joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ef552
sub esp, 0x40
mov dword [esp + 0x17], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f346
mov byte [esp + 0x17], 0x63
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x19], 0x79
mov byte [esp + 0x1a], 0x70
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], 0x6f
mov byte [esp + 0x1d], 0x2f
mov byte [esp + 0x1e], 0x63
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0x68
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x24], 0x3a
mov byte [esp + 0x25], 0x20
mov byte [esp + 0x26], 0x6f
mov byte [esp + 0x27], 0x75
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], 0x70
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], 0x74
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0x73
mov byte [esp + 0x2e], 0x6d
mov byte [esp + 0x2f], 0x61
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], 0x72
mov byte [esp + 0x34], 0x20
mov byte [esp + 0x35], 0x74
mov byte [esp + 0x36], 0x68
mov byte [esp + 0x37], 0x61
mov byte [esp + 0x38], 0x6e
mov byte [esp + 0x39], 0x20
mov byte [esp + 0x3a], 0x69
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x70
mov byte [esp + 0x3d], 0x75
mov byte [esp + 0x3e], 0x74
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x28
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
call fcn.0045dcb0
jmp fcn.004ef430
Function at 0x5431c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5432ec
sub esp, 0x5c
nop
lea edi, [esp + 0x3c]
lea esi, [0x78efe3]
call fcn.0045f810
xor eax, eax
jmp 0x5431f7
movzx ebp, byte [esp + eax + 0x3c]
add ebx, ebp
mov byte [esp + eax + 0x3c], bl
inc eax
cmp eax, 0x20
jge 0x54320d
lea edx, [0x78efc3]
movzx ebx, byte [eax + edx]
jb 0x5431eb
jmp 0x5432e1
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [esp + 0xc], 0x20
call fcn.004fc2f0
nop
lea edi, [esp + 0x1c]
lea esi, [0x78f023]
call fcn.0045f810
xor eax, eax
jmp 0x543257
movzx ebp, byte [esp + eax + 0x1c]
xor ebp, ebx
xchg ebp, ebx
mov byte [esp + eax + 0x1c], bl
xchg ebp, ebx
inc eax
cmp eax, 0x20
jge 0x54326a
lea edx, [0x78f003]
movzx ebx, byte [edx + eax]
jb 0x543247
jmp 0x5432d7
mov eax, dword [esp + 0x60]
mov ecx, dword [eax + 4]
mov dword [esp], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [esp + 0xc], 0x20
call fcn.004fc2f0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax + 8]
mov dword [ecx], 1
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0xffffffff
mov dword [ecx + 0x10], 0xffffffff
mov dword [ecx + 0x14], 0xffffffff
mov dword [ecx + 0x18], 0xfffffffe
mov dword [ecx + 0x1c], 0
mov dword [esp + 0x64], eax
add esp, 0x5c
ret
mov ecx, 0x20
call fcn.0045f150
mov ecx, 0x20
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.005431c0

Function at 0x54d1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54d295
sub esp, 0x2c
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x14], 0x50
mov byte [esp + 0x15], 0x35
mov byte [esp + 0x16], 0x32
mov byte [esp + 0x17], 0x31
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x74
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0x6e
mov byte [esp + 0x20], 0x6f
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x20
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], 0x20
mov byte [esp + 0x26], 0x63
mov byte [esp + 0x27], 0x75
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x76
mov byte [esp + 0x2a], 0x65
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x17
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
call fcn.0045dcb0
jmp fcn.0054d1d0
Function at 0x54d2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54d363
sub esp, 0x2c
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34b
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0x76
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x64
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], 0x63
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x61
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x28], 0x67
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x68
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x15
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
call fcn.0045dcb0
jmp fcn.0054d2a0
Function at 0x54e520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54e5e3
sub esp, 0x2c
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34b
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0x76
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x64
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], 0x63
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x61
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x28], 0x67
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x68
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x15
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
call fcn.0045dcb0
jmp fcn.0054e520
Function at 0x54eae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54ebf8
sub esp, 0x3c
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f347
mov byte [esp + 0x15], 0x69
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x76
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x19], 0x6c
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x64
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0x50
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x38
mov byte [esp + 0x20], 0x34
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x6d
mov byte [esp + 0x25], 0x70
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x73
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0x64
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0x70
mov byte [esp + 0x2e], 0x6f
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x30], 0x6e
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], 0x20
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x6e
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], 0x64
mov byte [esp + 0x38], 0x69
mov byte [esp + 0x39], 0x6e
mov byte [esp + 0x3a], 0x67
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x26
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x3c
ret
call fcn.0045dcb0
jmp fcn.0054eae0

Function at 0x54fa50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x18]
cmp eax, dword [ecx + 8]
jbe 0x54fb3a
sub esp, 0x98
mov dword [esp + 0x57], 0xfd1934eb
lea edi, [esp + 0x58]
lea esi, [0x794f40]
call fcn.0045f7c0
mov dword [esp + 0x15], 0x34113535
lea edi, [esp + 0x17]
lea esi, [0x7dd8e2]
call fcn.0045f7c0
xor eax, eax
jmp 0x54fab6
movzx edi, byte [esp + ebx + 0x57]
lea edx, [edi + edx + 5]
mov byte [esp + ebp + 0x57], dl
xchg esi, eax
mov byte [esp + ebx + 0x57], al
xchg esi, eax
add eax, 2
cmp eax, 0x42
jge 0x54fae8
movzx edx, byte [esp + eax + 0x15]
movzx ebx, byte [esp + eax + 0x16]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x41
jae 0x54fb2d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x57]
lea esi, [esi + edx + 5]
cmp ebx, 0x41
jb 0x54faa0
jmp 0x54fb21
mov dword [esp], 0
lea eax, [esp + 0x57]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x41
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], ecx
add esp, 0x98
ret
mov eax, ebx
mov ecx, 0x41
call fcn.0045f150
mov eax, ebp
mov ecx, 0x41
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.0054fa50
Function at 0x554500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5546dc
sub esp, 0x7c
lea edi, [esp + 0x24]
mov esi, dword [esp + 0x80]
call fcn.0045f7fc
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.00553ab0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
lea edi, [esp + 0x54]
xor eax, eax
call fcn.0045f346
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x84]
xor ecx, ecx
jmp 0x5545b0
mov edx, dword [esp + 0x1c]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x55467a
mov dword [esp + 0x1c], ecx
lea edx, [esp + ecx*8 + 0x54]
mov ebx, dword [edx]
mov dword [esp + 0x18], ebx
mov edx, dword [edx + 4]
imul ebp, ecx, 0x33
mov esi, ebp
sar ebp, 0x1f
shr ebp, 0x1d
add ebp, esi
mov dword [esp + 0x50], ebp
and ebp, 0xfffffff8
sub esi, ebp
mov ecx, esi
shl ebx, cl
shl edx, cl
mov dword [esp + 0x4c], edx
lea ebp, [ecx - 0x20]
mov ecx, ebp
mov edi, dword [esp + 0x18]
shl edi, cl
neg ecx
mov edx, dword [esp + 0x18]
shr edx, cl
cmp ebp, 0x20
sbb ebp, ebp
and edi, ebp
cmp esi, 0x20
sbb ebp, ebp
and ebx, ebp
mov dword [esp + 0x20], ebx
mov byte [esp + 8], bl
mov esi, dword [esp + 0x4c]
and esi, ebp
mov ebp, ebx
shr ebx, 8
shr ebp, 0x10
mov dword [esp + 0x4c], ebp
mov ebp, dword [esp + 0x20]
shr ebp, 0x18
cmp ecx, 0x20
sbb ecx, ecx
and edx, ecx
or esi, edx
or edi, esi
mov edx, edi
shl edi, 0x18
or edi, ebx
xchg edi, eax
mov byte [esp + 9], al
xchg edi, eax
mov ebx, edx
shl edx, 0x10
mov esi, dword [esp + 0x4c]
or esi, edx
xchg esi, eax
mov byte [esp + 0xa], al
xchg esi, eax
mov edx, ebx
shl ebx, 8
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x50]
xor ecx, ecx
jmp 0x5546b4
test byte [eax], al
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], 0x20
mov dword [esp + 0x90], 0x20
add esp, 0x7c
ret
test byte [eax], al
movzx ebp, byte [eax + edx]
movzx esi, byte [esp + ecx + 0x10]
or ebp, esi
xchg ebp, ebx
mov byte [eax + edx], bl
xchg ebp, ebx
inc ecx
mov edx, ebx
cmp ecx, 8
jge 0x5545a9
mov ebx, edx
sar edx, 3
add edx, ecx
cmp edx, 0x20
jge 0x5545a9
jb 0x55469d
mov eax, edx
mov ecx, 0x20
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.00554500
Function at 0x5548e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x554a66
sub esp, 0x6c
lea edi, [esp + 0x40]
xor eax, eax
call fcn.0045f346
mov ecx, dword [0x72400c]
lea edx, [esp + 0x40]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 8], ecx
call fcn.00553ca0
nop
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x68], ecx
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f348
mov ecx, dword [esp + 0x74]
mov dword [esp], ecx
lea edx, [esp + 0x14]
mov dword [esp + 4], edx
call fcn.00554500
mov ecx, dword [esp + 0xc]
test ecx, ecx
jbe 0x554a5c
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [esp + 0x74]
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 8]
movzx edi, byte [edi]
and edi, 1
mov dword [esp + 0x38], edi
sar edi, 0x1f
nop
nop
xor ebx, ebx
mov eax, dword [esp + 0x38]
sub ebx, eax
mov dword [esp + 0x34], ebx
mov eax, 0
sbb eax, edi
mov dword [esp + 0x3c], eax
and ecx, ebx
and edx, eax
mov edi, ebx
not ebx
not eax
and ebp, ebx
or ecx, ebp
mov ebp, dword [esp + 0x70]
mov dword [ebp], ecx
and esi, eax
or edx, esi
mov dword [ebp + 4], edx
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + 8]
and edx, edi
mov esi, dword [ecx + 0xc]
mov edi, dword [esp + 0x3c]
and esi, edi
mov edi, dword [esp + 0x74]
mov ecx, dword [edi + 8]
and ecx, ebx
or ecx, edx
mov edx, dword [edi + 0xc]
mov dword [ebp + 8], ecx
and edx, eax
or edx, esi
mov dword [ebp + 0xc], edx
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + 0x10]
mov esi, dword [esp + 0x34]
and edx, esi
mov esi, dword [ecx + 0x14]
mov ecx, dword [esp + 0x3c]
and esi, ecx
mov ecx, dword [edi + 0x10]
and ecx, ebx
or ecx, edx
mov edx, dword [edi + 0x14]
mov dword [ebp + 0x10], ecx
and edx, eax
or edx, esi
mov dword [ebp + 0x14], edx
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x34]
and edx, esi
mov esi, dword [ecx + 0x1c]
mov ecx, dword [esp + 0x3c]
and esi, ecx
mov ecx, dword [edi + 0x18]
and ecx, ebx
or ecx, edx
mov edx, dword [edi + 0x1c]
mov dword [ebp + 0x18], ecx
and edx, eax
or edx, esi
mov dword [ebp + 0x1c], edx
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + 0x20]
mov esi, dword [esp + 0x34]
and esi, edx
mov ecx, dword [ecx + 0x24]
mov edx, dword [esp + 0x3c]
and edx, ecx
mov ecx, dword [edi + 0x20]
and ebx, ecx
or ebx, esi
mov ecx, dword [edi + 0x24]
mov dword [ebp + 0x20], ebx
and eax, ecx
or eax, edx
mov dword [ebp + 0x24], eax
mov dword [esp + 0x78], ebp
add esp, 0x6c
ret
xor eax, eax
mov ecx, eax
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.005548e0
Function at 0x558350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x558512
sub esp, 0x60
mov dword [esp + 0x17], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f33e
mov byte [esp + 0x17], 0x63
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x19], 0x79
mov byte [esp + 0x1a], 0x70
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], 0x6f
mov byte [esp + 0x1d], 0x2f
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x63
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x68
mov byte [esp + 0x22], 0x3a
mov byte [esp + 0x23], 0x20
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x25], 0x6e
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x6e
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x6c
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x2f], 0x72
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x31], 0x72
mov byte [esp + 0x32], 0x3a
mov byte [esp + 0x33], 0x20
mov byte [esp + 0x34], 0x6e
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x73
mov byte [esp + 0x37], 0x74
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x63
mov byte [esp + 0x3a], 0x20
mov byte [esp + 0x3b], 0x53
mov byte [esp + 0x3c], 0x63
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x61
mov byte [esp + 0x40], 0x72
mov byte [esp + 0x41], 0x42
mov byte [esp + 0x42], 0x61
mov byte [esp + 0x43], 0x73
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x45], 0x4d
mov byte [esp + 0x46], 0x75
mov byte [esp + 0x47], 0x6c
mov byte [esp + 0x48], 0x74
mov byte [esp + 0x49], 0x20
mov byte [esp + 0x4a], 0x72
mov byte [esp + 0x4b], 0x65
mov byte [esp + 0x4c], 0x74
mov byte [esp + 0x4d], 0x75
mov byte [esp + 0x4e], 0x72
mov byte [esp + 0x4f], 0x6e
mov byte [esp + 0x50], 0x65
mov byte [esp + 0x51], 0x64
mov byte [esp + 0x52], 0x20
mov byte [esp + 0x53], 0x74
mov byte [esp + 0x54], 0x68
mov byte [esp + 0x55], 0x65
mov byte [esp + 0x56], 0x20
mov byte [esp + 0x57], 0x69
mov byte [esp + 0x58], 0x64
mov byte [esp + 0x59], 0x65
mov byte [esp + 0x5a], 0x6e
mov byte [esp + 0x5b], 0x74
mov byte [esp + 0x5c], 0x69
mov byte [esp + 0x5d], 0x74
mov byte [esp + 0x5e], 0x79
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x48
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
add esp, 0x60
ret
call fcn.0045dcb0
jmp fcn.00558350
Function at 0x5596f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x559841
sub esp, 0x48
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f343
mov byte [esp + 0x14], 0x63
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x70
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x2f
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x1e], 0x68
mov byte [esp + 0x1f], 0x3a
mov byte [esp + 0x20], 0x20
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x23], 0x74
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0x20
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2d], 0x6f
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x2f], 0x3a
mov byte [esp + 0x30], 0x20
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x32], 0x73
mov byte [esp + 0x33], 0x4c
mov byte [esp + 0x34], 0x65
mov byte [esp + 0x35], 0x73
mov byte [esp + 0x36], 0x73
mov byte [esp + 0x37], 0x20
mov byte [esp + 0x38], 0x69
mov byte [esp + 0x39], 0x6e
mov byte [esp + 0x3a], 0x70
mov byte [esp + 0x3b], 0x75
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], 0x20
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], 0x6f
mov byte [esp + 0x40], 0x6f
mov byte [esp + 0x41], 0x20
mov byte [esp + 0x42], 0x6c
mov byte [esp + 0x43], 0x61
mov byte [esp + 0x44], 0x72
mov byte [esp + 0x45], 0x67
mov byte [esp + 0x46], 0x65
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x33
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
call fcn.0045dcb0
jmp fcn.005596f0
Function at 0x559850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55993d
sub esp, 0x34
lea edi, [esp + 0x14]
xor eax, eax
call fcn.0045f348
mov byte [esp + 0x14], 0x63
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x70
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x2f
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x1e], 0x68
mov byte [esp + 0x1f], 0x3a
mov byte [esp + 0x20], 0x20
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x23], 0x76
mov byte [esp + 0x24], 0x61
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0x69
mov byte [esp + 0x27], 0x64
mov byte [esp + 0x28], 0x20
mov byte [esp + 0x29], 0x70
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x2e], 0x63
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], 0x65
mov byte [esp + 0x32], 0x79
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1f
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
call fcn.0045dcb0
jmp fcn.00559850
Function at 0x55ef40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55efe3
sub esp, 0x24
mov dword [esp + 0x17], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x64
mov byte [esp + 0x19], 0x76
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x33
mov byte [esp + 0x1e], 0x32
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x6c
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.0055ef40

Function at 0x55f1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55f268
sub esp, 0x24
mov dword [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x16], 0x52
mov byte [esp + 0x17], 0x65
mov byte [esp + 0x18], 0x67
mov byte [esp + 0x19], 0x44
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x65
mov byte [esp + 0x1d], 0x74
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x4b
mov byte [esp + 0x20], 0x65
mov byte [esp + 0x21], 0x79
mov byte [esp + 0x22], 0x57
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xd
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.0055f1c0

Function at 0x55f6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55f76d
sub esp, 0x24
mov dword [esp + 0x15], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x15], 0x52
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x17], 0x67
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1b], 0x56
mov byte [esp + 0x1c], 0x61
mov byte [esp + 0x1d], 0x6c
mov byte [esp + 0x1e], 0x75
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x45
mov byte [esp + 0x21], 0x78
mov byte [esp + 0x22], 0x57
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.0045dcb0
jmp fcn.0055f6c0