joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c5a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c5aa8
sub esp, 0x20
mov dword [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x16], 0x75
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0x64
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x66
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], 0x6f
mov byte [esp + 0x1e], 0x77
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.0045dcb0
jmp fcn.005c5a20
Function at 0x5ca180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ca2d1
sub esp, 0x48
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f343
mov byte [esp + 0x14], 0x63
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x70
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x2f
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], 0x6c
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], 0x3a
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x41
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x27], 0x64
mov byte [esp + 0x28], 0x20
mov byte [esp + 0x29], 0x77
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0x63
mov byte [esp + 0x2e], 0x61
mov byte [esp + 0x2f], 0x6c
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x65
mov byte [esp + 0x32], 0x64
mov byte [esp + 0x33], 0x20
mov byte [esp + 0x34], 0x6f
mov byte [esp + 0x35], 0x6e
mov byte [esp + 0x36], 0x20
mov byte [esp + 0x37], 0x61
mov byte [esp + 0x38], 0x6e
mov byte [esp + 0x39], 0x20
mov byte [esp + 0x3a], 0x69
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x76
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x69
mov byte [esp + 0x40], 0x64
mov byte [esp + 0x41], 0x20
mov byte [esp + 0x42], 0x70
mov byte [esp + 0x43], 0x6f
mov byte [esp + 0x44], 0x69
mov byte [esp + 0x45], 0x6e
mov byte [esp + 0x46], 0x74
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x33
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
add esp, 0x48
ret
call fcn.0045dcb0
jmp fcn.005ca180

Function at 0x5ca6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ca781
sub esp, 0x28
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f34b
mov byte [esp + 0x14], 0x6e
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x67
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x69
mov byte [esp + 0x1a], 0x76
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0x63
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x1f], 0x6f
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x6e
mov byte [esp + 0x24], 0x61
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x65
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x13
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x28
ret
call fcn.0045dcb0
jmp fcn.005ca6d0
Function at 0x5ca790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ca8df
sub esp, 0x48
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f344
mov byte [esp + 0x16], 0x63
mov byte [esp + 0x17], 0x72
mov byte [esp + 0x18], 0x79
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1b], 0x6f
mov byte [esp + 0x1c], 0x2f
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x21], 0x70
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0x69
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0x3a
mov byte [esp + 0x26], 0x20
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x2c], 0x6e
mov byte [esp + 0x2d], 0x61
mov byte [esp + 0x2e], 0x6c
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x65
mov byte [esp + 0x31], 0x72
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], 0x72
mov byte [esp + 0x35], 0x3a
mov byte [esp + 0x36], 0x20
mov byte [esp + 0x37], 0x69
mov byte [esp + 0x38], 0x6e
mov byte [esp + 0x39], 0x76
mov byte [esp + 0x3a], 0x61
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0x69
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x20
mov byte [esp + 0x3f], 0x65
mov byte [esp + 0x40], 0x6e
mov byte [esp + 0x41], 0x63
mov byte [esp + 0x42], 0x6f
mov byte [esp + 0x43], 0x64
mov byte [esp + 0x44], 0x69
mov byte [esp + 0x45], 0x6e
mov byte [esp + 0x46], 0x67
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x31
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
call fcn.0045dcb0
jmp fcn.005ca790
Function at 0x5d0330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d04de
sub esp, 0x5c
mov dword [esp + 0x17], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f33f
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x36
mov byte [esp + 0x19], 0x39
mov byte [esp + 0x1a], 0x35
mov byte [esp + 0x1b], 0x39
mov byte [esp + 0x1c], 0x39
mov byte [esp + 0x1d], 0x34
mov byte [esp + 0x1e], 0x36
mov byte [esp + 0x1f], 0x36
mov byte [esp + 0x20], 0x36
mov byte [esp + 0x21], 0x37
mov byte [esp + 0x22], 0x31
mov byte [esp + 0x23], 0x35
mov byte [esp + 0x24], 0x30
mov byte [esp + 0x25], 0x36
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x39
mov byte [esp + 0x28], 0x37
mov byte [esp + 0x29], 0x39
mov byte [esp + 0x2a], 0x34
mov byte [esp + 0x2b], 0x36
mov byte [esp + 0x2c], 0x36
mov byte [esp + 0x2d], 0x37
mov byte [esp + 0x2e], 0x30
mov byte [esp + 0x2f], 0x31
mov byte [esp + 0x30], 0x35
mov byte [esp + 0x31], 0x30
mov byte [esp + 0x32], 0x38
mov byte [esp + 0x33], 0x37
mov byte [esp + 0x34], 0x30
mov byte [esp + 0x35], 0x31
mov byte [esp + 0x36], 0x39
mov byte [esp + 0x37], 0x36
mov byte [esp + 0x38], 0x33
mov byte [esp + 0x39], 0x30
mov byte [esp + 0x3a], 0x36
mov byte [esp + 0x3b], 0x37
mov byte [esp + 0x3c], 0x33
mov byte [esp + 0x3d], 0x35
mov byte [esp + 0x3e], 0x35
mov byte [esp + 0x3f], 0x37
mov byte [esp + 0x40], 0x39
mov byte [esp + 0x41], 0x31
mov byte [esp + 0x42], 0x36
mov byte [esp + 0x43], 0x32
mov byte [esp + 0x44], 0x36
mov byte [esp + 0x45], 0x30
mov byte [esp + 0x46], 0x30
mov byte [esp + 0x47], 0x32
mov byte [esp + 0x48], 0x36
mov byte [esp + 0x49], 0x33
mov byte [esp + 0x4a], 0x30
mov byte [esp + 0x4b], 0x38
mov byte [esp + 0x4c], 0x31
mov byte [esp + 0x4d], 0x34
mov byte [esp + 0x4e], 0x33
mov byte [esp + 0x4f], 0x35
mov byte [esp + 0x50], 0x31
mov byte [esp + 0x51], 0x30
mov byte [esp + 0x52], 0x30
mov byte [esp + 0x53], 0x36
mov byte [esp + 0x54], 0x36
mov byte [esp + 0x55], 0x32
mov byte [esp + 0x56], 0x39
mov byte [esp + 0x57], 0x38
mov byte [esp + 0x58], 0x38
mov byte [esp + 0x59], 0x38
mov byte [esp + 0x5a], 0x31
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x44
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
add esp, 0x5c
ret
call fcn.0045dcb0
jmp fcn.005d0330
Function at 0x5d6ba0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d6db4
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x5d6c37
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x5d6d95
cmp ecx, 0xe
jne 0x5d6cb0
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5d6d95
cmp ecx, 0xf
jne 0x5d6d26
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5d6d95
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.0045dcb0
jmp fcn.005d6ba0
Function at 0x5da130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5da2ef
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
call fcn.005d9fe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x5da1d9
mov edx, dword [esp + 0x38]
cmp edx, 8
jg 0x5da18f
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], ecx
mov ebx, dword [esp + 0x34]
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x5da213
call fcn.005eba30
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0040a670
mov eax, dword [esp + 8]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
lea ecx, [0x7da7fc]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x30
ret
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x30
ret
shl edi, 8
shl esi, 8
mov ecx, dword [esp + 0x1c]
shr ecx, 0x18
movzx eax, byte [ebx + ebp]
inc ebp
or edi, ecx
or esi, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], esi
cmp edx, ebp
jg 0x5da1f5
shl edx, 3
lea ebx, [edx - 0x40]
neg ebx
mov byte [esp + 0x17], bl
mov ecx, ebx
shl edi, cl
shl esi, cl
add edx, 0xffffffe0
mov byte [esp + 0x16], dl
mov ecx, edx
mov ebp, dword [esp + 0x1c]
shr ebp, cl
mov dword [esp + 0x18], ebp
neg ecx
mov byte [esp + 0x15], cl
mov eax, dword [esp + 0x1c]
shl eax, cl
shr bl, 5
movzx ebx, bl
mov dword [esp + 0x1c], ebx
movzx ebp, byte [esp + 0x17]
xchg ebp, eax
cmp al, 0x20
xchg ebp, eax
sbb edx, edx
sbb ebx, ebx
and edi, edx
and esi, edx
mov ecx, ebp
shr esi, cl
and esi, edx
not ebx
or ecx, ebx
movzx edx, byte [esp + 0x15]
cmp dl, 0x20
sbb ebx, ebx
sbb ebp, ebp
and eax, ebx
xchg ebp, ebx
not ebx
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
mov byte [esp + 0x17], al
xchg ebp, eax
mov edx, dword [esp + 0x1c]
cmp edx, 1
sbb edx, edx
xor edx, 0xffffffff
mov dword [esp + 0x1c], edx
movzx ebx, byte [esp + 0x16]
cmp bl, 0x20
sbb edx, edx
mov ebp, dword [esp + 0x18]
and ebp, edx
or ebp, edi
or ebp, eax
mov eax, ecx
mov ecx, ebx
mov edi, ebp
shl ebp, cl
mov ecx, eax
mov eax, edi
sar edi, cl
and ebp, edx
or ebp, esi
movzx ecx, byte [esp + 0x17]
sar eax, cl
mov edx, dword [esp + 0x1c]
and edx, eax
or edx, ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x4c], eax
add esp, 0x30
ret
call fcn.0045dcb0
jmp fcn.005da130
Function at 0x5e7c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e7d1d
sub esp, 0x24
mov dword [esp + 0x15], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1b], 0x72
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x63
mov byte [esp + 0x1f], 0x61
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x65
mov byte [esp + 0x22], 0x64
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.005e7c70

Function at 0x5e8130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e820a
sub esp, 0x70
mov dword [esp + 0x43], 0x70414073
lea edi, [esp + 0x44]
lea esi, [0x7926a8]
call fcn.0045f7f2
mov dword [esp + 0x15], 0x1900140a
lea edi, [esp + 0x17]
lea esi, [0x7dcd04]
call fcn.0045f7f2
xor eax, eax
jmp 0x5e818f
movzx edi, byte [esp + ebx + 0x43]
lea edx, [edi + edx - 0x17]
mov byte [esp + ebp + 0x43], dl
xchg esi, eax
mov byte [esp + ebx + 0x43], al
xchg esi, eax
add eax, 2
cmp eax, 0x2e
jge 0x5e81c1
movzx edx, byte [esp + eax + 0x15]
movzx ebx, byte [esp + eax + 0x16]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x2d
jae 0x5e81fd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x43]
lea esi, [esi + edx - 0x17]
cmp ebx, 0x2d
jb 0x5e8179
jmp 0x5e81f1
mov dword [esp], 0
lea eax, [esp + 0x43]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2d
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x70
ret
mov eax, ebx
mov ecx, 0x2d
call fcn.0045f150
mov eax, ebp
mov ecx, 0x2d
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.005e8130
Function at 0x5e8a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e8b38
sub esp, 0x24
mov dword [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x16], 0x75
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0x73
mov byte [esp + 0x19], 0x75
mov byte [esp + 0x1a], 0x70
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x6f
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x3a
mov byte [esp + 0x22], 0x20
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xd
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.005e8a90

Function at 0x5e8e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e8f57
sub esp, 0x40
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f346
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x73
mov byte [esp + 0x18], 0x6e
mov byte [esp + 0x19], 0x31
mov byte [esp + 0x1a], 0x3a
mov byte [esp + 0x1b], 0x20
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x6e
mov byte [esp + 0x22], 0x61
mov byte [esp + 0x23], 0x6c
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x20
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2c], 0x6e
mov byte [esp + 0x2d], 0x20
mov byte [esp + 0x2e], 0x70
mov byte [esp + 0x2f], 0x61
mov byte [esp + 0x30], 0x72
mov byte [esp + 0x31], 0x73
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], 0x54
mov byte [esp + 0x34], 0x61
mov byte [esp + 0x35], 0x67
mov byte [esp + 0x36], 0x41
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], 0x64
mov byte [esp + 0x39], 0x4c
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x67
mov byte [esp + 0x3d], 0x74
mov byte [esp + 0x3e], 0x68
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x29
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
call fcn.0045dcb0
jmp fcn.005e8e30
Function at 0x5ea870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ea94a
sub esp, 0x68
mov dword [esp + 0x3e], 0xc697293
lea edi, [esp + 0x40]
lea esi, [0x791c90]
call fcn.0045f7fc
mov dword [esp + 0x14], 0xb100609
lea edi, [esp + 0x16]
lea esi, [0x7dca84]
call fcn.0045f7fc
xor eax, eax
jmp 0x5ea8cf
movzx edi, byte [esp + ebx + 0x3e]
lea edx, [edi + edx + 0x47]
mov byte [esp + ebp + 0x3e], dl
xchg esi, eax
mov byte [esp + ebx + 0x3e], al
xchg esi, eax
add eax, 2
cmp eax, 0x2a
jge 0x5ea901
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x2a
jae 0x5ea93d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x3e]
lea esi, [esi + edx + 0x47]
cmp ebx, 0x2a
jb 0x5ea8b9
jmp 0x5ea931
mov dword [esp], 0
lea eax, [esp + 0x3e]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2a
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
add esp, 0x68
ret
mov eax, ebx
mov ecx, 0x2a
call fcn.0045f150
mov eax, ebp
mov ecx, 0x2a
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.005ea870

Function at 0x5eab20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5eac0b
sub esp, 0x34
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f349
mov byte [esp + 0x16], 0x32
mov byte [esp + 0x17], 0x30
mov byte [esp + 0x18], 0x30
mov byte [esp + 0x19], 0x36
mov byte [esp + 0x1a], 0x30
mov byte [esp + 0x1b], 0x31
mov byte [esp + 0x1c], 0x30
mov byte [esp + 0x1d], 0x32
mov byte [esp + 0x1e], 0x31
mov byte [esp + 0x1f], 0x35
mov byte [esp + 0x20], 0x30
mov byte [esp + 0x21], 0x34
mov byte [esp + 0x22], 0x30
mov byte [esp + 0x23], 0x35
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x25], 0x39
mov byte [esp + 0x26], 0x39
mov byte [esp + 0x27], 0x39
mov byte [esp + 0x28], 0x39
mov byte [esp + 0x29], 0x39
mov byte [esp + 0x2a], 0x39
mov byte [esp + 0x2b], 0x39
mov byte [esp + 0x2c], 0x39
mov byte [esp + 0x2d], 0x39
mov byte [esp + 0x2e], 0x5a
mov byte [esp + 0x2f], 0x30
mov byte [esp + 0x30], 0x37
mov byte [esp + 0x31], 0x30
mov byte [esp + 0x32], 0x30
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1d
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
call fcn.0045dcb0
jmp fcn.005eab20
Function at 0x5ead30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5eade2
sub esp, 0x24
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x14], 0x30
mov byte [esp + 0x15], 0x36
mov byte [esp + 0x16], 0x30
mov byte [esp + 0x17], 0x31
mov byte [esp + 0x18], 0x30
mov byte [esp + 0x19], 0x32
mov byte [esp + 0x1a], 0x31
mov byte [esp + 0x1b], 0x35
mov byte [esp + 0x1c], 0x30
mov byte [esp + 0x1d], 0x34
mov byte [esp + 0x1e], 0x5a
mov byte [esp + 0x1f], 0x30
mov byte [esp + 0x20], 0x37
mov byte [esp + 0x21], 0x30
mov byte [esp + 0x22], 0x30
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xf
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.005ead30