joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4356c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
mov dword [ebp - 0x424], 1
lea ecx, [ebp - 0x415]
mov dword [ebp - 0x420], 0x104
call fcn.0042f400
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x424]
push ecx
push 0x54d334
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x435804
lea ecx, [ebp - 0x415]
call fcn.0042f5c0
push eax
lea ecx, [ebp - 0x41c]
call fcn.0040b980
lea eax, [ebp - 0x41c]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a9d0
mov edx, dword [ebp - 0x41c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43577e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.bizhi
call fcn.00420f40
mov ecx, eax
call fcn.0041aa90
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x59544c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a940
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.exist_wp
mov dword [eax + 0x24], 0
call fcn.00420f40
mov ecx, eax
call fcn.0041a530
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
call fcn.00431ba0
mov ecx, eax
call fcn.00426e70
test eax, eax
jne 0x4358f8
push 1
call fcn.004222e0
add esp, 4
test eax, eax
jne 0x4358f8
lea ecx, [ebp - 0x415]
call fcn.004304e0
push eax
lea ecx, [ebp - 0x41c]
call fcn.0040b980
lea eax, [ebp - 0x41c]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a9d0
mov edx, dword [ebp - 0x41c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435872
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.bizhi
call fcn.00420f40
mov ecx, eax
call fcn.0041aa90
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x59544c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a940
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.giveup
mov dword [eax + 0x24], 0
call fcn.00420f40
mov ecx, eax
call fcn.0041a530
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
cmp dword [0x595510], 0
jne 0x435929
push 0
lea ecx, [ebp - 0x415]
mov dword [0x595510], 1
call fcn.0042fef0
push eax
push 0
push dword [0x59544c]
call fcn.00433110
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [0x590204]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x435940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push 0x208
push 0
push eax
call fcn.004c0d00
add esp, 0xc
mov dword [ebp - 0x420], 1
lea ecx, [ebp - 0x415]
mov dword [ebp - 0x41c], 0x104
call fcn.0042f320
lea ecx, [ebp - 0x41c]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x420]
push ecx
push 0x54d334
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x435a67
push esi
call fcn.00431ba0
mov ecx, eax
call fcn.00425f10
call fcn.00431ba0
mov ecx, eax
call fcn.00425870
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a9d0
push str.bizhi
call fcn.00420f40
mov ecx, eax
call fcn.0041aa90
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x59544c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a940
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.exist_wp
mov dword [eax + 0x24], 0
call fcn.00420f40
mov ecx, eax
call fcn.0041a530
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
call fcn.00431ba0
mov ecx, eax
call fcn.00426e70
test eax, eax
jne 0x435b3a
push 1
call fcn.004222e0
add esp, 4
test eax, eax
jne 0x435b3a
push esi
call fcn.00431ba0
mov ecx, eax
call fcn.00425f10
call fcn.00431ba0
mov ecx, eax
call fcn.00425870
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a9d0
push str.bizhi
call fcn.00420f40
mov ecx, eax
call fcn.0041aa90
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x59544c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a940
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.giveup
mov dword [eax + 0x24], 0
call fcn.00420f40
mov ecx, eax
call fcn.0041a530
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
cmp dword [0x595510], 0
jne 0x435b60
push 0
push esi
push 0
push dword [0x59544c]
mov dword [0x595510], 1
call fcn.00433110
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [0x590204]
xor ecx, ebp
pop esi
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret

Function at 0x435c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.00429030
test eax, eax
je 0x435c48
push 0x1000
push 0x597518
push 0x595518
call fcn.00430e70
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
call fcn.00433110
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x436a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x599e58
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x436b92
movzx ecx, word [esi + eax]
test cx, cx
je 0x436b92
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x436b74
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x436bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x599f78
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x436ce2
movzx ecx, word [esi + eax]
test cx, cx
je 0x436ce2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x436cc4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x436d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x599b80
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x436e32
movzx ecx, word [esi + eax]
test cx, cx
je 0x436e32
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x436e14
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x436e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x59a038
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x436f82
movzx ecx, word [esi + eax]
test cx, cx
je 0x436f82
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x436f64
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x436fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x599d80
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x4370d2
movzx ecx, word [esi + eax]
test cx, cx
je 0x4370d2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4370b4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x4370f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x599ca0
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x437222
movzx ecx, word [esi + eax]
test cx, cx
je 0x437222
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x437204
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x4374e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x599c10
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x437612
movzx ecx, word [esi + eax]
test cx, cx
je 0x437612
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4375f4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret

Function at 0x4378d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x64], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x64]
mov eax, 0x599ae0
mov dword [ebp - 0x60], 0x700074
push edi
mov dword [ebp - 0x5c], 0x2f003a
mov edx, 0x2f
mov dword [ebp - 0x58], 0x64002f
sub esi, eax
mov dword [ebp - 0x54], 0x2e0064
mov dword [ebp - 0x50], 0x720062
mov dword [ebp - 0x4c], 0x77006f
mov dword [ebp - 0x48], 0x650073
mov dword [ebp - 0x44], 0x2e0072
mov dword [ebp - 0x40], 0x360033
mov dword [ebp - 0x3c], 0x2e0030
mov dword [ebp - 0x38], 0x6e0063
mov dword [ebp - 0x34], 0x73002f
mov dword [ebp - 0x30], 0x610074
mov dword [ebp - 0x2c], 0x690074
mov dword [ebp - 0x28], 0x2f0063
mov dword [ebp - 0x24], 0x2f0061
mov dword [ebp - 0x20], 0x350037
mov dword [ebp - 0x1c], 0x2e0038
mov dword [ebp - 0x18], 0x320032
mov dword [ebp - 0x14], 0x340035
mov dword [ebp - 0x10], 0x67002e
mov dword [ebp - 0xc], 0x660069
nop dword [eax]
lea ecx, [edx + 0x7fffffcf]
test ecx, ecx
je 0x4379be
movzx ecx, word [esi + eax]
test cx, cx
je 0x4379be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4379a0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x437ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x599ee8
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x437bf2
movzx ecx, word [esi + eax]
test cx, cx
je 0x437bf2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x437bd4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x438070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x59a0c8
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x4381a2
movzx ecx, word [esi + eax]
test cx, cx
je 0x4381a2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x438184
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret