joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x10], 0x7147595d
mov bl, 0x2e
mov dword [ebp - 0xc], 0x5a424748
mov ecx, dword [eax]
mov eax, dword [0x49e6e8]
mov word [ebp - 8], 0x5c4b
cmp eax, dword [ecx + 4]
jle 0x40c486
push 0x49e6e8
call fcn.0043751a
add esp, 4
cmp dword [0x49e6e8], 0xffffffff
jne 0x40c486
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x477100
movq qword [0x4a0620], xmm0
mov word [0x4a0628], ax
mov byte [0x4a062a], bl
call fcn.00437941
push 0x49e6e8
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0620
xor ecx, ebp
pop ebx
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40c4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x7147595d
mov dword [ebp - 0xc], 0x585c4b5d
mov dword [ebp - 8], 0x2e4b4d47
mov ecx, dword [eax]
mov eax, dword [0x4a0588]
cmp eax, dword [ecx + 4]
jle 0x40c51c
push 0x4a0588
call fcn.0043751a
add esp, 4
cmp dword [0x4a0588], 0xffffffff
jne 0x40c51c
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x4770e0
movq qword [0x49efe0], xmm0
mov dword [0x49efe8], eax
call fcn.00437941
push 0x4a0588
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49efe0
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40c900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x4f4b4b78
mov bl, 0x2e
mov dword [ebp - 0x10], 0x4d4f6c43
mov ecx, dword [eax]
mov eax, dword [0x49e8a4]
mov dword [ebp - 0xc], 0x7d5e5b45
mov word [ebp - 8], 0x4d58
cmp eax, dword [ecx + 4]
jle 0x40c995
push 0x49e8a4
call fcn.0043751a
add esp, 4
cmp dword [0x49e8a4], 0xffffffff
jne 0x40c995
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a03f8], eax
mov ax, word [ebp - 8]
push 0x476fe0
movq qword [0x4a03f0], xmm0
mov word [0x4a03fc], ax
mov byte [0x4a03fe], bl
call fcn.00437941
push 0x49e8a4
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a03f0
xor ecx, ebp
pop ebx
call fcn.00437386
mov esp, ebp
pop ebp
ret
Function at 0x40c9b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x4f4b4b78
mov bl, 0x2e
mov dword [ebp - 0x10], 0x415c6c43
mov ecx, dword [eax]
mov eax, dword [0x49eae8]
mov dword [ebp - 0xc], 0x7d5c4b45
mov word [ebp - 8], 0x4d58
cmp eax, dword [ecx + 4]
jle 0x40ca45
push 0x49eae8
call fcn.0043751a
add esp, 4
cmp dword [0x49eae8], 0xffffffff
jne 0x40ca45
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a073c], eax
mov ax, word [ebp - 8]
push 0x476fb0
movq qword [0x4a0734], xmm0
mov word [0x4a0740], ax
mov byte [0x4a0742], bl
call fcn.00437941
push 0x49eae8
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0734
xor ecx, ebp
pop ebx
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40cac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x4f4b4b78
mov dword [ebp - 0x10], 0x41426d43
mov dword [ebp - 0xc], 0x587d4a5b
mov ecx, dword [eax]
mov eax, dword [0x49e3ac]
mov word [ebp - 8], 0x2e4d
cmp eax, dword [ecx + 4]
jle 0x40cb4c
push 0x49e3ac
call fcn.0043751a
add esp, 4
cmp dword [0x49e3ac], 0xffffffff
jne 0x40cb4c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a04b4], eax
mov ax, word [ebp - 8]
push 0x476f80
movq qword [0x4a04ac], xmm0
mov word [0x4a04b8], ax
call fcn.00437941
push 0x49e3ac
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a04ac
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40cbf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x4f4b4b78
mov bl, 0x2e
mov dword [ebp - 0x10], 0x5e4b6a43
mov ecx, dword [eax]
mov eax, dword [0x49e50c]
mov dword [ebp - 0xc], 0x7d574142
mov word [ebp - 8], 0x4d58
cmp eax, dword [ecx + 4]
jle 0x40cc85
push 0x49e50c
call fcn.0043751a
add esp, 4
cmp dword [0x49e50c], 0xffffffff
jne 0x40cc85
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e970], eax
mov ax, word [ebp - 8]
push 0x476f20
movq qword [0x49e968], xmm0
mov word [0x49e974], ax
mov byte [0x49e976], bl
call fcn.00437941
push 0x49e50c
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e968
xor ecx, ebp
pop ebx
call fcn.00437386
mov esp, ebp
pop ebp
ret
Function at 0x40cca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x494f404f
mov dword [ebp - 0xc], 0x587d5c4b
mov word [ebp - 8], 0x2e4d
mov ecx, dword [eax]
mov eax, dword [0x49e75c]
cmp eax, dword [ecx + 4]
jle 0x40cd2b
push 0x49e75c
call fcn.0043751a
add esp, 4
cmp dword [0x49e75c], 0xffffffff
jne 0x40cd2b
movaps xmm0, xmmword [0x4894f0]
mov ax, word [ebp - 8]
movups xmmword [0x49f20c], xmm0
push 0x476f00
movq xmm0, qword [ebp - 0x10]
movq qword [0x49f21c], xmm0
mov word [0x49f224], ax
call fcn.00437941
push 0x49e75c
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49f20c
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40cd40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x4f4b4b78
mov dword [ebp - 0x10], 0x5b416343
mov dword [ebp - 0xc], 0x587d5a40
mov ecx, dword [eax]
mov eax, dword [0x4a0560]
mov word [ebp - 8], 0x2e4d
cmp eax, dword [ecx + 4]
jle 0x40cdcc
push 0x4a0560
call fcn.0043751a
add esp, 4
cmp dword [0x4a0560], 0xffffffff
jne 0x40cdcc
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49ea98], eax
mov ax, word [ebp - 8]
push 0x476ee0
movq qword [0x49ea90], xmm0
mov word [0x49ea9c], ax
call fcn.00437941
push 0x4a0560
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ea90
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40cde0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x4f4b4b78
mov dword [ebp - 0xc], 0x7d686043
mov dword [ebp - 8], 0x2e4d587d
mov ecx, dword [eax]
mov eax, dword [0x49e398]
cmp eax, dword [ecx + 4]
jle 0x40ce5c
push 0x49e398
call fcn.0043751a
add esp, 4
cmp dword [0x49e398], 0xffffffff
jne 0x40ce5c
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x476ec0
movq qword [0x4a0650], xmm0
mov dword [0x4a0658], eax
call fcn.00437941
push 0x49e398
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0650
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret
Function at 0x40ce70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x4f4b4b78
mov bl, 0x2e
mov dword [ebp - 0x10], 0x7d6b7c43
mov ecx, dword [eax]
mov eax, dword [0x4a055c]
mov dword [ebp - 0xc], 0x4d587d7a
cmp eax, dword [ecx + 4]
jle 0x40cef5
push 0x4a055c
call fcn.0043751a
add esp, 4
cmp dword [0x4a055c], 0xffffffff
jne 0x40cef5
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x476ea0
movq qword [0x4a0640], xmm0
mov dword [0x4a0648], eax
mov byte [0x4a064c], bl
call fcn.00437941
push 0x4a055c
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0640
xor ecx, ebp
pop ebx
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40d310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x10], 0x7147595d
mov bl, 0x2e
mov dword [ebp - 0xc], 0x4f4a5e5b
mov ecx, dword [eax]
mov eax, dword [0x49efac]
mov word [ebp - 8], 0x4b5a
cmp eax, dword [ecx + 4]
jle 0x40d396
push 0x49efac
call fcn.0043751a
add esp, 4
cmp dword [0x49efac], 0xffffffff
jne 0x40d396
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x476dc0
movq qword [0x49ecbc], xmm0
mov word [0x49ecc4], ax
mov byte [0x49ecc6], bl
call fcn.00437941
push 0x49efac
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ecbc
xor ecx, ebp
pop ebx
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40d3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x6f627f7d
mov dword [ebp - 0x10], 0x5a404b49
mov dword [ebp - 0xc], 0x6a766d0a
mov ecx, dword [eax]
mov eax, dword [0x4a0498]
mov word [ebp - 8], 0x2e6c
cmp eax, dword [ecx + 4]
jle 0x40d43c
push 0x4a0498
call fcn.0043751a
add esp, 4
cmp dword [0x4a0498], 0xffffffff
jne 0x40d43c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e7cc], eax
mov ax, word [ebp - 8]
push 0x476da0
movq qword [0x49e7c4], xmm0
mov word [0x49e7d0], ax
call fcn.00437941
push 0x4a0498
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e7c4
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret
Function at 0x40d450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x6f7a6b63
mov dword [ebp - 0xc], 0x636f7c68
mov word [ebp - 8], 0x2e6b
mov ecx, dword [eax]
mov eax, dword [0x4a06e4]
cmp eax, dword [ecx + 4]
jle 0x40d4db
push 0x4a06e4
call fcn.0043751a
add esp, 4
cmp dword [0x4a06e4], 0xffffffff
jne 0x40d4db
movaps xmm0, xmmword [0x489650]
mov ax, word [ebp - 8]
movups xmmword [0x4a04c0], xmm0
push 0x476d80
movq xmm0, qword [ebp - 0x10]
movq qword [0x4a04d0], xmm0
mov word [0x4a04d8], ax
call fcn.00437941
push 0x4a06e4
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a04c0
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40d710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x6f627f7d
mov dword [ebp - 0x10], 0x5a404b49
mov dword [ebp - 0xc], 0x617c7e0a
mov ecx, dword [eax]
mov eax, dword [0x4a04a8]
mov word [ebp - 8], 0x2e6a
cmp eax, dword [ecx + 4]
jle 0x40d79c
push 0x4a04a8
call fcn.0043751a
add esp, 4
cmp dword [0x4a04a8], 0xffffffff
jne 0x40d79c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e634], eax
mov ax, word [ebp - 8]
push 0x476cf0
movq qword [0x49e62c], xmm0
mov word [0x49e638], ax
call fcn.00437941
push 0x4a04a8
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e62c
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40d7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x5a485d43
mov dword [ebp - 0x10], 0x425f5d4b
mov dword [ebp - 0xc], 0x617c7e0a
mov ecx, dword [eax]
mov eax, dword [0x4a046c]
mov word [ebp - 8], 0x2e6a
cmp eax, dword [ecx + 4]
jle 0x40d83c
push 0x4a046c
call fcn.0043751a
add esp, 4
cmp dword [0x4a046c], 0xffffffff
jne 0x40d83c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e564], eax
mov ax, word [ebp - 8]
push 0x476cd0
movq qword [0x49e55c], xmm0
mov word [0x49e568], ax
call fcn.00437941
push 0x4a046c
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e55c
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret
Function at 0x40e310
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x4b4d564b
mov dword [ebp - 0xc], 0x564b0042
mov word [ebp - 8], 0x2e4b
mov ecx, dword [eax]
mov eax, dword [0x49e438]
cmp eax, dword [ecx + 4]
jle 0x40e38d
push 0x49e438
call fcn.0043751a
add esp, 4
cmp dword [0x49e438], 0xffffffff
jne 0x40e38d
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x476a90
movq qword [0x49eb74], xmm0
mov word [0x49eb7c], ax
call fcn.00437941
push 0x49e438
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49eb74
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40e9e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x5b4f4d41
mov bl, 0x2e
mov dword [ebp - 0x10], 0x5e5b415a
mov ecx, dword [eax]
mov eax, dword [0x49e6f8]
mov dword [ebp - 0xc], 0x4b005d4a
mov word [ebp - 8], 0x4b56
cmp eax, dword [ecx + 4]
jle 0x40ea75
push 0x49e6f8
call fcn.0043751a
add esp, 4
cmp dword [0x49e6f8], 0xffffffff
jne 0x40ea75
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a05cc], eax
mov ax, word [ebp - 8]
push 0x476900
movq qword [0x4a05c4], xmm0
mov word [0x4a05d0], ax
mov byte [0x4a05d2], bl
call fcn.00437941
push 0x49e6f8
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a05c4
xor ecx, ebp
pop ebx
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40ef40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x4c425f5d
mov bl, 0x2e
mov dword [ebp - 0x10], 0x5d59415c
mov ecx, dword [eax]
mov eax, dword [0x49e3b0]
mov dword [ebp - 0xc], 0x4b005c4b
mov word [ebp - 8], 0x4b56
cmp eax, dword [ecx + 4]
jle 0x40efd5
push 0x49e3b0
call fcn.0043751a
add esp, 4
cmp dword [0x49e3b0], 0xffffffff
jne 0x40efd5
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e3a4], eax
mov ax, word [ebp - 8]
push 0x4767d0
movq qword [0x49e39c], xmm0
mov word [0x49e3a8], ax
mov byte [0x49e3aa], bl
call fcn.00437941
push 0x49e3b0
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e39c
xor ecx, ebp
pop ebx
call fcn.00437386
mov esp, ebp
pop ebp
ret
Function at 0x40f090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x59425f5d
mov dword [ebp - 0x10], 0x4b5a475c
mov dword [ebp - 0xc], 0x564b005c
mov ecx, dword [eax]
mov eax, dword [0x49e898]
mov word [ebp - 8], 0x2e4b
cmp eax, dword [ecx + 4]
jle 0x40f11c
push 0x49e898
call fcn.0043751a
add esp, 4
cmp dword [0x49e898], 0xffffffff
jne 0x40f11c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a03a8], eax
mov ax, word [ebp - 8]
push 0x476790
movq qword [0x4a03a0], xmm0
mov word [0x4a03ac], ax
call fcn.00437941
push 0x49e898
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a03a0
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40f610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x5d5d4856
mov dword [ebp - 0x10], 0x414d4d58
mov dword [ebp - 0xc], 0x564b0040
mov ecx, dword [eax]
mov eax, dword [0x49ede0]
mov word [ebp - 8], 0x2e4b
cmp eax, dword [ecx + 4]
jle 0x40f69c
push 0x49ede0
call fcn.0043751a
add esp, 4
cmp dword [0x49ede0], 0xffffffff
jne 0x40f69c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49ed10], eax
mov ax, word [ebp - 8]
push 0x476670
movq qword [0x49ed08], xmm0
mov word [0x49ed14], ax
call fcn.00437941
push 0x49ede0
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ed08
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret

Function at 0x40f7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x6f7a606d
mov dword [ebp - 0x10], 0x49637d41
mov dword [ebp - 0xc], 0x564b005c
mov ecx, dword [eax]
mov eax, dword [0x4a0684]
mov word [ebp - 8], 0x2e4b
cmp eax, dword [ecx + 4]
jle 0x40f87c
push 0x4a0684
call fcn.0043751a
add esp, 4
cmp dword [0x4a0684], 0xffffffff
jne 0x40f87c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49ea68], eax
mov ax, word [ebp - 8]
push 0x476610
movq qword [0x49ea60], xmm0
mov word [0x49ea6c], ax
call fcn.00437941
push 0x4a0684
call fcn.004374d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ea60
xor ecx, ebp
call fcn.00437386
mov esp, ebp
pop ebp
ret
Function at 0x416680
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x17], 0
je 0x4166aa
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x18
jb 0x4166a0
mov eax, ecx
ret

Function at 0x4166b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x12], 0
je 0x4166da
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x13
jb 0x4166d0
mov eax, ecx
ret

Function at 0x416730
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xd], 0
je 0x416742
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xe
jb 0x416738
mov eax, ecx
ret

Function at 0x416780
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x416792
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xc
jb 0x416788
mov eax, ecx
ret

Function at 0x4167a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x4167b2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xf
jb 0x4167a8
mov eax, ecx
ret

Function at 0x416820
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x13], 0
je 0x41684a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x14
jb 0x416840
mov eax, ecx
ret

Function at 0x416890
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xa], 0
je 0x4168a2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xb
jb 0x416898
mov eax, ecx
ret

Function at 0x4168b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x16], 0
je 0x4168da
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x17
jb 0x4168d0
mov eax, ecx
ret

Function at 0x4169a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x18], 0
je 0x4169ca
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x19
jb 0x4169c0
mov eax, ecx
ret

Function at 0x4169d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x11], 0
je 0x4169fa
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x12
jb 0x4169f0
mov eax, ecx
ret

Function at 0x416a20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x416a4a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x16
jb 0x416a40
mov eax, ecx
ret
Function at 0x416ab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc], 0
je 0x416ac2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xd
jb 0x416ab8
mov eax, ecx
ret

Function at 0x416ad0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x19], 0
je 0x416afa
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1a
jb 0x416af0
mov eax, ecx
ret

Function at 0x416b00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x14], 0
je 0x416b2a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x15
jb 0x416b20
mov eax, ecx
ret
Function at 0x418960
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1f], 0
je 0x418984
movaps xmm1, xmmword [0x4890c0]
xor eax, eax
nop
movups xmm0, xmmword [eax + ecx]
pxor xmm0, xmm1
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x418970
ret

Function at 0x418990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x12], 0
je 0x4189ba
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x13
jb 0x4189b0
ret

Function at 0x418a10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xd], 0
je 0x418a22
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xe
jb 0x418a18
ret

Function at 0x418a30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1e], 0
je 0x418a5a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1f
jb 0x418a50
ret

Function at 0x418a90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x418aa2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xc
jb 0x418a98
ret

Function at 0x418ab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x418ac2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xf
jb 0x418ab8
ret

Function at 0x418b10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x13], 0
je 0x418b3a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x14
jb 0x418b30
ret

Function at 0x418b40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1c], 0
je 0x418b6a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1d
jb 0x418b60
ret

Function at 0x418ba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xa], 0
je 0x418bb2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xb
jb 0x418ba8
ret

Function at 0x418bc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x21], 0
je 0x418bfa
movaps xmm1, xmmword [0x4890c0]
xor eax, eax
nop
movups xmm0, xmmword [eax + ecx]
pxor xmm0, xmm1
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x418bd0
cmp eax, 0x22
jae 0x418bfa
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x22
jb 0x418bf0
ret

Function at 0x418c00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x16], 0
je 0x418c2a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x17
jb 0x418c20
ret