esp + 0xbc], bl
je 0x41a27e
call 0x42d9bd
cmp byte [esp + 0xbd], bl
je 0x41a28c
call 0x42d4bc
cmp byte [esp + 0xbb], bl
je 0x41a29a
call 0x432418
call 0x430b62
call 0x42c91c
lea eax, [esp + 0x90]
add byte [eax], al
push eax
call 0x42bca0
pop ecx
push 5
pop ecx
call 0x4322d8
call 0x4301c4
jmp 0x41a3ab
invalid
mov dword [esp + 0x90], 0xf0dfadad
mov dword [esp + 0x94], 0xefe2e6f7
mov dword [esp + 0x98], 0xf0dff1e6
mov dword [esp + 0x9c], 0xefe2e6f7
mov dword [esp + 0xa0], 0xe0adf1e6
mov word [esp + 0xa4], 0xf3f3
mov al, byte [esp + ecx + 0x90]
xor al, 0x83
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x16
jl 0x41a305
mov byte [esp + 0x2a], bl
mov ecx, ebx
mov dword [esp + 0x38], 0xe5f6e3c4
mov byte [esp + 0x3c], 0xe3
mov al, byte [esp + ecx + 0x38]
xor al, 0x97
mov byte [esp + ecx + 0x84], al
inc ecx
cmp ecx, 5
jl 0x41a32b
mov byte [esp + 0x89], bl
mov ecx, ebx
mov dword [esp + 0x64], 0x90959dba
mov dword [esp + 0x68], 0x88dc9899
mov dword [esp + 0x6c], 0x939fdc93
mov dword [esp + 0x70], 0x9f999292
mov dword [esp + 0x74], 0x9388dc88
mov dword [esp + 0x78], 0xf68fd9dc
mov al, byte [esp + ecx + 0x64]
xor al, 0xfc
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 0x18
jl 0x41a377
push edi
lea eax, [esp + 0x48]
mov byte [esp + 0x60], bl
push eax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x20]
push 0x9c
push eax
call 0x42beb4
add esp, 0x14
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call 0x41f552
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41a116
push esi
call 0x41eeb9
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
Function at 0x41a2ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x14], 0x5060593b
mov ecx, ebx
mov dword [esp + 0x18], 0x5b074e55
mov dword [esp + 0x1c], 0x564a0756
mov dword [esp + 0x20], 0x4a4c5555
mov dword [esp + 0x24], 0x565b075b
mov dword [esp + 0x28], 0xf15a0c07
mov al, byte [esp + ecx + 0x14]
add al, 0x19
mov byte [esp + ecx + 0xc4], al
inc ecx
cmp ecx, 0x18
jl 0x41a148
lea eax, [esp + 0xc4]
mov byte [esp + 0xdc], bl
push edi
push eax
call 0x42bb5f
pop ecx
pop ecx
lea edx, [esp + 0xb4]
mov ecx, edi
call 0x431426
mov ecx, ebx
test al, al
je 0x41a2c4
mov dword [esp + 0x44], 0xf0f0e6c0
mov dword [esp + 0x48], 0xf5e0e0f6
mov dword [esp + 0x4c], 0xeaffffe6
mov dword [esp + 0x50], 0xfdfcf0b3
mov dword [esp + 0x54], 0xe7f0f6fd
mov dword [esp + 0x58], 0xe7b3f7f6
mov dword [esp + 0x5c], 0xe0b6b3fc
mov byte [esp + 0x60], 0x99
mov al, byte [esp + ecx + 0x44]
xor al, 0x93
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x1d
jl 0x41a1c7
mov byte [esp + 0x81], bl
mov ecx, ebx
mov dword [esp + 0x14], 0xd07feec
mov dword [esp + 0x18], 0x805b9
mov dword [esp + 0x1c], 0x8e0b9c7
mov dword [esp + 0x20], 0xb9fa0707
mov dword [esp + 0x24], 0xfd07fe0c
mov dword [esp + 0x28], 0x708fdb9
mov dword [esp + 0x2c], 0xfe06b9fe
mov dword [esp + 0x30], 0xfa0c0c
mov word [esp + 0x34], 0xa3fe
mov al, byte [esp + ecx + 0x14]
add al, 0x67
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 0x22
jl 0x41a227
lea eax, [esp + 0x64]
mov byte [esp + 0xb2], bl
push edi
push eax
call 0x42bc3b
pop ecx
pop ecx
call 0x433ac8
lea ecx, [esp + 0xb4]
call 0x4329b7
cmp byte [esp + 0xbc], bl
je 0x41a27e
call 0x42d9bd
cmp byte [esp + 0xbd], bl
je 0x41a28c
call 0x42d4bc
cmp byte [esp + 0xbb], bl
je 0x41a29a
call 0x432418
call 0x430b62
call 0x42c91c
lea eax, [esp + 0x90]
add byte [eax], al
push eax
call 0x42bca0
pop ecx
push 5
pop ecx
call 0x4322d8
call 0x4301c4
jmp 0x41a3ab
invalid
mov dword [esp + 0x90], 0xf0dfadad
mov dword [esp + 0x94], 0xefe2e6f7
mov dword [esp + 0x98], 0xf0dff1e6
mov dword [esp + 0x9c], 0xefe2e6f7
mov dword [esp + 0xa0], 0xe0adf1e6
mov word [esp + 0xa4], 0xf3f3
mov al, byte [esp + ecx + 0x90]
xor al, 0x83
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x16
jl 0x41a305
mov byte [esp + 0x2a], bl
mov ecx, ebx
mov dword [esp + 0x38], 0xe5f6e3c4
mov byte [esp + 0x3c], 0xe3
mov al, byte [esp + ecx + 0x38]
xor al, 0x97
