joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007fe1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x2c87
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, 0x1d5a
mov dword [0x102b1f9c], 0
mov dword [0x102b1fa0], 0
mov dword [0x102b1fa8], 0
mov dword [0x102b1f94], 0x1d5a
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], edi
je 0x1000816c
jmp 0x1000807f
mov eax, dword [0x102b1f9c]
mov ecx, dword [0x102b1fa0]
mov edx, dword [0x102b1f94]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edi, 0x100
mov ebx, esi
add ebx, 1
add edx, 0xfffff6df
add eax, 1
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x102b1f9c], edx
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ecx + edx]
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0x40]
add ecx, edx
mov eax, ecx
cdq
idiv edi
mov dword [0x102b1fa0], edx
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x44]
mov cl, byte [ecx + edi]
mov byte [0x102b1fa4], cl
mov ecx, dword [ebp - 0x3c]
mov dword [0x102b1f94], ecx
mov ecx, dword [ebp - 0x2c]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x2c]
mov byte [edx + edi], cl
mov dword [0x102b1f98], 0x63b
mov cl, byte [0x102b1fa4]
mov edx, dword [0x102b1fa0]
mov edi, dword [ebp - 0x2c]
mov byte [edi + edx], cl
mov dword [0x102b1f94], 0xbac
mov edx, dword [0x102b1f9c]
movzx edx, byte [edi + edx]
mov ecx, dword [0x102b1fa0]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x102b1fa8], ecx
mov dword [0x102b1f94], 0x1236
mov edx, dword [ebp - 0x24]
mov dl, byte [edx + esi]
xor dl, byte [edi + ecx]
mov ecx, dword [ebp - 0x28]
mov byte [ecx + esi], dl
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x38], ebx
jne 0x1000805f
mov eax, dword [0x102b1f94]
add eax, 0xf2d
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [0x102b1f94], eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100082c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.1000817c
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x100082ff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x102b1f94], 0xfffff751
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x102b1f98], 0xffffe77b
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
jne 0x10008350
mov eax, dword [ebp - 0x34]
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebp - 0x38], eax
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
jmp 0x10008378
mov al, byte [ebp - 0x41]
test al, 1
jne 0x10008426
jmp 0x100083f9
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x59], bh
mov byte [ebp - 0x41], cl
je 0x10008368
mov eax, dword [ebp - 0x58]
add eax, 1
mov cl, byte [ebp - 0x59]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x41]
and ch, dl
cmp eax, 0x20
setb dl
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x61], ch
mov byte [ebp - 0x62], dl
mov al, byte [ebp - 0x61]
mov cl, byte [ebp - 0x62]
and al, cl
test al, 1
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x54], edx
jne 0x10008392
jmp 0x10008368
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov edx, dword [ebp - 0x4c]
add edx, 2
mov esi, dword [ebp - 0x30]
cmp ecx, esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], ecx
jb 0x10008378
jmp 0x10008345
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x34], edi
jmp 0x10008345
Function at 0x10008795
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x102b1f98]
add esi, 0xfffff0b4
mov dword [0x102b1f98], esi
mov dword [0x102b1f94], 0x13ed
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x10277858]
mov dl, byte [eax + 0x10277829]
sub dl, cl
mov byte [ebp + eax - 0x28], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
jne 0x100087ca
lea eax, [ebp - 0x28]
mov dword [0x102b1f98], 0x18e3
mov dword [ebp - 0x38], eax
call fcn.10008560
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.10008648
cmp eax, 0
mov dword [ebp - 0x3c], eax
je 0x100088de
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x102b1f94]
add ecx, 0xffffe855
mov dword [0x102b1f94], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.10007b93
mov dword [0x102b1f98], 0x26a5
mov eax, dword [ebp - 0x40]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xd0
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x12db
mov edx, dword [ebp - 0x40]
mov dword [edx + 0xd0], 0x4550
add edx, 0xffc00000
mov esi, dword [ebp - 0x30]
mov dword [esi + 0x54], edx
mov edx, dword [ebp - 0x40]
mov dword [esi + 0x3c], edx
mov edi, dword [0x102b1f98]
add edi, 0x236
mov dword [0x102b1f94], edi
cmp edx, 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x100088d4
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop edi
pop ebp
ret
Function at 0x40ed90
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 0x42f860
lea eax, [esp + 0x14]
push esi
push eax
mov ebp, ecx
xor bl, bl
mov dword [esp + 0x1c], 0
call fcn.00419053
add esp, 0xc
test eax, eax
je 0x40edca
push esi
push str.The_file__s_was_not_opened_n
call fcn.00404950
add esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40ee61
push 2
push 0
push eax
call fcn.0041a8cb
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0041a7d6
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
jne 0x40ee0b
mov edx, dword [esp + 0x10]
push edx
call fcn.00418dc4
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x10]
push 0
push 0
push eax
call fcn.0041a8cb
lea ecx, [edi + 1]
push 0
push ecx
call fcn.004024a0
mov edx, dword [esp + 0x24]
push edx
push 1
mov esi, eax
push edi
push esi
call fcn.00419c8a
add esp, 0x24
cmp eax, 1
jne 0x40ee4a
push esi
mov ecx, ebp
mov byte [esi + edi], 0
call fcn.0040ec10
mov bl, al
mov eax, dword [esp + 0x10]
push eax
call fcn.00418dc4
push esi
call fcn.0040eec8
add esp, 8
test bl, bl
jne 0x40ee6a
push 0
mov ecx, ebp
call fcn.0040ec10
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 4

Function at 0x417b3b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4424ac]
jne 0x417b45
repz ret
jmp fcn.0041e008
Function at 0x900baef
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a5e6b
call fcn.09007236
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900bb4b
xor al, al
jmp 0x900bb9b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900bf5b
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900cfd5
test al, al
je 0x900bb8e
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.09029284
mov ecx, edi
call fcn.0900e38a
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0900e401
mov al, bl
call fcn.09008fc6
ret
Function at 0x9029284
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x9029293
pop dword [ebp - 0x34]
mov eax, 0x9029293
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x4d3c3a66
add dword [ebp - 0x44], 0x1160ae5
mov dword [ebp - 0x40], 0xb77bf169
add dword [ebp - 0x40], 0x7ab75adc
mov dword [ebp - 0x3c], 0x3aa9729b
add dword [ebp - 0x3c], 0x11a2d193
mov dword [ebp - 0x38], 0x9cc9eb7f
add dword [ebp - 0x38], 0x63361481
lea eax, [ebp - 0x44]
push eax
mov eax, 0xa1b46493
sub eax, 0x98a9a45b
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xc3579157
sub dword [ebp - 0x44], 0x4ee52801
mov dword [ebp - 0x40], 0x8015d86d
sub dword [ebp - 0x40], 0x3ea976f8
mov dword [ebp - 0x3c], 0xfda91ee3
add dword [ebp - 0x3c], 0x65c64d89
mov dword [ebp - 0x38], 0x82c1df7a
sub dword [ebp - 0x38], 0x82c1df7a
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xbe2f0095
sub eax, 0xb5244045
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x6168d
push 0
call eax
mov ecx, 0x2c89c007
sub ecx, 0x2c89799d
xor esi, esi
add esi, eax
mov edx, 0x77a3d35d
add edx, 0x916b4ca3
add edx, dword [ebp - 0x34]
mov ebx, 0x9a0a5717
sub ebx, 0xff3eed23
xor dword [ebp - 4], esi
mov edi, dword [edx]
add dword [ebp - 0x2c], 0x92bbcf6b
xor edi, ebx
xor dword [ebp - 0x14], 0x134568e8
mov dword [esi], edi
xor dword [ebp - 0x30], 0xb4b15a82
add esi, 0xc1d5883e
sub esi, 0xc1d5883a
add edx, 0x65e2a503
sub edx, 0x65e2a4ff
loop 0x90293b2
add eax, 0xd39c37
add eax, 0xff2d7044
mov ebx, eax
add eax, 0xa576a243
sub eax, 0xa576a23e
mov ecx, 0x371628b7
sub ecx, 0x2e1628b7
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x906b1a2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x90a974c
call fcn.09007236
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b201
mov dword [ebp - 0x14c], ebx
jmp 0x906b37c
lea eax, [ebp - 0x148]
push eax
push esi
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b22a
mov dword [ebp - 0x148], ebx
jmp 0x906b37c
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
push str.Color
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b253
mov dword [ebp - 0x144], ebx
jmp 0x906b37c
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
push str.Monitor
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b27c
mov dword [ebp - 0x13c], ebx
jmp 0x906b37c
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
mov esi, ebx
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906b2ce
cmp dword [ebp - 0x154], 4
jne 0x906b2ce
mov esi, dword [ebp - 0x120]
cmp esi, 0x3e7
ja 0x906b37c
push esi
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.09029284
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x906b30e
mov dword [ebp - 0x140], ebx
jmp 0x906b391
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x906b37c
cmp dword [ebp - 0x154], 1
jne 0x906b37c
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.0901651a
lea eax, [ebp - 0x138]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.09029284
lea ecx, [ebp - 0x138]
call fcn.0900e401
mov bl, 1
cmp dword [ebp - 0x140], 0
je 0x906b391
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c], 0
je 0x906b3a6
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], 0
je 0x906b3bb
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x148], 0
je 0x906b3d0
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14c], 0
je 0x906b3e5
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.09008fc6
ret
Function at 0x906cba8
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a97f2
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.090a4f00
mov eax, dword [0x90e460c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x143c], edi
call fcn.0901658c
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1420], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1434], eax
mov eax, edi
xor edx, edx
div dword [ebp - 0x1420]
mov edi, ecx
mov dword [ebp - 0x1438], eax
mov edx, dword [ebp - 0x1434]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1420]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1438]
add esi, 4
cmp edi, 0xff0
jb 0x906cc50
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x906cc3e
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.09029284
push esi
mov esi, dword [0x90e6d28]
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
mov ecx, esi
push eax
call dword [0x90ac2d4]
call esi
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0xc16]
movzx ecx, word [ebp + esi - 0x1416]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0x1414]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0xc14]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0xc12]
sub esi, edx
movzx ecx, word [ebp + ecx - 0x1412]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1428]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x141c], esi
cmp esi, 0x800
jb 0x906cce8
cmp ecx, 0xa
ja 0x906cda4
mov eax, dword [ebp - 0x142c]
mov esi, dword [ebp - 0x1420]
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0
pop ecx
cmp eax, 0xff0
jb 0x906cc26
mov byte [ebp - 0x1430], 1
mov ecx, dword [ebp - 0x1424]
mov dword [ebp - 4], 2
call fcn.09016859
mov al, byte [ebp - 0x1430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001fa0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x907c663
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a9dd4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a4f00
mov eax, dword [0x90e460c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09029284
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907c6e8
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09029284
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.0901658c
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907c6ff
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907c75b
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907c74e
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.09029284
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09029284
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005b3d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x907c7f7
sub dword [ebp - 0x13d8], 1
jne 0x907c7ed
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09029284
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
push 2
pop ecx
add eax, ecx
mov dword [ebp - 0x13e0], edi
mov dword [ebp - 0x13dc], eax
cmp edi, 0xf424
jb 0x907c737
mov dword [ebp - 4], ecx
mov ecx, esi
call fcn.09016859
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001fa0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x907c8cd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a9dd4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a4f00
mov eax, dword [0x90e460c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09029284
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907c952
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.09029284
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.0901658c
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907c969
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907c9c5
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907c9b8
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.09029284
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.09029284
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005b3d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x907ca5e
sub dword [ebp - 0x13d8], 1
jne 0x907ca54
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09029284
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
push 2
pop ecx
add eax, ecx
mov dword [ebp - 0x13e0], edi
mov dword [ebp - 0x13dc], eax
cmp edi, 0xb71b
jb 0x907c9a1
mov dword [ebp - 4], ecx
mov ecx, esi
call fcn.09016859
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001fa0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4