joyce8/EMBER2024-capa huggingface dataset:
Function at 0x685580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x685695
sub esp, 0x3c
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f346
mov byte [esp + 0x14], 0x78
mov byte [esp + 0x15], 0x35
mov byte [esp + 0x16], 0x30
mov byte [esp + 0x17], 0x39
mov byte [esp + 0x18], 0x3a
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x76
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x4e
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x6d
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x43
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x73
mov byte [esp + 0x31], 0x20
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], 0x78
mov byte [esp + 0x34], 0x74
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x36], 0x6e
mov byte [esp + 0x37], 0x73
mov byte [esp + 0x38], 0x69
mov byte [esp + 0x39], 0x6f
mov byte [esp + 0x3a], 0x6e
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x27
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x3c
ret
call fcn.0045dcb0
jmp fcn.00685580

Function at 0x685de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x685eda
sub esp, 0x38
mov dword [esp + 0x17], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f348
mov byte [esp + 0x17], 0x78
mov byte [esp + 0x18], 0x35
mov byte [esp + 0x19], 0x30
mov byte [esp + 0x1a], 0x39
mov byte [esp + 0x1b], 0x3a
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x63
mov byte [esp + 0x26], 0x6f
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x28], 0x73
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x2d], 0x6e
mov byte [esp + 0x2e], 0x74
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x76
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x75
mov byte [esp + 0x34], 0x65
mov byte [esp + 0x35], 0x3a
mov byte [esp + 0x36], 0x20
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
call fcn.0045dcb0
jmp fcn.00685de0
Function at 0x688020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68811f
sub esp, 0x38
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f348
mov byte [esp + 0x16], 0x78
mov byte [esp + 0x17], 0x35
mov byte [esp + 0x18], 0x30
mov byte [esp + 0x19], 0x39
mov byte [esp + 0x1a], 0x3a
mov byte [esp + 0x1b], 0x20
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x76
mov byte [esp + 0x1f], 0x61
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x64
mov byte [esp + 0x23], 0x20
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x25], 0x78
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0x64
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0x6b
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x79
mov byte [esp + 0x30], 0x20
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x32], 0x73
mov byte [esp + 0x33], 0x61
mov byte [esp + 0x34], 0x67
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x36], 0x73
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x21
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
call fcn.0045dcb0
jmp fcn.00688020

Function at 0x688130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68822f
sub esp, 0x38
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f348
mov byte [esp + 0x16], 0x78
mov byte [esp + 0x17], 0x35
mov byte [esp + 0x18], 0x30
mov byte [esp + 0x19], 0x39
mov byte [esp + 0x1a], 0x3a
mov byte [esp + 0x1b], 0x20
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x76
mov byte [esp + 0x1f], 0x61
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x64
mov byte [esp + 0x23], 0x20
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x25], 0x78
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0x64
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0x6b
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x79
mov byte [esp + 0x30], 0x20
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x32], 0x73
mov byte [esp + 0x33], 0x61
mov byte [esp + 0x34], 0x67
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x36], 0x73
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x21
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
call fcn.0045dcb0
jmp fcn.00688130
Function at 0x688240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x688355
sub esp, 0x3c
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f346
mov byte [esp + 0x14], 0x78
mov byte [esp + 0x15], 0x35
mov byte [esp + 0x16], 0x30
mov byte [esp + 0x17], 0x39
mov byte [esp + 0x18], 0x3a
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x76
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x73
mov byte [esp + 0x23], 0x75
mov byte [esp + 0x24], 0x62
mov byte [esp + 0x25], 0x6a
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x63
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], 0x20
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x6c
mov byte [esp + 0x2c], 0x74
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x30], 0x61
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], 0x69
mov byte [esp + 0x33], 0x76
mov byte [esp + 0x34], 0x65
mov byte [esp + 0x35], 0x20
mov byte [esp + 0x36], 0x6e
mov byte [esp + 0x37], 0x61
mov byte [esp + 0x38], 0x6d
mov byte [esp + 0x39], 0x65
mov byte [esp + 0x3a], 0x73
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x27
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x3c
ret
call fcn.0045dcb0
jmp fcn.00688240
Function at 0x688360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x688478
sub esp, 0x3c
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f347
mov byte [esp + 0x15], 0x78
mov byte [esp + 0x16], 0x35
mov byte [esp + 0x17], 0x30
mov byte [esp + 0x18], 0x39
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], 0x20
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x76
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], 0x20
mov byte [esp + 0x23], 0x73
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x62
mov byte [esp + 0x26], 0x6a
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x63
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x20
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], 0x74
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x72
mov byte [esp + 0x30], 0x6e
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x74
mov byte [esp + 0x33], 0x69
mov byte [esp + 0x34], 0x76
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x36], 0x20
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x6d
mov byte [esp + 0x3a], 0x65
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x26
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x3c
ret
call fcn.0045dcb0
jmp fcn.00688360

Function at 0x688b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x688c1d
sub esp, 0x34
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f348
mov byte [esp + 0x14], 0x78
mov byte [esp + 0x15], 0x35
mov byte [esp + 0x16], 0x30
mov byte [esp + 0x17], 0x39
mov byte [esp + 0x18], 0x3a
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x76
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x62
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x73
mov byte [esp + 0x25], 0x69
mov byte [esp + 0x26], 0x63
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x63
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], 0x74
mov byte [esp + 0x2d], 0x72
mov byte [esp + 0x2e], 0x61
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x30], 0x6e
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], 0x73
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1f
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
call fcn.0045dcb0
jmp fcn.00688b30
Function at 0x6890b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x689187
sub esp, 0x30
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x16], 0x78
mov byte [esp + 0x17], 0x35
mov byte [esp + 0x18], 0x30
mov byte [esp + 0x19], 0x39
mov byte [esp + 0x1a], 0x3a
mov byte [esp + 0x1b], 0x20
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x76
mov byte [esp + 0x1f], 0x61
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x64
mov byte [esp + 0x23], 0x20
mov byte [esp + 0x24], 0x52
mov byte [esp + 0x25], 0x53
mov byte [esp + 0x26], 0x41
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x6d
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x64
mov byte [esp + 0x2b], 0x75
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], 0x75
mov byte [esp + 0x2e], 0x73
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x19
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
call fcn.0045dcb0
jmp fcn.006890b0
Function at 0x6891a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6892f4
sub esp, 0x48
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f344
mov byte [esp + 0x15], 0x78
mov byte [esp + 0x16], 0x35
mov byte [esp + 0x17], 0x30
mov byte [esp + 0x18], 0x39
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], 0x20
mov byte [esp + 0x1b], 0x52
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x41
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x21], 0x62
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x23], 0x69
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0x20
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x78
mov byte [esp + 0x28], 0x70
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x6e
mov byte [esp + 0x2d], 0x74
mov byte [esp + 0x2e], 0x20
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x30], 0x73
mov byte [esp + 0x31], 0x20
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], 0x74
mov byte [esp + 0x35], 0x20
mov byte [esp + 0x36], 0x61
mov byte [esp + 0x37], 0x20
mov byte [esp + 0x38], 0x70
mov byte [esp + 0x39], 0x6f
mov byte [esp + 0x3a], 0x73
mov byte [esp + 0x3b], 0x69
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], 0x69
mov byte [esp + 0x3e], 0x76
mov byte [esp + 0x3f], 0x65
mov byte [esp + 0x40], 0x20
mov byte [esp + 0x41], 0x6e
mov byte [esp + 0x42], 0x75
mov byte [esp + 0x43], 0x6d
mov byte [esp + 0x44], 0x62
mov byte [esp + 0x45], 0x65
mov byte [esp + 0x46], 0x72
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x32
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
call fcn.0045dcb0
jmp fcn.006891a0
Function at 0x6899a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x689ae0
sub esp, 0x44
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f345
mov byte [esp + 0x15], 0x78
mov byte [esp + 0x16], 0x35
mov byte [esp + 0x17], 0x30
mov byte [esp + 0x18], 0x39
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], 0x20
mov byte [esp + 0x1b], 0x66
mov byte [esp + 0x1c], 0x61
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x75
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x27], 0x6d
mov byte [esp + 0x28], 0x61
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x68
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], 0x6c
mov byte [esp + 0x2e], 0x20
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0x69
mov byte [esp + 0x33], 0x70
mov byte [esp + 0x34], 0x74
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x63
mov byte [esp + 0x37], 0x20
mov byte [esp + 0x38], 0x63
mov byte [esp + 0x39], 0x75
mov byte [esp + 0x3a], 0x72
mov byte [esp + 0x3b], 0x76
mov byte [esp + 0x3c], 0x65
mov byte [esp + 0x3d], 0x20
mov byte [esp + 0x3e], 0x70
mov byte [esp + 0x3f], 0x6f
mov byte [esp + 0x40], 0x69
mov byte [esp + 0x41], 0x6e
mov byte [esp + 0x42], 0x74
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2e
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x44
ret
call fcn.0045dcb0
jmp fcn.006899a0

Function at 0x68a2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68a395
sub esp, 0x78
lea edi, [esp + 0x48]
lea esi, [0x792ead]
call fcn.0045f7e8
mov dword [esp + 0x16], 0x1e272f06
lea edi, [esp + 0x18]
lea esi, [0x7dd03a]
call fcn.0045f7e8
xor eax, eax
jmp 0x68a317
movzx edi, byte [esp + ebx + 0x48]
lea edx, [edi + edx - 1]
mov byte [esp + ebp + 0x48], dl
xchg esi, eax
mov byte [esp + ebx + 0x48], al
xchg esi, eax
add eax, 2
cmp eax, 0x32
jge 0x68a349
movzx edx, byte [esp + eax + 0x16]
movzx ebx, byte [esp + eax + 0x17]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x30
jae 0x68a388
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x48]
lea esi, [esi + edx - 1]
cmp ebx, 0x30
jb 0x68a301
jmp 0x68a37c
mov dword [esp], 0
lea eax, [esp + 0x48]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x30
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
add esp, 0x78
ret
mov eax, ebx
mov ecx, 0x30
call fcn.0045f150
mov eax, ebp
mov ecx, 0x30
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.0068a2c0
Function at 0x68a3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68a486
sub esp, 0x34
mov dword [esp + 0x17], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f349
mov byte [esp + 0x17], 0x78
mov byte [esp + 0x18], 0x35
mov byte [esp + 0x19], 0x30
mov byte [esp + 0x1a], 0x39
mov byte [esp + 0x1b], 0x3a
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x44
mov byte [esp + 0x26], 0x53
mov byte [esp + 0x27], 0x41
mov byte [esp + 0x28], 0x20
mov byte [esp + 0x29], 0x70
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x2e], 0x63
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], 0x65
mov byte [esp + 0x32], 0x79
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1c
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
call fcn.0045dcb0
jmp fcn.0068a3a0

Function at 0x68ac20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68ad21
sub esp, 0x38
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f347
mov byte [esp + 0x14], 0x78
mov byte [esp + 0x15], 0x35
mov byte [esp + 0x16], 0x30
mov byte [esp + 0x17], 0x39
mov byte [esp + 0x18], 0x3a
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], 0x66
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x20], 0x6d
mov byte [esp + 0x21], 0x65
mov byte [esp + 0x22], 0x64
mov byte [esp + 0x23], 0x20
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x25], 0x78
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], 0x69
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x6e
mov byte [esp + 0x2d], 0x20
mov byte [esp + 0x2e], 0x4f
mov byte [esp + 0x2f], 0x49
mov byte [esp + 0x30], 0x44
mov byte [esp + 0x31], 0x20
mov byte [esp + 0x32], 0x66
mov byte [esp + 0x33], 0x69
mov byte [esp + 0x34], 0x65
mov byte [esp + 0x35], 0x6c
mov byte [esp + 0x36], 0x64
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x23
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
call fcn.0045dcb0
jmp fcn.0068ac20
Function at 0x68b370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68b45b
sub esp, 0x34
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f349
mov byte [esp + 0x16], 0x78
mov byte [esp + 0x17], 0x35
mov byte [esp + 0x18], 0x30
mov byte [esp + 0x19], 0x39
mov byte [esp + 0x1a], 0x3a
mov byte [esp + 0x1b], 0x20
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0x70
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], 0x69
mov byte [esp + 0x2a], 0x6d
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0x66
mov byte [esp + 0x2e], 0x6f
mov byte [esp + 0x2f], 0x72
mov byte [esp + 0x30], 0x6d
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x74
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1d
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
call fcn.0045dcb0
jmp fcn.0068b370

Function at 0x68b720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68b7f7
sub esp, 0x30
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x16], 0x78
mov byte [esp + 0x17], 0x35
mov byte [esp + 0x18], 0x30
mov byte [esp + 0x19], 0x39
mov byte [esp + 0x1a], 0x3a
mov byte [esp + 0x1b], 0x20
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x76
mov byte [esp + 0x1f], 0x61
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x64
mov byte [esp + 0x23], 0x20
mov byte [esp + 0x24], 0x52
mov byte [esp + 0x25], 0x44
mov byte [esp + 0x26], 0x4e
mov byte [esp + 0x27], 0x53
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x29], 0x71
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x6e
mov byte [esp + 0x2d], 0x63
mov byte [esp + 0x2e], 0x65
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x19
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
call fcn.0045dcb0
jmp fcn.0068b720
Function at 0x68bb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68bc64
sub esp, 0x48
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f344
mov byte [esp + 0x15], 0x78
mov byte [esp + 0x16], 0x35
mov byte [esp + 0x17], 0x30
mov byte [esp + 0x18], 0x39
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], 0x20
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x76
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], 0x20
mov byte [esp + 0x23], 0x52
mov byte [esp + 0x24], 0x44
mov byte [esp + 0x25], 0x4e
mov byte [esp + 0x26], 0x53
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x71
mov byte [esp + 0x29], 0x75
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0x6e
mov byte [esp + 0x2c], 0x63
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2e], 0x3a
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x69
mov byte [esp + 0x31], 0x6e
mov byte [esp + 0x32], 0x76
mov byte [esp + 0x33], 0x61
mov byte [esp + 0x34], 0x6c
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x64
mov byte [esp + 0x37], 0x20
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x74
mov byte [esp + 0x3a], 0x74
mov byte [esp + 0x3b], 0x72
mov byte [esp + 0x3c], 0x69
mov byte [esp + 0x3d], 0x62
mov byte [esp + 0x3e], 0x75
mov byte [esp + 0x3f], 0x74
mov byte [esp + 0x40], 0x65
mov byte [esp + 0x41], 0x20
mov byte [esp + 0x42], 0x76
mov byte [esp + 0x43], 0x61
mov byte [esp + 0x44], 0x6c
mov byte [esp + 0x45], 0x75
mov byte [esp + 0x46], 0x65
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x32
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
call fcn.0045dcb0
jmp fcn.0068bb10