mov byte [esp + ecx + 0x84], al
inc ecx
cmp ecx, 5
jl 0x41a32b
mov byte [esp + 0x89], bl
mov ecx, ebx
mov dword [esp + 0x64], 0x90959dba
mov dword [esp + 0x68], 0x88dc9899
mov dword [esp + 0x6c], 0x939fdc93
mov dword [esp + 0x70], 0x9f999292
mov dword [esp + 0x74], 0x9388dc88
mov dword [esp + 0x78], 0xf68fd9dc
mov al, byte [esp + ecx + 0x64]
xor al, 0xfc
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 0x18
jl 0x41a377
push edi
lea eax, [esp + 0x48]
mov byte [esp + 0x60], bl
push eax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x20]
push 0x9c
push eax
call 0x42beb4
add esp, 0x14
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call 0x41f552
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41a116
push esi
call 0x41eeb9
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
Function at 0x41a32d
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x14], 0x5060593b
mov ecx, ebx
mov dword [esp + 0x18], 0x5b074e55
mov dword [esp + 0x1c], 0x564a0756
mov dword [esp + 0x20], 0x4a4c5555
mov dword [esp + 0x24], 0x565b075b
mov dword [esp + 0x28], 0xf15a0c07
mov al, byte [esp + ecx + 0x14]
add al, 0x19
mov byte [esp + ecx + 0xc4], al
inc ecx
cmp ecx, 0x18
jl 0x41a148
lea eax, [esp + 0xc4]
mov byte [esp + 0xdc], bl
push edi
push eax
call 0x42bb5f
pop ecx
pop ecx
lea edx, [esp + 0xb4]
mov ecx, edi
call 0x431426
mov ecx, ebx
test al, al
je 0x41a2c4
mov dword [esp + 0x44], 0xf0f0e6c0
mov dword [esp + 0x48], 0xf5e0e0f6
mov dword [esp + 0x4c], 0xeaffffe6
mov dword [esp + 0x50], 0xfdfcf0b3
mov dword [esp + 0x54], 0xe7f0f6fd
mov dword [esp + 0x58], 0xe7b3f7f6
mov dword [esp + 0x5c], 0xe0b6b3fc
mov byte [esp + 0x60], 0x99
mov al, byte [esp + ecx + 0x44]
xor al, 0x93
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x1d
jl 0x41a1c7
mov byte [esp + 0x81], bl
mov ecx, ebx
mov dword [esp + 0x14], 0xd07feec
mov dword [esp + 0x18], 0x805b9
mov dword [esp + 0x1c], 0x8e0b9c7
mov dword [esp + 0x20], 0xb9fa0707
mov dword [esp + 0x24], 0xfd07fe0c
mov dword [esp + 0x28], 0x708fdb9
mov dword [esp + 0x2c], 0xfe06b9fe
mov dword [esp + 0x30], 0xfa0c0c
mov word [esp + 0x34], 0xa3fe
mov al, byte [esp + ecx + 0x14]
add al, 0x67
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 0x22
jl 0x41a227
lea eax, [esp + 0x64]
mov byte [esp + 0xb2], bl
push edi
push eax
call 0x42bc3b
pop ecx
pop ecx
call 0x433ac8
lea ecx, [esp + 0xb4]
call 0x4329b7
cmp byte [esp + 0xbc], bl
je 0x41a27e
call 0x42d9bd
cmp byte [esp + 0xbd], bl
je 0x41a28c
call 0x42d4bc
cmp byte [esp + 0xbb], bl
je 0x41a29a
call 0x432418
call 0x430b62
call 0x42c91c
lea eax, [esp + 0x90]
add byte [eax], al
push eax
call 0x42bca0
pop ecx
push 5
pop ecx
call 0x4322d8
call 0x4301c4
jmp 0x41a3ab
invalid
mov dword [esp + 0x90], 0xf0dfadad
mov dword [esp + 0x94], 0xefe2e6f7
mov dword [esp + 0x98], 0xf0dff1e6
mov dword [esp + 0x9c], 0xefe2e6f7
mov dword [esp + 0xa0], 0xe0adf1e6
mov word [esp + 0xa4], 0xf3f3
mov al, byte [esp + ecx + 0x90]
xor al, 0x83
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x16
jl 0x41a305
mov byte [esp + 0x2a], bl
mov ecx, ebx
mov dword [esp + 0x38], 0xe5f6e3c4
mov byte [esp + 0x3c], 0xe3
mov al, byte [esp + ecx + 0x38]
xor al, 0x97
mov byte [esp + ecx + 0x84], al
inc ecx
cmp ecx, 5
jl 0x41a32b
mov byte [esp + 0x89], bl
mov ecx, ebx
mov dword [esp + 0x64], 0x90959dba
mov dword [esp + 0x68], 0x88dc9899
mov dword [esp + 0x6c], 0x939fdc93
mov dword [esp + 0x70], 0x9f999292
mov dword [esp + 0x74], 0x9388dc88
mov dword [esp + 0x78], 0xf68fd9dc
mov al, byte [esp + ecx + 0x64]
xor al, 0xfc
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 0x18
jl 0x41a377
push edi
lea eax, [esp + 0x48]
mov byte [esp + 0x60], bl
push eax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x20]
push 0x9c
push eax
call 0x42beb4
add esp, 0x14
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call 0x41f552
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41a116
push esi
call 0x41eeb9
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret