joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410978
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xb4], 0x3b233809
mov dword [esp + 0xb8], 0x9243334
mov dword [esp + 0xbc], 0x24353833
mov dword [esp + 0xc0], 0x3322262f

Function at 0x410980
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
cmp byte [ebx], ah
cmp eax, edi
test byte [eax + edi*4], ah
add byte [eax], al
add byte [ebx + esi], dh
and al, 9

Function at 0x410995
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xb4], 0x3b233809
mov dword [esp + 0xb8], 0x9243334
mov dword [esp + 0xbc], 0x24353833
mov dword [esp + 0xc0], 0x3322262f

Function at 0x410997
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xb4], 0x3b233809
mov dword [esp + 0xb8], 0x9243334
mov dword [esp + 0xbc], 0x24353833
mov dword [esp + 0xc0], 0x3322262f

Function at 0x4109a9
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x2484c724
rol byte [eax], 0
add byte [edi], ch
and dh, byte es:[ebx]
mov dword [esp + 0xc4], 0x4107632
mov dword [esp + 0xc8], 0x35761b19
test byte [eax + ecx*8], ah
add byte [eax], al
add byte [ecx], bl
sbb esi, dword [esi + 0x35]
mov dword [esp + 0xcc], 0x3f323324
mov dword [esp + 0xd0], 0x37350922
mov word [esp + 0xd4], 0x3224
add byte [eax], al
add byte [edx + esi], ah
mov byte [esp + 0xd6], 0x25
mov al, byte [esp + ecx + 0x78]
xor al, 0x56
mov byte [esp + ecx + 0x1f8], al
inc ecx

Function at 0x4109b0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
test byte [eax + ecx*8], ah
add byte [eax], al
add byte [ecx], bl
sbb esi, dword [esi + 0x35]

Function at 0x4109bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x2484c724
rol byte [eax], 0
add byte [edi], ch
and dh, byte es:[ebx]
mov dword [esp + 0xc4], 0x4107632
mov dword [esp + 0xc8], 0x35761b19
test byte [eax + ecx*8], ah
add byte [eax], al
add byte [ecx], bl
sbb esi, dword [esi + 0x35]
mov dword [esp + 0xcc], 0x3f323324
mov dword [esp + 0xd0], 0x37350922
mov word [esp + 0xd4], 0x3224
add byte [eax], al
add byte [edx + esi], ah
mov byte [esp + 0xd6], 0x25
mov al, byte [esp + ecx + 0x78]
xor al, 0x56
mov byte [esp + ecx + 0x1f8], al
inc ecx

Function at 0x4109cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x2484c724
rol byte [eax], 0
add byte [edi], ch
and dh, byte es:[ebx]
mov dword [esp + 0xc4], 0x4107632
mov dword [esp + 0xc8], 0x35761b19
test byte [eax + ecx*8], ah
add byte [eax], al
add byte [ecx], bl
sbb esi, dword [esi + 0x35]
mov dword [esp + 0xcc], 0x3f323324
mov dword [esp + 0xd0], 0x37350922
mov word [esp + 0xd4], 0x3224
add byte [eax], al
add byte [edx + esi], ah
mov byte [esp + 0xd6], 0x25
mov al, byte [esp + ecx + 0x78]
xor al, 0x56
mov byte [esp + ecx + 0x1f8], al
inc ecx
Function at 0x4109df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x2484c724
rol byte [eax], 0
add byte [edi], ch
and dh, byte es:[ebx]
mov dword [esp + 0xc4], 0x4107632
mov dword [esp + 0xc8], 0x35761b19
test byte [eax + ecx*8], ah
add byte [eax], al
add byte [ecx], bl
sbb esi, dword [esi + 0x35]
mov dword [esp + 0xcc], 0x3f323324
mov dword [esp + 0xd0], 0x37350922
mov word [esp + 0xd4], 0x3224
add byte [eax], al
add byte [edx + esi], ah
mov byte [esp + 0xd6], 0x25
mov al, byte [esp + ecx + 0x78]
xor al, 0x56
mov byte [esp + ecx + 0x1f8], al
inc ecx

Function at 0x410d55
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov ecx, ebx
mov al, byte [esp + ecx + 0x68]
sub al, 0x1c
mov byte [esp + ecx + 0x130], al
inc ecx
cmp ecx, 8
jl 0x410aff
mov byte [esp + 0x138], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x70]
xor al, 0x16
mov byte [esp + ecx + 0x13c], al
inc ecx
cmp ecx, 8
jl 0x410b1b
mov byte [esp + 0x144], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x44]
xor al, 0xa7
mov byte [esp + ecx + 0x148], al
inc ecx
cmp ecx, 9
jl 0x410b37
mov byte [esp + 0x151], bl
mov ecx, ebx
mov word [esp + 0x58], 0x2f
mov dword [esp + 0x18], 0xf5f5c2c5
cmc
mov dword [esp + 0x1c], 0xf5f5f5f5
mov dword [esp + 0x20], 0xf5f5f5f5
mov dword [esp + 0x24], 0xf5f5f5f5
mov word [esp + 0x28], 0xc5f5
mov byte [esp + 0x2a], 0xc2
mov al, byte [esp + ecx + 0x18]
xor al, 0xc8
mov byte [esp + ecx + 0x170], al
inc ecx
cmp ecx, 0x13
jl 0x410b86
lea eax, [esp + 0x130]
mov byte [esp + 0x183], bl
push eax
call fcn.00415ae8
cmp ecx, dword [edi]
add byte [ecx + 0x50], bl
lea edx, [esp + 0x134]
lea ecx, [esp + 0x3c]
call 0x42b836
pop ecx
push 2
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call 0x42b9b4
pop ecx
lea eax, [esp + 0x13c]
push eax
call fcn.00415b2b
pop ecx
push eax
lea edx, [esp + 0x140]
lea ecx, [esp + 0x3c]
call fcn.0041b87c
pop ecx
push 3
add edi, edi
je 0x410c2c
sbb bh, bh
push esi
adc al, 0x8b
clc
pop ecx
pop ecx
test edi, edi
lea eax, [esp + 0x170]
push eax
call fcn.00415c7c
pop ecx
push eax
lea edx, [esp + 0x174]
lea ecx, [esp + 0x3c]
call 0x42b9ca
pop ecx
push dword [esp + 0x14]
je 0x410d7b
adc al, 0xff
push esi
or al, 0x59
cmp eax, 0x64
je 0x410afd
invalid
cwde
std
invalid
invalid
cmp dword [esp + 0x38], ebx
je 0x410eee
mov dword [esp + 0x18], 0x37362110
mov ecx, ebx
mov dword [esp + 0x1c], 0x3210273a
mov dword [esp + 0x20], 0x7c203721
mov dword [esp + 0x24], 0xc203f76
mov dword [esp + 0x28], 0x7d203f76
jge 0x410e00
mov dword [esp + 0x2c], 0x44c62b27
and al, 0x2e
daa
mov al, byte [esp + ecx + 0x18]
xor al, 0x53
movzx eax, al
Function at 0x410d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, ebx
mov al, byte [esp + ecx + 0x68]
sub al, 0x1c
mov byte [esp + ecx + 0x130], al
inc ecx
cmp ecx, 8
jl 0x410aff
mov byte [esp + 0x138], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x70]
xor al, 0x16
mov byte [esp + ecx + 0x13c], al
inc ecx
cmp ecx, 8
jl 0x410b1b
mov byte [esp + 0x144], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x44]
xor al, 0xa7
mov byte [esp + ecx + 0x148], al
inc ecx
cmp ecx, 9
jl 0x410b37
mov byte [esp + 0x151], bl
mov ecx, ebx
mov word [esp + 0x58], 0x2f
mov dword [esp + 0x18], 0xf5f5c2c5
cmc
mov dword [esp + 0x1c], 0xf5f5f5f5
mov dword [esp + 0x20], 0xf5f5f5f5
mov dword [esp + 0x24], 0xf5f5f5f5
mov word [esp + 0x28], 0xc5f5
mov byte [esp + 0x2a], 0xc2
mov al, byte [esp + ecx + 0x18]
xor al, 0xc8
mov byte [esp + ecx + 0x170], al
inc ecx
cmp ecx, 0x13
jl 0x410b86
lea eax, [esp + 0x130]
mov byte [esp + 0x183], bl
push eax
call fcn.00415ae8
cmp ecx, dword [edi]
add byte [ecx + 0x50], bl
lea edx, [esp + 0x134]
lea ecx, [esp + 0x3c]
call 0x42b836
pop ecx
push 2
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call 0x42b9b4
pop ecx
lea eax, [esp + 0x13c]
push eax
call fcn.00415b2b
pop ecx
push eax
lea edx, [esp + 0x140]
lea ecx, [esp + 0x3c]
call fcn.0041b87c
pop ecx
push 3
add edi, edi
je 0x410c2c
sbb bh, bh
push esi
adc al, 0x8b
clc
pop ecx
pop ecx
test edi, edi
lea eax, [esp + 0x170]
push eax
call fcn.00415c7c
pop ecx
push eax
lea edx, [esp + 0x174]
lea ecx, [esp + 0x3c]
call 0x42b9ca
pop ecx
push dword [esp + 0x14]
je 0x410d7b
adc al, 0xff
push esi
or al, 0x59
cmp eax, 0x64
je 0x410afd
invalid
cwde
std
invalid
invalid
cmp dword [esp + 0x38], ebx
je 0x410eee
mov dword [esp + 0x18], 0x37362110
mov ecx, ebx
mov dword [esp + 0x1c], 0x3210273a
mov dword [esp + 0x20], 0x7c203721
mov dword [esp + 0x24], 0xc203f76
mov dword [esp + 0x28], 0x7d203f76
jge 0x410e00
mov dword [esp + 0x2c], 0x44c62b27
and al, 0x2e
daa
mov al, byte [esp + ecx + 0x18]
xor al, 0x53
movzx eax, al

Function at 0x410dae
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + ecx*2 + 0xe4], ax
inc ecx
cmp ecx, 0x17
jl 0x410da5
Function at 0x411057
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov ecx, ebx
mov al, byte [esp + ecx + 0x5c]
sub al, 0xb
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, 6
jl 0x410f59
mov byte [esp + 0x11e], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x44]
xor al, 0x56
mov byte [esp + ecx + 0x154], al
or al, 0x54
add dword [eax], eax
add byte [ecx - 0x7d], al
stc
invalid
jl 0x410f75
mov byte [esp + 0x15d], bl
mov ecx, ebx
mov dword [esp + 0x18], 0x7f7f484f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
and byte [edi + 0x7f], bh
jg 0x411028
mov dword [esp + 0x24], 0x7f7f7f7f
mov word [esp + 0x28], 0x4f7f
mov byte [esp + 0x2a], 0x48
mov al, byte [esp + ecx + 0x18]
xor al, 0x42
mov byte [esp + ecx + 0x184], al
inc ecx
cmp ecx, 0x13
invalid
jl 0x410fbd
lea eax, [esp + 0x118]
mov byte [esp + 0x197], bl
push eax
call fcn.00415f1f
pop ecx
push eax
lea edx, [esp + 0x11c]
lea ecx, [esp + 0x3c]
call 0x42bc6d
pop ecx
push ebx
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call 0x42bde9
pop ecx
lea eax, [esp + 0x154]
push eax
call fcn.00415f60
pop ecx
push eax
lea edx, [esp + 0x158]
lea ecx, [esp + 0x3c]
call 0x42bcae
pop ecx
push 1
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call 0x42be2c
lodsd eax, dword [esi]
add dword [eax], eax
lodsd eax, dword [esi]
add dword [eax], eax
pop ecx
lea eax, [esp + 0x184]
push eax
call fcn.00415fa3
pop ecx
push eax
lea edx, [esp + 0x188]
lea ecx, [esp + 0x3c]
call 0x42bcf1
pop ecx
push dword [esp + 0x14]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x410f57
cmp dword [esp + 0x38], ebx
je 0x411128
mov dword [esp + 0x18], 0x5a414074
mov dword [esp + 0x1c], 0x59595c53
mov dword [esp + 0x20], 0x59101a46
mov dword [esp + 0x24], 0x59106a46
mov dword [esp + 0x28], 0x4d411b46
mov byte [esp + 0x2c], 0x41
mov al, byte [esp + ebx + 0x18]
xor al, 0x35
movzx eax, al
mov word [esp + ebx*2 + 0xe4], ax
add byte [eax], al
inc ebx
cmp ebx, 0x15
jl 0x4110c3
push dword [esp + 0x260]
xor eax, eax
push dword [esp + 0x118]
mov word [esp + 0x116], ax
add byte [ebp + 0xec2484], cl
add byte [eax], al
push eax
call 0x42bc33
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41111e
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
push edi
call 0x4290f6
pop ecx
push edi
call fcn.00415c08
pop ecx
push dword [esp + 0x38]
call fcn.00415c12
pop ecx
push dword [esp + 0x14]
call dword [esi + 0x18]
mov edi, dword [esp + 0x124]
pop ecx
push dword [esp + 0xdc]
add bh, bh
push esi
sbb al, 0x59
push dword [esp + 0x124]
call fcn.00415c39
pop ecx
xor ecx, ecx
invalid
Function at 0x4111bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x18]
xor al, 0x3e
movzx eax, al
mov word [esp + ecx*2 + 0x198], ax
inc ecx
cmp ecx, 0xf
jl 0x4111b8
xor eax, eax
mov dword [esp + 0x28], 0xf6faface
push 0x75
mov word [esp + 0x1ba], ax
xor ecx, ecx
mov word [esp + 0x30], 0xf0f4
mov ebx, 0xff
mov byte [esp + 0x32], 0xfe
pop edx
movzx eax, byte [esp + ecx + 0x28]
add ax, dx
and ax, bx
mov word [esp + ecx*2 + 0x158], ax
inc ecx
cmp ecx, 7
jl 0x4111f7
xor eax, eax
mov word [esp + 0x166], ax
call 0x42a20f
mov ebx, eax
test ebx, ebx
je 0x4119f2
lea eax, [esp + 0x198]
mov dword [esp + 0x88], 0xb49b84cd
mov dword [esp + 0x140], eax
xor edi, edi
lea eax, [esp + 0x158]
mov dword [esp + 0x100], edi
mov dword [esp + 0x144], eax
mov word [esp + 0x8c], 0x84cd
mov byte [esp + 0x8e], 0x9b

Function at 0x4112a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
les ecx, [ecx + ecx*4]
mov ah, 0x24
cmp byte [ecx], al
add byte [eax], al

Function at 0x411343
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, 0xf
mov byte [esp + ecx + 0x178], al

Function at 0x41134c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
cmp ecx, 0x1d
jl 0x41133f
push 0x58
pop eax
push 0x75
mov byte [esp + 0x99], al
cdq
add byte [eax], al
add byte [ebx], dh
leave

Function at 0x41135a
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
inc ecx
cmp ecx, 0x1d
jl 0x41133f
push 0x58
pop eax
push 0x75
mov byte [esp + 0x99], al
cdq
add byte [eax], al
add byte [ebx], dh
leave

Function at 0x41135b
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
inc ecx
cmp ecx, 0x1d
jl 0x41133f
push 0x58
pop eax
push 0x75
mov byte [esp + 0x99], al
cdq
add byte [eax], al
add byte [ebx], dh
leave
Function at 0x411399
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x9f], 0x7f652c20
mov dword [esp + 0xa3], 0x78786453
mov dword [esp + 0xa7], 0x6062637c
mov byte [esp + 0xab], al
mov dword [esp + 0xac], 0x6d7c2c20
add byte [eax], al
add byte [eax], ah
sub al, 0x7c
insd dword es:[edi], dx
mov dword [esp + 0xb0], 0x2c206478
mov dword [esp + 0xb4], 0x7f537f65
mov dword [esp + 0xb8], 0x7e796f69
mov dword [esp + 0xbc], 0x692c2069
mov dword [esp + 0xc0], 0x7e657c74
mov dword [esp + 0xc4], 0x79537f69
mov dword [esp + 0xc8], 0x2c206f78
mov dword [esp + 0xcc], 0x69616d62
mov dword [esp + 0xd0], 0x62692c20
mov word [esp + 0xd4], 0x7e6f
mov byte [esp + 0xd6], al
mov dword [esp + 0xd7], 0x6869787c
mov dword [esp + 0xdb], 0x606d7a53
mov dword [esp + 0xdf], 0x4a2c6979
mov dword [esp + 0xe3], 0x2c41435e
add byte [esi + 0x43], bl
inc ecx
sub al, 0xc7
test byte [edi], ah
add byte [eax], al
add byte [edi + 0x63], ch
arpl word [edi + 0x66], sp
mov dword [esp + 0xeb], 0x84c66965
and al, 0xed
add byte [eax], al
invalid
invalid
mov al, byte [esp + ecx + 0x90]
xor al, 0xc
mov byte [esp + ecx + 0x1e0], al
inc ecx
cmp ecx, 0x5e
jl 0x411489
lea eax, [esp + 0x178]
mov byte [esp + 0x23e], 0
push esi
push eax
call 0x422ea4
push 0
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1f4]
push eax
push dword [esp + 0x110]
call dword [ebx + 8]
push ebx
or byte [ebx - 0x3f7ae33c], al
jne 0x411994
push dword [esp + 0x14]
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4117f1
mov dword [esp + 0x68], 0x1116104d
mov word [esp + 0x6c], 0x4d01
mov dword [esp + 0x70], 0x9d9097d8
mov word [esp + 0x74], 0x9482
Function at 0x411467
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x9f], 0x7f652c20
mov dword [esp + 0xa3], 0x78786453
mov dword [esp + 0xa7], 0x6062637c
mov byte [esp + 0xab], al
mov dword [esp + 0xac], 0x6d7c2c20
add byte [eax], al
add byte [eax], ah
sub al, 0x7c
insd dword es:[edi], dx
mov dword [esp + 0xb0], 0x2c206478
mov dword [esp + 0xb4], 0x7f537f65
mov dword [esp + 0xb8], 0x7e796f69
mov dword [esp + 0xbc], 0x692c2069
mov dword [esp + 0xc0], 0x7e657c74
mov dword [esp + 0xc4], 0x79537f69
mov dword [esp + 0xc8], 0x2c206f78
mov dword [esp + 0xcc], 0x69616d62
mov dword [esp + 0xd0], 0x62692c20
mov word [esp + 0xd4], 0x7e6f
mov byte [esp + 0xd6], al
mov dword [esp + 0xd7], 0x6869787c
mov dword [esp + 0xdb], 0x606d7a53
mov dword [esp + 0xdf], 0x4a2c6979
mov dword [esp + 0xe3], 0x2c41435e
add byte [esi + 0x43], bl
inc ecx
sub al, 0xc7
test byte [edi], ah
add byte [eax], al
add byte [edi + 0x63], ch
arpl word [edi + 0x66], sp
mov dword [esp + 0xeb], 0x84c66965
and al, 0xed
add byte [eax], al
invalid
invalid
mov al, byte [esp + ecx + 0x90]
xor al, 0xc
mov byte [esp + ecx + 0x1e0], al
inc ecx
cmp ecx, 0x5e
jl 0x411489
lea eax, [esp + 0x178]
mov byte [esp + 0x23e], 0
push esi
push eax
call 0x422ea4
push 0
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1f4]
push eax
push dword [esp + 0x110]
call dword [ebx + 8]
push ebx
or byte [ebx - 0x3f7ae33c], al
jne 0x411994
push dword [esp + 0x14]
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4117f1
mov dword [esp + 0x68], 0x1116104d
mov word [esp + 0x6c], 0x4d01
mov dword [esp + 0x70], 0x9d9097d8
mov word [esp + 0x74], 0x9482
Function at 0x41173b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax], 0x30
je 0x411745
cmp byte [eax], 0x31
jne 0x411776
lea eax, [esp + 0x114]
mov ecx, esi
push eax
call 0x4203cb
mov esi, eax
pop ecx
test esi, esi
je 0x4117c6
push dword [esp + 0x114]
mov edx, esi
lea ecx, [esp + 0x1c]
call 0x42c3e4
pop ecx
push esi
call fcn.0041625f
jmp 0x4117c5

Function at 0x411755
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax], 0x30
je 0x411745
cmp byte [eax], 0x31
jne 0x411776
lea eax, [esp + 0x114]
mov ecx, esi
push eax
call 0x4203cb
mov esi, eax
pop ecx
test esi, esi
je 0x4117c6
push dword [esp + 0x114]
mov edx, esi
lea ecx, [esp + 0x1c]
call 0x42c3e4
pop ecx
push esi
call fcn.0041625f
jmp 0x4117c5

Function at 0x4117b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x50
add dword [eax], eax
add byte [ebx + 0x1582494], cl
add byte [eax], al

Function at 0x41180d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, 0xffbad71b
add byte [eax], al
add bh, al
inc esp
and al, 0x44
int 0x14
sbb eax, dword [edi]

Function at 0x41182c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x4e], 0x1c
pop esi
movzx eax, byte [esp + ecx + 0x38]
add ax, si
and ax, dx
mov word [esp + ecx*2 + 0x1b8], ax
inc ecx
cmp ecx, 0x13
jl 0x411832
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x118]
xor eax, eax
mov word [esp + 0x1de], ax
call 0x422d53
mov esi, eax
test esi, esi
je 0x411949
mov edx, dword [esp + 0x118]
lea eax, [esp + 0x11c]
push eax
mov ecx, esi
call 0x4204ff
add byte [ebx - 0x7aa608], cl
je 0x411942
mov dword [esp + 0x80], 0x6b511013
xor ecx, ecx
mov word [esp + 0x84], 0x407f
mov byte [esp + 0x86], 0x26
mov al, byte [esp + ecx + 0x80]
sub al, 6
push esi
call fcn.00416433
pop ecx
push dword [esp + 0x244]
lea eax, [esp + 0x1bc]
add bh, bh
mov ah, 0x24
inc eax
add dword [eax], eax
add byte [eax - 0x18], dl
xor al, 0xab
add dword [eax], eax
mov esi, eax
add esp, 0xc
test esi, esi
je 0x411983
mov edx, dword [esp + 0x20]
push dword [esp + 0x18]
call fcn.00416477
pop ecx

Function at 0x41195a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
add dword [eax], eax
add byte [eax - 0x18], dl
xor al, 0xab
add dword [eax], eax

Function at 0x411975
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push esi
call 0x42995b
pop ecx
push esi
call fcn.0041646d
pop ecx
Function at 0x411a4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x10]
xor al, 9
movzx eax, al
mov word [esp + ecx*2 + 0x134], ax
inc ecx
cmp ecx, 0xe
jl 0x411a44
xor eax, eax
mov word [esp + 0x150], ax
lea eax, [esp + 0x134]
push ebx
push eax
call 0x42c5a7
mov ebx, eax
mov dword [esp + 0xcc], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x4120e5
mov ecx, ebx
call 0x42c61b
mov ebp, eax
test ebp, ebp
je 0x4120de
xor edx, edx
mov ecx, ebp
call 0x42c89a
mov edi, eax
mov dword [esp + 0xc8], edi
test edi, edi
je 0x4120c7
push 0
push 1
lea eax, [esp + 0xd4]
push eax
push edi
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x4120b5
mov dword [esp + 0x34], 0xccd6d1ae
mov dword [esp + 0x38], 0xdad0cb88
inc esp
and al, 0x38
mov bl, cl
rcr dl, 1
mov dword [esp + 0x3c], 0xddd1d5d7
mov dword [esp + 0x40], 0xd7d488d5
mov dword [esp + 0x44], 0x88d6d1cf
mov dword [esp + 0x48], 0xc9dcc9cc
mov dword [esp + 0x4c], 0x88cacc88

Function at 0x411a54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x10]
xor al, 9
movzx eax, al
mov word [esp + ecx*2 + 0x134], ax
inc ecx
cmp ecx, 0xe
jl 0x411a44
xor eax, eax
mov word [esp + 0x150], ax
lea eax, [esp + 0x134]
push ebx
push eax
call 0x42c5a7
mov ebx, eax
mov dword [esp + 0xcc], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x4120e5
mov ecx, ebx
call 0x42c61b
mov ebp, eax
test ebp, ebp
je 0x4120de
xor edx, edx
mov ecx, ebp
call 0x42c89a
mov edi, eax
mov dword [esp + 0xc8], edi
test edi, edi
je 0x4120c7
push 0
push 1
lea eax, [esp + 0xd4]
push eax
push edi
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x4120b5
mov dword [esp + 0x34], 0xccd6d1ae
mov dword [esp + 0x38], 0xdad0cb88
inc esp
and al, 0x38
mov bl, cl
rcr dl, 1
mov dword [esp + 0x3c], 0xddd1d5d7
mov dword [esp + 0x40], 0xd7d488d5
mov dword [esp + 0x44], 0x88d6d1cf
mov dword [esp + 0x48], 0xc9dcc9cc
mov dword [esp + 0x4c], 0x88cacc88

Function at 0x411ad5
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + ecx + 0x10]
xor al, 9
movzx eax, al
mov word [esp + ecx*2 + 0x134], ax
inc ecx
cmp ecx, 0xe
jl 0x411a44
xor eax, eax
mov word [esp + 0x150], ax
lea eax, [esp + 0x134]
push ebx
push eax
call 0x42c5a7
mov ebx, eax
mov dword [esp + 0xcc], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x4120e5
mov ecx, ebx
call 0x42c61b
mov ebp, eax
test ebp, ebp
je 0x4120de
xor edx, edx
mov ecx, ebp
call 0x42c89a
mov edi, eax
mov dword [esp + 0xc8], edi
test edi, edi
je 0x4120c7
push 0
push 1
lea eax, [esp + 0xd4]
push eax
push edi
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x4120b5
mov dword [esp + 0x34], 0xccd6d1ae
mov dword [esp + 0x38], 0xdad0cb88
inc esp
and al, 0x38
mov bl, cl
rcr dl, 1
mov dword [esp + 0x3c], 0xddd1d5d7
mov dword [esp + 0x40], 0xd7d488d5
mov dword [esp + 0x44], 0x88d6d1cf
mov dword [esp + 0x48], 0xc9dcc9cc
mov dword [esp + 0x4c], 0x88cacc88