joyce8/EMBER2024-capa huggingface dataset:
Function at 0x627a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x627c1a
sub esp, 0x20
lea eax, [0x74afe0]
mov dword [esp], eax
call fcn.0040ca90
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x99
lea ecx, [0x743de0]
mov dword [esp], ecx
call fcn.0040ca90
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x74fde0]
mov dword [esp], ecx
call fcn.0040ca90
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x764b60]
mov dword [esp], ecx
call fcn.0040ca90
mov eax, dword [esp + 4]
lea ecx, [0x627c30]
mov dword [eax], ecx
mov ecx, dword [0x93d218]
test ecx, ecx
jne 0x627ae4
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x627b06
call fcn.0045f110
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0xc
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x21
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x46
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb4
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x66
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd6
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x9b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x39
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x75
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xdb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa9
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x57
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa7
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.0045dcb0
jmp fcn.00627a50
Function at 0x627ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x627f48
sub esp, 0x20
mov dword [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x16], 0x66
mov byte [esp + 0x17], 0x69
mov byte [esp + 0x18], 0x6c
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x1b], 0x2c
mov byte [esp + 0x1c], 0x64
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x73
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.0045dcb0
jmp fcn.00627ec0

Function at 0x628570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x62863b
sub esp, 0x28
mov dword [esp + 0x20], 0x34dfe75b
mov dword [esp + 0x24], 0x3335dc0a
lea edi, [esp + 0x14]
lea esi, [0x7d99d4]
call fcn.0045f842
xor eax, eax
jmp 0x6285c0
movzx edi, byte [esp + ebx + 0x20]
lea edx, [edi + edx + 0x4f]
mov byte [esp + ebp + 0x20], dl
xchg esi, eax
mov byte [esp + ebx + 0x20], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x6285f2
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x62862e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x20]
lea esi, [esi + edx + 0x4f]
cmp ebx, 8
jb 0x6285aa
jmp 0x628622
mov dword [esp], 0
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f150
mov eax, ebp
mov ecx, 8
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.00628570
Function at 0x628ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x628b97
sub esp, 0x30
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f34a
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0x76
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x64
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x77
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x24], 0x6b
mov byte [esp + 0x25], 0x20
mov byte [esp + 0x26], 0x69
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x66
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], 0x63
mov byte [esp + 0x2e], 0x65
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x19
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
call fcn.0045dcb0
jmp fcn.00628ac0
Function at 0x628ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x628fe0
sub esp, 0x34
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f349
mov byte [esp + 0x15], 0x69
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x76
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x19], 0x6c
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x64
mov byte [esp + 0x1c], 0x20
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0x77
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], 0x6b
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x69
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x66
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2c], 0x63
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2e], 0x20
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x30], 0x61
mov byte [esp + 0x31], 0x6d
mov byte [esp + 0x32], 0x65
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1e
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
call fcn.0045dcb0
jmp fcn.00628ef0

Function at 0x6293f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6294c3
sub esp, 0x2c
mov dword [esp + 0x23], 0xfffe4662
mov dword [esp + 0x24], 0x9fffe46
mov dword [esp + 0x28], 0x7473063e
lea edi, [esp + 0x17]
lea esi, [0x7d99e0]
call fcn.0045f842
xor eax, eax
jmp 0x629448
movzx edi, byte [esp + ebx + 0x23]
lea edx, [edi + edx + 0x26]
mov byte [esp + ebp + 0x23], dl
xchg esi, eax
mov byte [esp + ebx + 0x23], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x62947a
movzx edx, byte [esp + eax + 0x17]
movzx ebx, byte [esp + eax + 0x18]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x6294b6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x23]
lea esi, [esi + edx + 0x26]
cmp ebx, 9
jb 0x629432
jmp 0x6294aa
mov dword [esp], 0
lea eax, [esp + 0x23]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.0045f150
mov eax, ebp
mov ecx, 9
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.006293f0
Function at 0x629bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x629ccc
sub esp, 0x28
mov dword [esp + 0x1f], 0x36ce70bd
mov dword [esp + 0x20], 0x5f36ce70
mov dword [esp + 0x24], 0x706d6369
mov dword [esp + 0x15], 0
mov dword [esp + 0x17], 0x2040000
mov dword [esp + 0x1b], 0x2020202
xor eax, eax
jmp 0x629c51
movzx edi, byte [esp + ebx + 0x1f]
lea edx, [edi + edx + 0x55]
mov byte [esp + ebp + 0x1f], dl
xchg esi, eax
mov byte [esp + ebx + 0x1f], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x629c83
movzx edx, byte [esp + eax + 0x15]
movzx ebx, byte [esp + eax + 0x16]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x629cbf
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x1f]
lea esi, [esi + edx + 0x55]
cmp ebx, 9
jb 0x629c3b
jmp 0x629cb3
mov dword [esp], 0
lea eax, [esp + 0x1f]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.0045f150
mov eax, ebp
mov ecx, 9
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.00629bf0

Function at 0x62a040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x62a176
sub esp, 0x44
mov dword [esp + 0x17], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f345
mov byte [esp + 0x17], 0x75
mov byte [esp + 0x18], 0x73
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x20
mov byte [esp + 0x1b], 0x6f
mov byte [esp + 0x1c], 0x66
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x57
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x54
mov byte [esp + 0x24], 0x6f
mov byte [esp + 0x25], 0x20
mov byte [esp + 0x26], 0x77
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], 0x68
mov byte [esp + 0x2a], 0x20
mov byte [esp + 0x2b], 0x70
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2e], 0x2d
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x31], 0x6e
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x63
mov byte [esp + 0x35], 0x74
mov byte [esp + 0x36], 0x65
mov byte [esp + 0x37], 0x64
mov byte [esp + 0x38], 0x20
mov byte [esp + 0x39], 0x63
mov byte [esp + 0x3a], 0x6f
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x6e
mov byte [esp + 0x3d], 0x65
mov byte [esp + 0x3e], 0x63
mov byte [esp + 0x3f], 0x74
mov byte [esp + 0x40], 0x69
mov byte [esp + 0x41], 0x6f
mov byte [esp + 0x42], 0x6e
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2c
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x44
ret
call fcn.0045dcb0
jmp fcn.0062a040
Function at 0x63c440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x63c5b1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x63c4d7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x63c476
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x63c4e3
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x63c4a1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x63c4e3
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x18]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x63c4e3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.0063c260
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.006440e0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.0045dcb0
jmp fcn.0063c440
Function at 0x63c5c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x63c77d
sub esp, 0x4c
lea edi, [esp + 0x60]
xor eax, eax
call fcn.0045f34a
mov ecx, dword [esp + 0x54]
test ecx, ecx
jne 0x63c5fe
mov ecx, dword [0x8fdbf8]
mov edx, dword [0x8fdbfc]
mov ebx, dword [0x8fdc00]
jmp 0x63c608
mov edx, ecx
mov ecx, dword [esp + 0x50]
mov ebx, dword [esp + 0x58]
cmp edx, 4
je 0x63c61d
cmp edx, 0x10
jne 0x63c73d
xor ebp, ebp
jmp 0x63c74b
mov ebp, ecx
mov esi, edx
test ecx, ecx
je 0x63c681
mov dword [esp + 0x38], ecx
lea edi, [esp + 0x18]
call fcn.0045f34a
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x18], ecx
cmp edx, 4
jl 0x63c644
mov edx, 4
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x63c660
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0045fa40
lea edi, [esp + 0x60]
lea esi, [esp + 0x18]
call fcn.0045f824
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x4c
ret
mov dword [esp + 0x48], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x34], esi
call fcn.0064c0a0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
mov ecx, dword [esp]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 8], edx
call fcn.00638b90
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], ecx
lea edx, [0x75ef80]
mov dword [esp], edx
call fcn.0040ca90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov ecx, dword [0x93d218]
test ecx, ecx
jne 0x63c6fa
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
jmp 0x63c70c
call fcn.0045f0e0
mov ecx, dword [esp + 0x44]
mov dword [edi], ecx
mov edx, dword [esp + 0x40]
mov dword [edi + 4], edx
mov dword [esp + 0x3c], eax
mov dword [eax], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
mov dword [eax + 8], edx
lea edi, [esp + 0x60]
xor eax, eax
call fcn.0045f34a
lea ecx, [0x7da428]
mov dword [esp + 0x78], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x7c], ecx
add esp, 0x4c
ret
mov ebp, ecx
mov esi, edx
xor ecx, ecx
xor edx, edx
jmp 0x63c621
inc ebp
cmp ebp, 0xa
jge 0x63c75c
movzx esi, byte [ecx + ebp]
xchg esi, eax
test al, al
xchg esi, eax
je 0x63c74a
jmp 0x63c73d
cmp byte [ecx + 0xa], 0xff
jne 0x63c73d
cmp byte [ecx + 0xb], 0xff
jne 0x63c73d
lea ebp, [ecx + 0xc]
mov esi, edx
mov edx, 4
mov edi, ebp
mov ebp, ecx
mov ecx, edi
jmp 0x63c621
call fcn.0045dcb0
jmp fcn.0063c5c0
Function at 0x649940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x649a13
sub esp, 0x2c
mov dword [esp + 0x22], 0xbc746519
mov dword [esp + 0x24], 0x12cfbc74
mov dword [esp + 0x28], 0x74d0c2ba
lea edi, [esp + 0x16]
lea esi, [0x7d99f8]
call fcn.0045f842
xor eax, eax
jmp 0x64999a
movzx edi, byte [esp + ebx + 0x22]
sub edi, edx
lea edx, [edi + 0x61]
mov byte [esp + ebp + 0x22], dl
lea edx, [esi + 0x61]
mov byte [esp + ebx + 0x22], dl
add eax, 2
cmp eax, 0xc
jge 0x6499ca
movzx edx, byte [esp + eax + 0x16]
movzx ebx, byte [esp + eax + 0x17]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x649a06
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x22]
sub esi, edx
cmp ebx, 0xa
jb 0x649982
jmp 0x6499fa
mov dword [esp], 0
lea eax, [esp + 0x22]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.0045f150
mov eax, ebp
mov ecx, 0xa
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.00649940

Function at 0x64a240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x64a31b
sub esp, 0x2c
mov dword [esp + 0x22], 0x9f8f93e1
mov dword [esp + 0x24], 0x94d19f8f
mov dword [esp + 0x28], 0x74aa8c6b
mov dword [esp + 0x14], 0x30000
lea edi, [esp + 0x16]
lea esi, [0x7d9c76]
call fcn.0045f842
xor eax, eax
jmp 0x64a2a0
movzx edi, byte [esp + ebx + 0x22]
lea edx, [edi + edx - 0x31]
mov byte [esp + ebp + 0x22], dl
xchg esi, eax
mov byte [esp + ebx + 0x22], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x64a2d2
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x64a30e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x22]
lea esi, [esi + edx - 0x31]
cmp ebx, 0xa
jb 0x64a28a
jmp 0x64a302
mov dword [esp], 0
lea eax, [esp + 0x22]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.0045f150
mov eax, ebp
mov ecx, 0xa
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.0064a240
Function at 0x64da00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x64dad2
sub esp, 0x38
lea edi, [esp + 0x28]
lea esi, [0x789bd1]
call fcn.0045f838
mov dword [esp + 0x16], 0x2060002
lea edi, [esp + 0x18]
lea esi, [0x7d9ffe]
call fcn.0045f838
xor eax, eax
jmp 0x64da59
movzx edi, byte [esp + ebx + 0x28]
sub edi, edx
lea edx, [edi + 0x54]
mov byte [esp + ebp + 0x28], dl
lea edx, [esi + 0x54]
mov byte [esp + ebx + 0x28], dl
add eax, 2
cmp eax, 0x12
jge 0x64da89
movzx edx, byte [esp + eax + 0x16]
movzx ebx, byte [esp + eax + 0x17]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x64dac5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x28]
sub esi, edx
cmp ebx, 0x10
jb 0x64da41
jmp 0x64dab9
mov dword [esp], 0
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.0045f150
mov eax, ebp
mov ecx, 0x10
call fcn.0045f150
nop
call fcn.0045dcb0
jmp fcn.0064da00

Function at 0x64df50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x93d128]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x64dfdd
sub esp, 0x20
mov dword [esp + 0x15], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x69
mov byte [esp + 0x18], 0x78
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x1b], 0x63
mov byte [esp + 0x1c], 0x6b
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044b7a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.0045dcb0
jmp fcn.0064df50