joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4417a1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x472580], 0
push esi
jne 0x441714
call fcn.0044163a
test eax, eax
je 0x441757
mov eax, dword [0x472580]
cmp eax, 1
jne 0x441735
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x441757
pop esi
ret
push eax
call dword [0x472588]
test eax, eax
jne 0x44179f
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x44175b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x472580]
call dword [0x472588]
mov edi, eax
test edi, edi
je 0x441780
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x44179c
mov edi, esi
add esi, 0xff0
push edi
push dword [0x472580]
call dword [0x472584]
add edi, 0x10
cmp edi, esi
jb 0x441788
mov eax, edi
pop edi
pop esi
ret
jmp 0x441701

Function at 0x441af5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46e320]
jne 0x441aff
repz ret
jmp fcn.0044833c

Function at 0x45351d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00448661
and dword [ebp - 4], 0
cmp dword [0x4730e0], 0
mov ebx, eax
jne 0x4535ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45367f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45367f
push eax
call fcn.004485ef
mov dword [esp], 0x462a00
push edi
mov dword [0x4730e0], eax
call esi
push eax
call fcn.004485ef
mov dword [esp], 0x4629ec
push edi
mov dword [0x4730e4], eax
call esi
push eax
call fcn.004485ef
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4730e8], eax
call esi
push eax
call fcn.004485ef
pop ecx
mov dword [0x4730f0], eax
test eax, eax
je 0x4535ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004485ef
pop ecx
mov dword [0x4730ec], eax
mov eax, dword [0x4730ec]
cmp eax, ebx
je 0x453626
cmp dword [0x4730f0], ebx
je 0x453626
push eax
call fcn.0044866a
push dword [0x4730f0]
mov esi, eax
call fcn.0044866a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x453626
test edi, edi
je 0x453626
call esi
test eax, eax
je 0x45361d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45361d
test byte [ebp - 0xc], 1
jne 0x453626
or dword [ebp + 0x10], 0x200000
jmp 0x45365f
mov eax, dword [0x4730e4]
cmp eax, ebx
je 0x45365f
push eax
call fcn.0044866a
pop ecx
test eax, eax
je 0x45365f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45365f
mov eax, dword [0x4730e8]
cmp eax, ebx
je 0x45365f
push eax
call fcn.0044866a
pop ecx
test eax, eax
je 0x45365f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4730e0]
call fcn.0044866a
pop ecx
test eax, eax
je 0x45367f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x453681
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4017c0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x18], 0
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0xc], eax
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x10]
mov dword [ebp - 8], eax
jne 0x401825
mov eax, dword [ebp + 0xc]
push 0
push edi
push eax
push dword [ebp - 0xc]
push ecx
push edx
push 0
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
je 0x401876
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret 0x14
push 1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov eax, dword [esi + 8]
push 0
push 0
push ecx
push edx
push 0
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jne 0x401810
push 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [esi + 0x18]
push dword [esi + 0x10]
push 0
push dword [ebp + 0xc]
push ebx
push dword [esi + 8]
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jne 0x401810
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret 0x14
Function at 0x403d70
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472d2c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xorps xmm0, xmm0
mov eax, dword [0x49e29c]
movlpd qword [ebp - 0x1c], xmm0
mov esi, dword [eax + edi*8 + 4]
test esi, esi
je 0x403dce
lock inc dword [esi + 4]
mov esi, dword [eax + edi*8 + 4]
mov eax, dword [eax + edi*8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x2c], 0x49e290
mov dword [ebp - 0x28], edi
test esi, esi
je 0x403df7
lock inc dword [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
push 8
mov byte [ebp - 4], 1
call fcn.00437377
mov dword [ebp - 0x38], eax
push 0x10
mov byte [ebp - 4], 2
call fcn.00437377
add esp, 8
mov dword [eax], 0x49e290
mov dword [eax + 4], edi
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
test esi, esi
je 0x403e38
lock inc dword [esi + 4]
mov ecx, dword [ebp - 0x34]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], esi
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x38]
add ecx, 4
push ecx
push 0
push eax
push 0x41d760
push 0
push 0
mov dword [ebp - 0x34], ecx
call fcn.00452d79
mov edx, dword [ebp - 0x38]
add esp, 0x18
mov dword [edx], eax
test eax, eax
je 0x403eff
mov eax, dword [0x49e290]
mov ecx, dword [eax + edi*4]
mov dword [eax + edi*4], edx
test ecx, ecx
je 0x403e97
cmp dword [ecx + 4], 0
jne 0x403f0f
push 8
push ecx
call fcn.004373a7
add esp, 8
test esi, esi
je 0x403edf
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x403ec2
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x403ebf
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x403edf
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x403edf
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, dword [ebp - 0x34]
push 6
mov dword [eax], 0
call fcn.0041fd74
call fcn.00456396
int3
Function at 0x407a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x489800]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x415c5a40
mov ecx, dword [eax]
mov eax, dword [0x4a006c]
mov dword [ebp - 0x10], 0x4b7d0e42
mov dword [ebp - 0xc], 0x4d47585c
mov word [ebp - 8], 0x2e4b
cmp eax, dword [ecx + 4]
jle 0x407af6
push 0x4a006c
call fcn.004374fa
add esp, 4
cmp dword [0x4a006c], 0xffffffff
jne 0x407af6
lea eax, [ebp - 0x24]
mov ecx, 0x49e9ac
push eax
call fcn.00416a30
push 0x478200
call fcn.00437921
push 0x4a006c
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e9ac
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x4081f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x415c4d6f
mov bl, 0x2e
mov dword [ebp - 0x10], 0x6f5d4740
mov ecx, dword [eax]
mov eax, dword [0x4a088c]
mov dword [ebp - 0xc], 0x5a404b49
cmp eax, dword [ecx + 4]
jle 0x408275
push 0x4a088c
call fcn.004374fa
add esp, 4
cmp dword [0x4a088c], 0xffffffff
jne 0x408275
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x478030
movq qword [0x49eb00], xmm0
mov dword [0x49eb08], eax
mov byte [0x49eb0c], bl
call fcn.00437921
push 0x4a088c
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49eb00
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x408330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x475a406f
mov dword [ebp - 0xc], 0x5b5c4758
mov word [ebp - 8], 0x2e5d
mov ecx, dword [eax]
mov eax, dword [0x4a05f8]
cmp eax, dword [ecx + 4]
jle 0x4083ad
push 0x4a05f8
call fcn.004374fa
add esp, 4
cmp dword [0x4a05f8], 0xffffffff
jne 0x4083ad
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x477ff0
movq qword [0x4a0244], xmm0
mov word [0x4a024c], ax
call fcn.00437921
push 0x4a05f8
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0244
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret
Function at 0x408440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x489c30]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x424b4d4d
mov ecx, dword [eax]
mov eax, dword [0x49eb98]
mov dword [ebp - 0xc], 0x5a4f5c4b
mov word [ebp - 8], 0x5c41
mov byte [ebp - 6], 0x2e
cmp eax, dword [ecx + 4]
jle 0x4084c3
push 0x49eb98
call fcn.004374fa
add esp, 4
cmp dword [0x49eb98], 0xffffffff
jne 0x4084c3
lea eax, [ebp - 0x20]
mov ecx, 0x49e5dc
push eax
call fcn.00416920
push 0x477fa0
call fcn.00437921
push 0x49eb98
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e5dc
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x408570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x474a4b63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x5c4b7d4f
mov ecx, dword [eax]
mov eax, dword [0x4a0864]
mov dword [ebp - 0xc], 0x4b4d4758
cmp eax, dword [ecx + 4]
jle 0x408603
push 0x4a0864
call fcn.004374fa
add esp, 4
cmp dword [0x4a0864], 0xffffffff
jne 0x408603
movaps xmm0, xmmword [0x4898b0]
mov eax, dword [ebp - 0xc]
movups xmmword [0x49ec8c], xmm0
push 0x477f40
movq xmm0, qword [ebp - 0x14]
movq qword [0x49ec9c], xmm0
mov dword [0x49eca4], eax
mov byte [0x49eca8], bl
call fcn.00437921
push 0x4a0864
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ec8c
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x4086b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x5a404b43
mov dword [ebp - 0xc], 0x585c4b7d
mov dword [ebp - 8], 0x2e4b4d47
mov ecx, dword [eax]
mov eax, dword [0x49e614]
cmp eax, dword [ecx + 4]
jle 0x40873a
push 0x49e614
call fcn.004374fa
add esp, 4
cmp dword [0x49e614], 0xffffffff
jne 0x40873a
movaps xmm0, xmmword [0x4898a0]
mov eax, dword [ebp - 8]
movups xmmword [0x49eac8], xmm0
push 0x477f00
movq xmm0, qword [ebp - 0x10]
movq qword [0x49ead8], xmm0
mov dword [0x49eae0], eax
call fcn.00437921
push 0x49e614
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49eac8
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret
Function at 0x408b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x7d495d6b
mov dword [ebp - 0xc], 0x5c4b6546
mov dword [ebp - 8], 0x2e424b40
mov ecx, dword [eax]
mov eax, dword [0x49ffb4]
cmp eax, dword [ecx + 4]
jle 0x408bbc
push 0x49ffb4
call fcn.004374fa
add esp, 4
cmp dword [0x49ffb4], 0xffffffff
jne 0x408bbc
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x477e20
movq qword [0x49e668], xmm0
mov dword [0x49e670], eax
call fcn.00437921
push 0x49ffb4
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e668
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x408bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x7d716f68
mov bl, 0x2e
mov dword [ebp - 0x10], 0x4a4b464d
mov ecx, dword [eax]
mov eax, dword [0x49e674]
mov dword [ebp - 0xc], 0x5c4b425b
cmp eax, dword [ecx + 4]
jle 0x408c55
push 0x49e674
call fcn.004374fa
add esp, 4
cmp dword [0x49e674], 0xffffffff
jne 0x408c55
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x477e00
movq qword [0x49e4d8], xmm0
mov dword [0x49e4e0], eax
mov byte [0x49e4e4], bl
call fcn.00437921
push 0x49e674
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e4d8
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x408eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x636f6c63
mov dword [ebp - 0xc], 0x585c4b7d
mov dword [ebp - 8], 0x2e4b4d47
mov ecx, dword [eax]
mov eax, dword [0x49eab0]
cmp eax, dword [ecx + 4]
jle 0x408f2c
push 0x49eab0
call fcn.004374fa
add esp, 4
cmp dword [0x49eab0], 0xffffffff
jne 0x408f2c
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x477d70
movq qword [0x4a0570], xmm0
mov dword [0x4a0578], eax
call fcn.00437921
push 0x49eab0
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0570
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret
Function at 0x409090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x4b486f4d
mov bl, 0x2e
mov dword [ebp - 0x10], 0x4f5c684b
mov ecx, dword [eax]
mov eax, dword [0x4a09e8]
mov dword [ebp - 0xc], 0x41594b43
mov word [ebp - 8], 0x455c
cmp eax, dword [ecx + 4]
jle 0x409133
push 0x4a09e8
call fcn.004374fa
add esp, 4
cmp dword [0x4a09e8], 0xffffffff
jne 0x409133
movaps xmm0, xmmword [0x489b10]
mov eax, dword [ebp - 0xc]
movups xmmword [0x49e644], xmm0
mov dword [0x49e65c], eax
movq xmm0, qword [ebp - 0x14]
mov ax, word [ebp - 8]
push 0x477d00
movq qword [0x49e654], xmm0
mov word [0x49e660], ax
mov byte [0x49e662], bl
call fcn.00437921
push 0x4a09e8
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e644
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x4091e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x4f7a4d63
mov dword [ebp - 0x10], 0x4f63455d
mov dword [ebp - 0xc], 0x4b494f40
mov ecx, dword [eax]
mov eax, dword [0x49ff78]
mov word [ebp - 8], 0x2e5c
cmp eax, dword [ecx + 4]
jle 0x40926c
push 0x49ff78
call fcn.004374fa
add esp, 4
cmp dword [0x49ff78], 0xffffffff
jne 0x40926c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49ed2c], eax
mov ax, word [ebp - 8]
push 0x477cc0
movq qword [0x49ed24], xmm0
mov word [0x49ed30], ax
call fcn.00437921
push 0x49ff78
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ed24
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x409420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x57544143
mov dword [ebp - 0x10], 0x4c415c5e
mov dword [ebp - 0xc], 0x5b454d4f
mov ecx, dword [eax]
mov eax, dword [0x4a0470]
mov word [ebp - 8], 0x2e5e
cmp eax, dword [ecx + 4]
jle 0x4094ac
push 0x4a0470
call fcn.004374fa
add esp, 4
cmp dword [0x4a0470], 0xffffffff
jne 0x4094ac
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a08cc], eax
mov ax, word [ebp - 8]
push 0x477c50
movq qword [0x4a08c4], xmm0
mov word [0x4a08d0], ax
call fcn.00437921
push 0x4a0470
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a08c4
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret
Function at 0x4094c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x5a6a5d63
mov dword [ebp - 0xc], 0x5c4b7d5d
mov dword [ebp - 8], 0x2e5c4b58
mov ecx, dword [eax]
mov eax, dword [0x49eac4]
cmp eax, dword [ecx + 4]
jle 0x40953c
push 0x49eac4
call fcn.004374fa
add esp, 4
cmp dword [0x49eac4], 0xffffffff
jne 0x40953c
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x477c30
movq qword [0x4a08fc], xmm0
mov dword [0x4a0904], eax
call fcn.00437921
push 0x49eac4
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a08fc
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x4096b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x566b7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x404f464d
mov ecx, dword [eax]
mov eax, dword [0x4a03b4]
mov dword [ebp - 0xc], 0x7d6b4b49
cmp eax, dword [ecx + 4]
jle 0x409735
push 0x4a03b4
call fcn.004374fa
add esp, 4
cmp dword [0x4a03b4], 0xffffffff
jne 0x409735
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x477bb0
movq qword [0x49e99c], xmm0
mov dword [0x49e9a4], eax
mov byte [0x49e9a8], bl
call fcn.00437921
push 0x4a03b4
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e99c
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x409750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x566b7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x404f464d
mov ecx, dword [eax]
mov eax, dword [0x49ff28]
mov dword [ebp - 0xc], 0x7d674b49
cmp eax, dword [ecx + 4]
jle 0x4097d5
push 0x49ff28
call fcn.004374fa
add esp, 4
cmp dword [0x49ff28], 0xffffffff
jne 0x4097d5
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x477b90
movq qword [0x4a03b8], xmm0
mov dword [0x4a03c0], eax
mov byte [0x4a03c4], bl
call fcn.00437921
push 0x49ff28
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a03b8
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret
Function at 0x4097f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x566b7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x404f464d
mov ecx, dword [eax]
mov eax, dword [0x49e748]
mov dword [ebp - 0xc], 0x69634b49
mov word [ebp - 8], 0x7a63
cmp eax, dword [ecx + 4]
jle 0x409885
push 0x49e748
call fcn.004374fa
add esp, 4
cmp dword [0x49e748], 0xffffffff
jne 0x409885
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49ebd4], eax
mov ax, word [ebp - 8]
push 0x477b60
movq qword [0x49ebcc], xmm0
mov word [0x49ebd8], ax
mov byte [0x49ebda], bl
call fcn.00437921
push 0x49e748
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ebcc
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x4098a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x566b7d63
mov dword [ebp - 0x10], 0x404f464d
mov dword [ebp - 0xc], 0x7a634b49
mov ecx, dword [eax]
mov eax, dword [0x49ee10]
mov word [ebp - 8], 0x2e6f
cmp eax, dword [ecx + 4]
jle 0x40992c
push 0x49ee10
call fcn.004374fa
add esp, 4
cmp dword [0x49ee10], 0xffffffff
jne 0x40992c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a097c], eax
mov ax, word [ebp - 8]
push 0x477b40
movq qword [0x4a0974], xmm0
mov word [0x4a0980], ax
call fcn.00437921
push 0x49ee10
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0974
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x409940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x566b7d63
mov bl, 0x2e
mov dword [ebp - 0x10], 0x404f464d
mov ecx, dword [eax]
mov eax, dword [0x4a0240]
mov dword [ebp - 0xc], 0x6f7d4b49
cmp eax, dword [ecx + 4]
jle 0x4099c5
push 0x4a0240
call fcn.004374fa
add esp, 4
cmp dword [0x4a0240], 0xffffffff
jne 0x4099c5
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x477b20
movq qword [0x4a02f0], xmm0
mov dword [0x4a02f8], eax
mov byte [0x4a02fc], bl
call fcn.00437921
push 0x4a0240
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a02f0
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret