joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11d72f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2674], 1
jne 0x11d7de
or dword [0x1b2674], 1
mov eax, 0x838d
mov word [0x1b1a90], ax
inc eax
mov word [0x1b1a92], ax
mov ecx, 0x8380
push ebx
mov eax, ecx
mov word [0x1b1a94], ax
add eax, 0x1c
push esi
mov word [0x1b1a96], ax
lea esi, [ecx + 0x1a]
mov eax, esi
mov word [0x1b1a98], ax
add eax, 0xffffffec
mov word [0x1b1a9a], ax
lea edx, [ecx + 0x10]
mov eax, edx
mov word [0x1b1a9c], ax
add eax, 7
mov ebx, eax
mov word [0x1b1a9e], bx
mov word [0x1b1aa0], bx
mov ebx, ecx
mov word [0x1b1aa2], bx
add ebx, 0xb
mov word [0x1b1ab0], ax
lea eax, [ecx + 0x45]
pop esi
mov word [0x1b1aa4], bx
mov dword [0x1b1aa6], 0x839a8391
mov word [0x1b1aaa], dx
mov dword [0x1b1aac], 0x83808396
mov word [0x1b1ab2], ax
pop ebx
xor eax, eax
mov ecx, 0x83c5
xor cx, word [eax + 0x1b1a90]
add eax, 2
mov word [eax + 0x1b2256], cx
cmp eax, 0x24
jb 0x11d7e0
mov eax, 0x1b2258
ret

Function at 0x11d801
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2670], 1
mov edx, 0x83c5
jne 0x11d873
or dword [0x1b2670], 1
lea eax, [edx - 0x38]
mov word [0x1b1ab4], ax
inc eax
mov word [0x1b1ab6], ax
lea ecx, [edx - 0x45]
mov eax, ecx
mov word [0x1b1ab8], ax
add eax, 0x1c
mov word [0x1b1aba], ax
lea eax, [edx - 0x2b]
mov word [0x1b1abc], ax
add eax, 0xfffffff6
mov word [0x1b1abe], ax
lea eax, [edx - 0x2f]
push esi
mov esi, eax
mov eax, edx
mov word [0x1b1ac0], si
mov word [0x1b1ac2], cx
mov dword [0x1b1ac4], 0x83968397
mov word [0x1b1ac8], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x1b1ab4]
add eax, 2
mov word [eax + 0x1b227a], cx
cmp eax, 0x16
jb 0x11d875
mov eax, 0x1b227c
ret

Function at 0x11d893
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b266c], 1
jne 0x11d953
or dword [0x1b266c], 1
push ebx
mov eax, 0x838d
mov word [0x1b1acc], ax
inc eax
mov word [0x1b1ace], ax
push esi
mov esi, 0x8380
mov eax, esi
mov word [0x1b1ad0], ax
add eax, 0x1c
mov word [0x1b1ad2], ax
lea edx, [esi + 0x1a]
lea ecx, [esi + 6]
mov eax, edx
mov word [0x1b1ad4], ax
mov eax, ecx
mov word [0x1b1ad6], ax
add eax, 0xa
mov word [0x1b1ad8], ax
lea eax, [esi + 0x17]
mov ebx, eax
add eax, 0xfffffff4
mov esi, eax
lea eax, [edx - 0x17]
mov word [0x1b1aec], ax
add eax, 9
mov word [0x1b1aee], ax
lea eax, [edx - 0x18]
mov word [0x1b1ae0], si
mov word [0x1b1af0], ax
add eax, 0x43
pop esi
mov word [0x1b1ada], bx
mov dword [0x1b1adc], 0x83808397
mov dword [0x1b1ae2], 0x839a8391
mov word [0x1b1ae6], cx
mov dword [0x1b1ae8], 0x838b838a
mov word [0x1b1af2], ax
pop ebx
xor eax, eax
mov ecx, 0x83c5
xor cx, word [eax + 0x1b1acc]
add eax, 2
mov word [eax + 0x1b2292], cx
cmp eax, 0x28
jb 0x11d955
mov eax, 0x1b2294
ret
Function at 0x11d976
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2668], 1
jne 0x11da25
or dword [0x1b2668], 1
mov eax, 0x838d
mov word [0x1b1af4], ax
inc eax
mov word [0x1b1af6], ax
mov edx, 0x8380
mov eax, edx
mov word [0x1b1af8], ax
add eax, 0x1c
mov word [0x1b1afa], ax
lea ecx, [edx + 0x1a]
mov eax, ecx
mov word [0x1b1afc], ax
add eax, 0xffffffec
mov word [0x1b1afe], ax
lea eax, [edx + 9]
mov word [0x1b1b00], ax
add eax, 0xfffffffb
mov word [0x1b1b02], ax
lea eax, [edx + 0x16]
push edi
mov edi, eax
add eax, 0xfffffff4
mov ecx, eax
mov word [0x1b1b12], ax
lea eax, [edx + 0x11]
mov word [0x1b1b14], ax
add eax, 0x34
mov word [0x1b1b04], di
mov word [0x1b1b06], di
mov dword [0x1b1b08], 0x83968380
mov dword [0x1b1b0c], 0x8397839a
mov word [0x1b1b10], cx
mov word [0x1b1b16], ax
pop edi
xor eax, eax
mov ecx, 0x83c5
xor cx, word [eax + 0x1b1af4]
add eax, 2
mov word [eax + 0x1b22ba], cx
cmp eax, 0x24
jb 0x11da27
mov eax, 0x1b22bc
ret

Function at 0x11ddf3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2650], 1
jne 0x11de48
or dword [0x1b2650], 1
mov dword [0x1b1ba0], 0x86a2a097
mov dword [0x1b1ba4], 0xb1a4a0b7
mov dword [0x1b1ba8], 0xbca08ea0
mov dword [0x1b1bac], 0xecedbd80
mov dword [0x1b1bb0], 0xaca4a3e5
mov dword [0x1b1bb4], 0xffa1a0a9
mov word [0x1b1bb8], 0xc5e5
xor eax, eax
mov cl, byte [eax + 0x1b1ba0]
xor cl, 0xc5
mov byte [eax + 0x1b2318], cl
inc eax
cmp eax, 0x1a
jb 0x11de4a
mov eax, 0x1b2318
ret

Function at 0x11df2a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b264c], 1
jne 0x11df90
or dword [0x1b264c], 1
mov dword [0x1b1bbc], 0xa8b0ab80
mov dword [0x1b1bc0], 0xb1a4b7a0
mov dword [0x1b1bc4], 0xe5abaaac
mov dword [0x1b1bc8], 0xa0a1abac
mov dword [0x1b1bcc], 0xb0aae5bd
mov dword [0x1b1bd0], 0xa3aae5b1
mov dword [0x1b1bd4], 0xaba4b7e5
mov word [0x1b1bd8], 0xa0a2
mov byte [0x1b1bda], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1bbc]
xor cl, 0xc5
mov byte [eax + 0x1b2334], cl
inc eax
cmp eax, 0x1f
jb 0x11df92
mov eax, 0x1b2334
ret

Function at 0x11dfb0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2648], 1
jne 0x11dffc
or dword [0x1b2648], 1
mov dword [0x1b1bdc], 0x80a2a097
mov dword [0x1b1be0], 0x8ea8b0ab
mov dword [0x1b1be4], 0xbd80bca0
mov dword [0x1b1be8], 0xa3e5eced
mov dword [0x1b1bec], 0xa0a9aca4
mov dword [0x1b1bf0], 0xc5e5ffa1
xor eax, eax
mov cl, byte [eax + 0x1b1bdc]
xor cl, 0xc5
mov byte [eax + 0x1b2354], cl
inc eax
cmp eax, 0x18
jb 0x11dffe
mov eax, 0x1b2354
ret

Function at 0x11e161
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2644], 1
jne 0x11e196
or dword [0x1b2644], 1
mov dword [0x1b1bf4], 0xa9a9b08b
mov dword [0x1b1bf8], 0xabaaa6e5
mov dword [0x1b1bfc], 0xb1bda0b1
mov byte [0x1b1c00], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1bf4]
xor cl, 0xc5
mov byte [eax + 0x1b236c], cl
inc eax
cmp eax, 0xd
jb 0x11e198
mov eax, 0x1b236c
ret
Function at 0x11e1b3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2640], 1
jne 0x11e1ff
or dword [0x1b2640], 1
mov dword [0x1b1c04], 0x8aa2a097
mov dword [0x1b1c08], 0x8eaba0b5
mov dword [0x1b1c0c], 0xbd80bca0
mov dword [0x1b1c10], 0xa3e5eced
mov dword [0x1b1c14], 0xa0a9aca4
mov dword [0x1b1c18], 0xc5e5ffa1
xor eax, eax
mov cl, byte [eax + 0x1b1c04]
xor cl, 0xc5
mov byte [eax + 0x1b237c], cl
inc eax
cmp eax, 0x18
jb 0x11e201
mov eax, 0x1b237c
ret

Function at 0x11e21c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b263c], 1
jne 0x11e278
or dword [0x1b263c], 1
mov dword [0x1b1c1c], 0x94a2a097
mov dword [0x1b1c20], 0xbcb7a0b0
mov dword [0x1b1c24], 0xaaa3ab8c
mov dword [0x1b1c28], 0xedbca08e
mov dword [0x1b1c2c], 0xa4a3e5ec
mov dword [0x1b1c30], 0xa1a0a9ac
mov word [0x1b1c34], 0xe5ff
mov byte [0x1b1c36], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1c1c]
xor cl, 0xc5
mov byte [eax + 0x1b2394], cl
inc eax
cmp eax, 0x1b
jb 0x11e27a
mov eax, 0x1b2394
ret

Function at 0x11e36b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2638], 1
jne 0x11e3d1
or dword [0x1b2638], 1
mov dword [0x1b1c38], 0xa8b0ab80
mov dword [0x1b1c3c], 0xb1a4b7a0
mov dword [0x1b1c40], 0xe5abaaac
mov dword [0x1b1c44], 0xa0a1abac
mov dword [0x1b1c48], 0xb0aae5bd
mov dword [0x1b1c4c], 0xa3aae5b1
mov dword [0x1b1c50], 0xaba4b7e5
mov word [0x1b1c54], 0xa0a2
mov byte [0x1b1c56], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1c38]
xor cl, 0xc5
mov byte [eax + 0x1b23b0], cl
inc eax
cmp eax, 0x1f
jb 0x11e3d3
mov eax, 0x1b23b0
ret

Function at 0x11e3ee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2634], 1
jne 0x11e44a
or dword [0x1b2634], 1
mov dword [0x1b1c58], 0x94a2a097
mov dword [0x1b1c5c], 0xbcb7a0b0
mov dword [0x1b1c60], 0xaaa3ab8c
mov dword [0x1b1c64], 0xedbca08e
mov dword [0x1b1c68], 0xa4a3e5ec
mov dword [0x1b1c6c], 0xa1a0a9ac
mov word [0x1b1c70], 0xe5ff
mov byte [0x1b1c72], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1c58]
xor cl, 0xc5
mov byte [eax + 0x1b23d0], cl
inc eax
cmp eax, 0x1b
jb 0x11e44c
mov eax, 0x1b23d0
ret

Function at 0x11e5ac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2630], 1
jne 0x11e5e1
or dword [0x1b2630], 1
mov dword [0x1b1c74], 0xa9a9b08b
mov dword [0x1b1c78], 0xabaaa6e5
mov dword [0x1b1c7c], 0xb1bda0b1
mov byte [0x1b1c80], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1c74]
xor cl, 0xc5
mov byte [eax + 0x1b23ec], cl
inc eax
cmp eax, 0xd
jb 0x11e5e3
mov eax, 0x1b23ec
ret

Function at 0x11e5fe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b262c], 1
jne 0x11e64a
or dword [0x1b262c], 1
mov dword [0x1b1c84], 0x8aa2a097
mov dword [0x1b1c88], 0x8eaba0b5
mov dword [0x1b1c8c], 0xbd80bca0
mov dword [0x1b1c90], 0xa3e5eced
mov dword [0x1b1c94], 0xa0a9aca4
mov dword [0x1b1c98], 0xc5e5ffa1
xor eax, eax
mov cl, byte [eax + 0x1b1c84]
xor cl, 0xc5
mov byte [eax + 0x1b23fc], cl
inc eax
cmp eax, 0x18
jb 0x11e64c
mov eax, 0x1b23fc
ret
Function at 0x11e667
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2628], 1
jne 0x11e6c3
or dword [0x1b2628], 1
mov dword [0x1b1c9c], 0x94a2a097
mov dword [0x1b1ca0], 0xbcb7a0b0
mov dword [0x1b1ca4], 0xaaa3ab8c
mov dword [0x1b1ca8], 0xedbca08e
mov dword [0x1b1cac], 0xa4a3e5ec
mov dword [0x1b1cb0], 0xa1a0a9ac
mov word [0x1b1cb4], 0xe5ff
mov byte [0x1b1cb6], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1c9c]
xor cl, 0xc5
mov byte [eax + 0x1b2414], cl
inc eax
cmp eax, 0x1b
jb 0x11e6c5
mov eax, 0x1b2414
ret

Function at 0x11e971
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2624], 1
mov ecx, 0x83c5
jne 0x11e9df
or dword [0x1b2624], 1
lea eax, [ecx + 0x28]
mov word [0x1b1cb8], ax
add eax, 0xffffff94
mov word [0x1b1cba], ax
lea eax, [ecx - 0x25]
mov word [0x1b1cbc], ax
add eax, 3
mov word [0x1b1cbe], ax
lea eax, [ecx - 0x21]
mov word [0x1b1cc0], ax
add eax, 0xc
mov word [0x1b1cc2], ax
lea eax, [ecx - 0x1c]
mov word [0x1b1cc4], ax
add eax, 8
mov word [0x1b1cc6], ax
lea eax, [ecx + 0x27]
mov word [0x1b1cc8], ax
mov eax, ecx
mov word [0x1b1cca], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1b1cb8]
add eax, 2
mov word [eax + 0x1b242e], dx
cmp eax, 0x14
jb 0x11e9e1
mov eax, 0x1b2430
ret

Function at 0x11e9ff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2620], 1
mov ecx, 0x83c5
jne 0x11ea6d
or dword [0x1b2620], 1
lea eax, [ecx + 0x28]
mov word [0x1b1ccc], ax
add eax, 0xffffffb4
mov word [0x1b1cce], ax
lea eax, [ecx - 0x25]
mov word [0x1b1cd0], ax
add eax, 3
mov word [0x1b1cd2], ax
lea eax, [ecx - 0x21]
mov word [0x1b1cd4], ax
add eax, 0xc
mov word [0x1b1cd6], ax
lea eax, [ecx - 0x1c]
mov word [0x1b1cd8], ax
add eax, 8
mov word [0x1b1cda], ax
lea eax, [ecx + 0x27]
mov word [0x1b1cdc], ax
mov eax, ecx
mov word [0x1b1cde], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1b1ccc]
add eax, 2
mov word [eax + 0x1b2442], dx
cmp eax, 0x14
jb 0x11ea6f
mov eax, 0x1b2444
ret

Function at 0x11ea8d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b261c], 1
jne 0x11ead9
or dword [0x1b261c], 1
mov dword [0x1b1ce0], 0x8aa2a097
mov dword [0x1b1ce4], 0x8eaba0b5
mov dword [0x1b1ce8], 0xbd80bca0
mov dword [0x1b1cec], 0xa3e5eced
mov dword [0x1b1cf0], 0xa0a9aca4
mov dword [0x1b1cf4], 0xc5e5ffa1
xor eax, eax
mov cl, byte [eax + 0x1b1ce0]
xor cl, 0xc5
mov byte [eax + 0x1b2458], cl
inc eax
cmp eax, 0x18
jb 0x11eadb
mov eax, 0x1b2458
ret

Function at 0x11eaf6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2618], 1
jne 0x11eb52
or dword [0x1b2618], 1
mov dword [0x1b1cf8], 0x94a2a097
mov dword [0x1b1cfc], 0xbcb7a0b0
mov dword [0x1b1d00], 0xb0a9a493
mov dword [0x1b1d04], 0xedbd80a0
mov dword [0x1b1d08], 0xa4a3e5ec
mov dword [0x1b1d0c], 0xa1a0a9ac
mov word [0x1b1d10], 0xe5ff
mov byte [0x1b1d12], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1cf8]
xor cl, 0xc5
mov byte [eax + 0x1b2470], cl
inc eax
cmp eax, 0x1b
jb 0x11eb54
mov eax, 0x1b2470
ret
Function at 0x11eb6f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2614], 1
jne 0x11ebcb
or dword [0x1b2614], 1
mov dword [0x1b1d14], 0x94a2a097
mov dword [0x1b1d18], 0xbcb7a0b0
mov dword [0x1b1d1c], 0xb0a9a493
mov dword [0x1b1d20], 0xedbd80a0
mov dword [0x1b1d24], 0xa4a3e5ec
mov dword [0x1b1d28], 0xa1a0a9ac
mov word [0x1b1d2c], 0xe5ff
mov byte [0x1b1d2e], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1d14]
xor cl, 0xc5
mov byte [eax + 0x1b248c], cl
inc eax
cmp eax, 0x1b
jb 0x11ebcd
mov eax, 0x1b248c
ret

Function at 0x11ed47
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2610], 1
jne 0x11ed93
or dword [0x1b2610], 1
mov dword [0x1b1d30], 0x8aa2a097
mov dword [0x1b1d34], 0x8eaba0b5
mov dword [0x1b1d38], 0xbd80bca0
mov dword [0x1b1d3c], 0xa3e5eced
mov dword [0x1b1d40], 0xa0a9aca4
mov dword [0x1b1d44], 0xc5e5ffa1
xor eax, eax
mov cl, byte [eax + 0x1b1d30]
xor cl, 0xc5
mov byte [eax + 0x1b24a8], cl
inc eax
cmp eax, 0x18
jb 0x11ed95
mov eax, 0x1b24a8
ret

Function at 0x11edb0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b260c], 1
jne 0x11ee16
or dword [0x1b260c], 1
mov dword [0x1b1d48], 0x96a2a097
mov dword [0x1b1d4c], 0xa493b1a0
mov dword [0x1b1d50], 0x80a0b0a9
mov dword [0x1b1d54], 0xb1b6edbd
mov dword [0x1b1d58], 0xa2abacb7
mov dword [0x1b1d5c], 0xa4a3e5ec
mov dword [0x1b1d60], 0xa1a0a9ac
mov word [0x1b1d64], 0xe5ff
mov byte [0x1b1d66], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1d48]
xor cl, 0xc5
mov byte [eax + 0x1b24c0], cl
inc eax
cmp eax, 0x1f
jb 0x11ee18
mov eax, 0x1b24c0
ret

Function at 0x11ef82
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2608], 1
jne 0x11efce
or dword [0x1b2608], 1
mov dword [0x1b1d68], 0x8aa2a097
mov dword [0x1b1d6c], 0x8eaba0b5
mov dword [0x1b1d70], 0xbd80bca0
mov dword [0x1b1d74], 0xa3e5eced
mov dword [0x1b1d78], 0xa0a9aca4
mov dword [0x1b1d7c], 0xc5e5ffa1
xor eax, eax
mov cl, byte [eax + 0x1b1d68]
xor cl, 0xc5
mov byte [eax + 0x1b24e0], cl
inc eax
cmp eax, 0x18
jb 0x11efd0
mov eax, 0x1b24e0
ret

Function at 0x11efee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2604], 1
jne 0x11f04d
or dword [0x1b2604], 1
mov dword [0x1b1d80], 0x96a2a097
mov dword [0x1b1d84], 0xa493b1a0
mov dword [0x1b1d88], 0x80a0b0a9
mov dword [0x1b1d8c], 0xb2a1edbd
mov dword [0x1b1d90], 0xeca1b7aa
mov dword [0x1b1d94], 0xaca4a3e5
mov dword [0x1b1d98], 0xffa1a0a9
mov word [0x1b1d9c], 0xc5e5
xor eax, eax
mov cl, byte [eax + 0x1b1d80]
xor cl, 0xc5
mov byte [eax + 0x1b24f8], cl
inc eax
cmp eax, 0x1e
jb 0x11f04f
mov eax, 0x1b24f8
ret

Function at 0x11f1ba
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2600], 1
jne 0x11f234
or dword [0x1b2600], 1
mov dword [0x1b1da0], 0xb1b6b088
mov dword [0x1b1da4], 0xa0b5b6e5
mov dword [0x1b1da8], 0xbca3aca6
mov dword [0x1b1dac], 0xabe5a4e5
mov dword [0x1b1db0], 0xa0e8abaa
mov dword [0x1b1db4], 0xbcb1b5a8
mov dword [0x1b1db8], 0xa7b0b6e5
mov dword [0x1b1dbc], 0xe5bca0ae
mov dword [0x1b1dc0], 0xacb7b1b6
mov word [0x1b1dc4], 0xa2ab
mov byte [0x1b1dc6], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1da0]
xor cl, 0xc5
mov byte [eax + 0x1b2518], cl
inc eax
cmp eax, 0x27
jb 0x11f236
mov eax, 0x1b2518
ret
Function at 0x11f251
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b25fc], 1
jne 0x11f29d
or dword [0x1b25fc], 1
mov dword [0x1b1dc8], 0x8aa2a097
mov dword [0x1b1dcc], 0x8eaba0b5
mov dword [0x1b1dd0], 0xbd80bca0
mov dword [0x1b1dd4], 0xa3e5eced
mov dword [0x1b1dd8], 0xa0a9aca4
mov dword [0x1b1ddc], 0xc5e5ffa1
xor eax, eax
mov cl, byte [eax + 0x1b1dc8]
xor cl, 0xc5
mov byte [eax + 0x1b2540], cl
inc eax
cmp eax, 0x18
jb 0x11f29f
mov eax, 0x1b2540
ret

Function at 0x11f2ba
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b25f8], 1
jne 0x11f30c
or dword [0x1b25f8], 1
mov dword [0x1b1de0], 0xa0818d96
mov dword [0x1b1de4], 0xa0b1a0a9
mov dword [0x1b1de8], 0xedbca08e
mov dword [0x1b1dec], 0xa4a3e5ec
mov dword [0x1b1df0], 0xa1a0a9ac
mov word [0x1b1df4], 0xe5ff
mov byte [0x1b1df6], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1de0]
xor cl, 0xc5
mov byte [eax + 0x1b2558], cl
inc eax
cmp eax, 0x17
jb 0x11f30e
mov eax, 0x1b2558
ret

Function at 0x11f45b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b25f4], 1
jne 0x11f4a7
or dword [0x1b25f4], 1
mov dword [0x1b1df8], 0x8aa2a097
mov dword [0x1b1dfc], 0x8eaba0b5
mov dword [0x1b1e00], 0xbd80bca0
mov dword [0x1b1e04], 0xa3e5eced
mov dword [0x1b1e08], 0xa0a9aca4
mov dword [0x1b1e0c], 0xc5e5ffa1
xor eax, eax
mov cl, byte [eax + 0x1b1df8]
xor cl, 0xc5
mov byte [eax + 0x1b2570], cl
inc eax
cmp eax, 0x18
jb 0x11f4a9
mov eax, 0x1b2570
ret

Function at 0x11f4c4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b25f0], 1
jne 0x11f517
or dword [0x1b25f0], 1
mov dword [0x1b1e10], 0xa0818d96
mov dword [0x1b1e14], 0xa0b1a0a9
mov dword [0x1b1e18], 0xb0a9a493
mov dword [0x1b1e1c], 0xe5eceda0
mov dword [0x1b1e20], 0xa9aca4a3
mov dword [0x1b1e24], 0xe5ffa1a0
mov byte [0x1b1e28], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1e10]
xor cl, 0xc5
mov byte [eax + 0x1b2588], cl
inc eax
cmp eax, 0x19
jb 0x11f519
mov eax, 0x1b2588
ret

Function at 0x11f7f0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b25ec], 1
jne 0x11f8ab
or dword [0x1b25ec], 1
mov dword [0x1b1e30], 0x81868784
mov dword [0x1b1e34], 0x8d828380
mov dword [0x1b1e38], 0x898e8f8c
mov dword [0x1b1e3c], 0x958a8b88
mov dword [0x1b1e40], 0x91969794
mov dword [0x1b1e44], 0x9d929390
mov dword [0x1b1e48], 0xa7a49f9c
mov dword [0x1b1e4c], 0xa3a0a1a6
mov dword [0x1b1e50], 0xafacada2
mov dword [0x1b1e54], 0xaba8a9ae
mov dword [0x1b1e58], 0xb7b4b5aa
mov dword [0x1b1e5c], 0xb3b0b1b6
mov dword [0x1b1e60], 0xbfbcbdb2
mov dword [0x1b1e64], 0xf6f7f4f5
mov dword [0x1b1e68], 0xf2f3f0f1
mov dword [0x1b1e6c], 0xeaeefcfd
mov byte [0x1b1e70], 0xc5
xor eax, eax
mov cl, byte [eax + 0x1b1e30]
xor cl, 0xc5
mov byte [eax + 0x1b25a8], cl
inc eax
cmp eax, 0x41
jb 0x11f8ad
mov eax, 0x1b25a8
ret
Function at 0x11f958
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, eax
xor edx, edx
push 3
lea eax, [ecx + 2]
pop ebx
div ebx
mov esi, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [esi], eax
jae 0x11f982
mov dword [esi], eax
xor al, al
jmp 0x11fa5a
mov eax, ecx
xor edx, edx
push 3
pop ecx
div ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [0x1ac9b8]
xor edx, edx
imul eax, eax, 3
test eax, eax
je 0x11f9fe
dec eax
push 3
pop ebx
div ebx
inc eax
mov edx, eax
mov dword [ebp - 4], eax
imul edx, edx, 3
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [edi + 1]
movzx ebx, byte [edi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [edi + 2]
movzx ebx, byte [edi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 2], al
movzx eax, byte [edi + 2]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
add edi, 3
dec dword [ebp - 4]
jne 0x11f9ac
cmp edx, dword [ebp + 8]
jae 0x11fa4d
movzx eax, byte [edi]
inc edx
cmp edx, dword [ebp + 8]
jae 0x11fa12
movzx edi, byte [edi + 1]
jmp 0x11fa14
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + ecx]
mov byte [esi], bl
mov ebx, edi
shr ebx, 4
shl eax, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + ecx]
mov byte [esi + 1], al
cmp edx, dword [ebp + 8]
jae 0x11fa41
and edi, 0xf
mov cl, byte [ecx + edi*4]
jmp 0x11fa43
mov cl, 0x3d
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x128d20
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
mov eax, dword [eax + 0x1f0]
test cl, cl
je 0x128d42
lea esp, [esp]
imul eax, eax, 0xf4243
movzx ecx, cl
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x128d30
ret
Function at 0x1396b0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0x1397a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0x1397b9
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0x139812
cmp eax, edx
jae 0x1397fe
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0x1397f0
lea edx, [esi + 0x20]
push esi
call fcn.001391b0
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0x13982f
jmp 0x139820
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0x139820
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.001391b0
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x139f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0x13a094
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0x13a094
test eax, eax
js 0x13a094
mov eax, dword [esi + 0x234]
push eax
call fcn.0013df50
add esp, 4
test eax, eax
jne 0x13a099
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0x139f9a
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0x139ff5
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0x139fee
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0x139fb4
push ebx
push esi
call fcn.0013dec0
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x139fb2
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0x139ff8
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0x13a08d
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0x13a083
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0x13a040
push edi
push esi
call fcn.0013dec0
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0x13a010
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret