joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4155a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
mov dword [esp + 0x2c], 0x2023282a
mov word [esp + 0x30], 0x1c2b
movzx eax, byte [esp + ecx + 0x20]
add ax, 0x49
and ax, dx
mov word [esp + ecx*2 + 0x118], ax
add byte [eax], al
inc ecx
cmp ecx, 0x12
jl 0x415553
xor eax, eax
mov word [esp + 0x13c], ax
lea eax, [esp + 0x118]
push edi
push eax
call 0x4300b9
mov edi, eax
mov dword [esp + 0xd4], edi
pop ecx
pop ecx
test edi, edi
je 0x415ab7
mov ecx, edi
call 0x43012d
mov ebp, eax
test ebp, ebp
je 0x415ab0
invalid
xor edx, edx
mov ecx, ebp
call 0x4303ac
mov dword [esp + 0xe8], eax
test eax, eax
je 0x415a99
push ebx
push 1
lea ecx, [esp + 0xd8]
push ecx
push eax
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x415a81
mov dword [esp + 0x34], 0x10b0c23
mov ecx, ebx
mov dword [esp + 0x38], 0x6000245
inc ebp
add al, byte [eax]
push es
mov dword [esp + 0x3c], 0x6450a0e
mov dword [esp + 0x40], 0xc0e0a0a
mov dword [esp + 0x44], 0x1451600
mov dword [esp + 0x48], 0x9404507
mov word [esp + 0x4c], 0x6f16
mov al, byte [esp + ecx + 0x34]
xor al, 0x65
mov byte [esp + ecx + 0xfc], al
inc ecx
cmp ecx, 0x1a
jl 0x415614
mov byte [esp + 0x116], bl
mov ecx, ebx
mov dword [esp + 0x78], 0xc1c8c1cf
mov dword [esp + 0x7c], 0xe49cd0bf
mov dword [esp + 0x80], 0xa8f0efeb
mov dword [esp + 0x84], 0xc4efe59c
mov dword [esp + 0x88], 0xcbecf0f0
mov byte [eax], al
add byte [eax], al
invalid
invalid
in al, dx
retf
mov dword [esp + 0x8c], 0xa8f5e8ea
mov dword [esp + 0x90], 0xf0ddec9c
add byte [eax], al
pushfd
in al, dx
invalid
invalid
mov dword [esp + 0x94], 0xe59ca8e4
mov dword [esp + 0x98], 0xdfe1cfef
mov dword [esp + 0x9c], 0xa8e1eef1
add byte [eax], al
add cl, dh
out dx, al
loope 0x415640
mov dword [esp + 0xa0], 0xecf4e19c
mov dword [esp + 0xa4], 0xa8f5eee5
test al, 0xc7
test byte [eax + ebp*4], ah
add byte [eax], al
add byte [edx + ebp*8 - 0x7b381623], bl
and al, 0xac
add byte [eax], al
add cl, ah
test al, 0x9c
mov dword [esp + 0xb0], 0xe1f1e8dd
mov dword [esp + 0xb4], 0xcbcec29c
mov dword [esp + 0xb8], 0xebe99cc9
mov dword [esp + 0xbc], 0xebdfdbf6
mov dword [esp + 0xc0], 0xe1e5e7eb
mov byte [esp + 0xc4], 0xef
mov al, byte [esp + ecx + 0x78]
sub al, 0x7c
mov byte [esp + ecx + 0x140], al
inc ecx
cmp ecx, 0x4d
jl 0x415703
lea eax, [esp + 0xfc]
mov byte [esp + 0x18d], bl
push edi
push eax
call 0x42711a
add dword [eax], eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x154]
push eax
push dword [esp + 0xe8]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x415a79
push dword [esp + 0x14]
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4159da
mov dword [esp + 0x58], 0xc2bfc176
mov word [esp + 0x5c], 0x76b2
mov dword [esp + 0x68], 0x5a57501f
mov word [esp + 0x6c], 0x5345
mov byte [esp + 0x6e], 0x1f
mov dword [esp + 0x60], 0x888f89d4
mov word [esp + 0x64], 0xd498
mov dword [esp + 0x70], 0x5faffc2
mov word [esp + 0x74], 0xfe0c
mov byte [esp + 0x76], 0xc2
mov word [esp + 0x50], 0x3639
Function at 0x4155e9
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
mov dword [esp + 0x2c], 0x2023282a
mov word [esp + 0x30], 0x1c2b
movzx eax, byte [esp + ecx + 0x20]
add ax, 0x49
and ax, dx
mov word [esp + ecx*2 + 0x118], ax
add byte [eax], al
inc ecx
cmp ecx, 0x12
jl 0x415553
xor eax, eax
mov word [esp + 0x13c], ax
lea eax, [esp + 0x118]
push edi
push eax
call 0x4300b9
mov edi, eax
mov dword [esp + 0xd4], edi
pop ecx
pop ecx
test edi, edi
je 0x415ab7
mov ecx, edi
call 0x43012d
mov ebp, eax
test ebp, ebp
je 0x415ab0
invalid
xor edx, edx
mov ecx, ebp
call 0x4303ac
mov dword [esp + 0xe8], eax
test eax, eax
je 0x415a99
push ebx
push 1
lea ecx, [esp + 0xd8]
push ecx
push eax
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x415a81
mov dword [esp + 0x34], 0x10b0c23
mov ecx, ebx
mov dword [esp + 0x38], 0x6000245
inc ebp
add al, byte [eax]
push es
mov dword [esp + 0x3c], 0x6450a0e
mov dword [esp + 0x40], 0xc0e0a0a
mov dword [esp + 0x44], 0x1451600
mov dword [esp + 0x48], 0x9404507
mov word [esp + 0x4c], 0x6f16
mov al, byte [esp + ecx + 0x34]
xor al, 0x65
mov byte [esp + ecx + 0xfc], al
inc ecx
cmp ecx, 0x1a
jl 0x415614
mov byte [esp + 0x116], bl
mov ecx, ebx
mov dword [esp + 0x78], 0xc1c8c1cf
mov dword [esp + 0x7c], 0xe49cd0bf
mov dword [esp + 0x80], 0xa8f0efeb
mov dword [esp + 0x84], 0xc4efe59c
mov dword [esp + 0x88], 0xcbecf0f0
mov byte [eax], al
add byte [eax], al
invalid
invalid
in al, dx
retf
mov dword [esp + 0x8c], 0xa8f5e8ea
mov dword [esp + 0x90], 0xf0ddec9c
add byte [eax], al
pushfd
in al, dx
invalid
invalid
mov dword [esp + 0x94], 0xe59ca8e4
mov dword [esp + 0x98], 0xdfe1cfef
mov dword [esp + 0x9c], 0xa8e1eef1
add byte [eax], al
add cl, dh
out dx, al
loope 0x415640
mov dword [esp + 0xa0], 0xecf4e19c
mov dword [esp + 0xa4], 0xa8f5eee5
test al, 0xc7
test byte [eax + ebp*4], ah
add byte [eax], al
add byte [edx + ebp*8 - 0x7b381623], bl
and al, 0xac
add byte [eax], al
add cl, ah
test al, 0x9c
mov dword [esp + 0xb0], 0xe1f1e8dd
mov dword [esp + 0xb4], 0xcbcec29c
mov dword [esp + 0xb8], 0xebe99cc9
mov dword [esp + 0xbc], 0xebdfdbf6
mov dword [esp + 0xc0], 0xe1e5e7eb
mov byte [esp + 0xc4], 0xef
mov al, byte [esp + ecx + 0x78]
sub al, 0x7c
mov byte [esp + ecx + 0x140], al
inc ecx
cmp ecx, 0x4d
jl 0x415703
lea eax, [esp + 0xfc]
mov byte [esp + 0x18d], bl
push edi
push eax
call 0x42711a
add dword [eax], eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x154]
push eax
push dword [esp + 0xe8]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x415a79
push dword [esp + 0x14]
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4159da
mov dword [esp + 0x58], 0xc2bfc176
mov word [esp + 0x5c], 0x76b2
mov dword [esp + 0x68], 0x5a57501f
mov word [esp + 0x6c], 0x5345
mov byte [esp + 0x6e], 0x1f
mov dword [esp + 0x60], 0x888f89d4
mov word [esp + 0x64], 0xd498
mov dword [esp + 0x70], 0x5faffc2
mov word [esp + 0x74], 0xfe0c
mov byte [esp + 0x76], 0xc2
mov word [esp + 0x50], 0x3639
Function at 0x4156ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test al, 0xc7
test byte [eax + ebp*4], ah
add byte [eax], al
add byte [edx + ebp*8 - 0x7b381623], bl
and al, 0xac
add byte [eax], al
add cl, ah
test al, 0x9c
mov dword [esp + 0xb0], 0xe1f1e8dd
Function at 0x415751
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
mov dword [esp + 0x2c], 0x2023282a
mov word [esp + 0x30], 0x1c2b
movzx eax, byte [esp + ecx + 0x20]
add ax, 0x49
and ax, dx
mov word [esp + ecx*2 + 0x118], ax
add byte [eax], al
inc ecx
cmp ecx, 0x12
jl 0x415553
xor eax, eax
mov word [esp + 0x13c], ax
lea eax, [esp + 0x118]
push edi
push eax
call 0x4300b9
mov edi, eax
mov dword [esp + 0xd4], edi
pop ecx
pop ecx
test edi, edi
je 0x415ab7
mov ecx, edi
call 0x43012d
mov ebp, eax
test ebp, ebp
je 0x415ab0
invalid
xor edx, edx
mov ecx, ebp
call 0x4303ac
mov dword [esp + 0xe8], eax
test eax, eax
je 0x415a99
push ebx
push 1
lea ecx, [esp + 0xd8]
push ecx
push eax
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x415a81
mov dword [esp + 0x34], 0x10b0c23
mov ecx, ebx
mov dword [esp + 0x38], 0x6000245
inc ebp
add al, byte [eax]
push es
mov dword [esp + 0x3c], 0x6450a0e
mov dword [esp + 0x40], 0xc0e0a0a
mov dword [esp + 0x44], 0x1451600
mov dword [esp + 0x48], 0x9404507
mov word [esp + 0x4c], 0x6f16
mov al, byte [esp + ecx + 0x34]
xor al, 0x65
mov byte [esp + ecx + 0xfc], al
inc ecx
cmp ecx, 0x1a
jl 0x415614
mov byte [esp + 0x116], bl
mov ecx, ebx
mov dword [esp + 0x78], 0xc1c8c1cf
mov dword [esp + 0x7c], 0xe49cd0bf
mov dword [esp + 0x80], 0xa8f0efeb
mov dword [esp + 0x84], 0xc4efe59c
mov dword [esp + 0x88], 0xcbecf0f0
mov byte [eax], al
add byte [eax], al
invalid
invalid
in al, dx
retf
mov dword [esp + 0x8c], 0xa8f5e8ea
mov dword [esp + 0x90], 0xf0ddec9c
add byte [eax], al
pushfd
in al, dx
invalid
invalid
mov dword [esp + 0x94], 0xe59ca8e4
mov dword [esp + 0x98], 0xdfe1cfef
mov dword [esp + 0x9c], 0xa8e1eef1
add byte [eax], al
add cl, dh
out dx, al
loope 0x415640
mov dword [esp + 0xa0], 0xecf4e19c
mov dword [esp + 0xa4], 0xa8f5eee5
test al, 0xc7
test byte [eax + ebp*4], ah
add byte [eax], al
add byte [edx + ebp*8 - 0x7b381623], bl
and al, 0xac
add byte [eax], al
add cl, ah
test al, 0x9c
mov dword [esp + 0xb0], 0xe1f1e8dd
mov dword [esp + 0xb4], 0xcbcec29c
mov dword [esp + 0xb8], 0xebe99cc9
mov dword [esp + 0xbc], 0xebdfdbf6
mov dword [esp + 0xc0], 0xe1e5e7eb
mov byte [esp + 0xc4], 0xef
mov al, byte [esp + ecx + 0x78]
sub al, 0x7c
mov byte [esp + ecx + 0x140], al
inc ecx
cmp ecx, 0x4d
jl 0x415703
lea eax, [esp + 0xfc]
mov byte [esp + 0x18d], bl
push edi
push eax
call 0x42711a
add dword [eax], eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x154]
push eax
push dword [esp + 0xe8]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x415a79
push dword [esp + 0x14]
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4159da
mov dword [esp + 0x58], 0xc2bfc176
mov word [esp + 0x5c], 0x76b2
mov dword [esp + 0x68], 0x5a57501f
mov word [esp + 0x6c], 0x5345
mov byte [esp + 0x6e], 0x1f
mov dword [esp + 0x60], 0x888f89d4
mov word [esp + 0x64], 0xd498
mov dword [esp + 0x70], 0x5faffc2
mov word [esp + 0x74], 0xfe0c
mov byte [esp + 0x76], 0xc2
mov word [esp + 0x50], 0x3639
Function at 0x41589f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
mov ecx, edi
call 0x43051e
pop ecx
push 2
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
mov ecx, edi
call 0x43069a
pop ecx
push 3
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x4158ed
cmp byte [eax], 0x31
jne 0x4158ed
lea eax, [esp + 0xdc]
mov dword [esp + 0xc8], eax
jmp 0x4158fb
lea eax, [esp + 0xf4]
mov dword [esp + 0xc8], eax
push eax
call fcn.0041a83c
mov edx, dword [esp + 0xcc]
pop ecx
push eax
mov ecx, edi
call 0x430588
pop ecx
push 4
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 4
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
Function at 0x415929
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, ebx
mov al, byte [esp + ecx + 0x58]
sub al, 0x6d
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 6
jl 0x4157b7
mov byte [esp + 0xda], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x68]
xor al, 0x16
mov byte [esp + ecx + 0xec], al
inc ecx
cmp ecx, 7
jl 0x4157d3
mov byte [esp + 0xf3], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x60]
xor al, 0xdd
mov byte [esp + ecx + 0xdc], al
inc ecx
cmp ecx, 6
jl 0x4157ef
mov byte [esp + 0xe2], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x70]
add al, 0x47
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 7
jl 0x41580b
mov byte [esp + 0xfb], bl
mov ecx, ebx
mov word [esp + 0x18], 9
mov word [esp + 0x1c], 9
mov al, byte [esp + ecx + 0x50]
sub al, 0x2c
mov byte [esp + ecx + 0x54], al
inc ecx
cmp ecx, 2
jl 0x415835
push ebx
push dword [esp + 0x18]
mov byte [esp + 0x5e], bl
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x43063b
pop ecx
push 1
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x415889
cmp byte [eax], 0x31
jne 0x415889
lea edi, [esp + 0xd4]
mov eax, edi
jmp 0x415892
lea edi, [esp + 0xec]
mov eax, edi
push eax
call fcn.0041a7d3
mov edx, edi
lea edi, [esp + 0x24]
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430706
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.0041a87a
pop ecx
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x24]
call 0x4305c5
pop ecx
push 5
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 5
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430743
pop ecx
lea eax, [esp + 0x1c]
push eax
call fcn.0041a8b7
dec edi
add byte [eax], al
pop ecx
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
call 0x430602
add dword [eax], eax
pop ecx
push 6
push dword [esp + 0x18]
and al, 0x18
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 6
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430780
pop ecx
lea eax, [esp + 0x54]
push eax
call fcn.0041a8f4
pop ecx
push eax
lea edx, [esp + 0x58]
lea ecx, [esp + 0x24]
call 0x43063f
pop ecx
push dword [esp + 0x14]
call dword [esi + 0xc]
push esi
or al, 0x59
cmp eax, 0x64
invalid
test bl, bl
std
Function at 0x415989
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, ebx
mov al, byte [esp + ecx + 0x58]
sub al, 0x6d
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 6
jl 0x4157b7
mov byte [esp + 0xda], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x68]
xor al, 0x16
mov byte [esp + ecx + 0xec], al
inc ecx
cmp ecx, 7
jl 0x4157d3
mov byte [esp + 0xf3], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x60]
xor al, 0xdd
mov byte [esp + ecx + 0xdc], al
inc ecx
cmp ecx, 6
jl 0x4157ef
mov byte [esp + 0xe2], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x70]
add al, 0x47
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 7
jl 0x41580b
mov byte [esp + 0xfb], bl
