joyce8/EMBER2024-capa huggingface dataset:
Function at 0x571650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x571715
sub esp, 0x2c
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x14], 0x4d
mov byte [esp + 0x15], 0x61
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x17], 0x71
mov byte [esp + 0x18], 0x75
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x73
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x53
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], 0x6e
mov byte [esp + 0x22], 0x64
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x26], 0x20
mov byte [esp + 0x27], 0x54
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x29], 0x6d
mov byte [esp + 0x2a], 0x65
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x17
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
call fcn.0045dcb0
jmp fcn.00571650

Function at 0x571720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5717fc
sub esp, 0x30
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x15], 0x57
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x17], 0x73
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x50
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x66
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x63
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x53
mov byte [esp + 0x23], 0x74
mov byte [esp + 0x24], 0x61
mov byte [esp + 0x25], 0x6e
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2a], 0x20
mov byte [esp + 0x2b], 0x54
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x2d], 0x6d
mov byte [esp + 0x2e], 0x65
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
call fcn.0045dcb0
jmp fcn.00571720
Function at 0x575c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x575daf
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.0045f34b
call fcn.00582420
mov ecx, dword [esp + 0x58]
cmp dword [esp + 4], ecx
je 0x575c55
xor eax, eax
jmp 0x575c75
mov eax, dword [esp]
mov edx, dword [esp + 0x54]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00403c00
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
test al, al
je 0x575c80
mov eax, 1
jmp 0x575cbb
call fcn.005828c0
mov eax, dword [esp + 0x58]
cmp dword [esp + 4], eax
je 0x575c93
xor ecx, ecx
jmp 0x575cb5
mov ecx, dword [esp]
mov edx, dword [esp + 0x54]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00403c00
movzx eax, byte [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x58]
mov eax, ecx
mov ecx, dword [esp + 0x58]
test al, al
je 0x575d15
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045f34b
mov ecx, dword [0x723bd4]
lea edx, [0x7da590]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.005888f0
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.0045f82e
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x575d8e
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045f34b
mov ecx, dword [0x723bd4]
mov edx, dword [0x723bd0]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
call fcn.00575dc0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.0045f82e
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045f82e
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045f82e
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.0045dcb0
jmp fcn.00575c20
Function at 0x57fca0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57fe8c
sub esp, 0x48
mov eax, dword [0x723bd0]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.0057c320
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0045f82e
nop
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0045f82e
call fcn.00579db0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
nop
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.00457bb0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x57fd79
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x57fd93
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x57fe0a
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x57fde0
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x57fddc
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x57fdd5
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x57fde2
mov ebx, 0x1d
jmp 0x57fe00
mov ebp, eax
jmp 0x57fde2
mov ebp, eax
cmp ebp, 0xd
jae 0x57fe7f
lea eax, [ebp - 1]
lea edx, [0x716640]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x57fe75
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x57fe0a
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x57fe3c
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ebx, 0x1f
or ebp, ebx
shr ecx, 0x1f
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x57fe44
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.0045f150
mov eax, ebp
mov ecx, 0xd
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.0057fca0
Function at 0x580480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5805e5
sub esp, 0x4c
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f342
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x4f
mov byte [esp + 0x16], 0x46
mov byte [esp + 0x17], 0x54
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x19], 0x41
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1b], 0x45
mov byte [esp + 0x1c], 0x5c
mov byte [esp + 0x1d], 0x4d
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x63
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x22], 0x73
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x66
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x5c
mov byte [esp + 0x27], 0x57
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x29], 0x6e
mov byte [esp + 0x2a], 0x64
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x77
mov byte [esp + 0x2d], 0x73
mov byte [esp + 0x2e], 0x20
mov byte [esp + 0x2f], 0x4e
mov byte [esp + 0x30], 0x54
mov byte [esp + 0x31], 0x5c
mov byte [esp + 0x32], 0x43
mov byte [esp + 0x33], 0x75
mov byte [esp + 0x34], 0x72
mov byte [esp + 0x35], 0x72
mov byte [esp + 0x36], 0x65
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x74
mov byte [esp + 0x39], 0x56
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x72
mov byte [esp + 0x3c], 0x73
mov byte [esp + 0x3d], 0x69
mov byte [esp + 0x3e], 0x6f
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x40], 0x5c
mov byte [esp + 0x41], 0x54
mov byte [esp + 0x42], 0x69
mov byte [esp + 0x43], 0x6d
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x45], 0x20
mov byte [esp + 0x46], 0x5a
mov byte [esp + 0x47], 0x6f
mov byte [esp + 0x48], 0x6e
mov byte [esp + 0x49], 0x65
mov byte [esp + 0x4a], 0x73
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x37
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
add esp, 0x4c
ret
call fcn.0045dcb0
jmp fcn.00580480
Function at 0x5808d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x580982
sub esp, 0x24
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x14], 0x2c
mov byte [esp + 0x15], 0x4d
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x2e
mov byte [esp + 0x18], 0x32
mov byte [esp + 0x19], 0x2e
mov byte [esp + 0x1a], 0x30
mov byte [esp + 0x1b], 0x2c
mov byte [esp + 0x1c], 0x4d
mov byte [esp + 0x1d], 0x31
mov byte [esp + 0x1e], 0x31
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x31
mov byte [esp + 0x21], 0x2e
mov byte [esp + 0x22], 0x30
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xf
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.005808d0
Function at 0x582330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58240a
sub esp, 0x38
mov dword [esp + 0x27], 0xaf61a1e4
lea edi, [esp + 0x28]
lea esi, [0x789f2b]
call fcn.0045f838
mov dword [esp + 0x15], 0xa10070d
lea edi, [esp + 0x17]
lea esi, [0x7da022]
call fcn.0045f838
xor eax, eax
jmp 0x582391
movzx edi, byte [esp + ebx + 0x27]
sub edi, edx
lea edx, [edi - 0x2a]
mov byte [esp + ebp + 0x27], dl
lea edx, [esi - 0x2a]
mov byte [esp + ebx + 0x27], dl
add eax, 2
cmp eax, 0x12
jge 0x5823c1
movzx edx, byte [esp + eax + 0x15]
movzx ebx, byte [esp + eax + 0x16]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x11
jae 0x5823fd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x27]
sub esi, edx
cmp ebx, 0x11
jb 0x582379
jmp 0x5823f1
mov dword [esp], 0
lea eax, [esp + 0x27]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x11
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x11
call fcn.0045f150
mov eax, ebp
mov ecx, 0x11
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.00582330
Function at 0x582c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x582ce8
sub esp, 0x24
mov dword [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x16], 0x70
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x67
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x6d
mov byte [esp + 0x21], 0x65
mov byte [esp + 0x22], 0x20
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xd
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.00582c40

Function at 0x582d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x582db2
sub esp, 0x24
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x14], 0x3a
mov byte [esp + 0x15], 0x20
mov byte [esp + 0x16], 0x63
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x6e
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x20], 0x73
mov byte [esp + 0x21], 0x65
mov byte [esp + 0x22], 0x20
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xf
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.00582d00
Function at 0x583840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x583917
sub esp, 0x30
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x16], 0x32
mov byte [esp + 0x17], 0x30
mov byte [esp + 0x18], 0x30
mov byte [esp + 0x19], 0x36
mov byte [esp + 0x1a], 0x2d
mov byte [esp + 0x1b], 0x30
mov byte [esp + 0x1c], 0x31
mov byte [esp + 0x1d], 0x2d
mov byte [esp + 0x1e], 0x30
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x54
mov byte [esp + 0x21], 0x31
mov byte [esp + 0x22], 0x35
mov byte [esp + 0x23], 0x3a
mov byte [esp + 0x24], 0x30
mov byte [esp + 0x25], 0x34
mov byte [esp + 0x26], 0x3a
mov byte [esp + 0x27], 0x30
mov byte [esp + 0x28], 0x35
mov byte [esp + 0x29], 0x5a
mov byte [esp + 0x2a], 0x30
mov byte [esp + 0x2b], 0x37
mov byte [esp + 0x2c], 0x3a
mov byte [esp + 0x2d], 0x30
mov byte [esp + 0x2e], 0x30
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x19
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
call fcn.0045dcb0
jmp fcn.00583840

Function at 0x583930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x583a31
sub esp, 0x38
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f347
mov byte [esp + 0x14], 0x32
mov byte [esp + 0x15], 0x30
mov byte [esp + 0x16], 0x30
mov byte [esp + 0x17], 0x36
mov byte [esp + 0x18], 0x2d
mov byte [esp + 0x19], 0x30
mov byte [esp + 0x1a], 0x31
mov byte [esp + 0x1b], 0x2d
mov byte [esp + 0x1c], 0x30
mov byte [esp + 0x1d], 0x32
mov byte [esp + 0x1e], 0x54
mov byte [esp + 0x1f], 0x31
mov byte [esp + 0x20], 0x35
mov byte [esp + 0x21], 0x3a
mov byte [esp + 0x22], 0x30
mov byte [esp + 0x23], 0x34
mov byte [esp + 0x24], 0x3a
mov byte [esp + 0x25], 0x30
mov byte [esp + 0x26], 0x35
mov byte [esp + 0x27], 0x2e
mov byte [esp + 0x28], 0x39
mov byte [esp + 0x29], 0x39
mov byte [esp + 0x2a], 0x39
mov byte [esp + 0x2b], 0x39
mov byte [esp + 0x2c], 0x39
mov byte [esp + 0x2d], 0x39
mov byte [esp + 0x2e], 0x39
mov byte [esp + 0x2f], 0x39
mov byte [esp + 0x30], 0x39
mov byte [esp + 0x31], 0x5a
mov byte [esp + 0x32], 0x30
mov byte [esp + 0x33], 0x37
mov byte [esp + 0x34], 0x3a
mov byte [esp + 0x35], 0x30
mov byte [esp + 0x36], 0x30
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x23
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
call fcn.0045dcb0
jmp fcn.00583930
Function at 0x589740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5897f1
sub esp, 0x28
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f34b
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x15], 0x6b
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], 0x70
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x1a], 0x68
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x73
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x64
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x65
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], 0x74
mov byte [esp + 0x24], 0x6f
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], 0x79
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x13
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
call fcn.0045dcb0
jmp fcn.00589740

Function at 0x589800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5898ff
sub esp, 0x38
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f348
mov byte [esp + 0x16], 0x73
mov byte [esp + 0x17], 0x6b
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1a], 0x20
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x1c], 0x76
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x72
mov byte [esp + 0x1f], 0x79
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x68
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x6e
mov byte [esp + 0x24], 0x67
mov byte [esp + 0x25], 0x20
mov byte [esp + 0x26], 0x61
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], 0x20
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x74
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], 0x70
mov byte [esp + 0x2e], 0x20
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x31], 0x65
mov byte [esp + 0x32], 0x20
mov byte [esp + 0x33], 0x77
mov byte [esp + 0x34], 0x61
mov byte [esp + 0x35], 0x6c
mov byte [esp + 0x36], 0x6b
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x21
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
call fcn.0045dcb0
jmp fcn.00589800
Function at 0x58c670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58c713
sub esp, 0x24
mov dword [esp + 0x17], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x17], 0x69
mov byte [esp + 0x18], 0x70
mov byte [esp + 0x19], 0x68
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x61
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x6c
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.0058c670

Function at 0x58c720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58c7c3
sub esp, 0x24
mov dword [esp + 0x17], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x17], 0x6b
mov byte [esp + 0x18], 0x65
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], 0x33
mov byte [esp + 0x1e], 0x32
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x6c
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.0058c720

Function at 0x58c8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58c983
sub esp, 0x2c
mov dword [esp + 0x23], 0x84618158
mov dword [esp + 0x24], 0x69846181
mov dword [esp + 0x28], 0x6cb26477
lea edi, [esp + 0x17]
lea esi, [0x7d9a8c]
call fcn.0045f842
xor eax, eax
jmp 0x58c90a
movzx edi, byte [esp + ebx + 0x23]
sub edi, edx
lea edx, [edi - 5]
mov byte [esp + ebp + 0x23], dl
lea edx, [esi - 5]
mov byte [esp + ebx + 0x23], dl
add eax, 2
cmp eax, 0xc
jge 0x58c93a
movzx edx, byte [esp + eax + 0x17]
movzx ebx, byte [esp + eax + 0x18]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x58c976
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x23]
sub esi, edx
cmp ebx, 9
jb 0x58c8f2
jmp 0x58c96a
mov dword [esp], 0
lea eax, [esp + 0x23]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.0045f150
mov eax, ebp
mov ecx, 9
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.0058c8b0