joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11b0f80
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x338
mov dword [esp + 0x31c], 0x11ca1a0
mov dword [esp + 0x9c], 0
lea eax, [esp + 0x9c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x11c5070
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x11c5080
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x318], eax
mov eax, dword [esp + 0x31c]
mov ecx, dword [esp + 0x318]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x314], 0x11ca1a8
mov dword [esp + 0x30c], 0x11ca1b0
mov dword [esp + 0x304], 0x11ca1b8
mov dword [esp + 0x2fc], 0x11ca1c0
mov dword [esp + 0x2f4], 0x11ca1c8
mov dword [esp + 0x2ec], 0x11ca1d0
mov dword [esp + 0x2e4], 0x11ca1d8
mov dword [esp + 0x2dc], 0x11c9b00
mov dword [esp + 0x2d8], 0x84
mov dword [esp + 0x2d4], 0x11ca1e0
mov dword [esp + 0x2cc], 0x11c9b00
mov dword [esp + 0x2c8], 0x89
mov dword [esp + 0x2c4], 0x11ca1e8
mov dword [esp + 0x2bc], 0x11ca1f0
mov dword [esp + 0x2b4], 0x11c9b00
mov dword [esp + 0x2b0], 0x89
mov dword [esp + 0x2ac], 0x11ca1f8
mov dword [esp + 0x2a4], 0x11ca200
mov dword [esp + 0x29c], 0x11ca208
mov dword [esp + 0x294], 0x11c9b00
mov dword [esp + 0x290], 0x8d
mov dword [esp + 0x28c], 0x11c9b00
mov dword [esp + 0x288], 0x8e
mov dword [esp + 0x284], 0x11ca210
mov dword [esp + 0x27c], 0x11c9b00
mov dword [esp + 0x278], 0x90
mov dword [esp + 0x274], 0x11ca218
mov dword [esp + 0x26c], 0x11ca220
mov dword [esp + 0x264], 0x11ca228
mov dword [esp + 0x25c], 0x11c9b00
mov dword [esp + 0x258], 0x94
mov dword [esp + 0x254], 0x11ca230
mov dword [esp + 0x24c], 0x11ca238
mov dword [esp + 0x244], 0x11ca240
mov dword [esp + 0x23c], 0x11c9b00
mov dword [esp + 0x238], 0x98
mov dword [esp + 0x234], 0x11c9b00
mov dword [esp + 0x230], 0x99
mov dword [esp + 0x22c], 0x11ca248
mov dword [esp + 0x224], 0x11ca250
mov dword [esp + 0x21c], 0x11c9b00
mov dword [esp + 0x218], 0x9c
mov dword [esp + 0x214], 0x11ca258
mov dword [esp + 0x20c], 0x11c9b00
mov dword [esp + 0x208], 0x9e
mov dword [esp + 0x204], 0x11ca260
mov dword [esp + 0x1fc], 0x11ca268
mov dword [esp + 0x1f4], 0x11c9b00
mov dword [esp + 0x1f0], 0xa1
mov dword [esp + 0x1ec], 0x11c9b00
mov dword [esp + 0x1e8], 0xa2
mov dword [esp + 0x1e4], 0x11ca270
mov dword [esp + 0x1dc], 0x11ca278
mov dword [esp + 0x1d4], 0x11c9b00
mov dword [esp + 0x1d0], 0xa5
mov dword [esp + 0x1cc], 0x11c9b00
mov dword [esp + 0x1c8], 0xa6
mov dword [esp + 0x1c4], 0x11c9b00
mov dword [esp + 0x1c0], 0xa7
mov dword [esp + 0x1bc], 0x11c9b00
mov dword [esp + 0x1b8], 0x7d
mov dword [esp + 0x1b4], 0x11c9b00
mov dword [esp + 0x1b0], 0x80
mov dword [esp + 0x1ac], 0x11c9b00
mov dword [esp + 0x1a8], 0x87
mov dword [esp + 0x1a4], 0x11c9b00
mov dword [esp + 0x1a0], 0x8b
mov dword [esp + 0x19c], 0x11c9b00
mov dword [esp + 0x198], 0x91
mov dword [esp + 0x194], 0x11c9b00
mov dword [esp + 0x190], 0x95
mov dword [esp + 0x18c], 0x11c9b00
mov dword [esp + 0x188], 0x9a
mov dword [esp + 0x184], 0x11c9b00
mov dword [esp + 0x180], 0x9f
mov dword [esp + 0x17c], 0x11c9b00
mov dword [esp + 0x178], 0xa3
xor edi, edi
jmp eax
Function at 0x11b2c80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x11b2dd5
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x11b2ce1
jmp 0x11b2dcf
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0118cb00
mov ebp, eax
xor ebx, ebx
cmp ebp, 0
je 0x11b2dc3
mov al, byte [esp + 0x20]
mov byte [esp + 0x24], al
mov byte [esp + 0x10], 0xd1
mov byte [esp + 0x11], 0xaf
mov byte [esp + 0x12], 0xad
mov byte [esp + 0x13], 0xa9
mov byte [esp + 0x14], 0xb6
mov byte [esp + 0x15], 0x56
mov byte [esp + 0x16], 0x49
mov byte [esp + 0x17], 0x5b
mov byte [esp + 0x18], 0x48
mov byte [esp + 0x19], 0x11
mov byte [esp + 0x1a], 0x5e
mov byte [esp + 0x1b], 0x59
mov byte [esp + 0x1c], 0x5c
mov byte [esp + 0x1d], 0xef
mov eax, 0xe
mov byte [esp + eax + 0x10], 0
add eax, 1
cmp eax, 0x10
jne 0x11b2d57
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x10
jae 0x11b2da1
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.011b51e0
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x10], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x11b2d6c
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0118d680
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x11b2dc3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11b7af0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + esi], 0
lea esi, [esi + 2]
jne 0x11b7b10
mov dword [esp + 4], 0xbebabc31
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x11b7b81
nop
nop
nop
mov eax, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
mov ebx, eax
xor ebx, 0xd98a8fdf
and eax, 0xd98a8fdf
lea eax, [ebx + eax*2]
mov ebx, eax
and ebx, edi
add eax, edi
add ebx, ebx
sub eax, ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xa5
mov edi, dword [esp]
mov byte [esp + edi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x11b7b40
cmp esi, 2
je 0x11b7b9c
lea eax, [esi - 2]
mov edi, eax
sar edi, 1
mov ebx, dword [esp + 4]
test al, 2
jne 0x11b7ba0
cmp esi, 4
jne 0x11b7bbb
jmp 0x11b7bea
mov eax, edx
jmp 0x11b7bea
dec edi
movzx eax, word [ecx]
add ecx, 2
mov ebp, eax
and ebp, edx
add eax, edx
add ebp, ebp
sub eax, ebp
imul eax, ebx
mov edx, eax
cmp esi, 4
je 0x11b7bea
xor esi, esi
mov eax, edx
nop
movzx edx, word [ecx + esi*2]
mov ebp, eax
and ebp, edx
add eax, edx
add ebp, ebp
sub eax, ebp
imul eax, ebx
movzx edx, word [ecx + esi*2 + 2]
mov ebp, eax
and ebp, edx
add eax, edx
add ebp, ebp
sub eax, ebp
imul eax, ebx
add esi, 2
cmp edi, esi
jne 0x11b7bc0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11b89e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
mov ebx, 0xffffffff
mov esi, ebx
cmp byte [edi + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x11b89f0
mov eax, ebx
and eax, 0xfffffffc
mov ecx, ebx
and ecx, 3
mov edx, ebx
or edx, 3
imul edx, ecx
xor ecx, 3
imul ecx, eax
add edx, ecx
shr edx, 2
movzx eax, byte [edi + ebx - 1]
cmp eax, 0x3d
je 0x11b8a28
cmp eax, 0x2e
jne 0x11b8a29
dec edx
mov eax, ebx
not eax
and eax, 2
mov ecx, ebx
and ecx, 0xfffffffd
sub ecx, eax
movzx eax, byte [edi + ecx]
cmp eax, 0x3d
je 0x11b8a45
cmp eax, 0x2e
jne 0x11b8a46
dec edx
mov dword [esp], edx
mov edx, 0
test ebx, ebx
je 0x11b8b4a
xor ecx, ecx
mov ebp, 2
mov dword [esp + 8], ebx
jmp 0x11b8a86
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov ecx, edx
mov ebx, dword [esp + 8]
cmp ebp, ebx
mov ebp, eax
jae 0x11b8b4a
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x44]
movzx eax, byte [esi + ebp - 2]
push eax
call fcn.0119e800
add esp, 4
mov edi, ebx
mov bh, al
movzx eax, byte [esi + ebp - 1]
mov esi, dword [esp + 0xc]
push eax
call fcn.0119e800
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea edx, [esi + 1]
mov ecx, dword [esp + 0x48]
mov byte [ecx + esi], al
cmp ebp, edi
jae 0x11b8a70
mov eax, dword [esp + 0x44]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 8], edx
call fcn.0119e800
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x11b8a70
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov edx, dword [esp + 0x48]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, dword [esp + 8]
jae 0x11b8a63
mov ecx, dword [esp + 0x44]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 8], al
call fcn.0119e800
add esp, 4
movzx ecx, byte [esp + 4]
cmp al, 0x40
mov edx, ebx
je 0x11b8a70
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x48]
mov byte [ecx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x11b8a70
mov ebx, dword [esp]
cmp edx, ebx
mov eax, 0
jne 0x11b8bd5
mov esi, dword [esp + 0x48]
