joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001078
Capabilities:
Create thread
Set environment variable

Disassembly:
jmp 0x10001b90
cmp dword [esp + 8], 1
jne 0x10001c4a
push esi
call fcn.10001082
call fcn.10001032
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
sub eax, 0
je 0x10001bdf
sub eax, 1
je 0x10001bc8
sub eax, 1
jne 0x10001bef
push eax
push str.rugburn
push str.No_GameGuard_patch_is_available_for_PangyaTH.
jmp 0x10001beb
push 0
push 0
push 0
push 0x100010f5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10001bff
push 0
push str.rugburn
push str.No_GameGuard_patch_is_available_for_PangyaUS.
push 0
call esi
push 0
push str.rugburn
push str.It_looks_like_no_patch_exists_for_this_version_of_PangYa._nThe_game_will_likely_exit_a_couple_minutes_after_detecting_GameGuard_is_not_present.
push 0
call esi
call fcn.1000103c
call fcn.10001087
call fcn.10001032
push eax
call fcn.100010af
add esp, 4
mov esi, eax
push esi
push str.PANGYA_ARG
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x10001c3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_set_PANGYA_ARG___08x_
call fcn.100010c3
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.100010fa
pop esi
mov eax, 1
ret 0xc

Function at 0x10001091
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x100012d0
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x10001096
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x10002630
push ecx
push ebx
mov ebx, dword [esp + 0xc]
lea eax, [esp + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
xor esi, esi
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebp, dword [esp + 0x1c]
cmp ebp, 0x100062e6
je 0x1000267b
nop word [eax + eax]
push edi
push ebp
push ebx
call sub.msvcrt.dll_memcpy
inc esi
add esp, 0xc
cmp esi, 5
je 0x1000267b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002660
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push dword [esp + 0x28]
push str.Patch___Code_:__s___d__r_n
call fcn.10001113
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100010b9
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x10002590
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
mov esi, dword [edi]
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x14]
cmp esi, eax
je 0x100025c1
mov ebx, 1
mov dword [edi], eax
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x18]
cmp eax, str.9A7
je 0x10002602
cmp eax, str.992
je 0x10002602
cmp eax, str.9A0
je 0x10002602
cmp eax, 0x10006358
je 0x10002602
push ebx
push eax
push str.Patch__Code_:__s___d__r_n
call fcn.10001113
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x100010c3
Capabilities:
Terminate process

Disassembly:
jmp 0x10001280
push esi
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
push esi
call dword [sym.imp.USER32.dll_wvsprintfA]
push 0x10
push str.rugburn
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100010e6
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x10001590
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push ebp
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000162e
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea esi, [edi + 1]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push 0
push eax
mov dword [esp + 0x20], eax
call sub.msvcrt.dll_memset
mov esi, dword [esp + 0x20]
add esp, 0xc
test edi, edi
je 0x10001610
push 0
lea eax, [esp + 0x14]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10001623
add esi, dword [esp + 0x10]
sub edi, dword [esp + 0x10]
jne 0x100015f2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push ebp
push str.Error_loading_file__s.
call fcn.100010c3
push ebp
push str.Error_opening_file__s.
call fcn.100010c3
int3

Function at 0x10001113
Capabilities:
Write file on windows

Disassembly:
jmp 0x100013f0
push ecx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
push 0x1000
push 0
call esi
push 0x80
push 0
mov edi, eax
call esi
mov ecx, dword [0x10008128]
mov ebp, eax
mov esi, edi
test ecx, ecx
je 0x10001436
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [edi], 0
je 0x10001436
nop dword [eax]
inc esi
cmp byte [esi], 0
jne 0x10001430
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.T:_d_
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esi], 0
je 0x10001466
nop dword [eax]
inc esi
cmp byte [esi], 0
jne 0x10001460
mov eax, esi
sub eax, edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
push esi
call dword [sym.imp.USER32.dll_wvsprintfA]
add dword [esp + 0xc], eax
push 0
push 0x80
push 4
push 0
push 3
push 4
push str.gglog.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x6d2d5580
Capabilities:
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x210], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x6d2ddf5c
push SysReAllocString
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x2c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x6d2d562a
call fcn.6d2d50f0
test eax, eax
je 0x6d2d55fb
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.6d2d5640
add esp, 0x10
jmp 0x6d2d5603
mov edx, dword [esp + 4]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 8]
mov edx, dword [esp]
push eax
lea ecx, [esp + 0x14]
push ecx
push 3
push 0
push str.EnableAutoUpdateCheck
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x214
ret

Function at 0x6d2d5640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x6d2d564f
pop dword [ebp - 0x4c]
mov eax, 0xcbd00437
sub eax, 0x5ea2ade8
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe1cfcb5b
sub dword [ebp - 0x5c], 0x937d8610
mov dword [ebp - 0x58], 0x96cde478
sub dword [ebp - 0x58], 0x649a9833
mov dword [ebp - 0x54], 0xbdf6429b
sub dword [ebp - 0x54], 0x71a9fe6d
mov dword [ebp - 0x50], 0x4b5bb9a2
sub dword [ebp - 0x50], 0x4b5bb9a2
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x51d315fe
sub eax, 0xe4a565e2
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x6edc9c46
add dword [ebp - 0x5c], 0x595cd10
mov dword [ebp - 0x58], 0x74a3bb65
add dword [ebp - 0x58], 0xccc8a610
mov dword [ebp - 0x54], 0x8397a725
add dword [ebp - 0x54], 0xdfd7c547
mov dword [ebp - 0x50], 0x892dd915
add dword [ebp - 0x50], 0x76d226eb
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xcdc2a2a8
add eax, 0x9f6b0d70
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x360eb
push 0
call eax
mov ecx, 0xf3176f73
sub ecx, 0xf3172a02
mov ebx, eax
mov esi, 0x18ad62d0
add esi, 0x5481c530
add esi, dword [ebp - 0x4c]
mov edx, 0x10e97a66
mov dword [ebp - 0x20], 0xbcac0a83
mov edi, dword [esi]
xor dword [ebp - 0x20], 0xb3c60327
add edi, edx
add dword [ebp - 0x3c], 0xdf10a64e
mov dword [ebx], edi
sub dword [ebp - 0x44], 0x295d74d4
add ebx, 0xbaa74e0e
add ebx, 0x4558b1f6
add esi, 0xadf6063
sub esi, 0xadf605f
loop 0x6d2d576b
add eax, 0x27b3af63
add eax, 0xd84d5934
xor ebx, ebx
add ebx, eax
add eax, 0xea7e6b1e
sub eax, 0xea7e6b19
mov ecx, 0xc1d284b4
add ecx, 0xab597b4c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x6d2d932c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d2e54cc]
jne 0x6d2d9336
repz ret
jmp fcn.6d2d99bc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.090a51e0
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.090a51e0
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.090a51e0
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.090a51e0
call fcn.09006fcf
ret
Function at 0x9079b47
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90d3869
call fcn.09006dd9
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079ba6
mov dword [ebp - 0x14c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bcf
mov dword [ebp - 0x148], ebx
jmp 0x9079d25
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bf8
mov dword [ebp - 0x144], ebx
jmp 0x9079d25
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079c21
mov dword [ebp - 0x13c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079c73
cmp dword [ebp - 0x154], 4
jne 0x9079c73
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x9079d25
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.090a51e0
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079cb3
mov dword [ebp - 0x140], ebx
jmp 0x9079d3a
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079d25
cmp dword [ebp - 0x154], 1
jne 0x9079d25
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901904e
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.090a51e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.090a51e0
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x9079d3a
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x9079d4f
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x9079d64
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x9079d79
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x9079d8e
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09006f96
ret
Function at 0x907c6ab
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3926
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x143c], edi
call fcn.09018f87
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1420], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1434], eax
mov eax, edi
xor edx, edx
div dword [ebp - 0x1420]
mov edi, ecx
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1434]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1420]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1438]
add esi, 4
cmp edi, 0xff0
jb 0x907c753
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x907c741
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.090a51e0
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.090a51e0
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0xc16]
movzx ecx, word [ebp + esi - 0x1416]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0x1414]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0xc14]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0xc12]
sub esi, edx
movzx ecx, word [ebp + ecx - 0x1412]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1428]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x141c], esi
cmp esi, 0x800
jb 0x907c7e0
cmp ecx, 0xa
ja 0x907c89c
mov eax, dword [ebp - 0x142c]
mov esi, dword [ebp - 0x1420]
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0
pop ecx
cmp eax, 0xff0
jb 0x907c729
mov byte [ebp - 0x1430], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.090190fb
mov al, byte [ebp - 0x1430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x90a249d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.090a51e0
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2522
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.090a51e0
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2539
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2595
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2588
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.090a51e0
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.090a51e0
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2631
sub dword [ebp - 0x13d8], 1
jne 0x90a2627
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2571
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90a2706
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.090a51e0
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a278b
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.090a51e0
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a27a2
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a27fe
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a27f1
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.090a51e0
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.090a51e0
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x90a2897
sub dword [ebp - 0x13d8], 1
jne 0x90a288d
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x90a27da
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4