joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46b11b
sub esp, 0x30
mov dword [esp + 0x17], 0xd6ff850
mov dword [esp + 0x1a], 0x206e130d
mov dword [esp + 0x1e], 0x1470a9a3
mov dword [esp + 0x22], 0xa010008
lea edi, [esp + 0x24]
lea esi, [0x61a5b6]
call fcn.00461e72
xor eax, eax
jmp 0x46b0a2
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi + 0x6b]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi + 0x6b]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xe
jge 0x46b0d2
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x46b10e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 0xb
jb 0x46b08a
jmp 0x46b102
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0046b040
Function at 0x470b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x470c23
sub esp, 0x30
mov dword [esp + 0x15], 0x786c6974
mov dword [esp + 0x18], 0x45632078
mov dword [esp + 0x1c], 0x6a726a5b
lea edi, [esp + 0x20]
lea esi, [0x61a7d8]
call fcn.00461e68
xor eax, eax
jmp 0x470ba8
movzx edi, byte [esp + ebp + 0x15]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x15], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x10
jge 0x470bda
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
lea ebx, [eax + ebx + 0x28]
cmp edx, 0xb
jae 0x470c16
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x15]
xor esi, ebx
cmp ebp, 0xb
jb 0x470b92
jmp 0x470c0a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
mov eax, edx
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00470b50

Function at 0x4721f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4722c2
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, str.iz_alsd
call fcn.00461e68
mov dword [esp + 0x26], 0x20a0a01
lea edi, [esp + 0x28]
lea esi, [0x61aa4a]
call fcn.00461e68
xor eax, eax
jmp 0x472249
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0xb]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0xb]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x472279
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x4722b5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x472231
jmp 0x4722a9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00461830
mov eax, ebp
mov ecx, 0x10
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004721f0
Function at 0x4754d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4755a2
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, [0x5e5103]
call fcn.00461e68
mov dword [esp + 0x26], 0xe0e0806
lea edi, [esp + 0x28]
lea esi, [0x61aa5c]
call fcn.00461e68
xor eax, eax
jmp 0x475529
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 3]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 3]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x475559
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x475595
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x475511
jmp 0x475589
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00461830
mov eax, ebp
mov ecx, 0x10
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004754d0
Function at 0x477140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47721a
sub esp, 0x38
mov dword [esp + 0x15], 0x64d084d3
lea edi, [esp + 0x16]
lea esi, [0x5e5a66]
call fcn.00461e68
mov dword [esp + 0x26], 0xf000c08
lea edi, [esp + 0x28]
lea esi, [0x61aa6e]
call fcn.00461e68
xor eax, eax
jmp 0x47719f
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x78]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x12
jge 0x4771d1
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x11
jae 0x47720d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x78]
cmp ebx, 0x11
jb 0x477189
jmp 0x477201
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x11
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x11
call fcn.00461830
mov eax, ebp
mov ecx, 0x11
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00477140
Function at 0x47b390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47b463
sub esp, 0x2c
mov dword [esp + 0x16], 0xb39fa16f
mov dword [esp + 0x18], 0x9da9b39f
mov dword [esp + 0x1c], 0xa9cff79e
lea edi, [esp + 0x20]
lea esi, [0x61a3c0]
call fcn.00461e72
xor eax, eax
jmp 0x47b3ea
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x30]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x30]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xc
jge 0x47b41a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x47b456
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0xa
jb 0x47b3d2
jmp 0x47b44a
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0047b390
Function at 0x480590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x480663
sub esp, 0x30
mov dword [esp + 0x15], 0x28e5732a
mov dword [esp + 0x18], 0xd131dc28
mov dword [esp + 0x1c], 0xec293896
lea edi, [esp + 0x20]
lea esi, [0x61a808]
call fcn.00461e68
xor eax, eax
jmp 0x4805ea
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x53]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x53]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0x10
jge 0x48061a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x480656
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x4805d2
jmp 0x48064a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00480590

Function at 0x480670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x480743
sub esp, 0x2c
mov dword [esp + 0x16], 0x8832bdd4
mov dword [esp + 0x18], 0xb5b18832
mov dword [esp + 0x1c], 0xacc4c0c9
lea edi, [esp + 0x20]
lea esi, [0x61a3cc]
call fcn.00461e72
xor eax, eax
jmp 0x4806c8
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x5c]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x4806fa
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x480736
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x5c]
cmp ebx, 0xa
jb 0x4806b2
jmp 0x48072a
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00480670
Function at 0x4819e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x481aaa
sub esp, 0x34
lea edi, [esp + 0x24]
lea esi, [0x5e5123]
call fcn.00461e68
lea edi, [esp + 0x14]
lea esi, [0x61a828]
call fcn.00461e68
xor eax, eax
jmp 0x481a31
movzx edi, byte [esp + ebx + 0x24]
sub edi, edx
lea edx, [edi - 0x6b]
mov byte [esp + ebp + 0x24], dl
lea edx, [esi - 0x6b]
mov byte [esp + ebx + 0x24], dl
add eax, 2
cmp eax, 0x10
jge 0x481a61
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x481a9d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x24]
sub esi, edx
cmp ebx, 0x10
jb 0x481a19
jmp 0x481a91
mov dword [esp], 0
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00461830
mov eax, ebp
mov ecx, 0x10
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004819e0
Function at 0x4839e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x483ab3
sub esp, 0x2c
mov dword [esp + 0x16], 0x51736e75
mov dword [esp + 0x18], 0x65065173
mov dword [esp + 0x1c], 0xf6800556
lea edi, [esp + 0x20]
lea esi, [0x61a3d8]
call fcn.00461e72
xor eax, eax
jmp 0x483a38
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x6a]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x483a6a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x483aa6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x6a]
cmp ebx, 0xa
jb 0x483a22
jmp 0x483a9a
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004839e0

Function at 0x485790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48586b
sub esp, 0x2c
mov dword [esp + 0x14], 0xc1919043
mov dword [esp + 0x16], 0xf8c1c191
mov dword [esp + 0x1a], 0x968b8d50
mov dword [esp + 0x1e], 0x3020505
lea edi, [esp + 0x20]
lea esi, [0x61a5c4]
call fcn.00461e72
xor eax, eax
jmp 0x4857f0
movzx edi, byte [esp + ebx + 0x14]
lea edx, [edi + edx - 0x33]
mov byte [esp + ebp + 0x14], dl
xchg esi, eax
mov byte [esp + ebx + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x485822
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x48585e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
lea esi, [esi + edx - 0x33]
cmp ebx, 0xa
jb 0x4857da
jmp 0x485852
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00485790
Function at 0x486c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x486d43
sub esp, 0x2c
mov dword [esp + 0x15], 0x5f585749
mov dword [esp + 0x18], 0x6372525f
mov dword [esp + 0x1c], 0x4873656f
lea edi, [esp + 0x20]
lea esi, [0x61a3e4]
call fcn.00461e72
xor eax, eax
jmp 0x486cc8
movzx edi, byte [esp + ebp + 0x15]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x15], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x486cfa
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
lea ebx, [eax + ebx + 0x1b]
cmp edx, 0xb
jae 0x486d36
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x15]
xor esi, ebx
cmp ebp, 0xb
jb 0x486cb2
jmp 0x486d2a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
mov eax, edx
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00486c70

Function at 0x487080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48715a
sub esp, 0x30
mov dword [esp + 0x15], 0x340b1e08
lea edi, [esp + 0x16]
lea esi, [0x5e433f]
call fcn.00461e72
mov dword [esp + 0x22], 0x80a0200
lea edi, [esp + 0x24]
lea esi, [0x61a5d2]
call fcn.00461e72
xor eax, eax
jmp 0x4870e1
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x3d]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x3d]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xe
jge 0x487111
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xd
jae 0x48714d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xd
jb 0x4870c9
jmp 0x487141
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xd
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xd
call fcn.00461830
mov eax, ebp
mov ecx, 0xd
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00487080
Function at 0x4898a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x489972
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x5e3d68]
call fcn.00461e72
mov dword [esp + 0x22], 0x7020202
lea edi, [esp + 0x24]
lea esi, [0x61a5e0]
call fcn.00461e72
xor eax, eax
jmp 0x4898f9
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x52]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x52]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xe
jge 0x489929
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x489965
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0xc
jb 0x4898e1
jmp 0x489959
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.00461830
mov eax, ebp
mov ecx, 0xc
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004898a0

Function at 0x48a1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48a29a
sub esp, 0x38
mov dword [esp + 0x15], 0x83856579
lea edi, [esp + 0x16]
lea esi, [0x5e5a99]
call fcn.00461e68
mov dword [esp + 0x26], 0x40a0700
lea edi, [esp + 0x28]
lea esi, [0x61aaa4]
call fcn.00461e68
xor eax, eax
jmp 0x48a21f
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x27]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x12
jge 0x48a251
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x11
jae 0x48a28d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x27]
cmp ebx, 0x11
jb 0x48a209
jmp 0x48a281
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x11
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x11
call fcn.00461830
mov eax, ebp
mov ecx, 0x11
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0048a1c0
Function at 0x48d000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48d0db
sub esp, 0x30
mov dword [esp + 0x17], 0x468e651c
mov dword [esp + 0x1a], 0x95870c46
mov dword [esp + 0x1e], 0x656d8854
mov dword [esp + 0x22], 0x80608
lea edi, [esp + 0x24]
lea esi, [0x61a5ee]
call fcn.00461e72
xor eax, eax
jmp 0x48d062
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi - 0x15]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi - 0x15]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xe
jge 0x48d092
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x48d0ce
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 0xb
jb 0x48d04a
jmp 0x48d0c2
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0048d000

Function at 0x48d620
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48d6f3
sub esp, 0x2c
mov dword [esp + 0x15], 0x3c726956
mov dword [esp + 0x18], 0x675a4a3c
mov dword [esp + 0x1c], 0x6268754f
lea edi, [esp + 0x20]
lea esi, [0x61a3f0]
call fcn.00461e72
xor eax, eax
jmp 0x48d67a
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x16]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x16]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x48d6aa
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x48d6e6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x48d662
jmp 0x48d6da
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0048d620
Function at 0x48db70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48dc4c
sub esp, 0x28
mov dword [esp + 0x15], 0x74f918c9
mov dword [esp + 0x16], 0x6574f918
mov dword [esp + 0x1a], 0xbf0e211c
mov dword [esp + 0x1e], 0x5020800
mov dword [esp + 0x20], 0x8070502
mov dword [esp + 0x24], 0x106
xor eax, eax
jmp 0x48dbd1
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x44]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x48dc03
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x48dc3f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x44]
cmp ebx, 9
jb 0x48dbbb
jmp 0x48dc33
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.00461830
mov eax, ebp
mov ecx, 9
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0048db70

Function at 0x48fc10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48fceb
sub esp, 0x2c
mov dword [esp + 0x14], 0xd4f411ea
mov dword [esp + 0x16], 0x9c04d4f4
mov dword [esp + 0x1a], 0x8075749a
mov dword [esp + 0x1e], 0x2050901
lea edi, [esp + 0x20]
lea esi, [0x61a60a]
call fcn.00461e72
xor eax, eax
jmp 0x48fc72
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi + 0x76]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi + 0x76]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x48fca2
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x48fcde
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x48fc5a
jmp 0x48fcd2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0048fc10