joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1102fa10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.110d22e0
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1102fa5c
test ebp, ebp
je 0x1102fa5c
mov ecx, dword [esp + 0x2c]
mov dl, byte [eax + ecx]
mov esi, dword [esp + 0x18]
xor dl, byte [esi]
mov ecx, dword [esp + 0x1c]
mov byte [ecx], dl
inc ecx
inc esi
inc eax
dec ebp
and eax, 0xf
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
jne 0x1102fa30
mov edi, dword [esp + 0x28]
mov esi, dword [edi + 0xc]
bswap esi
cmp ebp, 0x10
jb 0x1102fad8
lea ebx, [ebx]
mov ebx, ebp
shr ebx, 4
add esi, ebx
cmp esi, ebx
jae 0x1102fa7f
sub ebx, esi
xor esi, esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push edi
push eax
push ebx
push ecx
push edx
call dword [esp + 0x48]
mov eax, esi
add esp, 0x14
bswap eax
mov dword [edi + 0xc], eax
test esi, esi
jne 0x1102fac2
mov eax, 0xc
mov ecx, 1
lea esp, [esp]
movzx edx, byte [eax + edi - 1]
dec eax
add ecx, edx
mov byte [eax + edi], cl
shr ecx, 8
test eax, eax
jne 0x1102fab0
shl ebx, 4
add dword [esp + 0x1c], ebx
add dword [esp + 0x18], ebx
sub ebp, ebx
cmp ebp, 0x10
jae 0x1102fa70
mov eax, dword [esp + 0x10]
test ebp, ebp
je 0x1102fb3e
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edi
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x28]
push eax
push 1
push ebx
push ebx
call dword [esp + 0x48]
add esp, 0x14
add esi, 1
bswap esi
mov dword [edi + 0xc], esi
jne 0x1102fb0f
mov edx, edi
call fcn.1102f9e0
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea eax, [edi + ebx]
sub ecx, ebx
sub esi, ebx
add edi, ebp
mov dl, byte [ecx + eax]
xor dl, byte [eax]
dec ebp
mov byte [esi + eax], dl
inc eax
test ebp, ebp
jne 0x1102fb24
mov eax, dword [esp + 0x30]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
pop ecx
ret
Function at 0x1102fb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
cmp ebp, 0x10
ja 0x1102fb5e
xor eax, eax
pop ebp
ret
push ebx
mov ebx, ebp
and ebx, 0xf
push esi
push edi
jne 0x1102fb6d
mov ebx, 0x10
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push eax
push esi
push ecx
sub ebp, ebx
push ebp
push edx
push edi
call sym.LIBEAY32.dll_CRYPTO_cbc128_encrypt
add dword [esp + 0x30], ebp
add esp, 0x18
add edi, ebp
test ebx, ebx
jbe 0x1102fbac
mov eax, esi
sub edi, esi
mov ecx, ebx
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x1102fba1
mov eax, dword [esp + 0x20]
push eax
push esi
push esi
call dword [esp + 0x34]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
push ebx
add edi, 0xfffffff0
push edi
push ecx
call fcn.110d37f0
mov edx, dword [esi]
mov dword [edi], edx
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov edx, dword [esi + 0xc]
add esp, 0x18
mov dword [edi + 0xc], edx
pop edi
pop esi
lea eax, [ebx + ebp]
pop ebx
pop ebp
ret

Function at 0x1102fbf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
cmp ebx, 0x10
jae 0x1102fbfe
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x24]
push eax
mov esi, ebx
push edi
push ecx
and esi, 0xf
sub ebx, esi
push ebx
push ebp
push edx
call sym.LIBEAY32.dll_CRYPTO_cbc128_encrypt
add esp, 0x18
test esi, esi
jne 0x1102fc35
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov ecx, dword [esp + 0x14]
add ecx, ebx
add ebp, ebx
test esi, esi
jbe 0x1102fc5d
mov eax, edi
sub ecx, edi
mov dword [esp + 0x1c], esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0x1c], 1
jne 0x1102fc50
mov eax, dword [esp + 0x20]
push eax
push edi
push edi
call dword [esp + 0x34]
mov ecx, dword [edi]
mov dword [esi + ebp - 0x10], ecx
mov edx, dword [edi + 4]
mov dword [esi + ebp - 0xc], edx
mov eax, dword [edi + 8]
mov dword [esi + ebp - 8], eax
mov ecx, dword [edi + 0xc]
add esp, 0xc
pop edi
mov dword [esi + ebp - 4], ecx
lea eax, [esi + ebx]
pop esi
pop ebp
pop ebx
ret
Function at 0x1102fe40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x44
call fcn.110d22e0
mov eax, dword [0x11143f70]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x58]
push ebx
mov ebx, dword [esp + 0x50]
push ebp
mov ebp, dword [esp + 0x64]
push esi
mov esi, dword [esp + 0x60]
push edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x14], ecx
cmp eax, 0x10
ja 0x1102fe8f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.110d2962
add esp, 0x44
ret
mov edx, eax
and edx, 0xf
mov dword [esp + 0x18], edx
jne 0x1102fea2
mov dword [esp + 0x18], 0x10
mov edx, 0xfffffff0
sub edx, dword [esp + 0x18]
add eax, edx
mov dword [esp + 0x24], eax
je 0x1102fec9
push ebp
push ecx
push esi
push eax
push ebx
push edi
call sym.LIBEAY32.dll_CRYPTO_cbc128_decrypt
mov eax, dword [esp + 0x3c]
add esp, 0x18
add edi, eax
add ebx, eax
push esi
lea eax, [esp + 0x44]
push eax
push edi
call ebp
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x44], eax
push edx
lea eax, [edi + 0x10]
mov dword [esp + 0x4c], ecx
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.110d37f0
lea edx, [esp + 0x48]
push esi
push edx
mov eax, edx
push eax
call ebp
mov ecx, dword [esp + 0x38]
lea ebp, [esp + 0x54]
mov edx, edi
sub edx, ebp
mov dword [esp + 0x44], edx
mov edx, ebx
sub edx, ebp
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x38]
sub edx, ebp
mov dword [esp + 0x4c], edx
mov edx, ebx
sub edx, dword [esp + 0x38]
add esp, 0x24
mov dword [esp + 0x2c], edx
mov edx, edi
xor eax, eax
inc ecx
sub edx, ebx
lea esi, [ebx + 2]
mov dword [esp + 0x14], edx
lea ecx, [ecx]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
add edx, eax
movzx edx, byte [esp + edx + 0x30]
mov byte [esp + 0x13], dl
mov edx, dword [esp + 0x28]
lea ebp, [edx + eax]
movzx edx, byte [esp + eax + 0x30]
xor dl, byte [esp + ebp + 0x30]
add ebx, eax
mov byte [esp + ebx + 0x30], dl
movzx edx, byte [esp + 0x13]
movzx ebx, byte [esp + eax + 0x31]
xor bl, byte [ecx]
lea ebp, [esp + ebp + 0x30]
mov byte [ebp], dl
mov edx, dword [esp + 0x2c]
lea ebp, [edx + ecx]
mov edx, dword [esp + 0x14]
mov dl, byte [edx + ebp]
mov byte [ebp], bl
movzx ebx, byte [esp + eax + 0x32]
xor bl, byte [ecx + 1]
mov byte [ecx], dl
mov edx, dword [esp + 0x14]
mov dl, byte [edx + esi]
mov byte [esi], bl
movzx ebx, byte [esp + eax + 0x33]
xor bl, byte [ecx + 2]
mov byte [ecx + 1], dl
mov dl, byte [edi + eax + 3]
mov byte [esi + 1], bl
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
add esi, 4
cmp eax, 0x10
jb 0x1102ff50
mov ecx, dword [esp + 0x18]
add ecx, 0x10
cmp eax, ecx
jae 0x11030007
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
lea ebx, [ebx]
lea edx, [esi + eax]
mov dl, byte [esp + edx + 0x30]
xor dl, byte [esp + eax + 0x30]
lea ebx, [edi + eax]
inc eax
mov byte [esp + ebx + 0x30], dl
cmp eax, ecx
jb 0x1102fff0
mov eax, dword [esp + 0x24]
pop edi
pop esi
lea eax, [eax + ecx + 0x10]
mov ecx, dword [esp + 0x48]
pop ebp
pop ebx
xor ecx, esp
call fcn.110d2962
add esp, 0x44
ret
Function at 0x11030700
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x34
call fcn.110d22e0
mov eax, dword [0x11143f70]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push esi
mov esi, dword [esp + 0x44]
mov ebx, edx
lea edx, [esi - 1]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
cmp edx, 0x7f
ja 0x110308b9
mov edx, dword [edi]
mov dword [esp + 0x18], edx
mov edx, dword [edi + 4]
push ebp
mov dword [esp + 0x20], edx
mov edx, dword [edi + 8]
push eax
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0xc]
push edi
push edi
mov dword [esp + 0x34], edx
call ecx
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
mov esi, eax
add esp, 0xc
sar esi, 3
cmp dword [esp + 0x58], 0
je 0x110307a7
test esi, esi
jle 0x110307ee
mov eax, dword [esp + 0x14]
mov edx, edi
lea ebp, [esp + 0x2c]
sub edx, ebx
sub ebp, ebx
sub eax, ebx
mov ecx, ebx
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov ebx, dword [esp + 0x14]
mov byte [ecx + ebp], al
mov byte [ebx + ecx], al
inc ecx
sub esi, 1
jne 0x11030790
jmp 0x110307ee
xor ebp, ebp
test esi, esi
jle 0x110307ee
lea eax, [esp + 0x2c]
mov ecx, eax
sub ebx, eax
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, ecx
sub eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
jmp 0x110307d4
mov edx, dword [esp + 0x18]
lea ecx, [esp + ebp + 0x2c]
mov al, byte [ebx + ecx]
mov dl, byte [edx + ecx]
xor dl, al
mov byte [ecx], al
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, esi
mov byte [eax + ecx], dl
jl 0x110307d0
mov eax, dword [esp + 0x4c]
mov ecx, eax
and ecx, reloc.WS2_32.dll_getsockopt
jns 0x11030801
dec ecx
or ecx, 0xfffffff8
inc ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x11030842
mov ecx, dword [esp + eax + 0x1c]
mov edx, dword [esp + eax + 0x20]
lea eax, [esp + eax + 0x1c]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
pop ebp
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.110d2962
add esp, 0x34
ret
mov dl, 8
sub dl, cl
mov byte [esp + 0x13], dl
inc edi
lea esi, [esp + eax + 0x1d]
mov ebp, 4
movzx edx, byte [esi - 1]
mov al, byte [esi]
shl dl, cl
movzx ecx, byte [esp + 0x13]
mov bl, al
shr bl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi - 1], dl
mov dl, byte [esi + 1]
mov bl, dl
shr bl, cl
mov ecx, dword [esp + 0x14]
shl dl, cl
movzx ecx, byte [esp + 0x13]
or al, bl
mov byte [edi], al
mov al, byte [esi + 2]
mov bl, al
shr bl, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi + 1], dl
movzx edx, byte [esi + 3]
shr dl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
add esi, 4
add edi, 4
or dl, al
sub ebp, 1
mov byte [edi - 2], dl
jne 0x11030854
pop ebp
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.110d2962
add esp, 0x34
ret
Function at 0x110309c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.110d22e0
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x28]
test esi, esi
je 0x11030a05
test ebx, ebx
je 0x11030a05
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
inc eax
inc ebp
inc esi
dec ebx
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x110309e0
cmp ebx, 0x10
jb 0x11030a80
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x24]
push edx
push edi
push edi
call dword [esp + 0x3c]
add esp, 0xc
cmp esi, 0x10
jae 0x11030a6c
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
inc ecx
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [eax + ebp - 4], edx
jne 0x11030a57
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x11030a36
test ebx, ebx
je 0x11030abd
mov eax, dword [esp + 0x24]
push eax
push edi
push edi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
mov dl, byte [eax + ebp]
xor dl, byte [eax]
dec ebx
mov byte [eax + ecx], dl
inc eax
test ebx, ebx
jne 0x11030aa3
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x2c]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x11030f00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.110d22e0
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x160]
push edi
mov dword [esp + 0x18], eax
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x16c], ecx
mov dword [esi + 0x168], ecx
cmp ebx, 0xc
jne 0x11030f75
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
lea edi, [ebx - 0xb]
jmp 0x11031044
mov eax, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
cmp ebx, 0x10
jb 0x11030fea
mov edi, dword [esp + 0x1c]
sub edi, esi
shr eax, 4
mov dword [esp + 0x20], eax
push ebp
mov ecx, dword [esp + 0x20]
add ecx, 2
mov eax, esi
mov ebp, 4
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x11030fa0
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x24]
add dword [esp + 0x28], 0x10
add esp, 8
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x24], 1
jne 0x11030f92
mov eax, dword [esp + 0x10]
xor ecx, ecx
pop ebp
cmp ebx, ecx
je 0x1103101b
jbe 0x1103100b
mov ecx, dword [esp + 0x1c]
mov eax, esi
sub ecx, esi
mov edi, ebx
lea ebx, [ebx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x11031000
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x20]
mov eax, dword [esp + 0x14]
add esp, 8
mov ecx, dword [esp + 0x10]
shld ecx, eax, 3
add eax, eax
bswap ecx
xor dword [esi + 8], ecx
add eax, eax
lea ecx, [esi + 0x60]
add eax, eax
push ecx
bswap eax
xor dword [esi + 0xc], eax
push esi
call dword [esp + 0x20]
mov edi, dword [esi + 0xc]
add esp, 8
bswap edi
mov edx, dword [esi + 0x174]
mov ecx, dword [esi + 0x170]
push edx
lea eax, [esi + 0x20]
push eax
push esi
call ecx
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x11031070
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.110d22e0
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 0x38]
or ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x164]
mov edx, dword [esi + 0x160]
mov dword [esp + 0xc], eax
je 0x1103109f
mov eax, 0xfffffffe
pop esi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x11031150
jb 0x110310c3
test ecx, ecx
ja 0x11031150
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [esi + 0x16c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
test edi, edi
je 0x11031106
lea esp, [esp]
test ebx, ebx
je 0x110310f5
mov al, byte [ebp]
xor byte [edi + esi + 0x40], al
inc edi
inc ebp
dec ebx
and edi, 0xf
jne 0x110310e0
jmp 0x110310f9
test edi, edi
jne 0x11031142
lea ecx, [esi + 0x60]
push ecx
lea eax, [esi + 0x40]
push eax
call edx
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x1103112a
push eax
push ebp
lea ecx, [esi + 0x60]
push ecx
lea edx, [esi + 0x40]
push edx
call dword [esp + 0x28]
mov eax, dword [esp + 0x20]
add esp, 0x10
add ebp, eax
sub ebx, eax
test ebx, ebx
je 0x11031142
xor eax, eax
mov edi, ebx
test ebx, ebx
jbe 0x11031142
mov cl, byte [eax + ebp]
xor byte [esi + eax + 0x40], cl
inc eax
cmp eax, ebx
jb 0x11031136
mov dword [esi + 0x16c], edi
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret
pop ebx
or eax, 0xffffffff
pop esi
pop ecx
ret
Function at 0x11031630
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.110d22e0
push esi
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0x164]
mov eax, dword [esi + 0x174]
mov edx, dword [esi + 0x160]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
xor eax, eax
add ecx, dword [esi + 0x38]
mov dword [esp + 4], edx
adc eax, dword [esi + 0x3c]
cmp eax, 0xf
ja 0x1103181c
jb 0x1103167d
cmp ecx, 0xffffffe0
ja 0x1103181c
cmp dword [esi + 0x16c], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
je 0x110316a3
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call edx
add esp, 8
mov dword [esi + 0x16c], 0
push ebx
mov ebx, dword [esi + 0x168]
push ebp
mov ebp, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x28]
bswap ebp
test ebx, ebx
je 0x11031700
lea esp, [esp]
cmp dword [esp + 0x2c], 0
je 0x110316e9
mov al, byte [ebx + esi + 0x10]
mov ecx, dword [esp + 0x24]
xor al, byte [ecx]
dec dword [esp + 0x2c]
mov byte [edi], al
xor byte [ebx + esi + 0x40], al
inc ecx
inc ebx
inc edi
and ebx, 0xf
mov dword [esp + 0x24], ecx
jne 0x110316c0
jmp 0x110316f1
test ebx, ebx
jne 0x1103180c
lea edx, [esi + 0x60]
push edx
lea eax, [esi + 0x40]
push eax
call dword [esp + 0x18]
add esp, 8
mov ecx, dword [esp + 0x2c]
cmp ecx, 0xc00
jb 0x11031771
mov eax, 0xaaaaaaab
mul ecx
shr edx, 0xb
mov dword [esp + 0x10], edx
lea ebx, [ebx]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push esi
push ecx
push 0xc0
push edi
push edx
call dword [esp + 0x44]
add ebp, 0xc0
mov eax, ebp
bswap eax
push 0xc00
mov dword [esi + 0xc], eax
push edi
lea eax, [esi + 0x60]
push eax
lea eax, [esi + 0x40]
push eax
call dword [esp + 0x38]
mov eax, 0xc00
add dword [esp + 0x48], eax
sub dword [esp + 0x50], eax
add esp, 0x24
add edi, eax
sub dword [esp + 0x10], 1
jne 0x11031720
mov ecx, dword [esp + 0x2c]
mov eax, ecx
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x110317c4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push esi
push ecx
shr eax, 4
push eax
push edi
push edx
mov dword [esp + 0x2c], eax
call dword [esp + 0x44]
add ebp, dword [esp + 0x2c]
lea ecx, [esi + 0x60]
mov eax, ebp
bswap eax
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x24]
add dword [esp + 0x38], eax
sub dword [esp + 0x40], eax
push eax
push edi
push ecx
lea edx, [esi + 0x40]
push edx
call dword [esp + 0x38]
mov ecx, dword [esp + 0x50]
add esp, 0x24
add edi, dword [esp + 0x10]
test ecx, ecx
je 0x1103180c
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 0x170]
push eax
lea ecx, [esi + 0x10]
push ecx
push esi
call edx
mov edx, dword [esp + 0x30]
inc ebp
bswap ebp
add esp, 0xc
mov dword [esi + 0xc], ebp
lea ecx, [ebx + edi]
sub edx, edi
lea esp, [esp]
mov al, byte [esi + ebx + 0x10]
xor al, byte [edx + ecx]
mov edi, dword [esp + 0x2c]
mov byte [ecx], al
xor byte [esi + ebx + 0x40], al
dec edi
inc ebx
inc ecx
mov dword [esp + 0x2c], edi
test edi, edi
jne 0x110317f0
pop edi
pop ebp
mov dword [esi + 0x168], ebx
pop ebx
xor eax, eax
pop esi
add esp, 0xc
ret
or eax, 0xffffffff
pop esi
add esp, 0xc
ret
Function at 0x11031830
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.110d22e0
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x164]
mov eax, dword [esi + 0x174]
mov edx, dword [esi + 0x160]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], eax
xor eax, eax
add ecx, dword [esi + 0x38]
mov dword [esp + 8], edx
adc eax, dword [esi + 0x3c]
cmp eax, 0xf
ja 0x11031a1e
jb 0x1103187d
cmp ecx, 0xffffffe0
ja 0x11031a1e
cmp dword [esi + 0x16c], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
je 0x110318a3
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call edx
add esp, 8
mov dword [esi + 0x16c], 0
mov eax, dword [esi + 0xc]
push ebx
mov ebx, dword [esi + 0x168]
push ebp
mov ebp, dword [esp + 0x28]
bswap eax
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x24], eax
test ebx, ebx
je 0x110318fc
cmp dword [esp + 0x30], 0
je 0x110318e5
mov al, byte [edi]
mov dl, byte [ebx + esi + 0x10]
dec dword [esp + 0x30]
xor dl, al
mov byte [ebp], dl
xor byte [ebx + esi + 0x40], al
inc ebx
inc edi
inc ebp
and ebx, 0xf
jne 0x110318c1
jmp 0x110318ed
test ebx, ebx
jne 0x11031a0e
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x30]
cmp edx, 0xc00
jb 0x1103196d
mov eax, 0xaaaaaaab
mul edx
shr edx, 0xb
mov dword [esp + 0x14], edx
push 0xc00
push edi
lea eax, [esi + 0x60]
push eax
lea eax, [esi + 0x40]
push eax
call dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push esi
push edx
push 0xc0
push ebp
push edi
call dword [esp + 0x58]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x54], 0xc00
add eax, 0xc0
mov dword [esp + 0x48], eax
add esp, 0x24
bswap eax
add ebp, 0xc00
add edi, 0xc00
sub dword [esp + 0x14], 1
mov dword [esi + 0xc], eax
jne 0x11031916
mov edx, dword [esp + 0x30]
mov ecx, edx
and ecx, 0xfffffff0
mov dword [esp + 0x1c], ecx
je 0x110319c4
mov eax, ecx
push ecx
shr eax, 4
mov dword [esp + 0x18], eax
push edi
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
push esi
push edx
push eax
push ebp
push edi
call dword [esp + 0x58]
mov eax, dword [esp + 0x48]
add eax, dword [esp + 0x38]
add esp, 0x24
mov dword [esp + 0x24], eax
bswap eax
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x1c]
add ebp, eax
add edi, eax
sub dword [esp + 0x30], eax
mov edx, dword [esp + 0x30]
test edx, edx
je 0x11031a0e
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x170]
push ecx
lea edx, [esi + 0x10]
push edx
push esi
call eax
mov eax, dword [esp + 0x30]
inc eax
bswap eax
add esp, 0xc
mov dword [esi + 0xc], eax
lea eax, [ebx + ebp]
sub edi, ebp
lea esp, [esp]
mov cl, byte [edi + eax]
mov dl, byte [esi + ebx + 0x10]
mov ebp, dword [esp + 0x30]
xor byte [esi + ebx + 0x40], cl
xor dl, cl
dec ebp
mov byte [eax], dl
inc ebx
inc eax
mov dword [esp + 0x30], ebp
test ebp, ebp
jne 0x110319f0
pop edi
pop ebp
mov dword [esi + 0x168], ebx
pop ebx
xor eax, eax
pop esi
add esp, 0x10
ret
or eax, 0xffffffff
pop esi
add esp, 0x10
ret