joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401730
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x18], 0
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0xc], eax
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x10]
mov dword [ebp - 8], eax
jne 0x401795
mov eax, dword [ebp + 0xc]
push 0
push edi
push eax
push dword [ebp - 0xc]
push ecx
push edx
push 0
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
je 0x4017e6
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret 0x14
push 1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov eax, dword [esi + 8]
push 0
push 0
push ecx
push edx
push 0
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jne 0x401780
push 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [esi + 0x18]
push dword [esi + 0x10]
push 0
push dword [ebp + 0xc]
push ebx
push dword [esi + 8]
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jne 0x401780
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret 0x14
Function at 0x403de0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4732dc
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov edx, dword [ebx + 8]
xorps xmm0, xmm0
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x3c], edx
movlpd qword [ebp - 0x1c], xmm0
mov esi, dword [eax + edx*8 + 4]
test esi, esi
je 0x403e42
lock inc dword [esi + 4]
mov esi, dword [eax + edx*8 + 4]
mov eax, dword [eax + edx*8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
test esi, esi
je 0x403e67
lock inc dword [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
push 8
mov byte [ebp - 4], 1
call fcn.004379f0
mov edi, eax
mov dword [ebp - 0x40], edi
push 0x10
mov byte [ebp - 4], 2
call fcn.004379f0
mov ecx, dword [ebp - 0x38]
add esp, 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 4], ecx
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
test esi, esi
je 0x403eac
lock inc dword [esi + 4]
mov ecx, dword [ebp - 0x34]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], esi
mov dword [ebp - 0x30], eax
lea ecx, [edi + 4]
mov byte [ebp - 4], 3
push ecx
push 0
push eax
push 0x41dd20
push 0
push 0
mov dword [ebp - 0x34], ecx
call fcn.004532d8
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x403f70
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov eax, dword [eax]
mov ecx, dword [eax + edx*4]
mov dword [eax + edx*4], edi
test ecx, ecx
je 0x403f08
cmp dword [ecx + 4], 0
jne 0x403f80
push 8
push ecx
call fcn.00437a20
add esp, 8
test esi, esi
je 0x403f50
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x403f33
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x403f30
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x403f50
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x403f50
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, dword [ebp - 0x34]
push 6
mov dword [eax], 0
call fcn.004203e4
call fcn.004568f6
int3
Function at 0x408370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x489230]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x415c5a40
mov ecx, dword [eax]
mov eax, dword [0x49edcc]
mov dword [ebp - 0x10], 0x4b7d0e42
mov dword [ebp - 0xc], 0x4d47585c
mov word [ebp - 8], 0x2e4b
cmp eax, dword [ecx + 4]
jle 0x4083f6
push 0x49edcc
call fcn.00437b73
add esp, 4
cmp dword [0x49edcc], 0xffffffff
jne 0x4083f6
lea eax, [ebp - 0x24]
mov ecx, 0x49e724
push eax
call fcn.00416ed0
push 0x4787b0
call fcn.00437f9a
push 0x49edcc
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e724
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x408af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x415c4d6f
mov bl, 0x2e
mov dword [ebp - 0x10], 0x6f5d4740
mov ecx, dword [eax]
mov eax, dword [0x4a054c]
mov dword [ebp - 0xc], 0x5a404b49
cmp eax, dword [ecx + 4]
jle 0x408b75
push 0x4a054c
call fcn.00437b73
add esp, 4
cmp dword [0x4a054c], 0xffffffff
jne 0x408b75
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x4785e0
movq qword [0x49e878], xmm0
mov dword [0x49e880], eax
mov byte [0x49e884], bl
call fcn.00437f9a
push 0x4a054c
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e878
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x408c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x475a406f
mov dword [ebp - 0xc], 0x5b5c4758
mov word [ebp - 8], 0x2e5d
mov ecx, dword [eax]
mov eax, dword [0x4a02ac]
cmp eax, dword [ecx + 4]
jle 0x408cad
push 0x4a02ac
call fcn.00437b73
add esp, 4
cmp dword [0x4a02ac], 0xffffffff
jne 0x408cad
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x4785a0
movq qword [0x49efc0], xmm0
mov word [0x49efc8], ax
call fcn.00437f9a
push 0x4a02ac
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49efc0
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret
Function at 0x408d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x489690]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x424b4d4d
mov ecx, dword [eax]
mov eax, dword [0x49e8f4]
mov dword [ebp - 0xc], 0x5a4f5c4b
mov word [ebp - 8], 0x5c41
mov byte [ebp - 6], 0x2e
cmp eax, dword [ecx + 4]
jle 0x408dc3
push 0x49e8f4
call fcn.00437b73
add esp, 4
cmp dword [0x49e8f4], 0xffffffff
jne 0x408dc3
lea eax, [ebp - 0x20]
mov ecx, 0x49e518
push eax
call fcn.00416dc0
push 0x478550
call fcn.00437f9a
push 0x49e8f4
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e518
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x408e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x474a4b63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x5c4b7d4f
mov ecx, dword [eax]
mov eax, dword [0x4a0524]
mov dword [ebp - 0xc], 0x4b4d4758
cmp eax, dword [ecx + 4]
jle 0x408f03
push 0x4a0524
call fcn.00437b73
add esp, 4
cmp dword [0x4a0524], 0xffffffff
jne 0x408f03
movaps xmm0, xmmword [0x489310]
mov eax, dword [ebp - 0xc]
movups xmmword [0x49e9e8], xmm0
push 0x4784f0
movq xmm0, qword [ebp - 0x14]
movq qword [0x49e9f8], xmm0
mov dword [0x49ea00], eax
mov byte [0x49ea04], bl
call fcn.00437f9a
push 0x4a0524
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e9e8
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x408fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x5a404b43
mov dword [ebp - 0xc], 0x585c4b7d
mov dword [ebp - 8], 0x2e4b4d47
mov ecx, dword [eax]
mov eax, dword [0x49e550]
cmp eax, dword [ecx + 4]
jle 0x40903a
push 0x49e550
call fcn.00437b73
add esp, 4
cmp dword [0x49e550], 0xffffffff
jne 0x40903a
movaps xmm0, xmmword [0x489300]
mov eax, dword [ebp - 8]
movups xmmword [0x49e840], xmm0
push 0x4784b0
movq xmm0, qword [ebp - 0x10]
movq qword [0x49e850], xmm0
mov dword [0x49e858], eax
call fcn.00437f9a
push 0x49e550
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e840
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret
Function at 0x409440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x7d495d6b
mov dword [ebp - 0xc], 0x5c4b6546
mov dword [ebp - 8], 0x2e424b40
mov ecx, dword [eax]
mov eax, dword [0x49ed18]
cmp eax, dword [ecx + 4]
jle 0x4094bc
push 0x49ed18
call fcn.00437b73
add esp, 4
cmp dword [0x49ed18], 0xffffffff
jne 0x4094bc
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x4783d0
movq qword [0x49e5a4], xmm0
mov dword [0x49e5ac], eax
call fcn.00437f9a
push 0x49ed18
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e5a4
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x4094d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x7d716f68
mov bl, 0x2e
mov dword [ebp - 0x10], 0x4a4b464d
mov ecx, dword [eax]
mov eax, dword [0x49e5b0]
mov dword [ebp - 0xc], 0x5c4b425b
cmp eax, dword [ecx + 4]
jle 0x409555
push 0x49e5b0
call fcn.00437b73
add esp, 4
cmp dword [0x49e5b0], 0xffffffff
jne 0x409555
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x4783b0
movq qword [0x49e414], xmm0
mov dword [0x49e41c], eax
mov byte [0x49e420], bl
call fcn.00437f9a
push 0x49e5b0
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e414
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x4097b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x636f6c63
mov dword [ebp - 0xc], 0x585c4b7d
mov dword [ebp - 8], 0x2e4b4d47
mov ecx, dword [eax]
mov eax, dword [0x49e828]
cmp eax, dword [ecx + 4]
jle 0x40982c
push 0x49e828
call fcn.00437b73
add esp, 4
cmp dword [0x49e828], 0xffffffff
jne 0x40982c
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x478320
movq qword [0x4a0228], xmm0
mov dword [0x4a0230], eax
call fcn.00437f9a
push 0x49e828
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0228
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret
Function at 0x409990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x4b486f4d
mov bl, 0x2e
mov dword [ebp - 0x10], 0x4f5c684b
mov ecx, dword [eax]
mov eax, dword [0x4a06a8]
mov dword [ebp - 0xc], 0x41594b43
mov word [ebp - 8], 0x455c
cmp eax, dword [ecx + 4]
jle 0x409a33
push 0x4a06a8
call fcn.00437b73
add esp, 4
cmp dword [0x4a06a8], 0xffffffff
jne 0x409a33
movaps xmm0, xmmword [0x489550]
mov eax, dword [ebp - 0xc]
movups xmmword [0x49e580], xmm0
mov dword [0x49e598], eax
movq xmm0, qword [ebp - 0x14]
mov ax, word [ebp - 8]
push 0x4782b0
movq qword [0x49e590], xmm0
mov word [0x49e59c], ax
mov byte [0x49e59e], bl
call fcn.00437f9a
push 0x4a06a8
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e580
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x409ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x4f7a4d63
mov dword [ebp - 0x10], 0x4f63455d
mov dword [ebp - 0xc], 0x4b494f40
mov ecx, dword [eax]
mov eax, dword [0x49ecd8]
mov word [ebp - 8], 0x2e5c
cmp eax, dword [ecx + 4]
jle 0x409b6c
push 0x49ecd8
call fcn.00437b73
add esp, 4
cmp dword [0x49ecd8], 0xffffffff
jne 0x409b6c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49ea88], eax
mov ax, word [ebp - 8]
push 0x478270
movq qword [0x49ea80], xmm0
mov word [0x49ea8c], ax
call fcn.00437f9a
push 0x49ecd8
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ea80
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x409d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x57544143
mov dword [ebp - 0x10], 0x4c415c5e
mov dword [ebp - 0xc], 0x5b454d4f
mov ecx, dword [eax]
mov eax, dword [0x49f1e8]
mov word [ebp - 8], 0x2e5e
cmp eax, dword [ecx + 4]
jle 0x409dac
push 0x49f1e8
call fcn.00437b73
add esp, 4
cmp dword [0x49f1e8], 0xffffffff
jne 0x409dac
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a058c], eax
mov ax, word [ebp - 8]
push 0x478200
movq qword [0x4a0584], xmm0
mov word [0x4a0590], ax
call fcn.00437f9a
push 0x49f1e8
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0584
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret
Function at 0x409dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x5a6a5d63
mov dword [ebp - 0xc], 0x5c4b7d5d
mov dword [ebp - 8], 0x2e5c4b58
mov ecx, dword [eax]
mov eax, dword [0x49e83c]
cmp eax, dword [ecx + 4]
jle 0x409e3c
push 0x49e83c
call fcn.00437b73
add esp, 4
cmp dword [0x49e83c], 0xffffffff
jne 0x409e3c
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x4781e0
movq qword [0x4a05bc], xmm0
mov dword [0x4a05c4], eax
call fcn.00437f9a
push 0x49e83c
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a05bc
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x409fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x566b7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x404f464d
mov ecx, dword [eax]
mov eax, dword [0x49f12c]
mov dword [ebp - 0xc], 0x7d6b4b49
cmp eax, dword [ecx + 4]
jle 0x40a035
push 0x49f12c
call fcn.00437b73
add esp, 4
cmp dword [0x49f12c], 0xffffffff
jne 0x40a035
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x478160
movq qword [0x49e714], xmm0
mov dword [0x49e71c], eax
mov byte [0x49e720], bl
call fcn.00437f9a
push 0x49f12c
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e714
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x40a050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x566b7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x404f464d
mov ecx, dword [eax]
mov eax, dword [0x49ec88]
mov dword [ebp - 0xc], 0x7d674b49
cmp eax, dword [ecx + 4]
jle 0x40a0d5
push 0x49ec88
call fcn.00437b73
add esp, 4
cmp dword [0x49ec88], 0xffffffff
jne 0x40a0d5
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x478140
movq qword [0x49f130], xmm0
mov dword [0x49f138], eax
mov byte [0x49f13c], bl
call fcn.00437f9a
push 0x49ec88
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49f130
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret
Function at 0x40a0f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x566b7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x404f464d
mov ecx, dword [eax]
mov eax, dword [0x49e684]
mov dword [ebp - 0xc], 0x69634b49
mov word [ebp - 8], 0x7a63
cmp eax, dword [ecx + 4]
jle 0x40a185
push 0x49e684
call fcn.00437b73
add esp, 4
cmp dword [0x49e684], 0xffffffff
jne 0x40a185
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e930], eax
mov ax, word [ebp - 8]
push 0x478110
movq qword [0x49e928], xmm0
mov word [0x49e934], ax
mov byte [0x49e936], bl
call fcn.00437f9a
push 0x49e684
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e928
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x40a1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x566b7d63
mov dword [ebp - 0x10], 0x404f464d
mov dword [ebp - 0xc], 0x7a634b49
mov ecx, dword [eax]
mov eax, dword [0x49eb6c]
mov word [ebp - 8], 0x2e6f
cmp eax, dword [ecx + 4]
jle 0x40a22c
push 0x49eb6c
call fcn.00437b73
add esp, 4
cmp dword [0x49eb6c], 0xffffffff
jne 0x40a22c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a063c], eax
mov ax, word [ebp - 8]
push 0x4780f0
movq qword [0x4a0634], xmm0
mov word [0x4a0640], ax
call fcn.00437f9a
push 0x49eb6c
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0634
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x40a240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x566b7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x404f464d
mov ecx, dword [eax]
mov eax, dword [0x49efbc]
mov dword [ebp - 0xc], 0x6f7d4b49
cmp eax, dword [ecx + 4]
jle 0x40a2c5
push 0x49efbc
call fcn.00437b73
add esp, 4
cmp dword [0x49efbc], 0xffffffff
jne 0x40a2c5
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x4780d0
movq qword [0x49f06c], xmm0
mov dword [0x49f074], eax
mov byte [0x49f078], bl
call fcn.00437f9a
push 0x49efbc
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49f06c
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret
Function at 0x40a2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x566b7d63
mov dword [ebp - 0x10], 0x404f464d
mov dword [ebp - 0xc], 0x7c7d4b49
mov ecx, dword [eax]
mov eax, dword [0x4a04ec]
mov word [ebp - 8], 0x2e7d
cmp eax, dword [ecx + 4]
jle 0x40a36c
push 0x4a04ec
call fcn.00437b73
add esp, 4
cmp dword [0x4a04ec], 0xffffffff
jne 0x40a36c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a03cc], eax
mov ax, word [ebp - 8]
push 0x4780b0
movq qword [0x4a03c4], xmm0
mov word [0x4a03d0], ax
call fcn.00437f9a
push 0x4a04ec
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a03c4
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x40a470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x10], 0x62617d63
mov bl, 0x2e
mov dword [ebp - 0xc], 0x7a0a7e6f
mov ecx, dword [eax]
mov eax, dword [0x4a02b0]
mov word [ebp - 8], 0x7d7e
cmp eax, dword [ecx + 4]
jle 0x40a4f6
push 0x4a02b0
call fcn.00437b73
add esp, 4
cmp dword [0x4a02b0], 0xffffffff
jne 0x40a4f6
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x478060
movq qword [0x49ef60], xmm0
mov word [0x49ef68], ax
mov byte [0x49ef6a], bl
call fcn.00437f9a
push 0x4a02b0
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ef60
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x40a510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x62617d63
mov dword [ebp - 0x10], 0x7a0a7e6f
mov dword [ebp - 0xc], 0x636f7d7e
mov ecx, dword [eax]
mov eax, dword [0x49edec]
mov word [ebp - 8], 0x2e6f
cmp eax, dword [ecx + 4]
jle 0x40a59c
push 0x49edec
call fcn.00437b73
add esp, 4
cmp dword [0x49edec], 0xffffffff
jne 0x40a59c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49f1cc], eax
mov ax, word [ebp - 8]
push 0x478040
movq qword [0x49f1c4], xmm0
mov word [0x49f1d0], ax
call fcn.00437f9a
push 0x49edec
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49f1c4
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret
Function at 0x40a5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x7f7d7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x656c0a62
mov ecx, dword [eax]
mov eax, dword [0x49e990]
mov dword [ebp - 0xc], 0x766b7e7b
mov word [ebp - 8], 0x6d6b
cmp eax, dword [ecx + 4]
jle 0x40a645
push 0x49e990
call fcn.00437b73
add esp, 4
cmp dword [0x49e990], 0xffffffff
jne 0x40a645
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49ee88], eax
mov ax, word [ebp - 8]
push 0x478010
movq qword [0x49ee80], xmm0
mov word [0x49ee8c], ax
mov byte [0x49ee8e], bl
call fcn.00437f9a
push 0x49e990
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ee80
xor ecx, ebp
pop ebx
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x40ade0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x489020]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x637d6c7d
mov ecx, dword [eax]
mov eax, dword [0x49ed1c]
mov dword [ebp - 0x10], 0x7a676061
mov dword [ebp - 0xc], 0x60677c61
mov word [ebp - 8], 0x2e69
cmp eax, dword [ecx + 4]
jle 0x40ae66
push 0x49ed1c
call fcn.00437b73
add esp, 4
cmp dword [0x49ed1c], 0xffffffff
jne 0x40ae66
lea eax, [ebp - 0x24]
mov ecx, 0x49e4d0
push eax
call fcn.00416ed0
push 0x477e20
call fcn.00437f9a
push 0x49ed1c
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e4d0
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret

Function at 0x40ae80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x489020]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x7c6f667d
mov ecx, dword [eax]
mov eax, dword [0x49e36c]
mov dword [ebp - 0xc], 0x67617e6b
mov word [ebp - 8], 0x7a60
mov byte [ebp - 6], 0x2e
cmp eax, dword [ecx + 4]
jle 0x40af03
push 0x49e36c
call fcn.00437b73
add esp, 4
cmp dword [0x49e36c], 0xffffffff
jne 0x40af03
lea eax, [ebp - 0x20]
mov ecx, 0x49e44c
push eax
call fcn.00416dc0
push 0x477df0
call fcn.00437f9a
push 0x49e36c
call fcn.00437b29
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e44c
xor ecx, ebp
call fcn.004379df
mov esp, ebp
pop ebp
ret