joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10d8744
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x115c993
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.010fc77f
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.010fab79
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.010d4ebf
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.010dacb3
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x10d87d1
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.010ff786
add esp, 0x10
test al, al
jne 0x10d8816
call fcn.010d888d
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.01133995
push 0x117ec28
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.0113d8b5
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.010dacb3
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x10d8856
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x10d8835
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.010da121
lea esi, [esp + 0x20]
call fcn.010d4c88
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.010d4d81
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10d888d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c34], 1
jne 0x10d88d6
or dword [0x1192c34], 1
mov dword [0x118df1c], 0xcbddcfec
mov dword [0x118df20], 0xca8e9a98
mov dword [0x118df24], 0xcac1cdcb
mov dword [0x118df28], 0xcfc88ecb
mov dword [0x118df2c], 0xcacbc2c7
mov byte [0x118df30], 0xae
xor eax, eax
mov cl, byte [eax + 0x118df1c]
xor cl, 0xae
mov byte [eax + 0x118e514], cl
inc eax
cmp eax, 0x15
jb 0x10d88d8
mov eax, 0x118e514
ret

Function at 0x10d8fca
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c30], 1
jne 0x10d901f
or dword [0x1192c30], 1
mov dword [0x118df34], 0xc2dbc1ed
mov dword [0x118df38], 0xc1c08eca
mov dword [0x118df3c], 0xdec18eda
mov dword [0x118df40], 0xcd8ec0cb
mov dword [0x118df44], 0xc6ddcfdc
mov dword [0x118df48], 0xc3dbca8e
mov word [0x118df4c], 0xaede
xor eax, eax
mov cl, byte [eax + 0x118df34]
xor cl, 0xae
mov byte [eax + 0x118e52c], cl
inc eax
cmp eax, 0x1a
jb 0x10d9021
mov eax, 0x118e52c
ret
Function at 0x10d903c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c28], 1
jne 0x10d905f
or dword [0x1192c28], 1
mov dword [0x118df54], 0xc9c1c281
mov word [0x118df58], 0xae81
xor eax, eax
mov cl, byte [eax + 0x118df54]
xor cl, 0xae
mov byte [eax + 0x118e54c], cl
inc eax
cmp eax, 6
jb 0x10d9061
mov eax, 0x118e54c
ret

Function at 0x10d907c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c24], 1
jne 0x10d90f7
or dword [0x1192c24], 1
mov dword [0x118df5c], 0xdedadac6
mov dword [0x118df60], 0xcf818194
mov dword [0x118df64], 0xd7c2cfc0
mov dword [0x118df68], 0xddcdc7da
mov dword [0x118df6c], 0xdacbc980
mov dword [0x118df70], 0xc0d9c1ca
mov dword [0x118df74], 0xdaddcbda
mov dword [0x118df78], 0xc3c1cd80
mov dword [0x118df7c], 0x819cd881
mov dword [0x118df80], 0x81c9c1c2
mov byte [0x118df84], 0xae
xor eax, eax
mov cl, byte [eax + 0x118df5c]
xor cl, 0xae
mov byte [eax + 0x118e554], cl
inc eax
cmp eax, 0x29
jb 0x10d90f9
mov eax, 0x118e554
ret

Function at 0x10d9114
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c20], 1
jne 0x10d913f
or dword [0x1192c20], 1
mov dword [0x118df88], 0xdd8893cd
mov dword [0x118df8c], 0x93da8893
mov byte [0x118df90], 0xae
xor eax, eax
mov cl, byte [eax + 0x118df88]
xor cl, 0xae
mov byte [eax + 0x118e580], cl
inc eax
cmp eax, 9
jb 0x10d9141
mov eax, 0x118e580
ret

Function at 0x10d915c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c10], 1
jne 0x10d91e4
or dword [0x1192c10], 1
mov dword [0x118dfa4], 0xdac0c1ed
mov dword [0x118dfa8], 0x83dac0cb
mov dword [0x118dfac], 0xcbded7fa
mov dword [0x118dfb0], 0xdecf8e94
mov dword [0x118dfb4], 0xcdc7c2de
mov dword [0x118dfb8], 0xc1c7dacf
mov dword [0x118dfbc], 0x83d681c0
mov dword [0x118dfc0], 0x83d9d9d9
mov dword [0x118dfc4], 0xc3dcc1c8
mov dword [0x118dfc8], 0xc2dcdb83
mov dword [0x118dfcc], 0xc1cdc0cb
mov dword [0x118dfd0], 0xaecacbca
xor eax, eax
mov cl, byte [eax + 0x118dfa4]
xor cl, 0xae
mov byte [eax + 0x118e59c], cl
inc eax
cmp eax, 0x30
jb 0x10d91e6
mov eax, 0x118e59c
ret

Function at 0x10d9201
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c0c], 1
jne 0x10d922c
or dword [0x1192c0c], 1
mov dword [0x118dfd4], 0xfafde1fe
mov dword [0x118dfd8], 0x8ec1da8e
mov byte [0x118dfdc], 0xae
xor eax, eax
mov cl, byte [eax + 0x118dfd4]
xor cl, 0xae
mov byte [eax + 0x118e5cc], cl
inc eax
cmp eax, 9
jb 0x10d922e
mov eax, 0x118e5cc
ret

Function at 0x10d9249
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c08], 1
jne 0x10d9292
or dword [0x1192c08], 1
mov dword [0x118dfe0], 0xc7cfc88e
mov dword [0x118dfe4], 0x8ecacbc2
mov dword [0x118dfe8], 0xc6dac7d9
mov dword [0x118dfec], 0xcfdadd8e
mov dword [0x118dff0], 0x8edddbda
mov byte [0x118dff4], 0xae
xor eax, eax
mov cl, byte [eax + 0x118dfe0]
xor cl, 0xae
mov byte [eax + 0x118e5d8], cl
inc eax
cmp eax, 0x15
jb 0x10d9294
mov eax, 0x118e5d8
ret
Function at 0x10d92c9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x115b208
call fcn.01159c78
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x10d947a
cmp dword [ebp + 0x10], ebx
je 0x10d947a
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.010da614
push eax
push 0x117cb80
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.010d5515
push 0x117cb7c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.010d554b
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.010d4ebf
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.010d4ebf
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x10d93d5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.010da614
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.010da636
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x10d9389
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.010de0ee
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.010d4ebf
inc bl
jne 0x10d9441
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.010d4ebf
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x10d9350
test byte [0x1192c00], 1
jne 0x10d9402
or dword [0x1192c00], 1
mov dword [0x118e004], 0x8edac1e0
mov dword [0x118e008], 0xc0dbc1c8
mov word [0x118e00c], 0xaeca
xor eax, eax
mov cl, byte [eax + 0x118e004]
xor cl, 0xae
mov byte [eax + 0x118e5fc], cl
inc eax
cmp eax, 0xa
jb 0x10d9404
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x118e5fc
call fcn.01133995
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x117ec28
lea eax, [ebp - 0x44]
push eax
call fcn.0113d8b5
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.010da636
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.010d4ebf
push 1
lea esi, [ebp - 0x2c]
call fcn.010d4ebf
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.010d949f
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.01133995
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x117ec28
lea eax, [ebp - 0x38]
jmp 0x10d943b

Function at 0x10d949f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c04], 1
jne 0x10d94cc
or dword [0x1192c04], 1
mov dword [0x118dff8], 0x8edac1e0
mov dword [0x118dffc], 0xc0dbc1c8
mov word [0x118e000], 0xaeca
xor eax, eax
mov cl, byte [eax + 0x118dff8]
xor cl, 0xae
mov byte [eax + 0x118e5f0], cl
inc eax
cmp eax, 0xa
jb 0x10d94ce
mov eax, 0x118e5f0
ret
Function at 0x10d9c83
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bfc], 1
mov ecx, 0xddae
jne 0x10d9d0d
or dword [0x1192bfc], 1
lea eax, [ecx + 0x1f]
mov word [0x118e010], ax
add eax, 0xf
mov edx, eax
mov word [0x118e012], dx
lea edx, [ecx + 0x21]
mov word [0x118e014], dx
add edx, 0xe
mov word [0x118e016], dx
lea edx, [ecx + 0x18]
mov word [0x118e018], dx
add edx, 0x2b
mov word [0x118e01a], dx
mov edx, eax
mov word [0x118e01c], dx
lea edx, [ecx + 0x1d]
lea eax, [ecx + 0x2c]
mov word [0x118e01e], dx
mov word [0x118e026], ax
add edx, 0x13
mov eax, ecx
mov word [0x118e020], dx
mov dword [0x118e022], 0xdddcddc1
mov word [0x118e028], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x118e010]
add eax, 2
mov word [eax + 0x118e606], dx
cmp eax, 0x1a
jb 0x10d9d0f
mov eax, 0x118e608
ret

Function at 0x10d9d2d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bf8], 1
jne 0x10d9d58
or dword [0x1192bf8], 1
mov dword [0x118e02c], 0xc0dccbc5
mov dword [0x118e030], 0x9c9dc2cb
mov byte [0x118e034], 0xae
xor eax, eax
mov cl, byte [eax + 0x118e02c]
xor cl, 0xae
mov byte [eax + 0x118e624], cl
inc eax
cmp eax, 9
jb 0x10d9d5a
mov eax, 0x118e624
ret

Function at 0x10d9d75
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bf4], 1
jne 0x10d9dde
or dword [0x1192bf4], 1
mov dword [0x118e038], 0xfedacbfd
mov dword [0x118e03c], 0xcbcdc1dc
mov dword [0x118e040], 0xddfbdddd
mov dword [0x118e044], 0xc1e3dccb
mov dword [0x118e048], 0xd6ebcbca
mov dword [0x118e04c], 0xdadecbcd
mov dword [0x118e050], 0xfec0c1c7
mov dword [0x118e054], 0xcdc7c2c1
mov word [0x118e058], 0xaed7
xor eax, eax
mov cl, byte [eax + 0x118e038]
xor cl, 0xae
mov byte [eax + 0x118e630], cl
inc eax
cmp eax, 0x22
jb 0x10d9de0
mov eax, 0x118e630
ret

Function at 0x10d9dfb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bf0], 1
jne 0x10d9e64
or dword [0x1192bf0], 1
mov dword [0x118e05c], 0xfedacbe9
mov dword [0x118e060], 0xcbcdc1dc
mov dword [0x118e064], 0xddfbdddd
mov dword [0x118e068], 0xc1e3dccb
mov dword [0x118e06c], 0xd6ebcbca
mov dword [0x118e070], 0xdadecbcd
mov dword [0x118e074], 0xfec0c1c7
mov dword [0x118e078], 0xcdc7c2c1
mov word [0x118e07c], 0xaed7
xor eax, eax
mov cl, byte [eax + 0x118e05c]
xor cl, 0xae
mov byte [eax + 0x118e654], cl
inc eax
cmp eax, 0x22
jb 0x10d9e66
mov eax, 0x118e654
ret

Function at 0x10d9e81
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bec], 1
jne 0x10d9ed7
or dword [0x1192bec], 1
mov dword [0x118e080], 0x8ecbc2e1
mov dword [0x118e084], 0xdac7c0c7
mov dword [0x118e088], 0xc7c2cfc7
mov dword [0x118e08c], 0xc7dacfd4
mov dword [0x118e090], 0xc88ec0c1
mov dword [0x118e094], 0xcbc2c7cf
mov dword [0x118e098], 0xae8e94ca
xor eax, eax
mov cl, byte [eax + 0x118e080]
xor cl, 0xae
mov byte [eax + 0x118e678], cl
inc eax
cmp eax, 0x1c
jb 0x10d9ed9
mov eax, 0x118e678
ret
Function at 0x10d9ef4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192be8], 1
mov ecx, 0xddae
jne 0x10d9f23
or dword [0x1192be8], 1
lea eax, [ecx + 0x21]
mov word [0x118e09c], ax
add eax, 0xffffffcd
mov word [0x118e09e], ax
mov eax, ecx
mov word [0x118e0a0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x118e09c]
add eax, 2
mov word [eax + 0x118e692], dx
cmp eax, 6
jb 0x10d9f25
mov eax, 0x118e694
ret

Function at 0x10d9f43
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192be0], 1
jne 0x10d9fb3
or dword [0x1192be0], 1
mov dword [0x118e0ac], 0xc2c7cfe8
mov dword [0x118e0b0], 0xda8ecacb
mov dword [0x118e0b4], 0xc0c78ec1
mov dword [0x118e0b8], 0xcfc7dac7
mov dword [0x118e0bc], 0xcbd4c7c2
mov dword [0x118e0c0], 0xd8c0cb8e
mov dword [0x118e0c4], 0xc0c1dcc7
mov dword [0x118e0c8], 0xdac0cbc3
mov word [0x118e0cc], 0x8e94
mov byte [0x118e0ce], 0xae
xor eax, eax
mov cl, byte [eax + 0x118e0ac]
xor cl, 0xae
mov byte [eax + 0x118e6a4], cl
inc eax
cmp eax, 0x23
jb 0x10d9fb5
mov eax, 0x118e6a4
ret

Function at 0x10d9fd0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bd8], 1
jne 0x10da01b
or dword [0x1192bd8], 1
mov dword [0x118e0d8], 0xcfc6c0fb
mov dword [0x118e0dc], 0xcbc2cac0
mov dword [0x118e0e0], 0xd6cb8eca
mov dword [0x118e0e4], 0xdadecbcd
mov dword [0x118e0e8], 0x94c0c1c7
mov word [0x118e0ec], 0xae8e
xor eax, eax
mov cl, byte [eax + 0x118e0d8]
xor cl, 0xae
mov byte [eax + 0x118e6d0], cl
inc eax
cmp eax, 0x16
jb 0x10da01d
mov eax, 0x118e6d0
ret

Function at 0x10da038
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bd4], 1
jne 0x10da08b
or dword [0x1192bd4], 1
mov dword [0x118e0f0], 0xcfc6c0fb
mov dword [0x118e0f4], 0xcbc2cac0
mov dword [0x118e0f8], 0xd6cb8eca
mov dword [0x118e0fc], 0xdadecbcd
mov dword [0x118e100], 0x94c0c1c7
mov dword [0x118e104], 0xa4dd8b8e
mov byte [0x118e108], 0xae
xor eax, eax
mov cl, byte [eax + 0x118e0f0]
xor cl, 0xae
mov byte [eax + 0x118e6e8], cl
inc eax
cmp eax, 0x19
jb 0x10da08d
mov eax, 0x118e6e8
ret

Function at 0x10da0a8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bd0], 1
jne 0x10da0e0
or dword [0x1192bd0], 1
mov dword [0x118e10c], 0xccdbdafd
mov dword [0x118e110], 0xc7d6cb8e
mov dword [0x118e114], 0x8b868eda
mov dword [0x118e118], 0xaea487ca
xor eax, eax
mov cl, byte [eax + 0x118e10c]
xor cl, 0xae
mov byte [eax + 0x118e704], cl
inc eax
cmp eax, 0x10
jb 0x10da0e2
mov eax, 0x118e704
ret
Function at 0x10dbae4
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x115af3d
call fcn.01159c78
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x10dbbc8
cmp byte [edi + 0x49], bl
je 0x10dbbc8
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10dbb1b
xor al, al
jmp 0x10dbbca
push esi
lea esi, [ebp - 0x2c]
call fcn.010db5dd
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x10dbb6b
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x10dbb70
dec eax
je 0x10dbb74
dec eax
dec eax
je 0x10dbbc4
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.010d4d81
mov al, bl
pop esi
jmp 0x10dbbca
mov edx, dword [ebp - 0x2c]
jmp 0x10dbb35
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x10dbb80
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x10dbba6
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x10dbb93
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0113576e
add esp, 0x10
cmp esi, eax
jne 0x10dbb58
cmp byte [edi + 0x49], 0
je 0x10dbbc4
test esi, esi
jne 0x10dbb27
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.010db6b6
jmp 0x10dbb27
mov bl, 1
jmp 0x10dbb5a
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10e0413
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bcc], 1
jne 0x10e0487
or dword [0x1192bcc], 1
mov dword [0x118e724], 0xdcc5dff3
mov dword [0x118e728], 0xdfde90d4
mov dword [0x118e72c], 0xd5d790c4
mov dword [0x118e730], 0xd9d490c4
mov dword [0x118e734], 0xd4d9c0c3
mov dword [0x118e738], 0x90d6df90
mov dword [0x118e73c], 0xd8c4d5dd
mov dword [0x118e740], 0x9790d4df
mov dword [0x118e744], 0xdcdcd1d3
mov dword [0x118e748], 0xb0908a97
xor eax, eax
mov cl, byte [eax + 0x118e724]
xor cl, 0xb0
mov byte [eax + 0x118e868], cl
inc eax
cmp eax, 0x28
jb 0x10e0489
mov eax, 0x118e868
ret

Function at 0x10e04a4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bc8], 1
jne 0x10e050b
or dword [0x1192bc8], 1
mov dword [0x118e74c], 0xdcd9d1f6
mov dword [0x118e750], 0xc490d4d5
mov dword [0x118e754], 0xded990df
mov dword [0x118e758], 0xd5dbdfc6
mov dword [0x118e75c], 0xc4d5dd90
mov dword [0x118e760], 0x90d4dfd8
mov dword [0x118e764], 0xdcd1d397
mov dword [0x118e768], 0x908a97dc
mov byte [0x118e76c], 0xb0
xor eax, eax
mov cl, byte [eax + 0x118e74c]
xor cl, 0xb0
mov byte [eax + 0x118e890], cl
inc eax
cmp eax, 0x21
jb 0x10e050d
mov eax, 0x118e890
ret
Function at 0x10e0528
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bc4], 1
jne 0x10e0588
or dword [0x1192bc4], 1
mov dword [0x118e770], 0xdfc2e0ba
mov dword [0x118e774], 0xdcd2d1d2
mov dword [0x118e778], 0xc5d490c9
mov dword [0x118e77c], 0xdfc490d5
mov dword [0x118e780], 0xc2d3c390
mov dword [0x118e784], 0x90c4c0d9
mov dword [0x118e788], 0xdfc2c2d5
mov dword [0x118e78c], 0xb0908ac2
xor eax, eax
mov cl, byte [eax + 0x118e770]
xor cl, 0xb0
mov byte [eax + 0x118e8b4], cl
inc eax
cmp eax, 0x20
jb 0x10e058a
mov eax, 0x118e8b4
ret

Function at 0x10e0b65
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x10e0caa
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x1192bc0], 1
jne 0x10e0bc7
or dword [0x1192bc0], 1
mov eax, 0xddc3
mov word [0x118e790], ax
add eax, 0x12
mov word [0x118e792], ax
mov eax, 0xddde
mov word [0x118e794], ax
add eax, 0xfffffff6
mov word [0x118e796], ax
mov eax, 0xddb0
mov word [0x118e798], ax
xor eax, eax
mov ecx, 0xddb0
xor cx, word [eax + 0x118e790]
add eax, 2
mov word [eax + 0x118e8d2], cx
cmp eax, 0xa
jb 0x10e0bc9
mov eax, dword [ebx + edi]
mov ecx, 0x118e8d4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10e0c10
test dx, dx
je 0x10e0c0c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10e0c10
add eax, esi
add ecx, esi
test dx, dx
jne 0x10e0bec
xor eax, eax
jmp 0x10e0c15
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10e0c21
mov dword [edi], 0x385
jmp 0x10e0c99
call fcn.010e0cba
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10e0c4d
test dx, dx
je 0x10e0c49
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10e0c4d
add ecx, esi
add eax, esi
test dx, dx
jne 0x10e0c29
xor eax, eax
jmp 0x10e0c52
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10e0c5e
mov dword [edi], 0x386
jmp 0x10e0c99
call fcn.010e0d8d
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10e0c8a
test dx, dx
je 0x10e0c86
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10e0c8a
add ecx, esi
add eax, esi
test dx, dx
jne 0x10e0c66
xor eax, eax
jmp 0x10e0c8f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10e0cb3
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x10e0b84
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x10e0cac
Function at 0x10e0cba
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bbc], 1
jne 0x10e0d6a
or dword [0x1192bbc], 1
mov eax, 0xddd1
mov word [0x118e79c], ax
add eax, 3
mov ecx, eax
mov word [0x118e7a0], ax
mov eax, 0xddf5
mov word [0x118e7a2], ax
add eax, 0xffffffd1
mov word [0x118e7a4], ax
mov eax, 0xddd5
mov word [0x118e79e], cx
mov ecx, eax
lea edx, [eax + 9]
mov word [0x118e7a6], cx
mov ecx, edx
push edi
mov word [0x118e7a8], cx
add ecx, 0xffffffe6
mov edi, ecx
mov word [0x118e7aa], di
lea edi, [eax + 0x27]
mov word [0x118e7ac], di
add edi, 0xffffffdd
mov ecx, eax
add eax, 0xffffffed
mov word [0x118e7ba], ax
lea eax, [ecx - 0x25]
mov word [0x118e7ae], di
mov dword [0x118e7b0], 0xddc4ddc3
mov word [0x118e7b4], cx
mov dword [0x118e7b6], 0xddd5ddde
mov word [0x118e7bc], ax
pop edi
xor eax, eax
mov ecx, 0xddb0
xor cx, word [eax + 0x118e79c]
add eax, 2
mov word [eax + 0x118e8de], cx
cmp eax, 0x22
jb 0x10e0d6c
mov eax, 0x118e8e0
ret

Function at 0x10e0d8d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bb8], 1
mov ecx, 0xddb0
jne 0x10e0de7
or dword [0x1192bb8], 1
lea eax, [ecx + 0x16]
mov word [0x118e7c0], ax
add eax, 0xf
mov word [0x118e7c2], ax
lea eax, [ecx + 0x12]
mov word [0x118e7c4], ax
inc eax
mov word [0x118e7c6], ax
lea eax, [ecx + 0x29]
mov word [0x118e7c8], ax
add eax, 6
mov word [0x118e7ca], ax
lea eax, [ecx + 0x2e]
mov word [0x118e7cc], ax
mov eax, ecx
mov word [0x118e7ce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x118e7c0]
add eax, 2
mov word [eax + 0x118e902], dx
cmp eax, 0x10
jb 0x10e0de9
mov eax, 0x118e904
ret

Function at 0x10e17a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bb4], 1
mov edx, 0xddb0
jne 0x10e1809
or dword [0x1192bb4], 1
lea ecx, [edx + 0x25]
mov eax, ecx
mov word [0x118e7d0], ax
add eax, 0xffffffed
push esi
mov esi, eax
lea eax, [edx + 0x4c]
mov word [0x118e7da], ax
add eax, 0xffffffdd
mov word [0x118e7dc], ax
mov eax, edx
mov word [0x118e7d2], si
mov word [0x118e7d4], si
mov dword [0x118e7d6], 0xddc2dddf
mov dword [0x118e7de], 0xddd5ddde
mov word [0x118e7e2], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x118e7d0]
add eax, 2
mov word [eax + 0x118e912], cx
cmp eax, 0x14
jb 0x10e180b
mov eax, 0x118e914
ret

Function at 0x10e1829
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192bb0], 1
jne 0x10e18c5
or dword [0x1192bb0], 1
mov edx, 0xddd5
mov eax, edx
mov word [0x118e7e4], ax
add eax, 0xffffffed
mov ecx, eax
mov word [0x118e7e6], cx
mov word [0x118e7e8], cx
lea ecx, [edx + 0xa]
mov word [0x118e7ea], cx
mov ecx, eax
mov word [0x118e7ec], cx
lea ecx, [edx + 0x1e]
mov word [0x118e7ee], cx
add ecx, 0xffffffe5
mov word [0x118e7f0], cx
lea ecx, [edx - 4]
push edi
mov edi, ecx
mov word [0x118e7f2], di
mov edi, eax
mov word [0x118e7f6], cx
mov word [0x118e7fe], ax
add ecx, 2
lea eax, [edx - 0x25]
mov word [0x118e7f4], di
mov word [0x118e7f8], cx
mov dword [0x118e7fa], 0xddd5ddc4
mov word [0x118e800], ax
pop edi
xor eax, eax
mov ecx, 0xddb0
xor cx, word [eax + 0x118e7e4]
add eax, 2
mov word [eax + 0x118e926], cx
cmp eax, 0x1e
jb 0x10e18c7
mov eax, 0x118e928
ret