joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bc810
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.100a7a90
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
movzx ecx, byte [eax + 0xf]
mov esi, dword [esp + 0x28]
mov ebp, ecx
and ecx, 0xf
mov dword [esp + 0x24], 0
add ecx, ecx
and ebp, 0xfffffff0
push edi
mov ebx, dword [esi + ecx*8]
mov edi, dword [esi + ecx*8 + 4]
mov edx, dword [esi + ecx*8 + 8]
mov ecx, dword [esi + ecx*8 + 0xc]
mov esi, edx
shrd edx, ecx, 4
and esi, 0xf
mov dword [esp + 0x14], ebx
or dword [esp + 0x28], edx
shl dword [esp + 0x14], 0x1c
shrd ebx, edi, 4
mov edx, dword [esi*4 + 0x10188268]
mov esi, dword [esp + 0x2c]
shr ecx, 4
or dword [esp + 0x14], ecx
xor ecx, ecx
shr edi, 4
xor ecx, ebx
xor ecx, dword [esi + ebp]
xor edx, edi
xor edx, dword [esi + ebp + 4]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor edi, dword [esi + ebp + 8]
xor ebx, dword [esi + ebp + 0xc]
mov dword [esp + 0x18], edx
mov edx, 0xe
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
nop dword [eax + eax]
movzx edx, byte [edx + eax]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, edx
shr ecx, 4
and edx, 0xf
mov dword [esp + 0x20], ecx
add edx, edx
mov ecx, edi
shl ebp, 0x1c
shrd edi, ebx, 4
and ecx, 0xf
mov dword [esp + 0x28], 0
shr ebx, 4
or esi, edi
or ebp, ebx
xor edi, edi
mov ebx, dword [ecx*4 + 0x10188268]
mov ecx, dword [esp + 0x18]
shrd dword [esp + 0x10], ecx, 4
xor edi, dword [esp + 0x10]
shr ecx, 4
xor ebx, ecx
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx + edx*8 + 4]
xor ebp, dword [ecx + edx*8 + 0xc]
xor edi, dword [ecx + edx*8]
xor esi, dword [ecx + edx*8 + 8]
mov edx, edi
shrd edi, ebx, 4
mov ecx, esi
shl edx, 0x1c
shrd esi, ebp, 4
and ecx, 0xf
shr ebx, 4
or dword [esp + 0x28], esi
shr ebp, 4
or edx, ebp
xor ebp, ebp
mov ecx, dword [ecx*4 + 0x10188268]
xor ebp, edi
xor ecx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov ebx, ebp
add edx, edx
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x2c]
xor ebx, dword [ebp + edx*8]
xor ecx, dword [ebp + edx*8 + 4]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x28]
xor ebx, dword [ebp + edx*8 + 8]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x14]
xor ebx, dword [ebp + edx*8 + 0xc]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
sub edx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jns 0x100bc8b0
mov edx, dword [esp + 0x18]
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov byte [eax + 3], dl
mov edx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 6], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + 8], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 9], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 0xa], cl
mov byte [eax + 7], dl
mov edx, edi
mov ecx, edx
mov byte [eax + 0xb], bl
shr ecx, 0x18
mov byte [eax + 0xc], cl
mov ecx, edx
shr ecx, 0x10
pop edi
mov byte [eax + 0xd], cl
mov ecx, edx
pop esi
shr ecx, 8
pop ebp
mov byte [eax + 0xe], cl
mov byte [eax + 0xf], dl
pop ebx
add esp, 0x14
ret
Function at 0x100c97f0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.100a9430
add esp, 8
test esi, esi
jg 0x100c9847
je 0x100c9829
cmp esi, 0xffffffff
jne 0x100c9847
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.100c9a30
add esp, 4
test eax, eax
je 0x100c9847
push 0xa
push edi
call fcn.100a9b00
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x100d47f0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.100f9110
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.10153e70
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x100d48a7
push 0x4a
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.100ad240
push 0x1019fd74
push esi
push 0x1019fd78
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.100aca30
add esp, 0x2c
call fcn.1015ac3d
cmp dword [eax], 2
je 0x100d4889
call fcn.1015ac3d
cmp dword [eax], 6
je 0x100d4889
push 0x53
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.100ad240
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x51
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.100ad240
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x1019fd24
call fcn.100a9820
mov esi, eax
add esp, 4
test esi, esi
jne 0x100d48c9
push edi
call fcn.101619e2
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.100a9430
push edi
push ebx
push 0x6a
push esi
call fcn.100a9460
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x100d50a0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x100d518c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x100d511d
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x100d5171
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x100d5131
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x100d515b
lea eax, [esi + 0x3c]
jmp 0x100d5168
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x100d50c0
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x100dd3f0
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.100a7a90
mov eax, dword [0x101e3070]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100dd466
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x100dd45a
mov eax, 8
call fcn.100a7a90
movsd xmm0, qword [0x101a1490]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.100adcd0
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100dd4ca
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x100dd4be
mov eax, 8
call fcn.100a7a90
movsd xmm0, qword [0x101a1490]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.100adcd0
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.100dd550
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.100a7a90
movsd xmm0, qword [0x101d94c8]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call fcn.100adcd0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.100a7a90
movsd xmm0, qword [0x101d94c8]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call fcn.100adcd0
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.100a66bf
add esp, 0x6c
ret
Function at 0x100e34e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, 2
je 0x100e353c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100e352d
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
call fcn.100d0610
add esp, 0x10
cmp dword [esp + 0x1c], 0xffffffff
je 0x100e352d
push 0x2f
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.100ad240
add esp, 0x14
xor eax, eax
pop edi
pop ebx
ret
test edi, edi
je 0x100e3538
cmp dword [esp + 0x18], 0x20
je 0x100e353c
push 0x35
jmp 0x100e3512
push esi
push 0x3a
push str.cryptoececx_meth.c
push 0x24
call fcn.100ac560
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100e3572
push 0x3c
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.100ad240
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebx
ret
test ebx, ebx
jne 0x100e3589
push dword [esp + 0x1c]
push edi
push esi
call fcn.101544a0
add esp, 0xc
jmp 0x100e3635
push 0x43
push str.cryptoececx_meth.c
push 0x20
call fcn.100c4c40
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
jne 0x100e35cc
push 0x45
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.100ad240
push 0x46
push str.cryptoececx_meth.c
push esi
call fcn.100ac320
add esp, 0x20
xor eax, eax
pop esi
pop edi
pop ebx
ret
cmp ebx, 2
jne 0x100e361b
push 0x20
push eax
call fcn.100add50
add esp, 8
test eax, eax
jg 0x100e3605
push 0x4b
push str.cryptoececx_meth.c
push dword [esi + 0x20]
call fcn.100c4c30
push 0x4c
push str.cryptoececx_meth.c
push esi
call fcn.100ac320
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x20]
and byte [eax], 0xf8
mov eax, dword [esi + 0x20]
and byte [eax + 0x1f], 0x7f
mov eax, dword [esi + 0x20]
or byte [eax + 0x1f], 0x40
jmp 0x100e3629
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
push dword [esi + 0x20]
push esi
call fcn.10103290
add esp, 8
push esi
push 0x40a
push dword [esp + 0x18]
call fcn.100b25a0
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x100ef3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x100ef3d1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100ef3d8
add edx, 4
add esi, 4
sub ecx, 4
jae 0x100ef3c0
xor edi, edi
cmp ecx, 0xfffffffc
je 0x100ef413
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x100ef413
cmp ecx, 0xfffffffd
je 0x100ef413
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x100ef413
cmp ecx, 0xfffffffe
je 0x100ef413
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x100ef413
cmp ecx, 0xffffffff
je 0x100ef413
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x100ef42e
push 0x157
push str.cryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.100ac610
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x100ef44d
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x100ef44d
inc ecx
inc edx
cmp ecx, ebx
jl 0x100ef440
lea edx, [ebx - 1]
test edx, edx
js 0x100ef471
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x100ef471
cmp byte [eax], 0xff
jne 0x100ef471
dec eax
sub edx, 1
jns 0x100ef460
cmp ecx, edx
jl case.0x100ef49d.2
jle 0x100ef483
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x100ef49d.2
movzx eax, byte [eax + 0x100ef510]
jmp dword [eax*4 + 0x100ef4f0]
mov eax, 7
jmp 0x100ef4d3
mov eax, 6
jmp 0x100ef4d3
mov eax, 5
jmp 0x100ef4d3
mov eax, 4
jmp 0x100ef4d3
mov eax, 3
jmp 0x100ef4d3
mov eax, 2
jmp 0x100ef4d3
mov eax, 1
test dl, dh
jne case.0x100ef49d.2
and bl, dl
cmp bl, dl
jne case.0x100ef49d.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x10103290
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x11c
call fcn.100a7a90
mov eax, dword [0x101e3070]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x124]
push esi
mov esi, dword [esp + 0x124]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movups xmmword [esp + 0xdc], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movups xmmword [esp + 0xcc], xmm0
mov byte [esp + 0xcc], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [esp + 0xeb], al
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.10105d60
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x84]
lea eax, [ecx + edx]
sub edx, ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0xfc], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0xd4], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x100], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 0xd8], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x104], edx
mov edx, dword [esp + 0x90]
mov dword [esp + 0xdc], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x108], edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0xe0], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x10c], edx
mov edx, dword [esp + 0x98]
mov dword [esp + 0xe4], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x110], edx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0xe8], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x114], edx
mov edx, dword [esp + 0xa0]
mov dword [esp + 0xec], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x118], edx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0xf0], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x11c], edx
mov edx, dword [esp + 0xa8]
mov dword [esp + 0xf4], eax
lea eax, [edx + ecx]
sub edx, ecx
mov dword [esp + 0xf8], eax
mov dword [esp + 0x120], edx
lea eax, [esp + 0xfc]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10103a30
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xe0]
push eax
push eax
call fcn.10103cb0
lea eax, [esp + 0xe8]
push eax
push esi
call fcn.10105510
mov ecx, dword [esp + 0x140]
add esp, 0x24
pop esi
xor ecx, esp
call fcn.100a66bf
add esp, 0x11c
ret
Function at 0x10110aa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100a7a90
push esi
mov esi, dword [esp + 0xc]
push esi
call fcn.100b1bc0
add esp, 4
cmp eax, 0x72
jne 0x10110bfd
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push ebp
push edi
mov edi, dword [esp + 0x2c]
mov ebp, eax
push edi
push esi
push dword [esp + 0x2c]
and eax, 1
shr ebp, 1
push dword [esp + 0x2c]
add eax, ebp
push eax
push dword [esp + 0x2c]
mov dword [esp + 0x24], eax
call fcn.100d53b0
push eax
call fcn.10110830
add esp, 0x1c
test eax, eax
jne 0x10110b02
pop edi
pop ebp
pop esi
pop ecx
ret
push ebx
push 0xf8
push str.cryptokdf_tls1_prf.c
push edi
call fcn.100ac2f0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10110b57
mov eax, dword [esp + 0x1c]
push edi
push ebx
push dword [esp + 0x30]
add eax, ebp
push dword [esp + 0x30]
push dword [esp + 0x20]
push eax
call fcn.100d2fe0
push eax
call fcn.10110830
add esp, 0x1c
test eax, eax
jne 0x10110b5f
push 0xfd
push str.cryptokdf_tls1_prf.c
push edi
push ebx
call fcn.100ac3f0
add esp, 0x10
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
pop ecx
ret
xor edx, edx
test edi, edi
je 0x10110bde
cmp edi, 0x20
jb 0x10110bbb
lea eax, [edi - 1]
lea ecx, [esi - 1]
add eax, ebx
add ecx, edi
cmp esi, eax
ja 0x10110b7c
cmp ecx, ebx
jae 0x10110bbb
mov ecx, edi
mov ebp, ebx
and ecx, 0xffffffe0
mov eax, esi
sub ebp, esi
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + edx + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x10110b90
cmp edx, edi
jae 0x10110bde
mov ebp, ebx
lea ecx, [edx + esi]
sub ebp, esi
mov esi, edi
sub esi, edx
nop word [eax + eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x10110bd0
push 0x102
push str.cryptokdf_tls1_prf.c
push edi
push ebx
call fcn.100ac3f0
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop ebp
pop esi
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call fcn.10110830
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
pop ecx
ret
Function at 0x1011c280
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, 0x400
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, 0x80
mov esi, edx
mov ecx, edi
mov byte [ebp], 0
cmp dword [esp + 0x18], ecx
cmovle ecx, dword [esp + 0x18]
test eax, eax
cmovg esi, eax
cmp esi, edx
cmovg esi, edx
mov dword [esp + 0x14], esi
test ecx, ecx
jle 0x1011c2d5
mov ebx, dword [esp + 0x1c]
mov edx, ebp
sub ebx, ebp
mov esi, ecx
mov al, byte [ebx + edx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub esi, 1
jne 0x1011c2c3
mov esi, dword [esp + 0x14]
movzx ebx, byte [ecx + ebp - 1]
cmp ecx, edi
jge 0x1011c2fa
mov edx, ebp
movzx eax, byte [edx]
lea edx, [edx + 1]
add eax, ebx
movzx eax, al
movzx ebx, byte [eax + 0x101bbb80]
mov byte [ecx + ebp], bl
inc ecx
cmp ecx, edi
jl 0x1011c2e0
mov ecx, dword [esp + 0x14]
lea ebx, [esi + 7]
sar ebx, 3
neg ecx
sub edi, ebx
and ecx, 7
movzx eax, byte [edi + ebp]
lea esi, [edi + ebp]
mov edx, 0xff
sar edx, cl
and edx, eax
movzx ecx, byte [edx + 0x101bbb80]
mov byte [esi], cl
test edi, edi
je 0x1011c348
nop dword [eax + eax]
movzx eax, byte [esi + ebx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x101bbb80]
mov byte [esi], cl
sub edi, 1
jne 0x1011c330
lea esi, [ebp + 0xfc]
mov edi, 0x40
lea edx, [ebp + 0x7e]
movzx ecx, byte [edx + 1]
lea esi, [esi - 4]
movzx eax, byte [edx]
lea edx, [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
sub edi, 1
jne 0x1011c356
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1011dff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.100a7a90
mov eax, dword [0x101e3070]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x54]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x1c], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x24], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x14], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x14], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x1011e1b5
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x40]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
nop dword [eax]
dec eax
mov dword [esp + 0x48], eax
test esi, esi
jne 0x1011e145
push dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
call fcn.1011da00
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x1011e0e0
test ebp, ebp
mov ebp, dword [esp + 0x24]
je 0x1011e19c
mov ecx, dword [esp + 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100a66bf
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100a66bf
add esp, 0x2c
ret