joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1134b8c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8d00], 1
jne 0x1134bc4
or dword [0x11d8d00], 1
mov dword [0x11d3060], 0x74222f27
mov dword [0x11d3064], 0x2763223d
mov dword [0x11d3068], 0x7f37272c
mov dword [0x11d306c], 0x72e7f22
xor eax, eax
mov cl, byte [eax + 0x11d3060]
xor cl, 7
mov byte [eax + 0x11d370c], cl
inc eax
cmp eax, 0x10
jb 0x1134bc6
mov eax, 0x11d370c
ret

Function at 0x1135e87
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cf0], 1
jne 0x1135edc
or dword [0x11d8cf0], 1
mov dword [0x11d3740], 0x4c5a4940
mov dword [0x11d3744], 0x4d5a495f
mov dword [0x11d3748], 0x584b4954
mov dword [0x11d374c], 0x5b4c5441
mov dword [0x11d3750], 0x5e545c4c
mov dword [0x11d3754], 0x5750474a
mov word [0x11d3758], 0x857
xor eax, eax
mov cl, byte [eax + 0x11d3740]
xor cl, 8
mov byte [eax + 0x11d3940], cl
inc eax
cmp eax, 0x1a
jb 0x1135ede
mov eax, 0x11d3940
ret

Function at 0x1135fee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cec], 1
jne 0x1136018
or dword [0x11d8cec], 1
mov dword [0x11d375c], 0x695f455e
mov word [0x11d3760], 0x6d7a
mov byte [0x11d3762], 8
xor eax, eax
mov cl, byte [eax + 0x11d375c]
xor cl, 8
mov byte [eax + 0x11d395c], cl
inc eax
cmp eax, 7
jb 0x113601a
mov eax, 0x11d395c
ret

Function at 0x1136035
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8ce8], 1
jne 0x1136062
or dword [0x11d8ce8], 1
mov dword [0x11d3764], 0x7c7a615e
mov dword [0x11d3768], 0x5864697d
mov word [0x11d376c], 0x84b
xor eax, eax
mov cl, byte [eax + 0x11d3764]
xor cl, 8
mov byte [eax + 0x11d3964], cl
inc eax
cmp eax, 0xa
jb 0x1136064
mov eax, 0x11d3964
ret

Function at 0x113607f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8ce4], 1
jne 0x11360b3
or dword [0x11d8ce4], 1
mov dword [0x11d3770], 0x7c7a615e
mov dword [0x11d3774], 0x4a64697d
mov word [0x11d3778], 0x7067
mov byte [0x11d377a], 8
xor eax, eax
mov cl, byte [eax + 0x11d3770]
xor cl, 8
mov byte [eax + 0x11d3970], cl
inc eax
cmp eax, 0xb
jb 0x11360b5
mov eax, 0x11d3970
ret

Function at 0x11360d0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8ce0], 1
jne 0x11360f4
or dword [0x11d8ce0], 1
mov dword [0x11d377c], 0x6d666d4f
mov dword [0x11d3780], 0x86b617a
xor eax, eax
mov cl, byte [eax + 0x11d377c]
xor cl, 8
mov byte [eax + 0x11d397c], cl
inc eax
cmp eax, 8
jb 0x11360f6
mov eax, 0x11d397c
ret
Function at 0x1136111
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x11a334f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x11d8cdc], 1
push esi
jne 0x1136164
or dword [0x11d8cdc], 1
mov dword [0x11d3784], 0x646c7c66
mov dword [0x11d3788], 0x646c2664
mov word [0x11d378c], 0x864
xor eax, eax
mov cl, byte [eax + 0x11d3784]
xor cl, 8
mov byte [eax + 0x11d3984], cl
inc eax
cmp eax, 0xa
jb 0x1136166
push 0x11d3984
call dword [0x11aa0cc]
mov esi, eax
test esi, esi
jne 0x11361d8
call dword [0x11aa0a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0115a8c7
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.0113631f
push eax
lea eax, [esp + 0x28]
push eax
call fcn.01136b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.01135c58
push 0x11c44a8
mov eax, esi
push eax
call fcn.01185926
call fcn.01136385
push eax
push esi
call dword [0x11aa0c8]
test eax, eax
jne 0x1136235
call dword [0x11aa0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0115a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.011363f7
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01136b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.01135c58
push 0x11c44a8
mov eax, esi
jmp 0x11361d2
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x11362bd
cmp dword [esp + 4], 0x18
jne 0x11362bd
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x11aa0c4]
test eax, eax
jne 0x113630c
call dword [0x11aa0a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0115a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.01136537
push eax
lea eax, [esp + 0x94]
push eax
call fcn.01136b70
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.01135c58
push 0x11c44a8
mov eax, esi
jmp 0x11361d2
call dword [0x11aa0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0115a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.011364aa
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01136b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.01135c58
push 0x11c44a8
mov eax, esi
jmp 0x11361d2
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x113631f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cd8], 1
jne 0x1136368
or dword [0x11d8cd8], 1
mov dword [0x11d3790], 0x6c696744
mov dword [0x11d3794], 0x7a6a6144
mov dword [0x11d3798], 0x28717a69
mov dword [0x11d379c], 0x6461696e
mov dword [0x11d37a0], 0x28326c6d
mov byte [0x11d37a4], 8
xor eax, eax
mov cl, byte [eax + 0x11d3790]
xor cl, 8
mov byte [eax + 0x11d3990], cl
inc eax
cmp eax, 0x15
jb 0x113636a
mov eax, 0x11d3990
ret
Function at 0x1136385
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cd4], 1
jne 0x11363da
or dword [0x11d8cd4], 1
mov dword [0x11d37a8], 0x7d597c46
mov dword [0x11d37ac], 0x41717a6d
mov dword [0x11d37b0], 0x7a676e66
mov dword [0x11d37b4], 0x617c6965
mov dword [0x11d37b8], 0x7a586667
mov dword [0x11d37bc], 0x7b6d6b67
mov word [0x11d37c0], 0x87b
xor eax, eax
mov cl, byte [eax + 0x11d37a8]
xor cl, 8
mov byte [eax + 0x11d39a8], cl
inc eax
cmp eax, 0x1a
jb 0x11363dc
mov eax, 0x11d39a8
ret

Function at 0x11363f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cd0], 1
jne 0x113648d
or dword [0x11d8cd0], 1
mov dword [0x11d37c4], 0x587c6d4f
mov dword [0x11d37c8], 0x496b677a
mov dword [0x11d37cc], 0x6d7a6c6c
mov dword [0x11d37d0], 0x6e287b7b
mov dword [0x11d37d4], 0x6d646169
mov dword [0x11d37d8], 0x4620286c
mov dword [0x11d37dc], 0x6d7d597c
mov dword [0x11d37e0], 0x6641717a
mov dword [0x11d37e4], 0x657a676e
mov dword [0x11d37e8], 0x67617c69
mov dword [0x11d37ec], 0x677a5866
mov dword [0x11d37f0], 0x7b7b6d6b
mov dword [0x11d37f4], 0x8283221
xor eax, eax
mov cl, byte [eax + 0x11d37c4]
xor cl, 8
mov byte [eax + 0x11d39c4], cl
inc eax
cmp eax, 0x34
jb 0x113648f
mov eax, 0x11d39c4
ret

Function at 0x11364aa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8ccc], 1
jne 0x113651a
or dword [0x11d8ccc], 1
mov dword [0x11d37f8], 0x7d597c46
mov dword [0x11d37fc], 0x41717a6d
mov dword [0x11d3800], 0x7a676e66
mov dword [0x11d3804], 0x617c6965
mov dword [0x11d3808], 0x7a586667
mov dword [0x11d380c], 0x7b6d6b67
mov dword [0x11d3810], 0x696e287b
mov dword [0x11d3814], 0x6c6d6461
mov word [0x11d3818], 0x2832
mov byte [0x11d381a], 8
xor eax, eax
mov cl, byte [eax + 0x11d37f8]
xor cl, 8
mov byte [eax + 0x11d39f8], cl
inc eax
cmp eax, 0x23
jb 0x113651c
mov eax, 0x11d39f8
ret

Function at 0x1136537
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cc8], 1
jne 0x1136580
or dword [0x11d8cc8], 1
mov dword [0x11d381c], 0x666d7847
mov dword [0x11d3820], 0x6b677a58
mov dword [0x11d3824], 0x287b7b6d
mov dword [0x11d3828], 0x6461696e
mov dword [0x11d382c], 0x28326c6d
mov byte [0x11d3830], 8
xor eax, eax
mov cl, byte [eax + 0x11d381c]
xor cl, 8
mov byte [eax + 0x11d3a1c], cl
inc eax
cmp eax, 0x15
jb 0x1136582
mov eax, 0x11d3a1c
ret
Function at 0x113659d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x11a32fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x11d8cc4], 1
push esi
push edi
jne 0x11365fa
or dword [0x11d8cc4], 1
mov dword [0x11d3834], 0x667a6d63
mov dword [0x11d3838], 0x3a3b646d
mov dword [0x11d383c], 0x64646c26
mov byte [0x11d3840], 8
xor eax, eax
mov cl, byte [eax + 0x11d3834]
xor cl, 8
mov byte [eax + 0x11d3a34], cl
inc eax
cmp eax, 0xd
jb 0x11365fc
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x11d3a34
call edi
mov esi, eax
test esi, esi
jne 0x1136670
call dword [0x11aa0a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0115a8c7
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.011367d2
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.01136b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.01135c58
push 0x11c44a8
mov eax, esi
push eax
call fcn.01185926
call fcn.0113684f
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x113673d
call fcn.011368c2
push eax
call edi
mov edi, eax
test edi, edi
jne 0x11366e1
call dword [0x11aa0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0115a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.0113690c
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01136b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.01135c58
push 0x11c44a8
mov eax, esi
jmp 0x113666a
call fcn.01136986
push eax
push edi
call esi
test eax, eax
jne 0x113673d
call dword [0x11aa0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0115a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.011369f6
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01136b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.01135c58
push 0x11c44a8
mov eax, esi
jmp 0x113666a
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x113679f
call dword [0x11aa0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0115a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.01136aaf
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01136b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.01135c58
push 0x11c44a8
mov eax, esi
jmp 0x113666a
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.01134cde
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x11367d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cc0], 1
jne 0x1136832
or dword [0x11d8cc0], 1
mov dword [0x11d3844], 0x6c696744
mov dword [0x11d3848], 0x7a6a6144
mov dword [0x11d384c], 0x28717a69
mov dword [0x11d3850], 0x6461696e
mov dword [0x11d3854], 0x20286c6d
mov dword [0x11d3858], 0x667a6d63
mov dword [0x11d385c], 0x3a3b646d
mov dword [0x11d3860], 0x8283221
xor eax, eax
mov cl, byte [eax + 0x11d3844]
xor cl, 8
mov byte [eax + 0x11d3a44], cl
inc eax
cmp eax, 0x20
jb 0x1136834
mov eax, 0x11d3a44
ret
Function at 0x113684f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cbc], 1
jne 0x11368a5
or dword [0x11d8cbc], 1
mov dword [0x11d3864], 0x4f3a3b43
mov dword [0x11d3868], 0x7a587c6d
mov dword [0x11d386c], 0x7b6d6b67
mov dword [0x11d3870], 0x6965417b
mov dword [0x11d3874], 0x614e6d6f
mov dword [0x11d3878], 0x69466d64
mov dword [0x11d387c], 0x8496d65
xor eax, eax
mov cl, byte [eax + 0x11d3864]
xor cl, 8
mov byte [eax + 0x11d3a64], cl
inc eax
cmp eax, 0x1c
jb 0x11368a7
mov eax, 0x11d3a64
ret

Function at 0x11368c2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cb8], 1
jne 0x11368ef
or dword [0x11d8cb8], 1
mov dword [0x11d3880], 0x78697b78
mov dword [0x11d3884], 0x646c2661
mov word [0x11d3888], 0x864
xor eax, eax
mov cl, byte [eax + 0x11d3880]
xor cl, 8
mov byte [eax + 0x11d3a80], cl
inc eax
cmp eax, 0xa
jb 0x11368f1
mov eax, 0x11d3a80
ret

Function at 0x113690c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cb4], 1
jne 0x1136969
or dword [0x11d8cb4], 1
mov dword [0x11d388c], 0x6c696744
mov dword [0x11d3890], 0x7a6a6144
mov dword [0x11d3894], 0x28717a69
mov dword [0x11d3898], 0x6461696e
mov dword [0x11d389c], 0x20286c6d
mov dword [0x11d38a0], 0x78697b78
mov dword [0x11d38a4], 0x28322161
mov byte [0x11d38a8], 8
xor eax, eax
mov cl, byte [eax + 0x11d388c]
xor cl, 8
mov byte [eax + 0x11d3a8c], cl
inc eax
cmp eax, 0x1d
jb 0x113696b
mov eax, 0x11d3a8c
ret

Function at 0x1136986
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cb0], 1
jne 0x11369d9
or dword [0x11d8cb0], 1
mov dword [0x11d38ac], 0x587c6d4f
mov dword [0x11d38b0], 0x6d6b677a
mov dword [0x11d38b4], 0x65417b7b
mov dword [0x11d38b8], 0x4e6d6f69
mov dword [0x11d38bc], 0x466d6461
mov dword [0x11d38c0], 0x496d6569
mov byte [0x11d38c4], 8
xor eax, eax
mov cl, byte [eax + 0x11d38ac]
xor cl, 8
mov byte [eax + 0x11d3aac], cl
inc eax
cmp eax, 0x19
jb 0x11369db
mov eax, 0x11d3aac
ret

Function at 0x11369f6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8cac], 1
jne 0x1136a92
or dword [0x11d8cac], 1
mov dword [0x11d38c8], 0x587c6d4f
mov dword [0x11d38cc], 0x496b677a
mov dword [0x11d38d0], 0x6d7a6c6c
mov dword [0x11d38d4], 0x6e287b7b
mov dword [0x11d38d8], 0x6d646169
mov dword [0x11d38dc], 0x4f20286c
mov dword [0x11d38e0], 0x7a587c6d
mov dword [0x11d38e4], 0x7b6d6b67
mov dword [0x11d38e8], 0x6965417b
mov dword [0x11d38ec], 0x614e6d6f
mov dword [0x11d38f0], 0x69466d64
mov dword [0x11d38f4], 0x21496d65
mov word [0x11d38f8], 0x2832
mov byte [0x11d38fa], 8
xor eax, eax
mov cl, byte [eax + 0x11d38c8]
xor cl, 8
mov byte [eax + 0x11d3ac8], cl
inc eax
cmp eax, 0x33
jb 0x1136a94
mov eax, 0x11d3ac8
ret
Function at 0x1136aaf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8ca8], 1
jne 0x1136b16
or dword [0x11d8ca8], 1
mov dword [0x11d38fc], 0x587c6d4f
mov dword [0x11d3900], 0x6d6b677a
mov dword [0x11d3904], 0x65417b7b
mov dword [0x11d3908], 0x4e6d6f69
mov dword [0x11d390c], 0x666d6461
mov dword [0x11d3910], 0x286d6569
mov dword [0x11d3914], 0x6461696e
mov dword [0x11d3918], 0x28326c6d
mov byte [0x11d391c], 8
xor eax, eax
mov cl, byte [eax + 0x11d38fc]
xor cl, 8
mov byte [eax + 0x11d3afc], cl
inc eax
cmp eax, 0x21
jb 0x1136b18
mov eax, 0x11d3afc
ret

Function at 0x11376e4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8ca4], 1
jne 0x11378ca
or dword [0x11d8ca4], 1
mov dword [0x11d3b28], 0x7a276660
mov dword [0x11d3b2c], 0x7c666d7d
mov dword [0x11d3b30], 0x6c7a337d
mov dword [0x11d3b34], 0x7c6b7f7d
mov dword [0x11d3b38], 0x672e216f
mov dword [0x11d3b3c], 0x3202e66
mov dword [0x11d3b40], 0x626a6879
mov dword [0x11d3b44], 0x276c6e68
mov dword [0x11d3b48], 0x617d6879
mov dword [0x11d3b4c], 0x2e293429
mov dword [0x11d3b50], 0x6c7b032e
mov dword [0x11d3b54], 0x7b607c78
mov dword [0x11d3b58], 0x7a2e216c
mov dword [0x11d3b5c], 0x6a607b7d
mov dword [0x11d3b60], 0x3202e7d
mov dword [0x11d3b64], 0x686a6665
mov dword [0x11d3b68], 0x257a2965
mov dword [0x11d3b6c], 0x34297b29
mov dword [0x11d3b70], 0x6a797129
mov dword [0x11d3b74], 0x21656568
mov dword [0x11d3b78], 0x6a677c6f
mov dword [0x11d3b7c], 0x6766607d
mov dword [0x11d3b80], 0x7b292021
mov dword [0x11d3b84], 0x7b7c7d6c
mov dword [0x11d3b88], 0x6c7b2967
mov dword [0x11d3b8c], 0x7b607c78
mov dword [0x11d3b90], 0x2c2e216c
mov dword [0x11d3b94], 0x27202e44
mov dword [0x11d3b98], 0x67606864
mov dword [0x11d3b9c], 0x68565621
mov dword [0x11d3ba0], 0x207a6e7b
mov dword [0x11d3ba4], 0x6d676c29
mov dword [0x11d3ba8], 0x6c6d2925
mov dword [0x11d3bac], 0x276e7c6b
mov dword [0x11d3bb0], 0x6a687b7d
mov dword [0x11d3bb4], 0x6a686b6c
mov dword [0x11d3bb8], 0x60032062
mov dword [0x11d3bbc], 0x6667296f
mov dword [0x11d3bc0], 0x297a297d
mov dword [0x11d3bc4], 0x676c617d
mov dword [0x11d3bc8], 0x7b7b6c29
mov dword [0x11d3bcc], 0x7b217b66
mov dword [0x11d3bd0], 0x676c2920
mov dword [0x11d3bd4], 0x6c7b036d
mov dword [0x11d3bd8], 0x677b7c7d
mov word [0x11d3bdc], 0x7b29
mov byte [0x11d3bde], 9
xor eax, eax
mov cl, byte [eax + 0x11d3b28]
xor cl, 9
mov byte [eax + 0x11d4118], cl
inc eax
cmp eax, 0xb7
jb 0x11378cc
mov eax, 0x11d4118
ret
Function at 0x11378e9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d8ca0], 1
jne 0x1137b6f
or dword [0x11d8ca0], 1
mov dword [0x11d3be0], 0x7a276660
mov dword [0x11d3be4], 0x7c666d7d
mov dword [0x11d3be8], 0x6c7a337d
mov dword [0x11d3bec], 0x7c6b7f7d
mov dword [0x11d3bf0], 0x672e216f
mov dword [0x11d3bf4], 0x3202e66
mov dword [0x11d3bf8], 0x626a6879
mov dword [0x11d3bfc], 0x276c6e68
mov dword [0x11d3c00], 0x617d6879
mov dword [0x11d3c04], 0x32e2e34
mov dword [0x11d3c08], 0x7c786c7b
mov dword [0x11d3c0c], 0x216c7b60
mov dword [0x11d3c10], 0x7b7d7a2e
mov dword [0x11d3c14], 0x2e7d6a60
mov dword [0x11d3c18], 0x66650320
mov dword [0x11d3c1c], 0x2965686a
mov dword [0x11d3c20], 0x34296564
mov dword [0x11d3c24], 0x786c7b29
mov dword [0x11d3c28], 0x6c7b607c
mov dword [0x11d3c2c], 0x65642e21
mov dword [0x11d3c30], 0x6503202e
mov dword [0x11d3c34], 0x65686a66
mov dword [0x11d3c38], 0x7b257a29
mov dword [0x11d3c3c], 0x34296c25
mov dword [0x11d3c40], 0x6a797129
mov dword [0x11d3c44], 0x21656568
mov dword [0x11d3c48], 0x6a677c6f
mov dword [0x11d3c4c], 0x6766607d
mov dword [0x11d3c50], 0x7b292021
mov dword [0x11d3c54], 0x7b7c7d6c
mov dword [0x11d3c58], 0x6c7b2967
mov dword [0x11d3c5c], 0x7b607c78
mov dword [0x11d3c60], 0x2c2e216c
mov dword [0x11d3c64], 0x27202e44
mov dword [0x11d3c68], 0x2c214f2c
mov dword [0x11d3c6c], 0x6c292048
mov dword [0x11d3c70], 0x29256d67
mov dword [0x11d3c74], 0x7c6b6c6d
mov dword [0x11d3c78], 0x7b7d276e
mov dword [0x11d3c7c], 0x6b6c6a68
mov dword [0x11d3c80], 0x20626a68
mov dword [0x11d3c84], 0x296f6003
mov dword [0x11d3c88], 0x297d6667
mov dword [0x11d3c8c], 0x617d297a
mov dword [0x11d3c90], 0x7b29676c
mov dword [0x11d3c94], 0x7b7c7d6c
mov dword [0x11d3c98], 0x60672967
mov dword [0x11d3c9c], 0x7b292565
mov dword [0x11d3ca0], 0x6d676c29
mov dword [0x11d3ca4], 0x296f6003
mov dword [0x11d3ca8], 0x3477297b
mov dword [0x11d3cac], 0x65606729
mov dword [0x11d3cb0], 0x6c617d29
mov dword [0x11d3cb4], 0x297b2967
mov dword [0x11d3cb8], 0x65642934
mov dword [0x11d3cbc], 0x7d7a7d27
mov dword [0x11d3cc0], 0x6e67607b
mov dword [0x11d3cc4], 0x29207b21
mov dword [0x11d3cc8], 0x36d676c
mov dword [0x11d3ccc], 0x7c7d6c7b
mov dword [0x11d3cd0], 0x7b29677b
mov word [0x11d3cd4], 0x6c25
mov byte [0x11d3cd6], 9
xor eax, eax
mov cl, byte [eax + 0x11d3be0]
xor cl, 9
mov byte [eax + 0x11d41d0], cl
inc eax
cmp eax, 0xf7
jb 0x1137b71
mov eax, 0x11d41d0
ret
Function at 0x1137b8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x11d8c64], 1
jne 0x1137bb5
or dword [0x11d8c64], 1
mov dword [0x11d3dc8], 0x626a6879
mov dword [0x11d3dcc], 0x96c6e68
xor eax, eax
mov cl, byte [eax + 0x11d3dc8]
xor cl, 9
mov byte [eax + 0x11d43b8], cl
inc eax
cmp eax, 8
jb 0x1137bb7
push 0x11d43b8
push dword [ebp + 8]
call fcn.01168c75
test byte [0x11d8c60], 1
pop ecx
pop ecx
jne 0x1137bff
or dword [0x11d8c60], 1
mov dword [0x11d3dd0], 0x656c7b79
mov dword [0x11d3dd4], 0x96d6866
xor eax, eax
mov cl, byte [eax + 0x11d3dd0]
xor cl, 9
mov byte [eax + 0x11d43c0], cl
inc eax
cmp eax, 8
jb 0x1137c01
push esi
push 0x11d43c0
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.01168ce9
add esp, 0xc
cmp dword [0x11cebe0], 0
mov esi, 0x11cebe0
je 0x1137c61
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.01168b95
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.01168f16
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x1137c3a
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.011683ea
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x1137edb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x11a2d38
call fcn.011a1cf8
sub esp, 0x64
test byte [0x11d8c4c], 1
jne 0x1137f08
or dword [0x11d8c4c], 1
mov word [0x11d3e00], 0x442c
mov byte [0x11d3e02], 9
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x11d3e00]
xor cl, 9
mov byte [eax + 0x11d43f0], cl
inc eax
cmp eax, 3
jb 0x1137f0f
mov esi, 0x11d43f0
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1137f3b
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.01134c69
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.0113d0cc
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.01134cff
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x1137f82
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.011677e8
pop ecx
pop ecx
cmp eax, ebx
je 0x1137fd3
cmp eax, 3
jne 0x1137fc0
call fcn.011380da
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0117ba25
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x11c44a8
lea eax, [ebp - 0x1c]
push eax
call fcn.01185926
cmp eax, 4
jne 0x1137fcc
call fcn.0113818d
jmp 0x1137f9c
call fcn.01138240
jmp 0x1137f9c
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0116921e
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x113808a
push ebx
call fcn.011382c4
push eax
push 0xffffffffffffffff
push esi
call fcn.01167f7f
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.01134cde
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x1138042
call fcn.0113830b
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0113d13d
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.01135c58
jmp 0x1137fb2
cmp edi, 4
jne 0x1138061
call fcn.0113836a
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0113d13d
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x1138035
cmp edi, 6
jne 0x1138080
call fcn.011383cf
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0113d13d
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x1138035
call fcn.01138453
jmp 0x1137f9c
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.011685da
pop ecx
pop ecx
test eax, eax
je 0x11380ab
push ebx
push edi
push esi
call fcn.0116879e
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.011683d4
sub edi, eax
push edi
push esi
call fcn.011683ea
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.01134cff
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret