joyce8/EMBER2024-capa huggingface dataset:
Function at 0x906767e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x906768d
pop dword [ebp - 0x50]
mov eax, 0x9d1a74be
add eax, 0x6bec01cf
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x348c0681
sub dword [ebp - 0x60], 0xe639c136
mov dword [ebp - 0x5c], 0x569e70cd
sub dword [ebp - 0x5c], 0x246b2488
mov dword [ebp - 0x58], 0xfb5274ee
add dword [ebp - 0x58], 0x50f9cf40
mov dword [ebp - 0x54], 0xaa2665dc
sub dword [ebp - 0x54], 0xaa2665dc
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xcd33555e
sub dword [ebp - 0x60], 0x58c0ec08
mov dword [ebp - 0x5c], 0x45d13609
add dword [ebp - 0x5c], 0xfb9b2b6c
mov dword [ebp - 0x58], 0x7685ff1e
add dword [ebp - 0x58], 0xece96d4e
mov dword [ebp - 0x54], 0x1b5ad025
sub dword [ebp - 0x54], 0x1b5ad025
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x5b169
push 0
call eax
mov ecx, 0x4ac61938
sub ecx, 0x4ac5da92
mov ebx, eax
mov edx, 0x994296a4
sub edx, 0x9033dca4
add edx, dword [ebp - 0x50]
mov edi, 0x61f835b6
xor dword [ebp - 0x24], edx
mov esi, dword [edx]
mov dword [ebp - 0x34], 0x177a1c00
add esi, edi
add dword [ebp - 0x3c], 0xd3fadde4
mov dword [ebx], esi
add ebx, 0xe27968e4
sub ebx, 0xe27968e0
add edx, 0xf9829d26
sub edx, 0xf9829d22
loop 0x906779f
add eax, 0xed6b
mov ebx, eax
add eax, 0x42fd9fab
add eax, 0xbd02605a
mov ecx, 0x9000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x906891a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14c
mov eax, 0x90a4789
call fcn.090070c5
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x14c]
push eax
push 0x20019
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x144], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x9068986
mov dword [ebp - 0x14c], ebx
jmp 0x9068b06
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call edi
test eax, eax
je 0x90689af
mov dword [ebp - 0x140], ebx
jmp 0x9068b06
lea eax, [ebp - 0x148]
push eax
push 0x20019
push ebx
push str.Color
push dword [ebp - 0x140]
call edi
test eax, eax
je 0x90689d8
mov dword [ebp - 0x148], ebx
jmp 0x9068b06
lea eax, [ebp - 0x13c]
push eax
push 0x20019
push ebx
push str.Monitor
push dword [ebp - 0x148]
call edi
test eax, eax
je 0x9068a01
mov dword [ebp - 0x13c], ebx
jmp 0x9068b06
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9068a52
cmp dword [ebp - 0x154], 4
jne 0x9068a52
mov eax, dword [ebp - 0x120]
cmp eax, 0x3e7
ja 0x9068b06
jmp 0x9068a54
mov eax, ebx
push eax
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.0906767e
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call edi
test eax, eax
je 0x9068a90
mov dword [ebp - 0x144], ebx
jmp 0x9068b17
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9068b06
cmp dword [ebp - 0x154], 1
jne 0x9068b06
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.090160db
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x138]
push eax
mov dword [ebp - 4], ebx
call fcn.0906767e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.0900e42b
mov bl, 1
cmp dword [ebp - 0x144], 0
je 0x9068b17
push dword [ebp - 0x144]
call esi
cmp dword [ebp - 0x13c], 0
je 0x9068b28
push dword [ebp - 0x13c]
call esi
cmp dword [ebp - 0x148], 0
je 0x9068b39
push dword [ebp - 0x148]
call esi
cmp dword [ebp - 0x140], 0
je 0x9068b4a
push dword [ebp - 0x140]
call esi
cmp dword [ebp - 0x14c], 0
je 0x9068b5b
push dword [ebp - 0x14c]
call esi
mov al, bl
call fcn.09008ed9
ret
Function at 0x9069ce6
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a482f
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x143c], edi
call fcn.09015fe5
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1438], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1420], eax
mov eax, edi
xor edx, edx
push 0xf
pop edi
div edi
mov edi, ecx
mov dword [ebp - 0x1434], eax
mov edx, dword [ebp - 0x1420]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1438]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1434]
add esi, 4
cmp edi, 0xff0
jb 0x9069d8d
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x9069d7c
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0906767e
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [0x90e15f0]
add esp, 0xc
mov dword [ebp - 0x1420], 0x100
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0x1416]
movzx ecx, word [ebp + esi - 0xc16]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0xc14]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0x1414]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0x1412]
sub esi, edx
movzx ecx, word [ebp + ecx - 0xc12]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1430]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
dec dword [ebp - 0x1420]
mov dword [ebp - 0x1430], ecx
mov dword [ebp - 0x141c], esi
jne 0x9069e25
cmp ecx, 0xa
ja 0x9069ede
mov eax, dword [ebp - 0x142c]
push 0
pop ecx
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0xf
pop esi
cmp eax, 0xff0
jb 0x9069d64
mov byte [ebp - 0x1428], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.0906767e
mov al, byte [ebp - 0x1428]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x90785fd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a4d68
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x8060
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x8058], esi
mov edi, dword [ebx + 8]
push 0
mov dword [ebp - 0x8054], edi
mov eax, dword [edi + 4]
add eax, 0x94
push eax
call fcn.0906767e
cmp dword [esi], 0
pop ecx
pop ecx
jne 0x9078682
push 0
push 0x4000
push 0x40000
push dword [edi + 4]
call fcn.0906767e
add esp, 0x10
mov dword [esi], eax
push 7
lea esi, [ebp - 0x34]
pop ecx
push 0xf
mov eax, ecx
xor edx, edx
pop edi
div edi
add ecx, 0x8000
mov word [esi], ax
lea esi, [esi + 2]
cmp ecx, 0x80007
jb 0x9078688
and dword [ebp - 0x8048], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x804c], ecx
movzx eax, word [ecx]
xor edx, edx
mov dword [ebp - 0x8040], edx
lea ecx, [ebp - 0x8036]
mov dword [ebp - 0x8050], eax
movzx eax, word [ebp + edx*2 - 0x34]
xor esi, esi
mov dword [ebp - 0x803c], esi
mov dword [ebp - 0x8044], eax
movzx edx, word [ebp + esi*2 - 0x34]
xor edi, edi
mov esi, dword [ebp - 0x8044]
mov eax, dword [ebp - 0x8050]
mov word [ecx - 2], ax
mov ax, word [ebp + edi*2 - 0x34]
inc edi
mov word [ecx], si
mov word [ecx + 2], dx
mov word [ecx + 4], ax
add ecx, 8
cmp edi, 0x10
jb 0x90786ec
mov esi, dword [ebp - 0x803c]
inc esi
mov dword [ebp - 0x803c], esi
cmp esi, 0x10
jb 0x90786df
mov edx, dword [ebp - 0x8040]
inc edx
mov dword [ebp - 0x8040], edx
cmp edx, 0x10
jb 0x90786cc
mov ecx, dword [ebp - 0x8054]
mov eax, 0x434d594b
push 0
push eax
push eax
push 0x1000
lea eax, [ebp - 0x8038]
push eax
push eax
call fcn.0906767e
mov eax, dword [ebp - 0x8058]
lea ecx, [ebp - 0x806c]
push 1
push 0x4000
push dword [ebp - 0x8048]
push dword [eax]
call fcn.0906767e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x806c]
call fcn.09005a8c
lea edi, [ebp - 0x8038]
mov dword [ebp - 0x8044], 0x10
lea esi, [eax + 2]
mov dword [ebp - 0x803c], 0x10
mov dword [ebp - 0x8040], 0x10
mov ecx, dword [edi]
mov edx, dword [edi + 4]
add edi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [esi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [esi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [esi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [esi + 1], al
add esi, 4
dec dword [ebp - 0x8040]
jne 0x90787aa
dec dword [ebp - 0x803c]
jne 0x90787a0
dec dword [ebp - 0x8044]
jne 0x9078796
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x806c]
call fcn.09005ab3
mov eax, dword [ebp - 0x8048]
mov ecx, dword [ebp - 0x804c]
add eax, 0x4000
add ecx, 2
mov dword [ebp - 0x8048], eax
mov dword [ebp - 0x804c], ecx
cmp eax, 0x40000
jb 0x90786b5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x9078cb8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a4de4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.0906767e
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x9078d3d
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.0906767e
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09015fe5
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x9078d54
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x9078db0
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x9078da3
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.0906767e
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.0906767e
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005a8c
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
dec dword [ebp - 0x13d4]
jne 0x9078e4c
dec dword [ebp - 0x13d8]
jne 0x9078e42
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005ab3
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x9078d8c
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0906767e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x9078f1f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a4de4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.0906767e
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x9078fa4
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.0906767e
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09015fe5
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x9078fbb
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x9079017
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907900a
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.0906767e
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.0906767e
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005a8c
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
dec dword [ebp - 0x13d4]
jne 0x90790b0
dec dword [ebp - 0x13d8]
jne 0x90790a6
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005ab3
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x9078ff3
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0906767e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x907952b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a4de4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.0906767e
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90795b0
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.0906767e
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09015fe5
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90795c7
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x9079623
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x9079616
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.0906767e
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.0906767e
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005a8c
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
dec dword [ebp - 0x13d4]
jne 0x90796bf
dec dword [ebp - 0x13d8]
jne 0x90796b5
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005ab3
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90795ff
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0906767e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x9098510
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a588d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb18
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb1c], eax
call fcn.0906767e
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.0906767e
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09007f5f
add esp, 0x3c
lea ecx, [ebp - 0xb28]
push eax
call fcn.0906767e
mov byte [ebp - 4], 1
xor eax, eax
jmp 0x90985c0
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x90985c0
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0906767e
movzx edi, word [ebp - 0x914]
movzx edx, word [ebp - 0x11c]
cmp edx, edi
ja 0x9098615
push 0x6250726f
call fcn.0906767e
mov ecx, edx
sub ecx, edi
xor esi, esi
mov dword [ebp - 0xb20], ecx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x9098631
xor eax, eax
jmp 0x9098656
cmp eax, edx
jb 0x909863c
mov eax, 0x8000
jmp 0x9098656
sub eax, edi
shr ecx, 1
shl eax, 0xf
xor edx, edx
add eax, ecx
mov ecx, dword [ebp - 0xb20]
div ecx
movzx edx, word [ebp - 0x11c]
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x9098621
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], 0
call fcn.090166cb
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.09019f2d
mov esi, dword [ebp - 0xb1c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb1c], eax
call fcn.0906767e
add esp, 8
mov dword [ebp - 0xb20], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x90986c2
push esi
mov ecx, eax
call fcn.0906767e
mov edx, eax
jmp 0x90986c4
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90b6910]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x90986f2
subsd xmm1, qword [0x90ac1b8]
jmp 0x90986fa
addsd xmm1, qword [0x90ac1b8]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret