Function at 0x42ebc8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42ebe7
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42ebf7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42ed19
test ebx, ebx
jl 0x42ed19
test esi, esi
jle 0x42ed19
mov eax, dword [ebp - 8]
call fcn.0040b6f8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b6f8
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42ecb6
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42ed19
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42ec9b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42ec6a
inc dword [ebp - 0x14]
jmp 0x42ec7a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42ec7a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42ec85
or eax, 0xffffffff
jmp 0x42ec9b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42ec98
inc eax
jmp 0x42ec9b
or eax, 0xffffffff
test eax, eax
jl 0x42eca3
cmp esi, eax
jg 0x42ec58
cmp esi, eax
jg 0x42ecae
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42ed1c
inc edx
dec dword [ebp - 0x1c]
jne 0x42ec54
jmp 0x42ed19
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42ed19
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42ed00
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42ecdf
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42ecea
or eax, 0xffffffff
jmp 0x42ed00
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42ecfd
inc eax
jmp 0x42ed00
or eax, 0xffffffff
test eax, eax
jl 0x42ed08
cmp esi, eax
jg 0x42ecc8
cmp esi, eax
jg 0x42ed13
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42ed1c
inc edx
dec dword [ebp - 0x1c]
jne 0x42ecc4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43dd70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43dd78
mov eax, edx
pop esi
pop ebx
ret

Function at 0x47dd74
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x47ddb7
cmp byte [ebx + 0x11], 0
jne 0x47ddb7
cmp byte [ebx + 0x24], 0
jne 0x47ddb7
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x47ddce
mov ecx, dword [0x5968b4]
mov dl, 1
mov eax, dword [0x44e0a4]
call fcn.0042910c
call fcn.0040a2d4
pop ebx
ret
mov ecx, dword [0x5968b4]
mov dl, 1
mov eax, dword [0x44e0a4]
call fcn.0042910c
call fcn.0040a2d4
pop ebx
ret