joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d80b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x5c1138]
test eax, eax
je 0x4d8173
mov eax, dword [0x5c2294]
test eax, eax
je 0x4d8173
push esi
xor esi, esi
mov ecx, dword [0x5c741c]
push 0x28
call fcn.00512c10
test eax, eax
je 0x4d80e8
push esi
mov ecx, eax
call fcn.004d8330
jmp 0x4d80ea
xor eax, eax
mov dword [esi*4 + 0x5c2280], eax
inc esi
cmp esi, 2
jl 0x4d80cd
push 0x100000
call fcn.0053434b
mov ecx, eax
add esp, 4
neg ecx
and ecx, 0xf
mov edx, 0x100000
push 0
sub edx, ecx
push 0
add ecx, eax
push edx
push ecx
mov ecx, dword [0x5c22c4]
call fcn.00513100
mov eax, dword [0x5c22c4]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
mov dword [eax + 8], 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x5c22d4], eax
call esi
push 0
push 0x10000
push 0x4d7df0
mov dword [0x5c22d0], eax
call fcn.00533d3c
add esp, 0xc
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop esi
ret

Function at 0x4efe80
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [0x5c463c]
push ebp
push esi
push edi
mov eax, dword [ecx]
push 0
lea ebp, [ebx + 0x7fc]
call dword [eax + 0x38]
mov edi, eax
or ecx, 0xffffffff
add edi, 0x10
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebx + 0x7fd], 1
add cl, 4
push eax
mov byte [ebp], cl
mov ecx, dword [0x5c463c]
mov edx, dword [ecx]
call dword [edx + 0x38]
mov al, byte [eax + 4]
mov byte [ebx + 0x7fe], al
mov ecx, dword [0x5c463c]
mov edx, dword [ecx]
call dword [edx + 0x20]
test al, al
je 0x4efedf
mov eax, dword [ebx + 4]
jmp 0x4efee4
mov eax, 0xff
mov byte [ebx + 0x7ff], al
mov ecx, dword [0x5c463c]
push 0
mov eax, dword [ecx]
call dword [eax + 0x38]
mov edi, eax
or ecx, 0xffffffff
add edi, 0x10
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
mov eax, ecx
mov ecx, dword [0x5c463c]
mov dword [esp + 0x14], eax
mov edx, dword [ecx]
call dword [edx + 0x38]
mov esi, eax
mov eax, dword [esp + 0x10]
mov ecx, eax
add esi, 0x10
lea edi, [ebx + 0x800]
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x6f8]
xor ecx, ecx
mov cl, byte [ebp]
push ecx
push ebp
push edx
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4f0014
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x5c463c]
push edi
mov ebx, 3
mov eax, dword [ecx]
xor edi, edi
call dword [eax + 0x3c]
test eax, eax
jle 0x4f009e
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_getpeername]
mov ecx, dword [0x5c463c]
push edi
mov edx, dword [ecx]
call dword [edx + 0x38]
mov cl, byte [eax + 0xc]
test cl, cl
je 0x4f008d
mov ecx, dword [0x5c463c]
push edi
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp eax, esi
je 0x4f008d
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [0x5c463c]
mov dword [esp + 0x14], 0x10
push edx
mov eax, dword [ecx]
push edi
call dword [eax + 0x38]
mov ecx, dword [eax + 0x6f8]
push ecx
call ebp
mov edx, dword [esp + 0x18]
mov dword [ebx + esi + 0x7fc], edx
add ebx, 4
mov ecx, dword [0x5c463c]
inc edi
mov eax, dword [ecx]
call dword [eax + 0x3c]
cmp edi, eax
jl 0x4f0035
pop ebp
lea edi, [esi + 0x7fc]
mov byte [esi + 0x7fd], 3
mov byte [edi], bl
mov ecx, dword [0x5c463c]
mov edx, dword [ecx]
call dword [edx + 0x4c]
mov ecx, dword [esi + 0x6f8]
mov byte [esi + 0x7fe], al
xor eax, eax
push 0
mov al, byte [edi]
push eax
push edi
push ecx
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4f0170
Capabilities:
Get local ipv4 addresses
Get socket information
Send data
Send data on socket

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
lea eax, [esp + 4]
push edi
mov edx, dword [esi + 0x900]
lea ecx, [esp + 0xc]
push eax
push ecx
push edx
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ax, word [esp + 0xe]
lea edi, [esi + 0x7fc]
mov byte [esi + 0x7fd], 4
mov word [esi + 0x7fe], ax
mov byte [edi], 9
mov ecx, dword [0x5c463c]
push 0
mov edx, dword [ecx]
call dword [edx + 0x38]
mov al, byte [eax + 0x90]
push 0
mov byte [esi + 0x800], al
mov ecx, dword [0x5c4630]
mov dword [esi + 0x801], ecx
mov ecx, dword [0x5c463c]
mov edx, dword [ecx]
call dword [edx + 0x38]
cmp dword [eax + 0x90], 0xffffffff
jne 0x4f02ae
mov byte [edi], 0xd
mov al, byte [0x5a3d34]
mov byte [esi + 0x801], al
mov cl, byte [0x5a3d38]
mov byte [esi + 0x802], cl
mov dl, byte [0x5a3d3c]
mov byte [esi + 0x803], dl
mov al, byte [0x5a3d40]
mov byte [esi + 0x804], al
mov cl, byte [0x5a3d44]
mov byte [esi + 0x805], cl
mov dl, byte [0x5a3d4c]
mov byte [esi + 0x806], dl
mov al, byte [0x5a3d54]
mov byte [esi + 0x807], al
mov cl, byte [0x5a3d5c]
push 0x78
lea edx, [esi + 0x809]
push 0x5a3d64
push edx
mov byte [esi + 0x808], cl
call fcn.00513420
mov al, byte [edi]
push 0x20
add al, 0x78
push 0x5a3ddc
mov byte [edi], al
and eax, 0xff
lea eax, [eax + esi + 0x7fc]
push eax
call fcn.00513420
mov dl, byte [edi]
push 0x20
add dl, 0x20
push 0x5a3dfc
mov al, dl
mov byte [edi], dl
and eax, 0xff
lea ecx, [eax + esi + 0x7fc]
push ecx
call fcn.00513420
mov al, byte [edi]
add esp, 0x24
add al, 0x20
mov byte [edi], al
mov eax, dword [esi + 0x6f8]
xor edx, edx
mov dl, byte [edi]
push 0
push edx
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4f09a0
Capabilities:
Send data
Send data on socket

Disassembly:
lea eax, [ecx + 0x7fc]
push 0
push 2
push eax
mov byte [eax], 2
mov eax, dword [ecx + 0x6f8]
push eax
mov byte [ecx + 0x7fd], 0xc
call dword [sym.imp.WS2_32.dll_send]
ret
Function at 0x5064c0
Capabilities:
Get session user name
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x400
test eax, eax
je 0x5064f1
push eax
call fcn.0052e72c
push eax
mov eax, dword [esp + 0x408]
push eax
lea ecx, [esp + 8]
push str._s_n_n_s
push ecx
call fcn.005134a0
add esp, 0x10
jmp 0x506506
mov edx, dword [esp + 0x404]
lea eax, [esp]
push edx
push eax
call fcn.005134f0
add esp, 8
lea ecx, [esp]
push ecx
push str.Fatal_error:_n_s_n
call fcn.00506360
push 0
call fcn.00506470
lea edx, [esp + 0xc]
push 0x5695b8
push edx
call fcn.005134c0
mov ecx, dword [0x5c6074]
add esp, 0x14
lea eax, [esp]
push 0
push str.MotoGP___fatal_error
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0045e7d0
push 1
call fcn.00533b04
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x506560
Capabilities:
Get session user name

Disassembly:
sub esp, 0xa8
push 1
mov byte [0x578448], 1
mov byte [0x5c6008], 0
mov dword [0x5c600c], 0
call fcn.00506470
push str.MotoGP__build_11__cover_disk_release___built_May_31_2002_n
call fcn.00506360
add esp, 8
lea eax, [esp + 4]
lea ecx, [esp + 0x58]
mov dword [esp + 4], 0x50
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp]
push edx
call fcn.00534f74
lea eax, [esp + 4]
push eax
call fcn.00534e14
push eax
call fcn.00534d22
add esp, 0xc
lea edx, [esp + 8]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x5065cb
mov al, byte [esp + 8]
test al, al
je 0x5065f8
lea eax, [esp + 8]
mov cl, byte [eax]
cmp cl, 0xd
je 0x5065ed
cmp cl, 0xa
jne 0x5065f0
mov byte [eax], 0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x5065e1
lea ecx, [esp + 8]
lea edx, [esp + 0x58]
push ecx
push edx
push str.Run_by__s_on__s_n_n
call fcn.00506360
push 0x580500
push str.Base_path:___s_n
call fcn.00506360
push 0x580850
push str.Data_path:___s_n
call fcn.00506360
push 0x5802b0
push str.Music_path:__s_n
call fcn.00506360
push 0x580628
push str.Video_path:__s_n
call fcn.00506360
push 0x580728
push str.Save_path:___s_n
call fcn.00506360
push 0x5684a8
call fcn.00506360
call fcn.00506690
push 0x5684a8
call fcn.00506360
call fcn.005067a0
push 0x5684a8
call fcn.00506360
add esp, 0x40
push 0
call fcn.00506470
add esp, 0xac
ret
Function at 0x506690
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
dec eax
je 0x506703
dec eax
je 0x5066cc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ecx
push edx
push str.Unknown_Windows
call fcn.00506360
add esp, 0xc
jmp 0x506737
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x5066f0
mov eax, dword [esp + 8]
test eax, eax
jne 0x5066e4
push str.Windows_2000
jmp 0x50672f
cmp eax, 1
jne 0x5066fc
push str.Windows_XP
jmp 0x50672f
cmp eax, 4
ja 0x5066fc
push str.Windows_NT
jmp 0x50672f
push str.Unknown_Windows_NT
jmp 0x50672f
mov eax, dword [esp + 8]
test eax, eax
jne 0x506712
push str.Windows_95
jmp 0x50672f
cmp eax, 0xa
jne 0x50671e
push str.Windows_98
jmp 0x50672f
cmp eax, 0x5a
jne 0x50672a
push str.Windows_ME
jmp 0x50672f
push str.Unknown_Windows_9x
call fcn.00506360
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push str.__version__d._d__build__d
call fcn.00506360
mov dl, byte [esp + 0x24]
mov cl, 0x20
add esp, 0x10
xor eax, eax
cmp dl, cl
jne 0x506768
mov dl, byte [esp + eax + 0x15]
inc eax
cmp dl, cl
je 0x50675f
mov cl, byte [esp + eax + 0x14]
lea eax, [esp + eax + 0x14]
test cl, cl
je 0x506789
push eax
push str.___s_n
call fcn.00506360
add esp, 8
add esp, 0x94
ret
push 0x5684a8
call fcn.00506360
add esp, 4
add esp, 0x94
ret

Function at 0x506f10
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [0x5c6024]
test eax, eax
jne case.0x506f35.8
mov eax, dword [0x5c6068]
test eax, eax
jne 0x506f2d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
add eax, 0xfffffff9
cmp eax, 0xa
ja case.0x506f35.8
jmp dword [eax*4 + 0x506f5c]
mov eax, str.French
ret
mov eax, str.German
ret
mov eax, str.Italian
ret
mov eax, str.Spanish
ret
mov eax, str.English
ret
Function at 0x5076e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1d8
push esi
push edi
call fcn.005078c0
mov esi, dword [esp + 0x1e4]
xor edi, edi
push str.motogp_icon
push esi
mov dword [esp + 0x30], 3
mov dword [esp + 0x34], 0x507100
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], str.MotoGP
call dword [sym.imp.USER32.dll_RegisterClassA]
push edi
push esi
push edi
push edi
push bind
push bind
push edi
push edi
push 0xca0000
push str.MotoGP
push str.MotoGP
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push edi
mov dword [0x5c6074], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x50]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, dword [0x5c6074]
mov dword [0x5c608c], esi
mov dword [0x5c6090], edx
call fcn.0040de70
mov eax, dword [0x5c6074]
push edi
push 0x3e8
push edi
push eax
mov dword [0x5c89fc], 0x5079b0
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push edi
push edi
push edi
lea ecx, [esp + 0x18]
push edi
push ecx
call esi
cmp dword [esp + 0x10], 0x12
je 0x50783a
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [0x57844c], edi
je 0x5077f3
push 1
push edi
push edi
lea edx, [esp + 0x20]
push edi
push edx
call esi
jmp 0x5077fd
push edi
push edi
lea eax, [esp + 0x1c]
push edi
push eax
call ebx
cmp eax, edi
je 0x507815
lea ecx, [esp + 0x14]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x507831
cmp dword [0x57844c], edi
je 0x507831
call fcn.0040e040
mov eax, dword [0x5c6078]
cmp eax, edi
je 0x507831
dec eax
mov dword [0x5c6078], eax
cmp dword [esp + 0x18], 0x12
jne 0x5077dd
pop ebp
pop ebx
push str.Shutting_down_n
call fcn.00506360
push 7
call fcn.004d1510
add esp, 8
mov ecx, 0x5c2288
push edi
call fcn.004150c0
cmp eax, edi
mov dword [0x5c2294], eax
setne al
mov byte [esp + 8], al
mov ecx, dword [esp + 8]
and ecx, 0xff
push ecx
mov ecx, 0x5c112c
call fcn.004150c0
mov dword [0x5c1138], eax
call fcn.0045e7d0
mov ecx, 0x5c73f8
call fcn.00512e70
call dword [sym.imp.ole32.dll_CoUninitialize]
push str.Quitting_WinMain___n
call fcn.00506360
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
add esp, 0x1d8
ret 0x10
Function at 0x5078c0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1000
call fcn.00534250
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x5078d4
mov al, byte [esp]
push ebx
push ebp
push esi
xor ebp, ebp
xor esi, esi
test al, al
push edi
je 0x50799d
mov al, byte [esp + esi + 0x10]
test al, al
je 0x507913
movsx eax, al
push eax
call fcn.00514420
add esp, 4
test eax, eax
je 0x507913
mov al, byte [esp + esi + 0x11]
inc esi
test al, al
jne 0x5078fa
mov cl, byte [esp + esi + 0x10]
lea eax, [esp + esi + 0x10]
test cl, cl
je 0x507991
xor edi, edi
cmp cl, 0x27
je 0x50792b
cmp cl, 0x22
jne 0x50793b
inc esi
movsx edi, cl
mov cl, byte [esp + esi + 0x10]
lea eax, [esp + esi + 0x10]
test cl, cl
je 0x50799d
mov ebx, eax
mov al, byte [eax]
test al, al
je 0x507971
test edi, edi
je 0x507953
movsx ecx, al
xor eax, eax
cmp ecx, edi
setne al
jmp 0x507964
movsx edx, al
push edx
call fcn.00533aaf
add esp, 4
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x507971
mov al, byte [esp + esi + 0x11]
inc esi
test al, al
jne 0x507943
mov al, byte [esp + esi + 0x10]
test al, al
je 0x50797f
mov byte [esp + esi + 0x10], 0
inc esi
test ebp, ebp
je 0x507990
push 1
push 0
push ebx
call fcn.00415650
add esp, 0xc
inc ebp
mov al, byte [esp + esi + 0x10]
test al, al
jne 0x5078f2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1000
ret

Function at 0x507ad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x507af3
xor al, al
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x507b23
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
ret

Function at 0x507b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x507b65
xor al, al
pop ecx
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
lea edx, [esp]
mov dword [esp], 4
push edx
mov edx, dword [esp + 0xc]
push eax
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x507b9e
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop ecx
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ecx
ret
Function at 0x511290
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x5c73dc]
mov ecx, dword [0x5c741c]
shl eax, 3
push eax
call fcn.00512c10
mov ecx, dword [0x5c73dc]
mov dword [0x5c7350], eax
xor eax, eax
lea edx, [ecx + ecx]
test edx, edx
jle 0x5112d4
mov ecx, dword [0x5c7350]
inc eax
mov dword [ecx + eax*4 - 4], 0
mov edx, dword [0x5c73dc]
lea ecx, [edx + edx]
cmp eax, ecx
jl 0x5112b8
mov eax, dword [0x5c7314]
push esi
xor esi, esi
test eax, eax
jle 0x5112f7
push esi
call fcn.00511360
add esp, 4
test al, al
je 0x511341
mov eax, dword [0x5c7314]
inc esi
cmp esi, eax
jl 0x5112e0
xor esi, esi
test eax, eax
jle 0x511320
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call edi
mov dword [esi*4 + 0x5c72c8], eax
mov eax, dword [0x5c7314]
inc esi
cmp esi, eax
jl 0x511304
pop edi
push 0
push 0x8000
push 0x511540
call fcn.00533d3c
add esp, 0xc
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, 1
pop esi
ret
push str.refill_buffer___failed_n
call fcn.00506360
add esp, 4
xor al, al
pop esi
ret
Function at 0x52d7b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
fld dword [ecx + 4]
fadd qword [0x552540]
sub esp, 0x30
push ebx
call fcn.00533a88
mov ebx, eax
mov eax, dword [esp + 0x48]
test eax, eax
jle 0x52d989
mov ecx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x58]
push esi
mov esi, dword [esp + 0x54]
sub ecx, ebp
push edi
mov dword [esp + 0x60], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov edi, dword [esi]
dec eax
push ebp
push eax
mov ecx, esi
call dword [edi + 0x50]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call dword [edi + 0x4c]
mov edx, dword [eax]
mov eax, dword [esp + 0x50]
test eax, eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x4c], 0
jle 0x52d972
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x5c]
add eax, ebp
lea edi, [ebx + 2]
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], ecx
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x60]
mov ebp, dword [esi]
inc eax
push edx
push eax
mov ecx, esi
call dword [ebp + 0x50]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
call dword [ebp + 0x4c]
mov edx, dword [eax]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x54]
mov ebp, dword [esi]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x30], edx
call dword [ebp + 0x50]
lea edx, [esp + 0x24]
push eax
push edx
mov ecx, esi
call dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [esp + 0x2b]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
and edx, 0xff
mov ecx, dword [eax]
mov eax, dword [esp + 0x3b]
and eax, 0xff
mov ebp, ecx
imul eax, ebx
add eax, edx
mov edx, dword [esp + 0x33]
and edx, 0xff
mov dword [esp + 0x18], ecx
add eax, edx
cdq
idiv edi
mov edx, dword [esp + 0x2a]
and edx, 0xff
push eax
mov eax, dword [esp + 0x3e]
and eax, 0xff
imul eax, ebx
add eax, edx
mov edx, dword [esp + 0x36]
and edx, 0xff
add eax, edx
cdq
idiv edi
mov edx, dword [esp + 0x2d]
and edx, 0xff
push eax
mov eax, dword [esp + 0x41]
and eax, 0xff
imul eax, ebx
add eax, edx
mov edx, dword [esp + 0x39]
and edx, 0xff
add eax, edx
cdq
idiv edi
mov edx, dword [esp + 0x30]
and edx, 0xff
push eax
mov eax, dword [esp + 0x44]
and eax, 0xff
imul eax, ebx
add eax, edx
mov edx, dword [esp + 0x3c]
and edx, 0xff
add eax, edx
cdq
idiv edi
push eax
mov ecx, dword [esp + 0x54]
call dword [ebp + 0x38]
mov ebp, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x20]
lea edx, [ecx + ebp]
mov ecx, dword [esp + 0x4c]
push edx
call dword [eax + 0x58]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x50]
inc ebp
add ecx, 2
cmp ebp, eax
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x54], ecx
jl 0x52d835
mov ebp, dword [esp + 0x60]
mov eax, dword [esp + 0x10]
inc ebp
dec eax
mov dword [esp + 0x60], ebp
mov dword [esp + 0x10], eax
jne 0x52d7ed
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x28
Function at 0x52d990
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
fld dword [ecx + 4]
fadd qword [0x552540]
sub esp, 0x30
push ebx
call fcn.00533a88
mov ebx, eax
mov eax, dword [esp + 0x44]
test eax, eax
jle 0x52db69
mov ecx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x54]
push esi
mov esi, dword [esp + 0x54]
sub ecx, ebp
push edi
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov edi, dword [esi]
dec eax
mov ecx, esi
push eax
push ebp
call dword [edi + 0x50]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call dword [edi + 0x4c]
mov edx, dword [eax]
mov eax, dword [esp + 0x54]
test eax, eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x48], 0
jle 0x52db52
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x60]
add eax, ebp
lea edi, [ebx + 2]
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x5c]
mov ebp, dword [esi]
inc edx
push edx
push eax
mov ecx, esi
call dword [ebp + 0x50]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
call dword [ebp + 0x4c]
mov edx, dword [eax]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x5c]
mov ebp, dword [esi]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x30], edx
call dword [ebp + 0x50]
lea edx, [esp + 0x24]
push eax
push edx
mov ecx, esi
call dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [esp + 0x2b]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
and edx, 0xff
mov ecx, dword [eax]
mov eax, dword [esp + 0x3b]
and eax, 0xff
mov ebp, ecx
imul eax, ebx
add eax, edx
mov edx, dword [esp + 0x33]
and edx, 0xff
mov dword [esp + 0x18], ecx
add eax, edx
cdq
idiv edi
mov edx, dword [esp + 0x2a]
and edx, 0xff
push eax
mov eax, dword [esp + 0x3e]
and eax, 0xff
imul eax, ebx
add eax, edx
mov edx, dword [esp + 0x36]
and edx, 0xff
add eax, edx
cdq
idiv edi
mov edx, dword [esp + 0x2d]
and edx, 0xff
push eax
mov eax, dword [esp + 0x41]
and eax, 0xff
imul eax, ebx
add eax, edx
mov edx, dword [esp + 0x39]
and edx, 0xff
add eax, edx
cdq
idiv edi
mov edx, dword [esp + 0x30]
and edx, 0xff
push eax
mov eax, dword [esp + 0x44]
and eax, 0xff
imul eax, ebx
add eax, edx
mov edx, dword [esp + 0x3c]
and edx, 0xff
add eax, edx
cdq
idiv edi
push eax
mov ecx, dword [esp + 0x54]
call dword [ebp + 0x38]
mov ebp, dword [esp + 0x48]
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x50]
lea ecx, [eax + ebp]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
call dword [eax + 0x58]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x54]
inc ebp
add ecx, 2
cmp ebp, eax
mov dword [esp + 0x48], ebp
mov dword [esp + 0x50], ecx
jl 0x52da15
mov ebp, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
inc ebp
dec eax
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x10], eax
jne 0x52d9cd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x28