joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a01d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a029a
sub esp, 0x3c
lea edi, [esp + 0x28]
lea esi, [0x5e6fcb]
call fcn.00461e5e
lea edi, [esp + 0x14]
lea esi, [0x61aedc]
call fcn.00461e5e
xor eax, eax
jmp 0x4a0221
movzx edi, byte [esp + ebx + 0x28]
sub edi, edx
lea edx, [edi + 0x32]
mov byte [esp + ebp + 0x28], dl
lea edx, [esi + 0x32]
mov byte [esp + ebx + 0x28], dl
add eax, 2
cmp eax, 0x14
jge 0x4a0251
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x14
jae 0x4a028d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x28]
sub esi, edx
cmp ebx, 0x14
jb 0x4a0209
jmp 0x4a0281
mov dword [esp], 0
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x3c
ret
mov eax, ebx
mov ecx, 0x14
call fcn.00461830
mov eax, ebp
mov ecx, 0x14
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004a01d0
Function at 0x4a24d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a259a
sub esp, 0x54
lea edi, [esp + 0x34]
lea esi, [0x5eb163]
call fcn.00461e40
lea edi, [esp + 0x14]
lea esi, [0x61ba00]
call fcn.00461e40
xor eax, eax
jmp 0x4a251f
movzx edi, byte [esp + ebx + 0x34]
lea edx, [edi + edx + 6]
mov byte [esp + ebp + 0x34], dl
xchg esi, eax
mov byte [esp + ebx + 0x34], al
xchg esi, eax
add eax, 2
cmp eax, 0x20
jge 0x4a2551
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x20
jae 0x4a258d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x34]
lea esi, [esi + edx + 6]
cmp ebx, 0x20
jb 0x4a2509
jmp 0x4a2581
mov dword [esp], 0
lea eax, [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
add esp, 0x54
ret
mov eax, ebx
mov ecx, 0x20
call fcn.00461830
mov eax, ebp
mov ecx, 0x20
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004a24d0
Function at 0x4a82f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a83c4
sub esp, 0x28
mov dword [esp + 0x16], 0x24e8a8b0
mov dword [esp + 0x1a], 0x63bfb76c
mov dword [esp + 0x1e], 0x6010603
mov dword [esp + 0x20], 0x5010601
mov dword [esp + 0x24], 0x3000002
xor eax, eax
jmp 0x4a834b
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x36]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x36]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xa
jge 0x4a837b
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4a83b7
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 8
jb 0x4a8333
jmp 0x4a83ab
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004a82f0

Function at 0x4a87f0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a88cb
sub esp, 0x30
mov dword [esp + 0x17], 0x4f386968
mov dword [esp + 0x1a], 0x6d65394f
mov dword [esp + 0x1e], 0x5759676b
mov dword [esp + 0x22], 0x30a0909
lea edi, [esp + 0x24]
lea esi, [0x61a784]
call fcn.00461e72
xor eax, eax
jmp 0x4a8852
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi + 0x19]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi + 0x19]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xe
jge 0x4a8882
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x4a88be
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 0xb
jb 0x4a883a
jmp 0x4a88b2
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004a87f0
Function at 0x4a99a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a9a74
sub esp, 0x28
mov dword [esp + 0x16], 0x6dfc3a35
mov dword [esp + 0x1a], 0x34a62e75
mov dword [esp + 0x1e], 0x6050200
mov dword [esp + 0x20], 0x1010605
mov dword [esp + 0x24], 0x70507
xor eax, eax
jmp 0x4a99fb
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x3f]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x3f]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xa
jge 0x4a9a2b
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4a9a67
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 8
jb 0x4a99e3
jmp 0x4a9a5b
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004a99a0

Function at 0x4a9de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a9eac
sub esp, 0x24
mov dword [esp + 0x1c], 0x8a65828f
mov dword [esp + 0x20], 0x9f6e6167
mov dword [esp + 0x14], 0x7070200
mov dword [esp + 0x18], 0x7070301
xor eax, eax
jmp 0x4a9e33
movzx edi, byte [esp + ebx + 0x1c]
sub edi, edx
lea edx, [edi - 0x1b]
mov byte [esp + ebp + 0x1c], dl
lea edx, [esi - 0x1b]
mov byte [esp + ebx + 0x1c], dl
add eax, 2
cmp eax, 8
jge 0x4a9e63
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4a9e9f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x1c]
sub esi, edx
cmp ebx, 8
jb 0x4a9e1b
jmp 0x4a9e93
mov dword [esp], 0
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004a9de0
Function at 0x4aa770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aa844
sub esp, 0x28
mov dword [esp + 0x16], 0xf7ef61e3
mov dword [esp + 0x1a], 0x49e5e8f7
mov dword [esp + 0x1e], 0x4020306
mov dword [esp + 0x20], 0x7000402
mov dword [esp + 0x24], 0x505
xor eax, eax
jmp 0x4aa7c9
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x77]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x4aa7fb
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4aa837
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x77]
cmp ebx, 8
jb 0x4aa7b3
jmp 0x4aa82b
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004aa770

Function at 0x4ae160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ae232
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x5e42a8]
call fcn.00461e72
mov dword [esp + 0x22], 0x4010806
lea edi, [esp + 0x24]
lea esi, [0x61a7a0]
call fcn.00461e72
xor eax, eax
jmp 0x4ae1b9
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x5c]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x5c]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xe
jge 0x4ae1e9
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x4ae225
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0xc
jb 0x4ae1a1
jmp 0x4ae219
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.00461830
mov eax, ebp
mov ecx, 0xc
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004ae160
Function at 0x4aed10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aede3
sub esp, 0x30
mov dword [esp + 0x15], 0xd724f53
mov dword [esp + 0x18], 0x2072480d
mov dword [esp + 0x1c], 0x676e0f0e
lea edi, [esp + 0x20]
lea esi, [0x61aa28]
call fcn.00461e68
xor eax, eax
jmp 0x4aed68
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x4b]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x10
jge 0x4aed9a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x4aedd6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x4b]
cmp ebx, 0xb
jb 0x4aed52
jmp 0x4aedca
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004aed10

Function at 0x4af680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4af74b
sub esp, 0x28
mov dword [esp + 0x14], 0xa9958092
mov dword [esp + 0x18], 0xc48795a6
lea edi, [esp + 0x1c]
lea esi, [0x61a570]
call fcn.00461e72
xor eax, eax
jmp 0x4af6d2
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi - 0x1f]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi - 0x1f]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xc
jge 0x4af702
movzx edx, byte [esp + eax + 0x1c]
movzx ebx, byte [esp + eax + 0x1d]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4af73e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 8
jb 0x4af6ba
jmp 0x4af732
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004af680
Function at 0x4af7f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4af8c4
sub esp, 0x28
mov dword [esp + 0x16], 0x4f613855
mov dword [esp + 0x1a], 0x3c48f31f
mov dword [esp + 0x1e], 0x3030405
mov dword [esp + 0x20], 0x7010303
mov dword [esp + 0x24], 0x5060504
xor eax, eax
jmp 0x4af849
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x21]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x4af87b
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4af8b7
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x21]
cmp ebx, 8
jb 0x4af833
jmp 0x4af8ab
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004af7f0

Function at 0x4af8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4af9a4
sub esp, 0x28
mov dword [esp + 0x16], 0xa5dd6950
mov dword [esp + 0x1a], 0xd0712de6
mov dword [esp + 0x1e], 0x7050703
mov dword [esp + 0x20], 0x70705
mov dword [esp + 0x24], 0x2040507
xor eax, eax
jmp 0x4af92b
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x64]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x64]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xa
jge 0x4af95b
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x4af997
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 8
jb 0x4af913
jmp 0x4af98b
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004af8d0
Function at 0x4b2300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b24b2
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0xd4
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5cdaa0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d98a0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x4b24c0]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x4b2394
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x4b23b6
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0x23
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x6b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xca
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x91
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x78
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x3a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x6c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd1
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x49
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa1
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x37
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x68
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.004b2300
Function at 0x4b2640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b282e
sub esp, 0x20
lea eax, [0x5c8020]
mov dword [esp], eax
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x10
lea ecx, [0x5c54c0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5cdae0]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5d9900]
mov dword [esp], ecx
call fcn.0040b5b0
mov eax, dword [esp + 4]
lea ecx, [0x4b2840]
mov dword [eax], ecx
mov ecx, dword [0x714790]
test ecx, ecx
jne 0x4b26d4
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x4b26f6
call fcn.00461810
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 0x5f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xba
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x71
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xef
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xcb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x27
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x3d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x89
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x11
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x92
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x47
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x13
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1c
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.004603c0
jmp fcn.004b2640
Function at 0x4b4db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b4e83
sub esp, 0x2c
mov dword [esp + 0x15], 0x2c696857
mov dword [esp + 0x18], 0xbd5f9b2c
mov dword [esp + 0x1c], 0xc7ce2270
lea edi, [esp + 0x20]
lea esi, [0x61a57c]
call fcn.00461e72
xor eax, eax
jmp 0x4b4e08
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x70]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x4b4e3a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x4b4e76
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x70]
cmp ebx, 0xb
jb 0x4b4df2
jmp 0x4b4e6a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004b4db0

Function at 0x4b9180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b925c
sub esp, 0x28
mov dword [esp + 0x15], 0xc1746e55
mov dword [esp + 0x16], 0xdbc1746e
mov dword [esp + 0x1a], 0xdddee2d7
mov dword [esp + 0x1e], 0x3070600
mov dword [esp + 0x20], 0x4070307
mov dword [esp + 0x24], 0x8040506
xor eax, eax
jmp 0x4b91e1
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x7f]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x4b9213
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x4b924f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x7f]
cmp ebx, 9
jb 0x4b91cb
jmp 0x4b9243
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.00461830
mov eax, ebp
mov ecx, 9
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.004b9180