joyce8/EMBER2024-capa huggingface dataset:
Function at 0x111dad
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27e0], 1
jne 0x111e13
or dword [0x1b27e0], 1
mov dword [0x1b09a4], 0xced4d3cf
mov dword [0x1b09a8], 0xd6e58889
mov dword [0x1b09ac], 0xced2ddd3
mov dword [0x1b09b0], 0xc8dfc9cf
mov dword [0x1b09b4], 0xdbcedbde
mov dword [0x1b09b8], 0xe5d5cee5
mov dword [0x1b09bc], 0xd8d7cfd4
mov word [0x1b09c0], 0xc8df
mov byte [0x1b09c2], 0xba
xor eax, eax
mov cl, byte [eax + 0x1b09a4]
xor cl, 0xba
mov byte [eax + 0x1b0b7c], cl
inc eax
cmp eax, 0x1f
jb 0x111e15
mov eax, 0x1b0b7c
ret

Function at 0x111e30
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27dc], 1
jne 0x111e8f
or dword [0x1b27dc], 1
mov dword [0x1b09c4], 0x89ced4d3
mov dword [0x1b09c8], 0xd3d6e588
mov dword [0x1b09cc], 0xcfced2dd
mov dword [0x1b09d0], 0xdec8dfc9
mov dword [0x1b09d4], 0xe5dbcedb
mov dword [0x1b09d8], 0xd4e5d5ce
mov dword [0x1b09dc], 0xdfd8d7cf
mov word [0x1b09e0], 0xbac8
xor eax, eax
mov cl, byte [eax + 0x1b09c4]
xor cl, 0xba
mov byte [eax + 0x1b0b9c], cl
inc eax
cmp eax, 0x1e
jb 0x111e91
mov eax, 0x1b0b9c
ret

Function at 0x111eac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27d8], 1
jne 0x111f0b
or dword [0x1b27d8], 1
mov dword [0x1b09e4], 0xdbd2d9ca
mov dword [0x1b09e8], 0xd3d6e5c8
mov dword [0x1b09ec], 0xcfced2dd
mov dword [0x1b09f0], 0xdec8dfc9
mov dword [0x1b09f4], 0xe5dbcedb
mov dword [0x1b09f8], 0xc9e5d5ce
mov dword [0x1b09fc], 0xd4d3c8ce
mov word [0x1b0a00], 0xbadd
xor eax, eax
mov cl, byte [eax + 0x1b09e4]
xor cl, 0xba
mov byte [eax + 0x1b0bbc], cl
inc eax
cmp eax, 0x1e
jb 0x111f0d
mov eax, 0x1b0bbc
ret

Function at 0x111f28
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27d4], 1
jne 0x111f8e
or dword [0x1b27d4], 1
mov dword [0x1b0a04], 0xd2d9cdca
mov dword [0x1b0a08], 0xd6e5c8db
mov dword [0x1b0a0c], 0xced2ddd3
mov dword [0x1b0a10], 0xc8dfc9cf
mov dword [0x1b0a14], 0xdbcedbde
mov dword [0x1b0a18], 0xe5d5cee5
mov dword [0x1b0a1c], 0xd3c8cec9
mov word [0x1b0a20], 0xddd4
mov byte [0x1b0a22], 0xba
xor eax, eax
mov cl, byte [eax + 0x1b0a04]
xor cl, 0xba
mov byte [eax + 0x1b0bdc], cl
inc eax
cmp eax, 0x1f
jb 0x111f90
mov eax, 0x1b0bdc
ret

Function at 0x111fab
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27d0], 1
jne 0x112012
or dword [0x1b27d0], 1
mov dword [0x1b0a24], 0xd2ddd3d6
mov dword [0x1b0a28], 0xdfc9cfce
mov dword [0x1b0a2c], 0xcedbdec8
mov dword [0x1b0a30], 0xdfc9e5db
mov dword [0x1b0a34], 0xdbcce5ce
mov dword [0x1b0a38], 0xd4dbd3c8
mov dword [0x1b0a3c], 0xcec9e5ce
mov dword [0x1b0a40], 0xddd4d3c8
mov byte [0x1b0a44], 0xba
xor eax, eax
mov cl, byte [eax + 0x1b0a24]
xor cl, 0xba
mov byte [eax + 0x1b0bfc], cl
inc eax
cmp eax, 0x21
jb 0x112014
mov eax, 0x1b0bfc
ret
Function at 0x11202f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27cc], 1
jne 0x112096
or dword [0x1b27cc], 1
mov dword [0x1b0a48], 0xd2ddd3d6
mov dword [0x1b0a4c], 0xdfc9cfce
mov dword [0x1b0a50], 0xcedbdec8
mov dword [0x1b0a54], 0xdfc9e5db
mov dword [0x1b0a58], 0xdbcce5ce
mov dword [0x1b0a5c], 0xd4dbd3c8
mov dword [0x1b0a60], 0xcfd4e5ce
mov dword [0x1b0a64], 0xc8dfd8d7
mov byte [0x1b0a68], 0xba
xor eax, eax
mov cl, byte [eax + 0x1b0a48]
xor cl, 0xba
mov byte [eax + 0x1b0c20], cl
inc eax
cmp eax, 0x21
jb 0x112098
mov eax, 0x1b0c20
ret

Function at 0x1120b3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27c8], 1
jne 0x11211c
or dword [0x1b27c8], 1
mov dword [0x1b0a6c], 0xd2ddd3d6
mov dword [0x1b0a70], 0xdfc9cfce
mov dword [0x1b0a74], 0xcedbdec8
mov dword [0x1b0a78], 0xdfc9e5db
mov dword [0x1b0a7c], 0xdbcce5ce
mov dword [0x1b0a80], 0xd4dbd3c8
mov dword [0x1b0a84], 0xd5d8e5ce
mov dword [0x1b0a88], 0xdbdfd6d5
mov word [0x1b0a8c], 0xbad4
xor eax, eax
mov cl, byte [eax + 0x1b0a6c]
xor cl, 0xba
mov byte [eax + 0x1b0c44], cl
inc eax
cmp eax, 0x22
jb 0x11211e
mov eax, 0x1b0c44
ret

Function at 0x112139
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27c4], 1
jne 0x11219f
or dword [0x1b27c4], 1
mov dword [0x1b0a90], 0xd2ddd3d6
mov dword [0x1b0a94], 0xdfc9cfce
mov dword [0x1b0a98], 0xcedbdec8
mov dword [0x1b0a9c], 0xdfc9e5db
mov dword [0x1b0aa0], 0xdbcce5ce
mov dword [0x1b0aa4], 0xd4dbd3c8
mov dword [0x1b0aa8], 0xcfd4e5ce
mov word [0x1b0aac], 0xd6d6
mov byte [0x1b0aae], 0xba
xor eax, eax
mov cl, byte [eax + 0x1b0a90]
xor cl, 0xba
mov byte [eax + 0x1b0c68], cl
inc eax
cmp eax, 0x1f
jb 0x1121a1
mov eax, 0x1b0c68
ret

Function at 0x112431
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x17ab69
call fcn.00179dc8
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
push edi
mov dword [ebp - 0x10], esi
call dword [0x1820a8]
test byte [0x1b27a4], 1
mov edi, eax
jne 0x11247e
or dword [0x1b27a4], 1
mov dword [0x1b0d04], 0xd6d1d6c8
mov dword [0x1b0d08], 0x91cbdad1
mov dword [0x1b0d0c], 0xbfd3d3db
xor ecx, ecx
mov al, byte [ecx + 0x1b0d04]
xor al, 0xbf
mov byte [ecx + 0x1b0fbc], al
inc ecx
cmp ecx, 0xc
jb 0x112480
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 0x1b0fbc
call dword [0x1820d4]
push eax
push 0x1b00
call dword [0x18212c]
test eax, eax
jne 0x1124cc
call fcn.00112542
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.000fd42c
pop ecx
pop ecx
jmp 0x112531
test byte [0x1b279c], 1
jne 0x1124ec
or dword [0x1b279c], 1
mov word [0x1b0d2c], 0x9f85
mov byte [0x1b0d2e], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0d2c]
xor cl, 0xbf
mov byte [eax + 0x1b0fe4], cl
inc eax
cmp eax, 3
jb 0x1124ee
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push 0x1b0fe4
push eax
call fcn.000fd42c
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.000fd7df
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.000f4ce5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x112542
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b27a0], 1
jne 0x112597
or dword [0x1b27a0], 1
mov dword [0x1b0d10], 0xdef9979f
mov dword [0x1b0d14], 0xdbdad3d6
mov dword [0x1b0d18], 0x9fd0cb9f
mov dword [0x1b0d1c], 0xd2cdd0d9
mov dword [0x1b0d20], 0xda9fcbde
mov dword [0x1b0d24], 0xcdd0cdcd
mov word [0x1b0d28], 0xbf96
xor eax, eax
mov cl, byte [eax + 0x1b0d10]
xor cl, 0xbf
mov byte [eax + 0x1b0fc8], cl
inc eax
cmp eax, 0x1a
jb 0x112599
mov eax, 0x1b0fc8
ret

Function at 0x112702
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2798], 1
jne 0x11274b
or dword [0x1b2798], 1
mov dword [0x1b0d30], 0xf7d1d6e8
mov dword [0x1b0d34], 0xf0cfcbcb
mov dword [0x1b0d38], 0x97d1dacf
mov dword [0x1b0d3c], 0xded99f96
mov dword [0x1b0d40], 0xdbdad3d6
mov byte [0x1b0d44], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0d30]
xor cl, 0xbf
mov byte [eax + 0x1b0fe8], cl
inc eax
cmp eax, 0x15
jb 0x11274d
mov eax, 0x1b0fe8
ret

Function at 0x112a12
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2794], 1
jne 0x112a65
or dword [0x1b2794], 1
mov dword [0x1b0d48], 0xf7d1d6e8
mov dword [0x1b0d4c], 0xfccfcbcb
mov dword [0x1b0d50], 0xd4dcdecd
mov dword [0x1b0d54], 0x97d3cdea
mov dword [0x1b0d58], 0xded99f96
mov dword [0x1b0d5c], 0xdbdad3d6
mov byte [0x1b0d60], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0d48]
xor cl, 0xbf
mov byte [eax + 0x1b1000], cl
inc eax
cmp eax, 0x19
jb 0x112a67
mov eax, 0x1b1000
ret

Function at 0x112a82
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2790], 1
jne 0x112ace
or dword [0x1b2790], 1
mov dword [0x1b0d64], 0xf7d1d6e8
mov dword [0x1b0d68], 0xfccfcbcb
mov dword [0x1b0d6c], 0xdad1d1d0
mov dword [0x1b0d70], 0x9697cbdc
mov dword [0x1b0d74], 0xd6ded99f
mov dword [0x1b0d78], 0xbfdbdad3
xor eax, eax
mov cl, byte [eax + 0x1b0d64]
xor cl, 0xbf
mov byte [eax + 0x1b101c], cl
inc eax
cmp eax, 0x18
jb 0x112ad0
mov eax, 0x1b101c
ret

Function at 0x113427
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b278c], 1
jne 0x113500
or dword [0x1b278c], 1
mov dword [0x1b0d80], 0xcacedaed
mov dword [0x1b0d84], 0x9fcbccda
mov dword [0x1b0d88], 0x9fd3cdca
mov dword [0x1b0d8c], 0xdbdaccca
mov dword [0x1b0d90], 0xdb9fde9f
mov dword [0x1b0d94], 0xdad9d9d6
mov dword [0x1b0d98], 0xcbd1dacd
mov dword [0x1b0d9c], 0xd7dccc9f
mov dword [0x1b0da0], 0x9fdad2da
mov dword [0x1b0da4], 0xd1ded7cb
mov dword [0x1b0da8], 0xdad7cb9f
mov dword [0x1b0dac], 0xd1d0dc9f
mov dword [0x1b0db0], 0xcbdcdad1
mov dword [0x1b0db4], 0x9fd1d0d6
mov dword [0x1b0db8], 0x9fccdec8
mov dword [0x1b0dbc], 0xcbd6d1d6
mov dword [0x1b0dc0], 0xd6d3ded6
mov dword [0x1b0dc4], 0x9fdbdac5
mov dword [0x1b0dc8], 0xd7cbd6c8
mov byte [0x1b0dcc], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0d80]
xor cl, 0xbf
mov byte [eax + 0x1b1038], cl
inc eax
cmp eax, 0x4d
jb 0x113502
mov eax, 0x1b1038
ret
Function at 0x11351d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2788], 1
jne 0x1135f9
or dword [0x1b2788], 1
mov dword [0x1b0dd0], 0xcacedaed
mov dword [0x1b0dd4], 0x9fcbccda
mov dword [0x1b0dd8], 0x9fd3cdca
mov dword [0x1b0ddc], 0xdbdaccca
mov dword [0x1b0de0], 0xdb9fde9f
mov dword [0x1b0de4], 0xdad9d9d6
mov dword [0x1b0de8], 0xcbd1dacd
mov dword [0x1b0dec], 0xccd0d79f
mov dword [0x1b0df0], 0xded19fcb
mov dword [0x1b0df4], 0xcb9fdad2
mov dword [0x1b0df8], 0x9fd1ded7
mov dword [0x1b0dfc], 0x9fdad7cb
mov dword [0x1b0e00], 0xd1d1d0dc
mov dword [0x1b0e04], 0xd6cbdcda
mov dword [0x1b0e08], 0xc89fd1d0
mov dword [0x1b0e0c], 0xd69fccde
mov dword [0x1b0e10], 0xd6cbd6d1
mov dword [0x1b0e14], 0xc5d6d3de
mov dword [0x1b0e18], 0xc89fdbda
mov dword [0x1b0e1c], 0xbfd7cbd6
xor eax, eax
mov cl, byte [eax + 0x1b0dd0]
xor cl, 0xbf
mov byte [eax + 0x1b1088], cl
inc eax
cmp eax, 0x50
jb 0x1135fb
mov eax, 0x1b1088
ret

Function at 0x113616
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2784], 1
jne 0x1136ee
or dword [0x1b2784], 1
mov dword [0x1b0e20], 0xcacedaed
mov dword [0x1b0e24], 0x9fcbccda
mov dword [0x1b0e28], 0x9fd3cdca
mov dword [0x1b0e2c], 0xdbdaccca
mov dword [0x1b0e30], 0xdb9fde9f
mov dword [0x1b0e34], 0xdad9d9d6
mov dword [0x1b0e38], 0xcbd1dacd
mov dword [0x1b0e3c], 0xcdd0cf9f
mov dword [0x1b0e40], 0xd7cb9fcb
mov dword [0x1b0e44], 0xcb9fd1de
mov dword [0x1b0e48], 0xdc9fdad7
mov dword [0x1b0e4c], 0xdad1d1d0
mov dword [0x1b0e50], 0xd0d6cbdc
mov dword [0x1b0e54], 0xdec89fd1
mov dword [0x1b0e58], 0xd1d69fcc
mov dword [0x1b0e5c], 0xded6cbd6
mov dword [0x1b0e60], 0xdac5d6d3
mov dword [0x1b0e64], 0xd6c89fdb
mov word [0x1b0e68], 0xd7cb
mov byte [0x1b0e6a], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0e20]
xor cl, 0xbf
mov byte [eax + 0x1b10d8], cl
inc eax
cmp eax, 0x4b
jb 0x1136f0
mov eax, 0x1b10d8
ret

Function at 0x11370b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2780], 1
jne 0x113761
or dword [0x1b2780], 1
mov dword [0x1b0e6c], 0xf7d1d6e8
mov dword [0x1b0e70], 0xf0cfcbcb
mov dword [0x1b0e74], 0xedd1dacf
mov dword [0x1b0e78], 0xdacaceda
mov dword [0x1b0e7c], 0x9697cbcc
mov dword [0x1b0e80], 0xd6ded99f
mov dword [0x1b0e84], 0xbfdbdad3
xor eax, eax
mov cl, byte [eax + 0x1b0e6c]
xor cl, 0xbf
mov byte [eax + 0x1b1124], cl
inc eax
cmp eax, 0x1c
jb 0x113763
mov eax, 0x1b1124
ret
Function at 0x11377e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b277c], 1
jne 0x11384d
or dword [0x1b277c], 1
mov dword [0x1b0e88], 0xf7d1d6e8
mov dword [0x1b0e8c], 0xeccfcbcb
mov dword [0x1b0e90], 0xcff0cbda
mov dword [0x1b0e94], 0xd1d0d6cb
mov dword [0x1b0e98], 0xf1f6e897
mov dword [0x1b0e9c], 0xefebebf7
mov dword [0x1b0ea0], 0xebeff0e0
mov dword [0x1b0ea4], 0xe0f1f0f6
mov dword [0x1b0ea8], 0xeafcfaec
mov dword [0x1b0eac], 0xe6ebf6ed
mov dword [0x1b0eb0], 0xfef3f9e0
mov dword [0x1b0eb4], 0x9f96ecf8
mov dword [0x1b0eb8], 0xcd9fd1d0
mov dword [0x1b0ebc], 0xdacaceda
mov dword [0x1b0ec0], 0xd79fcbcc
mov dword [0x1b0ec4], 0xd3dbd1de
mov dword [0x1b0ec8], 0xded99fda
mov dword [0x1b0ecc], 0xdbdad3d6
mov byte [0x1b0ed0], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0e88]
xor cl, 0xbf
mov byte [eax + 0x1b1140], cl
inc eax
cmp eax, 0x49
jb 0x11384f
mov eax, 0x1b1140
ret

Function at 0x11386a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2778], 1
jne 0x113938
or dword [0x1b2778], 1
mov dword [0x1b0ed8], 0xf7d1d6e8
mov dword [0x1b0edc], 0xeccfcbcb
mov dword [0x1b0ee0], 0xcff0cbda
mov dword [0x1b0ee4], 0xd1d0d6cb
mov dword [0x1b0ee8], 0xf1f6e897
mov dword [0x1b0eec], 0xefebebf7
mov dword [0x1b0ef0], 0xebeff0e0
mov dword [0x1b0ef4], 0xe0f1f0f6
mov dword [0x1b0ef8], 0xfbf1faec
mov dword [0x1b0efc], 0xf2f6ebe0
mov dword [0x1b0f00], 0xebeaf0fa
mov dword [0x1b0f04], 0xd1d09f96
mov dword [0x1b0f08], 0xcedacd9f
mov dword [0x1b0f0c], 0xcbccdaca
mov dword [0x1b0f10], 0xd1ded79f
mov dword [0x1b0f14], 0x9fdad3db
mov dword [0x1b0f18], 0xd3d6ded9
mov word [0x1b0f1c], 0xdbda
mov byte [0x1b0f1e], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0ed8]
xor cl, 0xbf
mov byte [eax + 0x1b1190], cl
inc eax
cmp eax, 0x47
jb 0x11393a
mov eax, 0x1b1190
ret

Function at 0x113955
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2774], 1
jne 0x1139be
or dword [0x1b2774], 1
mov dword [0x1b0f20], 0xf7d1d6e8
mov dword [0x1b0f24], 0xfecfcbcb
mov dword [0x1b0f28], 0xdaeddbdb
mov dword [0x1b0f2c], 0xccdacace
mov dword [0x1b0f30], 0xdedaf7cb
mov dword [0x1b0f34], 0xcccddadb
mov dword [0x1b0f38], 0xd99f9697
mov dword [0x1b0f3c], 0xdad3d6de
mov word [0x1b0f40], 0xbfdb
xor eax, eax
mov cl, byte [eax + 0x1b0f20]
xor cl, 0xbf
mov byte [eax + 0x1b11d8], cl
inc eax
cmp eax, 0x22
jb 0x1139c0
mov eax, 0x1b11d8
ret

Function at 0x1139db
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2770], 1
jne 0x113a2e
or dword [0x1b2770], 1
mov dword [0x1b0f44], 0xcfcbcbf7
mov dword [0x1b0f48], 0xdbd1daec
mov dword [0x1b0f4c], 0xcacedaed
mov dword [0x1b0f50], 0x97cbccda
mov dword [0x1b0f54], 0xded99f96
mov dword [0x1b0f58], 0xdbdad3d6
mov byte [0x1b0f5c], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0f44]
xor cl, 0xbf
mov byte [eax + 0x1b11fc], cl
inc eax
cmp eax, 0x19
jb 0x113a30
mov eax, 0x1b11fc
ret
Function at 0x113a4b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b276c], 1
jne 0x113a9d
or dword [0x1b276c], 1
mov dword [0x1b0f60], 0xcfcbcbf7
mov dword [0x1b0f64], 0xcddacaee
mov dword [0x1b0f68], 0xd9d1f6c6
mov dword [0x1b0f6c], 0x9f9697d0
mov dword [0x1b0f70], 0xd3d6ded9
mov word [0x1b0f74], 0xdbda
mov byte [0x1b0f76], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0f60]
xor cl, 0xbf
mov byte [eax + 0x1b1218], cl
inc eax
cmp eax, 0x17
jb 0x113a9f
mov eax, 0x1b1218
ret
Function at 0x11427d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2764], 1
jne 0x1142ed
or dword [0x1b2764], 1
mov dword [0x1b0f7c], 0xf7d1d6e8
mov dword [0x1b0f80], 0xeecfcbcb
mov dword [0x1b0f84], 0xc6cddaca
mov dword [0x1b0f88], 0xdecbdefb
mov dword [0x1b0f8c], 0xd6dec9fe
mov dword [0x1b0f90], 0xd3ddded3
mov dword [0x1b0f94], 0x9f9697da
mov dword [0x1b0f98], 0xd3d6ded9
mov word [0x1b0f9c], 0xdbda
mov byte [0x1b0f9e], 0xbf
xor eax, eax
mov cl, byte [eax + 0x1b0f7c]
xor cl, 0xbf
mov byte [eax + 0x1b1234], cl
inc eax
cmp eax, 0x23
jb 0x1142ef
mov eax, 0x1b1234
ret

Function at 0x11430a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2760], 1
jne 0x11435f
or dword [0x1b2760], 1
mov dword [0x1b0fa0], 0xdacbd1f6
mov dword [0x1b0fa4], 0xcbdad1cd
mov dword [0x1b0fa8], 0xdbdedaed
mov dword [0x1b0fac], 0xdad3d6f9
mov dword [0x1b0fb0], 0xd99f9697
mov dword [0x1b0fb4], 0xdad3d6de
mov word [0x1b0fb8], 0xbfdb
xor eax, eax
mov cl, byte [eax + 0x1b0fa0]
xor cl, 0xbf
mov byte [eax + 0x1b1258], cl
inc eax
cmp eax, 0x1a
jb 0x114361
mov eax, 0x1b1258
ret

Function at 0x115147
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2744], 1
jne 0x1151ce
or dword [0x1b2744], 1
mov dword [0x1b1290], 0xb4e1af80
mov dword [0x1b1294], 0xa2a4b3af
mov dword [0x1b1298], 0xa8afa6ae
mov dword [0x1b129c], 0xe1a5a4bb
mov dword [0x1b12a0], 0xa4aaaeb5
mov dword [0x1b12a4], 0xa0b6e1af
mov dword [0x1b12a8], 0xaea7e1b2
mov dword [0x1b12ac], 0xe1a5afb4
mov dword [0x1b12b0], 0xa2e1b5a0
mov dword [0x1b12b4], 0xa0b3a0a9
mov dword [0x1b12b8], 0xb3a4b5a2
mov word [0x1b12bc], 0xc1e1
xor eax, eax
mov cl, byte [eax + 0x1b1290]
xor cl, 0xc1
mov byte [eax + 0x1b13e0], cl
inc eax
cmp eax, 0x2e
jb 0x1151d0
mov eax, 0x1b13e0
ret
Function at 0x115614
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2740], 1
jne 0x115670
or dword [0x1b2740], 1
mov dword [0x1b12c0], 0xb2b2a88c
mov dword [0x1b12c4], 0xe1a6afa8
mov dword [0x1b12c8], 0xa4ade1a0
mov dword [0x1b12cc], 0xb1e1b5a7
mov dword [0x1b12d0], 0xafa4b3a0
mov dword [0x1b12d4], 0xb2a4a9b5
mov word [0x1b12d8], 0xb2a8
mov byte [0x1b12da], 0xc1
xor eax, eax
mov cl, byte [eax + 0x1b12c0]
xor cl, 0xc1
mov byte [eax + 0x1b1410], cl
inc eax
cmp eax, 0x1b
jb 0x115672
mov eax, 0x1b1410
ret

Function at 0x11568d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b273c], 1
jne 0x1156f6
or dword [0x1b273c], 1
mov dword [0x1b12dc], 0xe1b5ae8f
mov dword [0x1b12e0], 0xb4aeafa4
mov dword [0x1b12e4], 0xaee1a9a6
mov dword [0x1b12e8], 0xa0b3a4b1
mov dword [0x1b12ec], 0xe1b2a5af
mov dword [0x1b12f0], 0xa4e1afa8
mov dword [0x1b12f4], 0xa4b3b1b9
mov dword [0x1b12f8], 0xaea8b2b2
mov word [0x1b12fc], 0xc1af
xor eax, eax
mov cl, byte [eax + 0x1b12dc]
xor cl, 0xc1
mov byte [eax + 0x1b142c], cl
inc eax
cmp eax, 0x22
jb 0x1156f8
mov eax, 0x1b142c
ret

Function at 0x115713
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2738], 1
jne 0x115773
or dword [0x1b2738], 1
mov dword [0x1b1300], 0xe1aeae95
mov dword [0x1b1304], 0xb8afa0ac
mov dword [0x1b1308], 0xa4b1aee1
mov dword [0x1b130c], 0xa5afa0b3
mov dword [0x1b1310], 0xafa8e1b2
mov dword [0x1b1314], 0xb1b9a4e1
mov dword [0x1b1318], 0xb2b2a4b3
mov dword [0x1b131c], 0xc1afaea8
xor eax, eax
mov cl, byte [eax + 0x1b1300]
xor cl, 0xc1
mov byte [eax + 0x1b1450], cl
inc eax
cmp eax, 0x20
jb 0x115775
mov eax, 0x1b1450
ret

Function at 0x115790
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2734], 1
jne 0x1157e6
or dword [0x1b2734], 1
mov dword [0x1b1320], 0xb2b2a88c
mov dword [0x1b1324], 0xe1a6afa8
mov dword [0x1b1328], 0xa8b3e1a0
mov dword [0x1b132c], 0xe1b5a9a6
mov dword [0x1b1330], 0xa4b3a0b1
mov dword [0x1b1334], 0xa4a9b5af
mov dword [0x1b1338], 0xc1b2a8b2
xor eax, eax
mov cl, byte [eax + 0x1b1320]
xor cl, 0xc1
mov byte [eax + 0x1b1470], cl
inc eax
cmp eax, 0x1c
jb 0x1157e8
mov eax, 0x1b1470
ret

Function at 0x115803
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2730], 1
jne 0x115874
or dword [0x1b2730], 1
mov dword [0x1b133c], 0xb3a0af94
mov dword [0x1b1340], 0xb1aee1b8
mov dword [0x1b1344], 0xb5a0b3a4
mov dword [0x1b1348], 0xace1b3ae
mov dword [0x1b134c], 0xe1b5b2b4
mov dword [0x1b1350], 0xa4b7a0a9
mov dword [0x1b1354], 0xa4afaee1
mov dword [0x1b1358], 0xa4b1aee1
mov dword [0x1b135c], 0xa5afa0b3
mov byte [0x1b1360], 0xc1
xor eax, eax
mov cl, byte [eax + 0x1b133c]
xor cl, 0xc1
mov byte [eax + 0x1b148c], cl
inc eax
cmp eax, 0x25
jb 0x115876
mov eax, 0x1b148c
ret
Function at 0x115891
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b272c], 1
jne 0x11590b
or dword [0x1b272c], 1
mov dword [0x1b1364], 0xa0afa883
mov dword [0x1b1368], 0xaee1b8b3
mov dword [0x1b136c], 0xa0b3a4b1
mov dword [0x1b1370], 0xe1b3aeb5
mov dword [0x1b1374], 0xb5b2b4ac
mov dword [0x1b1378], 0xb7a0a9e1
mov dword [0x1b137c], 0xb6b5e1a4
mov dword [0x1b1380], 0xb1aee1ae
mov dword [0x1b1384], 0xafa0b3a4
mov word [0x1b1388], 0xb2a5
mov byte [0x1b138a], 0xc1
xor eax, eax
mov cl, byte [eax + 0x1b1364]
xor cl, 0xc1
mov byte [eax + 0x1b14b4], cl
inc eax
cmp eax, 0x27
jb 0x11590d
mov eax, 0x1b14b4
ret

Function at 0x115928
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b2728], 1
jne 0x115991
or dword [0x1b2728], 1
mov dword [0x1b138c], 0xa0afa883
mov dword [0x1b1390], 0xaee1b8b3
mov dword [0x1b1394], 0xa0b3a4b1
mov dword [0x1b1398], 0xe1b3aeb5
mov dword [0x1b139c], 0xe1b5aeaf
mov dword [0x1b13a0], 0xadb1aca8
mov dword [0x1b13a4], 0xafa4aca4
mov dword [0x1b13a8], 0xfba5a4b5
mov word [0x1b13ac], 0xc1e1
xor eax, eax
mov cl, byte [eax + 0x1b138c]
xor cl, 0xc1
mov byte [eax + 0x1b14dc], cl
inc eax
cmp eax, 0x22
jb 0x115993
mov eax, 0x1b14dc
ret
Function at 0x117343
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x117385
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x19be18]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x19be18]
inc edx
cmp dword [ebp + 8], 0
jne 0x117350
pop esi
not eax
pop ebp
ret

Function at 0x118fd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x118ff5
cmp dword [ecx + 0x38], ebx
je 0x118ff5
cmp eax, dword [ecx + 0x10]
jae 0x118ff5
cmp dword [ecx + 0x14], 1
jne 0x118ff5
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x118ff7
xor edi, edi
cmp edi, ebx
je 0x1190da
cmp esi, ebx
je 0x1190da
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00118779
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x119086
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.00157160
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x1190ab
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.00157160
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x1190dc
xor eax, eax
pop edi
pop ebx
ret

Function at 0x119b0c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1b271c], 1
jne 0x119b91
or dword [0x1b271c], 1
mov dword [0x1b1518], 0xaeaba384
mov dword [0x1b151c], 0xb6e2a6a7
mov dword [0x1b1520], 0xb0a1e2ad
mov dword [0x1b1524], 0xa7b6a3a7
mov dword [0x1b1528], 0xa3b7aee2
mov dword [0x1b152c], 0xa3b6b1e2
mov dword [0x1b1530], 0xeae2a7b6
mov dword [0x1b1534], 0xa9b0adb5
mov dword [0x1b1538], 0xb6e2b0a7
mov dword [0x1b153c], 0xa3a7b0aa
mov dword [0x1b1540], 0xe2f8eba6
mov byte [0x1b1544], 0xc2
xor eax, eax
mov cl, byte [eax + 0x1b1518]
xor cl, 0xc2
mov byte [eax + 0x1b15e0], cl
inc eax
cmp eax, 0x2d
jb 0x119b93
mov eax, 0x1b15e0
ret