joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1155757
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d871c], 1
jne 0x11557d1
or dword [0x11d871c], 1
mov dword [0x11d7354], 0x77787f54
mov dword [0x11d7358], 0x79366f64
mov dword [0x11d735c], 0x77647366
mov dword [0x11d7360], 0x36647962
mov dword [0x11d7364], 0x6265637b
mov dword [0x11d7368], 0x60777e36
mov dword [0x11d736c], 0x61623673
mov dword [0x11d7370], 0x66793679
mov dword [0x11d7374], 0x78776473
mov word [0x11d7378], 0x6572
mov byte [0x11d737a], 0x16
xor eax, eax
mov cl, byte [eax + 0x11d7354]
xor cl, 0x16
mov byte [eax + 0x11d74a4], cl
inc eax
cmp eax, 0x27
jb 0x11557d3
mov eax, 0x11d74a4
ret

Function at 0x11557ee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8718], 1
jne 0x1155857
or dword [0x11d8718], 1
mov dword [0x11d737c], 0x77787f54
mov dword [0x11d7380], 0x79366f64
mov dword [0x11d7384], 0x77647366
mov dword [0x11d7388], 0x36647962
mov dword [0x11d738c], 0x36627978
mov dword [0x11d7390], 0x7a667b7f
mov dword [0x11d7394], 0x78737b73
mov dword [0x11d7398], 0x2c727362
mov word [0x11d739c], 0x1636
xor eax, eax
mov cl, byte [eax + 0x11d737c]
xor cl, 0x16
mov byte [eax + 0x11d74cc], cl
inc eax
cmp eax, 0x22
jb 0x1155859
mov eax, 0x11d74cc
ret
Function at 0x1157209
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x115724b
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x11c1f08]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x11c1f08]
inc edx
cmp dword [ebp + 8], 0
jne 0x1157216
pop esi
not eax
pop ebp
ret

Function at 0x1158e96
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x1158ebb
cmp dword [ecx + 0x38], ebx
je 0x1158ebb
cmp eax, dword [ecx + 0x10]
jae 0x1158ebb
cmp dword [ecx + 0x14], 1
jne 0x1158ebb
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x1158ebd
xor edi, edi
cmp edi, ebx
je 0x1158fa0
cmp esi, ebx
je 0x1158fa0
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.0115863f
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x1158f4c
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.0117f0a0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x1158f71
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.0117f0a0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x1158fa2
xor eax, eax
pop edi
pop ebx
ret

Function at 0x115997b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d870c], 1
jne 0x1159a00
or dword [0x11d870c], 1
mov dword [0x11d7508], 0x7b7e7651
mov dword [0x11d750c], 0x63377372
mov dword [0x11d7510], 0x65743778
mov dword [0x11d7514], 0x72637672
mov dword [0x11d7518], 0x76627b37
mov dword [0x11d751c], 0x76636437
mov dword [0x11d7520], 0x3f377263
mov dword [0x11d7524], 0x7c657860
mov dword [0x11d7528], 0x63376572
mov dword [0x11d752c], 0x7672657f
mov dword [0x11d7530], 0x372d3e73
mov byte [0x11d7534], 0x17
xor eax, eax
mov cl, byte [eax + 0x11d7508]
xor cl, 0x17
mov byte [eax + 0x11d75d0], cl
inc eax
cmp eax, 0x2d
jb 0x1159a02
mov eax, 0x11d75d0
ret
Function at 0x1159a1d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86fc], 1
jne 0x1159a84
or dword [0x11d86fc], 1
mov dword [0x11d7544], 0x72377859
mov dword [0x11d7548], 0x65786565
mov dword [0x11d754c], 0x64727a37
mov dword [0x11d7550], 0x72707664
mov dword [0x11d7554], 0x63726537
mov dword [0x11d7558], 0x72796562
mov dword [0x11d755c], 0x6e753773
mov dword [0x11d7560], 0x75787d37
mov byte [0x11d7564], 0x17
xor eax, eax
mov cl, byte [eax + 0x11d7544]
xor cl, 0x17
mov byte [eax + 0x11d760c], cl
inc eax
cmp eax, 0x21
jb 0x1159a86
mov eax, 0x11d760c
ret

Function at 0x1159aa1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86f0], 1
jne 0x1159b0a
or dword [0x11d86f0], 1
mov dword [0x11d7590], 0x3776625b
mov dword [0x11d7594], 0x78656572
mov dword [0x11d7598], 0x62653765
mov dword [0x11d759c], 0x797e7979
mov dword [0x11d75a0], 0x65723770
mov dword [0x11d75a4], 0x37657865
mov dword [0x11d75a8], 0x7379767f
mov dword [0x11d75ac], 0x2d65727b
mov word [0x11d75b0], 0x1737
xor eax, eax
mov cl, byte [eax + 0x11d7590]
xor cl, 0x17
mov byte [eax + 0x11d7658], cl
inc eax
cmp eax, 0x22
jb 0x1159b0c
mov eax, 0x11d7658
ret

Function at 0x1159b27
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86ec], 1
jne 0x1159b79
or dword [0x11d86ec], 1
mov dword [0x11d75b4], 0x5b76627b
mov dword [0x11d75b8], 0x76787b48
mov dword [0x11d75bc], 0x65636473
mov dword [0x11d75c0], 0x3770797e
mov dword [0x11d75c4], 0x7b7e7671
mov word [0x11d75c8], 0x7372
mov byte [0x11d75ca], 0x17
xor eax, eax
mov cl, byte [eax + 0x11d75b4]
xor cl, 0x17
mov byte [eax + 0x11d767c], cl
inc eax
cmp eax, 0x17
jb 0x1159b7b
mov eax, 0x11d767c
ret
Function at 0x115a8c7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x11a2e1c
call fcn.011a1cf8
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0x11aa12c]
test eax, eax
jne 0x115a90f
call fcn.0115aa68
mov ecx, dword [ebp + 8]
push eax
call fcn.01136b33
mov eax, dword [ebp + 8]
jmp 0x115aa59
test byte [0x11d86e0], 1
jne 0x115a930
or dword [0x11d86e0], 1
mov dword [0x11d76b8], 0x38121511
mov byte [0x11d76bc], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d76b8]
xor cl, 0x18
mov byte [eax + 0x11d7e8c], cl
inc eax
cmp eax, 5
jb 0x115a932
push 0xf
mov esi, 0x11d7e8c
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x115a95d
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.01134c69
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.01134cde
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0115fd67
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.01134cff
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.01134cff
push dword [ebp - 0x10]
call dword [0x11aa0e0]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.0115adb3
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.0115aad1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.01136b70
add esp, 0xc
push 0x11c338c
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.0113d6ff
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.0113b624
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.01134cff
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.01134cff
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.01134cff
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.01134c1f
push ebx
push 1
mov ecx, esi
call fcn.01134cff
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x115aa68
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86e4], 1
jne 0x115aab4
or dword [0x11d86e4], 1
mov dword [0x11d76a0], 0x7d6a764d
mov dword [0x11d76a4], 0x767f777b
mov dword [0x11d76a8], 0x7c7d6271
mov dword [0x11d76ac], 0x6a6a7d38
mov dword [0x11d76b0], 0x7b386a77
mov dword [0x11d76b4], 0x187d7c77
xor eax, eax
mov cl, byte [eax + 0x11d76a0]
xor cl, 0x18
mov byte [eax + 0x11d7e74], cl
inc eax
cmp eax, 0x18
jb 0x115aab6
mov eax, 0x11d7e74
ret
Function at 0x115aad1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86dc], 1
jne 0x115ab0f
or dword [0x11d86dc], 1
mov dword [0x11d76c0], 0x6a7d3038
mov dword [0x11d76c4], 0x386a776a
mov dword [0x11d76c8], 0x7d7c777b
mov word [0x11d76cc], 0x3822
mov byte [0x11d76ce], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d76c0]
xor cl, 0x18
mov byte [eax + 0x11d7e94], cl
inc eax
cmp eax, 0xf
jb 0x115ab11
mov eax, 0x11d7e94
ret

Function at 0x115adb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0x11d86d8], 1
jne 0x115adde
or dword [0x11d86d8], 1
mov dword [0x11d76d0], 0x7c74743d
mov byte [0x11d76d4], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d76d0]
xor cl, 0x18
mov byte [eax + 0x11d7ea4], cl
inc eax
cmp eax, 5
jb 0x115ade0
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0x11d7ea4
push eax
call fcn.0115fdc0
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.01134cde
mov eax, esi
leave
ret

Function at 0x115af82
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86d4], 1
jne 0x115afde
or dword [0x11d86d4], 1
mov dword [0x11d76d8], 0x556c7d5f
mov dword [0x11d76dc], 0x746d7c77
mov dword [0x11d76e0], 0x74715e7d
mov dword [0x11d76e4], 0x7579567d
mov dword [0x11d76e8], 0x797e387d
mov dword [0x11d76ec], 0x7c7d7471
mov word [0x11d76f0], 0x3822
mov byte [0x11d76f2], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d76d8]
xor cl, 0x18
mov byte [eax + 0x11d7eac], cl
inc eax
cmp eax, 0x1b
jb 0x115afe0
mov eax, 0x11d7eac
ret

Function at 0x115affe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86d0], 1
jne 0x115b05b
or dword [0x11d86d0], 1
mov dword [0x11d76f4], 0x5b6c7d4b
mov dword [0x11d76f8], 0x7d6a6a6d
mov dword [0x11d76fc], 0x715c6c76
mov dword [0x11d7700], 0x6c7b7d6a
mov dword [0x11d7704], 0x38616a77
mov dword [0x11d7708], 0x7471797e
mov dword [0x11d770c], 0x38227c7d
mov byte [0x11d7710], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d76f4]
xor cl, 0x18
mov byte [eax + 0x11d7ec8], cl
inc eax
cmp eax, 0x1d
jb 0x115b05d
mov eax, 0x11d7ec8
ret

Function at 0x115b16f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86cc], 1
jne 0x115b1cc
or dword [0x11d86cc], 1
mov dword [0x11d7714], 0x5b6c7d5f
mov dword [0x11d7718], 0x7d6a6a6d
mov dword [0x11d771c], 0x715c6c76
mov dword [0x11d7720], 0x6c7b7d6a
mov dword [0x11d7724], 0x38616a77
mov dword [0x11d7728], 0x7471797e
mov dword [0x11d772c], 0x38227c7d
mov byte [0x11d7730], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d7714]
xor cl, 0x18
mov byte [eax + 0x11d7ee8], cl
inc eax
cmp eax, 0x1d
jb 0x115b1ce
mov eax, 0x11d7ee8
ret
Function at 0x115b387
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86c8], 1
jne 0x115b4f6
mov eax, 0x8744
mov ecx, eax
mov word [0x11d7738], cx
mov word [0x11d773a], cx
add ecx, 7
mov word [0x11d773c], cx
lea ecx, [eax + 0x28]
mov word [0x11d773e], cx
add ecx, 0xfffffffe
lea edx, [eax + 0x2d]
mov word [0x11d7740], cx
push ebx
mov ecx, edx
mov word [0x11d7742], cx
add ecx, 5
push esi
mov esi, ecx
lea ecx, [eax + 0x3a]
mov word [0x11d7744], si
lea esi, [eax + 0x3b]
mov word [0x11d7746], si
mov word [0x11d7754], cx
add esi, 0xfffffff8
add edx, 3
mov ecx, esi
push edi
lea edi, [eax + 0x39]
mov word [0x11d7756], cx
mov ecx, eax
mov word [0x11d774c], dx
mov edx, edi
mov word [0x11d7758], cx
mov word [0x11d775a], cx
add ecx, 0xffffffe4
mov word [0x11d774e], dx
mov edx, ecx
or dword [0x11d86c8], 1
mov word [0x11d775c], dx
lea edx, [eax - 0x18]
mov ebx, edx
mov word [0x11d775e], bx
mov ebx, ecx
mov word [0x11d7760], bx
lea ebx, [eax - 0x23]
mov word [0x11d776e], ax
mov word [0x11d7762], bx
mov ebx, ecx
mov ecx, eax
add eax, 4
mov word [0x11d7770], ax
lea eax, [ecx + 0x38]
mov word [0x11d7776], ax
add eax, 0xfffffff1
mov word [0x11d7778], ax
lea eax, [ecx + 0x37]
mov word [0x11d777a], ax
add eax, 0xfffffff1
mov word [0x11d777c], ax
lea eax, [ecx + 0x12]
mov word [0x11d777e], ax
add eax, 0x23
pop edi
mov word [0x11d7780], ax
lea eax, [ecx - 0x2c]
pop esi
mov word [0x11d7764], bx
mov dword [0x11d7748], 0x8771875e
mov dword [0x11d7750], 0x87768751
mov word [0x11d7766], dx
mov dword [0x11d7768], 0x8728875a
mov word [0x11d776c], cx
mov dword [0x11d7772], 0x8777876a
mov dword [0x11d7782], 0x877d8775
mov word [0x11d7786], ax
pop ebx
xor eax, eax
mov ecx, 0x8718
xor cx, word [eax + 0x11d7738]
add eax, 2
mov word [eax + 0x11d7f06], cx
cmp eax, 0x50
jb 0x115b4f8
mov eax, 0x11d7f08
ret

Function at 0x115b519
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86c4], 1
jne 0x115b56e
or dword [0x11d86c4], 1
mov dword [0x11d7788], 0x6e387756
mov dword [0x11d778c], 0x716b6a7d
mov dword [0x11d7790], 0x71387677
mov dword [0x11d7794], 0x38777e76
mov dword [0x11d7798], 0x71796e79
mov dword [0x11d779c], 0x747a7974
mov word [0x11d77a0], 0x187d
xor eax, eax
mov cl, byte [eax + 0x11d7788]
xor cl, 0x18
mov byte [eax + 0x11d7f58], cl
inc eax
cmp eax, 0x1a
jb 0x115b570
mov eax, 0x11d7f58
ret

Function at 0x115b75d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86c0], 1
jne 0x115b7b2
or dword [0x11d86c0], 1
mov dword [0x11d77a4], 0x6e387756
mov dword [0x11d77a8], 0x716b6a7d
mov dword [0x11d77ac], 0x71387677
mov dword [0x11d77b0], 0x38777e76
mov dword [0x11d77b4], 0x71796e79
mov dword [0x11d77b8], 0x747a7974
mov word [0x11d77bc], 0x187d
xor eax, eax
mov cl, byte [eax + 0x11d77a4]
xor cl, 0x18
mov byte [eax + 0x11d7f74], cl
inc eax
cmp eax, 0x1a
jb 0x115b7b4
mov eax, 0x11d7f74
ret
Function at 0x115b7cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86bc], 1
jne 0x115b835
or dword [0x11d86bc], 1
mov dword [0x11d77c0], 0x796e7651
mov dword [0x11d77c4], 0x387c7174
mov dword [0x11d77c8], 0x6b6a7d6e
mov dword [0x11d77cc], 0x38767771
mov dword [0x11d77d0], 0x777e7671
mov dword [0x11d77d4], 0x7f716b38
mov dword [0x11d77d8], 0x6d6c7976
mov word [0x11d77dc], 0x7d6a
mov byte [0x11d77de], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d77c0]
xor cl, 0x18
mov byte [eax + 0x11d7f90], cl
inc eax
cmp eax, 0x1f
jb 0x115b837
mov eax, 0x11d7f90
ret

Function at 0x115bb3c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86b8], 1
jne 0x115bba2
or dword [0x11d86b8], 1
mov dword [0x11d77e0], 0x7471795e
mov dword [0x11d77e4], 0x6c387c7d
mov dword [0x11d77e8], 0x7d7f3877
mov dword [0x11d77ec], 0x7d6c386c
mov dword [0x11d77f0], 0x7e386875
mov dword [0x11d77f4], 0x7d7c7477
mov dword [0x11d77f8], 0x7968386a
mov word [0x11d77fc], 0x706c
mov byte [0x11d77fe], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d77e0]
xor cl, 0x18
mov byte [eax + 0x11d7fb0], cl
inc eax
cmp eax, 0x1f
jb 0x115bba4
mov eax, 0x11d7fb0
ret

Function at 0x115bd14
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86b4], 1
jne 0x115bd66
or dword [0x11d86b4], 1
mov dword [0x11d7800], 0x5e6c7d5f
mov dword [0x11d7804], 0x7d7c7477
mov dword [0x11d7808], 0x6c79486a
mov dword [0x11d780c], 0x797e3870
mov dword [0x11d7810], 0x7c7d7471
mov word [0x11d7814], 0x3822
mov byte [0x11d7816], 0x18
xor eax, eax
mov cl, byte [eax + 0x11d7800]
xor cl, 0x18
mov byte [eax + 0x11d7fd0], cl
inc eax
cmp eax, 0x17
jb 0x115bd68
mov eax, 0x11d7fd0
ret

Function at 0x115c030
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86b0], 1
mov edx, 0x8718
jne 0x115c0c7
or dword [0x11d86b0], 1
lea ecx, [edx + 0x25]
mov eax, ecx
mov word [0x11d7818], ax
add eax, 0xb
mov word [0x11d781a], ax
push esi
lea eax, [edx + 0x52]
mov esi, eax
add eax, 0xf
mov word [0x11d7824], ax
lea eax, [edx + 0x5d]
mov word [0x11d7826], ax
add eax, 0xffffffda
mov word [0x11d7828], ax
lea eax, [edx + 0x16]
mov word [0x11d781c], si
add esi, 0xd
mov word [0x11d782a], ax
add eax, 0xfffffffe
mov word [0x11d782c], ax
lea eax, [edx + 0x13]
mov word [0x11d782e], ax
mov eax, edx
mov word [0x11d781e], si
mov dword [0x11d7820], 0x876a877f
mov dword [0x11d7830], 0x873d872a
mov word [0x11d7834], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x11d7818]
add eax, 2
mov word [eax + 0x11d7fe6], cx
cmp eax, 0x1e
jb 0x115c0c9
mov eax, 0x11d7fe8
ret

Function at 0x115c0e7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86ac], 1
mov ecx, 0x8718
jne 0x115c128
or dword [0x11d86ac], 1
lea eax, [ecx + 0x4b]
mov word [0x11d7838], ax
add eax, 5
mov word [0x11d783a], ax
lea eax, [ecx + 0x66]
mov word [0x11d783c], ax
add eax, 0xffffffe7
mov word [0x11d783e], ax
mov eax, ecx
mov word [0x11d7840], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11d7838]
add eax, 2
mov word [eax + 0x11d8006], dx
cmp eax, 0xa
jb 0x115c12a
mov eax, 0x11d8008
ret
Function at 0x115c148
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86a8], 1
mov ecx, 0x8718
jne 0x115c19b
or dword [0x11d86a8], 1
lea eax, [ecx + 0x4b]
mov word [0x11d7844], ax
add eax, 5
mov word [0x11d7846], ax
lea eax, [ecx + 0x66]
mov word [0x11d7848], ax
add eax, 0xffffffad
mov word [0x11d784a], ax
lea eax, [ecx + 0x12]
mov word [0x11d784c], ax
add eax, 0x3b
mov word [0x11d784e], ax
mov eax, ecx
mov word [0x11d7850], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11d7844]
add eax, 2
mov word [eax + 0x11d8012], dx
cmp eax, 0xe
jb 0x115c19d
mov eax, 0x11d8014
ret

Function at 0x115c1bb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86a4], 1
mov ecx, 0x8718
jne 0x115c20e
or dword [0x11d86a4], 1
lea eax, [ecx + 0x4b]
mov word [0x11d7854], ax
add eax, 5
mov word [0x11d7856], ax
lea eax, [ecx + 0x66]
mov word [0x11d7858], ax
add eax, 0xffffffb0
mov word [0x11d785a], ax
lea eax, [ecx + 0x14]
mov word [0x11d785c], ax
add eax, 0x39
mov word [0x11d785e], ax
mov eax, ecx
mov word [0x11d7860], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11d7854]
add eax, 2
mov word [eax + 0x11d8022], dx
cmp eax, 0xe
jb 0x115c210
mov eax, 0x11d8024
ret

Function at 0x115c22e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d86a0], 1
mov ecx, 0x8718
jne 0x115c26f
or dword [0x11d86a0], 1
lea eax, [ecx + 0x4b]
mov word [0x11d7864], ax
add eax, 5
mov word [0x11d7866], ax
lea eax, [ecx + 0x66]
mov word [0x11d7868], ax
add eax, 0xffffffe7
mov word [0x11d786a], ax
mov eax, ecx
mov word [0x11d786c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11d7864]
add eax, 2
mov word [eax + 0x11d8032], dx
cmp eax, 0xa
jb 0x115c271
mov eax, 0x11d8034
ret

Function at 0x115c28f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d869c], 1
mov ecx, 0x8718
jne 0x115c2e2
or dword [0x11d869c], 1
lea eax, [ecx + 0x4b]
mov word [0x11d7870], ax
add eax, 5
mov word [0x11d7872], ax
lea eax, [ecx + 0x66]
mov word [0x11d7874], ax
add eax, 0xffffffad
mov word [0x11d7876], ax
lea eax, [ecx + 0x12]
mov word [0x11d7878], ax
add eax, 0x3b
mov word [0x11d787a], ax
mov eax, ecx
mov word [0x11d787c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11d7870]
add eax, 2
mov word [eax + 0x11d803e], dx
cmp eax, 0xe
jb 0x115c2e4
mov eax, 0x11d8040
ret
Function at 0x115c3dc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8698], 1
mov ecx, 0x8718
jne 0x115c5f9
or dword [0x11d8698], 1
lea eax, [ecx + 0x10]
mov word [0x11d7888], ax
inc eax
mov word [0x11d788a], ax
lea eax, [ecx + 0x12]
mov word [0x11d788c], ax
inc eax
mov word [0x11d788e], ax
lea eax, [ecx + 0x14]
mov word [0x11d7890], ax
inc eax
mov word [0x11d7892], ax
lea eax, [ecx + 0x16]
mov word [0x11d7894], ax
inc eax
mov word [0x11d7896], ax
lea eax, [ecx + 8]
mov word [0x11d7898], ax
inc eax
mov word [0x11d789a], ax
lea eax, [ecx + 0x41]
mov word [0x11d789c], ax
inc eax
mov word [0x11d789e], ax
lea eax, [ecx + 0x43]
mov word [0x11d78a0], ax
inc eax
mov word [0x11d78a2], ax
lea eax, [ecx + 0x45]
mov word [0x11d78a4], ax
inc eax
mov word [0x11d78a6], ax
lea eax, [ecx + 0x47]
mov word [0x11d78a8], ax
add eax, 0xfffffff1
mov word [0x11d78aa], ax
lea eax, [ecx + 0x39]
mov word [0x11d78ac], ax
inc eax
mov word [0x11d78ae], ax
lea eax, [ecx + 0x3b]
mov word [0x11d78b0], ax
inc eax
mov word [0x11d78b2], ax
lea eax, [ecx + 0x3d]
mov word [0x11d78b4], ax
inc eax
mov word [0x11d78b6], ax
lea eax, [ecx + 0x3f]
mov word [0x11d78b8], ax
add eax, 0xfffffff1
mov word [0x11d78ba], ax
lea eax, [ecx + 0x31]
mov word [0x11d78bc], ax
inc eax
mov word [0x11d78be], ax
lea eax, [ecx + 0x33]
mov word [0x11d78c0], ax
inc eax
mov word [0x11d78c2], ax
lea eax, [ecx + 0x35]
mov word [0x11d78c4], ax
inc eax
mov word [0x11d78c6], ax
lea eax, [ecx + 0x37]
mov word [0x11d78c8], ax
add eax, 0xfffffff1
mov word [0x11d78ca], ax
lea eax, [ecx + 0x29]
mov word [0x11d78cc], ax
inc eax
mov word [0x11d78ce], ax
lea eax, [ecx + 0x61]
mov word [0x11d78d0], ax
inc eax
mov word [0x11d78d2], ax
lea eax, [ecx + 0x63]
mov word [0x11d78d4], ax
inc eax
mov word [0x11d78d6], ax
lea eax, [ecx + 0x65]
mov word [0x11d78d8], ax
inc eax
mov word [0x11d78da], ax
lea eax, [ecx + 0x67]
mov word [0x11d78dc], ax
add eax, 0xfffffff1
mov word [0x11d78de], ax
lea eax, [ecx + 0x59]
mov word [0x11d78e0], ax
inc eax
mov word [0x11d78e2], ax
lea eax, [ecx + 0x5b]
mov word [0x11d78e4], ax
inc eax
mov word [0x11d78e6], ax
lea eax, [ecx + 0x5d]
mov word [0x11d78e8], ax
inc eax
mov word [0x11d78ea], ax
lea eax, [ecx + 0x5f]
mov word [0x11d78ec], ax
add eax, 0xfffffff1
mov word [0x11d78ee], ax
lea eax, [ecx + 0x51]
mov word [0x11d78f0], ax
inc eax
mov word [0x11d78f2], ax
lea eax, [ecx + 0x53]
mov word [0x11d78f4], ax
inc eax
mov word [0x11d78f6], ax
lea eax, [ecx + 0x55]
mov word [0x11d78f8], ax
inc eax
mov word [0x11d78fa], ax
lea eax, [ecx + 0x57]
mov word [0x11d78fc], ax
add eax, 0xfffffff1
mov word [0x11d78fe], ax
lea eax, [ecx + 0x49]
mov word [0x11d7900], ax
inc eax
mov word [0x11d7902], ax
mov eax, ecx
mov word [0x11d7904], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11d7888]
add eax, 2
mov word [eax + 0x11d804e], dx
cmp eax, 0x7e
jb 0x115c5fb
mov eax, 0x11d8050
ret