joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a1070
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.10022920
mov eax, dword [0x101fd024]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.100272e0
add esp, 0xc
mov edi, eax
call fcn.10027250
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x100a127e
test esi, esi
je 0x100a127e
push 0
push edi
push esi
call fcn.10026d50
add esp, 0xc
test eax, eax
je 0x100a127e
push 0x20
push ebx
push esi
call fcn.10026d90
add esp, 0xc
test eax, eax
je 0x100a127e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.10026c20
add esp, 0xc
test eax, eax
je 0x100a127e
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.10026d50
add esp, 0xc
test eax, eax
je 0x100a127e
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.10026d90
add esp, 0xc
test eax, eax
je 0x100a127e
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.10026d90
add esp, 0xc
test eax, eax
je 0x100a127e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.10026c20
add esp, 0xc
test eax, eax
je 0x100a127e
lea eax, [esp + 0x100]
push eax
call fcn.100a5c00
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.100a0820
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.100a07a0
push 0
push edi
push esi
call fcn.10026d50
add esp, 0x20
test eax, eax
je 0x100a127e
push 0x20
push ebp
push esi
call fcn.10026d90
add esp, 0xc
test eax, eax
je 0x100a127e
push 0x20
push dword [esp + 0x20]
push esi
call fcn.10026d90
add esp, 0xc
test eax, eax
je 0x100a127e
push ebx
push dword [esp + 0x14]
push esi
call fcn.10026d90
add esp, 0xc
test eax, eax
je 0x100a127e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.10026c20
add esp, 0xc
test eax, eax
je 0x100a127e
lea eax, [esp + 0x140]
push eax
call fcn.100a5c00
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.100a17b0
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.1003ac40
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.1003ac40
push edi
call fcn.10027310
push esi
call fcn.100271c0
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10021a20
add esp, 0x174
ret
Function at 0x100cc520
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10022920
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov esi, dword [esi + 0x64]
mov edx, dword [esi + 0x70]
test edx, edx
je 0x100cc589
test ebp, ebp
je 0x100cc569
nop
cmp edx, 0x40
jae 0x100cc569
mov al, byte [edx + esi + 0x30]
inc edx
xor al, byte [ebx]
inc ebx
mov byte [ecx], al
inc ecx
mov dword [esp + 0x18], ecx
sub ebp, 1
jne 0x100cc550
mov dword [esi + 0x70], edx
test ebp, ebp
je 0x100cc636
cmp edx, 0x40
jne 0x100cc589
mov dword [esi + 0x70], 0
add dword [esi + 0x20], 1
jne 0x100cc589
inc dword [esi + 0x24]
mov edx, dword [esi + 0x20]
mov eax, ebp
and eax, 0x3f
sub ebp, eax
mov dword [esp + 0x10], eax
push edi
cmp ebp, 0x40
jb 0x100cc5ef
nop dword [eax]
mov eax, ebp
mov edi, edx
shr eax, 6
xor ecx, ecx
add edx, eax
cmp edx, eax
cmovae ecx, edx
neg edi
cmp edx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x1c]
cmovae edi, eax
lea eax, [esi + 0x20]
push eax
push esi
shl edi, 6
push edi
push ebx
push ecx
call fcn.1011f400
mov eax, dword [esp + 0x24]
add esp, 0x14
add dword [esp + 0x1c], edi
sub ebp, edi
add ebx, edi
mov dword [esi + 0x20], eax
test eax, eax
jne 0x100cc5e8
inc dword [esi + 0x24]
mov edx, eax
cmp ebp, 0x40
jae 0x100cc5a0
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x100cc635
push 0x40
lea edi, [esi + 0x30]
push 0
push edi
call fcn.10146e60
lea eax, [esi + 0x20]
push eax
push esi
push 0x40
push edi
push edi
call fcn.1011f400
add esp, 0x20
xor edi, edi
test ebp, ebp
je 0x100cc632
mov edx, dword [esp + 0x1c]
sub ebx, edx
mov al, byte [esi + edi + 0x30]
lea ecx, [edi + edx]
xor al, byte [ebx + ecx]
inc edi
mov byte [ecx], al
cmp edi, ebp
jb 0x100cc621
mov dword [esi + 0x70], ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x100d1c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.10022920
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x100d1cb8
call fcn.1002efd0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.1002f0d0
push 0
push 0x78
push 4
call fcn.1002f180
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.100d19c0
add esp, 4
test eax, eax
jne 0x100d1cf4
call fcn.1002efd0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.1002f0d0
push 0
push 0xb2
push 4
call fcn.1002f180
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.10033290
push esi
call fcn.10033030
push esi
mov dword [esp + 0x2c], eax
call fcn.10033030
push esi
mov ebp, eax
call fcn.10033030
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x100d1e24
test ebp, ebp
je 0x100d1e31
test ebx, ebx
je 0x100d1e24
push 4
push ebp
call fcn.100329c0
push 4
push ebx
call fcn.100329c0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x100d1d5e
call fcn.10032880
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x100d1d6c
call fcn.10032880
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x100d1e20
cmp dword [esi + 0x24], 0
je 0x100d1e20
push 4
push eax
call fcn.100329c0
push 4
push dword [esi + 0x24]
call fcn.100329c0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.101319e0
add esp, 0x3c
test eax, eax
je 0x100d1e20
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.101319e0
add esp, 0x2c
test eax, eax
je 0x100d1e20
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.100d1950
add esp, 0x10
test eax, eax
js 0x100d1e20
je 0x100d1dc0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.100d1950
add esp, 0x10
test eax, eax
js 0x100d1e20
je 0x100d1dc0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
test ebp, ebp
je 0x100d1e31
push ebp
call fcn.10031e80
add esp, 4
test ebx, ebx
je 0x100d1e3e
push ebx
call fcn.10031e80
add esp, 4
push dword [esp + 0x20]
call fcn.10031e80
push esi
call fcn.10032f30
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x100df1c0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
push ebp
push esi
push edi
je 0x100df34c
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
inc ebp
push esi
push dword [esp + 0x2c]
shr ebp, 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebp
push edi
push dword [esp + 0x28]
call fcn.100deff0
add esp, 0x1c
test eax, eax
je 0x100df374
push ebx
push 0x186
push str.providersimplementationskdfs_tls1_prf.c
push esi
call fcn.1002eab0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x100df24a
call fcn.1002efd0
push str.tls1_prf_alg
push 0x187
push str.providersimplementationskdfs_tls1_prf.c
call fcn.1002f0d0
push ebx
push 0xc0100
push 0x39
call fcn.1002f180
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
push ebx
push dword [esp + 0x30]
sub edi, ebp
push dword [esp + 0x30]
add edi, dword [esp + 0x30]
push ebp
push edi
push dword [esp + 0x30]
call fcn.100deff0
add esp, 0x1c
test eax, eax
jne 0x100df287
push 0x18d
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.1002eb90
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
xor edi, edi
test esi, esi
je 0x100df32e
mov edx, dword [esp + 0x2c]
cmp esi, 0x40
jb 0x100df30d
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, ebx
add ecx, esi
cmp edx, eax
ja 0x100df2ac
cmp ecx, ebx
jae 0x100df30d
mov ecx, esi
mov ebp, ebx
and ecx, 0xffffffc0
mov eax, edx
sub ebp, edx
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx + edi + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ebx + edi + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [ebx + edi + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x100df2c0
cmp edi, esi
jae 0x100df32e
mov ebp, ebx
lea ecx, [edi + edx]
sub ebp, edx
mov edx, esi
sub edx, edi
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x100df320
push 0x192
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.1002eb90
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x28]
call fcn.100deff0
add esp, 0x1c
test eax, eax
jne 0x100df37a
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebp
ret
Function at 0x100e5860
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x100e58c3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x100e58c3
push ebx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x14]
cmp edx, eax
mov ebx, eax
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x100e5896
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x1c], al
inc ecx
cmp ecx, ebx
jb 0x100e5887
mov eax, dword [edi + 0x14]
cmp edx, eax
jbe 0x100e58c1
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor ecx, ecx
test edx, edx
je 0x100e58c1
nop dword [eax]
mov eax, dword [edi + 0x14]
add eax, ecx
mov al, byte [eax + esi]
xor byte [edi + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x100e58b0
pop edi
pop ebx
pop esi
ret
Function at 0x100e5b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.10022920
mov eax, dword [0x101fd024]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x100e5ba0
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x100e5bc7
lea edi, [edx + 0x20]
jmp 0x100e5bf2
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x100e5bd1
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.10073930
add esp, 0x14
test eax, eax
je 0x100e5d09
cmp dword [esp + 0x14], edi
jne 0x100e5d09
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.10146360
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x100e5c9f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x100e5c5f
test ecx, ecx
jne 0x100e5c5f
test eax, eax
je 0x100e5c82
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.100e58d0
add esp, 0x1c
test eax, eax
je 0x100e5d09
test edi, edi
je 0x100e5cc2
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.100e5860
add esp, 0xc
jmp 0x100e5cc2
push dword [esp + 0x90]
push ebp
push esi
call fcn.100e5860
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.100e5860
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.10073900
add esp, 0x18
test eax, eax
je 0x100e5d09
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.10073900
add esp, 0x18
test eax, eax
je 0x100e5d09
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10021a20
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10021a20
add esp, 0x74
ret
Function at 0x100e9225
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x100e916d
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.1004fda0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x100e91b4
call fcn.1002efd0
push str.ecx_gen
push 0x249
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.1002f0d0
push edi
push 0xc0100
push 0x39
call fcn.1002f180
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x100e91ff
push esi
push edi
call fcn.1004fd20
mov esi, eax
add esp, 4
test esi, esi
jne 0x100e9202
call fcn.1002efd0
push str.ecx_gen
push 0x252
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.1002f0d0
push esi
push 0xc0100
push 0x39
call fcn.1002f180
add esp, 0x18
push edi
call fcn.1004fd40
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.100906e0
add esp, 0x10
test eax, eax
jle 0x100e91f3
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x100e921e
jmp dword [eax*4 + 0x100e929c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.100a15b0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.100aa670
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.100a0f60
jmp 0x100e9287
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.100a8b20
add esp, 0x10
test eax, eax
je 0x100e91f3
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x10113690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10022920
mov eax, dword [0x101fd024]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
push esi
mov esi, dword [ecx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test esi, esi
jns 0x101136e1
mov dword [ecx], 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10021a20
add esp, 0x28
ret
push ebx
movzx ebx, byte [eax]
push ebp
lea ebp, [eax + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x10], ebx
movzx eax, byte [edx + 6]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x28]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2b], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x10113850
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x101137f8
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call fcn.10112c80
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x10113793
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x10113850
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.10021a20
add esp, 0x28
ret
Function at 0x10115650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10022920
mov eax, dword [0x101fd024]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x24], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x10115815
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
nop dword [eax]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x101157a5
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.10115080
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x10115740
test ebp, ebp
mov ebp, dword [esp + 0x24]
je 0x101157fc
mov ecx, dword [esp + 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10021a20
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10021a20
add esp, 0x28
ret
Function at 0x10119450
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10022920
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x10119499
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x10119499
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x10119480
mov ecx, dword [esp + 0x2c]
movzx edx, byte [ecx + 0xc]
movzx eax, byte [ecx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x10119568
mov edi, ecx
nop dword [eax + eax]
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x10119546
mov edx, 0xc
mov eax, 1
nop dword [eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x10119530
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x101194d0
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x101195d6
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push ecx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x101195b7
push edx
call fcn.10119620
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x101195c4
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret