joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x58], 0x650073
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x58]
mov eax, 0x10172128
mov dword [ebp - 0x54], 0x200074
push edi
mov dword [ebp - 0x50], 0x6f006c
mov edx, 0x29
mov dword [ebp - 0x4c], 0x6b0063
sub esi, eax
mov dword [ebp - 0x48], 0x730020
mov dword [ebp - 0x44], 0x720063
mov dword [ebp - 0x40], 0x650065
mov dword [ebp - 0x3c], 0x20006e
mov dword [ebp - 0x38], 0x6f0064
mov dword [ebp - 0x34], 0x6e0077
mov dword [ebp - 0x30], 0x6f006c
mov dword [ebp - 0x2c], 0x640061
mov dword [ebp - 0x28], 0x690020
mov dword [ebp - 0x24], 0x61006d
mov dword [ebp - 0x20], 0x650067
mov dword [ebp - 0x1c], 0x730020
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x750074
mov dword [ebp - 0x10], 0x3d0073
mov dword [ebp - 0xc], 0x640025
lea ecx, [edx + 0x7fffffd5]
test ecx, ecx
je 0x10046e62
movzx ecx, word [esi + eax]
test cx, cx
je 0x10046e62
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10046e44
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x10046f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x5c], 0x650073
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x5c]
mov eax, 0x10172188
mov dword [ebp - 0x58], 0x200074
push edi
mov dword [ebp - 0x54], 0x6f006c
mov edx, 0x2b
mov dword [ebp - 0x50], 0x6b0063
sub esi, eax
mov dword [ebp - 0x4c], 0x730020
mov dword [ebp - 0x48], 0x720063
mov dword [ebp - 0x44], 0x650065
mov dword [ebp - 0x40], 0x20006e
mov dword [ebp - 0x3c], 0x650073
mov dword [ebp - 0x38], 0x200074
mov dword [ebp - 0x34], 0x790073
mov dword [ebp - 0x30], 0x740073
mov dword [ebp - 0x2c], 0x6d0065
mov dword [ebp - 0x28], 0x690020
mov dword [ebp - 0x24], 0x61006d
mov dword [ebp - 0x20], 0x650067
mov dword [ebp - 0x1c], 0x730020
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x750074
mov dword [ebp - 0x10], 0x3d0073
mov dword [ebp - 0xc], 0x640025
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffd3]
test ecx, ecx
je 0x1004703e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004703e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10047020
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x100474c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4c0043
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x101716a8
mov dword [ebp - 0x84], 0x63006f
push edi
mov dword [ebp - 0x80], 0x53006b
mov edx, 0x41
mov dword [ebp - 0x7c], 0x720063
sub esi, eax
mov dword [ebp - 0x78], 0x650065
mov dword [ebp - 0x74], 0x49006e
mov dword [ebp - 0x70], 0x70006d
mov dword [ebp - 0x6c], 0x3a006c
mov dword [ebp - 0x68], 0x54003a
mov dword [ebp - 0x64], 0x790072
mov dword [ebp - 0x60], 0x650053
mov dword [ebp - 0x5c], 0x440074
mov dword [ebp - 0x58], 0x660065
mov dword [ebp - 0x54], 0x750061
mov dword [ebp - 0x50], 0x74006c
mov dword [ebp - 0x4c], 0x630053
mov dword [ebp - 0x48], 0x650072
mov dword [ebp - 0x44], 0x6e0065
mov dword [ebp - 0x40], 0x6f004c
mov dword [ebp - 0x3c], 0x6b0063
mov dword [ebp - 0x38], 0x480020
mov dword [ebp - 0x34], 0x760061
mov dword [ebp - 0x30], 0x460065
mov dword [ebp - 0x2c], 0x720069
mov dword [ebp - 0x28], 0x740073
mov dword [ebp - 0x24], 0x6f004c
mov dword [ebp - 0x20], 0x6b0063
mov dword [ebp - 0x1c], 0x630053
mov dword [ebp - 0x18], 0x650072
mov dword [ebp - 0x14], 0x6e0065
mov dword [ebp - 0x10], 0x6c0046
mov dword [ebp - 0xc], 0x670061
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x100475f2
movzx ecx, word [esi + eax]
test cx, cx
je 0x100475f2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100475d4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x10047610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x4c0043
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x101718f0
mov dword [ebp - 0x5c], 0x63006f
push edi
mov dword [ebp - 0x58], 0x53006b
mov edx, 0x2d
mov dword [ebp - 0x54], 0x720063
sub esi, eax
mov dword [ebp - 0x50], 0x650065
mov dword [ebp - 0x4c], 0x49006e
mov dword [ebp - 0x48], 0x70006d
mov dword [ebp - 0x44], 0x3a006c
mov dword [ebp - 0x40], 0x4f003a
mov dword [ebp - 0x3c], 0x50006e
mov dword [ebp - 0x38], 0x77006f
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x720042
mov dword [ebp - 0x2c], 0x61006f
mov dword [ebp - 0x28], 0x630064
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x330074
mov dword [ebp - 0x1c], 0x730020
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x750074
mov dword [ebp - 0x10], 0x3d0073
mov dword [ebp - 0xc], 0x640025
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x100476f0
movzx ecx, word [esi + eax]
test cx, cx
je 0x100476f0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100476d2
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x10047710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10172550
mov dword [ebp - 0x78], 0x4c0043
lea esi, [ebp - 0x78]
mov dword [ebp - 0x74], 0x63006f
push edi
mov dword [ebp - 0x70], 0x53006b
mov edx, 0x3a
mov dword [ebp - 0x6c], 0x720063
sub esi, eax
mov dword [ebp - 0x68], 0x650065
mov dword [ebp - 0x64], 0x49006e
mov dword [ebp - 0x60], 0x70006d
mov dword [ebp - 0x5c], 0x3a006c
mov dword [ebp - 0x58], 0x4f003a
mov dword [ebp - 0x54], 0x44006e
mov dword [ebp - 0x50], 0x660065
mov dword [ebp - 0x4c], 0x750061
mov dword [ebp - 0x48], 0x74006c
mov dword [ebp - 0x44], 0x6f004c
mov dword [ebp - 0x40], 0x6b0063
mov dword [ebp - 0x3c], 0x630073
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x760045
mov dword [ebp - 0x2c], 0x6e0065
mov dword [ebp - 0x28], 0x280074
mov dword [ebp - 0x24], 0x200029
mov dword [ebp - 0x20], 0x640069
mov dword [ebp - 0x1c], 0x25003d
mov dword [ebp - 0x18], 0x2c0073
mov dword [ebp - 0x14], 0x790074
mov dword [ebp - 0x10], 0x650070
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x64
nop dword [eax]
lea ecx, [edx + 0x7fffffc4]
test ecx, ecx
je 0x1004781e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004781e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10047800
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x10047ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x101724c0
mov dword [ebp - 0x64], 0x4c0043
lea esi, [ebp - 0x64]
mov dword [ebp - 0x60], 0x63006f
push edi
mov dword [ebp - 0x5c], 0x53006b
mov edx, 0x30
mov dword [ebp - 0x58], 0x720063
sub esi, eax
mov dword [ebp - 0x54], 0x650065
mov dword [ebp - 0x50], 0x49006e
mov dword [ebp - 0x4c], 0x70006d
mov dword [ebp - 0x48], 0x3a006c
mov dword [ebp - 0x44], 0x49003a
mov dword [ebp - 0x40], 0x650052
mov dword [ebp - 0x3c], 0x650073
mov dword [ebp - 0x38], 0x4c0074
mov dword [ebp - 0x34], 0x63006f
mov dword [ebp - 0x30], 0x53006b
mov dword [ebp - 0x2c], 0x720063
mov dword [ebp - 0x28], 0x650065
mov dword [ebp - 0x24], 0x45006e
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x74006e
mov dword [ebp - 0x18], 0x4c005f
mov dword [ebp - 0x14], 0x63006f
mov dword [ebp - 0x10], 0x49006b
mov dword [ebp - 0xc], 0x66006e
mov dword [ebp - 8], 0x6f
nop word [eax + eax]
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x10047d8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10047d8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10047d70
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x10048050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10171f10
mov dword [ebp - 0x8c], 0x4c0043
lea esi, [ebp - 0x8c]
mov dword [ebp - 0x88], 0x63006f
push edi
mov dword [ebp - 0x84], 0x53006b
mov edx, 0x44
mov dword [ebp - 0x80], 0x720063
sub esi, eax
mov dword [ebp - 0x7c], 0x650065
mov dword [ebp - 0x78], 0x49006e
mov dword [ebp - 0x74], 0x70006d
mov dword [ebp - 0x70], 0x3a006c
mov dword [ebp - 0x6c], 0x53003a
mov dword [ebp - 0x68], 0x6f0068
mov dword [ebp - 0x64], 0x540077
mov dword [ebp - 0x60], 0x690068
mov dword [ebp - 0x5c], 0x640072
mov dword [ebp - 0x58], 0x6f004c
mov dword [ebp - 0x54], 0x6b0063
mov dword [ebp - 0x50], 0x630053
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x6e0065
mov dword [ebp - 0x44], 0x4c0020
mov dword [ebp - 0x40], 0x63006f
mov dword [ebp - 0x3c], 0x53006b
mov dword [ebp - 0x38], 0x720063
mov dword [ebp - 0x34], 0x650065
mov dword [ebp - 0x30], 0x53006e
mov dword [ebp - 0x2c], 0x690077
mov dword [ebp - 0x28], 0x630074
mov dword [ebp - 0x24], 0x200068
mov dword [ebp - 0x20], 0x6c0063
mov dword [ebp - 0x1c], 0x73006f
mov dword [ebp - 0x18], 0x200065
mov dword [ebp - 0x14], 0x6f0073
mov dword [ebp - 0x10], 0x660020
mov dword [ebp - 0xc], 0x690061
mov dword [ebp - 8], 0x6c
nop
lea ecx, [edx + 0x7fffffba]
test ecx, ecx
je 0x1004818e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004818e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10048170
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x100481b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x7c], 0x4c0043
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x7c]
mov eax, 0x10171d68
mov dword [ebp - 0x78], 0x63006f
push edi
mov dword [ebp - 0x74], 0x53006b
mov edx, 0x3b
mov dword [ebp - 0x70], 0x720063
sub esi, eax
mov dword [ebp - 0x6c], 0x650065
mov dword [ebp - 0x68], 0x49006e
mov dword [ebp - 0x64], 0x70006d
mov dword [ebp - 0x60], 0x3a006c
mov dword [ebp - 0x5c], 0x53003a
mov dword [ebp - 0x58], 0x6f0068
mov dword [ebp - 0x54], 0x430077
mov dword [ebp - 0x50], 0x75006f
mov dword [ebp - 0x4c], 0x74006e
mov dword [ebp - 0x48], 0x6f0064
mov dword [ebp - 0x44], 0x6e0077
mov dword [ebp - 0x40], 0x6e0057
mov dword [ebp - 0x3c], 0x200064
mov dword [ebp - 0x38], 0x610067
mov dword [ebp - 0x34], 0x65006d
mov dword [ebp - 0x30], 0x730020
mov dword [ebp - 0x2c], 0x20006f
mov dword [ebp - 0x28], 0x6c0063
mov dword [ebp - 0x24], 0x73006f
mov dword [ebp - 0x20], 0x2c0065
mov dword [ebp - 0x1c], 0x730020
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x750074
mov dword [ebp - 0x10], 0x3a0073
mov dword [ebp - 0xc], 0x640025
lea ecx, [edx + 0x7fffffc3]
test ecx, ecx
je 0x100482c1
movzx ecx, word [esi + eax]
test cx, cx
je 0x100482c1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100482a3
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x100484a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x7c], 0x4c0043
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x7c]
mov eax, 0x101719b0
mov dword [ebp - 0x78], 0x63006f
push edi
mov dword [ebp - 0x74], 0x53006b
mov edx, 0x3b
mov dword [ebp - 0x70], 0x720063
sub esi, eax
mov dword [ebp - 0x6c], 0x650065
mov dword [ebp - 0x68], 0x49006e
mov dword [ebp - 0x64], 0x70006d
mov dword [ebp - 0x60], 0x3a006c
mov dword [ebp - 0x5c], 0x54003a
mov dword [ebp - 0x58], 0x790072
mov dword [ebp - 0x54], 0x650052
mov dword [ebp - 0x50], 0x6e0045
mov dword [ebp - 0x4c], 0x620061
mov dword [ebp - 0x48], 0x65006c
mov dword [ebp - 0x44], 0x6f004c
mov dword [ebp - 0x40], 0x6b0063
mov dword [ebp - 0x3c], 0x630073
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x6e0020
mov dword [ebp - 0x2c], 0x74006f
mov dword [ebp - 0x28], 0x200020
mov dword [ebp - 0x24], 0x690066
mov dword [ebp - 0x20], 0x730072
mov dword [ebp - 0x1c], 0x200074
mov dword [ebp - 0x18], 0x6f006c
mov dword [ebp - 0x14], 0x6b0063
mov dword [ebp - 0x10], 0x6c0066
mov dword [ebp - 0xc], 0x670061
lea ecx, [edx + 0x7fffffc3]
test ecx, ecx
je 0x100485b1
movzx ecx, word [esi + eax]
test cx, cx
je 0x100485b1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10048593
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x10048790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10171820
mov dword [ebp - 0x5c], 0x4c0043
lea esi, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x63006f
push edi
mov dword [ebp - 0x54], 0x53006b
mov edx, 0x2c
mov dword [ebp - 0x50], 0x720063
sub esi, eax
mov dword [ebp - 0x4c], 0x650065
mov dword [ebp - 0x48], 0x49006e
mov dword [ebp - 0x44], 0x70006d
mov dword [ebp - 0x40], 0x3a006c
mov dword [ebp - 0x3c], 0x4f003a
mov dword [ebp - 0x38], 0x50006e
mov dword [ebp - 0x34], 0x77006f
mov dword [ebp - 0x30], 0x720065
mov dword [ebp - 0x2c], 0x720042
mov dword [ebp - 0x28], 0x61006f
mov dword [ebp - 0x24], 0x630064
mov dword [ebp - 0x20], 0x730061
mov dword [ebp - 0x1c], 0x200074
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x740061
mov dword [ebp - 0x10], 0x730075
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x64
nop dword [eax]
lea ecx, [edx + 0x7fffffd2]
test ecx, ecx
je 0x1004886e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004886e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10048850
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x10048cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10171b08
mov dword [ebp - 0x5c], 0x720054
lea esi, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x520079
push edi
mov dword [ebp - 0x54], 0x450065
mov edx, 0x2c
mov dword [ebp - 0x50], 0x61006e
sub esi, eax
mov dword [ebp - 0x4c], 0x6c0062
mov dword [ebp - 0x48], 0x4c0065
mov dword [ebp - 0x44], 0x63006f
mov dword [ebp - 0x40], 0x73006b
mov dword [ebp - 0x3c], 0x720063
mov dword [ebp - 0x38], 0x650065
mov dword [ebp - 0x34], 0x20006e
mov dword [ebp - 0x30], 0x690020
mov dword [ebp - 0x2c], 0x74006e
mov dword [ebp - 0x28], 0x720065
mov dword [ebp - 0x24], 0x610076
mov dword [ebp - 0x20], 0x20006c
mov dword [ebp - 0x1c], 0x610064
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x650020
mov dword [ebp - 0x10], 0x310078
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
nop dword [eax]
lea ecx, [edx + 0x7fffffd2]
test ecx, ecx
je 0x10048dce
movzx ecx, word [esi + eax]
test cx, cx
je 0x10048dce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10048db0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x10049170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10171cc0
mov dword [ebp - 0x7c], 0x4c0043
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x78], 0x63006f
push edi
mov dword [ebp - 0x74], 0x53006b
mov edx, 0x3c
mov dword [ebp - 0x70], 0x720063
sub esi, eax
mov dword [ebp - 0x6c], 0x650065
mov dword [ebp - 0x68], 0x49006e
mov dword [ebp - 0x64], 0x70006d
mov dword [ebp - 0x60], 0x3a006c
mov dword [ebp - 0x5c], 0x53003a
mov dword [ebp - 0x58], 0x6f0068
mov dword [ebp - 0x54], 0x430077
mov dword [ebp - 0x50], 0x75006f
mov dword [ebp - 0x4c], 0x74006e
mov dword [ebp - 0x48], 0x6f0064
mov dword [ebp - 0x44], 0x6e0077
mov dword [ebp - 0x40], 0x6e0057
mov dword [ebp - 0x3c], 0x200064
mov dword [ebp - 0x38], 0x6f0073
mov dword [ebp - 0x34], 0x630020
mov dword [ebp - 0x30], 0x6f006c
mov dword [ebp - 0x2c], 0x650073
mov dword [ebp - 0x28], 0x740020
mov dword [ebp - 0x24], 0x690068
mov dword [ebp - 0x20], 0x640072
mov dword [ebp - 0x1c], 0x6c0020
mov dword [ebp - 0x18], 0x63006f
mov dword [ebp - 0x14], 0x73006b
mov dword [ebp - 0x10], 0x720063
mov dword [ebp - 0xc], 0x650065
mov dword [ebp - 8], 0x6e
lea ecx, [edx + 0x7fffffc2]
test ecx, ecx
je 0x10049282
movzx ecx, word [esi + eax]
test cx, cx
je 0x10049282
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10049264
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x10049620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10171fa8
mov dword [ebp - 0x68], 0x4c0043
lea esi, [ebp - 0x68]
mov dword [ebp - 0x64], 0x63006f
push edi
mov dword [ebp - 0x60], 0x53006b
mov edx, 0x32
mov dword [ebp - 0x5c], 0x720063
sub esi, eax
mov dword [ebp - 0x58], 0x650065
mov dword [ebp - 0x54], 0x49006e
mov dword [ebp - 0x50], 0x70006d
mov dword [ebp - 0x4c], 0x3a006c
mov dword [ebp - 0x48], 0x53003a
mov dword [ebp - 0x44], 0x6f0068
mov dword [ebp - 0x40], 0x540077
mov dword [ebp - 0x3c], 0x690068
mov dword [ebp - 0x38], 0x640072
mov dword [ebp - 0x34], 0x6f004c
mov dword [ebp - 0x30], 0x6b0063
mov dword [ebp - 0x2c], 0x630053
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x6e0065
mov dword [ebp - 0x20], 0x670020
mov dword [ebp - 0x1c], 0x6d0061
mov dword [ebp - 0x18], 0x200065
mov dword [ebp - 0x14], 0x6f0073
mov dword [ebp - 0x10], 0x660020
mov dword [ebp - 0xc], 0x690061
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffcc]
test ecx, ecx
je 0x1004970f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004970f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100496f1
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x10049730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10172018
mov dword [ebp - 0x74], 0x4c0043
lea esi, [ebp - 0x74]
mov dword [ebp - 0x70], 0x63006f
push edi
mov dword [ebp - 0x6c], 0x53006b
mov edx, 0x38
mov dword [ebp - 0x68], 0x720063
sub esi, eax
mov dword [ebp - 0x64], 0x650065
mov dword [ebp - 0x60], 0x49006e
mov dword [ebp - 0x5c], 0x70006d
mov dword [ebp - 0x58], 0x3a006c
mov dword [ebp - 0x54], 0x53003a
mov dword [ebp - 0x50], 0x6f0068
mov dword [ebp - 0x4c], 0x540077
mov dword [ebp - 0x48], 0x690068
mov dword [ebp - 0x44], 0x640072
mov dword [ebp - 0x40], 0x6f004c
mov dword [ebp - 0x3c], 0x6b0063
mov dword [ebp - 0x38], 0x630053
mov dword [ebp - 0x34], 0x650072
mov dword [ebp - 0x30], 0x6e0065
mov dword [ebp - 0x2c], 0x690020
mov dword [ebp - 0x28], 0x61006d
mov dword [ebp - 0x24], 0x650067
mov dword [ebp - 0x20], 0x740020
mov dword [ebp - 0x1c], 0x700079
mov dword [ebp - 0x18], 0x200065
mov dword [ebp - 0x14], 0x6f0073
mov dword [ebp - 0x10], 0x660020
mov dword [ebp - 0xc], 0x690061
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffc6]
test ecx, ecx
je 0x10049834
movzx ecx, word [esi + eax]
test cx, cx
je 0x10049834
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10049816
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x1004a040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x4c0043
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x10171888
mov dword [ebp - 0x5c], 0x63006f
push edi
mov dword [ebp - 0x58], 0x53006b
mov edx, 0x2d
mov dword [ebp - 0x54], 0x720063
sub esi, eax
mov dword [ebp - 0x50], 0x650065
mov dword [ebp - 0x4c], 0x49006e
mov dword [ebp - 0x48], 0x70006d
mov dword [ebp - 0x44], 0x3a006c
mov dword [ebp - 0x40], 0x4f003a
mov dword [ebp - 0x3c], 0x50006e
mov dword [ebp - 0x38], 0x77006f
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x720042
mov dword [ebp - 0x2c], 0x61006f
mov dword [ebp - 0x28], 0x630064
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x320074
mov dword [ebp - 0x1c], 0x730020
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x750074
mov dword [ebp - 0x10], 0x3d0073
mov dword [ebp - 0xc], 0x640025
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x1004a120
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004a120
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1004a102
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x1004a3e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10172450
mov dword [ebp - 0x64], 0x6f006c
lea esi, [ebp - 0x64]
mov dword [ebp - 0x60], 0x6b0063
push edi
mov dword [ebp - 0x5c], 0x630073
mov edx, 0x30
mov dword [ebp - 0x58], 0x650072
sub esi, eax
mov dword [ebp - 0x54], 0x6e0065
mov dword [ebp - 0x50], 0x750020
mov dword [ebp - 0x4c], 0x6d0043
mov dword [ebp - 0x48], 0x200064
mov dword [ebp - 0x44], 0x3d003d
mov dword [ebp - 0x40], 0x4c0020
mov dword [ebp - 0x3c], 0x63006f
mov dword [ebp - 0x38], 0x53006b
mov dword [ebp - 0x34], 0x720063
mov dword [ebp - 0x30], 0x650065
mov dword [ebp - 0x2c], 0x3a006e
mov dword [ebp - 0x28], 0x45003a
mov dword [ebp - 0x24], 0x54004e
mov dword [ebp - 0x20], 0x520045
mov dword [ebp - 0x1c], 0x44005f
mov dword [ebp - 0x18], 0x420045
mov dword [ebp - 0x14], 0x470055
mov dword [ebp - 0x10], 0x4d005f
mov dword [ebp - 0xc], 0x44004f
mov dword [ebp - 8], 0x45
nop word [eax + eax]
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x1004a4ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004a4ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1004a4b0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret