joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11004940
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
test ebp, ebp
je 0x11004afe
mov esi, dword [esp + 0x10]
test esi, esi
je 0x11004afe
push ebx
push edi
call fcn.110d4566
mov dword [eax], 0
mov eax, dword [ebp]
test eax, eax
jne 0x11004ab7
mov eax, esi
xor ebx, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x11004980
sub eax, edx
mov edi, eax
jne 0x1100499f
call fcn.110d4566
mov dword [eax], 2
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret
push 0x244
call fcn.110d3726
add esp, 4
mov dword [ebp], eax
test eax, eax
je 0x110049ef
push 0x244
push 0
push eax
call fcn.110d3e90
add esp, 0xc
cmp byte [edi + esi - 1], 0x2a
je 0x11004a68
lea eax, [edi + 3]
push eax
call fcn.110d3726
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x11004a01
mov ecx, dword [ebp]
push ecx
call fcn.110d342e
add esp, 4
mov dword [ebp], ebx
call fcn.110d4566
pop edi
pop ebx
pop esi
mov dword [eax], 0xc
xor eax, eax
pop ebp
ret
mov al, byte [edi + esi - 1]
cmp al, 0x2f
je 0x11004a40
cmp al, 0x5c
je 0x11004a40
mov edx, ebx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x11004a13
mov eax, ebx
dec eax
lea esi, [eax + 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x11004a23
mov dx, word [0x110e8ab4]
mov word [eax], dx
mov cl, byte [0x110e8ab6]
mov byte [eax + 2], cl
jmp 0x11004a68
mov edx, ebx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x11004a46
mov edi, ebx
dec edi
lea esi, [edi + 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x11004a56
mov dx, word [0x110e8ab0]
mov word [edi], dx
mov eax, dword [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebp]
mov dword [ecx + 0x140], eax
test ebx, ebx
je 0x11004a89
push ebx
call fcn.110d342e
add esp, 4
mov eax, dword [ebp]
cmp dword [eax + 0x140], 0xffffffff
jne 0x11004acd
push eax
call fcn.110d342e
add esp, 4
mov dword [ebp], 0
call fcn.110d4566
pop edi
pop ebx
pop esi
mov dword [eax], 0x16
xor eax, eax
pop ebp
ret
mov edx, dword [eax + 0x140]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x11004998
mov eax, dword [ebp]
lea ecx, [eax + 0x2c]
push 0xff
push ecx
add eax, 0x144
push eax
call fcn.110d4400
mov edx, dword [ebp]
add esp, 0xc
pop edi
pop ebx
mov byte [edx + 0x243], 0
mov eax, dword [ebp]
pop esi
add eax, 0x144
pop ebp
ret
call fcn.110d4566
pop esi
mov dword [eax], 0x16
xor eax, eax
pop ebp
ret
Function at 0x11005b70
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.110d3e90
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x11007ca0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.110d3e90
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x11007dc0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.110d3e90
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x11007e20
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.110d3e90
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret

Function at 0x11008260
Capabilities:
Hash data using sha224

Disassembly:
mov eax, 0x70
call fcn.110d22e0
push esi
mov esi, dword [esp + 0x80]
test esi, esi
jne 0x1100827b
mov esi, 0x111454ac
push 0x70
lea eax, [esp + 8]
push 0
push eax
call fcn.110d3e90
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0xc1059ed8
mov dword [esp + 0x20], 0x367cd507
mov dword [esp + 0x24], 0x3070dd17
mov dword [esp + 0x28], 0xf70e5939
mov dword [esp + 0x2c], 0xffc00b31
mov dword [esp + 0x30], 0x68581511
mov dword [esp + 0x34], 0x64f98fa7
mov dword [esp + 0x38], 0xbefa4fa4
mov dword [esp + 0x88], 0x1c
call sym.LIBEAY32.dll_SHA256_Update
lea ecx, [esp + 0x1c]
push ecx
push esi
call sym.LIBEAY32.dll_SHA256_Final
lea edx, [esp + 0x24]
push 0x70
push edx
call sym.LIBEAY32.dll_OPENSSL_cleanse
add esp, 0x28
mov eax, esi
pop esi
add esp, 0x70
ret
Function at 0x11008310
Capabilities:
Hash data using sha256

Disassembly:
mov eax, 0x70
call fcn.110d22e0
push esi
mov esi, dword [esp + 0x80]
test esi, esi
jne 0x1100832b
mov esi, 0x1114548c
push 0x70
lea eax, [esp + 8]
push 0
push eax
call fcn.110d3e90
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x88], 0x20
call sym.LIBEAY32.dll_SHA256_Update
lea ecx, [esp + 0x1c]
push ecx
push esi
call sym.LIBEAY32.dll_SHA256_Final
lea edx, [esp + 0x24]
push 0x70
push edx
call sym.LIBEAY32.dll_OPENSSL_cleanse
add esp, 0x28
mov eax, esi
pop esi
add esp, 0x70
ret

Function at 0x110083e0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x11008480
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x11013ad0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.110d22e0
mov eax, dword [0x11143f70]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x11013c64
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call sym.LIBEAY32.dll_DES_set_odd_parity
lea ecx, [esp + 0x30]
push ecx
push edi
call sym.LIBEAY32.dll_DES_set_key_unchecked
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call sym.LIBEAY32.dll_DES_encrypt1
push ebp
call sym.LIBEAY32.dll_DES_set_odd_parity
lea ecx, [esp + 0x48]
push ecx
push ebp
call sym.LIBEAY32.dll_DES_set_key_unchecked
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call sym.LIBEAY32.dll_DES_encrypt1
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x11013b13
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.110d2962
add esp, 0xa0
ret
Function at 0x11013e20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.110d22e0
mov eax, dword [0x11143f70]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x11013e95
cmp ebx, dword [esi]
je 0x11013e8c
test edi, edi
je 0x11013e72
cmp dword [esp + 0xa0], eax
jge 0x11013e8c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.110d2962
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x11013e9b
mov ebx, dword [esi]
test ebx, ebx
je 0x11013e72
push ebp
test edi, edi
je 0x11013f6d
push ebx
call sym.LIBEAY32.dll_ENGINE_get_ctrl_function
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x11013ecb
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call sym.LIBEAY32.dll_OpenSSLDie
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x11013f25
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call sym.LIBEAY32.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x1101401a
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call sym.LIBEAY32.dll_EVP_DigestUpdate
add esp, 0xc
test eax, eax
je 0x1101401a
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call sym.LIBEAY32.dll_EVP_DigestFinal_ex
add esp, 0xc
test eax, eax
je 0x1101401a
jmp 0x11013f4a
cmp eax, 0x80
ja 0x1101401a
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.110d37f0
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x11013f75
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.110d3e90
add esp, 0xc
jmp 0x11013f75
test eax, eax
je 0x11014006
xor eax, eax
jmp 0x11013f80
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x11013f80
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call sym.LIBEAY32.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x1101401a
push ebx
call sym.LIBEAY32.dll_ENGINE_get_ctrl_function
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call sym.LIBEAY32.dll_EVP_DigestUpdate
add esp, 0x10
test eax, eax
je 0x1101401a
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x11013fc4
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call sym.LIBEAY32.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x1101401a
push ebx
call sym.LIBEAY32.dll_ENGINE_get_ctrl_function
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call sym.LIBEAY32.dll_EVP_DigestUpdate
add esp, 0x10
test eax, eax
je 0x1101401a
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call sym.LIBEAY32.dll_EVP_MD_CTX_copy_ex
add esp, 8
test eax, eax
jne 0x1101401e
xor eax, eax
jmp 0x11014023
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.110d2962
add esp, 0x88
ret
Function at 0x11014cb0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x11014cc2
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call sym.LIBEAY32.dll_X509_get_serialNumber
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x11014d72
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x11014d10
test esi, esi
jle 0x11014d51
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x11014d00
jmp 0x11014d51
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x11014d35
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.110d3e90
add esp, 0xc
test esi, esi
jle 0x11014d51
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x11014d43
push esi
push ebx
push ebx
push edi
call sym.LIBEAY32.dll_EVP_Cipher
add esp, 0x10
pop ebp
test eax, eax
jne 0x11014d72
push esi
push ebx
call sym.LIBEAY32.dll_OPENSSL_cleanse
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x11018f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.110d22e0
mov eax, dword [0x11143f70]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
movzx edx, byte [edi + 1]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
lea eax, [edi + 1]
movzx edx, byte [eax + 1]
mov dword [esp + 0x28], eax
inc eax
inc eax
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax]
inc eax
mov ebp, dword [esp + 0x40]
inc eax
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 1]
movzx eax, byte [eax]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x2d], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x2c], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x20], edx
mov byte [esp + 0x30], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
cmp dword [esp + 0x44], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
je 0x11019100
dec dword [esp + 0x18]
test esi, esi
jne 0x1101906c
mov ecx, dword [esp + 0x24]
push 1
push ecx
lea edx, [esp + 0x24]
push edx
call sym.LIBEAY32.dll_DES_encrypt1
mov ebx, dword [esp + 0x28]
mov eax, ebx
shr eax, 8
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x39], al
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x3c], al
shr ecx, 8
shr edx, 0x10
shr eax, 0x18
add esp, 0xc
inc dword [esp + 0x10]
mov byte [esp + 0x2c], bl
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], al
mov cl, byte [esp + esi + 0x2c]
mov eax, dword [esp + 0x3c]
xor cl, byte [eax]
inc esi
mov byte [ebp], cl
inc eax
inc ebp
and esi, 7
cmp dword [esp + 0x18], 0
mov dword [esp + 0x3c], eax
jne 0x11019008
cmp dword [esp + 0x10], 0
je 0x110190e7
mov eax, dword [esp + 0x28]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
inc eax
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
mov ecx, dword [esp + 0x20]
inc eax
shr ebx, 0x18
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
shr ecx, 0x18
mov byte [eax + 1], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.110d2962
add esp, 0x28
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.110d2962
add esp, 0x28
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.110d2962
add esp, 0x28
ret
Function at 0x1101d790
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0x80
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov byte [edi], 0
jle 0x1101d7aa
mov eax, 0x80
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jle 0x1101d7ba
cmp ecx, 0x400
jle 0x1101d7bf
mov ecx, 0x400
test eax, eax
jle 0x1101d7dc
mov esi, dword [esp + 0x18]
push ebp
mov edx, edi
sub esi, edi
mov ebp, eax
mov edi, edi
mov bl, byte [esi + edx]
mov byte [edx], bl
inc edx
sub ebp, 1
jne 0x1101d7d0
pop ebp
cmp eax, 0x80
movzx edx, byte [edi + eax - 1]
jge 0x1101d80e
mov esi, edi
sub esi, eax
lea esp, [esp]
movzx ebx, byte [esi + eax]
add ebx, edx
and ebx, 0xff
movzx edx, byte [ebx + 0x110e99d8]
mov byte [eax + edi], dl
inc eax
cmp eax, 0x80
jl 0x1101d7f0
lea edx, [ecx + 7]
neg ecx
sar edx, 3
mov eax, 0x80
and ecx, 7
sub eax, edx
lea esi, [eax + edi]
mov ebx, 0xff
sar ebx, cl
movzx ecx, byte [esi]
and ebx, ecx
movzx ecx, byte [ebx + 0x110e99d8]
mov byte [esi], cl
test eax, eax
je 0x1101d856
lea esp, [esp]
movzx ebx, byte [esi + edx - 1]
dec esi
xor ebx, ecx
movzx ecx, byte [ebx + 0x110e99d8]
dec eax
mov byte [esi], cl
test eax, eax
jne 0x1101d840
lea ecx, [edi + 0xfc]
lea eax, [edi + 0x7e]
mov edx, 0x40
movzx esi, byte [eax + 1]
movzx edi, byte [eax]
shl esi, 8
or esi, edi
and esi, 0xffff
mov dword [ecx], esi
sub ecx, 4
sub eax, 2
sub edx, 1
jne 0x1101d864
pop edi
pop esi
pop ebx
ret
Function at 0x1101e200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.110d22e0
mov eax, dword [0x11143f70]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
movzx edx, byte [edi + 1]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
lea eax, [edi + 1]
movzx edx, byte [eax + 1]
mov dword [esp + 0x28], eax
inc eax
inc eax
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax]
inc eax
mov ebp, dword [esp + 0x40]
inc eax
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 1]
movzx eax, byte [eax]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x2d], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x2c], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x20], edx
mov byte [esp + 0x30], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
cmp dword [esp + 0x44], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
je 0x1101e3ca
dec dword [esp + 0x18]
test esi, esi
jne 0x1101e33a
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
call sym.LIBEAY32.dll_RC2_encrypt
mov ebx, dword [esp + 0x24]
mov eax, ebx
shr eax, 8
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x35], al
mov eax, dword [esp + 0x28]
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x38], al
shr ecx, 8
shr edx, 0x10
shr eax, 0x18
add esp, 8
inc dword [esp + 0x10]
mov byte [esp + 0x2c], bl
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], al
mov cl, byte [esp + esi + 0x2c]
mov eax, dword [esp + 0x3c]
xor cl, byte [eax]
inc esi
mov byte [ebp], cl
inc eax
inc ebp
and esi, 7
cmp dword [esp + 0x18], 0
mov dword [esp + 0x3c], eax
jne 0x1101e2d8
cmp dword [esp + 0x10], 0
je 0x1101e3b1
mov eax, dword [esp + 0x28]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
inc eax
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
mov ecx, dword [esp + 0x20]
inc eax
shr ebx, 0x18
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
shr ecx, 0x18
mov byte [eax + 1], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.110d2962
add esp, 0x28
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.110d2962
add esp, 0x28
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.110d2962
add esp, 0x28
ret