joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d12dcc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x11
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x172047a1]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12df6
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d12dd5
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d12e07
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe6
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x3bb0d0c8]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12e33
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d12e12
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d12e44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xf0
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x1d7534b1]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12e70
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d12e4f
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d12e81
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x70
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x52f894ca]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12eab
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d12e8a
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d12ebc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x18
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x491bac54]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12ee6
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d12ec5
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d12ef7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xac
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x7a734d3e]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12f23
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d12f02
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d12f34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x78
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x438a3081]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12f5e
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d12f3d
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d12f6f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x41
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x62ad94b]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12f99
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d12f78
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d12faa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x31
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x6d001f2e]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d12fd4
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d12fb3
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d12fe5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xda
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x4045c020]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d13011
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d12ff0
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d13022
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xc1
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x593c8bf]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d1304e
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d1302d
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d1305f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xc9
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x2a09d4eb]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d1308b
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d1306a
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d1309c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xf4
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x1d265e8d]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d130c8
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d130a7
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d130d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0x81
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x120ec0af]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d13105
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d130e4
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d13116
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xba
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x2a102d1c]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d13142
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d13121
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d13153
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xec
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x571221a1]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d1317f
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d1315e
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d13190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xbf
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x694611bb]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d131bc
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d1319b
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d131cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xf5
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x76f6dbab]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d131f9
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d131d8
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d1320a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xc5
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0xed75c2]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d13236
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d13215
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d13247
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x56
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x723df7c5]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d13271
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d13250
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d13282
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0x93
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x49d80c00]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d132ae
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d1328d
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d132bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x46
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x27eef134]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d132e9
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 6
jl 0x1d132c8
mov byte [esi + 6], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d132fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x68
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x3b06097]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d13324
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0xd
jl 0x1d13303
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d13335
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xea
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x2cd402bc]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d13361
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x11
jl 0x1d13340
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d13372
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x32
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x4bd91079]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d1339c
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 6
jl 0x1d1337b
mov byte [esi + 6], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d133c3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1d1341d
cmp dword [ebp + 0x10], 1
je 0x1d13402
cmp dword [ebp + 0x10], 2
je 0x1d13402
push 0xd
pop eax
jmp 0x1d1341d
mov eax, dword [ebp - 4]
test edi, edi
je 0x1d13419
test eax, eax
je 0x1d13416
cmp byte [eax + edi - 1], 0
je 0x1d13419
jmp 0x1d133fd
mov byte [edi], 0
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x1d13d40
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1d57f2d
call fcn.01d55708
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov eax, 0x1d63d9c
sub eax, 0x6430a19b
push eax
lea ecx, [ebp - 0x29]
call fcn.01d154d8
push dword [ebp + 8]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_4283]
push dword [ebp + 0xc]
mov byte [ebp - 4], 5
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
add esp, 0x14
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1d13de4
mov bl, 1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [ebp - 0xc]
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
lea eax, [ebp - 0x18]
push eax
call fcn.01d47c92
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 6
call fcn.01d027ac
add esp, 0x10
test al, al
je 0x1d13e9c
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0x1d63da8
push 0x1d63dac
lea ecx, [ebp + 8]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x1d63db0
push eax
call esi
add esp, 0xc
push ebx
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov byte [ebp - 4], 8
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], 7
call fcn.01d40ffe
add esp, 0xc
lea ecx, [ebp - 0x14]
cmp al, bl
jne 0x1d13e96
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x1d13da7
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x1d13da5
Function at 0x1d13eaa
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1d57f97
call fcn.01d55708
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov eax, 0x1d63dec
sub eax, 0x6430a19b
push eax
lea ecx, [ebp - 0x2c]
call fcn.01d154d8
push dword [ebp + 8]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_4283]
push dword [ebp + 0xc]
mov byte [ebp - 4], 5
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
add esp, 0x14
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1d13f55
cmp byte [ebp + 0x18], bl
je 0x1d13f51
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [ebp - 0xc]
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret
mov bl, 1
jmp 0x1d13f14
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], ebx
call fcn.01d40d0f
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x34]
call fcn.01d40c3e
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0x24781f50
lea ecx, [ebp - 0x28]
call fcn.01d15515
push dword [ebp - 0x1c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x18]
push eax
call esi
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.01d027ac
add esp, 0x14
test al, al
je 0x1d14045
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0x1d63e00
push 0x1d63e04
lea ecx, [ebp + 8]
mov byte [ebp - 4], 9
call dword [sym.imp.mfc100.dll_Ordinal_11627]
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push str.https:__csdown.dokee.cn_7E3BDDDB12121987E848D8B125CEDCB2__s
push eax
call esi
add esp, 0xc
push ebx
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov byte [ebp - 4], 9
call fcn.01d40ffe
add esp, 0xc
lea ecx, [ebp - 0x14]
cmp al, bl
jne 0x1d1403f
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.01d40d21
jmp 0x1d13f14
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.01d40d21
jmp 0x1d13f51
Function at 0x1d14e81
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x26
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x5769f6f2]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d14eab
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x1d
jl 0x1d14e8a
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d14ebc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xa9
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x462bf091]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d14ee8
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x20
jl 0x1d14ec7
mov byte [esi + 0x20], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d14ef9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0xa
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x5c4a87a9]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d14f23
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x20
jl 0x1d14f02
mov byte [esi + 0x20], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d14f34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0x8b
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x36737203]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d14f60
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x18
jl 0x1d14f3f
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d14f71
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xc2
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x23b938aa]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d14f9d
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x17
jl 0x1d14f7c
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d14fae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xc1
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x6798ba7]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d14fda
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 5
jl 0x1d14fb9
mov byte [esi + 5], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d14feb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x3c
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x3f5e583c]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d15015
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x20
jl 0x1d14ff4
mov byte [esi + 0x20], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x1d15026
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x13
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x38550b95]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d15050
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x22
jl 0x1d1502f
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d15061
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0x90
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x5ee817b2]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d1508d
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 4
jl 0x1d1506c
mov byte [esi + 4], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d1509e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xb9
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x122bdf76]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d150ca
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 7
jl 0x1d150a9
mov byte [esi + 7], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d150db
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x64
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x3a185065]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d15105
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x10
jl 0x1d150e4
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d15116
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0x86
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x27f74b13]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d15142
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x15
jl 0x1d15121
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d15153
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xb6
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x6cc928da]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d1517f
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0x10
jl 0x1d1515e
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d15190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x75
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x5d1e7f7e]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d151ba
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 8
jl 0x1d15199
mov byte [esi + 8], 0
mov eax, esi
pop esi
pop ebx
ret 4