joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ccb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50cd92
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0xbc4e40d8
mov dword [esp + 0x14], 0x5a814131
lea edi, [esp + 0x18]
lea esi, [0x61a4bc]
call fcn.00461e72
xor eax, eax
jmp 0x50cd10
movzx edi, byte [esp + ebx + 0x10]
lea edx, [edi + edx + 0x2d]
mov byte [esp + ebp + 0x10], dl
xchg esi, eax
mov byte [esp + ebx + 0x10], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x50cd42
movzx edx, byte [esp + eax + 0x18]
movzx ebx, byte [esp + eax + 0x19]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50cd85
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x10]
lea esi, [esi + edx + 0x2d]
cmp ebx, 8
jb 0x50ccfa
jmp 0x50cd79
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
xor eax, eax
jmp 0x50cd60
movzx ecx, byte [esp + eax + 0x10]
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jl 0x50cd56
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050ccb0

Function at 0x50d2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50d382
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0xd82f789e
mov dword [esp + 0x14], 0xd5e7f4a3
lea edi, [esp + 0x18]
lea esi, [0x61a4c8]
call fcn.00461e72
xor eax, eax
jmp 0x50d302
movzx edi, byte [esp + ebx + 0x10]
sub edi, edx
lea edx, [edi + 0x30]
mov byte [esp + ebp + 0x10], dl
lea edx, [esi + 0x30]
mov byte [esp + ebx + 0x10], dl
add eax, 2
cmp eax, 0xc
jge 0x50d332
movzx edx, byte [esp + eax + 0x18]
movzx ebx, byte [esp + eax + 0x19]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50d375
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x10]
sub esi, edx
cmp ebx, 8
jb 0x50d2ea
jmp 0x50d369
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
xor eax, eax
jmp 0x50d350
movzx ecx, byte [esp + eax + 0x10]
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jl 0x50d346
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050d2a0
Function at 0x50d520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50d60b
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0x690e009b
mov dword [esp + 0x16], 0x2147eb0
mov dword [esp + 0x1a], 0x4070407
mov dword [esp + 0x1c], 0x4000407
mov dword [esp + 0x20], 0x6050500
xor eax, eax
jmp 0x50d58b
movzx edi, byte [esp + ebx + 0x12]
sub edi, edx
lea edx, [edi + 0x45]
mov byte [esp + ebp + 0x12], dl
lea edx, [esi + 0x45]
mov byte [esp + ebx + 0x12], dl
add eax, 2
cmp eax, 0xa
jge 0x50d5bb
movzx edx, byte [esp + eax + 0x1a]
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50d5fe
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
sub esi, edx
cmp ebx, 8
jb 0x50d573
jmp 0x50d5f2
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x50d5d9
movzx ecx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 8
jl 0x50d5cf
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050d520

Function at 0x50d620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50d703
sub esp, 0x20
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0xb210d4b3
mov dword [esp + 0x1c], 0xc5716c4b
mov dword [esp + 8], 0x1000102
mov dword [esp + 0xc], 7
xor eax, eax
jmp 0x50d681
movzx edi, byte [esp + ebx + 0x18]
lea edx, [edi + edx + 0x71]
mov byte [esp + ebp + 0x18], dl
xchg esi, eax
mov byte [esp + ebx + 0x18], al
xchg esi, eax
add eax, 2
cmp eax, 8
jge 0x50d6b3
movzx edx, byte [esp + eax + 8]
movzx ebx, byte [esp + eax + 9]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50d6f6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x18]
lea esi, [esi + edx + 0x71]
cmp ebx, 8
jb 0x50d66b
jmp 0x50d6ea
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor eax, eax
jmp 0x50d6d1
movzx ecx, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 8
jl 0x50d6c7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050d620
Function at 0x50de30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50df13
sub esp, 0x20
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0xfee16eff
mov dword [esp + 0x1c], 0x743661c9
mov dword [esp + 8], 0x3050603
mov dword [esp + 0xc], 0x7000501
xor eax, eax
jmp 0x50de93
movzx edi, byte [esp + ebx + 0x18]
sub edi, edx
lea edx, [edi + 0x25]
mov byte [esp + ebp + 0x18], dl
lea edx, [esi + 0x25]
mov byte [esp + ebx + 0x18], dl
add eax, 2
cmp eax, 8
jge 0x50dec3
movzx edx, byte [esp + eax + 8]
movzx ebx, byte [esp + eax + 9]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50df06
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x18]
sub esi, edx
cmp ebx, 8
jb 0x50de7b
jmp 0x50defa
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor eax, eax
jmp 0x50dee1
movzx ecx, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 8
jl 0x50ded7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050de30

Function at 0x50e2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50e39b
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0x4501749d
mov dword [esp + 0x16], 0xca6f9534
mov dword [esp + 0x1a], 0x1060201
mov dword [esp + 0x1c], 0x70106
mov dword [esp + 0x20], 0x5020204
xor eax, eax
jmp 0x50e319
movzx edi, byte [esp + ebx + 0x12]
lea edx, [edi + edx - 0x23]
mov byte [esp + ebp + 0x12], dl
xchg esi, eax
mov byte [esp + ebx + 0x12], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x50e34b
movzx edx, byte [esp + eax + 0x1a]
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50e38e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
lea esi, [esi + edx - 0x23]
cmp ebx, 8
jb 0x50e303
jmp 0x50e382
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x50e369
movzx ecx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 8
jl 0x50e35f
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050e2b0
Function at 0x50e3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50e493
sub esp, 0x20
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0xbb0263b7
mov dword [esp + 0x1c], 0x7194a09
mov dword [esp + 8], 0x4030105
mov dword [esp + 0xc], 0x1020107
xor eax, eax
jmp 0x50e413
movzx edi, byte [esp + ebx + 0x18]
sub edi, edx
lea edx, [edi + 7]
mov byte [esp + ebp + 0x18], dl
lea edx, [esi + 7]
mov byte [esp + ebx + 0x18], dl
add eax, 2
cmp eax, 8
jge 0x50e443
movzx edx, byte [esp + eax + 8]
movzx ebx, byte [esp + eax + 9]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50e486
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x18]
sub esi, edx
cmp ebx, 8
jb 0x50e3fb
jmp 0x50e47a
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor eax, eax
jmp 0x50e461
movzx ecx, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 8
jl 0x50e457
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050e3b0

Function at 0x50ea40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50eb22
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0x1032d88d
mov dword [esp + 0x14], 0x30989526
lea edi, [esp + 0x18]
lea esi, [0x61a4e0]
call fcn.00461e72
xor eax, eax
jmp 0x50eaa0
movzx edi, byte [esp + ebx + 0x10]
lea edx, [edi + edx + 6]
mov byte [esp + ebp + 0x10], dl
xchg esi, eax
mov byte [esp + ebx + 0x10], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x50ead2
movzx edx, byte [esp + eax + 0x18]
movzx ebx, byte [esp + eax + 0x19]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50eb15
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x10]
lea esi, [esi + edx + 6]
cmp ebx, 8
jb 0x50ea8a
jmp 0x50eb09
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
xor eax, eax
jmp 0x50eaf0
movzx ecx, byte [esp + eax + 0x10]
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jl 0x50eae6
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050ea40
Function at 0x50edb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50ee93
sub esp, 0x20
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x4b4ad9b3
mov dword [esp + 0x1c], 0xf62c8213
mov dword [esp + 8], 0x2070603
mov dword [esp + 0xc], 0x5020406
xor eax, eax
jmp 0x50ee13
movzx edi, byte [esp + ebx + 0x18]
sub edi, edx
lea edx, [edi - 0x4d]
mov byte [esp + ebp + 0x18], dl
lea edx, [esi - 0x4d]
mov byte [esp + ebx + 0x18], dl
add eax, 2
cmp eax, 8
jge 0x50ee43
movzx edx, byte [esp + eax + 8]
movzx ebx, byte [esp + eax + 9]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50ee86
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x18]
sub esi, edx
cmp ebx, 8
jb 0x50edfb
jmp 0x50ee7a
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor eax, eax
jmp 0x50ee61
movzx ecx, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 8
jl 0x50ee57
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050edb0

Function at 0x50eea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50ef8b
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0x79246eb3
mov dword [esp + 0x16], 0x93934856
mov dword [esp + 0x1a], 0x1040201
mov dword [esp + 0x1c], 0x1070104
mov dword [esp + 0x20], 0x2070603
xor eax, eax
jmp 0x50ef09
movzx edi, byte [esp + ebx + 0x12]
lea edx, [edi + edx + 0x3c]
mov byte [esp + ebp + 0x12], dl
xchg esi, eax
mov byte [esp + ebx + 0x12], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x50ef3b
movzx edx, byte [esp + eax + 0x1a]
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50ef7e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
lea esi, [esi + edx + 0x3c]
cmp ebx, 8
jb 0x50eef3
jmp 0x50ef72
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x50ef59
movzx ecx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 8
jl 0x50ef4f
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050eea0
Function at 0x50f0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50f1b3
sub esp, 0x20
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0xacd8a7de
mov dword [esp + 0x1c], 0xccf8dd29
mov dword [esp + 8], 0x1010304
mov dword [esp + 0xc], 0x70106
xor eax, eax
jmp 0x50f133
movzx edi, byte [esp + ebx + 0x18]
sub edi, edx
lea edx, [edi - 0x2b]
mov byte [esp + ebp + 0x18], dl
lea edx, [esi - 0x2b]
mov byte [esp + ebx + 0x18], dl
add eax, 2
cmp eax, 8
jge 0x50f163
movzx edx, byte [esp + eax + 8]
movzx ebx, byte [esp + eax + 9]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x50f1a6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x18]
sub esi, edx
cmp ebx, 8
jb 0x50f11b
jmp 0x50f19a
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor eax, eax
jmp 0x50f181
movzx ecx, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 8
jl 0x50f177
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050f0d0

Function at 0x50fe30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50ff4f
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
lea edi, [esp + 0x14]
lea esi, [0x5e5583]
call fcn.00461e68
mov dword [esp + 0xb], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
movzx eax, byte [esp + 0x18]
movzx ecx, byte [esp + 0x1e]
sub eax, ecx
movzx ecx, byte [esp + 0x21]
movzx edx, byte [esp + 0x1c]
sub ecx, edx
movzx edx, byte [esp + 0x15]
movzx ebx, byte [esp + 0x1f]
sub edx, ebx
movzx ebx, byte [esp + 0x19]
movzx ebp, byte [esp + 0x16]
sub ebx, ebp
movzx ebp, byte [esp + 0x22]
movzx esi, byte [esp + 0x1b]
add ebp, esi
movzx esi, byte [esp + 0x20]
movzx edi, byte [esp + 0x1d]
add esi, edi
xchg esi, eax
mov byte [esp + 2], al
xchg esi, eax
movzx edi, byte [esp + 0x1a]
movzx esi, byte [esp + 0x14]
add esi, edi
movzx edi, byte [esp + 0x17]
xchg edi, eax
mov byte [esp + 1], al
xchg edi, eax
movzx edi, byte [esp + 0x23]
mov byte [esp + 0xb], al
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], bl
xchg ebp, eax
mov byte [esp + 0xf], al
xchg ebp, eax
movzx eax, byte [esp + 2]
mov byte [esp + 0x10], al
xchg esi, eax
mov byte [esp + 0x11], al
xchg esi, eax
movzx eax, byte [esp + 1]
xor eax, edi
mov byte [esp + 0x12], al
mov dword [esp + 3], 0
mov dword [esp + 7], 0
xor eax, eax
jmp 0x50ff36
movzx ecx, byte [esp + eax + 0xb]
mov byte [esp + eax + 3], cl
inc eax
cmp eax, 8
jl 0x50ff2c
mov eax, dword [esp + 3]
mov ecx, dword [esp + 7]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.004603c0
jmp fcn.0050fe30
Function at 0x50ff60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51004b
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0x6c3188be
mov dword [esp + 0x16], 0x67a223f0
mov dword [esp + 0x1a], 0x1050104
mov dword [esp + 0x1c], 0x3060105
mov dword [esp + 0x20], 0x5010605
xor eax, eax
jmp 0x50ffcb
movzx edi, byte [esp + ebx + 0x12]
sub edi, edx
lea edx, [edi - 0x67]
mov byte [esp + ebp + 0x12], dl
lea edx, [esi - 0x67]
mov byte [esp + ebx + 0x12], dl
add eax, 2
cmp eax, 0xa
jge 0x50fffb
movzx edx, byte [esp + eax + 0x1a]
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x51003e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
sub esi, edx
cmp ebx, 8
jb 0x50ffb3
jmp 0x510032
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x510019
movzx ecx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 8
jl 0x51000f
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0050ff60

Function at 0x510520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51060b
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0x187fcbcd
mov dword [esp + 0x16], 0x9a756860
mov dword [esp + 0x1a], 0x60605
mov dword [esp + 0x1c], 0x6070006
mov dword [esp + 0x20], 0x6040103
xor eax, eax
jmp 0x51058b
movzx edi, byte [esp + ebx + 0x12]
sub edi, edx
lea edx, [edi + 0x31]
mov byte [esp + ebp + 0x12], dl
lea edx, [esi + 0x31]
mov byte [esp + ebx + 0x12], dl
add eax, 2
cmp eax, 0xa
jge 0x5105bb
movzx edx, byte [esp + eax + 0x1a]
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x5105fe
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
sub esi, edx
cmp ebx, 8
jb 0x510573
jmp 0x5105f2
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x5105d9
movzx ecx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 8
jl 0x5105cf
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00510520
Function at 0x510cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x510dd2
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0xbb792671
mov dword [esp + 0x14], 0x6dcd2f4a
lea edi, [esp + 0x18]
lea esi, [0x61a4ec]
call fcn.00461e72
xor eax, eax
jmp 0x510d52
movzx edi, byte [esp + ebx + 0x10]
sub edi, edx
lea edx, [edi + 0x64]
mov byte [esp + ebp + 0x10], dl
lea edx, [esi + 0x64]
mov byte [esp + ebx + 0x10], dl
add eax, 2
cmp eax, 0xc
jge 0x510d82
movzx edx, byte [esp + eax + 0x18]
movzx ebx, byte [esp + eax + 0x19]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x510dc5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x10]
sub esi, edx
cmp ebx, 8
jb 0x510d3a
jmp 0x510db9
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
xor eax, eax
jmp 0x510da0
movzx ecx, byte [esp + eax + 0x10]
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jl 0x510d96
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00510cf0

Function at 0x511e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x511f4b
sub esp, 0x2c
mov dword [esp + 0x14], 0x96a72405
mov dword [esp + 0x16], 0x69f596a7
mov dword [esp + 0x1a], 0x6cf90756
mov dword [esp + 0x1e], 0x3020000
lea edi, [esp + 0x20]
lea esi, [0x61a6ce]
call fcn.00461e72
xor eax, eax
jmp 0x511ed0
movzx edi, byte [esp + ebx + 0x14]
lea edx, [edi + edx + 0x5f]
mov byte [esp + ebp + 0x14], dl
xchg esi, eax
mov byte [esp + ebx + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x511f02
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x511f3e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
lea esi, [esi + edx + 0x5f]
cmp ebx, 0xa
jb 0x511eba
jmp 0x511f32
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00511e70
Function at 0x512900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5129d3
sub esp, 0x2c
mov dword [esp + 0x15], 0x33211f33
mov dword [esp + 0x18], 0x2e336f33
mov dword [esp + 0x1c], 0xbdf5252e
lea edi, [esp + 0x20]
lea esi, [0x61a51c]
call fcn.00461e72
xor eax, eax
jmp 0x51295a
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x49]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x49]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x51298a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x5129c6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x512942
jmp 0x5129ba
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00512900

Function at 0x513be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x513cb3
sub esp, 0x2c
mov dword [esp + 0x15], 0x4b72657e
mov dword [esp + 0x18], 0x566d694b
mov dword [esp + 0x1c], 0x646c642e
lea edi, [esp + 0x20]
lea esi, [0x61a528]
call fcn.00461e72
xor eax, eax
jmp 0x513c38
movzx edi, byte [esp + ebp + 0x15]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x15], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x513c6a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
lea ebx, [eax + ebx - 0x2b]
cmp edx, 0xb
jae 0x513ca6
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x15]
xor esi, ebx
cmp ebp, 0xb
jb 0x513c22
jmp 0x513c9a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
mov eax, edx
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00513be0