joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c7d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x35
mov dword [ebp - 8], 0
jmp 0x5c7da2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x5c7de1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x27f58405]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5c7ddc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5c7d99
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5c7e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xab
mov dword [ebp - 8], 0
jmp 0x5c7e22
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x5c7e61
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4eaba576]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5c7e5c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5c7e19
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5c7e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x5d
mov dword [ebp - 8], 0
jmp 0x5c7ea2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x5c7ee1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x20c2b356]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5c7edc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5c7e99
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5c7f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x9c
mov dword [ebp - 8], 0
jmp 0x5c7f22
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x15
jge 0x5c7f61
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1acc85b1]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5c7f5c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5c7f19
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x15], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x5c8180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x5c8198
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jge 0x5c81fd
mov ecx, dword [ebp - 4]
shl ecx, 8
mov word [ebp - 8], cx
mov byte [ebp - 9], 8
jmp 0x5c81ba
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
movzx eax, byte [ebp - 9]
test eax, eax
jle 0x5c81ec
movzx ecx, word [ebp - 8]
and ecx, 0x8000
je 0x5c81e0
movzx edx, word [ebp - 8]
shl edx, 1
xor edx, 0x1021
mov word [ebp - 8], dx
jmp 0x5c81ea
movzx eax, word [ebp - 8]
shl eax, 1
mov word [ebp - 8], ax
jmp 0x5c81b1
mov ecx, dword [ebp - 4]
mov dx, word [ebp - 8]
mov word [ecx*2 + 0x7fe8e8], dx
jmp 0x5c818f
mov esp, ebp
pop ebp
ret
Function at 0x5cc8f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x615627
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x370
mov dword [ebp - 0x35c], ecx
mov dword [ebp - 0x358], 0
lea ecx, [ebp - 0x2c]
call fcn.0041ce70
mov dword [ebp - 4], 1
mov byte [ebp - 0x244], 0
cmp dword [ebp + 0xc], 0
je 0x5cc9a1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x360]
add ecx, 1
mov dword [ebp - 0x364], ecx
mov edx, dword [ebp - 0x360]
mov al, byte [edx]
mov byte [ebp - 0x365], al
add dword [ebp - 0x360], 1
cmp byte [ebp - 0x365], 0
jne 0x5cc952
mov ecx, dword [ebp - 0x360]
sub ecx, dword [ebp - 0x364]
mov dword [ebp - 0x36c], ecx
je 0x5cc9a1
lea edx, [ebp - 0x244]
push edx
push 0x103
mov eax, dword [0x7fe890]
mov ecx, dword [eax + 0x170]
call ecx
test eax, eax
jne 0x5cc9d0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041cd10
mov eax, dword [ebp - 0x358]
or eax, 1
mov dword [ebp - 0x358], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00416470
mov eax, dword [ebp + 8]
jmp 0x5ccb30
mov cx, word [0x6b4850]
mov word [ebp - 0x30], cx
mov dl, byte [0x6b4852]
mov byte [ebp - 0x2e], dl
mov dword [ebp - 0x248], 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx]
mov byte [ebp - 0x30], dl
push 0x104
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x5ccada
lea edx, [ebp - 0x13c]
mov dword [ebp - 0x370], edx
mov eax, dword [ebp - 0x370]
add eax, 1
mov dword [ebp - 0x374], eax
mov ecx, dword [ebp - 0x370]
mov dl, byte [ecx]
mov byte [ebp - 0x375], dl
add dword [ebp - 0x370], 1
cmp byte [ebp - 0x375], 0
jne 0x5cca38
mov eax, dword [ebp - 0x370]
sub eax, dword [ebp - 0x374]
mov dword [ebp - 0x37c], eax
mov ecx, dword [ebp - 0x37c]
mov dword [ebp - 0x24c], ecx
cmp dword [ebp - 0x24c], 0x104
jae 0x5ccada
mov edx, dword [ebp - 0x24c]
push edx
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR90.dll_strncmp
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x248], eax
je 0x5ccada
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x24c]
push edx
lea eax, [ebp - 0x30]
push eax
push 0x6b4854
lea ecx, [ebp - 0x354]
push ecx
call fcn.005cd230
add esp, 0x10
lea edx, [ebp - 0x354]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0041ce40
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
test ecx, ecx
je 0x5ccaef
jmp 0x5ccada
cmp dword [ebp - 0x248], 0
jne 0x5ccb06
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x5cc9f7
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041cd10
mov eax, dword [ebp - 0x358]
or eax, 1
mov dword [ebp - 0x358], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00416470
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x5cd593
Capabilities:
Acquire debug privileges

Disassembly:
jae 0x5cd4f0
jmp 0x5cd4eb
call fcn.005cd4f2
jae 0x5cd4eb
add esp, 4
jmp 0x5cd4f7
dec dword [esp]
jno 0x5cd4fc
jns 0x5cd4e7
jp 0x5cd500
add esp, 4
popf
jmp 0x5cd507
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5cd520
jne 0x5cd520
call 0x101d0874
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
lea eax, [ebp - 4]
push eax
push 0x28
push 0xffffffffffffffff
mov ecx, dword [0x7fe890]
mov edx, dword [ecx + 0x1e4]
call edx
test eax, eax
jne 0x5cd552
xor al, al
jmp 0x5cd5f7
push 2
push 0x6b4ad0
mov eax, dword [ebp - 4]
push eax
call fcn.005cd600
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x5cd573
xor al, al
jmp 0x5cd5f7
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x7fe890]
mov ecx, dword [eax + 0xbc]
call ecx
pushf
push 0xa
jae 0x5cd591
jmp 0x5cd58c
call 0x5cd593
jae 0x5cd58c
add esp, 4
jmp 0x5cd598
dec dword [esp]
jno 0x5cd59d
jns 0x5cd588
jp 0x5cd5a1
add esp, 4
popf
jmp 0x5cd5a8
clc
jae 0x5cd5ad
jo 0x5cd547
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5cd5c6
jne 0x5cd5c6
lcall 0x749a, 0x3eb037c
sti
jl 0x5cd5cb
jmp 0x5cd5cd
je 0x5cd5c8
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5cd5e7
jne 0x5cd5e6
call 0x8360c66e
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5cd5f5
jne 0x5cd5f5
call 0xe5e7d7a9
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x5ce2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf8
mov dword [ebp - 8], 0
jmp 0x5ce2f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x5ce331
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x487eadea]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5ce32c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5ce2e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x5ce350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x62
mov dword [ebp - 8], 0
jmp 0x5ce372
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x5ce3b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x49b02f95]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5ce3ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5ce369
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5cf780
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x5cf803
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 8]
jne 0x5cf7ef
mov eax, dword [ebp - 0x118]
jmp 0x5cf803
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x5cf7dc
mov esp, ebp
pop ebp
ret
Function at 0x5d39f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xe6
mov dword [ebp - 8], 0
jmp 0x5d3a12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3c
jge 0x5d3a51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x38cc45f9]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3a4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3a09
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3c], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x44
mov dword [ebp - 8], 0
jmp 0x5d3a92
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x50
jge 0x5d3ad1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x22f86758]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3acc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3a89
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x50], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf
mov dword [ebp - 8], 0
jmp 0x5d3b72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x29
jge 0x5d3bb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0xd294c1d]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3bac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3b69
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x29], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3bd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc6
mov dword [ebp - 8], 0
jmp 0x5d3bf2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x22
jge 0x5d3c31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x7f57e86b]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3c2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3be9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x22], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x5d3c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x7b
mov dword [ebp - 8], 0
jmp 0x5d3c72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x22
jge 0x5d3cb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x69f09ee9]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3cac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3c69
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x22], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf1
mov dword [ebp - 8], 0
jmp 0x5d3cf2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x19
jge 0x5d3d31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x29f50fc2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3d2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3ce9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x19], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x22
mov dword [ebp - 8], 0
jmp 0x5d3d72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x24
jge 0x5d3db1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x64c2aed8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3dac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3d69
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x24], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x32
mov dword [ebp - 8], 0
jmp 0x5d3df2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x21
jge 0x5d3e31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x39592f06]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3e2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3de9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x21], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x5d3e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x86
mov dword [ebp - 8], 0
jmp 0x5d3e72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1b
jge 0x5d3eb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2a03e7c5]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3eac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3e69
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x18
mov dword [ebp - 8], 0
jmp 0x5d3ef2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x39
jge 0x5d3f31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x7b0f61f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3f2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3ee9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x39], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc0
mov dword [ebp - 8], 0
jmp 0x5d3f72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x18
jge 0x5d3fb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6bf5aa32]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d3fac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3f69
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x30
mov dword [ebp - 8], 0
jmp 0x5d3ff2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1d
jge 0x5d4031
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2727781]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d402c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d3fe9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x5d4050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa8
mov dword [ebp - 8], 0
jmp 0x5d4072
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x5d40b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x21d192f7]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d40ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d4069
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d40d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc3
mov dword [ebp - 8], 0
jmp 0x5d40f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xc
jge 0x5d4131
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x127c2d3b]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d412c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d40e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d4150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x5e
mov dword [ebp - 8], 0
jmp 0x5d4172
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x5d41b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x5bd0fc63]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d41ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d4169
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d41d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa7
mov dword [ebp - 8], 0
jmp 0x5d41f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x5d4231
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x24582726]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5d422c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5d41e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4