joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60ccb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60cef6
sub esp, 0x70
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.0045f34b
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
xor ebx, ebx
jmp 0x60ccdf
inc ebx
cmp ecx, ebx
jle 0x60cdc5
movzx ebp, byte [edx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x60cdae
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x60cd59
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x60ccde
lea edi, [esp + 0x5c]
call fcn.0045f34b
mov dword [esp], edx
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
call fcn.0060d8b0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x5c]
lea esi, [esp + 8]
call fcn.0045f82e
lea edi, [esp + 0x7c]
lea esi, [esp + 0x5c]
call fcn.0045f82e
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], edx
add esp, 0x70
ret
lea edi, [esp + 0x5c]
call fcn.0045f34b
mov dword [esp], edx
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
call fcn.0060d300
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x5c]
lea esi, [esp + 8]
call fcn.0045f82e
lea edi, [esp + 0x7c]
lea esi, [esp + 0x5c]
call fcn.0045f82e
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], edx
add esp, 0x70
ret
nop
lea edi, [esp + 0x24]
lea esi, [0x78b1ad]
call fcn.0045f82e
xor ecx, ecx
jmp 0x60ce47
call fcn.006131a0
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp + 0x3c], ecx
lea edi, [esp + 0x44]
mov edx, eax
xor eax, eax
call fcn.0045f34a
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x50], ecx
lea edi, [esp + 0x7c]
call fcn.0045f34b
lea eax, [0x7729a0]
mov dword [esp], eax
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
call fcn.0040a440
mov eax, dword [esp + 8]
lea ecx, [0x7da770]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x70
ret
movzx esi, byte [esp + ecx + 0x24]
xor esi, ebp
xchg esi, eax
mov byte [esp + ecx + 0x24], al
xchg esi, eax
inc ecx
cmp ecx, 0x14
jge 0x60ce5d
lea ebx, [0x78b199]
movzx ebp, byte [ebx + ecx]
jb 0x60ce39
jmp 0x60cee9
mov dword [esp], 0
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], ecx
lea edi, [esp + 0x44]
mov edx, eax
xor eax, eax
call fcn.0045f34a
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x50], ecx
lea edi, [esp + 0x7c]
call fcn.0045f34b
lea eax, [0x7729a0]
mov dword [esp], eax
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
call fcn.0040a440
mov eax, dword [esp + 8]
lea ecx, [0x7da770]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x70
ret
mov eax, ecx
mov ecx, 0x14
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.0060ccb0
Function at 0x6114f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6116a3
sub esp, 0x5c
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f33f
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x6f
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x79
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0x68
mov byte [esp + 0x20], 0x65
mov byte [esp + 0x21], 0x78
mov byte [esp + 0x22], 0x20
mov byte [esp + 0x23], 0x66
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], 0x64
mov byte [esp + 0x28], 0x73
mov byte [esp + 0x29], 0x20
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0x66
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x20
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x20
mov byte [esp + 0x34], 0x65
mov byte [esp + 0x35], 0x6d
mov byte [esp + 0x36], 0x62
mov byte [esp + 0x37], 0x65
mov byte [esp + 0x38], 0x64
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x64
mov byte [esp + 0x3c], 0x20
mov byte [esp + 0x3d], 0x49
mov byte [esp + 0x3e], 0x50
mov byte [esp + 0x3f], 0x76
mov byte [esp + 0x40], 0x34
mov byte [esp + 0x41], 0x20
mov byte [esp + 0x42], 0x61
mov byte [esp + 0x43], 0x74
mov byte [esp + 0x44], 0x20
mov byte [esp + 0x45], 0x74
mov byte [esp + 0x46], 0x68
mov byte [esp + 0x47], 0x65
mov byte [esp + 0x48], 0x20
mov byte [esp + 0x49], 0x65
mov byte [esp + 0x4a], 0x6e
mov byte [esp + 0x4b], 0x64
mov byte [esp + 0x4c], 0x20
mov byte [esp + 0x4d], 0x6f
mov byte [esp + 0x4e], 0x66
mov byte [esp + 0x4f], 0x20
mov byte [esp + 0x50], 0x74
mov byte [esp + 0x51], 0x68
mov byte [esp + 0x52], 0x65
mov byte [esp + 0x53], 0x20
mov byte [esp + 0x54], 0x61
mov byte [esp + 0x55], 0x64
mov byte [esp + 0x56], 0x64
mov byte [esp + 0x57], 0x72
mov byte [esp + 0x58], 0x65
mov byte [esp + 0x59], 0x73
mov byte [esp + 0x5a], 0x73
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x45
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
add esp, 0x5c
ret
call fcn.0045dcb0
jmp fcn.006114f0
Function at 0x611880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x611952
sub esp, 0x30
mov dword [esp + 0x17], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x64
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x1c], 0x73
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0x73
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x6e
mov byte [esp + 0x24], 0x67
mov byte [esp + 0x25], 0x20
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], 0x20
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x68
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], 0x72
mov byte [esp + 0x2e], 0x74
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
call fcn.0045dcb0
jmp fcn.00611880

Function at 0x6161b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61628a
sub esp, 0x40
mov dword [esp + 0x2b], 0xac31866b
lea edi, [esp + 0x2c]
lea esi, [0x78b5a9]
call fcn.0045f82e
mov dword [esp + 0x15], 0x10e1314
lea edi, [esp + 0x17]
lea esi, [0x7da990]
call fcn.0045f82e
xor eax, eax
jmp 0x616211
movzx edi, byte [esp + ebx + 0x2b]
sub edi, edx
lea edx, [edi - 5]
mov byte [esp + ebp + 0x2b], dl
lea edx, [esi - 5]
mov byte [esp + ebx + 0x2b], dl
add eax, 2
cmp eax, 0x16
jge 0x616241
movzx edx, byte [esp + eax + 0x15]
movzx ebx, byte [esp + eax + 0x16]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x15
jae 0x61627d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x2b]
sub esi, edx
cmp ebx, 0x15
jb 0x6161f9
jmp 0x616271
mov dword [esp], 0
lea eax, [esp + 0x2b]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x15
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x15
call fcn.0045f150
mov eax, ebp
mov ecx, 0x15
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.006161b0
Function at 0x616470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x616583
sub esp, 0x3c
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f347
mov byte [esp + 0x16], 0x63
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x6e
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0x63
mov byte [esp + 0x1e], 0x72
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x20
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0x6f
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x29], 0x78
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x20
mov byte [esp + 0x2c], 0x66
mov byte [esp + 0x2d], 0x72
mov byte [esp + 0x2e], 0x6f
mov byte [esp + 0x2f], 0x6d
mov byte [esp + 0x30], 0x20
mov byte [esp + 0x31], 0x6e
mov byte [esp + 0x32], 0x69
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0x20
mov byte [esp + 0x35], 0x70
mov byte [esp + 0x36], 0x61
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x6e
mov byte [esp + 0x3a], 0x74
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x25
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x3c
ret
call fcn.0045dcb0
jmp fcn.00616470

Function at 0x61b050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61b0e6
sub esp, 0x20
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x14], 0x43
mov byte [esp + 0x15], 0x6c
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x73
mov byte [esp + 0x18], 0x73
mov byte [esp + 0x19], 0x48
mov byte [esp + 0x1a], 0x45
mov byte [esp + 0x1b], 0x53
mov byte [esp + 0x1c], 0x49
mov byte [esp + 0x1d], 0x4f
mov byte [esp + 0x1e], 0x44
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.0045dcb0
jmp fcn.0061b050
Function at 0x61d070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61d135
sub esp, 0x2c
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x14], 0x74
mov byte [esp + 0x15], 0x6f
mov byte [esp + 0x16], 0x6f
mov byte [esp + 0x17], 0x20
mov byte [esp + 0x18], 0x6d
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x79
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x24], 0x73
mov byte [esp + 0x25], 0x20
mov byte [esp + 0x26], 0x28
mov byte [esp + 0x27], 0x3e
mov byte [esp + 0x28], 0x31
mov byte [esp + 0x29], 0x30
mov byte [esp + 0x2a], 0x29
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x17
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
call fcn.0045dcb0
jmp fcn.0061d070

Function at 0x61d670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61d79c
sub esp, 0x40
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f346
mov byte [esp + 0x15], 0x69
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x73
mov byte [esp + 0x18], 0x75
mov byte [esp + 0x19], 0x66
mov byte [esp + 0x1a], 0x66
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x6e
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x64
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x20
mov byte [esp + 0x27], 0x66
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x20
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x2c], 0x65
mov byte [esp + 0x2d], 0x73
mov byte [esp + 0x2e], 0x6f
mov byte [esp + 0x2f], 0x75
mov byte [esp + 0x30], 0x72
mov byte [esp + 0x31], 0x63
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], 0x20
mov byte [esp + 0x34], 0x62
mov byte [esp + 0x35], 0x6f
mov byte [esp + 0x36], 0x64
mov byte [esp + 0x37], 0x79
mov byte [esp + 0x38], 0x20
mov byte [esp + 0x39], 0x6c
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x67
mov byte [esp + 0x3d], 0x74
mov byte [esp + 0x3e], 0x68
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2a
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
call fcn.0045dcb0
jmp fcn.0061d670
Function at 0x61ea00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61eb13
sub esp, 0x3c
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f347
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x6f
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x79
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0x41
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x74
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x25], 0x6f
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], 0x20
mov byte [esp + 0x2b], 0x74
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], 0x20
mov byte [esp + 0x2e], 0x70
mov byte [esp + 0x2f], 0x61
mov byte [esp + 0x30], 0x63
mov byte [esp + 0x31], 0x6b
mov byte [esp + 0x32], 0x20
mov byte [esp + 0x33], 0x28
mov byte [esp + 0x34], 0x3e
mov byte [esp + 0x35], 0x36
mov byte [esp + 0x36], 0x35
mov byte [esp + 0x37], 0x35
mov byte [esp + 0x38], 0x33
mov byte [esp + 0x39], 0x35
mov byte [esp + 0x3a], 0x29
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x25
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x3c
ret
call fcn.0045dcb0
jmp fcn.0061ea00
Function at 0x621670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x62182d
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.0045f347
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x6216a8
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x6216d1
lea eax, [0x74afe0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.00448800
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.0045f347
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
nop
or edx, ecx
test bl, bl
je 0x621715
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x621724
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x621733
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x621742
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x621751
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x62175d
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x621769
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x42], ax
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x34]
cmp eax, edx
jae 0x6217d9
mov dword [esp + 0x30], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x74afe0]
mov dword [esp + 0x10], eax
call fcn.004488c0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x58], ebx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call fcn.0045fa40
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.0045f806
add esp, 0x5c
ret
call fcn.0045dcb0
jmp fcn.00621670
Function at 0x623e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x623e9d
sub esp, 0x20
mov dword [esp + 0x15], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x15], 0x73
mov byte [esp + 0x16], 0x6b
mov byte [esp + 0x17], 0x69
mov byte [esp + 0x18], 0x70
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x67
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x20
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.0045dcb0
jmp fcn.00623e10

Function at 0x624570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x624606
sub esp, 0x20
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x14], 0x61
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x68
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x73
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.0045dcb0
jmp fcn.00624570

Function at 0x627880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x627952
sub esp, 0x50
lea edi, [esp + 0x34]
lea esi, [0x78d626]
call fcn.0045f81a
mov dword [esp + 0x16], 0x18040e02
lea edi, [esp + 0x18]
lea esi, [0x7db690]
call fcn.0045f81a
xor eax, eax
jmp 0x6278d9
movzx edi, byte [esp + ebx + 0x34]
sub edi, edx
lea edx, [edi + 0x47]
mov byte [esp + ebp + 0x34], dl
lea edx, [esi + 0x47]
mov byte [esp + ebx + 0x34], dl
add eax, 2
cmp eax, 0x1e
jge 0x627909
movzx edx, byte [esp + eax + 0x16]
movzx ebx, byte [esp + eax + 0x17]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x1c
jae 0x627945
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x34]
sub esi, edx
cmp ebx, 0x1c
jb 0x6278c1
jmp 0x627939
mov dword [esp], 0
lea eax, [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1c
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x50
ret
mov eax, ebx
mov ecx, 0x1c
call fcn.0045f150
mov eax, ebp
mov ecx, 0x1c
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.00627880
Function at 0x627960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x627a3c
sub esp, 0x30
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x15], 0x63
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0x6e
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1b], 0x20
mov byte [esp + 0x1c], 0x6d
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1e], 0x72
mov byte [esp + 0x1f], 0x73
mov byte [esp + 0x20], 0x68
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x23], 0x20
mov byte [esp + 0x24], 0x44
mov byte [esp + 0x25], 0x4e
mov byte [esp + 0x26], 0x53
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x6d
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], 0x67
mov byte [esp + 0x2e], 0x65
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
call fcn.0045dcb0
jmp fcn.00627960