joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], 0x64004c
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x30]
mov eax, 0x4dc014
mov dword [ebp - 0x2c], 0x4d0073
push edi
mov dword [ebp - 0x28], 0x62006f
mov edx, 0x16
mov dword [ebp - 0x24], 0x6c0069
sub esi, eax
mov dword [ebp - 0x20], 0x4d0065
mov dword [ebp - 0x1c], 0x720067
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x430064
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
nop dword [eax]
lea ecx, [edx + 0x7fffffe8]
test ecx, ecx
je 0x41f68e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41f68e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41f670
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x4dc014
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x41f6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], 0x75004c
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x30]
mov eax, 0x4dbf98
mov dword [ebp - 0x2c], 0x610044
mov dword [ebp - 0x28], 0x680053
mov edx, 0x16
mov dword [ebp - 0x24], 0x460069
sub esi, eax
mov dword [ebp - 0x20], 0x650065
mov dword [ebp - 0x1c], 0x420064
mov dword [ebp - 0x18], 0x630061
mov dword [ebp - 0x14], 0x43006b
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
nop dword [eax]
lea ecx, [edx + 0x7fffffe8]
test ecx, ecx
je 0x41f73e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41f73e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41f720
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dbf98
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x41f760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc09c
mov dword [ebp - 0x30], 0x43005c
lea esi, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x6d006f
mov dword [ebp - 0x28], 0x750070
mov edx, 0x17
mov dword [ebp - 0x24], 0x650074
sub esi, eax
mov dword [ebp - 0x20], 0x5a0072
mov dword [ebp - 0x1c], 0x650053
mov dword [ebp - 0x18], 0x760072
mov dword [ebp - 0x14], 0x630069
mov dword [ebp - 0x10], 0x2e0065
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax]
lea ecx, [edx + 0x7fffffe7]
test ecx, ecx
je 0x41f7ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x41f7ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41f7d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc09c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x420700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x75004c
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x4dc1f0
mov dword [ebp - 0x20], 0x610064
mov dword [ebp - 0x1c], 0x680073
mov edx, 0x10
mov dword [ebp - 0x18], 0x500069
sub esi, eax
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x650074
mov dword [ebp - 0xc], 0x740063
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x42077e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42077e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x420760
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc1f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x4207a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc0cc
mov dword [ebp - 0x2c], 0x610048
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x640072
mov dword [ebp - 0x24], 0x610077
mov edx, 0x15
mov dword [ebp - 0x20], 0x650072
sub esi, eax
mov dword [ebp - 0x1c], 0x720050
mov dword [ebp - 0x18], 0x74006f
mov dword [ebp - 0x14], 0x630065
mov dword [ebp - 0x10], 0x2e0074
mov dword [ebp - 0xc], 0x790073
mov dword [ebp - 8], 0x73
lea ecx, [edx + 0x7fffffe9]
test ecx, ecx
je 0x420824
movzx ecx, word [esi + eax]
test cx, cx
je 0x420824
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x420806
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc0cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x420850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc1ac
mov dword [ebp - 0x20], 0x6f0043
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x70006d
mov dword [ebp - 0x18], 0x740075
mov edx, 0xf
mov dword [ebp - 0x14], 0x720065
sub esi, eax
mov dword [ebp - 0x10], 0x4c005a
mov dword [ebp - 0xc], 0x63006f
mov dword [ebp - 8], 0x6b
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x4208bf
movzx ecx, word [esi + eax]
test cx, cx
je 0x4208bf
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4208a1
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc1ac
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x4208e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x75004c
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x4dc12c
mov dword [ebp - 0x28], 0x610064
mov dword [ebp - 0x24], 0x680073
mov edx, 0x14
mov dword [ebp - 0x20], 0x500069
sub esi, eax
mov dword [ebp - 0x1c], 0x6f0072
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x740063
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 0xc], 0x730079
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x420963
movzx ecx, word [esi + eax]
test cx, cx
je 0x420963
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x420945
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc12c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x420990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc0f8
mov dword [ebp - 0x34], 0x610048
lea esi, [ebp - 0x34]
mov dword [ebp - 0x30], 0x640072
mov dword [ebp - 0x2c], 0x610077
mov edx, 0x19
mov dword [ebp - 0x28], 0x650072
sub esi, eax
mov dword [ebp - 0x24], 0x720050
mov dword [ebp - 0x20], 0x74006f
mov dword [ebp - 0x1c], 0x630065
mov dword [ebp - 0x18], 0x5f0074
mov dword [ebp - 0x14], 0x360078
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x790073
mov dword [ebp - 8], 0x73
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x420a22
movzx ecx, word [esi + eax]
test cx, cx
je 0x420a22
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x420a04
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc0f8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x420a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc180
mov dword [ebp - 0x2c], 0x610048
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x640072
mov dword [ebp - 0x24], 0x610077
mov edx, 0x15
mov dword [ebp - 0x20], 0x650072
sub esi, eax
mov dword [ebp - 0x1c], 0x720050
mov dword [ebp - 0x18], 0x74006f
mov dword [ebp - 0x14], 0x630065
mov dword [ebp - 0x10], str._.f
mov dword [ebp - 0xc], 0x740069
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffe9]
test ecx, ecx
je 0x420ad4
movzx ecx, word [esi + eax]
test cx, cx
je 0x420ad4
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x420ab6
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc180
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x420b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], 0x75004c
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x30]
mov eax, 0x4dc154
mov dword [ebp - 0x2c], 0x610064
mov dword [ebp - 0x28], 0x680073
mov edx, 0x16
mov dword [ebp - 0x24], 0x500069
sub esi, eax
mov dword [ebp - 0x20], 0x6f0072
mov dword [ebp - 0x1c], 0x650074
mov dword [ebp - 0x18], 0x740063
mov dword [ebp - 0x14], 0x340036
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 0xc], 0x730079
nop dword [eax]
lea ecx, [edx + 0x7fffffe8]
test ecx, ecx
je 0x420b8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x420b8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x420b70
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc154
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x420bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc1cc
mov dword [ebp - 0x24], 0x610048
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x640072
mov dword [ebp - 0x1c], 0x610077
mov edx, 0x11
mov dword [ebp - 0x18], 0x650072
sub esi, eax
mov dword [ebp - 0x14], 0x720050
mov dword [ebp - 0x10], 0x74006f
mov dword [ebp - 0xc], 0x630065
mov dword [ebp - 8], 0x74
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x420c2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x420c2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x420c10
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc1cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x421d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x75002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x4dc50c
mov dword [ebp - 0x18], 0x2f0020
mov dword [ebp - 0x14], 0x200073
mov edx, 0xc
mov dword [ebp - 0x10], 0x250022
sub esi, eax
mov dword [ebp - 0xc], 0x220073
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x421d9e
movzx ecx, word [esi + eax]
test cx, cx
je 0x421d9e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x421d80
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc50c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x421dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x6e0075
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x4dc43c
mov dword [ebp - 0x18], 0x6e0069
mov dword [ebp - 0x14], 0x740073
mov edx, 0xc
mov dword [ebp - 0x10], 0x65002e
sub esi, eax
mov dword [ebp - 0xc], 0x650078
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x421e2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x421e2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x421e10
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc43c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x421e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], 0x55005c
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x30]
mov eax, 0x4dc58c
mov dword [ebp - 0x2c], 0x690074
mov dword [ebp - 0x28], 0x73006c
mov edx, 0x16
mov dword [ebp - 0x24], 0x43005c
sub esi, eax
mov dword [ebp - 0x20], 0x660065
mov dword [ebp - 0x1c], 0x650048
mov dword [ebp - 0x18], 0x70006c
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x64002e
mov dword [ebp - 0xc], 0x6c006c
nop dword [eax]
lea ecx, [edx + 0x7fffffe8]
test ecx, ecx
je 0x421ede
movzx ecx, word [esi + eax]
test cx, cx
je 0x421ede
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x421ec0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc58c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x4220d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc47c
mov dword [ebp - 0x34], 0x4c0043
lea esi, [ebp - 0x34]
mov dword [ebp - 0x30], 0x490053
mov dword [ebp - 0x2c], 0x5c0044
mov edx, 0x19
mov dword [ebp - 0x28], 0x730025
sub esi, eax
mov dword [ebp - 0x24], 0x49005c
mov dword [ebp - 0x20], 0x70006e
mov dword [ebp - 0x1c], 0x6f0072
mov dword [ebp - 0x18], 0x530063
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x650076
mov dword [ebp - 0xc], 0x330072
mov dword [ebp - 8], 0x32
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x422162
movzx ecx, word [esi + eax]
test cx, cx
je 0x422162
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x422144
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc47c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x422190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x6f0043
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x4dc4b0
mov dword [ebp - 0x28], 0x70006d
mov dword [ebp - 0x24], 0x740075
mov edx, 0x14
mov dword [ebp - 0x20], 0x720065
sub esi, eax
mov dword [ebp - 0x1c], 0x37005a
mov dword [ebp - 0x18], 0x78005f
mov dword [ebp - 0x14], 0x340036
mov dword [ebp - 0x10], 0x64002e
mov dword [ebp - 0xc], 0x6c006c
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x422213
movzx ecx, word [esi + eax]
test cx, cx
je 0x422213
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4221f5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc4b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x422240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc3b0
mov dword [ebp - 0x28], 0x6f0043
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x70006d
mov dword [ebp - 0x20], 0x740075
mov edx, 0x13
mov dword [ebp - 0x1c], 0x720065
sub esi, eax
mov dword [ebp - 0x18], 0x54005a
mov dword [ebp - 0x14], 0x610072
mov dword [ebp - 0x10], 0x2e0079
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x4222be
movzx ecx, word [esi + eax]
test cx, cx
je 0x4222be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4222a0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc3b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x422350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc5b8
mov dword [ebp - 0x20], 0x2e0033
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x340033
mov dword [ebp - 0x18], 0x370039
mov edx, 0xf
mov dword [ebp - 0x14], 0x31002e
sub esi, eax
mov dword [ebp - 0x10], 0x340038
mov dword [ebp - 0xc], 0x2e0031
mov dword [ebp - 8], 0x30
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x4223bf
movzx ecx, word [esi + eax]
test cx, cx
je 0x4223bf
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4223a1
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc5b8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x4223e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x6f0043
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x4dc4d8
mov dword [ebp - 0x20], 0x70006d
mov dword [ebp - 0x1c], 0x740075
mov edx, 0x10
mov dword [ebp - 0x18], 0x720065
sub esi, eax
mov dword [ebp - 0x14], 0x37005a
mov dword [ebp - 0x10], 0x64002e
mov dword [ebp - 0xc], 0x6c006c
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x42245e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42245e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x422440
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc4d8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x422480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc28c
mov dword [ebp - 0x24], 0x610048
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x640072
mov dword [ebp - 0x1c], 0x610077
mov edx, 0x11
mov dword [ebp - 0x18], 0x650072
sub esi, eax
mov dword [ebp - 0x14], 0x720050
mov dword [ebp - 0x10], 0x74006f
mov dword [ebp - 0xc], 0x630065
mov dword [ebp - 8], 0x74
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x4224fe
movzx ecx, word [esi + eax]
test cx, cx
je 0x4224fe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4224e0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc28c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x422520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x680054
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x4dc320
mov dword [ebp - 0x34], 0x6d0065
push edi
mov dword [ebp - 0x30], 0x730065
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x55005c
sub esi, eax
mov dword [ebp - 0x28], 0x5c0049
mov dword [ebp - 0x24], 0x630069
mov dword [ebp - 0x20], 0x6e006f
mov dword [ebp - 0x1c], 0x62005c
mov dword [ebp - 0x18], 0x61006c
mov dword [ebp - 0x14], 0x6b0063
mov dword [ebp - 0x10], 0x69002e
mov dword [ebp - 0xc], 0x6f0063
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x4225be
movzx ecx, word [esi + eax]
test cx, cx
je 0x4225be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4225a0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x4dc320
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x4225e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc240
mov dword [ebp - 0x2c], 0x610048
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x640072
mov dword [ebp - 0x24], 0x610077
mov edx, 0x15
mov dword [ebp - 0x20], 0x650072
sub esi, eax
mov dword [ebp - 0x1c], 0x720050
mov dword [ebp - 0x18], 0x74006f
mov dword [ebp - 0x14], 0x630065
mov dword [ebp - 0x10], str._.f
mov dword [ebp - 0xc], 0x740069
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffe9]
test ecx, ecx
je 0x422664
movzx ecx, word [esi + eax]
test cx, cx
je 0x422664
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x422646
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc240
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x422690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x650072
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x4dc524
mov dword [ebp - 0x1c], 0x730067
mov dword [ebp - 0x18], 0x720076
mov edx, 0xe
mov dword [ebp - 0x14], 0x320033
sub esi, eax
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x4226fe
movzx ecx, word [esi + eax]
test cx, cx
je 0x4226fe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4226e0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc524
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x422720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc26c
mov dword [ebp - 0x20], 0x6f0043
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x70006d
mov dword [ebp - 0x18], 0x740075
mov edx, 0xf
mov dword [ebp - 0x14], 0x720065
sub esi, eax
mov dword [ebp - 0x10], 0x4c005a
mov dword [ebp - 0xc], 0x63006f
mov dword [ebp - 8], 0x6b
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x42278f
movzx ecx, word [esi + eax]
test cx, cx
je 0x42278f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x422771
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc26c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x4227b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x75004c
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x4dc2b0
mov dword [ebp - 0x20], 0x610064
mov dword [ebp - 0x1c], 0x680073
mov edx, 0x10
mov dword [ebp - 0x18], 0x500069
sub esi, eax
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x650074
mov dword [ebp - 0xc], 0x740063
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x42282e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42282e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x422810
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc2b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x422960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc2f8
mov dword [ebp - 0x28], 0x6f0043
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x70006d
mov dword [ebp - 0x20], 0x740075
mov edx, 0x13
mov dword [ebp - 0x1c], 0x720065
sub esi, eax
mov dword [ebp - 0x18], 0x54005a
mov dword [ebp - 0x14], 0x610072
mov dword [ebp - 0x10], 0x2e0079
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x4229de
movzx ecx, word [esi + eax]
test cx, cx
je 0x4229de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4229c0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc2f8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret