joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11380da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c48], 1
jne 0x1138170
or dword [0x11d8c48], 1
mov dword [0x11d3e04], 0x6560684f
mov dword [0x11d3e08], 0x7d296d6c
mov dword [0x11d3e0c], 0x7f6c2966
mov dword [0x11d3e10], 0x687c6568
mov dword [0x11d3e14], 0x6b296c7d
mov dword [0x11d3e18], 0x7a7d6666
mov dword [0x11d3e1c], 0x79687b7d
mov dword [0x11d3e20], 0x687b6f29
mov dword [0x11d3e24], 0x676c646e
mov dword [0x11d3e28], 0x7a29257d
mov dword [0x11d3e2c], 0x687d6770
mov dword [0x11d3e30], 0x7b6c2971
mov dword [0x11d3e34], 0x97b667b
xor eax, eax
mov cl, byte [eax + 0x11d3e04]
xor cl, 9
mov byte [eax + 0x11d43f4], cl
inc eax
cmp eax, 0x34
jb 0x1138172
mov eax, 0x11d43f4
ret

Function at 0x113818d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c44], 1
jne 0x1138223
or dword [0x11d8c44], 1
mov dword [0x11d3e38], 0x6560684f
mov dword [0x11d3e3c], 0x7d296d6c
mov dword [0x11d3e40], 0x7f6c2966
mov dword [0x11d3e44], 0x687c6568
mov dword [0x11d3e48], 0x6b296c7d
mov dword [0x11d3e4c], 0x7a7d6666
mov dword [0x11d3e50], 0x79687b7d
mov dword [0x11d3e54], 0x687b6f29
mov dword [0x11d3e58], 0x676c646e
mov dword [0x11d3e5c], 0x6429257d
mov dword [0x11d3e60], 0x7b66646c
mov dword [0x11d3e64], 0x7b6c2970
mov dword [0x11d3e68], 0x97b667b
xor eax, eax
mov cl, byte [eax + 0x11d3e38]
xor cl, 9
mov byte [eax + 0x11d4428], cl
inc eax
cmp eax, 0x34
jb 0x1138225
mov eax, 0x11d4428
ret

Function at 0x1138240
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c40], 1
jne 0x11382a7
or dword [0x11d8c40], 1
mov dword [0x11d3e6c], 0x6762675c
mov dword [0x11d3e70], 0x29677e66
mov dword [0x11d3e74], 0x667b7b6c
mov dword [0x11d3e78], 0x6760297b
mov dword [0x11d3e7c], 0x687c6529
mov dword [0x11d3e80], 0x66655645
mov dword [0x11d3e84], 0x7d7a6d68
mov dword [0x11d3e88], 0x6e67607b
mov byte [0x11d3e8c], 9
xor eax, eax
mov cl, byte [eax + 0x11d3e6c]
xor cl, 9
mov byte [eax + 0x11d445c], cl
inc eax
cmp eax, 0x21
jb 0x11382a9
mov eax, 0x11d445c
ret

Function at 0x11382c4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c3c], 1
jne 0x11382ee
or dword [0x11d8c3c], 1
mov dword [0x11d3e90], 0x67666735
mov word [0x11d3e94], 0x376c
mov byte [0x11d3e96], 9
xor eax, eax
mov cl, byte [eax + 0x11d3e90]
xor cl, 9
mov byte [eax + 0x11d4480], cl
inc eax
cmp eax, 7
jb 0x11382f0
mov eax, 0x11d4480
ret

Function at 0x113830b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c38], 1
jne 0x113834d
or dword [0x11d8c38], 1
mov dword [0x11d3e98], 0x29687c45
mov dword [0x11d3e9c], 0x7d677c7b
mov dword [0x11d3ea0], 0x296c6460
mov dword [0x11d3ea4], 0x667b7b6c
mov dword [0x11d3ea8], 0x929337b
xor eax, eax
mov cl, byte [eax + 0x11d3e98]
xor cl, 9
mov byte [eax + 0x11d4488], cl
inc eax
cmp eax, 0x14
jb 0x113834f
mov eax, 0x11d4488
ret
Function at 0x113836a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c34], 1
jne 0x11383b2
or dword [0x11d8c34], 1
mov dword [0x11d3eac], 0x29687c45
mov dword [0x11d3eb0], 0x66646c64
mov dword [0x11d3eb4], 0x6c29707b
mov dword [0x11d3eb8], 0x7b667b7b
mov word [0x11d3ebc], 0x2933
mov byte [0x11d3ebe], 9
xor eax, eax
mov cl, byte [eax + 0x11d3eac]
xor cl, 9
mov byte [eax + 0x11d449c], cl
inc eax
cmp eax, 0x13
jb 0x11383b4
mov eax, 0x11d449c
ret

Function at 0x11383cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c30], 1
jne 0x1138436
or dword [0x11d8c30], 1
mov dword [0x11d3ec0], 0x29687c45
mov dword [0x11d3ec4], 0x667b7b6c
mov dword [0x11d3ec8], 0x6760297b
mov dword [0x11d3ecc], 0x6c6d607a
mov dword [0x11d3ed0], 0x7b7b6c29
mov dword [0x11d3ed4], 0x61297b66
mov dword [0x11d3ed8], 0x656d6768
mov dword [0x11d3edc], 0x29337b6c
mov byte [0x11d3ee0], 9
xor eax, eax
mov cl, byte [eax + 0x11d3ec0]
xor cl, 9
mov byte [eax + 0x11d44b0], cl
inc eax
cmp eax, 0x21
jb 0x1138438
mov eax, 0x11d44b0
ret

Function at 0x1138453
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c2c], 1
jne 0x11384af
or dword [0x11d8c2c], 1
mov dword [0x11d3ee4], 0x6762675c
mov dword [0x11d3ee8], 0x29677e66
mov dword [0x11d3eec], 0x667b7b6c
mov dword [0x11d3ef0], 0x6760297b
mov dword [0x11d3ef4], 0x687c6529
mov dword [0x11d3ef8], 0x686a7956
mov word [0x11d3efc], 0x6565
mov byte [0x11d3efe], 9
xor eax, eax
mov cl, byte [eax + 0x11d3ee4]
xor cl, 9
mov byte [eax + 0x11d44d4], cl
inc eax
cmp eax, 0x1b
jb 0x11384b1
mov eax, 0x11d44d4
ret

Function at 0x11386ed
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c28], 1
jne 0x1138736
or dword [0x11d8c28], 1
mov dword [0x11d3f00], 0x6c7a684b
mov dword [0x11d3f04], 0x6d293d3f
mov dword [0x11d3f08], 0x6d666a6c
mov dword [0x11d3f0c], 0x686f296c
mov dword [0x11d3f10], 0x6d6c6560
mov byte [0x11d3f14], 9
xor eax, eax
mov cl, byte [eax + 0x11d3f00]
xor cl, 9
mov byte [eax + 0x11d44f0], cl
inc eax
cmp eax, 0x15
jb 0x1138738
mov eax, 0x11d44f0
ret
Function at 0x1138753
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x11a4a1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0115c73c
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0115ab2c
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.01134e3d
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.0113acc6
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x11387e0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0115f744
add esp, 0x10
test al, al
jne 0x1138825
call fcn.0113889c
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.0117ba25
push 0x11c44a8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.01185926
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.0113acc6
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x1138865
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x1138844
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.0113a131
lea esi, [esp + 0x20]
call fcn.01134bf7
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.01134cff
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x113889c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c24], 1
jne 0x11388e5
or dword [0x11d8c24], 1
mov dword [0x11d3f18], 0x6c7a684b
mov dword [0x11d3f1c], 0x6d293d3f
mov dword [0x11d3f20], 0x6d666a6c
mov dword [0x11d3f24], 0x686f296c
mov dword [0x11d3f28], 0x6d6c6560
mov byte [0x11d3f2c], 9
xor eax, eax
mov cl, byte [eax + 0x11d3f18]
xor cl, 9
mov byte [eax + 0x11d4508], cl
inc eax
cmp eax, 0x15
jb 0x11388e7
mov eax, 0x11d4508
ret

Function at 0x1138fda
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c20], 1
jne 0x113902f
or dword [0x11d8c20], 1
mov dword [0x11d3f30], 0x657c664a
mov dword [0x11d3f34], 0x6667296d
mov dword [0x11d3f38], 0x7966297d
mov dword [0x11d3f3c], 0x6a29676c
mov dword [0x11d3f40], 0x617a687b
mov dword [0x11d3f44], 0x647c6d29
mov word [0x11d3f48], 0x979
xor eax, eax
mov cl, byte [eax + 0x11d3f30]
xor cl, 9
mov byte [eax + 0x11d4520], cl
inc eax
cmp eax, 0x1a
jb 0x1139031
mov eax, 0x11d4520
ret
Function at 0x113904c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c18], 1
jne 0x113906f
or dword [0x11d8c18], 1
mov dword [0x11d3f50], 0x6e666526
mov word [0x11d3f54], 0x926
xor eax, eax
mov cl, byte [eax + 0x11d3f50]
xor cl, 9
mov byte [eax + 0x11d4540], cl
inc eax
cmp eax, 6
jb 0x1139071
mov eax, 0x11d4540
ret

Function at 0x113908c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c14], 1
jne 0x1139107
or dword [0x11d8c14], 1
mov dword [0x11d3f58], 0x797d7d61
mov dword [0x11d3f5c], 0x68262633
mov dword [0x11d3f60], 0x70656867
mov dword [0x11d3f64], 0x7a6a607d
mov dword [0x11d3f68], 0x7d6c6e27
mov dword [0x11d3f6c], 0x677e666d
mov dword [0x11d3f70], 0x7d7a6c7d
mov dword [0x11d3f74], 0x64666a27
mov dword [0x11d3f78], 0x263b7f26
mov dword [0x11d3f7c], 0x266e6665
mov byte [0x11d3f80], 9
xor eax, eax
mov cl, byte [eax + 0x11d3f58]
xor cl, 9
mov byte [eax + 0x11d4548], cl
inc eax
cmp eax, 0x29
jb 0x1139109
mov eax, 0x11d4548
ret

Function at 0x1139124
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c10], 1
jne 0x113914f
or dword [0x11d8c10], 1
mov dword [0x11d3f84], 0x7a2f346a
mov dword [0x11d3f88], 0x347d2f34
mov byte [0x11d3f8c], 9
xor eax, eax
mov cl, byte [eax + 0x11d3f84]
xor cl, 9
mov byte [eax + 0x11d4574], cl
inc eax
cmp eax, 9
jb 0x1139151
mov eax, 0x11d4574
ret

Function at 0x113916c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8c00], 1
jne 0x11391f4
or dword [0x11d8c00], 1
mov dword [0x11d3fa0], 0x7d67664a
mov dword [0x11d3fa4], 0x247d676c
mov dword [0x11d3fa8], 0x6c79705d
mov dword [0x11d3fac], 0x79682933
mov dword [0x11d3fb0], 0x6a606579
mov dword [0x11d3fb4], 0x66607d68
mov dword [0x11d3fb8], 0x24712667
mov dword [0x11d3fbc], 0x247e7e7e
mov dword [0x11d3fc0], 0x647b666f
mov dword [0x11d3fc4], 0x657b7c24
mov dword [0x11d3fc8], 0x666a676c
mov dword [0x11d3fcc], 0x96d6c6d
xor eax, eax
mov cl, byte [eax + 0x11d3fa0]
xor cl, 9
mov byte [eax + 0x11d4590], cl
inc eax
cmp eax, 0x30
jb 0x11391f6
mov eax, 0x11d4590
ret

Function at 0x1139211
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bfc], 1
jne 0x113923c
or dword [0x11d8bfc], 1
mov dword [0x11d3fd0], 0x5d5a4659
mov dword [0x11d3fd4], 0x29667d29
mov byte [0x11d3fd8], 9
xor eax, eax
mov cl, byte [eax + 0x11d3fd0]
xor cl, 9
mov byte [eax + 0x11d45c0], cl
inc eax
cmp eax, 9
jb 0x113923e
mov eax, 0x11d45c0
ret

Function at 0x1139259
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bf8], 1
jne 0x11392a2
or dword [0x11d8bf8], 1
mov dword [0x11d3fdc], 0x60686f29
mov dword [0x11d3fe0], 0x296d6c65
mov dword [0x11d3fe4], 0x617d607e
mov dword [0x11d3fe8], 0x687d7a29
mov dword [0x11d3fec], 0x297a7c7d
mov byte [0x11d3ff0], 9
xor eax, eax
mov cl, byte [eax + 0x11d3fdc]
xor cl, 9
mov byte [eax + 0x11d45cc], cl
inc eax
cmp eax, 0x15
jb 0x11392a4
mov eax, 0x11d45cc
ret
Function at 0x11392d9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x11a329a
call fcn.011a1cf8
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x113948a
cmp dword [ebp + 0x10], ebx
je 0x113948a
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.0113a627
push eax
push 0x11c2c70
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.01135493
push 0x11c2c6c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.011354c9
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.01134e3d
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.01134e3d
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x11393e5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.0113a627
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.0113a649
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1139399
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0113e0c4
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.01134e3d
inc bl
jne 0x1139451
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.01134e3d
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x1139360
test byte [0x11d8bf0], 1
jne 0x1139412
or dword [0x11d8bf0], 1
mov dword [0x11d4000], 0x297d6647
mov dword [0x11d4004], 0x677c666f
mov word [0x11d4008], 0x96d
xor eax, eax
mov cl, byte [eax + 0x11d4000]
xor cl, 9
mov byte [eax + 0x11d45f0], cl
inc eax
cmp eax, 0xa
jb 0x1139414
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x11d45f0
call fcn.0117ba25
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x11c44a8
lea eax, [ebp - 0x44]
push eax
call fcn.01185926
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.0113a649
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.01134e3d
push 1
lea esi, [ebp - 0x2c]
call fcn.01134e3d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.011394af
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.0117ba25
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x11c44a8
lea eax, [ebp - 0x38]
jmp 0x113944b

Function at 0x11394af
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bf4], 1
jne 0x11394dc
or dword [0x11d8bf4], 1
mov dword [0x11d3ff4], 0x297d6647
mov dword [0x11d3ff8], 0x677c666f
mov word [0x11d3ffc], 0x96d
xor eax, eax
mov cl, byte [eax + 0x11d3ff4]
xor cl, 9
mov byte [eax + 0x11d45e4], cl
inc eax
cmp eax, 0xa
jb 0x11394de
mov eax, 0x11d45e4
ret
Function at 0x1139c93
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bec], 1
mov ecx, 0x8709
jne 0x1139d1d
or dword [0x11d8bec], 1
lea eax, [ecx + 0x61]
mov word [0x11d400c], ax
add eax, 0x11
mov edx, eax
mov word [0x11d400e], dx
lea edx, [ecx + 0x5f]
mov word [0x11d4010], dx
add edx, 0x12
mov word [0x11d4012], dx
lea edx, [ecx + 0x58]
mov word [0x11d4014], dx
add edx, 0xfffffff5
mov word [0x11d4016], dx
mov edx, eax
mov word [0x11d4018], dx
lea edx, [ecx + 0x63]
lea eax, [ecx + 0x74]
mov word [0x11d401a], dx
mov word [0x11d4022], ax
add edx, 0xd
mov eax, ecx
mov word [0x11d401c], dx
mov dword [0x11d401e], 0x877b8766
mov word [0x11d4024], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11d400c]
add eax, 2
mov word [eax + 0x11d45fa], dx
cmp eax, 0x1a
jb 0x1139d1f
mov eax, 0x11d45fc
ret

Function at 0x1139d3d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8be8], 1
jne 0x1139d68
or dword [0x11d8be8], 1
mov dword [0x11d4028], 0x677b6c62
mov dword [0x11d402c], 0x3b3a656c
mov byte [0x11d4030], 9
xor eax, eax
mov cl, byte [eax + 0x11d4028]
xor cl, 9
mov byte [eax + 0x11d4618], cl
inc eax
cmp eax, 9
jb 0x1139d6a
mov eax, 0x11d4618
ret

Function at 0x1139d85
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8be4], 1
jne 0x1139dee
or dword [0x11d8be4], 1
mov dword [0x11d4034], 0x597d6c5a
mov dword [0x11d4038], 0x6c6a667b
mov dword [0x11d403c], 0x7a5c7a7a
mov dword [0x11d4040], 0x66447b6c
mov dword [0x11d4044], 0x714c6c6d
mov dword [0x11d4048], 0x7d796c6a
mov dword [0x11d404c], 0x59676660
mov dword [0x11d4050], 0x6a606566
mov word [0x11d4054], 0x970
xor eax, eax
mov cl, byte [eax + 0x11d4034]
xor cl, 9
mov byte [eax + 0x11d4624], cl
inc eax
cmp eax, 0x22
jb 0x1139df0
mov eax, 0x11d4624
ret

Function at 0x1139e0b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8be0], 1
jne 0x1139e74
or dword [0x11d8be0], 1
mov dword [0x11d4058], 0x597d6c4e
mov dword [0x11d405c], 0x6c6a667b
mov dword [0x11d4060], 0x7a5c7a7a
mov dword [0x11d4064], 0x66447b6c
mov dword [0x11d4068], 0x714c6c6d
mov dword [0x11d406c], 0x7d796c6a
mov dword [0x11d4070], 0x59676660
mov dword [0x11d4074], 0x6a606566
mov word [0x11d4078], 0x970
xor eax, eax
mov cl, byte [eax + 0x11d4058]
xor cl, 9
mov byte [eax + 0x11d4648], cl
inc eax
cmp eax, 0x22
jb 0x1139e76
mov eax, 0x11d4648
ret

Function at 0x1139e91
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bdc], 1
jne 0x1139ee7
or dword [0x11d8bdc], 1
mov dword [0x11d407c], 0x296c6546
mov dword [0x11d4080], 0x7d606760
mov dword [0x11d4084], 0x60656860
mov dword [0x11d4088], 0x607d6873
mov dword [0x11d408c], 0x6f296766
mov dword [0x11d4090], 0x6c656068
mov dword [0x11d4094], 0x929336d
xor eax, eax
mov cl, byte [eax + 0x11d407c]
xor cl, 9
mov byte [eax + 0x11d466c], cl
inc eax
cmp eax, 0x1c
jb 0x1139ee9
mov eax, 0x11d466c
ret
Function at 0x1139f04
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bd8], 1
mov ecx, 0x8709
jne 0x1139f33
or dword [0x11d8bd8], 1
lea eax, [ecx + 0x5f]
mov word [0x11d4098], ax
add eax, 0xffffffd3
mov word [0x11d409a], ax
mov eax, ecx
mov word [0x11d409c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11d4098]
add eax, 2
mov word [eax + 0x11d4686], dx
cmp eax, 6
jb 0x1139f35
mov eax, 0x11d4688
ret

Function at 0x1139f53
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bd0], 1
jne 0x1139fc3
or dword [0x11d8bd0], 1
mov dword [0x11d40a8], 0x6560684f
mov dword [0x11d40ac], 0x7d296d6c
mov dword [0x11d40b0], 0x67602966
mov dword [0x11d40b4], 0x68607d60
mov dword [0x11d40b8], 0x6c736065
mov dword [0x11d40bc], 0x7f676c29
mov dword [0x11d40c0], 0x67667b60
mov dword [0x11d40c4], 0x7d676c64
mov word [0x11d40c8], 0x2933
mov byte [0x11d40ca], 9
xor eax, eax
mov cl, byte [eax + 0x11d40a8]
xor cl, 9
mov byte [eax + 0x11d4698], cl
inc eax
cmp eax, 0x23
jb 0x1139fc5
mov eax, 0x11d4698
ret

Function at 0x1139fe0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bc8], 1
jne 0x113a02b
or dword [0x11d8bc8], 1
mov dword [0x11d40d4], 0x6861675c
mov dword [0x11d40d8], 0x6c656d67
mov dword [0x11d40dc], 0x716c296d
mov dword [0x11d40e0], 0x7d796c6a
mov dword [0x11d40e4], 0x33676660
mov word [0x11d40e8], 0x929
xor eax, eax
mov cl, byte [eax + 0x11d40d4]
xor cl, 9
mov byte [eax + 0x11d46c4], cl
inc eax
cmp eax, 0x16
jb 0x113a02d
mov eax, 0x11d46c4
ret

Function at 0x113a048
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bc4], 1
jne 0x113a09b
or dword [0x11d8bc4], 1
mov dword [0x11d40ec], 0x6861675c
mov dword [0x11d40f0], 0x6c656d67
mov dword [0x11d40f4], 0x716c296d
mov dword [0x11d40f8], 0x7d796c6a
mov dword [0x11d40fc], 0x33676660
mov dword [0x11d4100], 0x37a2c29
mov byte [0x11d4104], 9
xor eax, eax
mov cl, byte [eax + 0x11d40ec]
xor cl, 9
mov byte [eax + 0x11d46dc], cl
inc eax
cmp eax, 0x19
jb 0x113a09d
mov eax, 0x11d46dc
ret

Function at 0x113a0b8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bc0], 1
jne 0x113a0f0
or dword [0x11d8bc0], 1
mov dword [0x11d4108], 0x6b7c7d5a
mov dword [0x11d410c], 0x60716c29
mov dword [0x11d4110], 0x2c21297d
mov dword [0x11d4114], 0x903206d
xor eax, eax
mov cl, byte [eax + 0x11d4108]
xor cl, 9
mov byte [eax + 0x11d46f8], cl
inc eax
cmp eax, 0x10
jb 0x113a0f2
mov eax, 0x11d46f8
ret
Function at 0x113bae8
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x11a2a99
call fcn.011a1cf8
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x113bbcc
cmp byte [edi + 0x49], bl
je 0x113bbcc
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x113bb1f
xor al, al
jmp 0x113bbce
push esi
lea esi, [ebp - 0x2c]
call fcn.0113b5e1
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x113bb6f
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x113bb74
dec eax
je 0x113bb78
dec eax
dec eax
je 0x113bbc8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.01134cff
mov al, bl
pop esi
jmp 0x113bbce
mov edx, dword [ebp - 0x2c]
jmp 0x113bb39
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x113bb84
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x113bbaa
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x113bb97
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0117d7fe
add esp, 0x10
cmp esi, eax
jne 0x113bb5c
cmp byte [edi + 0x49], 0
je 0x113bbc8
test esi, esi
jne 0x113bb2b
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0113b6ba
jmp 0x113bb2b
mov bl, 1
jmp 0x113bb5e
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x11403d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bbc], 1
jne 0x1140446
or dword [0x11d8bbc], 1
mov dword [0x11d4718], 0x667f6549
mov dword [0x11d471c], 0x65642a6e
mov dword [0x11d4720], 0x6f6d2a7e
mov dword [0x11d4724], 0x636e2a7e
mov dword [0x11d4728], 0x6e637a79
mov dword [0x11d472c], 0x2a6c652a
mov dword [0x11d4730], 0x627e6f67
mov dword [0x11d4734], 0x2d2a6e65
mov dword [0x11d4738], 0x66666b69
mov dword [0x11d473c], 0xa2a302d
xor eax, eax
mov cl, byte [eax + 0x11d4718]
xor cl, 0xa
mov byte [eax + 0x11d485c], cl
inc eax
cmp eax, 0x28
jb 0x1140448
mov eax, 0x11d485c
ret

Function at 0x1140463
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8bb8], 1
jne 0x11404ca
or dword [0x11d8bb8], 1
mov dword [0x11d4740], 0x66636b4c
mov dword [0x11d4744], 0x7e2a6e6f
mov dword [0x11d4748], 0x64632a65
mov dword [0x11d474c], 0x6f61657c
mov dword [0x11d4750], 0x7e6f672a
mov dword [0x11d4754], 0x2a6e6562
mov dword [0x11d4758], 0x666b692d
mov dword [0x11d475c], 0x2a302d66
mov byte [0x11d4760], 0xa
xor eax, eax
mov cl, byte [eax + 0x11d4740]
xor cl, 0xa
mov byte [eax + 0x11d4884], cl
inc eax
cmp eax, 0x21
jb 0x11404cc
mov eax, 0x11d4884
ret
Function at 0x11404e7
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x11d8bb4], 1
jne 0x1140549
or dword [0x11d8bb4], 1
mov dword [0x11d4764], 0x65785a00
mov dword [0x11d4768], 0x66686b68
mov dword [0x11d476c], 0x7f6e2a73
mov dword [0x11d4770], 0x657e2a6f
mov dword [0x11d4774], 0x7869792a
mov dword [0x11d4778], 0x2a7e7a63
mov dword [0x11d477c], 0x6578786f
mov dword [0x11d4780], 0xa2a3078
mov cl, byte [eax + 0x11d4764]
xor cl, 0xa
mov byte [eax + 0x11d48a8], cl
inc eax
cmp eax, 0x20
jb 0x1140549
mov eax, 0x11d48a8
ret

Function at 0x1140b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x1140c69
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x11d8bb0], 1
jne 0x1140b86
or dword [0x11d8bb0], 1
mov eax, 0x8779
mov word [0x11d4784], ax
add eax, 0xfffffff6
mov word [0x11d4786], ax
mov eax, 0x8764
mov word [0x11d4788], ax
add eax, 0xa
mov word [0x11d478a], ax
mov eax, 0x870a
mov word [0x11d478c], ax
xor eax, eax
mov ecx, 0x870a
xor cx, word [eax + 0x11d4784]
add eax, 2
mov word [eax + 0x11d48c6], cx
cmp eax, 0xa
jb 0x1140b88
mov eax, dword [ebx + edi]
mov ecx, 0x11d48c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1140bcf
test dx, dx
je 0x1140bcb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1140bcf
add eax, esi
add ecx, esi
test dx, dx
jne 0x1140bab
xor eax, eax
jmp 0x1140bd4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1140be0
mov dword [edi], 0x385
jmp 0x1140c58
call fcn.01140c79
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1140c0c
test dx, dx
je 0x1140c08
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1140c0c
add ecx, esi
add eax, esi
test dx, dx
jne 0x1140be8
xor eax, eax
jmp 0x1140c11
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1140c1d
mov dword [edi], 0x386
jmp 0x1140c58
call fcn.01140d4c
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1140c49
test dx, dx
je 0x1140c45
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1140c49
add ecx, esi
add eax, esi
test dx, dx
jne 0x1140c25
xor eax, eax
jmp 0x1140c4e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1140c72
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x1140b43
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x1140c6b