lea edx, [esi + 0x20]
lea edi, [esp + 0x10]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x30]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x11b8bd1
cmp ebx, 0x21
je 0x11b8bba
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
mov edx, ebp
and edx, 0x1e
movzx ebx, byte [esi + ebp + 0x20]
mov bh, byte [esi + ebp + 0x21]
xor bl, byte [esp + edx + 0x10]
mov byte [esi + ebp], bl
lea edx, [ebp + 1]
and edx, 0x1f
xor bh, byte [esp + edx + 0x10]
mov byte [esi + ebp + 1], bh
add ebp, 2
cmp ecx, ebp
jne 0x11b8b90
test byte [esp], 1
je 0x11b8bd1
mov ecx, ebp
and ecx, 0x1f
movzx edx, byte [esi + ebp + 0x20]
xor dl, byte [esp + ecx + 0x10]
mov byte [esi + ebp], dl
mov byte [esi + eax], 0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11bba10
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0x292a2b54
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 6
ja 0x11bba7b
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0x50648807
and ecx, 0xd0648807
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xdd
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 7
jb 0x11bba40
mov ecx, dword [esp + 4]
mov ecx, dword fs:[ecx]
mov edx, dword [0x11cb1f0]
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx

Function at 0x11bbab0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x11cb1f8]
Function at 0x11bbe20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 8]
test edx, edx
je 0x11bbf17
xor eax, eax
cmp dword [ecx], 0
jne 0x11bbfac
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov word [esp + 0xc], 0x605
mov byte [esp + 0xe], 7
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x11bbeda
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
lea esi, [eax + 0x3ae8cac1]
and esi, edx
add eax, edx
add eax, 0x3ae8cac1
add esi, esi
sub eax, esi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 0x3b
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x11bbea0
mov eax, dword [esp + 0xc]
mov esi, dword [0x11cd3c4]
test esi, esi
je 0x11bbfac
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x11cd3c8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x11bbfb5
inc edi
cmp esi, edi
jne 0x11bbf00
jmp 0x11bbfac
mov dword [esp + 0x14], 0x914e4f44
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x11bbfa8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
mov edx, ecx
not edx
or edx, 0x32e85ced
add edx, ecx
xor ecx, 0x32e85ced
lea esi, [ecx + edx*2]
lea ecx, [ecx + edx*2]
add ecx, 2
lea edx, [eax + esi]
add edx, 2
mov esi, eax
not esi
or esi, ecx
lea ecx, [eax + esi]
add eax, esi
inc eax
mov esi, eax
xor esi, edx
not eax
and eax, edx
add eax, eax
add ecx, esi
inc ecx
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x5f
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x11bbf40
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x11bbfac
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x11cd3cc]
push esi
call fcn.011be4e0
add esp, 0x1c
jmp 0x11bbfac
Function at 0x11bd7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov dword [esp + 0x30], 0xb72a891a
mov dword [esp + 0x34], 0xb326b5d8
mov dword [esp + 0x38], 0xbfecb124
mov dword [esp + 0x3c], 0xbb2ebdd0
mov dword [esp + 0x40], 0xa7a6b92c
mov word [esp + 0x44], 0
mov byte [esp + 0x46], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x16
ja 0x11bd878
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x30]
mov edx, eax
xor edx, 0x3f986d1e
mov esi, eax
xor esi, 0x406792e1
or eax, 0x3f986d1e
and eax, esi
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x6a
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x30], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x17
jb 0x11bd830
lea eax, [esp + 0x30]
push eax
call fcn.011c08b0
add esp, 4
mov dword [0x11d53d8], eax
mov dword [esp + 0xc], 0xf2e0f624
test eax, eax
je 0x11bd89e
mov dword [esp + 0xc], 0xee6e16e5
mov edi, 0xef1e389d
xor eax, eax
cmp edi, 0xf17f408c
setl al
mov eax, dword [eax*4 + 0x11cb220]
mov ecx, 0xfe0baac0
xor ecx, dword [0x11cb228]
add eax, ecx
inc eax
jmp eax

Function at 0x11be3f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x11cb57c]
Function at 0x11bf8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x30]
mov ecx, ebp
add ecx, ebx
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x2c]
jb 0x11bf93a
mov ecx, ebp
shr ecx, 2
mov edx, ebx
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebp
and edx, 0xfffffffc
add esi, edx
add edx, ebx
mov ecx, ebp
not ecx
or ecx, 3
lea ebx, [ecx + ebp]
inc ebx
mov ecx, ebx
shr ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x11bfade
and ebx, 0xfffffffe
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x11bfade
mov dword [esp + 4], 0x80878685
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x11bf9a8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
mov edx, ecx
or edx, 0x87d4279e
mov edi, ecx
not edi
or edi, 0x782bd861
and edi, edx
not edi
and ecx, 0xf82bd861
lea ecx, [edi + ecx*2]
xor ecx, eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 8]
add al, 0x1b
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x11bf960
mov eax, dword [esp + 4]
mov ecx, dword [0x11cd3c4]
test ecx, ecx
je 0x11bf9fa
xor edx, edx
mov edi, dword [0x11cd3c8]
nop
nop
cmp dword [edi + edx*8], 0x54ca534e
je 0x11bf9d0
inc edx
cmp ecx, edx
jne 0x11bf9c0
jmp 0x11bf9fa
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x11bf9fa
lea eax, [esp + 0xc]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x11cd3cc]
push ecx
call fcn.011be4e0
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x28]
js 0x11bfade
push 0xc95dc39
push dword [0x11d53d8]
call fcn.011c0e30
add esp, 8
push 0
push 0
push ebp
push esi
push edi
push ebx
push dword [esp + 0x24]
call eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x80878685
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x11bfa99
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov edi, esi
or edi, 0x87d4279e
mov ebx, esi
not ebx
or ebx, 0x782bd861
and ebx, edi
not ebx
and esi, 0xf82bd861
lea esi, [ebx + esi*2]
xor esi, edx
mov dword [esp + 8], esi
mov edx, dword [esp + 8]
add dl, 0x1b
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x11bfa50
mov edx, dword [0x11cd3c4]
test edx, edx
je 0x11bfade
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x11cd3c8]
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x11bfac0
inc edi
cmp edx, edi
jne 0x11bfab0
jmp 0x11bfade
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x11bfade
push ecx
push 1
push dword [0x11cd3cc]
push edx
mov esi, eax
call fcn.011be4e0
mov eax, esi
add esp, 0x10
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11c0150
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ecx, dword [esp + 0x2c]
mov esi, 2
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec esi
cmp byte [ecx + edx + 1], 0
lea edx, [edx + 1]
jne 0x11c0170
mov dword [esp + 8], 0x92929063
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x11c01f1
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
mov ebx, edi
not ebx
or ebx, 0x7cddcca4
add ebx, edi
xor edi, 0xfcddcca4
lea ebp, [edi + ebx*2]
lea edi, [edi + ebx*2]
add edi, 2
lea ebx, [eax + ebp]
add ebx, 2
not eax
or edi, eax
sub eax, edi
lea eax, [ebx + eax*2]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0xcc
mov edi, dword [esp]
mov byte [esp + edi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x11c01a0
test edx, edx
je 0x11c0215
mov edi, ecx
mov ecx, dword [esp + 8]
mov ebx, ecx
not ebx
test dl, 1
mov dword [esp + 0x10], ebx
jne 0x11c021e
mov ebx, dword [esp + 0x30]
test esi, esi
jne 0x11c024a
jmp 0x11c02b0
mov eax, dword [esp + 0x30]
jmp 0x11c02b0
movsx eax, byte [edi]
xor eax, dword [esp + 0x30]
mov edx, eax
and edx, ebx
mov ebx, ecx
mov ebp, eax
not ebp
and ebp, ecx
imul ebp, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
mov edx, esi
neg edx
inc edi
add eax, ebp
mov ebx, eax
test esi, esi
je 0x11c02b0
xor esi, esi
mov eax, ebx
mov dword [esp + 4], edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ebp, byte [edi + esi]
xor ebp, eax
mov eax, ebp
mov edi, dword [esp + 0x10]
and eax, edi
mov ebx, ebp
not ebx
and ebx, ecx
imul ebx, eax
mov eax, ebp
and eax, ecx
or ebp, ecx
imul ebp, eax
add ebp, ebx
mov eax, dword [esp + 4]
movsx eax, byte [eax + esi + 1]
xor eax, ebp
mov ebx, eax
and ebx, edi
mov edi, dword [esp + 4]
mov ebp, eax
not ebp
and ebp, ecx
imul ebp, ebx
mov ebx, eax
and ebx, ecx
or eax, ecx
imul eax, ebx
add eax, ebp
add esi, 2
cmp edx, esi
jne 0x11c0260
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11c08b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 4], 0xc3c2c110
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x11c0910
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x71c21630
and eax, 0xf1c21630
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
add al, 0x10
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x11c08d0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x2c], 0
sete cl
jmp dword [ecx*4 + 0x11cbe04]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp + 8], 0
mov esi, dword [0x11cbe30]
mov edi, dword [edx]
xor eax, eax
cmp edi, edx
setne al
mov dword [esp + 0xc], edx
jmp dword [eax*4 + 0x11cbe0c]
mov ebp, dword [edi + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov dword [esp + 0x10], 1
jmp dword [eax*4 + 0x11cbe14]
mov eax, dword [0x11cbe48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [eax + 8]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x11c0d20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0x898a8b7c
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x11c0d89
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0x31bd87e3
and eax, 0x31bd87e3
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x91
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x11c0d50
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x11cbec4]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x11cbee0]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x11cbecc]
jmp esi
mov ecx, dword [0x11cbf10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x11c1960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x11c1980
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x11c199b
mov eax, 0xffffffff
jmp 0x11c199e
add eax, 0xa
push eax
call fcn.0118c9f0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x11c19e1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x11c19d0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x303f3e3d
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x11c1a93
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0xbcc49975
and ecx, 0x3cc49975
lea ecx, [esi + ecx*2]
mov esi, ecx
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xb7
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x11c1a50
mov esi, dword [esp + 4]
mov ecx, dword [0x11cd3c4]
test ecx, ecx
je 0x11c1af3
xor edx, edx
mov ebx, dword [0x11cd3c8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x11c1ac0
inc edx
cmp ecx, edx
jne 0x11c1ab0
jmp 0x11c1af3
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x11c1af3
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push ebp
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x11cd3cc]
push ecx
mov edi, eax
call fcn.011be4e0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0118ca00
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret