This code was unobfuscated. (see Listing5.txt) Unobfuscates memory range 0x0041D575-0x0041DF39 0x41CB17: 8B5C2420 MOV EBX,DWORD PTR [ESP+0x20] 0x41CB1B: 66BB0000 MOV BX,0x0 0x41CB1F: 0FB703 MOVZX EAX,WORD PTR [EBX] 0x41CB22: 2D4D5A0000 SUB EAX,0x5A4D 0x41CB27: 7408 JZ 0x41CB31 0x41CB29: 81EB00000100 SUB EBX,0x10000 0x41CB2F: EBEE JMP 0x41CB1F 0x41CB31: 8BFB MOV EDI,EBX 0x41CB33: 037B3C ADD EDI,DWORD PTR [EBX+0x3C] 0x41CB36: 83C778 ADD EDI,0x78 0x41CB39: 8B3F MOV EDI,DWORD PTR [EDI] 0x41CB3B: 03FB ADD EDI,EBX 0x41CB3D: 57 PUSH EDI 0x41CB3E: 83C720 ADD EDI,0x20 0x41CB41: 8B3F MOV EDI,DWORD PTR [EDI] 0x41CB43: 03FB ADD EDI,EBX 0x41CB45: 33C0 XOR EAX,EAX 0x41CB47: 40 INC EAX 0x41CB48: 8B0F MOV ECX,DWORD PTR [EDI] 0x41CB4A: 03CB ADD ECX,EBX 0x41CB4C: 83C704 ADD EDI,0x4 0x41CB4F: 813947657450 CMP DWORD PTR [ECX],0x50746547 0x41CB55: 75F0 JNE 0x41CB47 0x41CB57: 817904726F6341 CMP DWORD PTR [ECX+0x4],0x41636F72 0x41CB5E: 75E7 JNE 0x41CB47 0x41CB60: 6BC002 IMUL EAX,EAX,0x2 0x41CB63: 5F POP EDI 0x41CB64: 57 PUSH EDI 0x41CB65: 83C724 ADD EDI,0x24 0x41CB68: 8B3F MOV EDI,DWORD PTR [EDI] 0x41CB6A: 03FB ADD EDI,EBX 0x41CB6C: 03F8 ADD EDI,EAX 0x41CB6E: 668B07 MOV AX,WORD PTR [EDI] 0x41CB71: 6BC004 IMUL EAX,EAX,0x4 0x41CB74: 5F POP EDI 0x41CB75: 83C71C ADD EDI,0x1C 0x41CB78: 8B3F MOV EDI,DWORD PTR [EDI] 0x41CB7A: 03FB ADD EDI,EBX 0x41CB7C: 03F8 ADD EDI,EAX 0x41CB7E: 8B7FFC MOV EDI,DWORD PTR [EDI-0x4] 0x41CB81: 03FB ADD EDI,EBX 0x41CB83: 803FCC CMP BYTE PTR [EDI],0xCC 0x41CB86: 7509 JNE 0x41CB91 0x41CB88: 33C9 XOR ECX,ECX 0x41CB8A: 33FF XOR EDI,EDI 0x41CB8C: E9C1CEFFFF JMP 0x419A52 0x41CB91: E800000000 CALL 0x41CB96 0x41CB96: 58 POP EAX 0x41CB97: 2DEC3A0000 SUB EAX,0x3AEC 0x41CB9C: B000 MOV AL,0x0 0x41CB9E: 0500200100 ADD EAX,0x12000 0x41CBA3: 8BF0 MOV ESI,EAX 0x41CBA5: 891E MOV DWORD PTR [ESI],EBX 0x41CBA7: 897E10 MOV DWORD PTR [ESI+0x10],EDI 0x41CBAA: 33C9 XOR ECX,ECX 0x41CBAC: E800000000 CALL 0x41CBB1 0x41CBB1: 5F POP EDI 0x41CBB2: 81C7C4090000 ADD EDI,0x9C4 0x41CBB8: 0FB60439 MOVZX EAX,DWORD PTR [ECX+EDI] 0x41CBBC: 83F015 XOR EAX,0x15 0x41CBBF: 880439 MOV DWORD PTR [ECX+EDI],AL 0x41CBC2: 41 INC ECX 0x41CBC3: 81F93F0C0000 CMP ECX,0xC3F 0x41CBC9: 72ED JB 0x41CBB8 0x41CBCB: EB05 JMP 0x41CBD2 before execution of loop (@0x41E1C2 0x41EB7C: FA CLI 0x41EB7D: 14F9 ADC AL,0xF9 0x41EB7F: FA CLI 0x41EB80: 155111FAEB ADC EAX,0xEBFA1151 0x41EB85: F9 STC ; <==0x0041EB95(*+0x10) 0x41EB86: 1B11 SBB EDX,DWORD PTR [ECX] 0x41EB88: 1111 ADC DWORD PTR [ECX],EDX after execution of loop (@0x41E1C2) 0x41EB7C: EB05 JMP 0x0001EB83 ; (0x41EB83); (*+0x7)