joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57d230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57d30b
sub esp, 0x30
mov dword [esp + 0x17], 0xb2fa7aa7
mov dword [esp + 0x1a], 0x7bafa3b2
mov dword [esp + 0x1e], 0xaf9c6ebe
mov dword [esp + 0x22], 0x4020207
lea edi, [esp + 0x24]
lea esi, [0x61a650]
call fcn.00461e72
xor eax, eax
jmp 0x57d292
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi - 0x27]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi - 0x27]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xe
jge 0x57d2c2
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x57d2fe
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 0xb
jb 0x57d27a
jmp 0x57d2f2
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0057d230

Function at 0x57e900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57e9d3
sub esp, 0x2c
mov dword [esp + 0x15], 0x531feef8
mov dword [esp + 0x18], 0x14736853
mov dword [esp + 0x1c], 0x72276ce8
lea edi, [esp + 0x20]
lea esi, [0x61a438]
call fcn.00461e72
xor eax, eax
jmp 0x57e95a
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x62]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x62]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x57e98a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x57e9c6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x57e942
jmp 0x57e9ba
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0057e900
Function at 0x57f220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57f2fc
sub esp, 0x28
mov dword [esp + 0x15], 0x351865a1
mov dword [esp + 0x16], 0x2c351865
mov dword [esp + 0x1a], 0x39066442
mov dword [esp + 0x1e], 0x7040007
mov dword [esp + 0x20], 0x4040704
mov dword [esp + 0x24], 0x2030805
xor eax, eax
jmp 0x57f283
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x48]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x48]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xa
jge 0x57f2b3
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x57f2ef
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 9
jb 0x57f26b
jmp 0x57f2e3
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.00461830
mov eax, ebp
mov ecx, 9
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0057f220
Function at 0x580740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58081c
sub esp, 0x28
mov dword [esp + 0x15], 0x4545574b
mov dword [esp + 0x16], 0x4a454557
mov dword [esp + 0x1a], 0x55654241
mov dword [esp + 0x1e], 0x1060504
mov dword [esp + 0x20], 0x4060106
mov dword [esp + 0x24], 0x6080203
xor eax, eax
jmp 0x5807a1
movzx edi, byte [esp + ebp + 0x15]
xor edi, ebx
xchg edi, eax
mov byte [esp + edx + 0x15], al
xchg edi, eax
xchg esi, eax
mov byte [esp + ebp + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x5807d3
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, ebx
xor ebx, edx
movzx edx, dl
lea ebx, [eax + ebx + 0x22]
cmp edx, 9
jae 0x58080f
xchg ebp, eax
movzx eax, al
xchg ebp, eax
movzx esi, byte [esp + edx + 0x15]
xor esi, ebx
cmp ebp, 9
jb 0x58078b
jmp 0x580803
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebp
mov ecx, 9
call fcn.00461830
mov eax, edx
mov ecx, 9
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00580740

Function at 0x580830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x580903
sub esp, 0x2c
mov dword [esp + 0x15], 0x64e86104
mov dword [esp + 0x18], 0x72faf564
mov dword [esp + 0x1c], 0xf6728ac5
lea edi, [esp + 0x20]
lea esi, [0x61a444]
call fcn.00461e72
xor eax, eax
jmp 0x58088a
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x7f]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x7f]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x5808ba
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x5808f6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x580872
jmp 0x5808ea
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00580830
Function at 0x580b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x580c4c
sub esp, 0x28
mov dword [esp + 0x15], 0xcb617fc5
mov dword [esp + 0x16], 0x27cb617f
mov dword [esp + 0x1a], 0x1c756e06
mov dword [esp + 0x1e], 0x10803
mov dword [esp + 0x20], 0x5000001
mov dword [esp + 0x24], 0x8050401
xor eax, eax
jmp 0x580bd1
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x3d]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x580c03
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x580c3f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x3d]
cmp ebx, 9
jb 0x580bbb
jmp 0x580c33
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.00461830
mov eax, ebp
mov ecx, 9
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00580b70

Function at 0x581730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58180a
sub esp, 0x30
mov dword [esp + 0x22], 0x9d74ffb6
lea edi, [esp + 0x24]
lea esi, [0x5e4937]
call fcn.00461e72
mov dword [esp + 0x14], 0xb07040a
lea edi, [esp + 0x16]
lea esi, [0x61a66c]
call fcn.00461e72
xor eax, eax
jmp 0x581791
movzx edi, byte [esp + ebx + 0x22]
sub edi, edx
lea edx, [edi - 0x42]
mov byte [esp + ebp + 0x22], dl
lea edx, [esi - 0x42]
mov byte [esp + ebx + 0x22], dl
add eax, 2
cmp eax, 0xe
jge 0x5817c1
movzx edx, byte [esp + eax + 0x14]
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xe
jae 0x5817fd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x22]
sub esi, edx
cmp ebx, 0xe
jb 0x581779
jmp 0x5817f1
mov dword [esp], 0
lea eax, [esp + 0x22]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xe
call fcn.00461830
mov eax, ebp
mov ecx, 0xe
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00581730
Function at 0x583fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5840b2
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, [0x5e5423]
call fcn.00461e68
mov dword [esp + 0x26], 0xc08050f
lea edi, [esp + 0x28]
lea esi, [0x61aafe]
call fcn.00461e68
xor eax, eax
jmp 0x584039
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x1a]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x1a]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x584069
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x5840a5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x584021
jmp 0x584099
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00461830
mov eax, ebp
mov ecx, 0x10
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00583fe0
Function at 0x588480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x588552
sub esp, 0x50
lea edi, [esp + 0x16]
lea esi, [0x5e997f]
call fcn.00461e4a
mov dword [esp + 0x32], 0x20e140b
lea edi, [esp + 0x34]
lea esi, [0x61b7d8]
call fcn.00461e4a
xor eax, eax
jmp 0x5884d9
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x2a]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x2a]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x1e
jge 0x588509
movzx edx, byte [esp + eax + 0x32]
movzx ebx, byte [esp + eax + 0x33]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x1c
jae 0x588545
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x1c
jb 0x5884c1
jmp 0x588539
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1c
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x50
ret
mov eax, ebx
mov ecx, 0x1c
call fcn.00461830
mov eax, ebp
mov ecx, 0x1c
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00588480

Function at 0x58b110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58b1ec
sub esp, 0x28
mov dword [esp + 0x15], 0xc265b584
mov dword [esp + 0x16], 0x32c265b5
mov dword [esp + 0x1a], 0x6c6cc12e
mov dword [esp + 0x1e], 0x6060001
mov dword [esp + 0x20], 0x6000606
mov dword [esp + 0x24], 0x1030303
xor eax, eax
jmp 0x58b173
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x23]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x23]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xa
jge 0x58b1a3
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x58b1df
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 9
jb 0x58b15b
jmp 0x58b1d3
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.00461830
mov eax, ebp
mov ecx, 9
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0058b110
Function at 0x58c4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58c573
sub esp, 0x2c
mov dword [esp + 0x15], 0x9ae3c943
mov dword [esp + 0x18], 0x9f489b9a
mov dword [esp + 0x1c], 0x65946494
lea edi, [esp + 0x20]
lea esi, [0x61a45c]
call fcn.00461e72
xor eax, eax
jmp 0x58c4fa
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x22]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x22]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x58c52a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x58c566
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x58c4e2
jmp 0x58c55a
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0058c4a0

Function at 0x58c800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58c8d2
sub esp, 0x40
lea edi, [esp + 0x16]
lea esi, [0x5e6be3]
call fcn.00461e5e
mov dword [esp + 0x2a], 0x5060610
lea edi, [esp + 0x2c]
lea esi, [0x61b026]
call fcn.00461e5e
xor eax, eax
jmp 0x58c859
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x56]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x56]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x16
jge 0x58c889
movzx edx, byte [esp + eax + 0x2a]
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x14
jae 0x58c8c5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x14
jb 0x58c841
jmp 0x58c8b9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x14
call fcn.00461830
mov eax, ebp
mov ecx, 0x14
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0058c800
Function at 0x58d860
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58d93b
sub esp, 0x2c
mov dword [esp + 0x14], 0x635b6c47
mov dword [esp + 0x16], 0x3d71635b
mov dword [esp + 0x1a], 0x72775663
mov dword [esp + 0x1e], 0x7070605
lea edi, [esp + 0x20]
lea esi, [0x61a6b2]
call fcn.00461e72
xor eax, eax
jmp 0x58d8c2
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi + 0xc]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi + 0xc]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x58d8f2
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x58d92e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x58d8aa
jmp 0x58d922
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0058d860

Function at 0x58f100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58f1d3
sub esp, 0x2c
mov dword [esp + 0x15], 0xbd67398
mov dword [esp + 0x18], 0x3433340b
mov dword [esp + 0x1c], 0x6c6cfd2e
lea edi, [esp + 0x20]
lea esi, [0x61a468]
call fcn.00461e72
xor eax, eax
jmp 0x58f15a
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x3f]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x3f]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x58f18a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x58f1c6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x58f142
jmp 0x58f1ba
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0058f100
Function at 0x592240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x592312
sub esp, 0x30
lea edi, [esp + 0x16]
lea esi, [0x5e3eac]
call fcn.00461e72
mov dword [esp + 0x22], 0x30b0309
lea edi, [esp + 0x24]
lea esi, [0x61a6c0]
call fcn.00461e72
xor eax, eax
jmp 0x592299
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x3b]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x3b]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xe
jge 0x5922c9
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xc
jae 0x592305
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0xc
jb 0x592281
jmp 0x5922f9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xc
call fcn.00461830
mov eax, ebp
mov ecx, 0xc
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00592240

Function at 0x593310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5933e3
sub esp, 0x2c
mov dword [esp + 0x16], 0xa90d65a1
mov dword [esp + 0x18], 0x6a10a90d
mov dword [esp + 0x1c], 0x572ab7d2
lea edi, [esp + 0x20]
lea esi, [0x61a474]
call fcn.00461e72
xor eax, eax
jmp 0x59336a
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x5c]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x5c]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xc
jge 0x59339a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x5933d6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0xa
jb 0x593352
jmp 0x5933ca
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00593310
Function at 0x593cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x593d82
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, [0x5e5453]
call fcn.00461e68
mov dword [esp + 0x26], 0xb0f0804
lea edi, [esp + 0x28]
lea esi, [0x61ab34]
call fcn.00461e68
xor eax, eax
jmp 0x593d09
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x39]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x39]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x593d39
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x593d75
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x593cf1
jmp 0x593d69
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00461830
mov eax, ebp
mov ecx, 0x10
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00593cb0

Function at 0x596610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5966ec
sub esp, 0x28
mov dword [esp + 0x15], 0x83927453
mov dword [esp + 0x16], 0x6839274
mov dword [esp + 0x1a], 0x8866150
mov dword [esp + 0x1e], 0x7030304
mov dword [esp + 0x20], 0x2070703
mov dword [esp + 0x24], 0x4070803
xor eax, eax
jmp 0x596673
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x7b]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x7b]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xa
jge 0x5966a3
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 9
jae 0x5966df
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 9
jb 0x59665b
jmp 0x5966d3
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.00461830
mov eax, ebp
mov ecx, 9
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00596610
Function at 0x598950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x598a2a
sub esp, 0x40
mov dword [esp + 0x15], 0x64c71ffe
lea edi, [esp + 0x16]
lea esi, [0x5e718c]
call fcn.00461e5e
mov dword [esp + 0x2a], 0xf14040a
lea edi, [esp + 0x2c]
lea esi, [0x61b052]
call fcn.00461e5e
xor eax, eax
jmp 0x5989b1
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x59]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x59]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0x16
jge 0x5989e1
movzx edx, byte [esp + eax + 0x2a]
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x15
jae 0x598a1d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0x15
jb 0x598999
jmp 0x598a11
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x15
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x15
call fcn.00461830
mov eax, ebp
mov ecx, 0x15
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00598950