joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4617ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x2c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x461850
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x7369644e
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6e494d49
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x61697469
push edi
mov dword [ebp - 0x1c], 0x657a696c
mov dword [ebp - 0x18], 0x69766544
mov dword [ebp - 0x14], 0x6e496563
mov dword [ebp - 0x10], 0x6e617473
mov dword [ebp - 0xc], 0x78456563
mov dword [ebp - 8], ebx
call fcn.00404e08
cmp al, 1
jne 0x461850
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x461850
cmp eax, dword [ebp + 0xc]
jae 0x461850
push eax
push 0x36a
call fcn.004356b2
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push 0x36b
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x461866
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x24], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x461900
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x7369644e
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x65446649
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x69676572
push edi
mov dword [ebp - 0x14], 0x72657473
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x63616672
mov dword [ebp - 8], 0x65
call fcn.00404e08
cmp al, 1
jne 0x461900
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x461900
cmp eax, dword [ebp + 0xc]
jae 0x461900
push eax
push 0x380
call fcn.004356b2
mov eax, dword [ebp - 0x24]
add eax, esi
push eax
push 0x381
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x461916
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x24], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4619ac
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x7369644e
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x65446649
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x69676572
push edi
mov dword [ebp - 0x14], 0x72657473
mov dword [ebp - 0x10], 0x766f7250
mov dword [ebp - 0xc], 0x72656469
mov dword [ebp - 8], ebx
call fcn.00404e08
cmp al, 1
jne 0x4619ac
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4619ac
cmp eax, dword [ebp + 0xc]
jae 0x4619ac
push eax
push 0x37a
call fcn.004356b2
mov eax, dword [ebp - 0x24]
add eax, esi
push eax
push 0x37b
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4619c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x2c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x461a6a
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x7369644e
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x65476649
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x74654e74
push edi
mov dword [ebp - 0x1c], 0x6469754c
mov dword [ebp - 0x18], 0x6d6f7246
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x63616672
mov dword [ebp - 0xc], 0x646e4965
mov dword [ebp - 8], 0x7865
call fcn.00404e08
cmp al, 1
jne 0x461a6a
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x461a6a
cmp eax, dword [ebp + 0xc]
jae 0x461a6a
push eax
push 0x8fe
call fcn.004356b2
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push 0x8ff
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x461f0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x20], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x461f9f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x7369644e
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x65526649
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x74736967
push edi
mov dword [ebp - 0x10], 0x6e497265
mov dword [ebp - 0xc], 0x66726574
mov dword [ebp - 8], 0x656361
call fcn.00404e08
cmp al, 1
jne 0x461f9f
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x461f9f
cmp eax, dword [ebp + 0xc]
jae 0x461f9f
push eax
push 0x37c
call fcn.004356b2
mov eax, dword [ebp - 0x20]
add eax, esi
push eax
push 0x37d
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x461fb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x20], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x462047
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x7369644e
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x65526649
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x74736967
push edi
mov dword [ebp - 0x10], 0x72507265
mov dword [ebp - 0xc], 0x6469766f
mov dword [ebp - 8], 0x7265
call fcn.00404e08
cmp al, 1
jne 0x462047
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x462047
cmp eax, dword [ebp + 0xc]
jae 0x462047
push eax
push 0x376
call fcn.004356b2
mov eax, dword [ebp - 0x20]
add eax, esi
push eax
push 0x377
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x46205c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x20], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4620ef
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x7369644e
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x7465474d
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x6c66664f
push edi
mov dword [ebp - 0x10], 0x4864616f
mov dword [ebp - 0xc], 0x6c646e61
mov dword [ebp - 8], 0x737265
call fcn.00404e08
cmp al, 1
jne 0x4620ef
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4620ef
cmp eax, dword [ebp + 0xc]
jae 0x4620ef
push eax
push 0x382
call fcn.004356b2
mov eax, dword [ebp - 0x20]
add eax, esi
push eax
push 0x383
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x462104
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x20], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x462197
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x7369644e
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6765524d
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x65747369
push edi
mov dword [ebp - 0x10], 0x6e694d72
mov dword [ebp - 0xc], 0x726f7069
mov dword [ebp - 8], 0x74
call fcn.00404e08
cmp al, 1
jne 0x462197
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x462197
cmp eax, dword [ebp + 0xc]
jae 0x462197
push eax
push 0x36d
call fcn.004356b2
mov eax, dword [ebp - 0x20]
add eax, esi
push eax
push 0x36e
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4621ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x24], ebx
call fcn.004355f2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x46227c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x7369644e
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x6765524d
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x65747369
push edi
mov dword [ebp - 0x14], 0x6e694d72
mov dword [ebp - 0x10], 0x726f7069
mov dword [ebp - 0xc], 0x69724474
mov dword [ebp - 8], 0x726576
call fcn.00404e08
cmp al, 1
jne 0x46224d
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x46227c
cmp eax, dword [ebp + 0xc]
jae 0x46227c
push eax
push 0x36f
call fcn.004356b2
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
push eax
push 0x370
call fcn.004356b2
mov bl, 1
jmp 0x46227c
push 0x36d
call fcn.004355f2
test eax, eax
jne 0x462272
push dword [ebp + 0xc]
push edi
call fcn.00462104
push 0x36d
call fcn.004355f2
test eax, eax
je 0x46227c
push eax
push dword [ebp + 0xc]
push edi
call fcn.00462290
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x462350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x20], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4623e3
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x7369644e
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x69676552
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x72657473
push edi
mov dword [ebp - 0x10], 0x43696454
mov dword [ebp - 0xc], 0x426c6c61
mov dword [ebp - 8], 0x6b6361
call fcn.00404e08
cmp al, 1
jne 0x4623e3
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4623e3
cmp eax, dword [ebp + 0xc]
jae 0x4623e3
push eax
push 0x372
call fcn.004356b2
mov eax, dword [ebp - 0x20]
add eax, esi
push eax
push 0x373
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4625fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x18], ebx
call fcn.004355f2
test eax, eax
je 0x46269b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x7369644e
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x56746547
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x69737265
push edi
mov dword [ebp - 8], 0x6e6f
call fcn.00404e08
cmp al, 1
jne 0x46269b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x46269b
cmp eax, dword [ebp + 0xc]
jae 0x46269b
add eax, 5
cmp eax, dword [ebp + 0xc]
jae 0x46269b
push 0x914
call fcn.004355f2
cmp eax, 0x3fab
jae 0x46268d
mov eax, dword [ebp - 0x18]
push dword [edi + eax + 1]
push 0x363
call fcn.004356b2
mov bl, 1
jmp 0x46269b
push dword [ebp + 0xc]
push edi
push dword [ebp - 0x18]
call fcn.004626b0
mov bl, al
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x465d9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x58]
push 1
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], 0x53005c
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x730079
push eax
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x52006d
mov dword [ebp - 0x40], 0x6f006f
mov dword [ebp - 0x3c], 0x5c0074
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6d0065
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x28], 0x64005c
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x730072
mov dword [ebp - 0x18], 0x6e005c
mov dword [ebp - 0x14], 0x690064
mov dword [ebp - 0x10], 0x2e0073
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x465e6e
push ebx
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x54]
call fcn.00405020
cmp al, 1
jne 0x465e66
mov bl, al
push dword [ebp - 0x54]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4669dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], eax
push 0x802
mov dword [ebp - 0x18], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x466a9c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x496c6c44
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x6974696e
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x7a696c61
push dword [ebp - 0x1c]
mov dword [ebp - 8], 0x65
call fcn.00404e08
cmp al, 1
je 0x466a73
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x49696454
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x6974696e
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x7a696c61
push dword [ebp - 0x1c]
mov dword [ebp - 8], 0x65
call fcn.00404e08
cmp al, 1
jne 0x466a9c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x466a9c
cmp eax, dword [ebp + 0xc]
jae 0x466a9c
push eax
push 0x804
call fcn.004356b2
mov eax, dword [ebp - 0x18]
add eax, esi
push eax
push 0x805
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x466d0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x802
mov dword [ebp - 0x24], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x466da0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x44696454
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x67657265
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x65747369
push edi
mov dword [ebp - 0x14], 0x506e5072
mov dword [ebp - 0x10], 0x646e6148
mov dword [ebp - 0xc], 0x7372656c
mov dword [ebp - 8], ebx
call fcn.00404e08
cmp al, 1
jne 0x466da0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x466da0
cmp eax, dword [ebp + 0xc]
jae 0x466da0
push eax
push 0x80c
call fcn.004356b2
mov eax, dword [ebp - 0x24]
add eax, esi
push eax
push 0x80d
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x466efc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x730079
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x58]
push 1
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], 0x53005c
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x48], 0x650074
push eax
mov dword [ebp - 0x44], 0x52006d
mov dword [ebp - 0x40], 0x6f006f
mov dword [ebp - 0x3c], 0x5c0074
mov dword [ebp - 0x38], 0x790073
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6d0065
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x28], 0x64005c
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x730072
mov dword [ebp - 0x18], 0x74005c
mov dword [ebp - 0x14], 0x690064
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 8], ebx
call fcn.00439b16
test eax, eax
jne 0x466fc8
push ebx
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x54]
call fcn.00405020
cmp al, 1
jne 0x466fc0
mov bl, al
push dword [ebp - 0x54]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x46717c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x20], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x46720f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x4464664b
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x74656c65
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x6c614365
push edi
mov dword [ebp - 0x10], 0x74756f6c
mov dword [ebp - 0xc], 0x72746e45
mov dword [ebp - 8], 0x79
call fcn.00404e08
cmp al, 1
jne 0x46720f
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x46720f
cmp eax, dword [ebp + 0xc]
jae 0x46720f
push eax
push 0x7de
call fcn.004356b2
mov eax, dword [ebp - 0x20]
add eax, esi
push eax
push 0x7df
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x467224
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], eax
push 0x1a1
mov dword [ebp - 0x2c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x46731f
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x4464664b
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x67657265
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x65747369
push dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0x79614c72
mov dword [ebp - 0x18], 0x68437265
mov dword [ebp - 0x14], 0x65676e61
mov dword [ebp - 0x10], 0x6c6c6143
mov dword [ebp - 0xc], 0x6b636162
mov dword [ebp - 8], ebx
call fcn.00404e08
cmp al, 1
je 0x4672f6
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x4464664b
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x67657265
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x65747369
push dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0x79614c72
mov dword [ebp - 0x18], 0x76457265
mov dword [ebp - 0x14], 0x4e746e65
mov dword [ebp - 0x10], 0x6669746f
mov dword [ebp - 0xc], 0x79
call fcn.00404e08
cmp al, 1
jne 0x46731f
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x46731f
cmp eax, dword [ebp + 0xc]
jae 0x46731f
push eax
push 0x7be
call fcn.004356b2
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push 0x7bf
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x467334
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x1c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4673c0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x4764664b
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x664f7465
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x616f6c66
push edi
mov dword [ebp - 0xc], 0x6f704564
mov dword [ebp - 8], 0x6863
call fcn.00404e08
cmp al, 1
jne 0x4673c0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4673c0
cmp eax, dword [ebp + 0xc]
jae 0x4673c0
push eax
push 0x7b8
call fcn.004356b2
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push 0x7b9
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4673d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x1c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x46745e
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x4764664b
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x65527465
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x6c614366
push edi
mov dword [ebp - 0xc], 0x74756f6c
mov dword [ebp - 8], ebx
call fcn.00404e08
cmp al, 1
jne 0x46745e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46745e
cmp eax, dword [ebp + 0xc]
jae 0x46745e
push eax
push 0x7da
call fcn.004356b2
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push 0x7db
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x467474
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], eax
push 0x1a1
mov dword [ebp - 0x28], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x467565
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x5264664b
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x73696765
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x4c726574
push dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0x72657961
mov dword [ebp - 0x14], 0x6e616843
mov dword [ebp - 0x10], 0x61436567
mov dword [ebp - 0xc], 0x61626c6c
mov dword [ebp - 8], 0x6b63
call fcn.00404e08
cmp al, 1
je 0x46753c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x5264664b
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x73696765
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x4c726574
push dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0x72657961
mov dword [ebp - 0x14], 0x6e657645
mov dword [ebp - 0x10], 0x746f4e74
mov dword [ebp - 0xc], 0x796669
call fcn.00404e08
cmp al, 1
jne 0x467565
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x467565
cmp eax, dword [ebp + 0xc]
jae 0x467565
push eax
push 0x7bc
call fcn.004356b2
mov eax, dword [ebp - 0x28]
add eax, esi
push eax
push 0x7bd
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8