joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e025cc1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x2e025cd0
pop dword [ebp - 0x30]
mov eax, 0x2e025cd0
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x9153f19c
add dword [ebp - 0x40], 0xbcfe53af
mov dword [ebp - 0x3c], 0x5d52de63
add dword [ebp - 0x3c], 0xd4e06de2
mov dword [ebp - 0x38], 0x5716c040
add dword [ebp - 0x38], 0xf53583ee
mov dword [ebp - 0x34], 0xe4dd171d
sub dword [ebp - 0x34], 0xe4dd171d
lea eax, [ebp - 0x40]
push eax
mov eax, 0x6edf7aac
add eax, 0xbf233594
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x9d9a808c
sub dword [ebp - 0x40], 0x29281736
mov dword [ebp - 0x3c], 0xf752d4e7
sub dword [ebp - 0x3c], 0xb5e67372
mov dword [ebp - 0x38], 0xd1f8e10b
sub dword [ebp - 0x38], 0x6e89749f
mov dword [ebp - 0x34], 0x2c88643e
sub dword [ebp - 0x34], 0x2c88643e
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3f660
push 0
call eax
mov ecx, 0x30dd8376
add ecx, 0xcf22c6d7
mov esi, eax
mov edx, 0x2e04e800
add edx, dword [ebp - 0x30]
mov ebx, 0xa9881d37
add ebx, 0xd09ec95d
mov dword [ebp - 4], 0x930b3ea
mov edi, dword [edx]
mov dword [ebp - 8], 0xcd32f691
xor edi, ebx
add dword [ebp - 0x2c], 0xf5b25c40
mov dword [esi], edi
add esi, 0x5c814e64
add esi, 0xa37eb1a0
add edx, 4
loop 0x2e025de2
add eax, 0x11c07
xor ebx, ebx
add ebx, eax
add eax, 0xb28a8483
sub eax, 0xb28a847e
mov ecx, 0x9d3f05a6
sub ecx, 0x6f3f05a6
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x42bda0
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x42c5d8
call fcn.0042c1bc
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
push ebx
push esi
push 0x42dac4
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x42bc78
cmp eax, esi
jne 0x42bc6b
xor esi, esi
inc esi
mov edi, esi
jmp 0x42bc7b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42bc4f
xor esi, esi
inc esi
cmp dword [0x42dac8], esi
jne 0x42bc8d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x42bcc7
cmp dword [0x42dac8], ebx
jne 0x42bcc1
mov dword [0x42dac8], esi
push 0x401028
push 0x40101c
call fcn.0042bc0a
pop ecx
pop ecx
test eax, eax
je 0x42bcc7
mov dword [ebp - 4], EventActivityIdControl
mov eax, 0xff
jmp 0x42bd95
mov dword [0x42d184], esi
cmp dword [0x42dac8], esi
jne 0x42bcea
push 0x401018
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x42dac8], 2
test edi, edi
jne 0x42bcfa
push ebx
push 0x42dac4
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x42dad4], 0
je 0x42bd1c
push 0x42dad4
call fcn.0042c030
pop ecx
test eax, eax
je 0x42bd1c
push ebx
push 2
push ebx
call dword [0x42dad4]
push dword [0x42d190]
push dword [0x42d18c]
push dword [0x42d188]
call fcn.004168a3
add esp, 0xc
mov dword [0x42d180], eax
cmp dword [0x42d198], 0
jne 0x42bd7a
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x42d184], 0
jne 0x42bd8e
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x42d180]
mov dword [ebp - 4], EventActivityIdControl
call fcn.0042c201
ret
call fcn.0042c0f1
jmp 0x42bc33

Function at 0x42bfa0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x42bfb6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], reloc.ADVAPI32.dll_EventActivityIdControl
jne 0x42bfd1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x42bfe0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
movzx ebx, word [ecx + 6]
add eax, 0x18
push esi
xor edx, edx
add eax, ecx
push edi
test ebx, ebx
je 0x42c01e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x42c016
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x42c020
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x42c006
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41ff02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x41ff11
pop dword [ebp - 0x44]
mov eax, 0xac6c1ad7
add eax, 0x53d5e43a
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xa39cb6c2
sub dword [ebp - 0x54], 0x554a7177
mov dword [ebp - 0x50], 0xa85e31c7
sub dword [ebp - 0x50], 0x762ae582
mov dword [ebp - 0x4c], 0xccddf852
sub dword [ebp - 0x4c], 0x8091b424
mov dword [ebp - 0x48], 0xc5c2221
sub dword [ebp - 0x48], 0xc5c2221
lea eax, [ebp - 0x54]
push eax
mov eax, 0x981e54ec
sub eax, 0x97dc2478
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xa3fb220b
sub dword [ebp - 0x54], 0x2f88b8b5
mov dword [ebp - 0x50], 0x60819cfc
sub dword [ebp - 0x50], 0x1f153b87
mov dword [ebp - 0x4c], 0xb19acfa6
add dword [ebp - 0x4c], 0xb1d49cc6
mov dword [ebp - 0x48], 0x211ca5ae
add dword [ebp - 0x48], 0xdee35a52
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3cce3
push 0
call eax
mov ecx, 0x4461
xor edi, edi
add edi, eax
mov esi, 0x2faf1517
sub esi, 0x2f6bd117
add esi, dword [ebp - 0x44]
mov ebx, 0x9e1eae93
sub ebx, 0x32402dd8
xor dword [ebp - 0x30], 0x7b2ca5ad
mov edx, dword [esi]
add dword [ebp - 0x28], edi
sub edx, ebx
sub dword [ebp - 0x1c], 0x1196a5c7
mov dword [edi], edx
xor dword [ebp - 0xc], 0xdac89708
add edi, 0xe9117ca
add edi, 0xf16ee83a
add esi, 0xefbfc7a8
add esi, 0x1040385c
loop 0x42002a
add eax, 0xe64a6f87
add eax, 0x19b694d0
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.09038232
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.09038232
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.09038232
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.09038232
call fcn.09006fcf
ret
Function at 0x9079b47
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90d3869
call fcn.09006dd9
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079ba6
mov dword [ebp - 0x14c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bcf
mov dword [ebp - 0x148], ebx
jmp 0x9079d25
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079bf8
mov dword [ebp - 0x144], ebx
jmp 0x9079d25
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079c21
mov dword [ebp - 0x13c], ebx
jmp 0x9079d25
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079c73
cmp dword [ebp - 0x154], 4
jne 0x9079c73
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x9079d25
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.09038232
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x9079cb3
mov dword [ebp - 0x140], ebx
jmp 0x9079d3a
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9079d25
cmp dword [ebp - 0x154], 1
jne 0x9079d25
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901904e
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.09038232
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.09038232
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x9079d3a
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x9079d4f
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x9079d64
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x9079d79
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x9079d8e
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09006f96
ret
Function at 0x907c6ab
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3926
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x143c], edi
call fcn.09018f87
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1420], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1434], eax
mov eax, edi
xor edx, edx
div dword [ebp - 0x1420]
mov edi, ecx
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1434]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1420]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1438]
add esi, 4
cmp edi, 0xff0
jb 0x907c753
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x907c741
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.09038232
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.09038232
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0xc16]
movzx ecx, word [ebp + esi - 0x1416]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0x1414]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0xc14]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0xc12]
sub esi, edx
movzx ecx, word [ebp + ecx - 0x1412]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1428]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x141c], esi
cmp esi, 0x800
jb 0x907c7e0
cmp ecx, 0xa
ja 0x907c89c
mov eax, dword [ebp - 0x142c]
mov esi, dword [ebp - 0x1420]
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0
pop ecx
cmp eax, 0xff0
jb 0x907c729
mov byte [ebp - 0x1430], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.090190fb
mov al, byte [ebp - 0x1430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x90a249d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.09038232
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2522
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09038232
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2539
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2595
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2588
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.09038232
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09038232
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2631
sub dword [ebp - 0x13d8], 1
jne 0x90a2627
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2571
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90a2706
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.09038232
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a278b
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.09038232
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a27a2
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a27fe
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a27f1
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.09038232
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.09038232
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x90a2897
sub dword [ebp - 0x13d8], 1
jne 0x90a288d
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x90a27da
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90a2d18
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.09038232
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2d9d
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09038232
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2db4
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2e10
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2e03
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.09038232
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09038232
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2eac
sub dword [ebp - 0x13d8], 1
jne 0x90a2ea2
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2dec
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4