joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10f726b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x10f72ad
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x117be30]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x117be30]
inc edx
cmp dword [ebp + 8], 0
jne 0x10f7278
pop esi
not eax
pop ebp
ret

Function at 0x10f8ef8
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x10f8f1d
cmp dword [ecx + 0x38], ebx
je 0x10f8f1d
cmp eax, dword [ecx + 0x10]
jae 0x10f8f1d
cmp dword [ecx + 0x14], 1
jne 0x10f8f1d
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x10f8f1f
xor edi, edi
cmp edi, ebx
je 0x10f9002
cmp esi, ebx
je 0x10f9002
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.010f86a1
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x10f8fae
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.01137010
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x10f8fd3
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.01137010
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x10f9004
xor eax, eax
pop edi
pop ebx
ret

Function at 0x10f99f8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x119271c], 1
jne 0x10f9a7d
or dword [0x119271c], 1
mov dword [0x1191518], 0xa1a4ac8b
mov dword [0x119151c], 0xb9eda9a8
mov dword [0x1191520], 0xbfaeeda2
mov dword [0x1191524], 0xa8b9aca8
mov dword [0x1191528], 0xacb8a1ed
mov dword [0x119152c], 0xacb9beed
mov dword [0x1191530], 0xe5eda8b9
mov dword [0x1191534], 0xa6bfa2ba
mov dword [0x1191538], 0xb9edbfa8
mov dword [0x119153c], 0xaca8bfa5
mov dword [0x1191540], 0xedf7e4a9
mov byte [0x1191544], 0xcd
xor eax, eax
mov cl, byte [eax + 0x1191518]
xor cl, 0xcd
mov byte [eax + 0x11915e0], cl
inc eax
cmp eax, 0x2d
jb 0x10f9a7f
mov eax, 0x11915e0
ret
Function at 0x10f9a9a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x119270c], 1
jne 0x10f9b01
or dword [0x119270c], 1
mov dword [0x1191554], 0xa8eda283
mov dword [0x1191558], 0xbfa2bfbf
mov dword [0x119155c], 0xbea8a0ed
mov dword [0x1191560], 0xa8aaacbe
mov dword [0x1191564], 0xb9a8bfed
mov dword [0x1191568], 0xa8a3bfb8
mov dword [0x119156c], 0xb4afeda9
mov dword [0x1191570], 0xafa2a7ed
mov byte [0x1191574], 0xcd
xor eax, eax
mov cl, byte [eax + 0x1191554]
xor cl, 0xcd
mov byte [eax + 0x119161c], cl
inc eax
cmp eax, 0x21
jb 0x10f9b03
mov eax, 0x119161c
ret

Function at 0x10f9b1e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192700], 1
jne 0x10f9b87
or dword [0x1192700], 1
mov dword [0x11915a0], 0xedacb881
mov dword [0x11915a4], 0xa2bfbfa8
mov dword [0x11915a8], 0xb8bfedbf
mov dword [0x11915ac], 0xa3a4a3a3
mov dword [0x11915b0], 0xbfa8edaa
mov dword [0x11915b4], 0xedbfa2bf
mov dword [0x11915b8], 0xa9a3aca5
mov dword [0x11915bc], 0xf7bfa8a1
mov word [0x11915c0], 0xcded
xor eax, eax
mov cl, byte [eax + 0x11915a0]
xor cl, 0xcd
mov byte [eax + 0x1191668], cl
inc eax
cmp eax, 0x22
jb 0x10f9b89
mov eax, 0x1191668
ret

Function at 0x10f9ba4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926fc], 1
jne 0x10f9bf6
or dword [0x11926fc], 1
mov dword [0x11915c4], 0x81acb8a1
mov dword [0x11915c8], 0xaca2a192
mov dword [0x11915cc], 0xbfb9bea9
mov dword [0x11915d0], 0xedaaa3a4
mov dword [0x11915d4], 0xa1a4acab
mov word [0x11915d8], 0xa9a8
mov byte [0x11915da], 0xcd
xor eax, eax
mov cl, byte [eax + 0x11915c4]
xor cl, 0xcd
mov byte [eax + 0x119168c], cl
inc eax
cmp eax, 0x17
jb 0x10f9bf8
mov eax, 0x119168c
ret
Function at 0x10fa914
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x115ad9b
call fcn.01159c78
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0x116212c]
test eax, eax
jne 0x10fa95c
call fcn.010faab5
mov ecx, dword [ebp + 8]
push eax
call fcn.010d6b3f
mov eax, dword [ebp + 8]
jmp 0x10faaa6
test byte [0x11926f0], 1
jne 0x10fa97d
or dword [0x11926f0], 1
mov dword [0x11916c8], 0xefc5c2c6
mov byte [0x11916cc], 0xcf
xor eax, eax
mov cl, byte [eax + 0x11916c8]
xor cl, 0xcf
mov byte [eax + 0x1191e9c], cl
inc eax
cmp eax, 5
jb 0x10fa97f
push 0xf
mov esi, 0x1191e9c
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10fa9aa
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.010d4ceb
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.010d4d60
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.010ffda9
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.010d4d81
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.010d4d81
push dword [ebp - 0x10]
call dword [0x11620e0]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.010fae00
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.010fab1e
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.010d6b7c
add esp, 0xc
push 0x117d294
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.010dd6fb
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.010db620
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.010d4d81
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.010d4d81
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.010d4d81
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.010d4ca1
push ebx
push 1
mov ecx, esi
call fcn.010d4d81
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x10faab5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926f4], 1
jne 0x10fab01
or dword [0x11926f4], 1
mov dword [0x11916b0], 0xaabda19a
mov dword [0x11916b4], 0xa1a8a0ac
mov dword [0x11916b8], 0xabaab5a6
mov dword [0x11916bc], 0xbdbdaaef
mov dword [0x11916c0], 0xacefbda0
mov dword [0x11916c4], 0xcfaaaba0
xor eax, eax
mov cl, byte [eax + 0x11916b0]
xor cl, 0xcf
mov byte [eax + 0x1191e84], cl
inc eax
cmp eax, 0x18
jb 0x10fab03
mov eax, 0x1191e84
ret
Function at 0x10fab1e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926ec], 1
jne 0x10fab5c
or dword [0x11926ec], 1
mov dword [0x11916d0], 0xbdaae7ef
mov dword [0x11916d4], 0xefbda0bd
mov dword [0x11916d8], 0xaaaba0ac
mov word [0x11916dc], 0xeff5
mov byte [0x11916de], 0xcf
xor eax, eax
mov cl, byte [eax + 0x11916d0]
xor cl, 0xcf
mov byte [eax + 0x1191ea4], cl
inc eax
cmp eax, 0xf
jb 0x10fab5e
mov eax, 0x1191ea4
ret

Function at 0x10fae00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0x11926e8], 1
jne 0x10fae2b
or dword [0x11926e8], 1
mov dword [0x11916e0], 0xaba3a3ea
mov byte [0x11916e4], 0xcf
xor eax, eax
mov cl, byte [eax + 0x11916e0]
xor cl, 0xcf
mov byte [eax + 0x1191eb4], cl
inc eax
cmp eax, 5
jb 0x10fae2d
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0x1191eb4
push eax
call fcn.010ffe02
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.010d4d60
mov eax, esi
leave
ret

Function at 0x10fafd0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926e4], 1
jne 0x10fb02c
or dword [0x11926e4], 1
mov dword [0x11916e8], 0x82bbaa88
mov dword [0x11916ec], 0xa3baaba0
mov dword [0x11916f0], 0xa3a689aa
mov dword [0x11916f4], 0xa2ae81aa
mov dword [0x11916f8], 0xaea9efaa
mov dword [0x11916fc], 0xabaaa3a6
mov word [0x1191700], 0xeff5
mov byte [0x1191702], 0xcf
xor eax, eax
mov cl, byte [eax + 0x11916e8]
xor cl, 0xcf
mov byte [eax + 0x1191ebc], cl
inc eax
cmp eax, 0x1b
jb 0x10fb02e
mov eax, 0x1191ebc
ret

Function at 0x10fb049
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926e0], 1
jne 0x10fb0a6
or dword [0x11926e0], 1
mov dword [0x1191704], 0x8cbbaa9c
mov dword [0x1191708], 0xaabdbdba
mov dword [0x119170c], 0xa68bbba1
mov dword [0x1191710], 0xbbacaabd
mov dword [0x1191714], 0xefb6bda0
mov dword [0x1191718], 0xa3a6aea9
mov dword [0x119171c], 0xeff5abaa
mov byte [0x1191720], 0xcf
xor eax, eax
mov cl, byte [eax + 0x1191704]
xor cl, 0xcf
mov byte [eax + 0x1191ed8], cl
inc eax
cmp eax, 0x1d
jb 0x10fb0a8
mov eax, 0x1191ed8
ret

Function at 0x10fb1ba
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926dc], 1
jne 0x10fb217
or dword [0x11926dc], 1
mov dword [0x1191724], 0x8cbbaa88
mov dword [0x1191728], 0xaabdbdba
mov dword [0x119172c], 0xa68bbba1
mov dword [0x1191730], 0xbbacaabd
mov dword [0x1191734], 0xefb6bda0
mov dword [0x1191738], 0xa3a6aea9
mov dword [0x119173c], 0xeff5abaa
mov byte [0x1191740], 0xcf
xor eax, eax
mov cl, byte [eax + 0x1191724]
xor cl, 0xcf
mov byte [eax + 0x1191ef8], cl
inc eax
cmp eax, 0x1d
jb 0x10fb219
mov eax, 0x1191ef8
ret
Function at 0x10fb3d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926d8], 1
jne 0x10fb541
mov eax, 0xdd93
mov ecx, eax
mov word [0x1191748], cx
mov word [0x119174a], cx
add ecx, 9
mov word [0x119174c], cx
lea ecx, [eax + 0x28]
mov word [0x119174e], cx
add ecx, 2
lea edx, [eax + 0x13]
mov word [0x1191750], cx
push ebx
mov ecx, edx
mov word [0x1191752], cx
add ecx, 0xfffffffb
push esi
mov esi, ecx
lea ecx, [eax + 0x16]
mov word [0x1191754], si
lea esi, [eax + 0x15]
mov word [0x1191756], si
mov word [0x1191764], cx
add esi, 0xfffffff8
add edx, 0xfffffffd
mov ecx, esi
push edi
lea edi, [eax + 0x17]
mov word [0x1191766], cx
mov ecx, eax
mov word [0x119175c], dx
mov edx, edi
mov word [0x1191768], cx
mov word [0x119176a], cx
add ecx, 0x6c
mov word [0x119175e], dx
mov edx, ecx
or dword [0x11926d8], 1
mov word [0x119176c], dx
lea edx, [eax + 0x68]
mov ebx, edx
mov word [0x119176e], bx
mov ebx, ecx
mov word [0x1191770], bx
lea ebx, [eax + 0x63]
mov word [0x119177e], ax
mov word [0x1191772], bx
mov ebx, ecx
mov ecx, eax
add eax, 0xc
mov word [0x1191780], ax
lea eax, [ecx + 0x18]
mov word [0x1191786], ax
add eax, 0xf
mov word [0x1191788], ax
lea eax, [ecx + 0x19]
mov word [0x119178a], ax
add eax, 0xf
mov word [0x119178c], ax
lea eax, [ecx - 0x12]
mov word [0x119178e], ax
add eax, 0x2d
pop edi
mov word [0x1191790], ax
lea eax, [ecx + 0x3c]
pop esi
mov word [0x1191774], bx
mov dword [0x1191758], 0xdda6dd89
mov dword [0x1191760], 0xdda1dd86
mov word [0x1191776], dx
mov dword [0x1191778], 0xddffdd8d
mov word [0x119177c], cx
mov dword [0x1191782], 0xdda0ddbd
mov dword [0x1191792], 0xddaadda2
mov word [0x1191796], ax
pop ebx
xor eax, eax
mov ecx, 0xddcf
xor cx, word [eax + 0x1191748]
add eax, 2
mov word [eax + 0x1191f16], cx
cmp eax, 0x50
jb 0x10fb543
mov eax, 0x1191f18
ret

Function at 0x10fb564
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926d4], 1
jne 0x10fb5b9
or dword [0x11926d4], 1
mov dword [0x1191798], 0xb9efa081
mov dword [0x119179c], 0xa6bcbdaa
mov dword [0x11917a0], 0xa6efa1a0
mov dword [0x11917a4], 0xefa0a9a1
mov dword [0x11917a8], 0xa6aeb9ae
mov dword [0x11917ac], 0xa3adaea3
mov word [0x11917b0], 0xcfaa
xor eax, eax
mov cl, byte [eax + 0x1191798]
xor cl, 0xcf
mov byte [eax + 0x1191f68], cl
inc eax
cmp eax, 0x1a
jb 0x10fb5bb
mov eax, 0x1191f68
ret

Function at 0x10fb7a8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926d0], 1
jne 0x10fb7fd
or dword [0x11926d0], 1
mov dword [0x11917b4], 0xb9efa081
mov dword [0x11917b8], 0xa6bcbdaa
mov dword [0x11917bc], 0xa6efa1a0
mov dword [0x11917c0], 0xefa0a9a1
mov dword [0x11917c4], 0xa6aeb9ae
mov dword [0x11917c8], 0xa3adaea3
mov word [0x11917cc], 0xcfaa
xor eax, eax
mov cl, byte [eax + 0x11917b4]
xor cl, 0xcf
mov byte [eax + 0x1191f84], cl
inc eax
cmp eax, 0x1a
jb 0x10fb7ff
mov eax, 0x1191f84
ret
Function at 0x10fb81a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926cc], 1
jne 0x10fb880
or dword [0x11926cc], 1
mov dword [0x11917d0], 0xaeb9a186
mov dword [0x11917d4], 0xefaba6a3
mov dword [0x11917d8], 0xbcbdaab9
mov dword [0x11917dc], 0xefa1a0a6
mov dword [0x11917e0], 0xa0a9a1a6
mov dword [0x11917e4], 0xa8a6bcef
mov dword [0x11917e8], 0xbabbaea1
mov word [0x11917ec], 0xaabd
mov byte [0x11917ee], 0xcf
xor eax, eax
mov cl, byte [eax + 0x11917d0]
xor cl, 0xcf
mov byte [eax + 0x1191fa0], cl
inc eax
cmp eax, 0x1f
jb 0x10fb882
mov eax, 0x1191fa0
ret

Function at 0x10fbb87
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926c8], 1
jne 0x10fbbed
or dword [0x11926c8], 1
mov dword [0x11917f0], 0xa3a6ae89
mov dword [0x11917f4], 0xbbefabaa
mov dword [0x11917f8], 0xaaa8efa0
mov dword [0x11917fc], 0xaabbefbb
mov dword [0x1191800], 0xa9efbfa2
mov dword [0x1191804], 0xaaaba3a0
mov dword [0x1191808], 0xaebfefbd
mov word [0x119180c], 0xa7bb
mov byte [0x119180e], 0xcf
xor eax, eax
mov cl, byte [eax + 0x11917f0]
xor cl, 0xcf
mov byte [eax + 0x1191fc0], cl
inc eax
cmp eax, 0x1f
jb 0x10fbbef
mov eax, 0x1191fc0
ret

Function at 0x10fbd5f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926c4], 1
jne 0x10fbdb1
or dword [0x11926c4], 1
mov dword [0x1191810], 0x89bbaa88
mov dword [0x1191814], 0xaaaba3a0
mov dword [0x1191818], 0xbbae9fbd
mov dword [0x119181c], 0xaea9efa7
mov dword [0x1191820], 0xabaaa3a6
mov word [0x1191824], 0xeff5
mov byte [0x1191826], 0xcf
xor eax, eax
mov cl, byte [eax + 0x1191810]
xor cl, 0xcf
mov byte [eax + 0x1191fe0], cl
inc eax
cmp eax, 0x17
jb 0x10fbdb3
mov eax, 0x1191fe0
ret

Function at 0x10fc07b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926c0], 1
mov edx, 0xddcf
jne 0x10fc112
or dword [0x11926c0], 1
lea ecx, [edx + 0x1b]
mov eax, ecx
mov word [0x1191828], ax
add eax, 0xffffffb5
mov word [0x119182a], ax
push esi
lea eax, [edx - 0x12]
mov esi, eax
add eax, 0xfffffff1
mov word [0x1191834], ax
lea eax, [edx - 0x2d]
mov word [0x1191836], ax
add eax, 0xfffffff6
mov word [0x1191838], ax
lea eax, [edx + 0x2a]
mov word [0x119182c], si
add esi, 0xffffffe3
mov word [0x119183a], ax
add eax, 2
mov word [0x119183c], ax
lea eax, [edx + 0x2d]
mov word [0x119183e], ax
mov eax, edx
mov word [0x119182e], si
mov dword [0x1191830], 0xddbddda8
mov dword [0x1191840], 0xddeaddfd
mov word [0x1191844], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x1191828]
add eax, 2
mov word [eax + 0x1191ff6], cx
cmp eax, 0x1e
jb 0x10fc114
mov eax, 0x1191ff8
ret

Function at 0x10fc132
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926bc], 1
mov ecx, 0xddcf
jne 0x10fc173
or dword [0x11926bc], 1
lea eax, [ecx - 0x1b]
mov word [0x1191848], ax
add eax, 0xb
mov word [0x119184a], ax
lea eax, [ecx - 0x26]
mov word [0x119184c], ax
add eax, 9
mov word [0x119184e], ax
mov eax, ecx
mov word [0x1191850], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1191848]
add eax, 2
mov word [eax + 0x1192016], dx
cmp eax, 0xa
jb 0x10fc175
mov eax, 0x1192018
ret
Function at 0x10fc193
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926b8], 1
mov ecx, 0xddcf
jne 0x10fc1e6
or dword [0x11926b8], 1
lea eax, [ecx - 0x1b]
mov word [0x1191854], ax
add eax, 0xb
mov word [0x1191856], ax
lea eax, [ecx - 0x26]
mov word [0x1191858], ax
add eax, 0x53
mov word [0x119185a], ax
lea eax, [ecx + 0x2e]
mov word [0x119185c], ax
add eax, 0xffffffb5
mov word [0x119185e], ax
mov eax, ecx
mov word [0x1191860], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1191854]
add eax, 2
mov word [eax + 0x1192022], dx
cmp eax, 0xe
jb 0x10fc1e8
mov eax, 0x1192024
ret

Function at 0x10fc206
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926b4], 1
mov ecx, 0xddcf
jne 0x10fc259
or dword [0x11926b4], 1
lea eax, [ecx - 0x1b]
mov word [0x1191864], ax
add eax, 0xb
mov word [0x1191866], ax
lea eax, [ecx - 0x26]
mov word [0x1191868], ax
add eax, 0x50
mov word [0x119186a], ax
lea eax, [ecx + 0x2c]
mov word [0x119186c], ax
add eax, 0xffffffb7
mov word [0x119186e], ax
mov eax, ecx
mov word [0x1191870], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1191864]
add eax, 2
mov word [eax + 0x1192032], dx
cmp eax, 0xe
jb 0x10fc25b
mov eax, 0x1192034
ret

Function at 0x10fc279
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926b0], 1
mov ecx, 0xddcf
jne 0x10fc2ba
or dword [0x11926b0], 1
lea eax, [ecx - 0x1b]
mov word [0x1191874], ax
add eax, 0xb
mov word [0x1191876], ax
lea eax, [ecx - 0x26]
mov word [0x1191878], ax
add eax, 9
mov word [0x119187a], ax
mov eax, ecx
mov word [0x119187c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1191874]
add eax, 2
mov word [eax + 0x1192042], dx
cmp eax, 0xa
jb 0x10fc2bc
mov eax, 0x1192044
ret

Function at 0x10fc2da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926ac], 1
mov ecx, 0xddcf
jne 0x10fc32d
or dword [0x11926ac], 1
lea eax, [ecx - 0x1b]
mov word [0x1191880], ax
add eax, 0xb
mov word [0x1191882], ax
lea eax, [ecx - 0x26]
mov word [0x1191884], ax
add eax, 0x53
mov word [0x1191886], ax
lea eax, [ecx + 0x2e]
mov word [0x1191888], ax
add eax, 0xffffffb5
mov word [0x119188a], ax
mov eax, ecx
mov word [0x119188c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1191880]
add eax, 2
mov word [eax + 0x119204e], dx
cmp eax, 0xe
jb 0x10fc32f
mov eax, 0x1192050
ret
Function at 0x10fc427
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926a8], 1
mov ecx, 0xddcf
jne 0x10fc63c
or dword [0x11926a8], 1
lea eax, [ecx + 0x30]
mov word [0x1191898], ax
dec eax
mov word [0x119189a], ax
lea eax, [ecx + 0x2e]
mov word [0x119189c], ax
dec eax
mov word [0x119189e], ax
lea eax, [ecx + 0x2c]
mov word [0x11918a0], ax
dec eax
mov word [0x11918a2], ax
lea eax, [ecx + 0x2a]
mov word [0x11918a4], ax
dec eax
mov word [0x11918a6], ax
lea eax, [ecx + 0x28]
mov word [0x11918a8], ax
dec eax
mov word [0x11918aa], ax
lea eax, [ecx - 0x41]
mov word [0x11918ac], ax
dec eax
mov word [0x11918ae], ax
lea eax, [ecx - 0x43]
mov word [0x11918b0], ax
dec eax
mov word [0x11918b2], ax
lea eax, [ecx - 0x45]
mov word [0x11918b4], ax
dec eax
mov word [0x11918b6], ax
lea eax, [ecx - 0x47]
mov word [0x11918b8], ax
dec eax
mov word [0x11918ba], ax
lea eax, [ecx - 0x49]
mov word [0x11918bc], ax
dec eax
mov word [0x11918be], ax
lea eax, [ecx - 0x4b]
mov word [0x11918c0], ax
dec eax
mov word [0x11918c2], ax
lea eax, [ecx - 0x4d]
mov word [0x11918c4], ax
dec eax
mov word [0x11918c6], ax
lea eax, [ecx - 0x4f]
mov word [0x11918c8], ax
add eax, 0x1f
mov word [0x11918ca], ax
lea eax, [ecx - 0x31]
mov word [0x11918cc], ax
dec eax
mov word [0x11918ce], ax
lea eax, [ecx - 0x33]
mov word [0x11918d0], ax
dec eax
mov word [0x11918d2], ax
lea eax, [ecx - 0x35]
mov word [0x11918d4], ax
dec eax
mov word [0x11918d6], ax
lea eax, [ecx - 0x37]
mov word [0x11918d8], ax
dec eax
mov word [0x11918da], ax
lea eax, [ecx - 0x39]
mov word [0x11918dc], ax
dec eax
mov word [0x11918de], ax
lea eax, [ecx - 0x21]
mov word [0x11918e0], ax
dec eax
mov word [0x11918e2], ax
lea eax, [ecx - 0x23]
mov word [0x11918e4], ax
dec eax
mov word [0x11918e6], ax
lea eax, [ecx - 0x25]
mov word [0x11918e8], ax
dec eax
mov word [0x11918ea], ax
lea eax, [ecx - 0x27]
mov word [0x11918ec], ax
dec eax
mov word [0x11918ee], ax
lea eax, [ecx - 0x29]
mov word [0x11918f0], ax
dec eax
mov word [0x11918f2], ax
lea eax, [ecx - 0x2b]
mov word [0x11918f4], ax
dec eax
mov word [0x11918f6], ax
lea eax, [ecx - 0x2d]
mov word [0x11918f8], ax
dec eax
mov word [0x11918fa], ax
lea eax, [ecx - 0x2f]
mov word [0x11918fc], ax
add eax, 0x1f
mov word [0x11918fe], ax
lea eax, [ecx - 0x11]
mov word [0x1191900], ax
dec eax
mov word [0x1191902], ax
lea eax, [ecx - 0x13]
mov word [0x1191904], ax
dec eax
mov word [0x1191906], ax
lea eax, [ecx - 0x15]
mov word [0x1191908], ax
dec eax
mov word [0x119190a], ax
lea eax, [ecx - 0x17]
mov word [0x119190c], ax
dec eax
mov word [0x119190e], ax
lea eax, [ecx - 0x19]
mov word [0x1191910], ax
dec eax
mov word [0x1191912], ax
mov eax, ecx
mov word [0x1191914], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x1191898]
add eax, 2
mov word [eax + 0x119205e], dx
cmp eax, 0x7e
jb 0x10fc63e
mov eax, 0x1192060
ret
Function at 0x10fcd0e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926a4], 1
jne 0x10fcd75
or dword [0x11926a4], 1
mov dword [0x1191918], 0xb590b5a2
mov dword [0x119191c], 0xbd90bfa6
mov dword [0x1191920], 0xaaabaeaa
mov dword [0x1191924], 0xa1a690bd
mov dword [0x1191928], 0xa990bba6
mov dword [0x119192c], 0xe7aaa3a6
mov dword [0x1191930], 0xaea9efe6
mov dword [0x1191934], 0xabaaa3a6
mov byte [0x1191938], 0xcf
xor eax, eax
mov cl, byte [eax + 0x1191918]
xor cl, 0xcf
mov byte [eax + 0x11920e0], cl
inc eax
cmp eax, 0x21
jb 0x10fcd77
mov eax, 0x11920e0
ret

Function at 0x10fcd92
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11926a0], 1
jne 0x10fcdf9
or dword [0x11926a0], 1
mov dword [0x119193c], 0xb590b5a2
mov dword [0x1191940], 0xbd90bfa6
mov dword [0x1191944], 0xaaabaeaa
mov dword [0x1191948], 0xa6a990bd
mov dword [0x119194c], 0xbc90aaa3
mov dword [0x1191950], 0xe7bbaebb
mov dword [0x1191954], 0xaea9efe6
mov dword [0x1191958], 0xabaaa3a6
mov byte [0x119195c], 0xcf
xor eax, eax
mov cl, byte [eax + 0x119193c]
xor cl, 0xcf
mov byte [eax + 0x1192104], cl
inc eax
cmp eax, 0x21
jb 0x10fcdfb
mov eax, 0x1192104
ret

Function at 0x10fce16
Capabilities:
Encode data using xor

Disassembly:
test byte [0x119269c], 1
jne 0x10fce94
or dword [0x119269c], 1
mov dword [0x1191960], 0xb590b5a2
mov dword [0x1191964], 0xbd90bfa6
mov dword [0x1191968], 0xaaabaeaa
mov dword [0x119196c], 0xb7aa90bd
mov dword [0x1191970], 0xacaebdbb
mov dword [0x1191974], 0xa6a990bb
mov dword [0x1191978], 0xbb90aaa3
mov dword [0x119197c], 0xaaa790a0
mov dword [0x1191980], 0xe6e7bfae
mov dword [0x1191984], 0xa6aea9ef
mov dword [0x1191988], 0xcfabaaa3
xor eax, eax
mov cl, byte [eax + 0x1191960]
xor cl, 0xcf
mov byte [eax + 0x1192128], cl
inc eax
cmp eax, 0x2c
jb 0x10fce96
mov eax, 0x1192128
ret

Function at 0x10fceb1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192698], 1
jne 0x10fcf1b
or dword [0x1192698], 1
mov dword [0x119198c], 0xa3a6ae89
mov dword [0x1191990], 0xbbefabaa
mov dword [0x1191994], 0xbdacefa0
mov dword [0x1191998], 0xaabbaeaa
mov dword [0x119199c], 0xbcaaabef
mov dword [0x11919a0], 0xaea1a6bb
mov dword [0x11919a4], 0xa1a0a6bb
mov dword [0x11919a8], 0xbbaebfef
mov dword [0x11919ac], 0xcfeff5a7
xor eax, eax
mov cl, byte [eax + 0x119198c]
xor cl, 0xcf
mov byte [eax + 0x1192154], cl
inc eax
cmp eax, 0x24
jb 0x10fcf1d
mov eax, 0x1192154
ret

Function at 0x10fcf38
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192694], 1
jne 0x10fcf9e
or dword [0x1192694], 1
mov dword [0x11919b0], 0xa3a6ae89
mov dword [0x11919b4], 0xbbefabaa
mov dword [0x11919b8], 0xbdacefa0
mov dword [0x11919bc], 0xaabbaeaa
mov dword [0x11919c0], 0xbbbaa0ef
mov dword [0x11919c4], 0xefbbbabf
mov dword [0x11919c8], 0xaaa3a6a9
mov word [0x11919cc], 0xeff5
mov byte [0x11919ce], 0xcf
xor eax, eax
mov cl, byte [eax + 0x11919b0]
xor cl, 0xcf
mov byte [eax + 0x1192178], cl
inc eax
cmp eax, 0x1f
jb 0x10fcfa0
mov eax, 0x1192178
ret