Function at 0x42f898
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42f8b7
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42f8c7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42f9e9
test ebx, ebx
jl 0x42f9e9
test esi, esi
jle 0x42f9e9
mov eax, dword [ebp - 8]
call fcn.0040c258
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c258
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42f986
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42f9e9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42f96b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42f93a
inc dword [ebp - 0x14]
jmp 0x42f94a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42f94a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42f955
or eax, 0xffffffff
jmp 0x42f96b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42f968
inc eax
jmp 0x42f96b
or eax, 0xffffffff
test eax, eax
jl 0x42f973
cmp esi, eax
jg 0x42f928
cmp esi, eax
jg 0x42f97e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42f9ec
inc edx
dec dword [ebp - 0x1c]
jne 0x42f924
jmp 0x42f9e9
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42f9e9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42f9d0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42f9af
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42f9ba
or eax, 0xffffffff
jmp 0x42f9d0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42f9cd
inc eax
jmp 0x42f9d0
or eax, 0xffffffff
test eax, eax
jl 0x42f9d8
cmp esi, eax
jg 0x42f998
cmp esi, eax
jg 0x42f9e3
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42f9ec
inc edx
dec dword [ebp - 0x1c]
jne 0x42f994
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ea40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43ea48
mov eax, edx
pop esi
pop ebx
ret

Function at 0x47ea44
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x47ea87
cmp byte [ebx + 0x11], 0
jne 0x47ea87
cmp byte [ebx + 0x24], 0
jne 0x47ea87
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x47ea9e
mov ecx, dword [0x591908]
mov dl, 1
mov eax, dword [0x44ed74]
call fcn.00429e40
call fcn.0040ae68
pop ebx
ret
mov ecx, dword [0x591908]
mov dl, 1
mov eax, dword [0x44ed74]
call fcn.00429e40
call fcn.0040ae68
pop ebx
ret