joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41778e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x5c
pop eax
push dword [esp + 0x44]
mov word [esp + 0x38], ax
xor eax, eax
push ebx
mov word [esp + 0x3e], ax
call 0x41c7fe
lea eax, [esp + 0x3c]
push eax
push ebx
call 0x41c5f6
push edi
push ebx
call 0x41c5fd
add esp, 0x18
lea eax, [esp + 0x30]
mov edx, 0x68407afb
push eax
push ebx
push 0x80000001
push 4
pop ecx
call 0x4296f4
call eax
test eax, eax
jne 0x417796
mov dword [esp + 0x10], 0x7f7d7973
mov eax, esi
mov dword [esp + 0x14], 0x7a0c0c09
mov dword [esp + 0x18], 0x7b797b7e
mov dword [esp + 0x1c], 0x792e7b7b
mov dword [esp + 0x20], 0xb727208
mov dword [esp + 0x24], 0x7a7b7a7a
mov dword [esp + 0x28], 0xb78087e
mov dword [esp + 0x2c], 0x7c7d7c7c
movq xmm1, qword [esp + eax + 0x10]
movq xmm0, qword [0x420fc0]
pxor xmm1, xmm0
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
movups xmmword [esp + eax*2 + 0x5c], xmm1
add eax, 8
cmp eax, 0x20
jl 0x41769e
xor eax, eax
mov word [esp + 0x9c], ax
lea eax, [esp + 0x5c]
push eax
push edi
call 0x41c5ca
pop ecx
pop ecx
test eax, eax
jne 0x417841
push 0x200
call 0x41c1f3
mov ebp, eax
pop ecx
test ebp, ebp
je 0x41777f
push 0x100
push ebp
push esi
push dword [esp + 0x3c]
mov edx, 0x1bdd7fb
push 4
pop ecx
call 0x4297b2
call eax
test eax, eax
jne 0x417778
mov ebx, esi
lea eax, [esp + 0x38]
mov edx, 0x68407afb
push eax
push ebp
push dword [esp + 0x38]
push 4
pop ecx
call 0x4297d1
call eax
test eax, eax
jne 0x417755
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x50]
call 0x42e38e
push dword [esp + 0x38]
mov edx, 0x76485fc5
push 4
pop ecx
call 0x4297f5
call eax
push 0x100
push ebp
inc ebx
mov edx, 0x1bdd7fb
push ebx
push dword [esp + 0x3c]
push 4
pop ecx
call 0x429810
call eax
test eax, eax
invalid
je 0x417718
mov ebx, dword [esp + 0x4c]
push ebp
call 0x41c269
pop ecx
mov ebp, dword [esp + 0x3c]
push dword [esp + 0x30]
mov edx, 0x76485fc5
push 4
pop ecx
call 0x429836
call eax
mov eax, dword [esp + 0x40]
push 0x400
inc eax
push edi
mov dword [esp + 0x48], eax
push eax
push ebp
push 4
mov edx, 0x1bdd7fb
pop ecx
call 0x429856
call eax
test eax, eax
je 0x41760c
push ebx
call 0x41c2af
push edi
call 0x41c2b5
pop ecx
pop ecx
mov ecx, dword [esp + 0x50]
test ecx, ecx
je 0x417836
mov dword [esp + 0x10], 0x120a16ee
mov dword [esp + 0x14], 0x1becd815
mov dword [esp + 0x18], 0x170e0d0e
mov dword [esp + 0x1c], 0x150a121d
mov dword [esp + 0x20], 0x211dd71c
mov byte [esp + 0x24], 0x1d
movzx eax, byte [esp + esi + 0x10]
mov edx, 0xff
add ax, 0x57
and ax, dx
mov word [esp + esi*2 + 0x5c], ax
inc esi
cmp esi, 0x15
jl 0x417801
mov edx, dword [esp + 0x58]
xor eax, eax
mov word [esp + 0x86], ax
lea eax, [esp + 0x5c]
push eax
call 0x42f815
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret
mov ecx, dword [esp + 0x30]
mov edx, ebx
call 0x42e1f9
jmp 0x417783
Function at 0x4179ed
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push eax
lea edx, [ebp + 0x30]
mov ecx, esi
call 0x43266f
pop ecx
pop ecx
lea edx, [ebp - 0x470]
mov ecx, esi
call 0x432505
lea eax, [ebp + 0x64]
push eax
push ecx
lea eax, [ebp - 0x470]
mov ecx, edi
push eax
lea edx, [ebp - 0x38]
call 0x42e9de
add esp, 0xc
test al, al
jne 0x417b32
mov dword [ebp + 0x68], 0x3627332f
mov ecx, ebx
mov dword [ebp + 0x6c], 0x59473606
mov edx, 0xff
mov dword [ebp + 0x70], 0x58555d59
mov byte [ebp + 0x74], 0x4a
movzx eax, byte [ebp + ecx + 0x68]
add ax, 0x1a
and ax, dx
mov word [ebp + ecx*2 + 0x44], ax
inc ecx
cmp ecx, 0xd
jl 0x417a48
xor eax, eax
lea edx, [ebp + 0x44]
mov word [ebp + 0x5e], ax
lea eax, [ebp + 0x64]
push eax
push ecx
lea eax, [ebp - 0x470]
mov ecx, edi
push eax
call 0x42ea3c
add esp, 0xc
test al, al
jne 0x417b32
mov dword [ebp + 0x68], 0x7672726e
mov ecx, ebx
mov dword [ebp + 0x6c], 0x55477606
mov dword [ebp + 0x70], 0x54495155
mov byte [ebp + 0x74], 0x42
mov al, byte [ebp + ecx + 0x68]
xor al, 0x26
movzx eax, al
mov word [ebp + ecx*2 - 0x54], ax
inc ecx
cmp ecx, 0xd
jl 0x417aa1
xor eax, eax
lea edx, [ebp - 0x54]
mov word [ebp - 0x3a], ax
lea eax, [ebp + 0x64]
push eax
push ecx
lea eax, [ebp - 0x470]
mov ecx, edi
push eax
call 0x42ea92
add esp, 0xc
test al, al
jne 0x417b32
mov dword [ebp + 0x68], 0xf2f6eff5
mov ecx, ebx
mov dword [ebp + 0x6c], 0x1503f2c2
mov edx, 0xff
mov dword [ebp + 0x70], 0x14111915
mov byte [ebp + 0x74], 6
movzx eax, byte [ebp + ecx + 0x68]
add ax, 0x5e
and ax, dx
mov word [ebp + ecx*2 - 0x70], ax
inc ecx
cmp ecx, 0xd
jl 0x417af8
xor eax, eax
lea edx, [ebp - 0x70]
mov word [ebp - 0x56], ax
lea eax, [ebp + 0x64]
push eax
push ecx
lea eax, [ebp - 0x470]
mov ecx, edi
push eax
call 0x42eaec
add esp, 0xc
test al, al
je 0x417ba8
lea eax, [ebp - 0x46f]
mov edx, 0xbedfd981
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x6c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1c]
push eax
push 3
pop ecx
call 0x429bfd
call eax
test eax, eax
je 0x417ba8
mov dword [ebp + 0x60], 0xbb945659
mov ecx, ebx
mov dword [ebp + 0x64], 0x6c86c0bf
mov al, byte [ebp + ecx + 0x60]
sub al, 0x4c
mov byte [ebp + ecx + 0x24], al
inc ecx
cmp ecx, 8
jl 0x417b71
lea eax, [ebp + 0x24]
Function at 0x417dc4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov edi, ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x10]
xor bl, bl
call 0x432bd8
mov esi, eax
test esi, esi
je 0x417e5c
mov dword [esp + 0x14], 0xb8b1b4bb
xor ecx, ecx
mov dword [esp + 0x18], 0xb8b0bcb3
mov al, byte [esp + ecx + 0x14]
xor al, 0xdd
mov byte [esp + ecx + 0x1c], al
inc ecx
cmp ecx, 8
jl 0x417df6
push dword [esp + 0x10]
lea edx, [esp + 0x20]
mov byte [esp + 0x28], bl
push esi
mov ecx, edi
call 0x42f07b
mov bl, al
pop ecx
pop ecx
test bl, bl
je 0x417e55
mov dword [esp + 0x10], 0x6d74716e
xor ecx, ecx
mov al, byte [esp + ecx + 0x10]
sub al, 8
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 4
jl 0x417e2c
push dword [esp + 0x2c]
lea edx, [esp + 0x18]
mov byte [esp + 0x1c], 0
push ebp
mov ecx, edi
call 0x42f0b2
pop ecx
pop ecx
mov bl, al
push esi
call 0x41c946
pop ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret

Function at 0x417f7f
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
pop edi
lodsd eax, dword [esi]
imul ebx, dword [edi - 0x3a], 0xad1c2444

Function at 0x417f90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x18]
sub al, 0x3a
mov byte [esp + ecx + 0x24], al
or al, 0x24
or al, 0x24
inc ecx
cmp ecx, 5
jl 0x417f88
mov byte [esp + 0x29], bl
mov ecx, ebx
mov dword [esp + 0xa8], 0x505f5754
mov dword [esp + 0xac], 0x55175a4d
mov dword [esp + 0xb0], 0x5d4c4b59
mov byte [esp + 0xb4], 0x4a
mov al, byte [esp + ecx + 0xa8]
xor al, 0x38
mov byte [esp + ecx + 0x58], al
inc ecx
cmp ecx, 0xd
jl 0x417fc7
lea eax, [esp + 0x58]
mov byte [esp + 0x65], bl
push eax
lea eax, [esp + 0x28]
push esi
push eax
push 0x104
push 0x424ba8
mov edx, 0x534fbfb6
xor ecx, ecx
call 0x42a0a1
call eax
xor eax, eax
mov dword [0x424db0], 0x1f4
lea edi, [esp + 0x38]
add esp, 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call 0x4312e6
mov esi, eax
xor ecx, ecx
mov edi, 0x9e7f4339
inc ecx
push esi
mov edx, edi
call 0x42a0d0
call eax
push eax
push esi
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x2c]
call 0x42f2a3
pop ecx
pop ecx
xor ecx, ecx
mov esi, str.nuka
push esi
mov edx, edi
inc ecx
call 0x42a0f6
call eax
push eax
push esi
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x2c]
call 0x42f2c9
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], ebx
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x30]
call 0x42f190
add esp, 0xc
test al, al
je 0x4183f5
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4183f5
mov dword [esp + 0x14], 0xb8bff9fd
mov ecx, ebx

Function at 0x4180a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x14]
xor al, 0xb2
mov byte [esp + ecx + 0x24], al
inc ecx
cmp ecx, 4
jl 0x41809f
push 4
lea eax, [esp + 0x28]
mov byte [esp + 0x2c], bl
push eax
push edi
call fcn.0041979f
add esp, 0xc
test eax, eax
jne 0x4183ee
mov word [esp + 0x20], 0x7c
mov ecx, ebx
mov dword [esp + 0x6c], 0xbcc4c599
Function at 0x4180dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x70], 0xc876bdbf
mov dword [esp + 0x74], 0xbfc8cabb
mov dword [esp + 0x78], 0xbabbccbb
mov dword [esp + 0x7c], 0xba7b7690
mov dword [esp + 0x80], 0xba7b7682
mov dword [esp + 0x84], 0xba7b7682
add byte [eax], al
add byte [edx - 0x3845848a], al
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [edx - 0x3845848a], al
test byte [esp + ecx*4], ah
add byte [eax], al
add byte [edx - 0x3845848a], al
test byte [eax + edx*4], ah
add byte [eax], al
add byte [edx - 0x3845848a], al
test byte [esp + edx*4], ah
add byte [eax], al
add byte [edx - 0x3845848a], al
test byte [eax + ebx*4], ah
add byte [eax], al
add byte [edx - 0x3845848a], al
test byte [esp + ebx*4], ah
add byte [eax], al
add byte [edx - 0x3845848a], al
test byte [eax], ah
add byte [eax], al
add byte [edx - 0x3945848a], al
test byte [esp], ah
add byte [eax], al
invalid
pushal
mov al, byte [esp + ecx + 0x6c]
sub al, 0x56
mov byte [esp + ecx + 0xd0], al
inc ecx
cmp ecx, 0x39
jl 0x418167
mov byte [esp + 0x109], bl
mov ecx, ebx
mov dword [esp + 0x58], 0xe0a31

Function at 0x4181aa
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x5c], 0x17450b
mov dword [esp + 0x60], 0xc1711
mov dword [esp + 0x64], 0x5f010013
mov dword [esp + 0x68], 0x6f164045
outsd dx, dword [esi]
mov al, byte [esp + ecx + 0x58]
xor al, 0x65
mov byte [esp + ecx + 0xa8], al
inc ecx
cmp ecx, 0x14
jl 0x4181ab
lea eax, [esp + 0x18]
mov byte [esp + 0xbc], bl
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [edi + 4]
push eax
call 0x41d36f
add esp, 0xc
mov esi, ebx
test eax, eax
je 0x418396
mov edx, 0xbf77ea11

Function at 0x418389
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ecx], al
add bh, bh
sal bh, 1
fcomp dword [edx]
sar dh, 0xc0
adc edx, ebp
ja 0x41834c

Function at 0x418509
Capabilities:
Encode data using xor

Disassembly:
and al, 0x38
xor esi, esi
mov dword [esp + 0x28], 0xb79887ce
mov byte [esp + 0x2c], 0xc1
mov al, byte [esp + esi + 0x28]
xor al, 0xeb
movzx eax, al
mov word [esp + esi*2 + 0x64], ax
inc esi
cmp esi, 5
jl 0x41851a
xor eax, eax
mov dword [esp + 0x30], 0x5f766f28
mov word [esp + 0x6e], ax
xor ecx, ecx
mov word [esp + 0x34], 0x6f28
mov esi, 0xff
mov byte [esp + 0x36], 0x76

Function at 0x4186ff
Capabilities:
Encode data using xor

Disassembly:
div byte [ebp + ebx - 0x73]
dec ebx
dec dword [ebx - 0x4b00ae2a]
and al, 0xdc
add al, byte [eax]
add byte [ebx + 0x78f2e8cf], cl
add dword [eax], eax

Function at 0x4188df
Capabilities:
Encode data using xor

Disassembly:
dec edx
add byte [eax], al
pop ecx
push edi
call 0x41d3d4
pop ecx
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x80]
push eax
push ebp
call ebx
mov esi, 0xff
test eax, eax
jne 0x4187c1
xor ecx, ecx
mov edx, 0x83fbc401
sti
adc dword [ebp + 0x41], 0xffffffe8
invalid
and byte [ecx], al
invalid
Function at 0x418988
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add bh, al
inc esp
and al, 0x18
and ch, byte [ecx + 0x70]
jo 0x4189e3
jo 0x4189e3
mov byte [esp + 0x1c], 0x27
pop edx
movzx eax, byte [esp + esi + 0x14]
add ax, 3
and ax, bx
mov word [esp + esi*2 + 0x4c], ax
dec esp
inc esi
cmp esi, edx
jl 0x418990
xor eax, eax
mov word [esp + 0x56], ax
lea eax, [esp + 0x4c]
push ecx
push eax
call 0x4334ec
mov ebx, eax
mov dword [esp + 0x1c], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x418bda
lea eax, [esp + 0x88]
xor ecx, ecx
push eax
push ebx
mov edx, 0x54e1cc7b
inc ecx
call 0x42aa80
call eax
xor ecx, ecx
mov edx, 0x17299c7b
jnp 0x418981
sub dword [edi], edx
inc ecx
mov ebp, eax
call fcn.00412ca7
mov esi, eax
mov dword [esp + 0x20], esi
cmp ebp, 0xffffffff
je 0x418bd3
mov ebx, dword [esp + 0x24]
mov word [esp + 0x1c], 0x5555
mov dword [esp + 0x28], 0x3b140b42
mov word [esp + 0x2c], 0xb42
mov byte [esp + 0x2e], 0x14
push 0x2e
pop eax
mov word [esp + 0x24], ax
xor eax, eax
mov word [esp + 0x26], ax
xor ecx, ecx
mov al, byte [esp + ecx + 0x1c]
xor al, 0x7b
movzx eax, al
mov word [esp + ecx*2 + 0x44], ax
inc ecx
cmp ecx, 2
jl 0x418a2e
xor eax, eax
xor ecx, ecx
mov word [esp + 0x48], ax
mov al, byte [esp + ecx + 0x28]
xor al, 0x67
movzx eax, al
mov word [esp + ecx*2 + 0x58], ax
inc ecx
cmp ecx, 7
jl 0x418a4b
xor eax, eax
mov word [esp + 0x66], ax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xb8]
push eax
call 0x41d969
pop ecx
pop ecx
test eax, eax
je 0x418bac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0xb8]
push eax
call 0x41d985
pop ecx
pop ecx
test eax, eax
je 0x418bac
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x5c]
push ebx
push eax
call 0x4335e5
mov edi, eax
add esp, 0xc
test edi, edi
je 0x418bac
test byte [esp + 0x88], 0x10
je 0x418b27
mov dword [esp + 0x30], 0x217d622b
xor ecx, ecx
mov word [esp + 0x34], 0x622b
mov byte [esp + 0x36], 0x7d
mov al, byte [esp + ecx + 0x30]
xor al, 0xe
movzx eax, al
mov word [esp + ecx*2 + 0x68], ax
inc ecx
cmp ecx, 7
jl 0x418ade
xor eax, eax
mov word [esp + 0x76], ax
lea eax, [esp + 0xb4]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0x70]
push eax
call 0x433643
mov esi, eax
add esp, 0xc
test esi, esi
je 0x418ba1
mov edx, esi
mov ecx, edi
call 0x430887
jmp 0x418b9a
test byte [esp + 0x88], 0xa7
je 0x418ba5
push 5
mov dword [esp + 0x3c], 0x2a6e6720
xor ecx, ecx
mov word [esp + 0x40], 0x6720
mov esi, 0xff
mov byte [esp + 0x42], 0x6e
pop edx
movzx eax, byte [esp + ecx + 0x38]
add ax, dx
and ax, si
mov word [esp + ecx*2 + 0x78], ax
inc ecx
cmp ecx, 7
jl 0x418b4f
xor eax, eax
mov word [esp + 0x86], ax
lea eax, [esp + 0xb4]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0x80]
push eax
call 0x4336bc
mov esi, eax
add esp, 0xc
test esi, esi
je 0x418ba1
mov edx, esi
mov ecx, edi
call 0x4308c1
push esi
call 0x41d68b
pop ecx
mov esi, dword [esp + 0x20]
push edi
call 0x41d696
pop ecx
lea eax, [esp + 0x88]
push eax
push ebp
call esi
test eax, eax
jne 0x418a1d
xor ecx, ecx
mov edx, 0x83fbc401
push ebp
inc ecx
invalid
invalid
and byte [ecx], al
Function at 0x4189a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
add bh, al
inc esp
and al, 0x18
and ch, byte [ecx + 0x70]
jo 0x4189e3
jo 0x4189e3
mov byte [esp + 0x1c], 0x27
pop edx
movzx eax, byte [esp + esi + 0x14]
add ax, 3
and ax, bx
mov word [esp + esi*2 + 0x4c], ax
dec esp
inc esi
cmp esi, edx
jl 0x418990
xor eax, eax
mov word [esp + 0x56], ax
lea eax, [esp + 0x4c]
push ecx
push eax
call 0x4334ec
mov ebx, eax
mov dword [esp + 0x1c], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x418bda
lea eax, [esp + 0x88]
xor ecx, ecx
push eax
push ebx
mov edx, 0x54e1cc7b
inc ecx
call 0x42aa80
call eax
xor ecx, ecx
mov edx, 0x17299c7b
jnp 0x418981
sub dword [edi], edx
inc ecx
mov ebp, eax
call fcn.00412ca7
mov esi, eax
mov dword [esp + 0x20], esi
cmp ebp, 0xffffffff
je 0x418bd3
mov ebx, dword [esp + 0x24]
mov word [esp + 0x1c], 0x5555
mov dword [esp + 0x28], 0x3b140b42
mov word [esp + 0x2c], 0xb42
mov byte [esp + 0x2e], 0x14
push 0x2e
pop eax
mov word [esp + 0x24], ax
xor eax, eax
mov word [esp + 0x26], ax
xor ecx, ecx
mov al, byte [esp + ecx + 0x1c]
xor al, 0x7b
movzx eax, al
mov word [esp + ecx*2 + 0x44], ax
inc ecx
cmp ecx, 2
jl 0x418a2e
xor eax, eax
xor ecx, ecx
mov word [esp + 0x48], ax
mov al, byte [esp + ecx + 0x28]
xor al, 0x67
movzx eax, al
mov word [esp + ecx*2 + 0x58], ax
inc ecx
cmp ecx, 7
jl 0x418a4b
xor eax, eax
mov word [esp + 0x66], ax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xb8]
push eax
call 0x41d969
pop ecx
pop ecx
test eax, eax
je 0x418bac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0xb8]
push eax
call 0x41d985
pop ecx
pop ecx
test eax, eax
je 0x418bac
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x5c]
push ebx
push eax
call 0x4335e5
mov edi, eax
add esp, 0xc
test edi, edi
je 0x418bac
test byte [esp + 0x88], 0x10
je 0x418b27
mov dword [esp + 0x30], 0x217d622b
xor ecx, ecx
mov word [esp + 0x34], 0x622b
mov byte [esp + 0x36], 0x7d
mov al, byte [esp + ecx + 0x30]
xor al, 0xe
movzx eax, al
mov word [esp + ecx*2 + 0x68], ax
inc ecx
cmp ecx, 7
jl 0x418ade
xor eax, eax
mov word [esp + 0x76], ax
lea eax, [esp + 0xb4]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0x70]
push eax
call 0x433643
mov esi, eax
add esp, 0xc
test esi, esi
je 0x418ba1
mov edx, esi
mov ecx, edi
call 0x430887
jmp 0x418b9a
test byte [esp + 0x88], 0xa7
je 0x418ba5
push 5
mov dword [esp + 0x3c], 0x2a6e6720
xor ecx, ecx
mov word [esp + 0x40], 0x6720
mov esi, 0xff
mov byte [esp + 0x42], 0x6e
pop edx
movzx eax, byte [esp + ecx + 0x38]
add ax, dx
and ax, si
mov word [esp + ecx*2 + 0x78], ax
inc ecx
cmp ecx, 7
jl 0x418b4f
xor eax, eax
mov word [esp + 0x86], ax
lea eax, [esp + 0xb4]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0x80]
push eax
call 0x4336bc
mov esi, eax
add esp, 0xc
test esi, esi
je 0x418ba1
mov edx, esi
mov ecx, edi
call 0x4308c1
push esi
call 0x41d68b
pop ecx
mov esi, dword [esp + 0x20]
push edi
call 0x41d696
pop ecx
lea eax, [esp + 0x88]
push eax
push ebp
call esi
test eax, eax
jne 0x418a1d
xor ecx, ecx
mov edx, 0x83fbc401
push ebp
inc ecx
invalid
invalid
and byte [ecx], al
Function at 0x418e21
Capabilities:
Encode data using xor

Disassembly:
lea eax, [esp + 0xd8]
push eax
call 0x42a81d
pop ecx
push ebx
lea eax, [esp + 0x8c]
mov dword [esp + 0x64], 0x46
push eax
lea eax, [esp + 0xa0]
mov dword [esp + 0x18], ebx
push eax
push 6
mov edx, 0xe7ea7d5c
mov dword [esp + 0x98], 1
pop ecx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
call 0x42af1b
call eax
test eax, eax
jne 0x419341
mov dword [esp + 0x2c], 0x9f9c868b
mov ecx, ebx
mov word [esp + 0x30], 0x8e83
mov byte [esp + 0x32], 0x96
mov al, byte [esp + ecx + 0x2c]
xor al, 0xcf
movzx eax, al
mov word [esp + ecx*2 + 0x9c], ax
inc ecx
cmp ecx, 7
jl 0x418e99
push ebx
xor eax, eax
mov edx, 0xf09d96e3
push ebx
mov word [esp + 0xb2], ax

Function at 0x41920f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
and al, 0x28
add dword [eax], eax
add byte [eax - 1], dl
mov ah, 0x24
sub al, 1
add byte [eax], al

Function at 0x4193db
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x10]
sub al, 0x6f
outsd dx, dword [esi]
outsd dx, dword [esi]
mov byte [esp + ecx + 0x10c], al
inc ecx
cmp ecx, 3
jl 0x4193d6
mov byte [esp + 0x10f], bl
mov ecx, ebx
mov dword [esp + 0x28], 0xfe010608
mov word [esp + 0x2c], 0xfa09
mov byte [esp + 0x2e], 0xc8
mov al, byte [esp + ecx + 0x28]
add al, 0x6b
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, 7
jl 0x419406
mov byte [esp + 0x11f], bl
cmp dword [0x424db8], ebx
je 0x41942f
mov al, 1
jmp 0x419bee
lea edx, [esp + 0x118]
mov byte [esp + 0x27], bl
lea ecx, [esp + 0x10c]
call 0x430c70
mov edi, eax
test edi, edi
je 0x419aac
lea eax, [esp + 0x28]
push eax
push edi
call 0x41e396
pop ecx
mov edx, eax
mov ecx, edi
call 0x427fe0
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], 0x2f
pop ecx
test eax, eax
je 0x41955b
invalid
push 0x400
call 0x41df90
add byte [eax], al
push 0x5c
pop eax
invalid
test byte [esp + ebp*8], ah
invalid

Function at 0x41947f
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], ch
add al, 0
add al, ch
push es
dec ebx

Function at 0x419481
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], ch
add al, 0
add al, ch
push es
dec ebx
Function at 0x419488
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov al, byte [esp + ecx + 0x10]
sub al, 0x6f
outsd dx, dword [esi]
outsd dx, dword [esi]
mov byte [esp + ecx + 0x10c], al
inc ecx
cmp ecx, 3
jl 0x4193d6
mov byte [esp + 0x10f], bl
mov ecx, ebx
mov dword [esp + 0x28], 0xfe010608
mov word [esp + 0x2c], 0xfa09
mov byte [esp + 0x2e], 0xc8
mov al, byte [esp + ecx + 0x28]
add al, 0x6b
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, 7
jl 0x419406
mov byte [esp + 0x11f], bl
cmp dword [0x424db8], ebx
je 0x41942f
mov al, 1
jmp 0x419bee
lea edx, [esp + 0x118]
mov byte [esp + 0x27], bl
lea ecx, [esp + 0x10c]
call 0x430c70
mov edi, eax
test edi, edi
je 0x419aac
lea eax, [esp + 0x28]
push eax
push edi
call 0x41e396
pop ecx
mov edx, eax
mov ecx, edi
call 0x427fe0
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], 0x2f
pop ecx
test eax, eax
je 0x41955b
invalid
push 0x400
call 0x41df90
add byte [eax], al
push 0x5c
pop eax
invalid
test byte [esp + ebp*8], ah
invalid

Function at 0x419575
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
dec ebp
inc edx
add byte [ebx], dh
leave
stosd dword es:[edi], eax
loop 0x41956f

Function at 0x419648
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
and al, 0x14
int1
in al, dx
jmp 0x1865db1a

Function at 0x41968f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add bh, al
test byte [edx + ebx*4], ah
add byte [eax], al
add ch, bh
sub dword [0x2484c739], ebp
sahf
add byte [eax], al
add byte [esi], dh
aas
aaa
cmp byte [esi - 0x39], ah
test byte [edx], ah
add byte [eax], al
add byte [ecx], ch
mov byte ds:[esp + 0xa4], al
Function at 0x419751
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x419bd6
push dword [0x424db4]
xor ecx, ecx
mov edx, 0xf6e264ab
inc ecx
call 0x42b621
call eax
mov dword [0x424db8], eax
test eax, eax
je 0x419aa5
mov dword [esp + 0x14], 0x7a7d8284
mov ecx, ebx
mov dword [esp + 0x18], 0x70447685
mov dword [esp + 0x1c], 0x7f768180
mov al, byte [esp + ecx + 0x14]
sub al, 0x11
mov byte [esp + ecx + 0x138], al
inc ecx
cmp ecx, 0xc
jl 0x4195a8
mov byte [esp + 0x144], bl
mov ecx, ebx
mov dword [esp + 0x30], 0x585d4042
mov dword [esp + 0x34], 0x6e025445
mov dword [esp + 0x38], 0x5f54415e
mov word [esp + 0x3c], 0x476e
mov byte [esp + 0x3e], 3
mov al, byte [esp + ecx + 0x30]
xor al, 0x31
mov byte [esp + ecx + 0x148], al
inc ecx
cmp ecx, 0xf
jl 0x4195e8
mov byte [esp + 0x157], bl
mov ecx, ebx
mov dword [esp + 0x60], 0xfefbe6e4
mov dword [esp + 0x64], 0xc8a4f2e3
mov dword [esp + 0x68], 0xe7f2e5e7
mov dword [esp + 0x6c], 0xc8f2e5f6
mov word [esp + 0x70], 0xa5e1
mov al, byte [esp + ecx + 0x60]
xor al, 0x97
mov byte [esp + ecx + 0x16c], al
inc ecx
cmp ecx, 0x12
jl 0x41962b
mov byte [esp + 0x17e], bl
mov ecx, ebx
mov dword [esp + 0x14], 0xe9ecf1f3
inc esp
and al, 0x14
int1
in al, dx
jmp 0x1865db1a
hlt
in eax, 0xb3
ffreep st(7)
inc esp
and al, 0x1c
hlt
in eax, 0xf0
mov al, byte [esp + ecx + 0x14]
add al, 0x80
mov byte [esp + ecx + 0x60], al
inc ecx
cmp ecx, 0xc
jl 0x41965f
push 0x2f
pop eax
mov byte [esp + 0x6c], bl
mov ecx, ebx
mov dword [esp + 0x94], 0x33363b3d
mov byte [esp + 0x98], 0x3e
test byte [eax + ebx*4], ah
add byte [eax], al
add byte [esi], bh
mov byte [esp + 0x99], al
mov dword [esp + 0x9a], 0x392d29fd
mov dword [esp + 0x9e], 0x38373f36
mov word [esp + 0xa2], 0x3e29
mov byte [esp + 0xa4], al
mov word [esp + 0xa5], 0x3e42
mov al, byte [esp + ecx + 0x94]
add al, 0x36
mov byte [esp + ecx + 0x74], al
inc esp
or al, 0x74
inc ecx
cmp ecx, 0x13
jl 0x4196c3
mov byte [esp + 0x87], bl
mov ecx, ebx
mov dword [esp + 0xd4], 0x484b5052
mov dword [esp + 0xd8], 0x3e124453
mov dword [esp + 0xdc], 0x544b4e42
mov dword [esp + 0xe0], 0x413e4d4c
mov word [esp + 0xe4], 0x4e4b
mov byte [esp + 0xe6], 0x41
mov al, byte [esp + ecx + 0xd4]
add al, 0x21
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 0x13
jl 0x41971d
mov dword [esp + 0x30], 0x6a6d7274
mov ecx, ebx
mov dword [esp + 0x34], 0x60346675
mov dword [esp + 0x38], 0x626f6a67
mov dword [esp + 0x3c], 0x667b6a6d
insd dword es:[edi], dx
push 0x7b
movupd xmm0, xmmword [esp + 0x30]
mov byte [esp + 0x133], bl
mov byte [esp + 0x168], bl
psubb xmm0, xmmword [0x420f60]
movups xmmword [esp + 0x158], xmm0
mov dword [esp + 0x14], 0x63667b79
mov dword [esp + 0x18], 0x55396f7e
mov dword [esp + 0x1c], 0x79656669
mov byte [esp + 0x20], 0x6f
mov eax, dword [0x424db4]
test eax, eax
je 0x419bec
push eax
call 0x41e6d0
pop ecx
mov dword [0x424db4], ebx
xor al, al