joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x417168]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x40e546
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x418788]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x40e567
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x418788]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0040e9a0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x40e6c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417168]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x40e820
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417168]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x40e85e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x40e85e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x40e860
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40e870
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417168]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x40e8a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x417168]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x40e8c4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x40e912
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x418788]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x40e9f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417168]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40ed40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x417168]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x40608f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a74], 0
push esi
jne 0x4060c6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4060a0
mov dword [ecx*4 + 0x422a70], eax
inc ecx
cmp ecx, 0x100
jl 0x40609b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4060f7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a70]
xor eax, esi
inc ecx
dec edx
jne 0x4060d9
pop edi
not eax
pop esi
ret 0xc
Function at 0x426544
Capabilities:
Hash data with md5

Disassembly:
movzx eax, word [0x4393d6]
imul eax, eax, 0xfc40b23d
mov word [0x4393d6], ax
and dword [ecx], 0
or dword [0x438260], 0xbf7aa6df
and dword [ecx + 4], 0
mov eax, dword [0x43851c]
sub eax, 0x1a488537
xor eax, 0xc4c9c4c5
dec dword [0x43851c]
cmp eax, 0xe67193bf
je 0x42659a
cmp dword [0x437f24], 0x8300a819
je 0x42659a
add dword [0x4371e8], 0x2c842404
mov dword [ecx + 8], 0x67452301
movzx eax, word [0x439eec]
sub eax, 0x32d6e4a
mov word [0x438ee4], ax
mov dword [ecx + 0xc], 0xefcdab89
mov dword [0x43635c], 0x34d6eb65
mov dword [ecx + 0x10], 0x98badcfe
movzx eax, word [0x438ffa]
add eax, 0x63244e1
mov word [0x438ffa], ax
mov dword [ecx + 0x14], 0x10325476
movzx eax, word [0x438e6e]
imul eax, eax, 0x44c1227e
mov word [0x438e6e], ax
ret
Function at 0x421f30
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421cb0

Function at 0x432ff0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00432e6f
Function at 0x11a18c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x11a19c1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x11a19c1
push ebx
call fcn.011a8900
add esp, 4
test eax, eax
je 0x11a191a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x11a1921
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x11a1900
jmp 0x11a1923
mov esi, 0x1505
jmp 0x11a1923
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x11a19c1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x11a1954
inc ebp
dec ebx
je 0x11a19bf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x11a19bf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x11a1950
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.011a8900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x11a1950
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.011a8930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x11a1950
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x11a19bf
cmp dword [eax + 4], 2
mov edi, 0
jne 0x11a19c1
mov edi, dword [eax + 8]
jmp 0x11a19c1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11a19f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x11a1a5b
mov esi, dword [esp + 0x30]
test esi, esi
je 0x11a1a5b
push esi
call fcn.011a8900
add esp, 4
test eax, eax
je 0x11a1a3a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x11a1a41
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x11a1a20
jmp 0x11a1a43
mov ebp, 0x1505
jmp 0x11a1a43
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x11a1a67
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x11a1a84
inc ebx
dec edi
je 0x11a1a5b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x11a1a5b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x11a1a80
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.011a8900
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x11a1a80
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.011a8930
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x11a1a80
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x11a1a5b
cmp dword [eax + 4], 3
jne 0x11a1a5b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x11a1a5b
Function at 0x11a1b20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x11a1c21
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x11a1c21
push ebx
call fcn.011a8900
add esp, 4
test eax, eax
je 0x11a1b7a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x11a1b81
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x11a1b60
jmp 0x11a1b83
mov esi, 0x1505
jmp 0x11a1b83
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x11a1c21
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x11a1bb4
inc ebp
dec ebx
je 0x11a1c1f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x11a1c1f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x11a1bb0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.011a8900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x11a1bb0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.011a8930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x11a1bb0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x11a1c1f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x11a1c21
mov edi, dword [eax + 8]
jmp 0x11a1c21
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11a1c50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x11a1d54
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x11a1d54
push ebx
call fcn.011a8900
add esp, 4
test eax, eax
je 0x11a1caa
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x11a1cb1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x11a1c90
jmp 0x11a1cb3
mov esi, 0x1505
jmp 0x11a1cb3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x11a1d54
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x11a1ce4
inc ebp
dec ebx
je 0x11a1d4f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x11a1d4f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x11a1ce0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.011a8900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x11a1ce0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.011a8930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x11a1ce0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x11a1d4f
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x11a1d54
mov edi, dword [eax + 8]
jmp 0x11a1d54
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11a1f50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x11a1fbd
mov esi, dword [esp + 0x28]
test esi, esi
je 0x11a1fbd
push esi
call fcn.011a8900
add esp, 4
test eax, eax
je 0x11a1f9a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x11a1fa1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x11a1f80
jmp 0x11a1fa3
mov ebx, 0x1505
jmp 0x11a1fa3
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x11a1fc5
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x11a1fd4
inc ebp
dec edi
je 0x11a1fbb
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x11a1fbb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x11a1fd0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.011a8900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x11a1fd0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.011a8930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x11a1fd0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x11a1fbd
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x11a1fbd
Function at 0x11a9150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x11a91bc
mov eax, 0x270
mov edx, 0x80000000
mov esi, 0x270
nop
nop
nop
nop
mov ebp, dword [ecx + esi*4 - 0x9bc]
and ebp, edx
mov edi, dword [ecx + esi*4 - 0x9b8]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 - 0x388]
shr ebx, 1
xor edi, ebx
mov dword [ecx + esi*4 + 4], edi
mov edi, esi
and edi, 1
xor esi, 1
lea esi, [esi + edi*2]
cmp esi, 0x4e0
jb 0x11a9170
jmp 0x11a928f
cmp eax, 0x4e0
jb 0x11a928f
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
mov edi, dword [ecx + eax*4 + 0x9c8]
and esi, 0x80000000
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x11a91d0
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edx, dword [ecx + eax*4 + 4]
xor edx, edi
mov dword [ecx + eax*4 + 0x390], edx
inc eax
cmp eax, 0x18c
jne 0x11a9220
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11b8670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [esp + 0x14]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], cl
mov byte [esi + 9], al
movzx edx, byte [ebx]
test dl, dl
je 0x11b86ea
lea ecx, [ebx + 1]
xor eax, eax
jmp 0x11b86b9
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x11b86ec
movzx edi, dl
mov ebp, edi
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x11b86b0
test dl, dl
jns 0x11b86b0
mov edx, edi
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x11b86b0
and edi, 0xfffffff8
cmp edi, 0xf0
jne 0x11b86b1
add eax, 2
jmp 0x11b86b1
xor eax, eax
mov edi, dword [esp + 0x18]
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebp, [eax + ecx*2]
test ebp, ebp
jns 0x11b8706
mov eax, 0xffffffff
jmp 0x11b870d
lea eax, [ebp*2]
push eax
call fcn.011a86e0
add esp, 4
mov dword [esi], eax
push 0
push ebx
push ebp
push eax
call fcn.011aafb0
add esp, 0x10
movzx edx, byte [edi]
test dl, dl
je 0x11b8786
lea ecx, [edi + 1]
xor eax, eax
jmp 0x11b8749
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x11b877a
movzx ebx, dl
mov ebp, ebx
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x11b8740
test dl, dl
jns 0x11b8740
mov edx, ebx
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x11b8740
and ebx, 0xfffffff8
cmp ebx, 0xf0
jne 0x11b8741
add eax, 2
jmp 0x11b8741
mov ebx, eax
inc ebx
jns 0x11b8792
mov eax, 0xffffffff
jmp 0x11b8799
mov eax, 2
mov ebx, 1
jmp 0x11b8799
lea eax, [eax*2 + 2]
push eax
call fcn.011a86e0
add esp, 4
mov dword [esi + 4], eax
push 0
push edi
push ebx
push eax
call fcn.011aafb0
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x11bcfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov dword [esp + 8], 0x49dc4b1d
mov dword [esp + 0xc], 0x45d747c5
mov dword [esp + 0x10], 0x414243d6
mov dword [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov edx, 0xc
sub edx, eax
lea esi, [eax + 0xf3]
and esi, 0xc6
mov edi, edx
and edi, 0x39
or edi, esi
mov esi, 0x58d40c
sub esi, eax
xor edi, esi
xor edi, 0xc6
and edx, esi
or edx, edi
mov ebx, esi
xor ebx, ecx
and edx, ecx
not ecx
and ecx, esi
add ebx, esi
not ebx
add ebx, ecx
or ebx, edx
add bl, 0x41
mov byte [esp + eax + 8], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x10
jb 0x11bcff0
mov dword [esp + 0x34], 0xf19a0fa4
mov dword [esp + 0x38], 0xf562f364
mov dword [esp + 0x3c], 0xf927f72e
mov dword [esp + 0x40], 0xfd56fb29
mov dword [esp + 0x44], 0xe15bff6d
mov dword [esp + 0x48], 0xe54ee343
mov dword [esp + 0x4c], 0xe977e74c
mov dword [esp + 0x50], 0xed7eeb7d
mov dword [esp + 0x54], 0xd1eeef36
mov word [esp + 0x58], 0
mov byte [esp + 0x5a], 0
mov eax, 0xfd
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xc9]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xf
mov byte [esp + eax - 0xc9], dl
inc eax
dec ecx
cmp eax, 0x124
jne 0x11bd0b0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14c]
test cx, cx
je 0x11bd103
lea edx, [esp + 0x36]
mov esi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x11bd0f0
jmp 0x11bd106
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x11bd131
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x11bd120
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x11bd161
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x11bd150
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x34], 0x959090ca
mov byte [esp + 0x38], 0x38
mov dword [esp + 0x39], 0
mov byte [esp + 0x3d], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xcb
xor cl, byte [esp + eax + 0x34]
add cl, 9
mov byte [esp + eax + 0x34], cl
inc eax
cmp eax, 0xa
jne 0x11bd190
movzx eax, byte [esp + 0x34]
test al, al
je 0x11bd1cb
lea ecx, [esp + 0x35]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x11bd1c0
mov byte [esi], 0
lea eax, [esp + 0x140]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x14c]
push eax
push ecx
push edx
call fcn.011ab6e0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x11e69b8]
mov ecx, 0x40ba4041
xor ecx, dword [0x11e69c0]
add eax, ecx
inc eax
jmp eax
Function at 0x11c0cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x11c0ce0
sar ebp, 1
lea esi, [esp + 0x1c]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [fcn.011ecd18]
mov dword [esp + 8], 0xf13e3f19
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov ecx, 0x77f33335
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x77f3332d]
xor edx, ecx
add edx, 0xa9e267ef
mov ebx, edx
xor ebx, 6
and edx, 6
lea edx, [ebx + edx*2]
add dl, 2
mov byte [esp + ecx - 0x77f3332d], dl
inc ecx
cmp ecx, 0x77f3333c
jne 0x11c0d20
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x11e6cb8]
Function at 0x14b5ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
movzx eax, word [edi]
mov dword [esp], 0xf10eb5c3
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xa
mov ebx, edx
xor ebx, 0xfd
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0xf
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 7
jne 0x14b5cd0
xor ecx, ecx
cmp dword [esp], eax
setne cl
jmp dword [ecx*4 + 0x11ea530]

Function at 0x14b6950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov eax, 0x3d
mov edx, 0x5b2fb6c2
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3d]
mov ebx, edx
or ebx, ecx
not ecx
or ecx, eax
and ecx, ebx
mov ebx, 0xc7ee91cd
sub ebx, ecx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
mov byte [esp + eax - 0x3d], cl
inc eax
dec edx
cmp eax, 0x43
jne 0x14b6980
mov eax, dword [esp]
mov edx, dword [0x11ecd1c]
test edx, edx
je 0x14b6a08
xor ebx, ebx
mov ecx, dword [0x11ecd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x14b69e0
inc ebx
cmp edx, ebx
jne 0x14b69d0
jmp 0x14b6a08
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x14b6a08
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x11ecd24]
call fcn.014b4070
add esp, 0x20
test edi, edi
je 0x14b6a12
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x14b6a1e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret