joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x10028164]
xor eax, ebp
mov dword [ebp + 0x398], eax
mov edx, dword [ebp + 0x3a8]
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x70], edx
mov edx, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x6c], esi
push edi
test eax, eax
je 0x10008a43
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100088d1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov ecx, 2
imul ecx
mov edi, eax
test edx, edx
jg 0x10008977
jl 0x100088fe
cmp edi, 0x7fffffff
ja 0x10008977
cmp edx, 0xffffffff
jl 0x10008977
jg 0x1000890d
cmp edi, 0x80000000
jb 0x10008977
cmp edi, 0x400
jg 0x1000892d
push edi
call fcn.10016698
add esp, 4
test al, al
je 0x1000892d
mov eax, edi
call fcn.1000bf00
mov ebx, esp
jmp 0x10008951
mov eax, edi
not eax
cmp eax, 8
jb 0x10008a91
lea eax, [edi + 8]
push eax
call fcn.10016698
add esp, 4
test eax, eax
je 0x10008977
mov dword [eax], esi
lea ebx, [eax + 8]
mov esi, eax
test ebx, ebx
je 0x10008977
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x74]
mov byte [ebx], 0
push 0
push 3
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
jmp 0x10008979
xor edi, edi
test edi, edi
je 0x10008a43
push 0x60
push 0
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x100089ae
push 2
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x100089ae
call fcn.10003920
mov edi, eax
jmp 0x10008a48
push dword [ebp - 0x78]
push dword [ebp - 0x70]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100089c8
call fcn.10003920
jmp 0x10008a34
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x70], eax
test eax, eax
jne 0x100089de
call fcn.10003920
jmp 0x10008a34
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x100089f6
mov edi, 0x8007000e
jmp 0x10008a36
push eax
lea ecx, [ebp - 0x6c]
call fcn.100033c0
cmp dword [ebp - 0x6c], 0
jne 0x10008a0c
mov edi, 0x8007000e
jmp 0x10008a36
push edi
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call fcn.1000aa30
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x80]
add esp, 0x10
mov byte [eax + edi], 0
push dword [ebp + 0x3b0]
push dword [ebp - 0x6c]
call fcn.100086f0
mov edi, eax
test ebx, ebx
je 0x10008a48
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
jmp 0x10008a48
mov edi, 0x8007000e
lea eax, [ebp - 0x68]
cmp dword [ebp - 0x6c], eax
je 0x10008a58
lea ecx, [ebp - 0x6c]
call fcn.10005750
test esi, esi
je 0x10008a6f
nop dword [eax]
push esi
mov esi, dword [esi]
call fcn.10016698
add esp, 4
test esi, esi
jne 0x10008a60
mov eax, edi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
call fcn.1000bc54
lea esp, [ebp + 0x39c]
pop ebp
ret 0x10
push 0x80070216
call fcn.100013a0
int3
Function at 0x42b590
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x42b5a4
call fcn.0042b510
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x42b597
pop esi
cmp ebx, 0x2d
jne 0x42b5be
mov dword [0x2bdf700], 0xa62e7790
mov dword [0x2bdf704], 0xffffffff
ret

Function at 0x42b5c0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x437004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x437de0]
push ebx
mov ebx, dword [0x2bdf6f4]
push edi
mov edi, dword [0x2bdd274]
call fcn.0042b560
cmp dword [0x2bdf6f4], 0x2f
jne 0x42b62d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0042b590
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e2
add esp, 0x24
ret
Function at 0x40eb68
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ec3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40ec58
push ebx
push 0x40ec68
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40ebe8
mov al, 0x6a
call fcn.0040e788
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040eb3c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40ebf1
call fcn.0040eb3c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ec44
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ed58
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ee23
jmp 0x40ee17
cmp dword [esi + 0x10], 0x1000
jne 0x40ee03
test byte [esi + 0x15], 1
jne 0x40ee03
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40edb4
cmp ebp, 2
je 0x40edb4
cmp ebp, 0x10
je 0x40edb4
cmp ebp, 0x20
jne 0x40edd0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40edd0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ede1
mov eax, dword [esi]
add eax, ebx
call fcn.0040ed50
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40edd4
cmp byte [esp + 4], 0
je 0x40ee03
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ee23
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ed89
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xf09d84
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf09d8e
pushal
call 0xf09d94
pop ebp
sub ebp, 0x10
sub ebp, 0xb09d84
jmp 0xf09daa
mov eax, 0xb09d84
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b5
mov edx, 0x43589f4f
xor byte [eax], dl
inc eax
dec ecx
jne 0xf09dc1
jmp 0xf09dd4
les eax, [edx + 0x4f73c6c4]
dec edi
dec edi
into
invalid
Function at 0x9001690
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x90de124]
jne 0x900169a
repz ret
jmp fcn.0909ebfc

Function at 0x9013f61
Capabilities:
Check os version

Disassembly:
push 0x118
mov eax, 0x90a2736
call fcn.09004c60
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x124], edi
call fcn.0900373e
lea eax, [ebp - 0x4c]
xor ebx, ebx
push eax
mov edx, esi
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.09015738
pop ecx
test al, al
jne 0x9013fbf
lea eax, [ebp - 0x4c]
push eax
call fcn.0906031b
pop ecx
test al, al
jne 0x9013fbf
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.090167a9
mov eax, esi
call fcn.09005591
ret
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
je 0x9014150
cmp dword [ebp - 0x110], 6
sbb al, al
inc al
je 0x9014150
push str.CDMP
lea ecx, [ebp - 0x4c]
call fcn.090168fc
test al, al
je 0x9014150
lea ecx, [ebp - 0x68]
call fcn.0900373e
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 1
call fcn.09099989
pop ecx
test al, al
je 0x901411d
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.09056076
mov esi, str..icc
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.09099989
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x9014065
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x68]
call fcn.09099989
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.090183d0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 4
call fcn.09099989
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x68]
call fcn.09099989
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.09099989
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x90140e1
lea eax, [ebp - 0x68]
push eax
push edi
call fcn.090178a6
pop ecx
pop ecx
lea ecx, [ebp - 0x11c]
mov esi, eax
mov byte [ebp - 4], 3
call fcn.0901978b
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.09099989
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68]
jmp 0x9014141
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.0901978b
mov dword [ebp - 4], 2
jmp 0x901410e
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.09099989
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.0905855e
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68]
test al, al
je 0x901414b
mov esi, dword [ebp - 0x120]
call fcn.090167a9
jmp 0x9013fab
call fcn.090167a9
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.090178a6
pop ecx
pop ecx
mov esi, eax
jmp 0x9013fab
Function at 0x90422dc
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90a0c3e
call fcn.09004c60
lea eax, [ebp - 0x34]
push eax
mov esi, ecx
mov dword [ebp - 0x34], 0x20
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
xor edi, edi
sub eax, dword [esi + 8]
sbb edi, dword [esi + 0xc]
js 0x904234b
jg 0x9042311
test eax, eax
jb 0x904234b
mov ecx, dword [esi + 4]
mov edx, ecx
xor ebx, ebx
imul edx, edx, 3
cmp edi, ebx
jg 0x904234b
jl 0x9042325
cmp eax, edx
ja 0x904234b
cmp ecx, eax
jae 0x904233f
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.09099989
jmp 0x904234b
jbe 0x904234b
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.09099989
call fcn.09005591
ret

Function at 0x90423b0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], al
ret
Function at 0x90556d5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x90556dd
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x90556ec
xor al, al
ret
shr eax, 4
and eax, 1
ret

Function at 0x90563e9
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x90a0dde
call fcn.0900621d
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push 0x208
sete al
push ebx
lea esi, [eax - 1]
lea eax, [ebp - 0x218]
and esi, 0xffffffef
push eax
add esi, 0x2b
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp byte [ebp + 0xc], bl
je 0x905642e
or esi, 0x8000
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
je 0x9056447
xor al, al
jmp 0x9056497
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.09015b83
push dword [ebp + 0xc]
lea ecx, [ebp - 0x234]
push str.Adobe
mov dword [ebp - 4], ebx
call fcn.0905636c
test al, al
je 0x905648a
lea eax, [ebp - 0x234]
push eax
mov ecx, edi
call fcn.09099989
mov ecx, edi
call fcn.090556d5
mov bl, al
lea ecx, [ebp - 0x234]
call fcn.090167a9
mov al, bl
call fcn.0900804d
ret
Function at 0x906031b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x158
mov eax, 0x90a26eb
call fcn.0900621d
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x164], eax
xor ebx, ebx
lea eax, [ebp - 0x154]
push eax
mov edi, 0x20019
push edi
push ebx
push str.SOFTWARE
push 0x80000002
mov byte [ebp - 0x13d], bl
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x14c], ebx
call esi
test eax, eax
je 0x9060388
mov dword [ebp - 0x154], ebx
jmp 0x9060557
lea eax, [ebp - 0x148]
push eax
push edi
push ebx
push str.Adobe
push dword [ebp - 0x154]
call esi
test eax, eax
je 0x90603ad
mov dword [ebp - 0x148], ebx
jmp 0x9060557
lea eax, [ebp - 0x150]
push eax
push edi
push ebx
push str.Color
push dword [ebp - 0x148]
call esi
test eax, eax
je 0x90603d2
mov dword [ebp - 0x150], ebx
jmp 0x9060557
lea eax, [ebp - 0x144]
push eax
push edi
push ebx
push str.Monitor
push dword [ebp - 0x150]
call esi
test eax, eax
je 0x90603f7
mov dword [ebp - 0x144], ebx
jmp 0x9060557
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x144]
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9060452
cmp dword [ebp - 0x15c], 4
jne 0x9060452
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x160], eax
cmp eax, 0x3e7
ja 0x9060557
push dword [ebp - 0x160]
lea eax, [ebp - 0x1c]
push str.Monitor_u
push 0xb
push eax
call fcn.09099989
add esp, 0x10
lea eax, [ebp - 0x14c]
push eax
push edi
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x144]
call esi
test eax, eax
je 0x90604dc
mov dword [ebp - 0x14c], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], ebx
je 0x90604a0
push dword [ebp - 0x144]
call esi
cmp dword [ebp - 0x150], ebx
je 0x90604b0
push dword [ebp - 0x150]
call esi
cmp dword [ebp - 0x148], ebx
je 0x90604c0
push dword [ebp - 0x148]
call esi
cmp dword [ebp - 0x154], ebx
je 0x90604d0
push dword [ebp - 0x154]
call esi
mov al, byte [ebp - 0x13d]
call fcn.0900804d
ret
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x14c]
mov dword [ebp - 0x158], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9060557
cmp dword [ebp - 0x15c], 1
jne 0x9060557
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0905592d
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 4], ebx
call fcn.09099989
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.090167a9
mov byte [ebp - 0x13d], 1
cmp dword [ebp - 0x14c], ebx
je 0x906048a
push dword [ebp - 0x14c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x9060490
Function at 0x9063086
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a2ae1
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.0909ea10
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
mov eax, dword [esi + 4]
add eax, 0x78
mov edi, ecx
push 0
push eax
mov dword [ebp - 0x13e8], edi
mov dword [ebp - 0x13e4], esi
call fcn.09099989
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x906310a
mov eax, dword [esi + 4]
push 0
push 0x753
push 0xb71b
push eax
call fcn.09099989
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.0900e991
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], 0xc
mov eax, dword [ebp - 0x13d4]
push 0x18
xor edx, edx
pop ecx
div ecx
mov ecx, dword [ebp - 0x13d8]
add dword [ebp - 0x13d4], 0x8000
add dword [ebp - 0x13d8], 2
cmp dword [ebp - 0x13d4], 0xc800c
mov word [ecx], ax
jb 0x906312e
and dword [ebp - 0x13d8], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13e0], eax
jmp 0x906317f
mov edi, dword [ebp - 0x13e8]
mov esi, dword [ebp - 0x13e4]
mov eax, dword [ebp - 0x13e0]
movzx eax, word [eax]
and dword [ebp - 0x13d4], 0
mov dword [ebp - 0x13dc], eax
lea eax, [ebp - 0x13cc]
xor ecx, ecx
mov dx, word [ebp - 0x13dc]
mov word [eax - 2], dx
mov edx, dword [ebp - 0x13d4]
movzx edx, word [ebp + edx*2 - 0x48]
mov word [eax], dx
mov dx, word [ebp + ecx*2 - 0x48]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x19
jb 0x906319d
inc dword [ebp - 0x13d4]
cmp dword [ebp - 0x13d4], 0x19
jb 0x906319b
push 0
mov eax, 0x504c4142
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
mov ecx, esi
call fcn.09099989
push 1
push 0x753
push dword [ebp - 0x13d8]
lea ecx, [ebp - 0x1408]
push dword [edi]
call fcn.09099989
lea ecx, [ebp - 0x1408]
mov byte [ebp - 4], 1
call fcn.09005145
lea edi, [ebp - 0x13d0]
lea esi, [eax + 2]
mov dword [ebp - 0x13dc], 0x19
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [edi]
mov ecx, dword [edi + 4]
shr eax, 0x10
imul eax, eax, 0xff
add eax, 0x4000
shr eax, 0xf
mov byte [esi - 2], al
movzx eax, cx
push eax
mov dword [ebp - 0x13f0], ecx
call fcn.09099989
mov byte [esi - 1], al
movzx eax, word [ebp - 0x13ee]
push eax
call fcn.09099989
mov byte [esi], al
pop ecx
add esi, 3
add edi, 8
dec dword [ebp - 0x13d4]
pop ecx
jne 0x906323a
dec dword [ebp - 0x13dc]
jne 0x9063230
lea ecx, [ebp - 0x1408]
mov byte [ebp - 4], 0
call fcn.09005177
add dword [ebp - 0x13d8], 0x753
add dword [ebp - 0x13e0], 2
cmp dword [ebp - 0x13d8], 0xb71b
jb 0x9063173
mov ecx, dword [ebp - 0x13e4]
or dword [ebp - 4], 0xffffffff
call fcn.09099989
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x906400a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a2cd0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.0909ea10
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
mov eax, dword [edi + 4]
add eax, 0x78
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x13ec], esi
mov dword [ebp - 0x13e4], edi
call fcn.09099989
cmp dword [esi], 0
pop ecx
pop ecx
jne 0x906408e
mov eax, dword [edi + 4]
push 0
push 0x9c4
push 0xf424
push eax
call fcn.09099989
add esp, 0x10
mov dword [esi], eax
mov ecx, edi
mov dword [ebp - 0x13f0], edi
call fcn.0900e991
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x13d4], 0xc
mov eax, dword [ebp - 0x13d4]
push 0x18
xor edx, edx
pop esi
div esi
add dword [ebp - 0x13d4], 0x8000
mov word [ecx], ax
add ecx, 2
cmp dword [ebp - 0x13d4], 0xc800c
jb 0x90640ac
and dword [ebp - 0x13dc], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13e0], eax
mov esi, 0x4000
jmp 0x90640f2
mov edi, dword [ebp - 0x13e4]
mov eax, dword [ebp - 0x13e0]
movzx eax, word [eax]
and dword [ebp - 0x13d4], 0
mov dword [ebp - 0x13d8], eax
lea eax, [ebp - 0x13cc]
xor ecx, ecx
mov dx, word [ebp - 0x13d8]
mov word [eax - 2], dx
mov edx, dword [ebp - 0x13d4]
movzx edx, word [ebp + edx*2 - 0x48]
mov word [eax], dx
mov dx, word [ebp + ecx*2 - 0x48]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x19
jb 0x9064110
inc dword [ebp - 0x13d4]
cmp dword [ebp - 0x13d4], 0x19
jb 0x906410e
push 0
push 0x434d594b
push 0x50524742
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
mov ecx, edi
call fcn.09099989
mov eax, dword [ebp - 0x13ec]
push 1
push 0x9c4
push dword [ebp - 0x13dc]
lea ecx, [ebp - 0x1404]
push dword [eax]
call fcn.09099989
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 1
call fcn.09005145
lea ecx, [ebp - 0x13d0]
add eax, 2
mov dword [ebp - 0x13d8], 0x19
mov dword [ebp - 0x13d4], ecx
mov dword [ebp - 0x13e8], 0x19
mov ecx, dword [ebp - 0x13d4]
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
movzx edx, di
imul edx, edx, 0xff
add edx, esi
shr edx, 0xf
mov byte [eax - 2], dl
shr edi, 0x10
mov edx, edi
imul edx, edx, 0xff
add dword [ebp - 0x13d4], 8
add edx, esi
shr edx, 0xf
mov byte [eax - 1], dl
movzx edx, cx
shr ecx, 0x10
imul edx, edx, 0xff
imul ecx, ecx, 0xff
add edx, esi
add ecx, esi
shr edx, 0xf
shr ecx, 0xf
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
dec dword [ebp - 0x13e8]
jne 0x90641bc
dec dword [ebp - 0x13d8]
mov ecx, dword [ebp - 0x13d4]
jne 0x90641ac
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 0
call fcn.09005177
add dword [ebp - 0x13dc], 0x9c4
add dword [ebp - 0x13e0], 2
cmp dword [ebp - 0x13dc], 0xf424
jb 0x90640ec
mov ecx, dword [ebp - 0x13e4]
or dword [ebp - 4], 0xffffffff
call fcn.09099989
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4