joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66059320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660593fb
sub esp, 0x2c
mov dword [esp + 0x14], 0xd0b57027
mov dword [esp + 0x16], 0x1930d0b5
mov dword [esp + 0x1a], 0x3899bc21
mov dword [esp + 0x1e], 0x3020708
lea edi, [esp + 0x20]
lea esi, [0x661ef1f0]
call fcn.65f65002
xor eax, eax
jmp 0x66059382
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi + 0x54]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi + 0x54]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x660593b2
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x660593ee
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x6605936a
jmp 0x660593e2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.66059320

Function at 0x66059600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660596db
sub esp, 0x2c
mov dword [esp + 0x14], 0xb0b3b8a1
mov dword [esp + 0x16], 0xc454b0b3
mov dword [esp + 0x1a], 0x8ab86599
mov dword [esp + 0x1e], 0x5060003
lea edi, [esp + 0x20]
lea esi, [0x661ef1fe]
call fcn.65f65002
xor eax, eax
jmp 0x66059660
movzx edi, byte [esp + ebx + 0x14]
lea edx, [edi + edx - 0x36]
mov byte [esp + ebp + 0x14], dl
xchg esi, eax
mov byte [esp + ebx + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x66059692
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x660596ce
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
lea esi, [esi + edx - 0x36]
cmp ebx, 0xa
jb 0x6605964a
jmp 0x660596c2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.66059600
Function at 0x66059c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66059cd2
sub esp, 0x40
lea edi, [esp + 0x16]
lea esi, [0x66115ea2]
call fcn.65f64fee
mov dword [esp + 0x2a], 0x110b0207
lea edi, [esp + 0x2c]
lea esi, [0x661efb3c]
call fcn.65f64fee
xor eax, eax
jmp 0x66059c59
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 4]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 4]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x16
jge 0x66059c89
movzx edx, byte [esp + eax + 0x2a]
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x14
jae 0x66059cc5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x14
jb 0x66059c41
jmp 0x66059cb9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x14
call fcn.65f649b0
mov eax, ebp
mov ecx, 0x14
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.66059c00
Function at 0x6605eb50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6605ed1a
sub esp, 0x20
lea eax, [0x660f0fe0]
mov dword [esp], eax
call fcn.65f0bca0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0xb2
lea ecx, [0x660edce0]
mov dword [esp], ecx
call fcn.65f0bca0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x660f4880]
mov dword [esp], ecx
call fcn.65f0bca0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x66101100]
mov dword [esp], ecx
call fcn.65f0bca0
mov eax, dword [esp + 4]
lea ecx, [0x6605ed30]
mov dword [eax], ecx
mov ecx, dword [0x663128d0]
test ecx, ecx
jne 0x6605ebe4
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x6605ec06
call fcn.65f64990
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ebx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 8], ebp
mov dword [edi + 0xc], eax
mov esi, dword [ebp]
mov dword [edi + 0x10], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [ebp], eax
mov edx, dword [ebp]
mov eax, dword [edx]
mov byte [esp], 6
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x1d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x47
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x89
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x21
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x35
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x7d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xeb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xbb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x9b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x29
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x3f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x91
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4f
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x9c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x49
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.65f63530
jmp fcn.6605eb50
Function at 0x6605fa70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6605fb4b
sub esp, 0x30
mov dword [esp + 0x17], 0x84995756
mov dword [esp + 0x1a], 0x8c847384
mov dword [esp + 0x1e], 0x65cb727a
mov dword [esp + 0x22], 0x9020909
lea edi, [esp + 0x24]
lea esi, [0x661ef20c]
call fcn.65f65002
xor eax, eax
jmp 0x6605fad0
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx - 0x23]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x6605fb02
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x6605fb3e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx - 0x23]
cmp ebx, 0xb
jb 0x6605faba
jmp 0x6605fb32
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6605fa70

Function at 0x66061200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660612d4
sub esp, 0x28
mov dword [esp + 0x16], 0x3e63b3bd
mov dword [esp + 0x1a], 0xa54510a6
mov dword [esp + 0x1e], 0x4010307
mov dword [esp + 0x20], 0x5070401
mov dword [esp + 0x24], 0x5000507
xor eax, eax
jmp 0x6606125b
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x3c]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x3c]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xa
jge 0x6606128b
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x660612c7
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 8
jb 0x66061243
jmp 0x660612bb
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.65f649b0
mov eax, ebp
mov ecx, 8
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.66061200
Function at 0x660615c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66061692
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, [0x661147b2]
call fcn.65f64ff8
mov dword [esp + 0x26], 0x80101
lea edi, [esp + 0x28]
lea esi, [0x661ef58e]
call fcn.65f64ff8
xor eax, eax
jmp 0x66061617
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x30]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0x12
jge 0x66061649
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x66061685
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x30]
cmp ebx, 0x10
jb 0x66061601
jmp 0x66061679
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.65f649b0
mov eax, ebp
mov ecx, 0x10
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660615c0

Function at 0x66061a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66061b1a
sub esp, 0x30
mov dword [esp + 0x22], 0x93ae874e
lea edi, [esp + 0x24]
lea esi, [0x66113c59]
call fcn.65f65002
mov dword [esp + 0x14], 0xc090709
lea edi, [esp + 0x16]
lea esi, [0x661ef21a]
call fcn.65f65002
xor eax, eax
jmp 0x66061a9f
movzx edi, byte [esp + ebx + 0x22]
lea edx, [edi + edx - 0x35]
mov byte [esp + ebp + 0x22], dl
xchg esi, eax
mov byte [esp + ebx + 0x22], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x66061ad1
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xe
jae 0x66061b0d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x22]
lea esi, [esi + edx - 0x35]
cmp ebx, 0xe
jb 0x66061a89
jmp 0x66061b01
mov dword [esp], 0
lea eax, [esp + 0x22]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xe
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xe
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.66061a40
Function at 0x6606df20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6606dffa
sub esp, 0x40
mov dword [esp + 0x2a], 0x61657243
lea edi, [esp + 0x2c]
lea esi, [0x66116b7d]
call fcn.65f64fee
mov dword [esp + 0x14], 0x6151504
lea edi, [esp + 0x16]
lea esi, [0x661efb68]
call fcn.65f64fee
xor eax, eax
jmp 0x6606df7f
movzx edi, byte [esp + ebx + 0x2a]
lea edx, [edi + edx - 0x1c]
mov byte [esp + ebp + 0x2a], dl
xchg esi, eax
mov byte [esp + ebx + 0x2a], al
xchg esi, eax
add eax, 2
cmp eax, 0x16
jge 0x6606dfb1
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x16
jae 0x6606dfed
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x2a]
lea esi, [esi + edx - 0x1c]
cmp ebx, 0x16
jb 0x6606df69
jmp 0x6606dfe1
mov dword [esp], 0
lea eax, [esp + 0x2a]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x16
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x16
call fcn.65f649b0
mov eax, ebp
mov ecx, 0x16
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6606df20

Function at 0x6606e910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6606e9ea
sub esp, 0x30
mov dword [esp + 0x15], 0x3656725e
lea edi, [esp + 0x16]
lea esi, [0x661136dc]
call fcn.65f65002
mov dword [esp + 0x22], 0x3040c0b
lea edi, [esp + 0x24]
lea esi, [0x661ef228]
call fcn.65f65002
xor eax, eax
jmp 0x6606e96f
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 2]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x6606e9a1
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xd
jae 0x6606e9dd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 2]
cmp ebx, 0xd
jb 0x6606e959
jmp 0x6606e9d1
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xd
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xd
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xd
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6606e910
Function at 0x6606f530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6606f603
sub esp, 0x2c
mov dword [esp + 0x15], 0xf7295358
mov dword [esp + 0x18], 0xd2110ff7
mov dword [esp + 0x1c], 0x6d051903
lea edi, [esp + 0x20]
lea esi, [0x661ef030]
call fcn.65f65002
xor eax, eax
jmp 0x6606f58a
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x5b]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x5b]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x6606f5ba
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x6606f5f6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x6606f572
jmp 0x6606f5ea
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6606f530

Function at 0x6606fdd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6606fea3
sub esp, 0x2c
mov dword [esp + 0x15], 0x21dc1b27
mov dword [esp + 0x18], 0x2e152221
mov dword [esp + 0x1c], 0xd9652963
lea edi, [esp + 0x20]
lea esi, [0x661ef03c]
call fcn.65f65002
xor eax, eax
jmp 0x6606fe28
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x3f]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x6606fe5a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x6606fe96
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x3f]
cmp ebx, 0xb
jb 0x6606fe12
jmp 0x6606fe8a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6606fdd0
Function at 0x66070e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66070f03
sub esp, 0x2c
mov dword [esp + 0x16], 0x39747a64
mov dword [esp + 0x18], 0x632a3974
mov dword [esp + 0x1c], 0x733c6f27
lea edi, [esp + 0x20]
lea esi, [0x661ef048]
call fcn.65f65002
xor eax, eax
jmp 0x66070e88
movzx edi, byte [esp + ebp + 0x16]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x16], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x66070eba
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
lea ebx, [eax + ebx + 0x49]
cmp edx, 0xa
jae 0x66070ef6
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x16]
xor esi, ebx
cmp ebp, 0xa
jb 0x66070e72
jmp 0x66070eea
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
mov eax, edx
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.66070e30

Function at 0x66090670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66090752
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0xbe7d3bf6
mov dword [esp + 0x14], 0xf7d3ab0d
lea edi, [esp + 0x18]
lea esi, [0x661eef34]
call fcn.65f65002
xor eax, eax
jmp 0x660906d0
movzx edi, byte [esp + ebx + 0x10]
lea edx, [edi + edx - 7]
mov byte [esp + ebp + 0x10], dl
xchg esi, eax
mov byte [esp + ebx + 0x10], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x66090702
movzx edx, byte [esp + eax + 0x18]
movzx ebx, byte [esp + eax + 0x19]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x66090745
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x10]
lea esi, [esi + edx - 7]
cmp ebx, 8
jb 0x660906ba
jmp 0x66090739
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
xor eax, eax
jmp 0x66090720
movzx ecx, byte [esp + eax + 0x10]
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jl 0x66090716
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.65f649b0
mov eax, ebp
mov ecx, 8
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.66090670
Function at 0x6609a220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6609a2fb
sub esp, 0x2c
mov dword [esp + 0x14], 0x693b6565
mov dword [esp + 0x16], 0x5709693b
mov dword [esp + 0x1a], 0x3520792b
mov dword [esp + 0x1e], 0x8080507
lea edi, [esp + 0x20]
lea esi, [0x661ef156]
call fcn.65f65002
xor eax, eax
jmp 0x6609a280
movzx edi, byte [esp + ebp + 0x14]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x14], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x6609a2b2
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
lea ebx, [eax + ebx + 0x4c]
cmp edx, 0xa
jae 0x6609a2ee
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x14]
xor esi, ebx
cmp ebp, 0xa
jb 0x6609a26a
jmp 0x6609a2e2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
mov eax, edx
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6609a220

Function at 0x6609c620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6609c6f3
sub esp, 0x2c
mov dword [esp + 0x16], 0xe1f7fbca
mov dword [esp + 0x18], 0x6349e1f7
mov dword [esp + 0x1c], 0xcc006e6f
lea edi, [esp + 0x20]
lea esi, [0x661eef40]
call fcn.65f65002
xor eax, eax
jmp 0x6609c678
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x75]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x6609c6aa
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x6609c6e6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x75]
cmp ebx, 0xa
jb 0x6609c662
jmp 0x6609c6da
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6609c620