joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53f870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53f968
sub esp, 0x50
lea edi, [esp + 0x16]
lea esi, [0x5d21e9]
call fcn.004526fa
mov dword [esp + 0x32], 0xb131811
lea edi, [esp + 0x34]
lea esi, [0x5fa352]
call fcn.004526fa
xor eax, eax
jmp 0x53f8cb
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x60]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x60]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0x1e
jge 0x53f909
jae 0x53f95d
movzx edx, byte [esp + eax + 0x32]
lea ebx, [eax + 1]
cmp ebx, 0x1e
jae 0x53f951
movzx ebx, byte [esp + eax + 0x33]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x1c
jae 0x53f945
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 0x1c
jb 0x53f8b3
jmp 0x53f939
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1c
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x50
ret
mov eax, ebx
mov ecx, 0x1c
call fcn.004520a0
mov eax, ebp
mov ecx, 0x1c
call fcn.004520a0
mov eax, ebx
mov ecx, 0x1e
call fcn.004520a0
mov ecx, 0x1e
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0053f870
Function at 0x544380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54447a
sub esp, 0x28
mov dword [esp + 0x16], 0x9d65d387
mov dword [esp + 0x1a], 0xa869ba77
mov dword [esp + 0x1e], 0x5070103
mov dword [esp + 0x20], 0x3010507
mov dword [esp + 0x24], 0x5000701
xor eax, eax
jmp 0x5443dd
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x19]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x19]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xa
jge 0x54441b
jae 0x54446f
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x544463
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x544457
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 8
jb 0x5443c5
jmp 0x54444b
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00544380
Function at 0x5460a0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x546148
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x5460fb
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x546132
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.00450c10
jmp fcn.005460a0
Function at 0x54aea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54afa1
sub esp, 0x2c
mov dword [esp + 0x14], 0x842d8f4a
mov dword [esp + 0x16], 0x7357842d
mov dword [esp + 0x1a], 0x7d445f45
mov dword [esp + 0x1e], 0x3010301
lea edi, [esp + 0x20]
lea esi, [0x5f9856]
call fcn.00452722
xor eax, eax
jmp 0x54af04
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi - 0x19]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi - 0x19]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x54af42
jae 0x54af96
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xe
jae 0x54af8a
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xa
jae 0x54af7e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x54aeec
jmp 0x54af72
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov eax, ebp
mov ecx, 0xa
call fcn.004520a0
mov eax, ebx
mov ecx, 0xe
call fcn.004520a0
mov ecx, 0xe
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0054aea0
Function at 0x54bd90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54bf75
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.004526dc
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0054b7f0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.00452226
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x54be42
mov edx, dword [esp + 0xc]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x54bf10
mov dword [esp + 0xc], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
mov dword [esp + 0x1c], edx
and edx, 0xfffffff8
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [ebx - 0x20]
mov dword [esp + 0x18], esi
cmp esi, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg esi, ebx
neg ebx
xchg esi, ebx
cmp esi, 0x20
sbb ebp, ebp
mov dword [esp + 0x10], ebp
lea edi, [esp + ecx*8 + 0x58]
mov ebp, dword [edi]
mov dword [esp + 8], ebp
mov edi, dword [edi + 4]
mov ecx, ebx
shl ebp, cl
and ebp, edx
xchg ebp, eax
mov byte [esp + 0x20], al
xchg ebp, eax
shl edi, cl
and edi, edx
mov ecx, esi
mov edx, dword [esp + 8]
mov ebx, edx
shr edx, cl
mov esi, dword [esp + 0x10]
and edx, esi
or edx, edi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov esi, dword [esp + 0x14]
and ebx, esi
or ebx, edx
mov edx, ebp
shr ebp, 8
mov esi, ebx
shl ebx, 0x18
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0x21], al
xchg ebp, eax
mov ebx, edx
shr edx, 0x10
mov ebp, esi
shl esi, 0x10
or esi, edx
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov edx, ebp
shl ebp, 8
shr ebx, 0x18
or ebx, ebp
mov byte [esp + 0x23], bl
mov dword [esp + 0x24], edx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x54bf43
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + edx]
or esi, ebx
xchg esi, ebx
mov byte [eax + edx], bl
xchg esi, ebx
inc ecx
mov edx, ebp
cmp ecx, 8
jge 0x54be3b
movzx ebx, byte [esp + ecx + 0x28]
mov ebp, edx
sar edx, 3
add edx, ecx
cmp edx, 0x20
jge 0x54be3b
test byte [eax], al
cmp edx, 0x20
jb 0x54bf33
mov eax, edx
mov ecx, 0x20
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0054bd90
Function at 0x550790
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5509a6
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x550829
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x550987
cmp ecx, 0xe
jne 0x5508a2
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x550987
cmp ecx, 0xf
jne 0x550918
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x550987
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.00450c10
jmp fcn.00550790
Function at 0x553e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x553f00
sub esp, 0x5c
lea edi, [esp + 0x38]
lea esi, [0x5d3cb7]
call fcn.004526e6
lea edi, [esp + 0x14]
lea esi, [0x5fa788]
call fcn.004526e6
xor eax, eax
jmp 0x553e63
movzx edi, byte [esp + ebx + 0x38]
sub edi, edx
lea edx, [edi + 0x4d]
mov byte [esp + ebp + 0x38], dl
lea edx, [esi + 0x4d]
mov byte [esp + ebx + 0x38], dl
add eax, 2
cmp eax, 0x24
jge 0x553ea1
jae 0x553ef5
movzx edx, byte [esp + eax + 0x14]
lea ebx, [eax + 1]
cmp ebx, 0x24
jae 0x553ee9
movzx ebx, byte [esp + eax + 0x15]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x24
jae 0x553edd
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x38]
sub esi, edx
cmp ebx, 0x24
jb 0x553e4b
jmp 0x553ed1
mov dword [esp], 0
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x24
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
add esp, 0x5c
ret
mov eax, ebx
mov ecx, 0x24
call fcn.004520a0
mov eax, ebp
mov ecx, 0x24
call fcn.004520a0
mov eax, ebx
mov ecx, 0x24
call fcn.004520a0
mov ecx, 0x24
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00553e10
Function at 0x554b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x554bfa
sub esp, 0x28
mov dword [esp + 0x16], 0x68359054
mov dword [esp + 0x1a], 0x75317034
mov dword [esp + 0x1e], 0x5070103
mov dword [esp + 0x20], 0x3010507
mov dword [esp + 0x24], 0x5000701
xor eax, eax
jmp 0x554b5d
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x19]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x19]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xa
jge 0x554b9b
jae 0x554bef
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x554be3
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x554bd7
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 8
jb 0x554b45
jmp 0x554bcb
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00554b00

Function at 0x555950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x555a4a
sub esp, 0x28
mov dword [esp + 0x16], 0x9f70a067
mov dword [esp + 0x1a], 0x9741bb41
mov dword [esp + 0x1e], 0x5070103
mov dword [esp + 0x20], 0x3010507
mov dword [esp + 0x24], 0x5000701
xor eax, eax
jmp 0x5559ad
movzx edi, byte [esp + ebx + 0x16]
sub edi, edx
lea edx, [edi - 0x19]
mov byte [esp + ebp + 0x16], dl
lea edx, [esi - 0x19]
mov byte [esp + ebx + 0x16], dl
add eax, 2
cmp eax, 0xa
jge 0x5559eb
jae 0x555a3f
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xa
jae 0x555a33
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x555a27
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x16]
sub esi, edx
cmp ebx, 8
jb 0x555995
jmp 0x555a1b
mov dword [esp], 0
lea eax, [esp + 0x16]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov ecx, 0xa
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00555950
Function at 0x55d330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55d472
sub esp, 0x40
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
lea edi, [esp + 0x1a]
lea esi, [0x5cf502]
call fcn.00452718
mov dword [esp + 0x2a], 0xd07090b
lea edi, [esp + 0x2c]
lea esi, [0x5f9e64]
call fcn.0045270e
xor eax, eax
jmp 0x55d3ad
mov esi, ebx
movzx ebx, byte [esp + ebx + 0x1a]
sub ebx, edx
lea edx, [ebx - 0x19]
mov byte [esp + ecx + 0x1a], dl
lea edx, [ebp - 0x19]
mov byte [esp + esi + 0x1a], dl
add eax, 2
cmp eax, 0x16
jge 0x55d3f1
jae 0x55d467
movzx edx, byte [esp + eax + 0x2a]
lea ebx, [eax + 1]
cmp ebx, 0x16
jae 0x55d45b
movzx ebx, byte [esp + eax + 0x2b]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 0x10
jae 0x55d44f
movzx ebx, bl
mov ecx, ebp
movzx ebp, byte [esp + ebp + 0x1a]
sub ebp, edx
cmp ebx, 0x10
jb 0x55d393
jmp 0x55d443
mov dword [esp + 0xa], 0
mov dword [esp + 0xe], 0
mov dword [esp + 0x12], 0
mov dword [esp + 0x16], 0
xor eax, eax
jmp 0x55d41f
movzx edx, byte [esp + eax + 0x1a]
mov byte [esp + eax + 0xa], dl
inc eax
cmp eax, 0x10
jge 0x55d428
jb 0x55d415
jmp 0x55d439
lea edi, [esp + 0x44]
lea esi, [esp + 0xa]
call fcn.00452718
add esp, 0x40
ret
mov ecx, 0x10
call fcn.004520a0
mov eax, ebx
mov ecx, 0x10
call fcn.004520a0
mov eax, ebp
mov ecx, 0x10
call fcn.004520a0
mov eax, ebx
mov ecx, 0x16
call fcn.004520a0
mov ecx, 0x16
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0055d330
Function at 0x561410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x561510
sub esp, 0x48
mov dword [esp + 0x15], 0xeb20eee5
lea edi, [esp + 0x16]
lea esi, [0x5d171c]
call fcn.00452704
mov dword [esp + 0x2e], 0xe14100d
lea edi, [esp + 0x30]
lea esi, [0x5fa176]
call fcn.00452704
xor eax, eax
jmp 0x561471
movzx edi, byte [esp + ebx + 0x15]
lea edx, [edi + edx + 0x73]
mov byte [esp + ebp + 0x15], dl
xchg esi, eax
mov byte [esp + ebx + 0x15], al
xchg esi, eax
add eax, 2
cmp eax, 0x1a
jge 0x5614b1
jae 0x561505
movzx edx, byte [esp + eax + 0x2e]
lea ebx, [eax + 1]
cmp ebx, 0x1a
jae 0x5614f9
movzx ebx, byte [esp + eax + 0x2f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0x19
jae 0x5614ed
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
lea esi, [esi + edx + 0x73]
cmp ebx, 0x19
jb 0x56145b
jmp 0x5614e1
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x19
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x48
ret
mov eax, ebx
mov ecx, 0x19
call fcn.004520a0
mov eax, ebp
mov ecx, 0x19
call fcn.004520a0
mov eax, ebx
mov ecx, 0x1a
call fcn.004520a0
mov ecx, 0x1a
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00561410
Function at 0x567a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x567b09
sub esp, 0x30
mov dword [esp + 0x15], 0xad058e95
mov dword [esp + 0x18], 0x788f90ad
mov dword [esp + 0x1c], 0x970098a6
lea edi, [esp + 0x20]
lea esi, [0x5f9900]
call fcn.00452718
xor eax, eax
jmp 0x567a6c
movzx edi, byte [esp + ebx + 0x15]
sub edi, edx
lea edx, [edi - 0x53]
mov byte [esp + ebp + 0x15], dl
lea edx, [esi - 0x53]
mov byte [esp + ebx + 0x15], dl
add eax, 2
cmp eax, 0x10
jge 0x567aaa
jae 0x567afe
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0x10
jae 0x567af2
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xb
jae 0x567ae6
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x15]
sub esi, edx
cmp ebx, 0xb
jb 0x567a54
jmp 0x567ada
mov dword [esp], 0
lea eax, [esp + 0x15]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x30
ret
mov eax, ebx
mov ecx, 0xb
call fcn.004520a0
mov eax, ebp
mov ecx, 0xb
call fcn.004520a0
mov eax, ebx
mov ecx, 0x10
call fcn.004520a0
mov ecx, 0x10
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00567a10
Function at 0x569430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x569521
sub esp, 0x28
mov dword [esp + 0x14], 0x404a48d7
mov dword [esp + 0x18], 0xac535236
lea edi, [esp + 0x1c]
lea esi, [0x5f9720]
call fcn.00452722
xor eax, eax
jmp 0x569484
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi + 0x5d]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi + 0x5d]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xc
jge 0x5694c2
jae 0x569516
movzx edx, byte [esp + eax + 0x1c]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x56950a
movzx ebx, byte [esp + eax + 0x1d]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 8
jae 0x5694fe
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 8
jb 0x56946c
jmp 0x5694f2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.004520a0
mov eax, ebp
mov ecx, 8
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.00569430
Function at 0x57aae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57abe1
sub esp, 0x2c
mov dword [esp + 0x14], 0x74759386
mov dword [esp + 0x16], 0x97647475
mov dword [esp + 0x1a], 0xc3a28e7a
mov dword [esp + 0x1e], 0x1050508
lea edi, [esp + 0x20]
lea esi, [0x5f98aa]
call fcn.00452722
xor eax, eax
jmp 0x57ab44
movzx edi, byte [esp + ebx + 0x14]
sub edi, edx
lea edx, [edi - 0xc]
mov byte [esp + ebp + 0x14], dl
lea edx, [esi - 0xc]
mov byte [esp + ebx + 0x14], dl
add eax, 2
cmp eax, 0xe
jge 0x57ab82
jae 0x57abd6
movzx edx, byte [esp + eax + 0x1e]
lea ebx, [eax + 1]
cmp ebx, 0xe
jae 0x57abca
movzx ebx, byte [esp + eax + 0x1f]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 0xa
jae 0x57abbe
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
sub esi, edx
cmp ebx, 0xa
jb 0x57ab2c
jmp 0x57abb2
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 0xa
call fcn.004520a0
mov eax, ebp
mov ecx, 0xa
call fcn.004520a0
mov eax, ebx
mov ecx, 0xe
call fcn.004520a0
mov ecx, 0xe
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0057aae0
Function at 0x57be40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57bf39
sub esp, 0x2c
mov dword [esp + 0x17], 0xb9c4c610
mov dword [esp + 0x18], 0x15b9c4c6
mov dword [esp + 0x1c], 0x17d1d90c
lea edi, [esp + 0x20]
lea esi, [0x5f97a4]
call fcn.00452722
xor eax, eax
jmp 0x57be9c
movzx edi, byte [esp + ebx + 0x17]
sub edi, edx
lea edx, [edi - 0x22]
mov byte [esp + ebp + 0x17], dl
lea edx, [esi - 0x22]
mov byte [esp + ebx + 0x17], dl
add eax, 2
cmp eax, 0xc
jge 0x57beda
jae 0x57bf2e
movzx edx, byte [esp + eax + 0x20]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x57bf22
movzx ebx, byte [esp + eax + 0x21]
mov ebp, edx
xor edx, ebx
add edx, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
cmp ebp, 9
jae 0x57bf16
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x17]
sub esi, edx
cmp ebx, 9
jb 0x57be84
jmp 0x57bf0a
mov dword [esp], 0
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.00441fd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x2c
ret
mov eax, ebx
mov ecx, 9
call fcn.004520a0
mov eax, ebp
mov ecx, 9
call fcn.004520a0
mov eax, ebx
mov ecx, 0xc
call fcn.004520a0
mov ecx, 0xc
call fcn.004520a0
nop
call fcn.00450c10
jmp fcn.0057be40