joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x466571
sub esp, 0x28
mov dword [esp + 0x14], 0x13d8fba3
mov dword [esp + 0x18], 0x7465919c
lea edi, [esp + 0x1c]
lea esi, [0x5f9750]
call fcn.00452722
xor eax, eax
jmp 0x4664d4
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi - 0x32]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi - 0x32]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xc
jge 0x466512
jae 0x466566
movzx edx, byte [esp + eax + 0x1c]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x46655a
movzx ebx, byte [esp + eax + 0x1d]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x46654e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 8
jb 0x4664bc
jmp 0x466542
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00466480

Function at 0x467220
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x467321
sub esp, 0x2c
mov dword [esp + 0x14], 0x726c7244
mov dword [esp + 0x16], 0x636d726c
mov dword [esp + 0x1a], 0x5c6e6a70
mov dword [esp + 0x1e], 0x1010602
lea edi, [esp + 0x20]
lea esi, [0x5f9848]
call fcn.00452722
xor eax, eax
jmp 0x467282
movzx edi, byte [esp + ebx + 0x14]
lea edx, [edi + edx - 0xf]
mov byte [esp + ebp + 0x14], dl
xchg esi, eax
mov byte [esp + ebx + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x4672c2
jae 0x467316
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xe
jae 0x46730a
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xa
jae 0x4672fe
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
lea esi, [esi + edx - 0xf]
cmp ebx, 0xa
jb 0x46726c
jmp 0x4672f2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov eax, ebp
mov ecx, 0xa
call fcn.004520a0
mov eax, ebx
mov ecx, 0xe
call fcn.004520a0
mov ecx, 0xe
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00467220
Function at 0x467840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x467942
sub esp, 0x28
mov dword [esp + 0x15], 0xdb78b748
mov dword [esp + 0x16], 0xdb78b7
mov dword [esp + 0x1a], 0x74bafeb3
mov dword [esp + 0x1e], 0x1050706
mov dword [esp + 0x20], 0x7030105
mov dword [esp + 0x24], 0x7070407
xor eax, eax
jmp 0x4678a3
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x54]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x4678e3
jae 0x467937
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x46792b
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 9
jae 0x46791f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x54]
cmp ebx, 9
jb 0x46788d
jmp 0x467913
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.004520a0
mov eax, ebp
mov ecx, 9
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00467840
Function at 0x46a860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46a959
sub esp, 0x30
mov dword [esp + 0x15], 0x9698a9ef
mov dword [esp + 0x18], 0x6f455f96
mov dword [esp + 0x1c], 0x259974ac
lea edi, [esp + 0x20]
lea esi, [0x5f9920]
call fcn.00452718
xor eax, eax
jmp 0x46a8ba
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x48]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x10
jge 0x46a8fa
jae 0x46a94e
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0x10
jae 0x46a942
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x46a936
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x48]
cmp ebx, 0xb
jb 0x46a8a4
jmp 0x46a92a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0x10
call fcn.004520a0
mov ecx, 0x10
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0046a860
Function at 0x4792e0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4793e1
sub esp, 0x30
mov dword [esp + 0x17], 0x6176727e
mov dword [esp + 0x1a], 0x706d6c61
mov dword [esp + 0x1e], 0x6c656828
mov dword [esp + 0x22], 0xa050401
lea edi, [esp + 0x24]
lea esi, [0x5f98e2]
call fcn.00452722
xor eax, eax
jmp 0x479342
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx - 0x10]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x479382
jae 0x4793d6
movzx edx, byte [esp + eax + 0x22]
lea ebx, [eax + 1]
cmp ebx, 0xe
jae 0x4793ca
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x4793be
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx - 0x10]
cmp ebx, 0xb
jb 0x47932c
jmp 0x4793b2
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0xe
call fcn.004520a0
mov ecx, 0xe
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004792e0
Function at 0x47de00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47df00
sub esp, 0x40
mov dword [esp + 0x15], 0x63b10174
lea edi, [esp + 0x16]
lea esi, [0x5d074f]
call fcn.0045270e
mov dword [esp + 0x2a], 0x12131006
lea edi, [esp + 0x2c]
lea esi, [0x5f9dca]
call fcn.0045270e
xor eax, eax
jmp 0x47de61
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x4e]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x16
jge 0x47dea1
jae 0x47def5
movzx edx, byte [esp + eax + 0x2a]
lea ebx, [eax + 1]
cmp ebx, 0x16
jae 0x47dee9
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x15
jae 0x47dedd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x4e]
cmp ebx, 0x15
jb 0x47de4b
jmp 0x47ded1
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x15
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x15
call fcn.004520a0
mov eax, ebp
mov ecx, 0x15
call fcn.004520a0
mov eax, ebx
mov ecx, 0x16
call fcn.004520a0
mov ecx, 0x16
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0047de00
Function at 0x48a6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48a7da
sub esp, 0x28
mov dword [esp + 0x16], 0x75c136e
mov dword [esp + 0x1a], 0x3644f12
mov dword [esp + 0x1e], 0x3070105
mov dword [esp + 0x20], 0x4040307
mov dword [esp + 0x24], 0x2010102
xor eax, eax
jmp 0x48a73b
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x58]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x48a77b
jae 0x48a7cf
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x48a7c3
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x48a7b7
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x58]
cmp ebx, 8
jb 0x48a725
jmp 0x48a7ab
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0048a6e0
Function at 0x48bda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48bfa9
sub esp, 0x20
lea eax, [0x5b0a60]
mov dword [esp], eax
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x61
lea ecx, [0x5ad780]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5b3900]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5be760]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
lea ecx, [0x48bfc0]
mov dword [eax], ecx
mov ecx, dword [0x6d6280]
test ecx, ecx
jne 0x48be41
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ebx, dword [esp + 0x14]
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + 0xc], ebx
mov dword [ebx], eax
jmp 0x48be72
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x1c]
call fcn.00452020
lea edi, [ecx + 8]
mov eax, dword [esp + 0x14]
call fcn.00452020
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x18]
call fcn.00452020
mov edi, eax
mov eax, ecx
call fcn.00452020
mov ebx, edi
mov edx, dword [ebx]
mov eax, dword [edx]
mov byte [esp], 0xd1
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa4
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x45
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x19
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x26
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x58
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xad
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x6a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xaf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x55
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xbf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x69
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xda
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x63
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x98
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x29
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00450c10
jmp fcn.0048bda0
Function at 0x48c760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48c945
sub esp, 0x20
lea eax, [0x5b0a60]
mov dword [esp], eax
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0x5c
lea ecx, [0x5ad780]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5b3980]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5be820]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
lea ecx, [0x48c950]
mov dword [eax], ecx
mov ecx, dword [0x6d6280]
test ecx, ecx
jne 0x48c801
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ebx, dword [esp + 0x14]
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + 0xc], ebx
mov dword [ebx], eax
jmp 0x48c832
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x1c]
call fcn.00452020
lea edi, [ecx + 8]
mov eax, dword [esp + 0x14]
call fcn.00452020
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x18]
call fcn.00452020
mov edi, eax
mov eax, ecx
call fcn.00452020
mov ebx, edi
mov edx, dword [ebx]
mov eax, dword [edx]
mov byte [esp], 0xc0
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x81
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x13
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x19
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x6f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x59
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xb7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x75
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa9
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x94
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x32
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x70
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00450c10
jmp fcn.0048c760
Function at 0x4921a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x492391
sub esp, 0x20
lea eax, [0x5b0a60]
mov dword [esp], eax
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0xe1
lea ecx, [0x5ad780]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5b3b80]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5beb20]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
lea ecx, [0x4923a0]
mov dword [eax], ecx
mov ecx, dword [0x6d6280]
test ecx, ecx
jne 0x492241
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ebx, dword [esp + 0x14]
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + 0xc], ebx
mov dword [ebx], eax
jmp 0x492272
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x1c]
call fcn.00452020
lea edi, [ecx + 8]
mov eax, dword [esp + 0x14]
call fcn.00452020
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x18]
call fcn.00452020
mov edi, eax
mov eax, ecx
call fcn.00452020
mov ebx, edi
mov edx, dword [ebx]
mov eax, dword [edx]
mov byte [esp], 0x44
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x94
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x27
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x93
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x24
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x59
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x54
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x54
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x9d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x3e
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x74
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x63
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xcc
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x97
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00450c10
jmp fcn.004921a0
Function at 0x4947c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4948c1
sub esp, 0x30
mov dword [esp + 0x17], 0x75d9dc1c
mov dword [esp + 0x1a], 0xf0c7275
mov dword [esp + 0x1e], 0x158e0ee5
mov dword [esp + 0x22], 0x90702
lea edi, [esp + 0x24]
lea esi, [0x5f988e]
call fcn.00452722
xor eax, eax
jmp 0x494822
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx + 0x45]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x494862
jae 0x4948b6
movzx edx, byte [esp + eax + 0x22]
lea ebx, [eax + 1]
cmp ebx, 0xe
jae 0x4948aa
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x49489e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx + 0x45]
cmp ebx, 0xb
jb 0x49480c
jmp 0x494892
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0xe
call fcn.004520a0
mov ecx, 0xe
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004947c0

Function at 0x494b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x494c29
sub esp, 0x2c
mov dword [esp + 0x15], 0x725b9275
mov dword [esp + 0x18], 0x768d9b72
mov dword [esp + 0x1c], 0x98babdcd
lea edi, [esp + 0x20]
lea esi, [0x5f9780]
call fcn.00452722
xor eax, eax
jmp 0x494b8a
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x36]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x494bca
jae 0x494c1e
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x494c12
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x494c06
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x36]
cmp ebx, 0xb
jb 0x494b74
jmp 0x494bfa
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00494b30
Function at 0x4961b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4962a0
sub esp, 0x34
lea edi, [esp + 0x24]
lea esi, [0x5cf242]
call fcn.00452718
lea edi, [esp + 0x14]
lea esi, [0x5f9940]
call fcn.00452718
xor eax, eax
jmp 0x496201
movzx edi, byte [esp + ebx + 0x24]
lea edx, [edi + edx + 7]
mov byte [esp + ebp + 0x24], dl
xchg esi, eax
mov byte [esp + ebx + 0x24], al
xchg esi, eax
add eax, 2
cmp eax, 0x10
jge 0x496241
jae 0x496295
movzx edx, byte [esp + eax + 0x14]
lea ebx, [eax + 1]
cmp ebx, 0x10
jae 0x496289
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x10
jae 0x49627d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x24]
lea esi, [esi + edx + 7]
cmp ebx, 0x10
jb 0x4961eb
jmp 0x496271
mov dword [esp], 0
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
mov eax, ebx
mov ecx, 0x10
call fcn.004520a0
mov eax, ebp
mov ecx, 0x10
call fcn.004520a0
mov eax, ebx
mov ecx, 0x10
call fcn.004520a0
mov ecx, 0x10
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004961b0
Function at 0x498840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x498939
sub esp, 0x30
mov dword [esp + 0x15], 0x73e6fd09
mov dword [esp + 0x18], 0xf0496573
mov dword [esp + 0x1c], 0x64b012a0
lea edi, [esp + 0x20]
lea esi, [0x5f9950]
call fcn.00452718
xor eax, eax
jmp 0x49889a
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x51]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x10
jge 0x4988da
jae 0x49892e
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0x10
jae 0x498922
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x498916
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x51]
cmp ebx, 0xb
jb 0x498884
jmp 0x49890a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0x10
call fcn.004520a0
mov ecx, 0x10
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00498840