joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54309a
sub esp, 0x30
mov dword [esp + 0x15], 0xec75b661
lea edi, [esp + 0x16]
lea esi, [0x5e44ab]
call fcn.00461e72
mov dword [esp + 0x22], 0xa010100
lea edi, [esp + 0x24]
lea esi, [0x61a722]
call fcn.00461e72
xor eax, eax
jmp 0x543021
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x70]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x70]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xe
jge 0x543051
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xd
jae 0x54308d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xd
jb 0x543009
jmp 0x543081
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xd
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xd
call fcn.00461830
mov eax, ebp
mov ecx, 0xd
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00542fc0
Function at 0x54a9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54aa72
sub esp, 0x38
lea edi, [esp + 0x16]
lea esi, str.GRcG
call fcn.00461e68
mov dword [esp + 0x26], 0x609090e
lea edi, [esp + 0x28]
lea esi, [0x61ac0c]
call fcn.00461e68
xor eax, eax
jmp 0x54a9f9
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x26]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x26]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x12
jge 0x54aa29
movzx edx, byte [esp + eax + 0x26]
movzx ebx, byte [esp + eax + 0x27]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x54aa65
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x10
jb 0x54a9e1
jmp 0x54aa59
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x38
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00461830
mov eax, ebp
mov ecx, 0x10
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0054a9a0
Function at 0x54c9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54caab
sub esp, 0x2c
mov dword [esp + 0x14], 0xc20b3f5c
mov dword [esp + 0x16], 0x657ec20b
mov dword [esp + 0x1a], 0x7013d861
mov dword [esp + 0x1e], 0x7000102
lea edi, [esp + 0x20]
lea esi, [0x61a73e]
call fcn.00461e72
xor eax, eax
jmp 0x54ca32
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi - 0x78]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi - 0x78]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x54ca62
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x54ca9e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x54ca1a
jmp 0x54ca92
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0054c9d0

Function at 0x54df30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54e00b
sub esp, 0x2c
mov dword [esp + 0x14], 0x1952f7e0
mov dword [esp + 0x16], 0x61171952
mov dword [esp + 0x1a], 0xfe9474fc
mov dword [esp + 0x1e], 0x3080201
lea edi, [esp + 0x20]
lea esi, [0x61a74c]
call fcn.00461e72
xor eax, eax
jmp 0x54df92
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi + 0x69]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi + 0x69]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x54dfc2
movzx edx, byte [esp + eax + 0x1e]
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x54dffe
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x54df7a
jmp 0x54dff2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0054df30
Function at 0x54e020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54e0fb
sub esp, 0x30
mov dword [esp + 0x17], 0xa66f6c12
mov dword [esp + 0x1a], 0xc3e138a6
mov dword [esp + 0x1e], 0x99656be7
mov dword [esp + 0x22], 0x4070704
lea edi, [esp + 0x24]
lea esi, [0x61a75a]
call fcn.00461e72
xor eax, eax
jmp 0x54e080
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx - 0x46]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xe
jge 0x54e0b2
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x54e0ee
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx - 0x46]
cmp ebx, 0xb
jb 0x54e06a
jmp 0x54e0e2
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0054e020

Function at 0x568c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x568d6b
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0x8000006
mov dword [esp + 0x16], 0x460bd400
mov dword [esp + 0x1a], 0x6060006
mov dword [esp + 0x1c], 0x5060606
mov dword [esp + 0x20], 0x30603
xor eax, eax
jmp 0x568ceb
movzx edi, byte [esp + ebx + 0x12]
sub edi, edx
lea edx, [edi + 3]
mov byte [esp + ebp + 0x12], dl
lea edx, [esi + 3]
mov byte [esp + ebx + 0x12], dl
add eax, 2
cmp eax, 0xa
jge 0x568d1b
movzx edx, byte [esp + eax + 0x1a]
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x568d5e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
sub esi, edx
cmp ebx, 8
jb 0x568cd3
jmp 0x568d52
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x568d39
movzx ecx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 8
jl 0x568d2f
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00568c80
Function at 0x568d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x568e5f
sub esp, 0x20
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0xf5009ca3
mov dword [esp + 0x1c], 0xf71da931
mov dword [esp + 8], 0x5040503
mov dword [esp + 0xc], 0x4070300
xor eax, eax
jmp 0x568ddf
movzx edi, byte [esp + ebx + 0x18]
add edx, edi
mov byte [esp + ebp + 0x18], dl
xchg esi, eax
mov byte [esp + ebx + 0x18], al
xchg esi, eax
add eax, 2
cmp eax, 8
jge 0x568e0f
movzx edx, byte [esp + eax + 8]
movzx ebx, byte [esp + eax + 9]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x568e52
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x18]
add esi, edx
cmp ebx, 8
jb 0x568dcb
jmp 0x568e46
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor eax, eax
jmp 0x568e2d
movzx ecx, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 8
jl 0x568e23
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00568d80

Function at 0x569220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56930b
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0x519e00b0
mov dword [esp + 0x16], 0x1859515b
mov dword [esp + 0x1a], 0x2070700
mov dword [esp + 0x1c], 0x4040207
mov dword [esp + 0x20], 0x3050606
xor eax, eax
jmp 0x569289
movzx edi, byte [esp + ebx + 0x12]
lea edx, [edi + edx - 0x5f]
mov byte [esp + ebp + 0x12], dl
xchg esi, eax
mov byte [esp + ebx + 0x12], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x5692bb
movzx edx, byte [esp + eax + 0x1a]
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x5692fe
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
lea esi, [esi + edx - 0x5f]
cmp ebx, 8
jb 0x569273
jmp 0x5692f2
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x5692d9
movzx ecx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 8
jl 0x5692cf
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.00569220
Function at 0x56a640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56a723
sub esp, 0x20
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0xde7705fc
mov dword [esp + 0x1c], 0x31720839
mov dword [esp + 8], 0x50301
mov dword [esp + 0xc], 0x4040204
xor eax, eax
jmp 0x56a6a1
movzx edi, byte [esp + ebx + 0x18]
lea edx, [edi + edx - 0x78]
mov byte [esp + ebp + 0x18], dl
xchg esi, eax
mov byte [esp + ebx + 0x18], al
xchg esi, eax
add eax, 2
cmp eax, 8
jge 0x56a6d3
movzx edx, byte [esp + eax + 8]
movzx ebx, byte [esp + eax + 9]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x56a716
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x18]
lea esi, [esi + edx - 0x78]
cmp ebx, 8
jb 0x56a68b
jmp 0x56a70a
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor eax, eax
jmp 0x56a6f1
movzx ecx, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 8
jl 0x56a6e7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0056a640

Function at 0x56a730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56a81b
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x12], 0xf94b6612
mov dword [esp + 0x16], 0x127916f4
mov dword [esp + 0x1a], 0x7070503
mov dword [esp + 0x1c], 0x6000707
mov dword [esp + 0x20], 0x1030203
xor eax, eax
jmp 0x56a79b
movzx edi, byte [esp + ebx + 0x12]
sub edi, edx
lea edx, [edi + 0x24]
mov byte [esp + ebp + 0x12], dl
lea edx, [esi + 0x24]
mov byte [esp + ebx + 0x12], dl
add eax, 2
cmp eax, 0xa
jge 0x56a7cb
movzx edx, byte [esp + eax + 0x1a]
movzx ebx, byte [esp + eax + 0x1b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x56a80e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x12]
sub esi, edx
cmp ebx, 8
jb 0x56a783
jmp 0x56a802
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
xor eax, eax
jmp 0x56a7e9
movzx ecx, byte [esp + eax + 0x12]
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 8
jl 0x56a7df
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0056a730
Function at 0x56ae40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56af5f
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
lea edi, [esp + 0x14]
lea esi, [0x5e52b3]
call fcn.00461e68
mov dword [esp + 0xb], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
movzx eax, byte [esp + 0x21]
movzx ecx, byte [esp + 0x23]
sub eax, ecx
movzx ecx, byte [esp + 0x16]
movzx edx, byte [esp + 0x20]
add ecx, edx
movzx edx, byte [esp + 0x1d]
movzx ebx, byte [esp + 0x1a]
add edx, ebx
movzx ebx, byte [esp + 0x17]
movzx ebp, byte [esp + 0x19]
xor ebx, ebp
movzx ebp, byte [esp + 0x22]
movzx esi, byte [esp + 0x1b]
sub ebp, esi
movzx esi, byte [esp + 0x15]
movzx edi, byte [esp + 0x1e]
add esi, edi
xchg esi, eax
mov byte [esp + 2], al
xchg esi, eax
movzx edi, byte [esp + 0x1f]
movzx esi, byte [esp + 0x14]
sub edi, esi
movzx esi, byte [esp + 0x1c]
xchg esi, eax
mov byte [esp + 1], al
xchg esi, eax
movzx esi, byte [esp + 0x18]
mov byte [esp + 0xb], al
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], bl
xchg ebp, eax
mov byte [esp + 0xf], al
xchg ebp, eax
movzx eax, byte [esp + 2]
mov byte [esp + 0x10], al
xchg edi, eax
mov byte [esp + 0x11], al
xchg edi, eax
movzx eax, byte [esp + 1]
sub eax, esi
mov byte [esp + 0x12], al
mov dword [esp + 3], 0
mov dword [esp + 7], 0
xor eax, eax
jmp 0x56af46
movzx ecx, byte [esp + eax + 0xb]
mov byte [esp + eax + 3], cl
inc eax
cmp eax, 8
jl 0x56af3c
mov eax, dword [esp + 3]
mov ecx, dword [esp + 7]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.004603c0
jmp fcn.0056ae40

Function at 0x56b2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56b3d2
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0x3bda894a
mov dword [esp + 0x14], 0x1aa657c8
lea edi, [esp + 0x18]
lea esi, [0x61a414]
call fcn.00461e72
xor eax, eax
jmp 0x56b350
movzx edi, byte [esp + ebx + 0x10]
lea edx, [edi + edx - 0x29]
mov byte [esp + ebp + 0x10], dl
xchg esi, eax
mov byte [esp + ebx + 0x10], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x56b382
movzx edx, byte [esp + eax + 0x18]
movzx ebx, byte [esp + eax + 0x19]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x56b3c5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x10]
lea esi, [esi + edx - 0x29]
cmp ebx, 8
jb 0x56b33a
jmp 0x56b3b9
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
xor eax, eax
jmp 0x56b3a0
movzx ecx, byte [esp + eax + 0x10]
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jl 0x56b396
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0056b2f0
Function at 0x56c4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56c5c3
sub esp, 0x20
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0xe203914
mov dword [esp + 0x1c], 0x5c934ea
mov dword [esp + 8], 0x3070501
mov dword [esp + 0xc], 0x7070600
xor eax, eax
jmp 0x56c541
movzx edi, byte [esp + ebx + 0x18]
lea edx, [edi + edx - 0x1d]
mov byte [esp + ebp + 0x18], dl
xchg esi, eax
mov byte [esp + ebx + 0x18], al
xchg esi, eax
add eax, 2
cmp eax, 8
jge 0x56c573
movzx edx, byte [esp + eax + 8]
movzx ebx, byte [esp + eax + 9]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x56c5b6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x18]
lea esi, [esi + edx - 0x1d]
cmp ebx, 8
jb 0x56c52b
jmp 0x56c5aa
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor eax, eax
jmp 0x56c591
movzx ecx, byte [esp + eax + 0x18]
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 8
jl 0x56c587
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0056c4e0

Function at 0x56e2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56e3df
sub esp, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
lea edi, [esp + 0x14]
lea esi, [0x5e52f3]
call fcn.00461e68
mov dword [esp + 0xb], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
movzx eax, byte [esp + 0x1e]
movzx ecx, byte [esp + 0x1b]
sub eax, ecx
movzx ecx, byte [esp + 0x14]
movzx edx, byte [esp + 0x1a]
sub ecx, edx
movzx edx, byte [esp + 0x18]
movzx ebx, byte [esp + 0x23]
sub edx, ebx
movzx ebx, byte [esp + 0x19]
movzx ebp, byte [esp + 0x1c]
xor ebx, ebp
movzx ebp, byte [esp + 0x1d]
movzx esi, byte [esp + 0x15]
add ebp, esi
movzx esi, byte [esp + 0x20]
movzx edi, byte [esp + 0x21]
add esi, edi
xchg esi, eax
mov byte [esp + 2], al
xchg esi, eax
movzx edi, byte [esp + 0x16]
movzx esi, byte [esp + 0x22]
sub edi, esi
movzx esi, byte [esp + 0x1f]
xchg esi, eax
mov byte [esp + 1], al
xchg esi, eax
movzx esi, byte [esp + 0x17]
mov byte [esp + 0xb], al
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], bl
xchg ebp, eax
mov byte [esp + 0xf], al
xchg ebp, eax
movzx eax, byte [esp + 2]
mov byte [esp + 0x10], al
xchg edi, eax
mov byte [esp + 0x11], al
xchg edi, eax
movzx eax, byte [esp + 1]
sub eax, esi
mov byte [esp + 0x12], al
mov dword [esp + 3], 0
mov dword [esp + 7], 0
xor eax, eax
jmp 0x56e3c6
movzx ecx, byte [esp + eax + 0xb]
mov byte [esp + eax + 3], cl
inc eax
cmp eax, 8
jl 0x56e3bc
mov eax, dword [esp + 3]
mov ecx, dword [esp + 7]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
call fcn.004603c0
jmp fcn.0056e2c0
Function at 0x5795f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5796c3
sub esp, 0x2c
mov dword [esp + 0x16], 0x61a27241
mov dword [esp + 0x18], 0x97e061a2
mov dword [esp + 0x1c], 0x3c00654d
lea edi, [esp + 0x20]
lea esi, [0x61a420]
call fcn.00461e72
xor eax, eax
jmp 0x579648
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx + 0x59]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x57967a
movzx edx, byte [esp + eax + 0x20]
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xa
jae 0x5796b6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx + 0x59]
cmp ebx, 0xa
jb 0x579632
jmp 0x5796aa
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.00461830
mov eax, ebp
mov ecx, 0xa
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.005795f0

Function at 0x57af90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57b06b
sub esp, 0x30
mov dword [esp + 0x17], 0x999973c9
mov dword [esp + 0x1a], 0xdb650d99
mov dword [esp + 0x1e], 0x57dbfec4
mov dword [esp + 0x22], 0x7010802
lea edi, [esp + 0x24]
lea esi, [0x61a634]
call fcn.00461e72
xor eax, eax
jmp 0x57aff2
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi - 0x4a]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi - 0x4a]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xe
jge 0x57b022
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x57b05e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 0xb
jb 0x57afda
jmp 0x57b052
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0057af90
Function at 0x57c020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57c0fb
sub esp, 0x30
mov dword [esp + 0x17], 0x4d3a6540
mov dword [esp + 0x1a], 0x6517b74d
mov dword [esp + 0x1e], 0x72df4eed
mov dword [esp + 0x22], 0x4020904
lea edi, [esp + 0x24]
lea esi, [0x61a642]
call fcn.00461e72
xor eax, eax
jmp 0x57c082
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi + 0x3c]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi + 0x3c]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xe
jge 0x57c0b2
movzx edx, byte [esp + eax + 0x22]
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0xb
jae 0x57c0ee
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 0xb
jb 0x57c06a
jmp 0x57c0e2
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.00461830
mov eax, ebp
mov ecx, 0xb
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0057c020

Function at 0x57ce90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x71469c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57cf5b
sub esp, 0x28
mov dword [esp + 0x14], 0x977465d2
mov dword [esp + 0x18], 0xc63e6907
lea edi, [esp + 0x1c]
lea esi, [0x61a42c]
call fcn.00461e72
xor eax, eax
jmp 0x57cee0
movzx edi, byte [esp + ebx + 0x14]
lea edx, [edi + edx - 0x6b]
mov byte [esp + ebp + 0x14], dl
xchg esi, eax
mov byte [esp + ebx + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x57cf12
movzx edx, byte [esp + eax + 0x1c]
movzx ebx, byte [esp + eax + 0x1d]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x57cf4e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
lea esi, [esi + edx - 0x6b]
cmp ebx, 8
jb 0x57ceca
jmp 0x57cf42
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.0044d8f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.00461830
mov eax, ebp
mov ecx, 8
call fcn.00461830
nop
call fcn.004603c0
jmp fcn.0057ce90