joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110804d0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
push esi
push str.kernel32
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x110804ea
pop esi
pop ebp
pop ecx
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [esp + 0x18]
mov edi, eax
push 0x11170fec
push ebx
mov dword [esp + 0x18], edi
call fcn.1113e119
add esp, 8
test eax, eax
je 0x11080536
test edi, edi
je 0x11080527
push 8
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
test edi, edi
je 0x1108055c
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1108055c
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x11080614
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x11080575
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x111c4168]
mov esi, eax
add esp, 4
test esi, esi
je 0x1108060a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1108060a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x110805a5
sub eax, edx
mov word [eax + esi], 0x5c
mov eax, esi
lea edx, [eax + 1]
jmp 0x110805c0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x110805c0
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
add ecx, 1
test al, al
jne 0x110805d2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x11080601
push 8
push 0
push esi
call eax
push esi
mov ebp, eax
call dword [0x111c416c]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
push esi
call dword [0x111c416c]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x11082910
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x2c]
mov ebx, dword [ebp]
mov ecx, dword [ebx + 0x1ec]
test ecx, ecx
push esi
push edi
mov esi, ecx
jne 0x1108292d
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.1105c900
push edx
push eax
call fcn.1105c930
mov ecx, eax
mov eax, edx
mov dword [esp + 0x24], eax
mov eax, esi
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov ecx, dword [esp + 0x14]
mov esi, edx
sbb esi, ecx
cmp dword [ebx + 0x1e0], 0
je 0x1108299a
mov edx, dword [ebp + 0x184]
mov eax, dword [ebp + 0x180]
push edx
push eax
call fcn.1105c900
push edx
push eax
call fcn.1105c930
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov ebp, edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, ebp
cmp esi, edx
jl 0x1108299a
jg 0x1108299e
cmp edi, eax
jae 0x1108299e
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x11083af0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x11083b22
push 0x2e
push esi
call fcn.1113bf30
add esp, 8
test eax, eax
je 0x11083b20
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x110855a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x111c4168]
mov edi, eax
add esp, 4
test edi, edi
jne 0x110855c5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x1108560c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x11085610
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x10], 0
jbe 0x11085670
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
add ebx, 1
call edx
add esp, 0x18
sub ebp, 1
jne 0x11085633
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x10]
pop ebp
pop ebx
jae 0x110856b3
jmp 0x11085680
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x1117178c
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x1117178d
push eax
call ecx
mov eax, dword [esp + 0x20]
add eax, 1
add esp, 0x18
cmp eax, dword [esi + 0x10]
mov dword [esp + 8], eax
jb 0x11085680
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x11086240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.11135fa0
mov eax, dword [0x111c8010]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov dword [esp + 0x3c], 0
jne 0x11086287
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.1113507a
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.1113e202
add esp, 8
test eax, eax
jl 0x11086270
mov eax, 8
call fcn.11135fa0
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.110860b0
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x11086270
push 0x11168460
push esi
call fcn.1113c651
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x40], edi
je 0x11086381
test dword [esp + 0x4e], 0x2000
je 0x11086304
cmp ebx, 0xffffffff
jne 0x110862ee
mov ebx, 0x800
push 0
push 4
push 0
push edi
call fcn.1113a419
add esp, 0x10
jmp 0x11086304
mov edi, dword [esp + 0x40]
test ebx, ebx
jle 0x11086312
cmp ebx, 0x400
mov esi, ebx
jl 0x11086317
mov esi, 0x400
push edi
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.1113b6a4
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [esp + 0x44], edi
jle 0x11086365
fild dword [esp + 0x44]
mov eax, 8
call fcn.11135fa0
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.110860b0
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x11086300
sub ebx, esi
test ebx, ebx
jg 0x11086300
mov ecx, dword [esp + 0x40]
push ecx
call fcn.11139ba5
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.11097090
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1113507a
mov esp, ebp
pop ebp
ret
Function at 0x110905d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
add ecx, 0xffffffff
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
sub ecx, 1
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x11090606
jmp dword [edx*4 + 0x11090730]
mov edi, 0xa
cmp ebx, edi
jle case.0x11090606.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
add edi, 1
cmp edi, dword [esp + 0x20]
jl 0x11090617
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x11093ad0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.11135000
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x11093b30
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.11135000
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x11095980
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.11135000
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x11099840
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.11135fa0
mov eax, dword [0x111c8010]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x110998c7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x110998c7
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.1113f02a
add esp, 0x10
test eax, eax
jge 0x1109989d
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1113507a
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.1113f02a
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x11099959
call fcn.11099700
test eax, eax
jle 0x11099959
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x1109996d
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1113507a
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.1113507a
add esp, 0x108
ret

Function at 0x110999c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x110999ea
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
add eax, 1
sub edi, 1
jne 0x110999d7
pop esi
pop ebx
movzx eax, cl
pop edi
ret

Function at 0x1109d170
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x1109d1b9
mov al, byte [edx]
test al, al
je 0x1109d1b9
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
add edx, 1
xor esi, ecx
test al, al
jne 0x1109d187
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1109f5a0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.1109ef10
mov edi, eax
add esp, 4
test edi, edi
jne 0x1109f646
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.110881e0
push 0x111851a8
push esi
push 0x111851a4
push ebx
push str.fopen_
push 5
call fcn.11088500
add esp, 0x2c
call fcn.1113b6fa
cmp dword [eax], 2
je 0x1109f625
call fcn.1113b6fa
cmp dword [eax], 6
je 0x1109f625
push 0xb8
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.110881e0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0xb6
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.110881e0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x111c467c
call fcn.11088da0
mov esi, eax
add esp, 4
test esi, esi
jne 0x1109f668
push edi
call fcn.11139ba5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.110887e0
push edi
push 1
push 0x6a
push esi
call fcn.11088b40
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x110bc700
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.11135000
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x110bdff0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x110be090
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x110d2930
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x110d2a20
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x110d29b2
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
add ecx, 1
add ecx, 1
add ecx, 1
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x11191f78]
mov byte [ecx - 3], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x11191f78]
mov byte [ecx - 2], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x11191f78]
mov byte [ecx - 1], al
and edx, 0x3f
movzx edx, byte [edx + 0x11191f78]
mov byte [ecx], dl
jmp 0x110d2a0b
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x110d29c4
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x11191f78]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x11191f78]
add ecx, 1
mov byte [ecx], al
add ecx, 1
cmp edi, 1
jne 0x110d29f6
lea edx, [edi + 0x3c]
jmp 0x110d2a03
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x11191f78]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
sub edi, 3
add ecx, 1
add ebp, 4
add esi, 3
test edi, edi
jg 0x110d2950
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x110d4bc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.11135fa0
mov eax, dword [0x111c8010]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
add edi, 0xffffffff
test eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
jne 0x110d4c1f
call fcn.1109add0
mov dword [esp + 0x10], eax
test esi, esi
jne 0x110d4c27
mov dword [esp + 0x14], eax
push eax
call fcn.1109af20
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x110d4c6b
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.110881e0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1113507a
add esp, 0x5c
ret
add eax, 1
cmp dword [esp + 0x1c], eax
jge 0x110d4c7f
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x110d4c47
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.11099fc0
add esp, 0x18
test eax, eax
je 0x110d4c56
sub edi, ebp
sub edi, 1
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.11135000
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
sub edx, esi
push ebp
lea eax, [edx + edi]
push ecx
push eax
mov byte [eax - 1], 1
call fcn.11135a80
mov ebp, dword [esp + 0x30]
push esi
push ebp
call fcn.11086120
add esp, 0x20
test eax, eax
jle 0x110d4c56
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.1108a720
add esp, 0xc
test eax, eax
mov dword [esp + 0x10], eax
jne 0x110d4d1c
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x110d4c47
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.110d4a40
add esp, 0x14
test eax, eax
jl 0x110d4d6a
test edi, edi
jle 0x110d4d51
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
nop
mov dl, byte [eax + ebp]
xor byte [eax], dl
add eax, 1
sub ecx, 1
jne 0x110d4d40
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.110d4a40
add esp, 0x14
test eax, eax
jge 0x110d4d8c
mov edx, dword [esp + 0x10]
push edx
call fcn.1108a920
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1113507a
add esp, 0x5c
ret
test esi, esi
jle 0x110d4da5
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x110d4d98
mov eax, dword [esp + 0x10]
push eax
call fcn.1108a920
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1113507a
add esp, 0x5c
ret
Function at 0x110d5c40
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x110d5d0d
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x110d5c61
cmp al, 0x6b
jne 0x110d5d0d
cmp al, 0x6b
lea edx, [ecx + 1]
jne 0x110d5cce
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x110d5c85
mov al, byte [edx]
add edx, 1
cmp al, 0xba
je 0x110d5c85
cmp al, 0xbb
jne 0x110d5cae
add ecx, 1
cmp ecx, esi
jl 0x110d5c71
sub esi, ecx
test ecx, ecx
jne 0x110d5cd1
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.110881e0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.110881e0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x110d5cfa
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.110881e0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.11135a80
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.110881e0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x110d9f70
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x110d9f82
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.11086aa0
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
test ebx, ebx
mov dword [eax], esi
je 0x110da043
mov eax, dword [edi + 0x10c]
cmp eax, esi
push ebp
jne 0x110d9fd4
test esi, esi
jle 0x110da022
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
add eax, 1
mov byte [ecx], dl
add ecx, 1
sub ebp, 1
jne 0x110d9fc0
jmp 0x110da022
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x110d9ffb
add ecx, 0xffffffff
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.11135000
add esp, 0xc
test esi, esi
jle 0x110da022
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
lea esp, [esp]
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
add eax, 1
mov byte [ecx], dl
add ecx, 1
sub ebp, 1
jne 0x110da010
push esi
push ebx
push ebx
push edi
call fcn.1109aed0
add esp, 0x10
test eax, eax
pop ebp
jne 0x110da043
push esi
push ebx
call fcn.11097090
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret