joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4330c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 8], ebx
jb 0x4330df
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x433101
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4330f0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebp - 0x10], eax
cmp edx, ebx
jne 0x43312b
mov eax, ebx
jmp 0x43312f
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4331d4
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov edx, edi
jb 0x433144
mov edx, dword [edi]
cmp dword [eax + 0x14], 0x10
mov edi, dword [eax + 0x10]
jb 0x43314f
mov eax, dword [eax]
cmp edi, dword [ebp - 8]
jne 0x4331b0
sub edi, 4
jb 0x433171
nop dword [eax]
mov ecx, dword [eax]
cmp ecx, dword [edx]
jne 0x433176
add eax, 4
add edx, 4
sub edi, 4
jae 0x433160
cmp edi, 0xfffffffc
je 0x4331aa
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4331a3
cmp edi, 0xfffffffd
je 0x4331aa
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4331a3
cmp edi, 0xfffffffe
je 0x4331aa
mov cl, byte [eax + 2]
cmp cl, byte [edx + 2]
jne 0x4331a3
cmp edi, 0xffffffff
je 0x4331aa
mov al, byte [eax + 3]
cmp al, byte [edx + 3]
je 0x4331aa
sbb eax, eax
or eax, 1
jmp 0x4331ac
xor eax, eax
test eax, eax
je 0x4331c0
mov esi, dword [esi]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x433123
mov ecx, dword [ebp - 4]
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.00409670
test al, al
cmove ebx, esi
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x434240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x434314
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x434303
jg 0x434278
test edx, edx
je 0x434303
call fcn.0040dfe0
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x4342c8
jg 0x43428e
test esi, esi
je 0x4342c8
cmp ebx, eax
jg 0x43429d
jl 0x434298
cmp edi, esi
jae 0x43429d
mov esi, edi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [ebp + 8]
call fcn.00552be0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x4342ea
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4342fd
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x434278
jl 0x4342fd
test edi, edi
jne 0x434278
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x434333
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x434335
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x4343dd
jg 0x43434f
test esi, esi
je 0x4343dd
test eax, eax
jl 0x43438e
jg 0x434359
test ebx, ebx
je 0x43438e
cmp edi, eax
jg 0x434368
jl 0x434363
cmp esi, ebx
jae 0x434368
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00552be0
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], ebx
sub esi, ebx
sbb edi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x434394
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x4343dd
jg 0x43439e
test esi, esi
je 0x4343dd
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x4343dd
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x4343c9
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [ebp + 8]
call fcn.0056603f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434710
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xffffffc0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
push esi
push edi
push 0x5999b8
push eax
mov dword [ebp - 0x2c8], ecx
call fcn.005654b5
mov esi, eax
add esp, 8
mov dword [ebp - 0x2cc], esi
test esi, esi
jne 0x434773
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x100000
call fcn.0051289b
mov edi, eax
mov dword [ebp - 0x2c4], eax
add esp, 4
test edi, edi
je 0x43479e
push 0x100000
push 0
push edi
call fcn.005536e0
add esp, 0xc
jmp 0x4347a6
xor edi, edi
mov dword [ebp - 0x2c4], edi
push 0xc0
push 0x5990c0
push 0
lea eax, [ebp - 0x2c0]
push 0
push eax
call fcn.004348c0
push esi
push 0x100000
push 1
push edi
call fcn.0056603f
add esp, 0x24
test eax, eax
je 0x4347f8
push eax
lea eax, [ebp - 0x2c0]
push edi
push eax
call fcn.00435b80
push esi
push 0x100000
push 1
push edi
call fcn.0056603f
add esp, 0x1c
test eax, eax
jne 0x4347d5
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004357b0
add esp, 8
lea edi, [ebp - 0x40]
movups xmm1, xmmword [eax]
mov word [ebp - 0x20], 0
movaps xmmword [ebp - 0x50], xmm1
movaps xmm0, xmm1
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
psrldq xmm0, 8
movd esi, xmm0
xorps xmm0, xmm0
psrldq xmm1, 0xc
movd ecx, xmm1
bswap esi
bswap edx
bswap ecx
bswap eax
mov dword [ebp - 0x4c], esi
xor esi, esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
movaps xmmword [ebp - 0x40], xmm0
movaps xmmword [ebp - 0x30], xmm0
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0x50]
push eax
push 0x5999c0
push edi
call fcn.004372c0
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jb 0x434860
lea eax, [ebp - 0x40]
push eax
push dword [ebx + 0x10]
push dword [ebp - 0x2c8]
call fcn.00565224
mov edi, dword [ebp - 0x2c4]
push edi
call fcn.005128a4
push dword [ebp - 0x2cc]
call fcn.0056578e
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.00512634
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x434980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
sub esi, edx
mov edi, 4
sub edx, eax
nop word [eax + eax]
lea ecx, [edx + eax]
lea eax, [eax + 0x10]
movups xmm2, xmmword [ecx + esi]
movups xmm0, xmmword [ecx]
pxor xmm0, xmm2
pshufd xmm1, xmm0, 0x31
pmuludq xmm1, xmm0
pshufd xmm0, xmm2, 0x4e
paddq xmm0, xmmword [eax - 0x10]
paddq xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
sub edi, 1
jne 0x4349a0
pop edi
pop esi
pop ebp
ret
Function at 0x435700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, 4
mov eax, dword [ebp + 8]
sub ecx, eax
movaps xmm2, xmmword [0x599d90]
nop word [eax + eax]
movups xmm1, xmmword [eax]
lea eax, [eax + 0x10]
psrlq xmm1, 0x2f
movups xmm0, xmmword [ecx + eax - 0x10]
pxor xmm1, xmmword [eax - 0x10]
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x31
pmuludq xmm0, xmm2
pmuludq xmm1, xmm2
psllq xmm0, 0x20
paddq xmm0, xmm1
movups xmmword [eax - 0x10], xmm0
sub edx, 1
jne 0x435720
pop ebp
ret
Function at 0x43d3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xf4], 0x740068
push edi
mov dword [ebp - 0xf0], 0x700074
mov dword [ebp - 0xec], 0x2f003a
mov dword [ebp - 0xe8], 0x61002f
mov dword [ebp - 0xe4], 0x690070
mov dword [ebp - 0xe0], 0x6c002e
mov dword [ebp - 0xdc], 0x640075
mov dword [ebp - 0xd8], 0x730061
mov dword [ebp - 0xd4], 0x690068
mov dword [ebp - 0xd0], 0x63002e
mov dword [ebp - 0xcc], 0x6d006f
mov dword [ebp - 0xc8], 0x67002f
mov dword [ebp - 0xc4], 0x2f006d
mov dword [ebp - 0xc0], 0x650073
mov dword [ebp - 0xbc], 0x750063
mov dword [ebp - 0xb8], 0x690072
mov dword [ebp - 0xb4], 0x790074
mov dword [ebp - 0xb0], 0x6f0044
mov dword [ebp - 0xac], 0x6e0077
mov dword [ebp - 0xa8], 0x6f006c
mov dword [ebp - 0xa4], 0x640061
mov dword [ebp - 0xa0], 0x6e0049
mov dword [ebp - 0x9c], 0x6f0066
mov dword [ebp - 0x98], 0x70003f
mov dword [ebp - 0x94], 0x640069
mov dword [ebp - 0x90], 0x7b003d
mov dword [ebp - 0x8c], 0x690070
mov dword [ebp - 0x88], 0x7d0064
mov dword [ebp - 0x84], 0x610026
mov dword [ebp - 0x80], 0x700070
mov dword [ebp - 0x7c], 0x7b003d
mov dword [ebp - 0x78], 0x700061
mov dword [ebp - 0x74], 0x7d0070
mov dword [ebp - 0x70], 0x6d0026
mov dword [ebp - 0x6c], 0x640069
mov dword [ebp - 0x68], 0x7b003d
mov dword [ebp - 0x64], 0x69006d
mov dword [ebp - 0x60], 0x7d0064
mov dword [ebp - 0x5c], 0x6d0026
mov dword [ebp - 0x58], 0x640069
mov dword [ebp - 0x54], 0x3d0032
mov dword [ebp - 0x50], 0x6d007b
mov dword [ebp - 0x4c], 0x640069
mov dword [ebp - 0x48], 0x7d0032
mov dword [ebp - 0x44], 0x6d0026
mov dword [ebp - 0x40], 0x64006f
mov dword [ebp - 0x3c], 0x650076
mov dword [ebp - 0x38], 0x3d0072
mov dword [ebp - 0x34], 0x6d007b
mov dword [ebp - 0x30], 0x64006f
mov dword [ebp - 0x2c], 0x650076
mov dword [ebp - 0x28], 0x7d0072
mov dword [ebp - 0x24], 0x610026
mov dword [ebp - 0x20], 0x700070
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x3d0072
mov dword [ebp - 0x14], 0x61007b
mov dword [ebp - 0x10], 0x700070
mov dword [ebp - 0xc], 0x650076
mov dword [ebp - 8], 0x7d0072
mov word [ebp - 4], ax
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x43d61e
mov eax, dword [ecx]
push 2
push 0x78
call dword [eax]
test eax, eax
je 0x43d628
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x78
jl 0x43d614
mov dword [eax - 0xc], 0x78
xor eax, eax
mov ecx, dword [esi]
push 0x78
mov word [ecx + 0xf0], ax
lea eax, [ebp - 0xf4]
push eax
push 0x78
push dword [esi]
call fcn.004120d0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409c80
push 0x80004005
call fcn.00409c80
call fcn.0040d420
int3
Function at 0x4405e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587e41
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], 0x44
lea eax, [ebp - 0x2a0]
movlpd qword [ebp - 0x29c], xmm0
push eax
movlpd qword [ebp - 0x294], xmm0
movlpd qword [ebp - 0x28c], xmm0
movlpd qword [ebp - 0x284], xmm0
movlpd qword [ebp - 0x27c], xmm0
movlpd qword [ebp - 0x274], xmm0
movlpd qword [ebp - 0x26c], xmm0
movlpd qword [ebp - 0x264], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x274], 1
push 0x208
push eax
mov word [ebp - 0x270], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x218]
push eax
movups xmmword [ebp - 0x25c], xmm0
call fcn.005536e0
add esp, 0xc
push str.UtilsACSSigned.exe
call fcn.00428170
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne byte [ebp - 0x249]
test eax, eax
je 0x440701
push dword [ebp - 0x258]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x25c]
call esi
jmp 0x4407eb
call fcn.0047f3e0
push 1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ecx, eax
call edx
movzx eax, al
sub eax, 1
jne 0x4407eb
push 0x4a
push str.d:jenkins.jenkinsworkspacemgame_security_security_maineppinstepp.cpp
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], al
call fcn.0040e990
push 3
push 0x597c7c
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.0040e990
push 0x158
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x338]
call fcn.004080a0
mov esi, eax
push str.run_acs_err:
push esi
mov byte [ebp - 4], 2
call fcn.00409170
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0041e360
call fcn.0047f3e0
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
lea ecx, [ebp - 0x338]
call fcn.00409700
lea ecx, [ebp - 0x230]
call fcn.00408b80
lea ecx, [ebp - 0x248]
call fcn.00408b80
mov al, byte [ebp - 0x249]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret
Function at 0x4494d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f64f8
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x39005c
mov dword [ebp - 0x4c], 0x300033
mov dword [ebp - 0x48], 0x450039
mov dword [ebp - 0x44], 0x440033
mov dword [ebp - 0x40], 0x2d0041
mov dword [ebp - 0x3c], 0x460041
mov dword [ebp - 0x38], 0x340035
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x390037
mov dword [ebp - 0x2c], 0x2d0031
mov dword [ebp - 0x28], 0x460041
mov dword [ebp - 0x24], 0x310034
mov dword [ebp - 0x20], 0x42002d
mov dword [ebp - 0x1c], 0x310036
mov dword [ebp - 0x18], 0x330030
mov dword [ebp - 0x14], 0x350042
mov dword [ebp - 0x10], 0x420033
mov dword [ebp - 0xc], 0x320034
mov dword [ebp - 8], 0x38
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x4495b1
movzx ecx, word [esi + eax]
test cx, cx
je 0x4495b1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x449593
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret

Function at 0x4495d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f65c8
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x32005c
mov dword [ebp - 0x4c], 0x370030
mov dword [ebp - 0x48], 0x330033
mov dword [ebp - 0x44], 0x440033
mov dword [ebp - 0x40], 0x2d0031
mov dword [ebp - 0x3c], 0x420035
mov dword [ebp - 0x38], 0x320036
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x340044
mov dword [ebp - 0x2c], 0x2d0030
mov dword [ebp - 0x28], 0x420042
mov dword [ebp - 0x24], 0x380046
mov dword [ebp - 0x20], 0x34002d
mov dword [ebp - 0x1c], 0x430031
mov dword [ebp - 0x18], 0x460032
mov dword [ebp - 0x14], 0x370032
mov dword [ebp - 0x10], 0x330033
mov dword [ebp - 0xc], 0x410032
mov dword [ebp - 8], 0x34
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x4496b1
movzx ecx, word [esi + eax]
test cx, cx
je 0x4496b1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x449693
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret
Function at 0x4497b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f6560
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x37005c
mov dword [ebp - 0x4c], 0x420038
mov dword [ebp - 0x48], 0x420032
mov dword [ebp - 0x44], 0x410032
mov dword [ebp - 0x40], 0x2d0046
mov dword [ebp - 0x3c], 0x320031
mov dword [ebp - 0x38], 0x460033
mov dword [ebp - 0x34], 0x38002d
mov dword [ebp - 0x30], 0x360046
mov dword [ebp - 0x2c], 0x2d0033
mov dword [ebp - 0x28], 0x420038
mov dword [ebp - 0x24], 0x300039
mov dword [ebp - 0x20], 0x35002d
mov dword [ebp - 0x1c], 0x330033
mov dword [ebp - 0x18], 0x340032
mov dword [ebp - 0x14], 0x430032
mov dword [ebp - 0x10], 0x410037
mov dword [ebp - 0xc], 0x460037
mov dword [ebp - 8], 0x31
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x449891
movzx ecx, word [esi + eax]
test cx, cx
je 0x449891
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x449873
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret

Function at 0x4498b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f6700
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x45005c
mov dword [ebp - 0x4c], 0x380030
mov dword [ebp - 0x48], 0x340030
mov dword [ebp - 0x44], 0x410046
mov dword [ebp - 0x40], 0x2d0035
mov dword [ebp - 0x3c], 0x450037
mov dword [ebp - 0x38], 0x350031
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x450045
mov dword [ebp - 0x2c], 0x2d0032
mov dword [ebp - 0x28], 0x410038
mov dword [ebp - 0x24], 0x320033
mov dword [ebp - 0x20], 0x33002d
mov dword [ebp - 0x1c], 0x300035
mov dword [ebp - 0x18], 0x320037
mov dword [ebp - 0x14], 0x360035
mov dword [ebp - 0x10], 0x450042
mov dword [ebp - 0xc], 0x320039
mov dword [ebp - 8], 0x37
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x449991
movzx ecx, word [esi + eax]
test cx, cx
je 0x449991
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x449973
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret
Function at 0x4499b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f6490
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x39005c
mov dword [ebp - 0x4c], 0x350044
mov dword [ebp - 0x48], 0x440034
mov dword [ebp - 0x44], 0x320034
mov dword [ebp - 0x40], 0x2d0044
mov dword [ebp - 0x3c], 0x350042
mov dword [ebp - 0x38], 0x410031
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x350033
mov dword [ebp - 0x2c], 0x2d0035
mov dword [ebp - 0x28], 0x440039
mov dword [ebp - 0x24], 0x460034
mov dword [ebp - 0x20], 0x42002d
mov dword [ebp - 0x1c], 0x370038
mov dword [ebp - 0x18], 0x330045
mov dword [ebp - 0x14], 0x300036
mov dword [ebp - 0x10], 0x340033
mov dword [ebp - 0xc], 0x450039
mov dword [ebp - 8], 0x30
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x449a91
movzx ecx, word [esi + eax]
test cx, cx
je 0x449a91
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x449a73
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret

Function at 0x449ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f6768
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x34005c
mov dword [ebp - 0x4c], 0x300033
mov dword [ebp - 0x48], 0x450041
mov dword [ebp - 0x44], 0x440042
mov dword [ebp - 0x40], 0x2d0035
mov dword [ebp - 0x3c], 0x320037
mov dword [ebp - 0x38], 0x410037
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x450045
mov dword [ebp - 0x2c], 0x2d0044
mov dword [ebp - 0x28], 0x370038
mov dword [ebp - 0x24], 0x380031
mov dword [ebp - 0x20], 0x31002d
mov dword [ebp - 0x1c], 0x440033
mov dword [ebp - 0x18], 0x460037
mov dword [ebp - 0x14], 0x300037
mov dword [ebp - 0x10], 0x430030
mov dword [ebp - 0xc], 0x460044
mov dword [ebp - 8], 0x42
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x449b91
movzx ecx, word [esi + eax]
test cx, cx
je 0x449b91
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x449b73
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret