joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65fb9680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fb975b
sub esp, 0x30
mov dword [esp + 0x17], 0x643c294e
mov dword [esp + 0x1a], 0x616ee464
mov dword [esp + 0x1e], 0xf6292bfe
mov dword [esp + 0x22], 0x40a0a02
lea edi, [esp + 0x24]
lea esi, [0x661ef27c]
call fcn.65f65002
xor eax, eax
jmp 0x65fb96e0
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx + 0x2d]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x65fb9712
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x65fb974e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx + 0x2d]
cmp ebx, 0xb
jb 0x65fb96ca
jmp 0x65fb9742
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fb9680

Function at 0x65fb9770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fb9843
sub esp, 0x2c
mov dword [esp + 0x15], 0x5f7765d6
mov dword [esp + 0x18], 0xe0f3d05f
mov dword [esp + 0x1c], 0xcaea6be3
lea edi, [esp + 0x20]
lea esi, [0x661ef090]
call fcn.65f65002
xor eax, eax
jmp 0x65fb97c8
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x76]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x65fb97fa
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x65fb9836
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x76]
cmp ebx, 0xb
jb 0x65fb97b2
jmp 0x65fb982a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fb9770
Function at 0x65fb98f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fb99bc
sub esp, 0x24
mov dword [esp + 0x1c], 0xd25ff34f
mov dword [esp + 0x20], 0xcd2369cc
mov dword [esp + 0x14], 0x1030704
mov dword [esp + 0x18], 0x4070106
xor eax, eax
jmp 0x65fb9943
movzx edi, byte [esp + ebx + 0x1c]
sub edi, edx
lea edx, [edi + 0x54]
mov byte [esp + ebp + 0x1c], dl
lea edx, [esi + 0x54]
mov byte [esp + ebx + 0x1c], dl
add eax, 2
cmp eax, 8
jge 0x65fb9973
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x65fb99af
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x1c]
sub esi, edx
cmp ebx, 8
jb 0x65fb992b
jmp 0x65fb99a3
mov dword [esp], 0
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.65f649b0
mov eax, ebp
mov ecx, 8
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fb98f0
Function at 0x65fc0c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fc0d33
sub esp, 0x2c
mov dword [esp + 0x15], 0x14496857
mov dword [esp + 0x18], 0x535ff914
mov dword [esp + 0x1c], 0xf90db9a0
lea edi, [esp + 0x20]
lea esi, [0x661ef0a8]
call fcn.65f65002
xor eax, eax
jmp 0x65fc0cb8
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x54]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x65fc0cea
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x65fc0d26
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x54]
cmp ebx, 0xb
jb 0x65fc0ca2
jmp 0x65fc0d1a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fc0c60

Function at 0x65fc0d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fc0e13
sub esp, 0x2c
mov dword [esp + 0x17], 0xfdfd0149
mov dword [esp + 0x18], 0x72fdfd01
mov dword [esp + 0x1c], 0x6465eef9
lea edi, [esp + 0x20]
lea esi, [0x661ef0b4]
call fcn.65f65002
xor eax, eax
jmp 0x65fc0d98
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx + 0x70]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x65fc0dca
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x65fc0e06
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx + 0x70]
cmp ebx, 9
jb 0x65fc0d82
jmp 0x65fc0dfa
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.65f649b0
mov eax, ebp
mov ecx, 9
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fc0d40
Function at 0x65fc4d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fc4e4c
sub esp, 0x28
mov dword [esp + 0x15], 0x9d6d6f90
mov dword [esp + 0x16], 0xa19d6d6f
mov dword [esp + 0x1a], 0xb7d19765
mov dword [esp + 0x1e], 0x4030600
mov dword [esp + 0x20], 0x6080403
mov dword [esp + 0x24], 0x6000700
xor eax, eax
jmp 0x65fc4dd1
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x3a]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x65fc4e03
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x65fc4e3f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x3a]
cmp ebx, 9
jb 0x65fc4dbb
jmp 0x65fc4e33
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.65f649b0
mov eax, ebp
mov ecx, 9
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fc4d70
Function at 0x65fc7ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fc7b83
sub esp, 0x2c
mov dword [esp + 0x16], 0x727b6634
mov dword [esp + 0x18], 0x3233727b
mov dword [esp + 0x1c], 0x626c227d
lea edi, [esp + 0x20]
lea esi, [0x661eef04]
call fcn.65f65002
xor eax, eax
jmp 0x65fc7b08
movzx edi, byte [esp + ebp + 0x16]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x16], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x65fc7b3a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
lea ebx, [eax + ebx + 0x49]
cmp edx, 0xa
jae 0x65fc7b76
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x16]
xor esi, ebx
cmp ebp, 0xa
jb 0x65fc7af2
jmp 0x65fc7b6a
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
mov eax, edx
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fc7ab0

Function at 0x65fc8ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fc8dbb
sub esp, 0x2c
mov dword [esp + 0x14], 0xb67b5275
mov dword [esp + 0x16], 0x806bb67b
mov dword [esp + 0x1a], 0x87656761
mov dword [esp + 0x1e], 0x5020001
lea edi, [esp + 0x20]
lea esi, [0x661ef13a]
call fcn.65f65002
xor eax, eax
jmp 0x65fc8d42
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi - 5]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi - 5]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x65fc8d72
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x65fc8dae
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x65fc8d2a
jmp 0x65fc8da2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fc8ce0
Function at 0x65fc99d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fc9aa2
sub esp, 0x40
lea edi, [esp + 0x16]
lea esi, [0x66115cc2]
call fcn.65f64fee
mov dword [esp + 0x2a], 0x30e0e03
lea edi, [esp + 0x2c]
lea esi, [0x661efa60]
call fcn.65f64fee
xor eax, eax
jmp 0x65fc9a27
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x3a]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0x16
jge 0x65fc9a59
movzx edx, byte [esp + eax + 0x2a]
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x14
jae 0x65fc9a95
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x3a]
cmp ebx, 0x14
jb 0x65fc9a11
jmp 0x65fc9a89
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x14
call fcn.65f649b0
mov eax, ebp
mov ecx, 0x14
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fc99d0

Function at 0x65fcd830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fcd8fa
sub esp, 0x2c
lea edi, [esp + 0x20]
lea esi, [0x66113460]
call fcn.65f65002
lea edi, [esp + 0x14]
lea esi, [0x661ef0c0]
call fcn.65f65002
xor eax, eax
jmp 0x65fcd881
movzx edi, byte [esp + ebx + 0x20]
sub edi, edx
lea edx, [edi + 0x41]
mov byte [esp + ebp + 0x20], dl
lea edx, [esi + 0x41]
mov byte [esp + ebx + 0x20], dl
add eax, 2
cmp eax, 0xc
jge 0x65fcd8b1
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x65fcd8ed
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x20]
sub esi, edx
cmp ebx, 0xc
jb 0x65fcd869
jmp 0x65fcd8e1
mov dword [esp], 0
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xc
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xc
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fcd830
Function at 0x65fcf960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fcfa2c
sub esp, 0x24
mov dword [esp + 0x1c], 0xc49c689b
mov dword [esp + 0x20], 0x9b986486
mov dword [esp + 0x14], 0x7020703
mov dword [esp + 0x18], 0x4060007
xor eax, eax
jmp 0x65fcf9b1
movzx edi, byte [esp + ebx + 0x1c]
lea edx, [edi + edx - 0x2d]
mov byte [esp + ebp + 0x1c], dl
xchg esi, eax
mov byte [esp + ebx + 0x1c], al
xchg esi, eax
add eax, 2
cmp eax, 8
jge 0x65fcf9e3
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x65fcfa1f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x1c]
lea esi, [esi + edx - 0x2d]
cmp ebx, 8
jb 0x65fcf99b
jmp 0x65fcfa13
mov dword [esp], 0
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.65f649b0
mov eax, ebp
mov ecx, 8
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fcf960
Function at 0x65fe3910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fe3af2
sub esp, 0x20
lea eax, [0x660f0fe0]
mov dword [esp], eax
call fcn.65f0bca0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0xef
lea ecx, [0x660edce0]
mov dword [esp], ecx
call fcn.65f0bca0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x660f7180]
mov dword [esp], ecx
call fcn.65f0bca0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x661050c0]
mov dword [esp], ecx
call fcn.65f0bca0
mov eax, dword [esp + 4]
lea ecx, [0x65fe3b00]
mov dword [eax], ecx
mov ecx, dword [0x663128d0]
test ecx, ecx
jne 0x65fe39a4
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x65fe39c6
call fcn.65f64990
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0x30
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x99
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x27
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x51
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x95
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x38
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x6d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xfb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x9c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x35
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe8
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xad
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb4
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.65f63530
jmp fcn.65fe3910
Function at 0x65fea550
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65fea73c
sub esp, 0x48
mov eax, dword [0x660da7b4]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 8]
movzx ebx, word [ecx + 0xa]
movzx ebp, word [ecx + 0xc]
movzx esi, word [ecx + 2]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], 1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.65fd4f80
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.65f64fee
nop
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.65f64fee
call fcn.65fd3870
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
nop
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call fcn.65f5de40
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x65fea629
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x65fea643
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x65fea6ba
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x65fea690
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x65fea68c
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x65fea685
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x65fea692
mov ebx, 0x1d
jmp 0x65fea6b0
mov ebp, eax
jmp 0x65fea692
mov ebp, eax
cmp ebp, 0xd
jae 0x65fea72f
lea eax, [ebp - 1]
lea edx, [0x660d3580]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x65fea725
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x65fea6ba
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x65fea6ec
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ebx, 0x1f
or ebp, ebx
shr ecx, 0x1f
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x65fea6f4
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xd
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65fea550
Function at 0x65ff3bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65ff3c96
sub esp, 0x40
mov dword [esp + 0x15], 0x756a5c41
lea edi, [esp + 0x16]
lea esi, [0x66116853]
call fcn.65f64fee
mov dword [esp + 0x2a], 0x10050712
lea edi, [esp + 0x2c]
lea esi, [0x661efbd6]
call fcn.65f64fee
xor eax, eax
jmp 0x65ff3c1d
movzx edi, byte [esp + ebx + 0x15]
add edx, edi
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x16
jge 0x65ff3c4d
movzx edx, byte [esp + eax + 0x2a]
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x15
jae 0x65ff3c89
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
add esi, edx
cmp ebx, 0x15
jb 0x65ff3c09
jmp 0x65ff3c7d
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x15
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x15
call fcn.65f649b0
mov eax, ebp
mov ecx, 0x15
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65ff3bc0

Function at 0x65ff6f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65ff6ff2
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x66113400]
call fcn.65f65002
mov dword [esp + 0x22], 0x20104
lea edi, [esp + 0x24]
lea esi, [0x661ef252]
call fcn.65f65002
xor eax, eax
jmp 0x65ff6f77
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x2e]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x65ff6fa9
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x65ff6fe5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x2e]
cmp ebx, 0xc
jb 0x65ff6f61
jmp 0x65ff6fd9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xc
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65ff6f20
Function at 0x65ff7000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65ff70db
sub esp, 0x30
mov dword [esp + 0x17], 0x44142922
mov dword [esp + 0x1a], 0x45133544
mov dword [esp + 0x1e], 0x3364450f
mov dword [esp + 0x22], 0x7080203
lea edi, [esp + 0x24]
lea esi, [0x661ef260]
call fcn.65f65002
xor eax, eax
jmp 0x65ff7062
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi + 0x31]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi + 0x31]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xe
jge 0x65ff7092
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x65ff70ce
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 0xb
jb 0x65ff704a
jmp 0x65ff70c2
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.65ff7000