mov ecx, ebx
mov word [esp + 0x18], 9
mov word [esp + 0x1c], 9
mov al, byte [esp + ecx + 0x50]
sub al, 0x2c
mov byte [esp + ecx + 0x54], al
inc ecx
cmp ecx, 2
jl 0x415835
push ebx
push dword [esp + 0x18]
mov byte [esp + 0x5e], bl
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x43063b
pop ecx
push 1
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x415889
cmp byte [eax], 0x31
jne 0x415889
lea edi, [esp + 0xd4]
mov eax, edi
jmp 0x415892
lea edi, [esp + 0xec]
mov eax, edi
push eax
call fcn.0041a7d3
mov edx, edi
lea edi, [esp + 0x24]
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430706
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.0041a87a
pop ecx
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x24]
call 0x4305c5
pop ecx
push 5
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 5
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430743
pop ecx
lea eax, [esp + 0x1c]
push eax
call fcn.0041a8b7
dec edi
add byte [eax], al
pop ecx
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
call 0x430602
add dword [eax], eax
pop ecx
push 6
push dword [esp + 0x18]
and al, 0x18
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 6
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430780
pop ecx
lea eax, [esp + 0x54]
push eax
call fcn.0041a8f4
pop ecx
push eax
lea edx, [esp + 0x58]
lea ecx, [esp + 0x24]
call 0x43063f
pop ecx
push dword [esp + 0x14]
call dword [esi + 0xc]
push esi
or al, 0x59
cmp eax, 0x64
invalid
test bl, bl
std
Function at 0x415990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, ebx
mov al, byte [esp + ecx + 0x58]
sub al, 0x6d
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 6
jl 0x4157b7
mov byte [esp + 0xda], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x68]
xor al, 0x16
mov byte [esp + ecx + 0xec], al
inc ecx
cmp ecx, 7
jl 0x4157d3
mov byte [esp + 0xf3], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x60]
xor al, 0xdd
mov byte [esp + ecx + 0xdc], al
inc ecx
cmp ecx, 6
jl 0x4157ef
mov byte [esp + 0xe2], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x70]
add al, 0x47
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 7
jl 0x41580b
mov byte [esp + 0xfb], bl
mov ecx, ebx
mov word [esp + 0x18], 9
mov word [esp + 0x1c], 9
mov al, byte [esp + ecx + 0x50]
sub al, 0x2c
mov byte [esp + ecx + 0x54], al
inc ecx
cmp ecx, 2
jl 0x415835
push ebx
push dword [esp + 0x18]
mov byte [esp + 0x5e], bl
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x43063b
pop ecx
push 1
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x415889
cmp byte [eax], 0x31
jne 0x415889
lea edi, [esp + 0xd4]
mov eax, edi
jmp 0x415892
lea edi, [esp + 0xec]
mov eax, edi
push eax
call fcn.0041a7d3
mov edx, edi
lea edi, [esp + 0x24]
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430706
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.0041a87a
pop ecx
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x24]
call 0x4305c5
pop ecx
push 5
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 5
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430743
pop ecx
lea eax, [esp + 0x1c]
push eax
call fcn.0041a8b7
dec edi
add byte [eax], al
pop ecx
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
call 0x430602
add dword [eax], eax
pop ecx
push 6
push dword [esp + 0x18]
and al, 0x18
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 6
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430780
pop ecx
lea eax, [esp + 0x54]
push eax
call fcn.0041a8f4
pop ecx
push eax
lea edx, [esp + 0x58]
lea ecx, [esp + 0x24]
call 0x43063f
pop ecx
push dword [esp + 0x14]
call dword [esi + 0xc]
push esi
or al, 0x59
cmp eax, 0x64
invalid
test bl, bl
std
Function at 0x4159ce
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov ecx, ebx
mov al, byte [esp + ecx + 0x58]
sub al, 0x6d
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 6
jl 0x4157b7
mov byte [esp + 0xda], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x68]
xor al, 0x16
mov byte [esp + ecx + 0xec], al
inc ecx
cmp ecx, 7
jl 0x4157d3
mov byte [esp + 0xf3], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x60]
xor al, 0xdd
mov byte [esp + ecx + 0xdc], al
inc ecx
cmp ecx, 6
jl 0x4157ef
mov byte [esp + 0xe2], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x70]
add al, 0x47
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 7
jl 0x41580b
mov byte [esp + 0xfb], bl
mov ecx, ebx
mov word [esp + 0x18], 9
mov word [esp + 0x1c], 9
mov al, byte [esp + ecx + 0x50]
sub al, 0x2c
mov byte [esp + ecx + 0x54], al
inc ecx
cmp ecx, 2
jl 0x415835
push ebx
push dword [esp + 0x18]
mov byte [esp + 0x5e], bl
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x43063b
pop ecx
push 1
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x415889
cmp byte [eax], 0x31
jne 0x415889
lea edi, [esp + 0xd4]
mov eax, edi
jmp 0x415892
lea edi, [esp + 0xec]
mov eax, edi
push eax
call fcn.0041a7d3
mov edx, edi
lea edi, [esp + 0x24]
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430706
pop ecx
lea eax, [esp + 0x18]
push eax
call fcn.0041a87a
pop ecx
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x24]
call 0x4305c5
pop ecx
push 5
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 5
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430743
pop ecx
lea eax, [esp + 0x1c]
push eax
call fcn.0041a8b7
dec edi
add byte [eax], al
pop ecx
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
call 0x430602
add dword [eax], eax
pop ecx
push 6
push dword [esp + 0x18]
and al, 0x18
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 6
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x24]
call 0x430780
pop ecx
lea eax, [esp + 0x54]
push eax
call fcn.0041a8f4
pop ecx
push eax
lea edx, [esp + 0x58]
lea ecx, [esp + 0x24]
call 0x43063f
pop ecx
push dword [esp + 0x14]
call dword [esi + 0xc]
push esi
or al, 0x59
cmp eax, 0x64
invalid
test bl, bl
std
Function at 0x415b2b
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov al, byte [esp + ecx + 0x10]
xor al, 0xca
movzx eax, al
mov word [esp + ecx*2 + 0x74], ax
inc ecx
cmp ecx, 7
jl 0x415b25
movaps xmm1, xmmword [0x421050]
xor eax, eax
mov dword [esp + 0x10], 0xa2a4b3b5
xor ecx, ecx
mov dword [esp + 0x14], 0xb4b2f8ee
movq xmm0, qword [esp + 0x10]
pxor xmm1, xmm0
mov dword [esp + 0x10], 0x2041315
xorps xmm0, xmm0
mov dword [esp + 0x14], 0x1412584f
punpcklbw xmm1, xmm0
movq xmm0, qword [esp + 0x10]
movups xmmword [esp + 0x94], xmm1
mov word [esp + 0x82], ax
movaps xmm1, xmmword [0x421010]
pxor xmm1, xmm0
mov word [esp + 0xa4], ax
xorps xmm0, xmm0
mov word [esp + 0xb8], ax
punpcklbw xmm1, xmm0
movups xmmword [esp + 0xa8], xmm1
mov dword [esp + 0x10], 0x544d4f59
mov dword [esp + 0x14], 0x14595455
mov dword [esp + 0x18], 0x4f525759
mov word [esp + 0x1c], 0x4b5a
movzx eax, byte [esp + ecx + 0x10]
add ax, 0x1a
and ax, dx
mov word [esp + ecx*2 + 0xec], ax
inc ecx
cmp ecx, 0xe
jl 0x415bd4
xor eax, eax
mov word [esp + 0x10], 0x5655
mov word [esp + 0x108], ax
add byte [ebx], dh
leave
mov byte [esp + 0x12], 0x5e
mov byte [esp + 0x13], bl
and al, 0x13
mov dword [esp + 0x14], 0x53174a57
Function at 0x415c12
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0x18], 0x564a
mov byte [esp + 0x1a], 0x57
mov al, byte [esp + ecx + 0x10]
xor al, 0x39
movzx eax, al
mov word [esp + ecx*2 + 0xd4], ax
inc ecx
cmp ecx, 0xb
jl 0x415c1e
xor eax, eax
mov dword [esp + 0x10], 0xcee5de97
and al, 0x10
xchg edi, eax
fsubrp st(5)
into
mov word [esp + 0xea], ax
xor ebx, ebx
lea eax, [esp + 0x64]
mov word [esp + 0x14], 0xde97
and al, 0x14
xchg edi, eax
invalid
mov dword [esp + 0x4c], eax
dec esp
lea eax, [esp + 0x74]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x94]
mov dword [esp + 0x54], eax
lea eax, [esp + 0xa8]
mov dword [esp + 0x58], eax
lea eax, [esp + 0xec]
add byte [ecx - 0x72a3dbbc], cl
test byte [esp + edx*8], ah
add byte [eax], al
add byte [ecx - 0x399fdbbc], cl
inc esp
and al, 0x16
invalid
xor ecx, ecx
movzx eax, byte [esp + ecx + 0x10]
sub ax, 0x72
and ax, dx
mov word [esp + ecx*2 + 0x84], ax
inc ecx
cmp ecx, 7
jl 0x415c93
push dword [esp + ebx*4 + 0x4c]
xor eax, eax
mov word [esp + 0x96], ax
lea eax, [esp + 0x88]
push ebp
push eax
call 0x4307fd
mov edi, eax
add esp, 0xc
test edi, edi
je 0x415dcf
xor ecx, ecx
mov edx, 0xeeb55893
push edi
inc ecx
call 0x427d86
call eax
cmp eax, 0xffffffff
je 0x415dc8
mov dword [esp + 0x34], 0x4e585330
xor ecx, ecx
mov dword [esp + 0x38], 0x4d4f510a
mov dword [esp + 0x3c], 0x500a5955
mov dword [esp + 0x40], 0xa4f5653
mov dword [esp + 0x44], 0xf45d560f
mov al, byte [esp + ecx + 0x34]
add al, 0x16
mov byte [esp + ecx + 0xbc], al
inc ecx
cmp ecx, 0x14
jl 0x415d19
mov byte [esp + 0xd0], 0
xor ecx, ecx
mov dword [esp + 0x20], 0x39313315
mov edx, 0xff
mov dword [esp + 0x24], 0x3af3fd3d
mov dword [esp + 0x28], 0x3af3fd41
mov dword [esp + 0x2c], 0x3af3fd41
mov byte [esp + 0x30], 0x41
movzx eax, byte [esp + ecx + 0x20]
add ax, 0x32
and ax, dx
mov word [esp + ecx*2 + 0x10c], ax
inc ecx
cmp ecx, 0x11
jl 0x415d60
xor eax, eax
mov word [esp + 0x12e], ax
lea eax, [esp + 0xbc]
and al, 0xbc
add byte [eax], al
add byte [edi + 0x50], dl
call 0x427781
push dword [esp + ebx*4 + 0x54]
je 0x415d31
push esp
lea eax, [esp + 0x118]
push dword [esp + 0x140]
push esi
push eax
call 0x4308df
mov esi, eax
add esp, 0x18
test esi, esi
je 0x415dc4
mov edx, esi
mov ecx, edi
call 0x42dae4
push esi
call fcn.0041a8ae
mov esi, dword [esp + 0x48]
push edi
call fcn.0041a8b9
pop ecx
inc ebx
mov edx, 0xff
cmp ebx, 6
jb 0x415c91
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret