joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1186e70
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x1187026
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x118701f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebp
sub esi, eax
jmp 0x1186f12
mov esi, dword [esp]
mov eax, esi
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, dword [esp + 0xc]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, ecx
mov edx, 0x80078071
mul edx
sub edi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov eax, ebp
not eax
and eax, esi
not esi
and ebp, esi
mov esi, 0x15b0
sub ebp, eax
je 0x118701f
xor eax, eax
cmp esi, 8
mov dword [esp], esi
jb 0x1186f8c
and esi, 0x1ff8
mov dword [esp + 4], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebx + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
mov esi, dword [esp]
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x1186f30
add ebx, edx
mov eax, dword [esp + 4]
mov edx, eax
sub edx, esi
jae 0x1186ecf
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
mov ebp, esi
and ebp, 3
mov dword [esp + 4], eax
je 0x1186fd0
neg ebp
xor eax, eax
mov edx, ebx
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x1186fb0
mov ebp, dword [esp + 4]
sub ebp, eax
cmp dword [esp + 8], 0xfffffffc
ja 0x1186ec0
jmp 0x1186fdf
mov ebp, eax
mov edx, ebx
cmp dword [esp + 8], 0xfffffffc
ja 0x1186ec0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x1186ff0
jmp 0x1186ec0
shl ecx, 0x10
or ecx, edi
jmp 0x118702b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1187040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x118709c
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x118709e
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
mov eax, dword [eax*4 + 0x11c3c50]
mov ebp, eax
and ebp, ebx
add ebx, eax
add ebp, ebp
sub ebx, ebp
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x11c3c50]
inc esi
cmp edx, esi
jne 0x1187060
not eax
jmp 0x118709e
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x118e340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x10]
test edi, edi
sets bl
mov esi, edi
sub esi, 1
sete bh
or bl, bh
mov esi, edi
sub esi, 0x25
setge bh
or bl, bh
test bl, 1
jne 0x118e373
jmp 0x118e378
jmp 0x118e4c3
movzx ebx, cl
mov esi, eax
add esi, edx
add esi, 0xffffffff
mov byte [eax + edx - 1], 0
cmp ebx, 0
jne 0x118e39a
mov eax, esi
add eax, 0xffffffff
mov byte [esi - 1], 0x30
jmp 0x118e4c1
cmp edi, 0xa
jne 0x118e42e
jmp 0x118e3a5
movzx ecx, cl
cmp ecx, 0x64
setae al
test al, 1
jne 0x118e3b4
jmp 0x118e3ee
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
shl edx, 1
mov al, byte [edx + 0x11c4761]
mov edi, esi
add edi, 0xffffffff
mov byte [esi - 1], al
mov al, byte [edx + 0x11c4760]
add edi, 0xffffffff
mov byte [esi - 2], al
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
mov esi, edi
jmp 0x118e3a5
cmp ecx, 0xa
setb al
test al, 1
jne 0x118e3fa
jmp 0x118e40b
mov cl, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov eax, esi
add eax, 0xffffffff
mov byte [esi - 1], cl
jmp 0x118e429
shl ecx, 1
mov dl, byte [ecx + 0x11c4761]
mov eax, esi
add eax, 0xffffffff
mov byte [esi - 1], dl
mov cl, byte [ecx + 0x11c4760]
add eax, 0xffffffff
mov byte [esi - 2], cl
jmp 0x118e4c1
cmp edi, 0x10
je 0x118e435
jmp 0x118e494
movzx ecx, cl
jmp 0x118e43a
cmp ecx, 0x10
setl al
jmp 0x118e442
test al, 1
jne 0x118e448
jmp 0x118e459
mov cl, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov eax, esi
add eax, 0xffffffff
mov byte [esi - 1], cl
jmp 0x118e4c1
mov eax, ecx
and eax, 0xfffffffd
mov edx, ecx
or edx, 0xfffffffd
xor edx, 0xffffffff
imul edx, eax
mov eax, ecx
and eax, 2
or ecx, 2
imul ecx, eax
add ecx, edx
mov dl, byte [ecx + 0x11c482a]
mov eax, esi
add eax, 0xffffffff
mov byte [esi - 1], dl
mov cl, byte [ecx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add eax, 0xffffffff
mov byte [esi - 2], cl
jmp 0x118e4c1
movzx ecx, cl
cmp ecx, 0
jbe 0x118e4bd
mov eax, ecx
xor edx, edx
div edi
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov ebx, esi
add ebx, 0xffffffff
mov byte [esi - 1], al
mov eax, ecx
xor edx, edx
div edi
mov ecx, eax
mov esi, ebx
jmp 0x118e494
mov eax, esi
jmp 0x118e4c1
jmp 0x118e4c3
pop esi
pop edi
pop ebx
ret
Function at 0x118f960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x11cc088]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x118fa0e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x11c7080]
xor eax, eax
jmp 0x119004f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1191310
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x11c7880]

Function at 0x11928c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x140
mov word [esp + 0x90], 0x4bd1
mov dword [esp + 0x92], 0
mov byte [esp + 0x96], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x119293f
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x90]
mov edx, eax
xor edx, 0x87779bf3
and eax, 0x7779bf3
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x44]
add al, 0x41
mov ecx, dword [esp]
mov byte [esp + ecx + 0x90], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x1192900
lea eax, [esp + 0x90]
push eax
push dword [ebp + 8]
call fcn.01184680
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x11c7958]
xor edi, edi
mov dword [esp + 0x120], esi
jmp 0x119297f
push esi
call fcn.01184bd0
add esp, 4
xor ecx, ecx
cmp edi, eax
setb cl
mov al, 1
jmp dword [ecx*4 + 0x11c7970]
mov ecx, dword [case.0x119295b.5]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x119a010
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x119a030
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x119a050
sar ebp, 1
sar eax, 1
lea ecx, [eax + ebp]
add ecx, 2
test ecx, ecx
jns 0x119a070
mov eax, 0xffffffff
jmp 0x119a079
add eax, ebp
lea eax, [eax*2 + 4]
push eax
call fcn.0118c9f0
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x119a0b1
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x119a0a0
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [edi]
test cx, cx
je 0x119a0e1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x119a0d0
mov word [ebx], 0
lea ecx, [esp + 0xc]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x24], eax
push eax
call fcn.011c1960
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x11c7ef0]
Function at 0x119a3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaa8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x119a3d0
sar esi, 1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x11cd3c0]
mov ebx, dword [esp + 0x28]
mov edi, 0xffffffff
test ebx, ebx
jns 0x119a404
mov eax, 0xffffffff
jmp 0x119a407
lea eax, [ebx + ebx]
push eax
call fcn.0118c9f0
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x11cd3c0]
mov eax, dword [esp + 0x28]
mov ecx, eax
add ecx, 0xd
js 0x119a439
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0118c9f0
add esp, 4
mov edi, eax
mov dword [esp + 0x1f8], 0x23de21cc
mov dword [esp + 0x1fc], 0x27b525c5
mov dword [esp + 0x200], 0xdbfad94c
mov dword [esp + 0x204], 0xdf3bdd2a
mov dword [esp + 0x208], 0xd341d142
mov dword [esp + 0x20c], 0xd749d54d
mov dword [esp + 0x210], 0xcbcac956
mov word [esp + 0x214], 0
mov byte [esp + 0x216], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
cmp eax, 0x1e
ja 0x119a517
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
movzx ecx, byte [esp + ecx + 0x1f8]
mov edx, eax
xor edx, 0x91a4f6f8
and eax, 0x11a4f6f8
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x698], eax
mov eax, dword [esp + 0x698]
mov ecx, eax
xor ecx, 0xd8
and eax, 0x27
add eax, eax
sub eax, ecx
mov ecx, dword [esp + 0x48]
mov byte [esp + ecx + 0x1f8], al
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0x1f
jb 0x119a4c0
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x119a541
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, edi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x119a530
mov word [eax], 0
movzx ecx, word [esp + 0x1f8]
test cx, cx
je 0x119a571
lea edx, [esp + 0x1fa]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x119a560
mov word [eax], 0
lea eax, [esp + 0x638]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.011c1960
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x11c81f4]
Function at 0x11a0860
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x11a0880
cmp eax, 0xffffffdd
jge 0x11a0897
mov eax, 0xffffffff
jmp 0x11a089a
add eax, 0x22
push eax
call fcn.0118c9f0
add esp, 4
mov esi, eax
mov dword [esp + 8], 0x4fd949a4
mov dword [esp + 0xc], 0x43d14dd8
mov dword [esp + 0x10], 0x47a741d6
mov dword [esp + 0x14], 0x7b9f45df
mov dword [esp + 0x18], 0x7f9a7994
mov dword [esp + 0x1c], 0x73e87d99
mov dword [esp + 0x20], 0x77e37191
mov dword [esp + 0x24], 0x6bfe75e8
mov word [esp + 0x28], 0x6968
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x11a093e
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x7c759192
xor eax, ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
add al, 0x26
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x11a0910
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x11a0961
add ecx, 2
mov eax, esi
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x11a0950
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x11a0991
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x11a0980
mov word [eax], 0
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x5c], eax
mov dword [esp + 8], 0x631d611d
mov dword [esp + 0xc], 0x675b65ee
mov dword [esp + 0x10], 0x7bf2791d
mov dword [esp + 0x14], 0x7f1b7d08
mov dword [esp + 0x18], 0x7301710e
mov dword [esp + 0x1c], 0x7709750d
mov dword [esp + 0x20], 0x8bb189f6
mov dword [esp + 0x24], 0x8fb58db7
mov dword [esp + 0x28], 0x83ec81ba
mov dword [esp + 0x2c], 0x87f585f1
mov dword [esp + 0x30], 0x9be899fd
mov dword [esp + 0x34], 0x9fe19ddf
mov dword [esp + 0x38], 0x93e691ee
mov dword [esp + 0x3c], 0x971e95f1
mov dword [esp + 0x40], 0xabf3a9dc
mov dword [esp + 0x44], 0xafe3adc8
mov dword [esp + 0x48], 0xa3a2a19a
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x43
ja 0x11a0a81
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x5f09b6e8
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x78
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x44
jb 0x11a0a50
lea eax, [esp + 0x4c]
lea ecx, [esp + 8]
push eax
push 0x11a0d30
push ecx
push esi
call fcn.011a14c0
add esp, 0x10
mov ebx, eax
jmp dword [0x11c86f0]
Function at 0x11a0bfb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x11a0bf0
cmp eax, 0xffffffed
jge 0x11a0c07
mov eax, 0xffffffff
jmp 0x11a0c0a
add eax, 0x12
push eax
call fcn.0118c9f0
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x23b921cc
mov dword [esp + 8], 0x27af25c1
mov dword [esp + 0xc], 0xdb04d90c
mov dword [esp + 0x10], 0xdf3cdd38
mov dword [esp + 0x14], 0xd1d0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x14
ja 0x11a0c99
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x9e990d78
and eax, 0x1e990d78
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xa8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x15
jb 0x11a0c60
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x11a0cc1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x11a0cb0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x11a0cf1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x11a0ce0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.011c1b10
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x11c8708]

Function at 0x11a1310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x6c]
movzx ecx, byte [esp + 0x68]
mov dword [esp + 0x30], ebp
mov byte [esp + 0x34], cl
mov dword [esp + 0x38], eax
test ebp, ebp
setg al
and al, cl
movzx eax, al
jmp dword [eax*4 + 0x11c87e8]
Function at 0x11a7750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [esp + 4]
call fcn.011a7770
add esp, 4
test al, al
je 0x11a7fb0
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
push eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x2c], eax
push eax
mov dword [ebp - 0x40], esp
sub esp, 0xc
mov dword [ebp - 0x30], esp
sub esp, 0x2c
mov edi, esp
sub esp, 0x30
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x3c], esp
sub esp, 0x20
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x20], esp
sub esp, 0x44
mov dword [ebp - 0x44], esp
sub esp, 0x44
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x68], esp
push eax
mov dword [ebp - 0x50], esp
sub esp, 0x28
mov dword [ebp - 0xc4], esp
sub esp, 8
mov dword [ebp - 0x64], esp
sub esp, 8
mov dword [ebp - 0xc8], esp
sub esp, 8
mov dword [ebp - 0x4c], esp
sub esp, 0x24
mov dword [ebp - 0x54], esp
add eax, 0x18
mov dword [ebp - 0x38], eax
xor esi, esi
mov dword [ebp - 0x18], 0x20219
mov eax, 1
jmp dword [eax*4 + 0x11c968c]
Function at 0x11ac2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp esi, 0x24
ja 0x11ac31b
cmp esi, 1
je 0x11ac31b
mov edi, dword [esp + 0x34]
mov ebp, edi
jmp 0x11ac2f1
inc ebp
movzx eax, byte [ebp]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x11ac2f0
cmp ecx, 0x20
je 0x11ac2f0
cmp ecx, 0x2b
mov edx, esi
je 0x11ac311
cmp ecx, 0x2d
jne 0x11ac330
cmp al, 0x2b
sete byte [esp + 3]
inc ebp
jmp 0x11ac335
xor edi, edi
test eax, eax
je 0x11ac4e7
mov dword [eax], 0x16
jmp 0x11ac4e7
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], edi
jle 0x11ac360
cmp edx, 0x10
jne 0x11ac379
cmp byte [ebp], 0x30
jne 0x11ac359
movzx eax, byte [ebp + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebp, [ebp + ecx*2]
mov edi, 0x10
jmp 0x11ac37b
xor eax, eax
xor ecx, ecx
cmp byte [ebp], 0x30
setne al
sete cl
add ebp, ecx
lea edi, [eax*2 + 8]
jmp 0x11ac37b
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x18], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x1c], eax
xor ebx, ebx
xor esi, esi
mov edx, edi
mov dword [esp + 0x10], edi
inc ebp
jmp 0x11ac3ce
mov ebx, ecx
mov esi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x11ac484
mov dword [eax], 0x22
mov dword [esp + 4], ebp
inc ebp
mov edi, ebx
movsx ebx, byte [ebp - 1]
lea eax, [ebx - 0x30]
cmp eax, 0xa
jae 0x11ac3f0
and ebx, 0xf
cmp ebx, edx
jl 0x11ac412
jmp 0x11ac4b2
mov eax, ebx
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp eax, 0x1a
jae 0x11ac4b2
or bl, 0x20
movsx ebx, bl
add ebx, 0xffffffa9
cmp ebx, edx
jge 0x11ac4b2
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x11ac3b0
mov dword [esp + 0x14], ebp
mov eax, edi
mul edx
xor ebp, ebp
cmp dword [esp + 0x1c], edi
mov edi, 0
sbb edi, esi
setae cl
jae 0x11ac440
xor edx, edx
mov eax, dword [esp + 8]
jmp 0x11ac447
imul esi, dword [esp + 0x10]
add edx, esi
mov esi, ebx
sar esi, 0x1f
mov edi, dword [esp + 8]
sub edi, ebx
sbb ebp, esi
add ebx, eax
adc esi, edx
cmp edi, eax
mov edi, dword [esp + 8]
sbb ebp, edx
setae al
jae 0x11ac469
xor esi, esi
mov ebx, edi
and cl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x10]
je 0x11ac499
test cl, cl
jne 0x11ac499
mov ebp, dword [esp + 0x14]
jmp 0x11ac3c3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebp
mov ebx, ecx
xor esi, esi
jmp 0x11ac3a9
test cl, cl
jne 0x11ac4a5
mov dword [esp + 0xc], 0x22
mov ebp, dword [esp + 0x14]
mov dword [esp + 4], ebp
jmp 0x11ac3a9
mov eax, dword [esp + 0x38]
test eax, eax
je 0x11ac4c0
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x11ac4ce
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x11ac4de
mov edi, SysReAllocString
sub edi, dword [esp + 0x18]
jmp 0x11ac4e7
cmp byte [esp + 3], 0
jne 0x11ac4e7
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret