joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x513d92
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x5e3f18]
call fcn.00461e72
mov dword [esp + 0x22], 0x303000b
lea edi, [esp + 0x24]
lea esi, [0x61a6ea]
call fcn.00461e72
xor eax, eax
jmp 0x513d19
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x35]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x35]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xe
jge 0x513d49
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x513d85
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0xc
jb 0x513d01
jmp 0x513d79
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.00461830
mov eax, ebp
mov ecx, 0xc
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00513cc0

Function at 0x517230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51730a
sub esp, 0x38
mov dword [esp + 0x26], 0x61fabcb7
lea edi, [esp + 0x28]
lea esi, [0x5e607b]
call fcn.00461e68
mov dword [esp + 0x14], 0xb07060e
lea edi, [esp + 0x16]
lea esi, str._a_v_a_r_b_f
call fcn.00461e68
xor eax, eax
jmp 0x517291
movzx edi, byte [esp + ebx + 0x26]
sub edi, edx
lea edx, [edi - 0x4c]
mov byte [esp + ebp + 0x26], dl
lea edx, [esi - 0x4c]
mov byte [esp + ebx + 0x26], dl
add eax, 2
cmp eax, 0x12
jge 0x5172c1
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x12
jae 0x5172fd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x26]
sub esi, edx
cmp ebx, 0x12
jb 0x517279
jmp 0x5172f1
mov dword [esp], 0
lea eax, [esp + 0x26]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x12
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x12
call fcn.00461830
mov eax, ebp
mov ecx, 0x12
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00517230
Function at 0x522da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x522f82
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x12
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5cc5a0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d75c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x522f90]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x522e34
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x522e56
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0x55
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xcc
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x73
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x52
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x3b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe2
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.00522da0
Function at 0x524170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x524243
sub esp, 0x2c
mov dword [esp + 0x16], 0x391b6e39
mov dword [esp + 0x18], 0xc514391b
mov dword [esp + 0x1c], 0x572f7972
lea edi, [esp + 0x20]
lea esi, [0x61a534]
call fcn.00461e72
xor eax, eax
jmp 0x5241c8
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x34]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x5241fa
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x524236
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x34]
cmp ebx, 0xa
jb 0x5241b2
jmp 0x52422a
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00524170
Function at 0x525e10
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x525ee3
sub esp, 0x2c
mov dword [esp + 0x15], 0x566f5e43
mov dword [esp + 0x18], 0x5e4c4d56
mov dword [esp + 0x1c], 0x653c235b
lea edi, [esp + 0x20]
lea esi, [0x61a540]
call fcn.00461e72
xor eax, eax
jmp 0x525e6a
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x1e]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x1e]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x525e9a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x525ed6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x525e52
jmp 0x525eca
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00525e10
Function at 0x5287e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52886d
sub esp, 0x2c
mov dword [esp + 0x21], 0x20fac342
mov dword [esp + 0x24], 0x25234d20
mov dword [esp + 0x28], 0x2f45454e
mov dword [esp + 0x16], 0x4596a606
mov dword [esp + 0x19], 0x63463945
mov dword [esp + 0x1d], 0x78202927
xor eax, eax
jmp 0x528838
movzx ecx, byte [esp + eax + 0x21]
movzx edx, byte [esp + eax + 0x16]
xor edx, ecx
mov byte [esp + eax + 0x16], dl
inc eax
cmp eax, 0xb
jl 0x528827
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
call fcn.004603c0
jmp fcn.005287e0
Function at 0x52d800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52d8ca
sub esp, 0x3c
lea edi, [esp + 0x28]
lea esi, [0x5e6cfb]
call fcn.00461e5e
lea edi, [esp + 0x14]
lea esi, [0x61ae3c]
call fcn.00461e5e
xor eax, eax
jmp 0x52d84f
movzx edi, byte [esp + ebx + 0x28]
lea edx, [edi + edx + 0x45]
mov byte [esp + ebp + 0x28], dl
xchg esi, eax
mov byte [esp + ebx + 0x28], al
xchg esi, eax
add eax, 2
cmp eax, 0x14
jge 0x52d881
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x14
jae 0x52d8bd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x28]
lea esi, [esi + edx + 0x45]
cmp ebx, 0x14
jb 0x52d839
jmp 0x52d8b1
mov dword [esp], 0
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x3c
ret
mov eax, ebx
mov ecx, 0x14
call fcn.00461830
mov eax, ebp
mov ecx, 0x14
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0052d800
Function at 0x52efc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52f092
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, str.ej_n_xa
call fcn.00461e68
mov dword [esp + 0x26], 0xb040c03
lea edi, [esp + 0x28]
lea esi, [0x61aba0]
call fcn.00461e68
xor eax, eax
jmp 0x52f019
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 4]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 4]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x52f049
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x52f085
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x52f001
jmp 0x52f079
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00461830
mov eax, ebp
mov ecx, 0x10
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0052efc0
Function at 0x533990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x533b8a
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0xb
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5ccba0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d7ec0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x533ba0]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x533a24
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x533a46
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0x52
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc2
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x93
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 6
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x21
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x46
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x84
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xfd
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x31
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x46
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb1
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xbd
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xde
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xcf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x93
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x57
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.00533990
Function at 0x535c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x535d1b
sub esp, 0x2c
mov dword [esp + 0x14], 0x6b14a283
mov dword [esp + 0x16], 0xa9b86b14
mov dword [esp + 0x1a], 0x782e7fa6
mov dword [esp + 0x1e], 8
lea edi, [esp + 0x20]
lea esi, [0x61a714]
call fcn.00461e72
xor eax, eax
jmp 0x535ca0
movzx edi, byte [esp + ebx + 0x14]
lea edx, [edi + edx - 0x46]
mov byte [esp + ebp + 0x14], dl
xchg esi, eax
mov byte [esp + ebx + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x535cd2
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x535d0e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
lea esi, [esi + edx - 0x46]
cmp ebx, 0xa
jb 0x535c8a
jmp 0x535d02
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00535c40

Function at 0x536b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x536c03
sub esp, 0x2c
mov dword [esp + 0x16], 0x6ec1705c
mov dword [esp + 0x18], 0x5fcb6ec1
mov dword [esp + 0x1c], 0x5778d0e8
lea edi, [esp + 0x20]
lea esi, [0x61a558]
call fcn.00461e72
xor eax, eax
jmp 0x536b88
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x80]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x536bba
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x536bf6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x80]
cmp ebx, 0xa
jb 0x536b72
jmp 0x536bea
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00536b30
Function at 0x538dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x538e9c
sub esp, 0x28
mov dword [esp + 0x1e], 0xc2b65052
mov dword [esp + 0x20], 0x57d4c2b6
mov dword [esp + 0x24], 0xd96e6576
mov dword [esp + 0x14], 0x3050901
mov dword [esp + 0x16], 0x5020305
mov dword [esp + 0x1a], 0x9020403
xor eax, eax
jmp 0x538e21
movzx edi, byte [esp + ebx + 0x1e]
lea edx, [edi + edx - 0x7c]
mov byte [esp + ebp + 0x1e], dl
xchg esi, eax
mov byte [esp + ebx + 0x1e], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x538e53
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x538e8f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x1e]
lea esi, [esi + edx - 0x7c]
cmp ebx, 0xa
jb 0x538e0b
jmp 0x538e83
mov dword [esp], 0
lea eax, [esp + 0x1e]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00538dc0
Function at 0x53c430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53c612
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x17
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5cae60]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d52e0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x53c620]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x53c4c4
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x53c4e6
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0x6a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe6
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xdb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x98
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x49
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x27
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x46
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x84
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf0
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 2
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x20
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x57
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa8
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x55
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb0
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x43
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.0053c430
Function at 0x53f4c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53f6ae
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0xb0
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5cb0a0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d5640]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x53f6c0]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x53f554
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x53f576
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0xfe
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x13
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x35
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x3d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x98
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x3f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x54
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xcd
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x94
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x35
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x16
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x35
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x6d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x9e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x93
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x57
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.0053f4c0