joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c230e
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0xcb
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5cd260]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d8b80]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x4c2320]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x4c21b4
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x4c21d6
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0xe
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x3e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x85
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x10
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x61
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x76
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xab
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x63
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xbc
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x75
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xfb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe8
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xad
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb4
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.004c2120
Function at 0x4c3aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c3b6a
sub esp, 0x44
lea edi, [esp + 0x2c]
lea esi, [0x5e878b]
call fcn.00461e54
lea edi, [esp + 0x14]
lea esi, [0x61b308]
call fcn.00461e54
xor eax, eax
jmp 0x4c3af1
movzx edi, byte [esp + ebx + 0x2c]
sub edi, edx
lea edx, [edi - 0x59]
mov byte [esp + ebp + 0x2c], dl
lea edx, [esi - 0x59]
mov byte [esp + ebx + 0x2c], dl
add eax, 2
cmp eax, 0x18
jge 0x4c3b21
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x18
jae 0x4c3b5d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x2c]
sub esi, edx
cmp ebx, 0x18
jb 0x4c3ad9
jmp 0x4c3b51
mov dword [esp], 0
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x44
ret
mov eax, ebx
mov ecx, 0x18
call fcn.00461830
mov eax, ebp
mov ecx, 0x18
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004c3aa0
Function at 0x4ca930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cab2a
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x3e
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5cd3e0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d8dc0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x4cab40]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x4ca9c4
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x4ca9e6
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0x85
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x28
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x63
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc8
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x88
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xec
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x37
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xfb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe8
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xad
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb4
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.004ca930
Function at 0x4cd800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cd8da
sub esp, 0x48
mov dword [esp + 0x15], 0xda17ac41
lea edi, [esp + 0x16]
lea esi, [0x5e8e1f]
call fcn.00461e54
mov dword [esp + 0x2e], 0x16150a0f
lea edi, [esp + 0x30]
lea esi, [0x61b584]
call fcn.00461e54
xor eax, eax
jmp 0x4cd861
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x4a]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x4a]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0x1a
jge 0x4cd891
movzx edx, byte [esp + eax + 0x2e]
movzx ebx, byte [esp + eax + 0x2f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x19
jae 0x4cd8cd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0x19
jb 0x4cd849
jmp 0x4cd8c1
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x19
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
mov eax, ebx
mov ecx, 0x19
call fcn.00461830
mov eax, ebp
mov ecx, 0x19
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004cd800
Function at 0x4cf520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cf6ea
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x44
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5cd4a0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d8ee0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x4cf700]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x4cf5b4
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x4cf5d6
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0x96
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x9c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x38
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x66
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc4
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x47
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc2
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x99
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x36
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x64
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x83
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x40
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x95
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x29
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x49
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xad
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.004cf520
Function at 0x4d8b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d8c02
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, [0x5e59e3]
call fcn.00461e68
mov dword [esp + 0x26], 0x2070207
lea edi, [esp + 0x28]
lea esi, [0x61ac8a]
call fcn.00461e68
xor eax, eax
jmp 0x4d8b89
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x16]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x16]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x4d8bb9
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x4d8bf5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x4d8b71
jmp 0x4d8be9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00461830
mov eax, ebp
mov ecx, 0x10
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004d8b30

Function at 0x4d9770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d9842
sub esp, 0x40
lea edi, [esp + 0x16]
lea esi, [0x5e70bb]
call fcn.00461e5e
mov dword [esp + 0x2a], 0xb100c0a
lea edi, [esp + 0x2c]
lea esi, [0x61b12e]
call fcn.00461e5e
xor eax, eax
jmp 0x4d97c7
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x78]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0x16
jge 0x4d97f9
movzx edx, byte [esp + eax + 0x2a]
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x14
jae 0x4d9835
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x78]
cmp ebx, 0x14
jb 0x4d97b1
jmp 0x4d9829
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x14
call fcn.00461830
mov eax, ebp
mov ecx, 0x14
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004d9770
Function at 0x4e2040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e2114
sub esp, 0x28
mov dword [esp + 0x16], 0x53526e23
mov dword [esp + 0x1a], 0xc453067
mov dword [esp + 0x1e], 0x5000707
mov dword [esp + 0x20], 0x6070500
mov dword [esp + 0x24], 0x30205
xor eax, eax
jmp 0x4e209b
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x2d]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x2d]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xa
jge 0x4e20cb
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4e2107
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 8
jb 0x4e2083
jmp 0x4e20fb
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004e2040
Function at 0x4e7c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e7d4a
sub esp, 0x50
mov dword [esp + 0x15], 0x221a2573
lea edi, [esp + 0x16]
lea esi, [0x5ea20e]
call fcn.00461e4a
mov dword [esp + 0x32], 0x1a141618
lea edi, [esp + 0x34]
lea esi, [0x61b850]
call fcn.00461e4a
xor eax, eax
jmp 0x4e7ccf
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x35]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x1e
jge 0x4e7d01
movzx edx, byte [esp + eax + 0x32]
movzx ebx, byte [esp + eax + 0x33]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x1d
jae 0x4e7d3d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x35]
cmp ebx, 0x1d
jb 0x4e7cb9
jmp 0x4e7d31
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1d
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x50
ret
mov eax, ebx
mov ecx, 0x1d
call fcn.00461830
mov eax, ebp
mov ecx, 0x1d
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004e7c70
Function at 0x4ec180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ec271
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x4ec1bc
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x4ec1f5
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.004015f0
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4ec1b1
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4ec1ff
inc eax
cmp eax, 4
jge 0x4ec214
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x4ec26a
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00401620
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x4ec23b
jmp 0x4ec1fe
call fcn.004603c0
jmp fcn.004ec180
Function at 0x4effd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f009c
sub esp, 0x24
mov dword [esp + 0x1c], 0x6f707974
mov dword [esp + 0x20], 0x41f982a2
mov dword [esp + 0x14], 0x40006
mov dword [esp + 0x18], 0x5000403
xor eax, eax
jmp 0x4f0021
movzx edi, byte [esp + ebx + 0x1c]
lea edx, [edi + edx - 0x39]
mov byte [esp + ebp + 0x1c], dl
xchg esi, eax
mov byte [esp + ebx + 0x1c], al
xchg esi, eax
add eax, 2
cmp eax, 8
jge 0x4f0053
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4f008f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x1c]
lea esi, [esi + edx - 0x39]
cmp ebx, 8
jb 0x4f000b
jmp 0x4f0083
mov dword [esp], 0
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004effd0

Function at 0x4f0db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f0e7b
sub esp, 0x28
mov dword [esp + 0x14], 0xfc061389
mov dword [esp + 0x18], 0x8d4e1cb9
lea edi, [esp + 0x1c]
lea esi, [0x61a588]
call fcn.00461e72
xor eax, eax
jmp 0x4f0e02
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi + 0x63]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi + 0x63]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xc
jge 0x4f0e32
movzx edx, byte [esp + eax + 0x1c]
movzx ebx, byte [esp + eax + 0x1d]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4f0e6e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 8
jb 0x4f0dea
jmp 0x4f0e62
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004f0db0
Function at 0x4fc840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fc912
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x5e426c]
call fcn.00461e72
mov dword [esp + 0x22], 0x6060503
lea edi, [esp + 0x24]
lea esi, [0x61a768]
call fcn.00461e72
xor eax, eax
jmp 0x4fc897
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x35]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x4fc8c9
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x4fc905
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x35]
cmp ebx, 0xc
jb 0x4fc881
jmp 0x4fc8f9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.00461830
mov eax, ebp
mov ecx, 0xc
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004fc840

Function at 0x4fffc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50009c
sub esp, 0x28
mov dword [esp + 0x15], 0x8bcc75be
mov dword [esp + 0x16], 0x658bcc75
mov dword [esp + 0x1a], 0x7246c572
mov dword [esp + 0x1e], 0x2060202
mov dword [esp + 0x20], 0x30206
mov dword [esp + 0x24], 0x2020307
xor eax, eax
jmp 0x500021
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x30]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x500053
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x50008f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x30]
cmp ebx, 9
jb 0x50000b
jmp 0x500083
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.00461830
mov eax, ebp
mov ecx, 9
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004fffc0