joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e47c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e48c0
sub esp, 0x58
mov dword [esp + 0x15], 0x615a651c
lea edi, [esp + 0x16]
lea esi, str.eZae_2
call fcn.004526f0
mov dword [esp + 0x36], 0x20c1510
lea edi, [esp + 0x38]
lea esi, [0x5fa744]
call fcn.004526f0
xor eax, eax
jmp 0x4e4823
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0x22]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0x22]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0x22
jge 0x4e4861
jae 0x4e48b5
movzx edx, byte [esp + eax + 0x36]
lea ebx, [eax + 1]
cmp ebx, 0x22
jae 0x4e48a9
movzx ebx, byte [esp + eax + 0x37]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x21
jae 0x4e489d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0x21
jb 0x4e480b
jmp 0x4e4891
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x21
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
add esp, 0x58
ret
mov eax, ebx
mov ecx, 0x21
call fcn.004520a0
mov eax, ebp
mov ecx, 0x21
call fcn.004520a0
mov eax, ebx
mov ecx, 0x22
call fcn.004520a0
mov ecx, 0x22
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004e47c0
Function at 0x4e5120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e531d
sub esp, 0x20
lea eax, [0x5b0a60]
mov dword [esp], eax
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov byte [eax], 0xd5
lea ecx, [0x5ad780]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov dword [eax], 0
lea ecx, [0x5b4e40]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
lea ecx, [0x5c0740]
mov dword [esp], ecx
call fcn.0040a590
mov eax, dword [esp + 4]
lea ecx, [0x4e5330]
mov dword [eax], ecx
mov ecx, dword [0x6d6280]
test ecx, ecx
jne 0x4e51c1
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ebx, dword [esp + 0x14]
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + 0xc], ebx
mov dword [ebx], eax
jmp 0x4e51f2
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x1c]
call fcn.00452020
lea edi, [ecx + 8]
mov eax, dword [esp + 0x14]
call fcn.00452020
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x18]
call fcn.00452020
mov edi, eax
mov eax, ecx
call fcn.00452020
mov ebx, edi
mov edx, dword [ebx]
mov eax, dword [edx]
mov byte [esp], 0x47
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x81
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 3
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xc
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x11
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x20
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x51
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x5c
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xe0
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xcb
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa1
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4b
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x86
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xd5
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xbf
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xaa
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x52
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0xa7
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x4a
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x8d
call eax
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov byte [esp], 0x2d
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x20
ret
call fcn.00450c10
jmp fcn.004e5120
Function at 0x4ebd30
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ebe29
sub esp, 0x2c
mov dword [esp + 0x17], 0x6e63657b
mov dword [esp + 0x18], 0x796e6365
mov dword [esp + 0x1c], 0x52706872
lea edi, [esp + 0x20]
lea esi, [0x5f975c]
call fcn.00452722
xor eax, eax
jmp 0x4ebd8a
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx - 0xd]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x4ebdca
jae 0x4ebe1e
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x4ebe12
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 9
jae 0x4ebe06
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx - 0xd]
cmp ebx, 9
jb 0x4ebd74
jmp 0x4ebdfa
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.004520a0
mov eax, ebp
mov ecx, 9
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004ebd30

Function at 0x4ec610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ec701
sub esp, 0x28
mov dword [esp + 0x14], 0xcb2b65f5
mov dword [esp + 0x18], 0x372a0af3
lea edi, [esp + 0x1c]
lea esi, [0x5f9774]
call fcn.00452722
xor eax, eax
jmp 0x4ec662
movzx edi, byte [esp + ebx + 0x14]
lea edx, [edi + edx + 0x31]
mov byte [esp + ebp + 0x14], dl
xchg esi, eax
mov byte [esp + ebx + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x4ec6a2
jae 0x4ec6f6
movzx edx, byte [esp + eax + 0x1c]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x4ec6ea
movzx ebx, byte [esp + eax + 0x1d]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x4ec6de
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
lea esi, [esi + edx + 0x31]
cmp ebx, 8
jb 0x4ec64c
jmp 0x4ec6d2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004ec610
Function at 0x4f9b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f9c20
sub esp, 0x48
mov dword [esp + 0x2e], 0x29696143
lea edi, [esp + 0x30]
lea esi, [0x5d1992]
call fcn.00452704
mov dword [esp + 0x14], 0x17050b07
lea edi, [esp + 0x16]
lea esi, [0x5fa08c]
call fcn.00452704
xor eax, eax
jmp 0x4f9b81
movzx edi, byte [esp + ebx + 0x2e]
lea edx, [edi + edx + 0x67]
mov byte [esp + ebp + 0x2e], dl
xchg esi, eax
mov byte [esp + ebx + 0x2e], al
xchg esi, eax
add eax, 2
cmp eax, 0x1a
jge 0x4f9bc1
jae 0x4f9c15
movzx edx, byte [esp + eax + 0x14]
lea ebx, [eax + 1]
cmp ebx, 0x1a
jae 0x4f9c09
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x1a
jae 0x4f9bfd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x2e]
lea esi, [esi + edx + 0x67]
cmp ebx, 0x1a
jb 0x4f9b6b
jmp 0x4f9bf1
mov dword [esp], 0
lea eax, [esp + 0x2e]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
mov eax, ebx
mov ecx, 0x1a
call fcn.004520a0
mov eax, ebp
mov ecx, 0x1a
call fcn.004520a0
mov eax, ebx
mov ecx, 0x1a
call fcn.004520a0
mov ecx, 0x1a
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.004f9b20
Function at 0x501610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x501708
sub esp, 0x48
lea edi, [esp + 0x16]
lea esi, [0x5d1292]
call fcn.00452704
mov dword [esp + 0x2e], 0x415120a
lea edi, [esp + 0x30]
lea esi, [0x5fa0c0]
call fcn.00452704
xor eax, eax
jmp 0x50166b
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi + 0x3b]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi + 0x3b]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x1a
jge 0x5016a9
jae 0x5016fd
movzx edx, byte [esp + eax + 0x2e]
lea ebx, [eax + 1]
cmp ebx, 0x1a
jae 0x5016f1
movzx ebx, byte [esp + eax + 0x2f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x18
jae 0x5016e5
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x18
jb 0x501653
jmp 0x5016d9
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
mov eax, ebx
mov ecx, 0x18
call fcn.004520a0
mov eax, ebp
mov ecx, 0x18
call fcn.004520a0
mov eax, ebx
mov ecx, 0x1a
call fcn.004520a0
mov ecx, 0x1a
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00501610
Function at 0x506650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x506750
sub esp, 0x40
mov dword [esp + 0x15], 0x92abb64e
lea edi, [esp + 0x16]
lea esi, [0x5d0518]
call fcn.0045270e
mov dword [esp + 0x2a], 0x602080b
lea edi, [esp + 0x2c]
lea esi, [0x5f9db4]
call fcn.0045270e
xor eax, eax
jmp 0x5066b3
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x13]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x13]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0x16
jge 0x5066f1
jae 0x506745
movzx edx, byte [esp + eax + 0x2a]
lea ebx, [eax + 1]
cmp ebx, 0x16
jae 0x506739
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x15
jae 0x50672d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0x15
jb 0x50669b
jmp 0x506721
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x15
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x40
ret
mov eax, ebx
mov ecx, 0x15
call fcn.004520a0
mov eax, ebp
mov ecx, 0x15
call fcn.004520a0
mov eax, ebx
mov ecx, 0x16
call fcn.004520a0
mov ecx, 0x16
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00506650

Function at 0x506760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x506860
sub esp, 0x48
mov dword [esp + 0x2e], 0x74fee0a2
lea edi, [esp + 0x30]
lea esi, [0x5d1ae4]
call fcn.00452704
mov dword [esp + 0x14], 0x10020d12
lea edi, [esp + 0x16]
lea esi, [0x5fa0f4]
call fcn.00452704
xor eax, eax
jmp 0x5067c1
movzx edi, byte [esp + ebx + 0x2e]
lea edx, [edi + edx + 0x5c]
mov byte [esp + ebp + 0x2e], dl
xchg esi, eax
mov byte [esp + ebx + 0x2e], al
xchg esi, eax
add eax, 2
cmp eax, 0x1a
jge 0x506801
jae 0x506855
movzx edx, byte [esp + eax + 0x14]
lea ebx, [eax + 1]
cmp ebx, 0x1a
jae 0x506849
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x1a
jae 0x50683d
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x2e]
lea esi, [esi + edx + 0x5c]
cmp ebx, 0x1a
jb 0x5067ab
jmp 0x506831
mov dword [esp], 0
lea eax, [esp + 0x2e]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
mov eax, ebx
mov ecx, 0x1a
call fcn.004520a0
mov eax, ebp
mov ecx, 0x1a
call fcn.004520a0
mov eax, ebx
mov ecx, 0x1a
call fcn.004520a0
mov ecx, 0x1a
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00506760
Function at 0x5174b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5175b1
sub esp, 0x30
mov dword [esp + 0x17], 0x2926ef2f
mov dword [esp + 0x1a], 0x74732f29
mov dword [esp + 0x1e], 0xc0f9328c
mov dword [esp + 0x22], 0x90a0901
lea edi, [esp + 0x24]
lea esi, [0x5f989c]
call fcn.00452722
xor eax, eax
jmp 0x517514
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi + 0x49]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi + 0x49]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xe
jge 0x517552
jae 0x5175a6
movzx edx, byte [esp + eax + 0x22]
lea ebx, [eax + 1]
cmp ebx, 0xe
jae 0x51759a
movzx ebx, byte [esp + eax + 0x23]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x51758e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 0xb
jb 0x5174fc
jmp 0x517582
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0xe
call fcn.004520a0
mov ecx, 0xe
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.005174b0
Function at 0x51b220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51b31a
sub esp, 0x28
mov dword [esp + 0x16], 0xc69bbb64
mov dword [esp + 0x1a], 0xce6b6150
mov dword [esp + 0x1e], 0x1070706
mov dword [esp + 0x20], 0x2000107
mov dword [esp + 0x24], 0x3010102
xor eax, eax
jmp 0x51b27b
movzx edi, byte [esp + ebx + 0x16]
lea edx, [edi + edx - 0x5b]
mov byte [esp + ebp + 0x16], dl
xchg esi, eax
mov byte [esp + ebx + 0x16], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x51b2bb
jae 0x51b30f
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x51b303
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x51b2f7
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
lea esi, [esi + edx - 0x5b]
cmp ebx, 8
jb 0x51b265
jmp 0x51b2eb
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0051b220
Function at 0x525ae0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x525bd9
sub esp, 0x2c
mov dword [esp + 0x15], 0x21403c2f
mov dword [esp + 0x18], 0x5a442b21
mov dword [esp + 0x1c], 0x28464552
lea edi, [esp + 0x20]
lea esi, [0x5f9714]
call fcn.00452722
xor eax, eax
jmp 0x525b3c
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi + 0xa]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi + 0xa]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0xc
jge 0x525b7a
jae 0x525bce
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x525bc2
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x525bb6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x525b24
jmp 0x525baa
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00525ae0

Function at 0x526200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5262f2
sub esp, 0x24
mov dword [esp + 0x1c], 0x1f53042c
mov dword [esp + 0x20], 0x2c3025de
mov dword [esp + 0x14], 0x10604
mov dword [esp + 0x18], 0x6050703
xor eax, eax
jmp 0x526253
movzx edi, byte [esp + ebx + 0x1c]
lea edx, [edi + edx + 0x40]
mov byte [esp + ebp + 0x1c], dl
xchg esi, eax
mov byte [esp + ebx + 0x1c], al
xchg esi, eax
add eax, 2
cmp eax, 8
jge 0x526293
jae 0x5262e7
movzx edx, byte [esp + eax + 0x14]
lea ebx, [eax + 1]
cmp ebx, 8
jae 0x5262db
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x5262cf
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x1c]
lea esi, [esi + edx + 0x40]
cmp ebx, 8
jb 0x52623d
jmp 0x5262c3
mov dword [esp], 0
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x24
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov ecx, 8
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00526200
Function at 0x539880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x539982
sub esp, 0x28
mov dword [esp + 0x1e], 0x4135453e
mov dword [esp + 0x20], 0x6104135
mov dword [esp + 0x24], 0x65464069
mov dword [esp + 0x14], 0x7040305
mov dword [esp + 0x16], 0x30704
mov dword [esp + 0x1a], 0x1080207
xor eax, eax
jmp 0x5398e5
movzx edi, byte [esp + ebx + 0x1e]
sub edi, edx
lea edx, [edi + 0x38]
mov byte [esp + ebp + 0x1e], dl
lea edx, [esi + 0x38]
mov byte [esp + ebx + 0x1e], dl
add eax, 2
cmp eax, 0xa
jge 0x539923
jae 0x539977
movzx edx, byte [esp + eax + 0x14]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x53996b
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xa
jae 0x53995f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x1e]
sub esi, edx
cmp ebx, 0xa
jb 0x5398cd
jmp 0x539953
mov dword [esp], 0
lea eax, [esp + 0x1e]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov eax, ebp
mov ecx, 0xa
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00539880
Function at 0x53ae90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53af89
sub esp, 0x2c
mov dword [esp + 0x17], 0x1fab6ee2
mov dword [esp + 0x18], 0xac1fab6e
mov dword [esp + 0x1c], 0xa76fe0d4
lea edi, [esp + 0x20]
lea esi, [0x5f97e0]
call fcn.00452722
xor eax, eax
jmp 0x53aeea
movzx edi, byte [esp + ebx + 0x17]
lea edx, [edi + edx - 0x45]
mov byte [esp + ebp + 0x17], dl
xchg esi, eax
mov byte [esp + ebx + 0x17], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x53af2a
jae 0x53af7e
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x53af72
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 9
jae 0x53af66
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
lea esi, [esi + edx - 0x45]
cmp ebx, 9
jb 0x53aed4
jmp 0x53af5a
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.004520a0
mov eax, ebp
mov ecx, 9
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0053ae90

Function at 0x53afa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53b0a2
sub esp, 0x28
mov dword [esp + 0x15], 0xcb2cc11b
mov dword [esp + 0x16], 0x72cb2cc1
mov dword [esp + 0x1a], 0x106f1c21
mov dword [esp + 0x1e], 0x8050200
mov dword [esp + 0x20], 0x6010805
mov dword [esp + 0x24], 0x6060603
xor eax, eax
jmp 0x53b003
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x47]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0xa
jge 0x53b043
jae 0x53b097
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x53b08b
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 9
jae 0x53b07f
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x47]
cmp ebx, 9
jb 0x53afed
jmp 0x53b073
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 9
call fcn.004520a0
mov eax, ebp
mov ecx, 9
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0053afa0
Function at 0x53ef20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53f020
sub esp, 0x60
mov dword [esp + 0x15], 0xdddd7263
lea edi, [esp + 0x16]
lea esi, [0x5d411e]
call fcn.004526e6
mov dword [esp + 0x3a], 0x11220914
lea edi, [esp + 0x3c]
lea esi, [0x5fa8f2]
call fcn.004526e6
xor eax, eax
jmp 0x53ef81
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x5b]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x26
jge 0x53efc1
jae 0x53f015
movzx edx, byte [esp + eax + 0x3a]
lea ebx, [eax + 1]
cmp ebx, 0x26
jae 0x53f009
movzx ebx, byte [esp + eax + 0x3b]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x25
jae 0x53effd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x5b]
cmp ebx, 0x25
jb 0x53ef6b
jmp 0x53eff1
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x25
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
add esp, 0x60
ret
mov eax, ebx
mov ecx, 0x25
call fcn.004520a0
mov eax, ebp
mov ecx, 0x25
call fcn.004520a0
mov eax, ebx
mov ecx, 0x26
call fcn.004520a0
mov ecx, 0x26
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0053ef20