joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6609c880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6609c95b
sub esp, 0x30
mov dword [esp + 0x17], 0x4028190c
mov dword [esp + 0x1a], 0x36ee3540
mov dword [esp + 0x1e], 0xe8344538
mov dword [esp + 0x22], 0xa000204
lea edi, [esp + 0x24]
lea esi, [0x661ef164]
call fcn.65f65002
xor eax, eax
jmp 0x6609c8e0
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx + 0x26]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x6609c912
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x6609c94e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx + 0x26]
cmp ebx, 0xb
jb 0x6609c8ca
jmp 0x6609c942
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6609c880

Function at 0x6609d8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6609d9a1
sub esp, 0x2c
mov dword [esp + 0x15], 0x6778587a
mov dword [esp + 0x18], 0x65635067
mov dword [esp + 0x1c], 0x7c757473
lea edi, [esp + 0x20]
lea esi, [0x661eef4c]
call fcn.65f65002
xor eax, eax
jmp 0x6609d928
movzx edi, byte [esp + ebp + 0x15]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x15], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x6609d958
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
add ebx, eax
cmp edx, 0xb
jae 0x6609d994
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x15]
xor esi, ebx
cmp ebp, 0xb
jb 0x6609d912
jmp 0x6609d988
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
mov eax, edx
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.6609d8d0
Function at 0x660a0530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660a0603
sub esp, 0x30
mov dword [esp + 0x15], 0xa5d7c7d0
mov dword [esp + 0x18], 0x43a5eea5
mov dword [esp + 0x1c], 0x77c36cc7
lea edi, [esp + 0x20]
lea esi, [0x661ef308]
call fcn.65f64ff8
xor eax, eax
jmp 0x660a0588
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx - 0x3c]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x10
jge 0x660a05ba
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x660a05f6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx - 0x3c]
cmp ebx, 0xb
jb 0x660a0572
jmp 0x660a05ea
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xb
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660a0530

Function at 0x660a0840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660a091a
sub esp, 0x30
mov dword [esp + 0x15], 0x53748fed
lea edi, [esp + 0x16]
lea esi, [0x66113667]
call fcn.65f65002
mov dword [esp + 0x22], 0xa0a0701
lea edi, [esp + 0x24]
lea esi, [0x661ef172]
call fcn.65f65002
xor eax, eax
jmp 0x660a089f
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x6c]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x660a08d1
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xd
jae 0x660a090d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x6c]
cmp ebx, 0xd
jb 0x660a0889
jmp 0x660a0901
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xd
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xd
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xd
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660a0840
Function at 0x660a4c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660a4cf2
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x66112f8c]
call fcn.65f65002
mov dword [esp + 0x22], 0x6000102
lea edi, [esp + 0x24]
lea esi, [0x661ef180]
call fcn.65f65002
xor eax, eax
jmp 0x660a4c79
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x6c]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x6c]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xe
jge 0x660a4ca9
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x660a4ce5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0xc
jb 0x660a4c61
jmp 0x660a4cd9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xc
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660a4c20

Function at 0x660a5870
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660a594c
sub esp, 0x28
mov dword [esp + 0x15], 0x6562654f
mov dword [esp + 0x16], 0x25656265
mov dword [esp + 0x1a], 0x61513f33
mov dword [esp + 0x1e], 0x40502
mov dword [esp + 0x20], 0x7000004
mov dword [esp + 0x24], 0x2000608
xor eax, eax
jmp 0x660a58d3
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x18]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x18]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xa
jge 0x660a5903
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x660a593f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 9
jb 0x660a58bb
jmp 0x660a5933
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.65f649b0
mov eax, ebp
mov ecx, 9
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660a5870
Function at 0x660a5960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660a5a33
sub esp, 0x2c
mov dword [esp + 0x16], 0x426de528
mov dword [esp + 0x18], 0x4c76426d
mov dword [esp + 0x1c], 0x75074635
lea edi, [esp + 0x20]
lea esi, [0x661eef58]
call fcn.65f65002
xor eax, eax
jmp 0x660a59b8
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x15]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x660a59ea
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x660a5a26
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x15]
cmp ebx, 0xa
jb 0x660a59a2
jmp 0x660a5a1a
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660a5960

Function at 0x660a6130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660a620c
sub esp, 0x28
mov dword [esp + 0x15], 0x64b565fa
mov dword [esp + 0x16], 0xb064b565
mov dword [esp + 0x1a], 0x3c7591c8
mov dword [esp + 0x1e], 0x6080600
mov dword [esp + 0x20], 0x6050608
mov dword [esp + 0x24], 0x5020604
xor eax, eax
jmp 0x660a6193
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x38]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x38]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xa
jge 0x660a61c3
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x660a61ff
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 9
jb 0x660a617b
jmp 0x660a61f3
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.65f649b0
mov eax, ebp
mov ecx, 9
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660a6130
Function at 0x660a9a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660a9ad2
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x66112f98]
call fcn.65f65002
mov dword [esp + 0x22], 0x5090a08
lea edi, [esp + 0x24]
lea esi, [0x661ef18e]
call fcn.65f65002
xor eax, eax
jmp 0x660a9a59
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x3f]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x3f]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xe
jge 0x660a9a89
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x660a9ac5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0xc
jb 0x660a9a41
jmp 0x660a9ab9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xc
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660a9a00

Function at 0x660aedc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660aee92
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x66112fbc]
call fcn.65f65002
mov dword [esp + 0x22], 0x6040108
lea edi, [esp + 0x24]
lea esi, [0x661ef19c]
call fcn.65f65002
xor eax, eax
jmp 0x660aee17
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x54]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x660aee49
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x660aee85
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x54]
cmp ebx, 0xc
jb 0x660aee01
jmp 0x660aee79
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xc
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660aedc0
Function at 0x660b1200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660b12d2
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x66112fc8]
call fcn.65f65002
mov dword [esp + 0x22], 0x706050b
lea edi, [esp + 0x24]
lea esi, [0x661ef1aa]
call fcn.65f65002
xor eax, eax
jmp 0x660b1257
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x60]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x660b1289
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x660b12c5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x60]
cmp ebx, 0xc
jb 0x660b1241
jmp 0x660b12b9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xc
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660b1200
Function at 0x660b2ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660b2b93
sub esp, 0x2c
mov dword [esp + 0x16], 0x625c6555
mov dword [esp + 0x18], 0x6c61625c
mov dword [esp + 0x1c], 0x646b6661
lea edi, [esp + 0x20]
lea esi, [0x661eef64]
call fcn.65f65002
xor eax, eax
jmp 0x660b2b18
movzx edi, byte [esp + ebp + 0x16]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x16], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x660b2b4a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
lea ebx, [eax + ebx + 0x14]
cmp edx, 0xa
jae 0x660b2b86
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x16]
xor esi, ebx
cmp ebp, 0xa
jb 0x660b2b02
jmp 0x660b2b7a
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
mov eax, edx
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660b2ac0

Function at 0x660b5320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660b53f2
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, [0x66114512]
call fcn.65f64ff8
mov dword [esp + 0x26], 0x40b0501
lea edi, [esp + 0x28]
lea esi, [0x661ef510]
call fcn.65f64ff8
xor eax, eax
jmp 0x660b5379
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x70]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x70]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x660b53a9
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x660b53e5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x660b5361
jmp 0x660b53d9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.65f649b0
mov eax, ebp
mov ecx, 0x10
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660b5320
Function at 0x660b6110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660b61ec
sub esp, 0x28
mov dword [esp + 0x15], 0x1372a36
mov dword [esp + 0x16], 0x501372a
mov dword [esp + 0x1a], 0x57cfaa65
mov dword [esp + 0x1e], 0x2010607
mov dword [esp + 0x20], 0x40201
mov dword [esp + 0x24], 0x6030607
xor eax, eax
jmp 0x660b6171
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x36]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x660b61a3
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x660b61df
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x36]
cmp ebx, 9
jb 0x660b615b
jmp 0x660b61d3
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.65f649b0
mov eax, ebp
mov ecx, 9
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660b6110

Function at 0x660b8100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660b81db
sub esp, 0x2c
mov dword [esp + 0x14], 0x47c921c0
mov dword [esp + 0x16], 0x230747c9
mov dword [esp + 0x1a], 0xb7746383
mov dword [esp + 0x1e], 0x5020406
lea edi, [esp + 0x20]
lea esi, [0x661ef1b8]
call fcn.65f65002
xor eax, eax
jmp 0x660b8162
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi - 0x56]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi - 0x56]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x660b8192
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x660b81ce
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x660b814a
jmp 0x660b81c2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xa
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660b8100
Function at 0x660b9d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660b9dfc
sub esp, 0x28
mov dword [esp + 0x15], 0x2c7365ec
mov dword [esp + 0x16], 0xd12c7365
mov dword [esp + 0x1a], 0xd444eef7
mov dword [esp + 0x1e], 0x4000505
mov dword [esp + 0x20], 0x6040400
mov dword [esp + 0x24], 0x8060306
xor eax, eax
jmp 0x660b9d81
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x7b]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x660b9db3
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x660b9def
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x7b]
cmp ebx, 9
jb 0x660b9d6b
jmp 0x660b9de3
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.65f649b0
mov eax, ebp
mov ecx, 9
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660b9d20

Function at 0x660ba600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660ba6dc
sub esp, 0x28
mov dword [esp + 0x15], 0x44f74953
mov dword [esp + 0x16], 0x4944f749
mov dword [esp + 0x1a], 0x121e490c
mov dword [esp + 0x1e], 0x8020705
mov dword [esp + 0x20], 0x5080802
mov dword [esp + 0x24], 0x7060201
xor eax, eax
jmp 0x660ba663
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x34]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x34]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xa
jge 0x660ba693
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x660ba6cf
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 9
jb 0x660ba64b
jmp 0x660ba6c3
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.65f649b0
mov eax, ebp
mov ecx, 9
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660ba600
Function at 0x660cabf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x663127c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x660cacca
sub esp, 0x30
mov dword [esp + 0x22], 0x74fdf2f6
lea edi, [esp + 0x24]
lea esi, [0x66113981]
call fcn.65f65002
mov dword [esp + 0x14], 0x1000c00
lea edi, [esp + 0x16]
lea esi, [0x661ef0f4]
call fcn.65f65002
xor eax, eax
jmp 0x660cac4f
movzx edi, byte [esp + ebx + 0x22]
lea edx, [edi + edx + 0x61]
mov byte [esp + ebp + 0x22], dl
xchg esi, eax
mov byte [esp + ebx + 0x22], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x660cac81
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xe
jae 0x660cacbd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x22]
lea esi, [esi + edx + 0x61]
cmp ebx, 0xe
jb 0x660cac39
jmp 0x660cacb1
mov dword [esp], 0
lea eax, [esp + 0x22]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
call fcn.65f4fbe0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xe
call fcn.65f649b0
mov eax, ebp
mov ecx, 0xe
call fcn.65f649b0
nop
call fcn.65f63530
jmp fcn.660cabf0