joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x499299
sub esp, 0x20
lea eax, [0x5b0a60]
mov dword [esp], eax
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x39
lea ecx, [0x5ad780]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5b3dc0]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5bee80]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
lea ecx, [0x4992b0]
mov dword [eax], ecx
mov ecx, dword [0x6d6280]
test ecx, ecx
jne 0x499131
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ebx, dword [esp + 0x14]
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + 0xc], ebx
mov dword [ebx], eax
jmp 0x499162
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x1c]
call fcn.00452020
lea edi, [ecx + 8]
mov eax, dword [esp + 0x14]
call fcn.00452020
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x18]
call fcn.00452020
mov edi, eax
mov eax, ecx
call fcn.00452020
mov ebx, edi
mov edx, dword [ebx]
mov eax, dword [edx]
mov byte [esp], 0x7c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x27
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x41
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 2
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x28
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf6
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xef
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xda
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xad
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x69
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x94
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x27
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x30
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 1
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 4
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00450c10
jmp fcn.00499090
Function at 0x49b960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49ba59
sub esp, 0x30
mov dword [esp + 0x15], 0x6dd472e8
mov dword [esp + 0x18], 0xf1ee4c6d
mov dword [esp + 0x1c], 0x79e7ef04
lea edi, [esp + 0x20]
lea esi, [0x5f9970]
call fcn.00452718
xor eax, eax
jmp 0x49b9ba
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x6e]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x10
jge 0x49b9fa
jae 0x49ba4e
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0x10
jae 0x49ba42
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x49ba36
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x6e]
cmp ebx, 0xb
jb 0x49b9a4
jmp 0x49ba2a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0x10
call fcn.004520a0
mov ecx, 0x10
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0049b960

Function at 0x49bde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49bed8
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, [0x5cf332]
call fcn.00452718
mov dword [esp + 0x26], 0x10c0100
lea edi, [esp + 0x28]
lea esi, [0x5f9a7c]
call fcn.00452718
xor eax, eax
jmp 0x49be3b
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x1b]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x1b]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x49be79
jae 0x49becd
movzx edx, byte [esp + eax + 0x26]
lea ebx, [eax + 1]
cmp ebx, 0x12
jae 0x49bec1
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x10
jae 0x49beb5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x49be23
jmp 0x49bea9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.004520a0
mov eax, ebp
mov ecx, 0x10
call fcn.004520a0
mov eax, ebx
mov ecx, 0x12
call fcn.004520a0
mov ecx, 0x12
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0049bde0
Function at 0x49d180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49d276
sub esp, 0x40
lea edi, [esp + 0x16]
lea esi, [0x5d03e9]
call fcn.0045270e
mov dword [esp + 0x2a], 0x7070b02
lea edi, [esp + 0x2c]
lea esi, [0x5f9e0c]
call fcn.0045270e
xor eax, eax
jmp 0x49d1d9
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
xchg edi, eax
mov byte [esp + ebp + 0x16], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0x16
jge 0x49d217
jae 0x49d26b
movzx edx, byte [esp + eax + 0x2a]
lea ebx, [eax + 1]
cmp ebx, 0x16
jae 0x49d25f
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x14
jae 0x49d253
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x14
jb 0x49d1c3
jmp 0x49d247
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x14
call fcn.004520a0
mov eax, ebp
mov ecx, 0x14
call fcn.004520a0
mov eax, ebx
mov ecx, 0x16
call fcn.004520a0
mov ecx, 0x16
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0049d180
Function at 0x49fe30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49ff29
sub esp, 0x2c
mov dword [esp + 0x17], 0x8a8877fa
mov dword [esp + 0x18], 0x6f8a8877
mov dword [esp + 0x1c], 0x659f7295
lea edi, [esp + 0x20]
lea esi, [0x5f978c]
call fcn.00452722
xor eax, eax
jmp 0x49fe8a
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx - 0x2c]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x49feca
jae 0x49ff1e
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x49ff12
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 9
jae 0x49ff06
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx - 0x2c]
cmp ebx, 9
jb 0x49fe74
jmp 0x49fefa
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.004520a0
mov eax, ebp
mov ecx, 9
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0049fe30
Function at 0x4b2e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b2f73
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0x89e58177
mov dword [esp + 0x16], 0xcdc395e3
mov dword [esp + 0x1a], 0x5070103
mov dword [esp + 0x1c], 0x3010507
mov dword [esp + 0x20], 0x5000701
xor eax, eax
jmp 0x4b2ebd
movzx edi, byte [esp + ebx + 0x12]
sub edi, edx
lea edx, [edi - 0x19]
mov byte [esp + ebp + 0x12], dl
lea edx, [esi - 0x19]
mov byte [esp + ebx + 0x12], dl
add eax, 2
cmp eax, 0xa
jge 0x4b2eff
jae 0x4b2f68
movzx edx, byte [esp + eax + 0x1a]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x4b2f5c
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4b2f50
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
sub esi, edx
cmp ebx, 8
jb 0x4b2ea5
jmp 0x4b2f44
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x4b2f1d
movzx edx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], dl
inc eax
cmp eax, 8
jge 0x4b2f26
jb 0x4b2f13
jmp 0x4b2f3a
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004b2e50

Function at 0x4b4bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b4ca0
sub esp, 0x2c
lea edi, [esp + 0x20]
lea esi, [0x5ce9f4]
call fcn.00452722
lea edi, [esp + 0x14]
lea esi, [0x5f9708]
call fcn.00452722
xor eax, eax
jmp 0x4b4c03
movzx edi, byte [esp + ebx + 0x20]
sub edi, edx
lea edx, [edi + 0x4d]
mov byte [esp + ebp + 0x20], dl
lea edx, [esi + 0x4d]
mov byte [esp + ebx + 0x20], dl
add eax, 2
cmp eax, 0xc
jge 0x4b4c41
jae 0x4b4c95
movzx edx, byte [esp + eax + 0x14]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x4b4c89
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xc
jae 0x4b4c7d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x20]
sub esi, edx
cmp ebx, 0xc
jb 0x4b4beb
jmp 0x4b4c71
mov dword [esp], 0
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov eax, ebp
mov ecx, 0xc
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004b4bb0
Function at 0x4b7570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b7779
sub esp, 0x20
lea eax, [0x5b0a60]
mov dword [esp], eax
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x85
lea ecx, [0x5ad780]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5b1400]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5bb1c0]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
lea ecx, [0x4b7790]
mov dword [eax], ecx
mov ecx, dword [0x6d6280]
test ecx, ecx
jne 0x4b7611
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ebx, dword [esp + 0x14]
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + 0xc], ebx
mov dword [ebx], eax
jmp 0x4b7642
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x1c]
call fcn.00452020
lea edi, [ecx + 8]
mov eax, dword [esp + 0x14]
call fcn.00452020
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x18]
call fcn.00452020
mov edi, eax
mov eax, ecx
call fcn.00452020
mov ebx, edi
mov edx, dword [ebx]
mov eax, dword [edx]
mov byte [esp], 0xc8
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xbf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x71
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xde
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xcf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xfe
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x25
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x52
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x97
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x37
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x6b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa9
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x9d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x40
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc6
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x12
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2c
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00450c10
jmp fcn.004b7570
Function at 0x4bcda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bcf85
sub esp, 0x20
lea eax, [0x5b0a60]
mov dword [esp], eax
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x46
lea ecx, [0x5ad780]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5b2000]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5bc240]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
lea ecx, [0x4bcf90]
mov dword [eax], ecx
mov ecx, dword [0x6d6280]
test ecx, ecx
jne 0x4bce41
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ebx, dword [esp + 0x14]
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + 0xc], ebx
mov dword [ebx], eax
jmp 0x4bce72
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x1c]
call fcn.00452020
lea edi, [ecx + 8]
mov eax, dword [esp + 0x14]
call fcn.00452020
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x18]
call fcn.00452020
mov edi, eax
mov eax, ecx
call fcn.00452020
mov ebx, edi
mov edx, dword [ebx]
mov eax, dword [edx]
mov byte [esp], 0x71
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x83
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x79
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x81
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x71
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x77
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x81
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x77
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x83
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x72
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf1
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00450c10
jmp fcn.004bcda0
Function at 0x4bd060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bd251
sub esp, 0x20
lea eax, [0x5b0a60]
mov dword [esp], eax
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x61
lea ecx, [0x5ad780]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5b2040]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5bc2a0]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
lea ecx, [0x4bd260]
mov dword [eax], ecx
mov ecx, dword [0x6d6280]
test ecx, ecx
jne 0x4bd101
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ebx, dword [esp + 0x14]
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + 0xc], ebx
mov dword [ebx], eax
jmp 0x4bd132
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x1c]
call fcn.00452020
lea edi, [ecx + 8]
mov eax, dword [esp + 0x14]
call fcn.00452020
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x18]
call fcn.00452020
mov edi, eax
mov eax, ecx
call fcn.00452020
mov ebx, edi
mov edx, dword [ebx]
mov eax, dword [edx]
mov byte [esp], 0x94
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x53
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa9
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x41
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x84
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x36
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x6e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb6
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x64
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xcb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x92
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x50
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa3
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00450c10
jmp fcn.004bd060
Function at 0x4ca880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ca983
sub esp, 0x78
mov dword [esp + 0x15], 0xed495ec0
lea edi, [esp + 0x16]
lea esi, [0x5d5d50]
call fcn.004526c8
mov dword [esp + 0x46], 0x1d2516
lea edi, [esp + 0x48]
lea esi, [0x5fad64]
call fcn.004526c8
xor eax, eax
jmp 0x4ca8e3
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x3b]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x3b]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0x32
jge 0x4ca921
jae 0x4ca978
movzx edx, byte [esp + eax + 0x46]
lea ebx, [eax + 1]
cmp ebx, 0x32
jae 0x4ca96c
movzx ebx, byte [esp + eax + 0x47]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x31
jae 0x4ca960
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0x31
jb 0x4ca8cb
jmp 0x4ca954
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x31
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
add esp, 0x78
ret
mov eax, ebx
mov ecx, 0x31
call fcn.004520a0
mov eax, ebp
mov ecx, 0x31
call fcn.004520a0
mov eax, ebx
mov ecx, 0x32
call fcn.004520a0
mov ecx, 0x32
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004ca880
Function at 0x4db410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4db509
sub esp, 0x2c
mov dword [esp + 0x17], 0x77769184
mov dword [esp + 0x18], 0xa0777691
mov dword [esp + 0x1c], 0x2872929d
lea edi, [esp + 0x20]
lea esi, [0x5f9804]
call fcn.00452722
xor eax, eax
jmp 0x4db46a
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx - 0x1d]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x4db4aa
jae 0x4db4fe
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x4db4f2
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 9
jae 0x4db4e6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx - 0x1d]
cmp ebx, 9
jb 0x4db454
jmp 0x4db4da
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.004520a0
mov eax, ebp
mov ecx, 9
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004db410