joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57c273
Capabilities:
Execute anti-debugging instructions

Disassembly:
and ah, ah
mov eax, dword [esi + 0x28]
cmc
pushfd
cmp edi, eax
pushal
lea esp, [esp + 0x24]
jae 0x5b9733
jmp 0x5ac003
not dx
push edi
mov eax, dword [esi + 0x20]
btr dx, bx
mov dword [esp + 4], ebx
bswap edx
sub dh, ch
clc
lea ecx, [ecx]
add esp, 4
inc dx
clc
jmp 0x5895ef
cmp bl, bl
test ebx, ebx
pushal
lea esp, [esp + 0x20]
je 0x566f55
call fcn.0056b687
mov ebx, dword [esp + 0x48]
pushfd
call fcn.005adfce
lea esp, [esp + 0x2c]
je 0x582d2f
push 0x63047fa1
inc edi
jmp 0x5bac97
add ch, 0x15
mov ecx, dword [eax + 8]
pushfd
mov edx, dword [eax]
push dword [esp]
push eax
pushal
mov ebx, dword [eax + 4]
test ah, 0xb
stc
cmp ecx, dword [ebp + 8]
jmp 0x586b3e
pushfd
add eax, 0xc
bt sp, 1
pushfd
cmc
cmp edi, dword [esi + 0x28]
mov word [esp], 0xc5f1
mov word [esp], dx
lea esp, [esp + 0xc]
jb 0x57c28d
pushfd
lea esp, [esp + 4]
jmp 0x5b9742

Function at 0x57c58e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and al, 0xff
mov dword [0xe8605901], eax
jbe 0x57c5b6
add byte [eax], al
call fcn.005bcb97
lds edi, [ebp + 0x47d93962]
or eax, 0xee1381a8
call ebx
les ebp, [ecx - 0x19cfa086]
sbb dword [edx + 0x2f], 0x68ac9ca5
and bh, byte [ebp + 0x4e78de92]
jmp 0x57c583
int3
Function at 0x58bdd9
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x1c], esi
pushal
lea esp, [esp + 0x3c]
call fcn.004eafab
sub cl, 0xa
shld ax, bp, cl
mov eax, dword [ebp + 0x14]
push esp
shr cl, 5
not cx
mov ecx, dword [ebp + 0xc]
mov byte [esp], bh
pushfd
clc
cmp cl, 0xf7
add esp, 0x18
pushal
call fcn.005567ac
jp 0x58be58
test eax, 0x4a7afffc
scasd eax, dword es:[edi]
jo 0x58be53
salc
inc edi
loope 0x58bdfb
mov esi, 0x1e4a90bf
leave
pushfd
aad 0xa3
cmc
rcl dword [ebx + ebp - 0x39]
cdq
mov eax, 0x2b94bc8d
add al, 0x96
mov dword [0xf020b31], eax
cld
popfd
ja 0x58be58
std
out 0xab, al
xchg ebx, eax
cwde
jno 0x58be82
lea esi, [ebx + 0x535d370]
pop es
mov byte [0x7518ffc8], al
jp 0x58be97
mul dword [eax - 5]
salc
pop edx
push 0x3d
dec eax
aas
add al, 0x63
jge 0x58be09
cmp esi, esi
arpl bx, bx
mul byte [ebx - 0x25]
pop ds
cwde
push 0xae3a6762
push ebx
pop eax
xor edi, dword [ebx]
salc
scasd eax, dword es:[edi]
lcall 0xb11f, 0x468eb426
add byte [esi + eax*4 + 0x503579b4], 0xed
in al, 6
salc
cmpsd dword [esi], dword es:[edi]
inc edx
sbb eax, 0x598662ef
xor al, 3
out 0xb5, al
invalid
add esp, esi
mov ch, 0xc6
ljmp 0xad63
inc esi
sbb al, 0xb7
xchg edx, eax
insb byte es:[di], dx
inc ecx
inc ebp
loopne 0x58be5c
mov eax, 0xadf51b93
mov byte [ebx - 0x1a], cl
mov ecx, 0xc45073a9
pushal
add al, 0x4d
lodsd eax, dword [esi]
and word ss:[ecx + edx*4 - 0x6a43de7f], di
and eax, 0xd0268fc0
loopne 0x58bee0
mov eax, dword [0xc379c9d]
xor dword [edi], 0x68
jg 0x58bef7
jle 0x58bece
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
jbe 0x58bf33
cld
retf
shr dword [ebp + 0x45], 0x4d
lodsd eax, dword [esi]
push edi
daa
mov ah, 0xd8
stosd dword es:[edi], eax
mov ch, 0xff
lcall 0x51b6, 0xacd73c6f
int3
sbb byte [ecx + 0x1141b3eb], cl
jbe 0x58bf31
add byte gs:[ebp + 0x7fa3caba], ch
test edx, 0xfe2c53b8
xchg edi, eax
leave
xchg ebp, eax
ret
sal byte [eax], 1
sbb edi, dword [edi]
push ss
mov edi, 0xf2cc0801
pop esp
outsd dx, dword [esi]
lodsb al, byte [esi]
jl 0x58bfbe
sub al, byte [edi]
salc
mov edx, 0x14b9e0bc
ljmp 0xf257
cld
test al, 0xf0
aad 0xba
xchg edx, eax
bound ebx, qword [edi + esi*8 - 0x3a]
test byte [ebx - 0x1a], cl
mov edi, 0xeefa278c
stosd dword es:[edi], eax
sub bh, 0x8a
arpl word [edx + 0x50808646], si
push edx
fidiv word [edx - 0x74]
mov edx, 0xa3a9d6d1
mov eax, 0x486f8cbd
mov word [edi + 0x48], gs
add eax, 0x1d42a7de
call 0x6de9222e
mov ah, byte [esi]
and dword [ebp + 0x1f], edx
dec byte cs:[ebx + 0x50a3f926]
jmp 0x58bf6c
les ebx, cs:[ebp + 0x2d]
mov edx, 0x88b23055
cwde
jae 0x58bf93
into
mov eax, dword [0xab93adda]
add eax, 0xb153d7d5
outsd dx, dword [esi]
les edi, [ebp - 0xfafcea8]
mov ebx, dword [edx - 0x29]
stosb byte es:[edi], al
jl 0x58c032
mov edi, 0xa885a6cf
jmp 0x58c040
outsb dx, byte [esi]
inc esp
adc al, 0xfe
aad 0xd4
dec esi
and dh, byte [ebx + 0x34]
cmp al, 0xd6
inc edi
xor edi, dword [eax]
or bh, al
aam 0x62
cmp cl, bl
mov cl, 0x48
and al, 0x30
or ecx, dword [eax]
xlatb
wait
insd dword es:[edi], dx
xchg edi, eax
insb byte es:[edi], dx
wait
outsb dx, byte [esi]
push ds
clc
test dword [esi - 0x10], ebx
invalid
cmp byte [eax], cl
invalid
Function at 0x59160f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
call fcn.004ea751
or bh, bh
xor bl, 0xa8
jbe 0x567d17
sal ebx, 4
mov ebx, dword [ebp - 4]
rol esi, 0x14
mov esi, dword [ebp - 8]
cmc
push edi
call fcn.0055d36f
push eax
sub esi, edi
mov eax, dword [0xee47d7ea]
adc ah, bl
xor eax, ecx
xchg ebx, eax
dec eax
pop ss
cmp bl, ah
mov bl, 0xce
xchg edi, eax
xor cl, byte [ecx]
mov esp, 0x5123fa4
leave
xor dword [edx + 0x13389d0e], esi
mov ebp, 0x704bd694
mov bh, 0x54
ljmp 0x6054

Function at 0x5991f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + 0x64b4b42c]
mov dh, 4
push eax
pushal
mov edx, ebx
lea edx, [ebp - 0xd0]
push esp
jmp 0x59abcb
lea esp, [esp + 0x48]
je 0x58b4ca
bswap cx
push 0x6adb7
lea ecx, [eax*8 + 0x10390923]
movsx cx, al
jmp 0x5a2cf8
mov dword [esp + 0x1c], ecx
lea esp, [esp + 0x1c]
jg 0x4e0d72
push eax
lea edx, [edx*2 + 0x23615483]
lea edx, [ebp - 0xd0]
pushfd
mov byte [esp], ch
mov byte [esp], cl
lea esp, [esp + 4]
call fcn.004e1ca0
bswap ax
rdtsc
cdq
lea edx, [ebp - 0xd0]
mov al, 0x76
pushal
call fcn.0059ed7c
pushal
shld ax, bp, cl
not ah
sal ah, 2
mov eax, edi
lea esp, [esp + 0x20]
push 0xa06ee9ec
and eax, 0xf
mov dword [esp], 0x1dfa0a2e
cmp al, 0xf
movsx ax, bl
movsx eax, cl
mov eax, 0x4f6fb8
push esp
pushfd
lea esp, [esp + 0xc]
je 0x586b69
lahf
jmp 0x586b5c
mov ecx, dword [ebp - 0x1a8]
push 0x28549f0b
lea esp, [esp + 4]
call fcn.004155d0
push eax
pushfd
push ecx
pushfd
mov dword [ebp - 0x248], eax
pushfd
pushal
pushfd
lea esp, [esp + 0x38]
jmp fcn.0058b4d9
bt di, 0xf
add esp, 0x24
jmp 0x57a29e
push ebx
pushal
mov dword [ebp - 0x1a8], eax
test bl, 0x5b
mov byte [esp], 0x76
test ecx, 0x99c4634b
cmp dword [ebp - 0x1a8], 0
pushal
push dword [esp + 8]
jmp 0x4e1bf5
jmp 0x5b319b
bswap ax
pushfd
mov eax, 0x4f6fc4
lea esp, [esp + 4]
seta dl
movzx ecx, byte [edi + ebx]
movsx dx, dl
not dl
pushal
jmp 0x4e99f6
bswap dx
not dl
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x4d0]
pushfd
call fcn.004e182a
call fcn.005bdadd
push 0xee096c35
push eax
pushal
mov di, 0x27e1
mov dword [esp + 0x24], esi
pop edi
pop edi
mov edi, eax
mov byte [esp], bh
lea esp, [esp + 0x1c]
call fcn.004ea751
neg bh
mov ebx, dword [ebp - 4]
adc si, dx
bswap si
ror si, cl
rcl si, 0xd
mov esi, dword [ebp - 8]
stc
jmp 0x5be661
push dword [esp]
pushfd
lea esp, [esp + 0x2c]
call fcn.004e1ca0
lea eax, [esi + 0x12873614]
lea edx, [ebp - 0xd0]
call fcn.0055bbb9
push 0x3ab6bebd
lea esp, [esp + 0xc]
call fcn.0049d93d
pushal
cmc
jmp 0x577f6a
jmp 0x571894
pushal
lea esp, [esp + 0x24]
jl 0x55ec3a
xchg di, cx
mov edi, dword [ebp + 0x10]
push ebx
not cx
lea ecx, [edi*2 + 0x25b92d30]
jmp 0x5991e6
cmc
add esp, 4
push ebp
pushal
lea esp, [esp + 0x24]
jmp fcn.005b4228

Function at 0x5b44cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5c373d
mov byte [esp + 0xc], 0xd6
mov byte [esp], 0xd0
lea esp, [esp + 0x54]
jb 0x5ac046

Function at 0x5be646
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
add esp, 0x10
pushal
lea esp, [esp + 0x20]
jmp fcn.005b4228
Function at 0x5bf999
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], ebx
cmp cl, 0xe4
sub ebx, ebx
call fcn.005bae50

Function at 0x5bf9a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0xf65f1abd
lea esp, [esp + 0x38]
call fcn.004ea746
mov si, si
call fcn.00555c37

Function at 0x5bf9c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
call fcn.00590122
mov byte [esp + 0xc], al
mov dword [esp + 0xc], 0
push dword [esp]
mov dword [esp + 0xc], 0x5c3e61
pushal
jmp 0x4e41db
Function at 0x408590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5ccf90
mov dword [ebp - 0x1c], 0x6e0049
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov edx, 0xd
mov dword [ebp - 0x10], 0x54006c
sub esi, eax
mov dword [ebp - 0xc], 0x6d0069
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x4085fe
movzx ecx, word [esi + eax]
test cx, cx
je 0x4085fe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4085e0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5ccf90
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x408620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5ccc98
mov dword [ebp - 0x60], 0x6e0049
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x740073
push edi
mov dword [ebp - 0x58], 0x6c0061
mov edx, 0x2f
mov dword [ebp - 0x54], 0x46006c
sub esi, eax
mov dword [ebp - 0x50], 0x6c0069
mov dword [ebp - 0x4c], 0x730065
mov dword [ebp - 0x48], 0x20002c
mov dword [ebp - 0x44], 0x6e0049
mov dword [ebp - 0x40], 0x740073
mov dword [ebp - 0x3c], 0x6c0061
mov dword [ebp - 0x38], 0x43006c
mov dword [ebp - 0x34], str._vR4X_
mov dword [ebp - 0x30], 0x650052
mov dword [ebp - 0x2c], 0x3a0073
mov dword [ebp - 0x28], 0x720020
mov dword [ebp - 0x24], 0x730065
mov dword [ebp - 0x20], 0x63005f
mov dword [ebp - 0x1c], 0x70006f
mov dword [ebp - 0x18], 0x5f0079
mov dword [ebp - 0x14], 0x750073
mov dword [ebp - 0x10], 0x630063
mov dword [ebp - 0xc], 0x730065
mov dword [ebp - 8], 0x73
lea ecx, [edx + 0x7fffffcf]
test ecx, ecx
je 0x408701
movzx ecx, word [esi + eax]
test cx, cx
je 0x408701
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4086e3
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5ccc98
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x408730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cd07c
mov dword [ebp - 0x24], 0x6e0055
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x740073
mov edx, 0x11
mov dword [ebp - 0x18], 0x6c0061
sub esi, eax
mov dword [ebp - 0x14], 0x53006c
mov dword [ebp - 0x10], 0x720074
mov dword [ebp - 0xc], 0x6e0069
mov dword [ebp - 8], 0x67
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x4087ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x4087ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408790
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd07c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x4087d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5ccda8
mov dword [ebp - 0x58], 0x650063
lea esi, [ebp - 0x58]
mov dword [ebp - 0x54], 0x680066
push edi
mov dword [ebp - 0x50], 0x6c0065
mov edx, 0x2b
mov dword [ebp - 0x4c], 0x650070
sub esi, eax
mov dword [ebp - 0x48], 0x2e0072
mov dword [ebp - 0x44], 0x6c0064
mov dword [ebp - 0x40], 0x20006c
mov dword [ebp - 0x3c], 0x740053
mov dword [ebp - 0x38], 0x720061
mov dword [ebp - 0x34], 0x450074
mov dword [ebp - 0x30], 0x200078
mov dword [ebp - 0x2c], str.9_d
mov dword [ebp - 0x28], 0x63006e
mov dword [ebp - 0x24], str.R_n_M
mov dword [ebp - 0x20], 0x6e006f
mov dword [ebp - 0x1c], 0x690020
mov dword [ebp - 0x18], 0x200073
mov dword [ebp - 0x14], 0x75006e
mov dword [ebp - 0x10], 0x6c006c
mov dword [ebp - 0xc], 0x740070
mov dword [ebp - 8], 0x72
lea ecx, [edx + 0x7fffffd3]
test ecx, ecx
je 0x4088a3
movzx ecx, word [esi + eax]
test cx, cx
je 0x4088a3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408885
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5ccda8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x4088d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x80], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x80]
mov eax, 0x5cd178
mov dword [ebp - 0x7c], 0x700074
push edi
mov dword [ebp - 0x78], 0x2f003a
mov edx, 0x3e
mov dword [ebp - 0x74], 0x74002f
sub esi, eax
mov dword [ebp - 0x70], 0x2e0067
mov dword [ebp - 0x6c], str.46381
mov dword [ebp - 0x68], 0x6a006f
mov dword [ebp - 0x64], 0x6b0069
mov dword [ebp - 0x60], 0x2e0065
mov dword [ebp - 0x5c], 0x6f0063
mov dword [ebp - 0x58], 0x2e006d
mov dword [ebp - 0x54], 0x6e0063
mov dword [ebp - 0x50], str.iuC
mov dword [ebp - 0x4c], 0x67006f
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x64002f
mov dword [ebp - 0x40], 0x730069
mov dword [ebp - 0x3c], 0x650070
mov dword [ebp - 0x38], 0x73006e
mov dword [ebp - 0x34], 0x3f0065
mov dword [ebp - 0x30], 0x680063
mov dword [ebp - 0x2c], 0x6e0061
mov dword [ebp - 0x28], 0x65006e
mov dword [ebp - 0x24], 0x3d006c
mov dword [ebp - 0x20], 0x640077
mov dword [ebp - 0x1c], 0x75005f
mov dword [ebp - 0x18], 0x69006e
mov dword [ebp - 0x14], 0x73006e
mov dword [ebp - 0x10], str.46381
mov dword [ebp - 0xc], 0x6c006c
nop dword [eax]
lea ecx, [edx + 0x7fffffc0]
test ecx, ecx
je 0x4089ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x4089ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4089d0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cd178
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x408a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x72002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5cc814
mov dword [ebp - 0x1c], 0x630065
mov dword [ebp - 0x18], 0x72006f
mov edx, 0xe
mov dword [ebp - 0x14], 0x5f0064
sub esi, eax
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6f0066
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x408a8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x408a8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408a70
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cc814
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x408ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x5c], 0x6e0049
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x5c]
mov eax, 0x5cccf8
mov dword [ebp - 0x58], 0x740073
push edi
mov dword [ebp - 0x54], 0x6c0061
mov edx, 0x2c
mov dword [ebp - 0x50], 0x46006c
sub esi, eax
mov dword [ebp - 0x4c], 0x6c0069
mov dword [ebp - 0x48], 0x730065
mov dword [ebp - 0x44], 0x20002c
mov dword [ebp - 0x40], 0x490043
mov dword [ebp - 0x3c], 0x73006e
mov dword [ebp - 0x38], str.46381
mov dword [ebp - 0x34], 0x6c006c
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x3a0073
mov dword [ebp - 0x28], 0x64003a
mov dword [ebp - 0x24], 0x77006f
mov dword [ebp - 0x20], 0x6c006e
mov dword [ebp - 0x1c], 0x61006f
mov dword [ebp - 0x18], 0x730064
mov dword [ebp - 0x14], 0x630075
mov dword [ebp - 0x10], 0x650063
mov dword [ebp - 0xc], 0x730073
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffd2]
test ecx, ecx
je 0x408b8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x408b8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408b70
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cccf8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x4095d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5ccc40
mov dword [ebp - 0x58], 0x6e0049
lea esi, [ebp - 0x58]
mov dword [ebp - 0x54], 0x740073
push edi
mov dword [ebp - 0x50], 0x6c0061
mov edx, 0x2b
mov dword [ebp - 0x4c], 0x46006c
sub esi, eax
mov dword [ebp - 0x48], 0x6c0069
mov dword [ebp - 0x44], 0x730065
mov dword [ebp - 0x40], 0x20002c
mov dword [ebp - 0x3c], 0x6e0049
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x6c0061
mov dword [ebp - 0x30], 0x43006c
mov dword [ebp - 0x2c], str._vR4X_
mov dword [ebp - 0x28], 0x650052
mov dword [ebp - 0x24], 0x3a0073
mov dword [ebp - 0x20], 0x630020
mov dword [ebp - 0x1c], str._vR4X_
mov dword [ebp - 0x18], 0x650072
mov dword [ebp - 0x14], 0x200073
mov dword [ebp - 0x10], 0x780065
mov dword [ebp - 0xc], 0x730069
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffd3]
test ecx, ecx
je 0x4096a3
movzx ecx, word [esi + eax]
test cx, cx
je 0x4096a3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409685
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5ccc40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x4096d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cce3c
mov dword [ebp - 0x20], 0x55005c
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], str.R_n_M
mov dword [ebp - 0x18], 0x73006c
mov edx, 0xf
mov dword [ebp - 0x14], 0x37005c
sub esi, eax
mov dword [ebp - 0x10], 0x2e007a
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x40973f
movzx ecx, word [esi + eax]
test cx, cx
je 0x40973f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409721
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cce3c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x409760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cce5c
mov dword [ebp - 0x20], 0x55005c
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], str.R_n_M
mov dword [ebp - 0x18], 0x73006c
mov edx, 0xf
mov dword [ebp - 0x14], 0x37005c
sub esi, eax
mov dword [ebp - 0x10], 0x2e007a
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x4097cf
movzx ecx, word [esi + eax]
test cx, cx
je 0x4097cf
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4097b1
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cce5c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x409a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5cc734
mov dword [ebp - 0x24], 0x73002f
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6c0069
push edi
mov dword [ebp - 0x1c], 0x6e0065
mov edx, 0x11
mov dword [ebp - 0x18], 0x5f0074
sub esi, eax
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x409ade
movzx ecx, word [esi + eax]
test cx, cx
je 0x409ade
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409ac0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cc734
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x409b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cd508
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x409b7e
movzx ecx, word [esi + eax]
test cx, cx
je 0x409b7e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409b60
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd508
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x409ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x54], 0x6e0049
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x54]
mov eax, 0x5ccbf0
mov dword [ebp - 0x50], 0x740073
push edi
mov dword [ebp - 0x4c], 0x6c0061
mov edx, 0x28
mov dword [ebp - 0x48], 0x46006c
sub esi, eax
mov dword [ebp - 0x44], 0x6c0069
mov dword [ebp - 0x40], 0x730065
mov dword [ebp - 0x3c], 0x20002c
mov dword [ebp - 0x38], 0x6e0049
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6c0061
mov dword [ebp - 0x2c], 0x43006c
mov dword [ebp - 0x28], str._vR4X_
mov dword [ebp - 0x24], 0x650052
mov dword [ebp - 0x20], 0x3a0073
mov dword [ebp - 0x1c], 0x630020
mov dword [ebp - 0x18], str._vR4X_
mov dword [ebp - 0x14], 0x650020
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffd6]
test ecx, ecx
je 0x409c6e
movzx ecx, word [esi + eax]
test cx, cx
je 0x409c6e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409c50
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5ccbf0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret