joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406756
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x416750]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x413418]
mov ecx, dword [0x416758]
mov dword [0x416750], eax
movzx eax, al
add eax, dword [0x416754]
imul eax, eax, 0x8088405
inc eax
mov dword [0x416754], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x413418]
mov eax, dword [esp + 4]
mov dword [0x416758], ecx
ret

Function at 0x4067e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4122b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x413d3c]
mov esi, ecx
call fcn.004067ae
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040126e
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.0040673c
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.00406756
inc esi
cmp esi, 0xc
pop ecx
jl 0x406815
cmp dword [0x413d38], 0
movzx ax, byte [ebp - 5]
movzx eax, ax
pop esi
je 0x406854
movzx cx, byte [0x413403]
cmp ax, cx
je 0x40685e
or eax, 0xffffffff
jmp 0x406860
movzx cx, byte [0x413409]
jmp 0x40684a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bf6
leave
ret

Function at 0x406bf6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4122b0]
jne 0x406c00
repz ret
jmp fcn.0040776e
Function at 0x409188
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x412a78]
je 0x4091a3
inc edi
cmp edi, 0x17
jb 0x409194
cmp edi, 0x17
jae 0x409323
push ebp
push 3
call fcn.0040c151
cmp eax, 1
pop ecx
je 0x4092ef
push 3
call fcn.0040c151
test eax, eax
pop ecx
jne 0x4091d7
cmp dword [0x4122c0], 1
je 0x4092ef
cmp ebx, 0xfc
je 0x409322
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x416b30
push ebp
call fcn.0040717b
add esp, 0xc
test eax, eax
je 0x40920d
push esi
push esi
push esi
push esi
push esi
call fcn.00408afe
add esp, 0x14
push 0x104
mov esi, 0x416b49
push esi
push 0
mov byte [0x416c4d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x409251
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040717b
add esp, 0xc
test eax, eax
je 0x409251
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00408afe
add esp, 0x14
push esi
call fcn.004070f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x409296
push esi
call fcn.004070f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x416e44
push 0x40fab4
sub ecx, eax
push ecx
push eax
call fcn.0040b686
add esp, 0x14
test eax, eax
je 0x409296
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00408afe
add esp, 0x14
jmp 0x409298
xor esi, esi
push 0x40fab0
push ebx
push ebp
call fcn.004071e0
add esp, 0xc
test eax, eax
je 0x4092b8
push esi
push esi
push esi
push esi
push esi
call fcn.00408afe
add esp, 0x14
push dword [edi*8 + 0x412a7c]
push ebx
push ebp
call fcn.004071e0
add esp, 0xc
test eax, eax
je 0x4092da
push esi
push esi
push esi
push esi
push esi
call fcn.00408afe
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040bf94
add esp, 0xc
jmp 0x409322
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x409322
cmp ebp, 0xffffffff
je 0x409322
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x412a7c]
push dword [esi]
call fcn.004070f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40bf94
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040830f
xor ebx, ebx
cmp dword [0x4170e8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40c06a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40c14a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41052c
push edi
call esi
cmp eax, ebx
je 0x40c14a
push eax
call fcn.004082a1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4170e8], eax
call esi
push eax
call fcn.004082a1
mov dword [esp], 0x410508
push edi
mov dword [0x4170ec], eax
call esi
push eax
call fcn.004082a1
mov dword [0x4170f0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00408f15
test eax, eax
pop ecx
pop ecx
je 0x40c038
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408afe
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40c06a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004082a1
cmp eax, ebx
pop ecx
mov dword [0x4170f8], eax
je 0x40c06a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004082a1
pop ecx
mov dword [0x4170f4], eax
mov eax, dword [0x4170f4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40c0ef
cmp dword [0x4170f8], ecx
je 0x40c0ef
push eax
call fcn.00408318
push dword [0x4170f8]
mov esi, eax
call fcn.00408318
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40c0ef
cmp edi, ebx
je 0x40c0ef
call esi
cmp eax, ebx
je 0x40c0bc
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c0bc
test byte [ebp - 0x18], 1
jne 0x40c0ef
lea eax, [ebp - 0x10]
push eax
call fcn.00408f4c
test eax, eax
pop ecx
je 0x40c0d7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408afe
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40c0e6
or dword [ebp + 0x10], 0x200000
jmp 0x40c12a
or dword [ebp + 0x10], 0x40000
jmp 0x40c12a
mov eax, dword [0x4170ec]
cmp eax, dword [ebp - 8]
je 0x40c12a
push eax
call fcn.00408318
cmp eax, ebx
pop ecx
je 0x40c12a
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40c12a
mov eax, dword [0x4170f0]
cmp eax, dword [ebp - 8]
je 0x40c12a
push eax
call fcn.00408318
cmp eax, ebx
pop ecx
je 0x40c12a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4170e8]
call fcn.00408318
cmp eax, ebx
pop ecx
je 0x40c14a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c14c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.09015650
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.09015650
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x9015650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x901565f
pop dword [ebp - 0x48]
mov eax, 0xc7e7e13a
sub eax, 0xbee68adb
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x1df20911
sub dword [ebp - 0x58], 0xcf9fc3c6
mov dword [ebp - 0x54], 0xef54794c
sub dword [ebp - 0x54], 0xbd212d07
mov dword [ebp - 0x50], 0x66818216
add dword [ebp - 0x50], 0xe5cac218
mov dword [ebp - 0x4c], 0x413079a2
add dword [ebp - 0x4c], 0xbecf865e
lea eax, [ebp - 0x58]
push eax
mov eax, 0x966dea3e
add eax, 0x729f7686
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xda8ab971
sub dword [ebp - 0x58], 0x6618501b
mov dword [ebp - 0x54], 0x3fb6c26
add dword [ebp - 0x54], 0x3d70f54f
mov dword [ebp - 0x50], 0x482df785
sub dword [ebp - 0x50], 0xe4be8b19
mov dword [ebp - 0x4c], 0x69d85408
add dword [ebp - 0x4c], 0x9627abf8
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x9f7ebf6b
add eax, 0x698ea155
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x776ed
push 0
call eax
mov ecx, 0x43fe
xor edi, edi
add edi, eax
mov ebx, 0x4d695731
sub ebx, 0x4456fb31
add ebx, dword [ebp - 0x48]
mov edx, 0xf1cabd21
xor dword [ebp - 0x38], ecx
mov esi, dword [ebx]
sub dword [ebp - 8], eax
sub esi, edx
xor dword [ebp - 0x14], esi
mov dword [edi], esi
mov dword [ebp - 0x2c], 0x250c1068
add edi, 0xe3bcb1d3
sub edi, 0xe3bcb1cf
add ebx, 4
loop 0x9015777
add eax, 0xd0889e8c
sub eax, 0xd0879bc1
mov ebx, eax
add eax, 5
mov ecx, 0x91dd466f
add ecx, 0x7722b991
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.09015650
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.09015650
call fcn.09006fcf
ret
Function at 0x9079b47
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90d3869
call fcn.09006dd9
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079ba6
mov dword [ebp - 0x14c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bcf
mov dword [ebp - 0x148], ebx
jmp 0x9079d25
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bf8
mov dword [ebp - 0x144], ebx
jmp 0x9079d25
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079c21
mov dword [ebp - 0x13c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079c73
cmp dword [ebp - 0x154], 4
jne 0x9079c73
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x9079d25
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.09015650
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079cb3
mov dword [ebp - 0x140], ebx
jmp 0x9079d3a
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079d25
cmp dword [ebp - 0x154], 1
jne 0x9079d25
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901904e
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.09015650
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.09015650
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x9079d3a
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x9079d4f
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x9079d64
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x9079d79
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x9079d8e
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09006f96
ret
Function at 0x907c6ab
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3926
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x143c], edi
call fcn.09018f87
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1420], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1434], eax
mov eax, edi
xor edx, edx
div dword [ebp - 0x1420]
mov edi, ecx
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1434]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1420]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1438]
add esi, 4
cmp edi, 0xff0
jb 0x907c753
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x907c741
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.09015650
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.09015650
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0xc16]
movzx ecx, word [ebp + esi - 0x1416]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0x1414]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0xc14]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0xc12]
sub esi, edx
movzx ecx, word [ebp + ecx - 0x1412]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1428]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x141c], esi
cmp esi, 0x800
jb 0x907c7e0
cmp ecx, 0xa
ja 0x907c89c
mov eax, dword [ebp - 0x142c]
mov esi, dword [ebp - 0x1420]
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0
pop ecx
cmp eax, 0xff0
jb 0x907c729
mov byte [ebp - 0x1430], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.090190fb
mov al, byte [ebp - 0x1430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x90a249d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.09015650
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2522
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09015650
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2539
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2595
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2588
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.09015650
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09015650
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2631
sub dword [ebp - 0x13d8], 1
jne 0x90a2627
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2571
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90a2706
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.09015650
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a278b
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.09015650
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a27a2
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a27fe
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a27f1
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.09015650
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.09015650
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x90a2897
sub dword [ebp - 0x13d8], 1
jne 0x90a288d
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x90a27da
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4