joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5d051c
mov dword [ebp - 0x24], 0x73002f
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6c0069
push edi
mov dword [ebp - 0x1c], 0x6e0065
mov edx, 0x11
mov dword [ebp - 0x18], 0x5f0074
sub esi, eax
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x46e40e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46e40e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e3f0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d051c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46e440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x77002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x5d0584
mov dword [ebp - 0x20], 0x5f0064
push edi
mov dword [ebp - 0x1c], 0x6f0070
mov edx, 0x10
mov dword [ebp - 0x18], 0x750070
sub esi, eax
mov dword [ebp - 0x14], 0x5f0070
mov dword [ebp - 0x10], 0x680073
mov dword [ebp - 0xc], 0x77006f
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x46e4be
movzx ecx, word [esi + eax]
test cx, cx
je 0x46e4be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e4a0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5d0584
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46e4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d0618
mov dword [ebp - 0x1c], 0x73002f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x740072
mov edx, 0xd
mov dword [ebp - 0x10], 0x66005f
sub esi, eax
mov dword [ebp - 0xc], 0x6f0072
mov dword [ebp - 8], 0x6d
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x46e54e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46e54e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e530
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0618
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x46e5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d04e0
mov dword [ebp - 0x28], 0x2d002d
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x750070
mov dword [ebp - 0x20], 0x680073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x6a002d
sub esi, eax
mov dword [ebp - 0x18], 0x77006b
mov dword [ebp - 0x14], str.TJ0p
mov dword [ebp - 0x10], 0x6c0069
mov dword [ebp - 0xc], 0x6e0065
mov dword [ebp - 8], 0x74
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x46e66e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46e66e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e650
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d04e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46e690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5d065c
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], str._EE7
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], 0x610069
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], str._6_G
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x46e72e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46e72e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e710
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d065c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46e7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d0640
mov dword [ebp - 0x1c], 0x4f0053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x540046
mov dword [ebp - 0x14], 0x410057
mov edx, 0xd
mov dword [ebp - 0x10], 0x450052
sub esi, eax
mov dword [ebp - 0xc], 0x25005c
mov dword [ebp - 8], 0x73
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x46e84e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46e84e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e830
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0640
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x46e870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x64002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5d05a4
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x790061
mov edx, 0xc
mov dword [ebp - 0x10], 0x6c005f
sub esi, eax
mov dword [ebp - 0xc], 0x6b006e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x46e8de
movzx ecx, word [esi + eax]
test cx, cx
je 0x46e8de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e8c0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d05a4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46e900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d0754
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x46e96e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46e96e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e950
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0754
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46e990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d0540
mov dword [ebp - 0x28], 0x63002f
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x740061
mov edx, 0x13
mov dword [ebp - 0x1c], 0x5f0065
sub esi, eax
mov dword [ebp - 0x18], 0x650064
mov dword [ebp - 0x14], 0x6b0073
mov dword [ebp - 0x10], 0x69005f
mov dword [ebp - 0xc], 0x6f0063
mov dword [ebp - 8], 0x6e
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x46ea0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46ea0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46e9f0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0540
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x46ecf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5d06b8
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x46ed73
movzx ecx, word [esi + eax]
test cx, cx
je 0x46ed73
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46ed55
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d06b8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46eda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d05bc
mov dword [ebp - 0x20], 0x64002f
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x790061
mov edx, 0xf
mov dword [ebp - 0x14], 0x75005f
sub esi, eax
mov dword [ebp - 0x10], str.t__5H_Wzs
mov dword [ebp - 0xc], 0x73006e
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x46ee0f
movzx ecx, word [esi + eax]
test cx, cx
je 0x46ee0f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46edf1
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d05bc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46ee30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5d0690
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x46eeb3
movzx ecx, word [esi + eax]
test cx, cx
je 0x46eeb3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46ee95
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0690
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x46f9e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d0880
mov dword [ebp - 0x20], 0x64002f
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x790061
mov edx, 0xf
mov dword [ebp - 0x14], 0x75005f
sub esi, eax
mov dword [ebp - 0x10], str.t__5H_Wzs
mov dword [ebp - 0xc], 0x73006e
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x46fa4f
movzx ecx, word [esi + eax]
test cx, cx
je 0x46fa4f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46fa31
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0880
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46fa70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d082c
mov dword [ebp - 0x1c], 0x5f004d
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x5f0069
mov dword [ebp - 0x14], 0x5f0063
mov edx, 0xd
mov dword [ebp - 0x10], 0x5f0044
sub esi, eax
mov dword [ebp - 0xc], 0x5f0069
mov dword [ebp - 8], 0x72
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x46fade
movzx ecx, word [esi + eax]
test cx, cx
je 0x46fade
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46fac0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d082c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x46fb00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d07a4
mov dword [ebp - 0x28], 0x2d002d
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x750070
mov dword [ebp - 0x20], 0x680073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x6a002d
sub esi, eax
mov dword [ebp - 0x18], 0x77006b
mov dword [ebp - 0x14], str.TJ0p
mov dword [ebp - 0x10], 0x6c0069
mov dword [ebp - 0xc], 0x6e0065
mov dword [ebp - 8], 0x74
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x46fb7e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46fb7e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46fb60
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d07a4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x46ff60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x77002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x5d0848
mov dword [ebp - 0x20], 0x5f0064
push edi
mov dword [ebp - 0x1c], 0x6f0070
mov edx, 0x10
mov dword [ebp - 0x18], 0x750070
sub esi, eax
mov dword [ebp - 0x14], 0x5f0070
mov dword [ebp - 0x10], 0x680073
mov dword [ebp - 0xc], 0x77006f
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x46ffde
movzx ecx, word [esi + eax]
test cx, cx
je 0x46ffde
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46ffc0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5d0848
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x470000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x720067
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5d09e4
mov dword [ebp - 0x1c], 0x700061
mov dword [ebp - 0x18], 0x2e0068
mov edx, 0xe
mov dword [ebp - 0x14], 0x710071
sub esi, eax
mov dword [ebp - 0x10], 0x63002e
mov dword [ebp - 0xc], 0x6d006f
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x47006e
movzx ecx, word [esi + eax]
test cx, cx
je 0x47006e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470050
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d09e4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x470090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5d0a28
mov dword [ebp - 0x34], 0x61004d
lea esi, [ebp - 0x34]
mov dword [ebp - 0x30], 0x6e0069
push edi
mov dword [ebp - 0x2c], 0x690057
mov edx, 0x19
mov dword [ebp - 0x28], 0x64006e
sub esi, eax
mov dword [ebp - 0x24], 0x77006f
mov dword [ebp - 0x20], 0x650057
mov dword [ebp - 0x1c], 0x570062
mov dword [ebp - 0x18], 0x6e0069
mov dword [ebp - 0x14], 0x6f0064
mov dword [ebp - 0x10], 0x2e0077
mov dword [ebp - 0xc], str.G_t7
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x470124
movzx ecx, word [esi + eax]
test cx, cx
je 0x470124
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470106
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d0a28
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x470340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d0804
mov dword [ebp - 0x28], 0x63002f
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x740061
mov edx, 0x13
mov dword [ebp - 0x1c], 0x5f0065
sub esi, eax
mov dword [ebp - 0x18], 0x650064
mov dword [ebp - 0x14], 0x6b0073
mov dword [ebp - 0x10], 0x69005f
mov dword [ebp - 0xc], 0x6f0063
mov dword [ebp - 8], 0x6e
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x4703be
movzx ecx, word [esi + eax]
test cx, cx
je 0x4703be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4703a0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0804
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x4703e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x72002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5d08c0
mov dword [ebp - 0x1c], 0x630065
mov dword [ebp - 0x18], 0x72006f
mov edx, 0xe
mov dword [ebp - 0x14], 0x5f0064
sub esi, eax
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6f0066
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x47044e
movzx ecx, word [esi + eax]
test cx, cx
je 0x47044e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470430
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d08c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x470470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5d07e0
mov dword [ebp - 0x24], 0x73002f
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6c0069
push edi
mov dword [ebp - 0x1c], 0x6e0065
mov edx, 0x11
mov dword [ebp - 0x18], 0x5f0074
sub esi, eax
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x4704ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x4704ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4704d0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d07e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x470520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5d0770
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], str._EE7
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], 0x610069
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], str._6_G
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x4705be
movzx ecx, word [esi + eax]
test cx, cx
je 0x4705be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4705a0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d0770
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x4705f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5d0970
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x470673
movzx ecx, word [esi + eax]
test cx, cx
je 0x470673
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470655
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0970
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x18cc9d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18cc9de
pushal
call 0x18cc9e4
pop ebp
sub ebp, 0x10
sub ebp, 0x14cc9d4
jmp 0x18cc9fa
mov eax, 0x14cc9d4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b0
mov edx, 0x447e01bf
xor byte [eax], dl
inc eax
dec ecx
jne 0x18cca11
jmp 0x18cca24
xor al, 0x72
xor al, 0x36
cmp dword [edi + 0x7e3ebfbf], 0x47
mov edi, 0x72bcbfbf
pop es
mov ecx, 0x5bfbfbf
xchg edi, eax
mov edi, 0x5d48bfbf
mov esp, 0xb33e3477
mov edi, 0x7abcbfbf
xor bl, bl
wait
inc ebx
mov ebx, 0x37d7ef9b
xchg ecx, eax
lahf
mov edi, 0x9324f3d7
mov esi, 0xd79b93be
push eax
dec edx
inc edi
mov eax, 0xbfbfba57
mov edi, 0xbfbf9556
mov edi, 0x9bd332ea
mov edi, 0xbfb73a34
mov edi, 0xb32a34bf
mov edi, 0x3234bfbf
scasd eax, dword es:[edi]
mov edi, 0x567ebfbf
mov ebp, 0x7d3cbd8e
mov ebx, 0x4b3ab0f6
inc eax
inc eax
inc eax
loop 0x18ccb13
mov bl, 0xbf
xor al, 0x33
wait
mov ebx, 0xd7bfbfbf
aaa
xchg ecx, eax
lahf
mov edi, 0x9324f3d7
mov esi, 0x329b93be
fistp dword [ebx - 0x644cc9bd]
wait
push edi
mov edx, 0x56bfbfbf
invalid
mov edi, 0x407356fe
inc eax
inc eax
xchg esi, eax
xrelease xchg byte [esi + 0x3cba7e3c], bh
push edi
mov ebx, 0x40400256
inc eax
xchg esi, eax
jmp 0x18ccab2