joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x457dad
sub esp, 0x68
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x102
call fcn.00455fb0
mov eax, dword [esp + 0x74]
test byte [eax], al
mov ecx, eax
mov eax, 0xaaaaaaab
mov edx, dword [esp + 0x70]
mov ebx, edx
mul edx
shr edx, 1
lea eax, [edx + edx*2]
sub ebx, eax
lea eax, [ecx + ebx*4 + 0xe0]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x64], ebx
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x44], ebp
mov esi, dword [esp + 0x14]
mov dword [esp + 0x40], esi
mov dword [esp], eax
call fcn.00406960
mov eax, dword [esp + 4]
test eax, eax
je 0x457c4e
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x457cd6
mov eax, dword [esp + 0x74]
lea ecx, [eax + 0xe0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
call fcn.00458ab0
movzx eax, byte [esp + 8]
test al, al
jne 0x457c7f
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x457cd6
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
movzx ebx, byte [eax + 0x6e]
mov ebp, dword [esp + 0x64]
mov dword [esp], ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x1c], 4
mov byte [esp + 0x1d], bl
call fcn.00458830
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x60], ebx
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x70]
mov ecx, eax
and eax, 1
mov edx, dword [esp + 0x74]
lea eax, [edx + eax*8 + 0xec]
mov edi, dword [eax]
mov esi, dword [eax + 4]
add edi, 1
mov dword [esp + 0x3c], edi
mov dword [eax], edi
adc esi, 0
mov dword [eax + 4], esi
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x78]
mov dword [esp], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
call fcn.004585c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
lea edi, [esp + 0x48]
mov edx, eax
xor eax, eax
call fcn.0046419a
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov eax, dword [eax + 0x54]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x15
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.004561d0
add esp, 0x68
ret
call fcn.00462b00
jmp fcn.00457bc0
Function at 0x458f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4590c7
sub esp, 0x6c
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x80]
cmp edx, ecx
jne 0x458f59
mov ebx, dword [ecx + 0x18]
cmp dword [ebx + 0x50], ecx
je 0x4590b0
mov ecx, dword [esp + 0x74]
cmp ecx, 0xffffffff
jne 0x458f87
mov ebx, dword [esp + 0x78]
cmp ebx, 0xffffffff
jne 0x458f7f
mov ecx, dword [edx + 0x38]
test ecx, ecx
je 0x458f77
mov ebx, dword [edx + 0x3c]
jmp 0x458f8d
mov ebx, dword [edx + 0x20]
mov ecx, dword [edx + 0x1c]
jmp 0x458f8d
mov ebx, ecx
mov ecx, dword [esp + 0x78]
jmp 0x458f8d
mov ebx, ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ecx
lea edi, [esp + 0x10]
xor eax, eax
call fcn.00464197
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x24], ecx
test ebx, ebx
jne 0x458fbf
mov ebp, ecx
mov ecx, dword [ecx]
mov dword [esp + 0x18], ecx
lea ecx, [ebp + 4]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00451af0
mov eax, dword [esp + 4]
test eax, eax
je 0x459070
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x80]
mov edx, dword [ecx + 0xc4]
dec edx
mov ebx, ecx
mov dword [esp + 0xc], ecx
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.00464194
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.00464656
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
movzx ecx, byte [esp + 0x84]
mov byte [esp + 0x69], cl
mov edi, dword [esp + 0x70]
lea esi, [esp + 0x3c]
call fcn.00464638
mov ecx, dword [esp + 0x38]
cmp dword [esp + 0x18], ecx
jne 0x459055
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x24], eax
jne 0x459055
cmp dword [ebx + 0x3c], ecx
jne 0x459055
cmp dword [ebx + 0x38], eax
sete al
jmp 0x459057
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword [esp], ecx
mov byte [esp + 4], 1
mov byte [esp + 5], al
call fcn.004590e0
add esp, 0x6c
ret
movzx ecx, byte [esp + 0x84]
test cl, 2
jne 0x459086
mov edx, dword [esp + 0x80]
test byte [edx], al
test cl, 3
je 0x45909a
mov edi, dword [esp + 0x70]
xor eax, eax
call fcn.00464194
add esp, 0x6c
ret
lea eax, [0xd02d04]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00438ba0
lea eax, [0xd161bc]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.00438ba0
nop
call fcn.00462b00
jmp fcn.00458f20
Function at 0x459ae0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x459b7b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x11d9bdc]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00464197
lea ecx, [0x459b90]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00462a10
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00462b00
jmp fcn.00459ae0
Function at 0x463db0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x11da380]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46253b
je 0x46258e
cmp ebx, 0x20
jbe 0x462594
cmp ebx, 0x40
jbe 0x4625da
jmp 0x46267b
test ebx, ebx
je 0x462584
add eax, 0x10
test ax, 0xff0
je 0x462570
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xe86460]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xe86560]
jmp 0x462558
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x462558
pxor xmm1, xmmword [0x11da390]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x11da390]
pxor xmm2, xmmword [0x11da3a0]
pxor xmm3, xmmword [0x11da3b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x11da390]
pxor xmm2, xmmword [0x11da3a0]
pxor xmm3, xmmword [0x11da3b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4626da
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x11d9a2e], 0
je 0x463dca
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x462500
jmp fcn.0040c650
Function at 0x47af60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47b050
sub esp, 0x34
mov dword [esp + 0x15], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.00464199
mov byte [esp + 0x15], 0x73
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0x63
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], 0x20
mov byte [esp + 0x1b], 0x75
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x6c
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x1f], 0x63
mov byte [esp + 0x20], 0x6b
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x66
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x75
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x27], 0x6c
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], 0x63
mov byte [esp + 0x2a], 0x6b
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x64
mov byte [esp + 0x2d], 0x20
mov byte [esp + 0x2e], 0x6d
mov byte [esp + 0x2f], 0x75
mov byte [esp + 0x30], 0x74
mov byte [esp + 0x31], 0x65
mov byte [esp + 0x32], 0x78
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1e
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x34
ret
call fcn.00462b00
jmp fcn.0047af60
Function at 0x51b2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51b4e3
sub esp, 0x6c
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0046418b
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x17], 0x65
mov byte [esp + 0x18], 0x66
mov byte [esp + 0x19], 0x6c
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x63
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x2e
mov byte [esp + 0x1e], 0x56
mov byte [esp + 0x1f], 0x61
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x75
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x2e
mov byte [esp + 0x24], 0x49
mov byte [esp + 0x25], 0x6e
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x66
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x63
mov byte [esp + 0x2c], 0x65
mov byte [esp + 0x2d], 0x3a
mov byte [esp + 0x2e], 0x20
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x30], 0x61
mov byte [esp + 0x31], 0x6e
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], 0x74
mov byte [esp + 0x35], 0x20
mov byte [esp + 0x36], 0x72
mov byte [esp + 0x37], 0x65
mov byte [esp + 0x38], 0x74
mov byte [esp + 0x39], 0x75
mov byte [esp + 0x3a], 0x72
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x20
mov byte [esp + 0x3d], 0x76
mov byte [esp + 0x3e], 0x61
mov byte [esp + 0x3f], 0x6c
mov byte [esp + 0x40], 0x75
mov byte [esp + 0x41], 0x65
mov byte [esp + 0x42], 0x20
mov byte [esp + 0x43], 0x6f
mov byte [esp + 0x44], 0x62
mov byte [esp + 0x45], 0x74
mov byte [esp + 0x46], 0x61
mov byte [esp + 0x47], 0x69
mov byte [esp + 0x48], 0x6e
mov byte [esp + 0x49], 0x65
mov byte [esp + 0x4a], 0x64
mov byte [esp + 0x4b], 0x20
mov byte [esp + 0x4c], 0x66
mov byte [esp + 0x4d], 0x72
mov byte [esp + 0x4e], 0x6f
mov byte [esp + 0x4f], 0x6d
mov byte [esp + 0x50], 0x20
mov byte [esp + 0x51], 0x75
mov byte [esp + 0x52], 0x6e
mov byte [esp + 0x53], 0x65
mov byte [esp + 0x54], 0x78
mov byte [esp + 0x55], 0x70
mov byte [esp + 0x56], 0x6f
mov byte [esp + 0x57], 0x72
mov byte [esp + 0x58], 0x74
mov byte [esp + 0x59], 0x65
mov byte [esp + 0x5a], 0x64
mov byte [esp + 0x5b], 0x20
mov byte [esp + 0x5c], 0x66
mov byte [esp + 0x5d], 0x69
mov byte [esp + 0x5e], 0x65
mov byte [esp + 0x5f], 0x6c
mov byte [esp + 0x60], 0x64
mov byte [esp + 0x61], 0x20
mov byte [esp + 0x62], 0x6f
mov byte [esp + 0x63], 0x72
mov byte [esp + 0x64], 0x20
mov byte [esp + 0x65], 0x6d
mov byte [esp + 0x66], 0x65
mov byte [esp + 0x67], 0x74
mov byte [esp + 0x68], 0x68
mov byte [esp + 0x69], 0x6f
mov byte [esp + 0x6a], 0x64
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x55
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
add esp, 0x6c
ret
call fcn.00462b00
jmp fcn.0051b2e0
Function at 0x51db70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51dc43
sub esp, 0x2c
mov dword [esp + 0x23], 0x1d7e7472
mov dword [esp + 0x24], 0x651d7e74
mov dword [esp + 0x28], 0x208ab863
lea edi, [esp + 0x17]
lea esi, [0xe78a1c]
call fcn.00464692
xor eax, eax
jmp 0x51dbca
movzx edi, byte [esp + ebx + 0x23]
sub edi, edx
lea edx, [edi - 0x4e]
mov byte [esp + ebp + 0x23], dl
lea edx, [esi - 0x4e]
mov byte [esp + ebx + 0x23], dl
add eax, 2
cmp eax, 0xc
jge 0x51dbfa
movzx edx, byte [esp + eax + 0x17]
movzx ebx, byte [esp + eax + 0x18]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x51dc36
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x23]
sub esi, edx
cmp ebx, 9
jb 0x51dbb2
jmp 0x51dc2a
mov dword [esp], 0
lea eax, [esp + 0x23]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.00463f80
mov eax, ebp
mov ecx, 9
call fcn.00463f80
nop
call fcn.00462b00
jmp fcn.0051db70

Function at 0x51e1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51e228
sub esp, 0x20
mov dword [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x17], 0x65
mov byte [esp + 0x18], 0x66
mov byte [esp + 0x19], 0x6c
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x63
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x20
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00462b00
jmp fcn.0051e1a0

Function at 0x51e240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51e303
sub esp, 0x2c
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0046419b
mov byte [esp + 0x16], 0x20
mov byte [esp + 0x17], 0x6f
mov byte [esp + 0x18], 0x66
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x75
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x65
mov byte [esp + 0x1d], 0x78
mov byte [esp + 0x1e], 0x70
mov byte [esp + 0x1f], 0x6f
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x25], 0x6d
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0x68
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x64
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x15
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
call fcn.00462b00
jmp fcn.0051e240
Function at 0x51efe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51f068
sub esp, 0x20
mov dword [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x16], 0x62
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x64
mov byte [esp + 0x19], 0x20
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x64
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x72
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00462b00
jmp fcn.0051efe0

Function at 0x51f730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51f7c6
sub esp, 0x20
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x14], 0x6d
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x68
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x1b], 0x72
mov byte [esp + 0x1c], 0x67
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x28
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00462b00
jmp fcn.0051f730
Function at 0x52b500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52b63b
sub esp, 0x44
mov dword [esp + 0x16], 0
lea edi, [esp + 0x18]
xor eax, eax
call fcn.00464195
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x17], 0x65
mov byte [esp + 0x18], 0x66
mov byte [esp + 0x19], 0x6c
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x63
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2d], 0x3a
mov byte [esp + 0x2e], 0x20
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x30], 0x6e
mov byte [esp + 0x31], 0x76
mov byte [esp + 0x32], 0x61
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0x69
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x36], 0x20
mov byte [esp + 0x37], 0x6d
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x74
mov byte [esp + 0x3a], 0x68
mov byte [esp + 0x3b], 0x6f
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], 0x20
mov byte [esp + 0x3e], 0x69
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x40], 0x64
mov byte [esp + 0x41], 0x65
mov byte [esp + 0x42], 0x78
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2d
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x44
ret
call fcn.00462b00
jmp fcn.0052b500

Function at 0x53a5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x11d9bdc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53a673
sub esp, 0x2c
mov dword [esp + 0x23], 0xb07d8aa0
mov dword [esp + 0x24], 0x7fb07d8a
mov dword [esp + 0x28], 0x8c2064a3
lea edi, [esp + 0x17]
lea esi, [0xe78a58]
call fcn.00464692
xor eax, eax
jmp 0x53a5fa
movzx edi, byte [esp + ebx + 0x23]
sub edi, edx
lea edx, [edi - 0xd]
mov byte [esp + ebp + 0x23], dl
lea edx, [esi - 0xd]
mov byte [esp + ebx + 0x23], dl
add eax, 2
cmp eax, 0xc
jge 0x53a62a
movzx edx, byte [esp + eax + 0x17]
movzx ebx, byte [esp + eax + 0x18]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x53a666
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x23]
sub esi, edx
cmp ebx, 9
jb 0x53a5e2
jmp 0x53a65a
mov dword [esp], 0
lea eax, [esp + 0x23]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044f940
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.00463f80
mov eax, ebp
mov ecx, 9
call fcn.00463f80
nop
call fcn.00462b00
jmp fcn.0053a5a0