joyce8/EMBER2024-capa huggingface dataset:
Function at 0x27e881f
Capabilities:
Encode data using xor

Disassembly:
call fcn.016b06b5
dec ecx
js 0x27e8875
cmp byte [eax + 0x5a4ef2a8], cl
xor dword [esi - 0xc41155f], eax
mov gs, word [edi]
adc eax, dword [esi - 0x3e99b52f]
retf 0xc108
xchg edx, eax
xlatb
mov edx, 0x9e3f4b80
pushal
sbb byte [ecx + 0x50ae0746], dh
mov ah, 0x1f
mov ebp, 0x2c164e3f
sti
jo 0x27e8837
dec ebx
mov ah, 0x5d
cmpsb byte [esi], byte es:[edi]
aaa
mov cl, 0x3b
sbb dword [edi], eax
mov dl, 0xc7
mov eax, dword [0x4eb10282]
inc eax
das
sal byte [ecx + 0x1654c39d], cl
xchg edi, eax
mov ch, 0x3d
sub byte [edi], dh
sub esp, dword [ecx - 0xbff77b]
jns 0x27e88f5
test byte [ecx - 0x36], cl
mov ebx, 0x8977596a
and dword [si + 0x38b2], ebp
xor bl, byte [0xa4c9b7fb]
jge 0x27e88ff
or al, 0x72
pop esp
dec ebp
adc bh, byte ds:[esi]
sbb eax, 0x9e9bf3f2
jo 0x27e894c
dec ebx
sub al, 0xf7
nop
hlt
insb byte es:[edi], dx
ror byte [edi - 0x17205a8d], cl
lodsb al, byte [esi]
salc
cmp al, 0xc2
mov word [edx - 0x23], fs
cmc
ret 0x5f5a
ret 0x628c
add eax, 0x7ece41d9
add esp, dword [edx + 0x6abf5d7d]
into
test dword [ecx], 0xa90f5a91
pop eax
cmpsd dword [esi], dword es:[edi]
sub eax, 0xa765d09a
in al, dx
sbb eax, 0xf0981c34
in eax, dx
and ch, dl
aam 0x23
scasb al, byte es:[edi]
dec edx
push ebp
adc byte [edx], al
dec ecx
arpl word [edi], bx
into
mov dh, 0x82
test byte [esi + 4], dl
invalid
Function at 0x27ec6eb
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
pop edx
jae fcn.0169bed5
jmp 0x27cb8c1
xor al, 3
sal dl, 0x87
jne 0x18878a5
dec dl
neg al
rol edx, 0x88
xor al, 0x23
xor bl, al
sar dl, 0x87
push edi
push esi
push ebx
mov ebx, eax
mov edx, ebx
mov eax, 0x94084427
shl edx, 2
shl ax, 0xd
shl al, 0x27
call fcn.0257bb1a
adc bh, 0xc
lodsd eax, dword [esi]
sar al, cl
in al, 0xc4
fcomp qword [esp + edi + 0x5723ee52]
push cs
pushfd
les ebp, [ebx]
xor bh, byte [esi - 0x6c]
dec esp
push ebp
and dh, byte [esi - 0x2c5fe1d1]
aad 0xb7
movsb byte es:[edi], byte [esi]
mov dword [0xc189abd5], eax
lodsb al, byte [esi]
sub bh, cl
loope 0x2509696
add al, 0
fdivr st(0), st(0)
mov gs, word [edx + esi*4 - 0x70]
jmp 0x2509709
wait
insb byte es:[edi], dx
dec esi
mov cl, 0x4e
mov al, byte [0x47e42e6d]
in eax, 0xd5
pop ss
push ss
dec edx
mov ebp, 0xd0fe5c73
wait
mov dh, 0x38
ret 0x2ab3
mov cl, byte [esi + eax - 1]
and eax, 0x700b78b3
lea esi, [eax + esi - 1]
dec al
push eax
shl dx, cl
movzx ecx, word [esp + eax - 2]
xor cl, byte [esp + eax]
mov word [esi + eax*8 - 0x10], dx
lea edi, [eax + edi - 6]
mov edx, dword [edi + eax - 2]
not dword [esp + eax*4 - 8]
call fcn.028e75ee
mov dword [esp], 0x16e11e6c
call fcn.01791fe8
mov eax, 0x488ae69d
movzx edx, al
and edx, eax
lea edi, [edi + eax - 0x488ae6a1]
xchg dx, ax
jl 0x15a1432
mov edx, dword [edi + edx*4 - 0x39a74]
setle al
sub eax, eax
xor edx, ebx
push eax
rol edx, 1
rol eax, 0x95
xor byte [esp + eax + 2], ah
inc edx
xadd byte [esp + eax + 1], ah
pop eax
cwde
not edx
btr ax, ax
shr eax, 0xf
sar al, 0x64
xor edx, 0xbe31d539
neg edx
rol al, 0xe4
inc edx
cbw
bswap edx
bts ax, ax
xor ebx, edx
add esi, edx
movzx edx, ax
imul eax
bswap edx
sbb edi, eax
div eax
not ax
movzx eax, byte [eax + edi - 0xfffe]
ror edx, 0x2d
btc edx, edx
xor al, bl
add al, 0x8b
inc edx
jg 0x2509678
div al
add ebp, edx
mov dword [esp + eax - 0x27262fe0], eax
mov dword [esp + eax*2 - 0x4e4c5fcc], eax
sal dword [esp + eax*2 - 0x4e4c5fcb], 0x82
mov edx, dword [esi + eax*2 - 0x4e4c5fd0]
mov ax, word [esi + eax*2 - 0x4e4c5fcc]
adc esi, 5
mov ecx, dword [esp + 8]
mov word [edx + ecx*2 - 0x4e4c5f40], ax
movsx edx, cl
xor dx, 0x750b
mov dword [esp + ecx*2 - 0x4e4c5f40], ebp
ret 8
Function at 0x28049d8
Capabilities:
Encode data using xor

Disassembly:
adc esi, 6
or word [esp + 2], dx
mov byte es:[eax], cl
pop edx
jmp ebp
mov bl, 0x33
ror dword [edi], cl
retf 0x334a
movzx edx, al
sub edx, eax
mov eax, dword [esi + eax - 0x1c49007f]
mov dword [esp], edx
bt ecx, ecx
mov cl, byte [esi + 4]
or dword [esp], edx
and edx, dword [esp]
jae 0x172000e
lds eax, [ebx - 0x55d352b2]
ficomp dword [eax + 2]
jp 0x2804a7d
add byte [ebx - 0x7e], bl
dec ebx
push 0x5b5b7dba
fist dword [ecx + 0x75]
add byte [ecx], 0xcf
jbe 0x280499b
push esi
movsb byte es:[edi], byte [esi]
iretd
or edx, dword [esi + 0x13]
sbb al, 0x48
sub eax, 0xa49a9539
salc
adc eax, 0xbc740964
add ecx, ebp
call 0x67fd4d6e
add dword [eax*8 - 0x66e70c35], eax
std
repne scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
mov edi, gs
xor cl, byte [0xe2381672]
mov dword [ebx + ebp*2], ecx
or eax, 0x6e197b2d
jnp 0x2804a98
outsb dx, byte [esi]
or eax, 0xaec8f70d
jmp 0x2804a4d
push esi
movsb byte es:[edi], byte [esi]
push ebp
mul byte [ebx - 0xd878670]
loopne 0x2804b1b
xor ch, byte [edi + ebp*2]
sti
cmp dword [eax - 0x18], 0x22d9b64d
into
or eax, 0xedeb8b7d
dec ebp
push es
notrack jmp 0xe75f5936
daa
pop ebp
sub dword [ebx + 0x58], 0xed774074
push esi
enter 0x476f, 0xffffffffffffffe8
push ebp
cmp byte [ebp - 0x26], dh
push eax
xor cl, byte [edx]
insb byte es:[edi], dx
pop eax
inc ecx
push ds
jae 0x2804b91
pop ds
mov bh, 0x28
out 0xcc, al
inc esi
push ss
or eax, 0x944025eb
dec ebx
and eax, 0x8dbd8220
sbb esi, dword [ebx + 0x27fa9775]
sub ah, byte [ebx - 0x22843fdc]
xor ebp, dword [ebp + 0x53]
push eax
cmp al, 0xb1
mul dword [edi - 0x799eef2e]
inc ecx
out dx, eax
pushfd
push edx
out dx, al
in eax, 0xc2
or byte [edi - 0x74a6c51f], bl
in al, dx
jmp 0x7e59ca16
in al, dx
sti
retf
sbb eax, 0x9ed40cdd
sub eax, 0xd08d35d8
outsb dx, byte [esi]
xchg dword [esi + 0x2b2d9684], esp
not byte [edx + 0x4b]
jge 0x2804bf6
jns 0x2804b83
leave
inc ecx
invalid
invalid

Function at 0x2835a7b
Capabilities:
Encode data using xor

Disassembly:
push 0x63015407
rol dword [esp], 0xfa
mov dword [esp], esi
lea esp, [esp + 0xc]
je 0x15826e0
jmp 0x17233b7

Function at 0x28e97a3
Capabilities:
Encode data using xor

Disassembly:
inc edx
dec cl
sub cx, ax
call fcn.01933489
inc ecx
mov ecx, 0x161aac2b
inc ecx
mov edx, ecx
inc edi
mov ebp, dword [ebx + ecx - 0x161aac2b]
mov ebp, 0x5f0e6211
inc ebx
mov cl, byte [ebx + ecx*4 - 0x586ab0a8]
mov edi, ebp
inc ecx
mov eax, ecx
call fcn.016a1c3a
inc ecx
mov eax, 0x3c31d335
inc ebp
movzx edi, ax
dec edi
lea esp, [esp + eax*2 - 0x7863a66e]
inc cx
shr edi, 0x42
inc ecx
movzx esi, di
inc ebx
mov ebp, dword [esp + eax - 0x3c31d335]
inc ecx
push eax
dec ecx
and esi, eax
inc ecx
xor ebp, edx
neg ebp
xor ebp, 0x4ea525b0
inc ecx
bts edi, esi
bswap ebp
neg ebp
mov edi, 0x58838b96
inc esi
movzx esi, word [esp + edi*8 - 0x1a768]
pop edx
inc ecx
push edx
dec eax
lea eax, [edi*8 - 0x4e654047]
dec ecx
and esi, 0x48028caf
inc edx
xor dword [esp + eax - 0x3c31d335], ebp
inc edi
inc ecx
pop edx
inc ecx
inc bh
dec eax
arpl bp, bp
jl 0x183d53f
adc al, 0xa8
mov ecx, 0x993e0eea
invalid
mov dword [esp + eax - 0x16], eax
jmp 0x1845286
Function at 0x290165c
Capabilities:
Get number of processors

Disassembly:
xor edi, edi
push 0xee8efe39
dec eax
xor dword [esp], 0xa925e392
jo 0x192872b
dec eax
test edx, edx
dec eax
lea esp, [esp + 0x18]
je 0x1902fd4
call fcn.0256b6ec
mov edx, 0x502dbfb7
mov dl, byte [edx + edi - 0x502dbfb7]
mov ecx, 0xd0a3f809
shr ecx, cl
movzx ax, byte [edi + ecx*2 - 0xd0a3f6]
lea ecx, [ecx*4 - 0x1ff506f6]
bswap ecx
add cx, cx
adc edi, 1
bts ecx, ecx
imul cx, cx

Function at 0x291630d
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x5e99e0b6
adc esi, 5
push 0x3f8bacb7
mov edi, dword [edi]
rol dword [esp + 4], 0x11
ror word [esp + 4], 0x85
shrd edx, eax, cl
mov eax, dword [esp + 4]
neg word [esp + 2]
call fcn.01662657
or dword [ebx + 0x2c399e78], ebx
mov edx, 0xa9344b58
aaa
mov cl, 0x23
add eax, 0xb4a264d0
in eax, dx
push edx
mov dl, 0x3f
dec esi
xor al, 0xd
cmovge esp, dword [esi - 0x46e9466a]
mov cl, 0x7b
cmp ebx, edx
dec esi
mov dl, 0xa8
cmc
jae 0x291631e
dec edx
cli
cmp dword [0xcf2747b3], ebp
jb 0x29163c4
movsb byte es:[edi], byte [esi]
arpl word [edi + ebp*2 - 0x2aeea914], cx
and byte [0xa2381d27], bl
push 0x3a1ebcc
int3
mov cl, 0x60
xchg esp, eax
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5d9e0828
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..7LWLf
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x64ab326a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x408590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5ccf90
mov dword [ebp - 0x1c], str.A6__q
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov edx, 0xd
mov dword [ebp - 0x10], 0x54006c
sub esi, eax
mov dword [ebp - 0xc], 0x6d0069
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x4085fe
movzx ecx, word [esi + eax]
test cx, cx
je 0x4085fe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4085e0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5ccf90
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x408620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5ccc98
mov dword [ebp - 0x60], str.A6__q
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x740073
push edi
mov dword [ebp - 0x58], 0x6c0061
mov edx, 0x2f
mov dword [ebp - 0x54], 0x46006c
sub esi, eax
mov dword [ebp - 0x50], 0x6c0069
mov dword [ebp - 0x4c], 0x730065
mov dword [ebp - 0x48], 0x20002c
mov dword [ebp - 0x44], str.A6__q
mov dword [ebp - 0x40], 0x740073
mov dword [ebp - 0x3c], 0x6c0061
mov dword [ebp - 0x38], 0x43006c
mov dword [ebp - 0x34], str.u__b6
mov dword [ebp - 0x30], 0x650052
mov dword [ebp - 0x2c], 0x3a0073
mov dword [ebp - 0x28], 0x720020
mov dword [ebp - 0x24], 0x730065
mov dword [ebp - 0x20], 0x63005f
mov dword [ebp - 0x1c], 0x70006f
mov dword [ebp - 0x18], 0x5f0079
mov dword [ebp - 0x14], 0x750073
mov dword [ebp - 0x10], 0x630063
mov dword [ebp - 0xc], 0x730065
mov dword [ebp - 8], 0x73
lea ecx, [edx + 0x7fffffcf]
test ecx, ecx
je 0x408701
movzx ecx, word [esi + eax]
test cx, cx
je 0x408701
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4086e3
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5ccc98
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x408730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cd07c
mov dword [ebp - 0x24], 0x6e0055
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x740073
mov edx, 0x11
mov dword [ebp - 0x18], 0x6c0061
sub esi, eax
mov dword [ebp - 0x14], 0x53006c
mov dword [ebp - 0x10], 0x720074
mov dword [ebp - 0xc], 0x6e0069
mov dword [ebp - 8], 0x67
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x4087ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x4087ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408790
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd07c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x408a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x72002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5cc814
mov dword [ebp - 0x1c], 0x630065
mov dword [ebp - 0x18], 0x72006f
mov edx, 0xe
mov dword [ebp - 0x14], 0x5f0064
sub esi, eax
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6f0066
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x408a8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x408a8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408a70
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cc814
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x408ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x5c], str.A6__q
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x5c]
mov eax, 0x5cccf8
mov dword [ebp - 0x58], 0x740073
push edi
mov dword [ebp - 0x54], 0x6c0061
mov edx, 0x2c
mov dword [ebp - 0x50], 0x46006c
sub esi, eax
mov dword [ebp - 0x4c], 0x6c0069
mov dword [ebp - 0x48], 0x730065
mov dword [ebp - 0x44], 0x20002c
mov dword [ebp - 0x40], 0x490043
mov dword [ebp - 0x3c], 0x73006e
mov dword [ebp - 0x38], 0x610074
mov dword [ebp - 0x34], 0x6c006c
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x3a0073
mov dword [ebp - 0x28], 0x64003a
mov dword [ebp - 0x24], 0x77006f
mov dword [ebp - 0x20], 0x6c006e
mov dword [ebp - 0x1c], 0x61006f
mov dword [ebp - 0x18], 0x730064
mov dword [ebp - 0x14], 0x630075
mov dword [ebp - 0x10], 0x650063
mov dword [ebp - 0xc], 0x730073
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffd2]
test ecx, ecx
je 0x408b8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x408b8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408b70
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cccf8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x4095d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5ccc40
mov dword [ebp - 0x58], str.A6__q
lea esi, [ebp - 0x58]
mov dword [ebp - 0x54], 0x740073
push edi
mov dword [ebp - 0x50], 0x6c0061
mov edx, 0x2b
mov dword [ebp - 0x4c], 0x46006c
sub esi, eax
mov dword [ebp - 0x48], 0x6c0069
mov dword [ebp - 0x44], 0x730065
mov dword [ebp - 0x40], 0x20002c
mov dword [ebp - 0x3c], str.A6__q
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x6c0061
mov dword [ebp - 0x30], 0x43006c
mov dword [ebp - 0x2c], str.u__b6
mov dword [ebp - 0x28], 0x650052
mov dword [ebp - 0x24], 0x3a0073
mov dword [ebp - 0x20], 0x630020
mov dword [ebp - 0x1c], str.u__b6
mov dword [ebp - 0x18], 0x650072
mov dword [ebp - 0x14], 0x200073
mov dword [ebp - 0x10], 0x780065
mov dword [ebp - 0xc], 0x730069
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffd3]
test ecx, ecx
je 0x4096a3
movzx ecx, word [esi + eax]
test cx, cx
je 0x4096a3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409685
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5ccc40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x4096d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cce3c
mov dword [ebp - 0x20], 0x55005c
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x690074
mov dword [ebp - 0x18], 0x73006c
mov edx, 0xf
mov dword [ebp - 0x14], 0x37005c
sub esi, eax
mov dword [ebp - 0x10], 0x2e007a
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x40973f
movzx ecx, word [esi + eax]
test cx, cx
je 0x40973f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409721
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cce3c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x409760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cce5c
mov dword [ebp - 0x20], 0x55005c
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x690074
mov dword [ebp - 0x18], 0x73006c
mov edx, 0xf
mov dword [ebp - 0x14], 0x37005c
sub esi, eax
mov dword [ebp - 0x10], 0x2e007a
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x4097cf
movzx ecx, word [esi + eax]
test cx, cx
je 0x4097cf
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4097b1
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cce5c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x409a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5cc734
mov dword [ebp - 0x24], 0x73002f
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6c0069
push edi
mov dword [ebp - 0x1c], 0x6e0065
mov edx, 0x11
mov dword [ebp - 0x18], 0x5f0074
sub esi, eax
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x409ade
movzx ecx, word [esi + eax]
test cx, cx
je 0x409ade
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409ac0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cc734
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x409b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cd508
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x409b7e
movzx ecx, word [esi + eax]
test cx, cx
je 0x409b7e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409b60
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd508
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x409ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x54], str.A6__q
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x54]
mov eax, 0x5ccbf0
mov dword [ebp - 0x50], 0x740073
push edi
mov dword [ebp - 0x4c], 0x6c0061
mov edx, 0x28
mov dword [ebp - 0x48], 0x46006c
sub esi, eax
mov dword [ebp - 0x44], 0x6c0069
mov dword [ebp - 0x40], 0x730065
mov dword [ebp - 0x3c], 0x20002c
mov dword [ebp - 0x38], str.A6__q
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6c0061
mov dword [ebp - 0x2c], 0x43006c
mov dword [ebp - 0x28], str.u__b6
mov dword [ebp - 0x24], 0x650052
mov dword [ebp - 0x20], 0x3a0073
mov dword [ebp - 0x1c], 0x630020
mov dword [ebp - 0x18], str.u__b6
mov dword [ebp - 0x14], 0x650020
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffd6]
test ecx, ecx
je 0x409c6e
movzx ecx, word [esi + eax]
test cx, cx
je 0x409c6e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409c50
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5ccbf0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x40a7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x690044
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x5cd0c4
mov dword [ebp - 0x20], 0x700073
mov dword [ebp - 0x1c], 0x61006c
mov edx, 0x10
mov dword [ebp - 0x18], 0x560079
sub esi, eax
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x6e006f
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x40a85e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40a85e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40a840
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd0c4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x40a880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x57a9c0]
mov eax, 0x5ccd50
push esi
movups xmmword [ebp - 0x34], xmm0
lea esi, [ebp - 0x34]
mov dword [ebp - 0x14], 0x2864616f
movaps xmm0, xmmword [0x57aa40]
mov edx, 0x2e
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x10], 0x61662029
sub esi, eax
mov dword [ebp - 0xc], 0x64656c69
mov byte [ebp - 8], 0
nop
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x40a8e9
mov cl, byte [esi + eax]
test cl, cl
je 0x40a8e9
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x40a8d0
test edx, edx
lea ecx, [eax - 1]
pop esi
cmovne ecx, eax
mov eax, 0x5ccd50
mov byte [ecx], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x40a910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cd0a0
mov dword [ebp - 0x24], str.A6__q
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x740073
push edi
mov dword [ebp - 0x1c], 0x6c0061
mov edx, 0x11
mov dword [ebp - 0x18], 0x4c006c
sub esi, eax
mov dword [ebp - 0x14], 0x63006f
mov dword [ebp - 0x10], 0x740061
mov dword [ebp - 0xc], 0x6f0069
mov dword [ebp - 8], 0x6e
nop dword [eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x40a98e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40a98e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40a970
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5cd0a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret