joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1127209
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x112724b
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x1191f08]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x1191f08]
inc edx
cmp dword [ebp + 8], 0
jne 0x1127216
pop esi
not eax
pop ebp
ret

Function at 0x1128e96
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x1128ebb
cmp dword [ecx + 0x38], ebx
je 0x1128ebb
cmp eax, dword [ecx + 0x10]
jae 0x1128ebb
cmp dword [ecx + 0x14], 1
jne 0x1128ebb
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x1128ebd
xor edi, edi
cmp edi, ebx
je 0x1128fa0
cmp esi, ebx
je 0x1128fa0
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.0112863f
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x1128f4c
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.0114f0a0
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x1128f71
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.0114f0a0
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x1128fa2
xor eax, eax
pop edi
pop ebx
ret

Function at 0x112997b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a870c], 1
jne 0x1129a00
or dword [0x11a870c], 1
mov dword [0x11a7508], 0x7b7e7651
mov dword [0x11a750c], 0x63377372
mov dword [0x11a7510], 0x65743778
mov dword [0x11a7514], 0x72637672
mov dword [0x11a7518], 0x76627b37
mov dword [0x11a751c], 0x76636437
mov dword [0x11a7520], 0x3f377263
mov dword [0x11a7524], 0x7c657860
mov dword [0x11a7528], 0x63376572
mov dword [0x11a752c], 0x7672657f
mov dword [0x11a7530], 0x372d3e73
mov byte [0x11a7534], 0x17
xor eax, eax
mov cl, byte [eax + 0x11a7508]
xor cl, 0x17
mov byte [eax + 0x11a75d0], cl
inc eax
cmp eax, 0x2d
jb 0x1129a02
mov eax, 0x11a75d0
ret
Function at 0x1129a1d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86fc], 1
jne 0x1129a84
or dword [0x11a86fc], 1
mov dword [0x11a7544], 0x72377859
mov dword [0x11a7548], 0x65786565
mov dword [0x11a754c], 0x64727a37
mov dword [0x11a7550], 0x72707664
mov dword [0x11a7554], 0x63726537
mov dword [0x11a7558], 0x72796562
mov dword [0x11a755c], 0x6e753773
mov dword [0x11a7560], 0x75787d37
mov byte [0x11a7564], 0x17
xor eax, eax
mov cl, byte [eax + 0x11a7544]
xor cl, 0x17
mov byte [eax + 0x11a760c], cl
inc eax
cmp eax, 0x21
jb 0x1129a86
mov eax, 0x11a760c
ret

Function at 0x1129aa1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86f0], 1
jne 0x1129b0a
or dword [0x11a86f0], 1
mov dword [0x11a7590], 0x3776625b
mov dword [0x11a7594], 0x78656572
mov dword [0x11a7598], 0x62653765
mov dword [0x11a759c], 0x797e7979
mov dword [0x11a75a0], 0x65723770
mov dword [0x11a75a4], 0x37657865
mov dword [0x11a75a8], 0x7379767f
mov dword [0x11a75ac], 0x2d65727b
mov word [0x11a75b0], 0x1737
xor eax, eax
mov cl, byte [eax + 0x11a7590]
xor cl, 0x17
mov byte [eax + 0x11a7658], cl
inc eax
cmp eax, 0x22
jb 0x1129b0c
mov eax, 0x11a7658
ret

Function at 0x1129b27
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86ec], 1
jne 0x1129b79
or dword [0x11a86ec], 1
mov dword [0x11a75b4], 0x5b76627b
mov dword [0x11a75b8], 0x76787b48
mov dword [0x11a75bc], 0x65636473
mov dword [0x11a75c0], 0x3770797e
mov dword [0x11a75c4], 0x7b7e7671
mov word [0x11a75c8], 0x7372
mov byte [0x11a75ca], 0x17
xor eax, eax
mov cl, byte [eax + 0x11a75b4]
xor cl, 0x17
mov byte [eax + 0x11a767c], cl
inc eax
cmp eax, 0x17
jb 0x1129b7b
mov eax, 0x11a767c
ret
Function at 0x112a8c7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1172e1c
call fcn.01171cf8
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0x117a12c]
test eax, eax
jne 0x112a90f
call fcn.0112aa68
mov ecx, dword [ebp + 8]
push eax
call fcn.01106b33
mov eax, dword [ebp + 8]
jmp 0x112aa59
test byte [0x11a86e0], 1
jne 0x112a930
or dword [0x11a86e0], 1
mov dword [0x11a76b8], 0x38121511
mov byte [0x11a76bc], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a76b8]
xor cl, 0x18
mov byte [eax + 0x11a7e8c], cl
inc eax
cmp eax, 5
jb 0x112a932
push 0xf
mov esi, 0x11a7e8c
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x112a95d
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.01104c69
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.01104cde
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0112fd67
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.01104cff
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.01104cff
push dword [ebp - 0x10]
call dword [0x117a0e0]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.0112adb3
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.0112aad1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.01106b70
add esp, 0xc
push 0x119338c
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.0110d6ff
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.0110b624
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.01104cff
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.01104cff
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.01104cff
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.01104c1f
push ebx
push 1
mov ecx, esi
call fcn.01104cff
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x112aa68
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86e4], 1
jne 0x112aab4
or dword [0x11a86e4], 1
mov dword [0x11a76a0], 0x7d6a764d
mov dword [0x11a76a4], 0x767f777b
mov dword [0x11a76a8], 0x7c7d6271
mov dword [0x11a76ac], 0x6a6a7d38
mov dword [0x11a76b0], 0x7b386a77
mov dword [0x11a76b4], 0x187d7c77
xor eax, eax
mov cl, byte [eax + 0x11a76a0]
xor cl, 0x18
mov byte [eax + 0x11a7e74], cl
inc eax
cmp eax, 0x18
jb 0x112aab6
mov eax, 0x11a7e74
ret
Function at 0x112aad1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86dc], 1
jne 0x112ab0f
or dword [0x11a86dc], 1
mov dword [0x11a76c0], 0x6a7d3038
mov dword [0x11a76c4], 0x386a776a
mov dword [0x11a76c8], 0x7d7c777b
mov word [0x11a76cc], 0x3822
mov byte [0x11a76ce], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a76c0]
xor cl, 0x18
mov byte [eax + 0x11a7e94], cl
inc eax
cmp eax, 0xf
jb 0x112ab11
mov eax, 0x11a7e94
ret

Function at 0x112adb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0x11a86d8], 1
jne 0x112adde
or dword [0x11a86d8], 1
mov dword [0x11a76d0], 0x7c74743d
mov byte [0x11a76d4], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a76d0]
xor cl, 0x18
mov byte [eax + 0x11a7ea4], cl
inc eax
cmp eax, 5
jb 0x112ade0
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0x11a7ea4
push eax
call fcn.0112fdc0
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.01104cde
mov eax, esi
leave
ret

Function at 0x112af82
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86d4], 1
jne 0x112afde
or dword [0x11a86d4], 1
mov dword [0x11a76d8], 0x556c7d5f
mov dword [0x11a76dc], 0x746d7c77
mov dword [0x11a76e0], 0x74715e7d
mov dword [0x11a76e4], 0x7579567d
mov dword [0x11a76e8], 0x797e387d
mov dword [0x11a76ec], 0x7c7d7471
mov word [0x11a76f0], 0x3822
mov byte [0x11a76f2], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a76d8]
xor cl, 0x18
mov byte [eax + 0x11a7eac], cl
inc eax
cmp eax, 0x1b
jb 0x112afe0
mov eax, 0x11a7eac
ret

Function at 0x112affe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86d0], 1
jne 0x112b05b
or dword [0x11a86d0], 1
mov dword [0x11a76f4], 0x5b6c7d4b
mov dword [0x11a76f8], 0x7d6a6a6d
mov dword [0x11a76fc], 0x715c6c76
mov dword [0x11a7700], 0x6c7b7d6a
mov dword [0x11a7704], 0x38616a77
mov dword [0x11a7708], 0x7471797e
mov dword [0x11a770c], 0x38227c7d
mov byte [0x11a7710], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a76f4]
xor cl, 0x18
mov byte [eax + 0x11a7ec8], cl
inc eax
cmp eax, 0x1d
jb 0x112b05d
mov eax, 0x11a7ec8
ret

Function at 0x112b16f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86cc], 1
jne 0x112b1cc
or dword [0x11a86cc], 1
mov dword [0x11a7714], 0x5b6c7d5f
mov dword [0x11a7718], 0x7d6a6a6d
mov dword [0x11a771c], 0x715c6c76
mov dword [0x11a7720], 0x6c7b7d6a
mov dword [0x11a7724], 0x38616a77
mov dword [0x11a7728], 0x7471797e
mov dword [0x11a772c], 0x38227c7d
mov byte [0x11a7730], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a7714]
xor cl, 0x18
mov byte [eax + 0x11a7ee8], cl
inc eax
cmp eax, 0x1d
jb 0x112b1ce
mov eax, 0x11a7ee8
ret
Function at 0x112b387
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86c8], 1
jne 0x112b4f6
mov eax, 0x8744
mov ecx, eax
mov word [0x11a7738], cx
mov word [0x11a773a], cx
add ecx, 7
mov word [0x11a773c], cx
lea ecx, [eax + 0x28]
mov word [0x11a773e], cx
add ecx, 0xfffffffe
lea edx, [eax + 0x2d]
mov word [0x11a7740], cx
push ebx
mov ecx, edx
mov word [0x11a7742], cx
add ecx, 5
push esi
mov esi, ecx
lea ecx, [eax + 0x3a]
mov word [0x11a7744], si
lea esi, [eax + 0x3b]
mov word [0x11a7746], si
mov word [0x11a7754], cx
add esi, 0xfffffff8
add edx, 3
mov ecx, esi
push edi
lea edi, [eax + 0x39]
mov word [0x11a7756], cx
mov ecx, eax
mov word [0x11a774c], dx
mov edx, edi
mov word [0x11a7758], cx
mov word [0x11a775a], cx
add ecx, 0xffffffe4
mov word [0x11a774e], dx
mov edx, ecx
or dword [0x11a86c8], 1
mov word [0x11a775c], dx
lea edx, [eax - 0x18]
mov ebx, edx
mov word [0x11a775e], bx
mov ebx, ecx
mov word [0x11a7760], bx
lea ebx, [eax - 0x23]
mov word [0x11a776e], ax
mov word [0x11a7762], bx
mov ebx, ecx
mov ecx, eax
add eax, 4
mov word [0x11a7770], ax
lea eax, [ecx + 0x38]
mov word [0x11a7776], ax
add eax, 0xfffffff1
mov word [0x11a7778], ax
lea eax, [ecx + 0x37]
mov word [0x11a777a], ax
add eax, 0xfffffff1
mov word [0x11a777c], ax
lea eax, [ecx + 0x12]
mov word [0x11a777e], ax
add eax, 0x23
pop edi
mov word [0x11a7780], ax
lea eax, [ecx - 0x2c]
pop esi
mov word [0x11a7764], bx
mov dword [0x11a7748], 0x8771875e
mov dword [0x11a7750], 0x87768751
mov word [0x11a7766], dx
mov dword [0x11a7768], 0x8728875a
mov word [0x11a776c], cx
mov dword [0x11a7772], 0x8777876a
mov dword [0x11a7782], 0x877d8775
mov word [0x11a7786], ax
pop ebx
xor eax, eax
mov ecx, 0x8718
xor cx, word [eax + 0x11a7738]
add eax, 2
mov word [eax + 0x11a7f06], cx
cmp eax, 0x50
jb 0x112b4f8
mov eax, 0x11a7f08
ret

Function at 0x112b519
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86c4], 1
jne 0x112b56e
or dword [0x11a86c4], 1
mov dword [0x11a7788], 0x6e387756
mov dword [0x11a778c], 0x716b6a7d
mov dword [0x11a7790], 0x71387677
mov dword [0x11a7794], 0x38777e76
mov dword [0x11a7798], 0x71796e79
mov dword [0x11a779c], 0x747a7974
mov word [0x11a77a0], 0x187d
xor eax, eax
mov cl, byte [eax + 0x11a7788]
xor cl, 0x18
mov byte [eax + 0x11a7f58], cl
inc eax
cmp eax, 0x1a
jb 0x112b570
mov eax, 0x11a7f58
ret

Function at 0x112b75d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86c0], 1
jne 0x112b7b2
or dword [0x11a86c0], 1
mov dword [0x11a77a4], 0x6e387756
mov dword [0x11a77a8], 0x716b6a7d
mov dword [0x11a77ac], 0x71387677
mov dword [0x11a77b0], 0x38777e76
mov dword [0x11a77b4], 0x71796e79
mov dword [0x11a77b8], 0x747a7974
mov word [0x11a77bc], 0x187d
xor eax, eax
mov cl, byte [eax + 0x11a77a4]
xor cl, 0x18
mov byte [eax + 0x11a7f74], cl
inc eax
cmp eax, 0x1a
jb 0x112b7b4
mov eax, 0x11a7f74
ret
Function at 0x112b7cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86bc], 1
jne 0x112b835
or dword [0x11a86bc], 1
mov dword [0x11a77c0], 0x796e7651
mov dword [0x11a77c4], 0x387c7174
mov dword [0x11a77c8], 0x6b6a7d6e
mov dword [0x11a77cc], 0x38767771
mov dword [0x11a77d0], 0x777e7671
mov dword [0x11a77d4], 0x7f716b38
mov dword [0x11a77d8], 0x6d6c7976
mov word [0x11a77dc], 0x7d6a
mov byte [0x11a77de], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a77c0]
xor cl, 0x18
mov byte [eax + 0x11a7f90], cl
inc eax
cmp eax, 0x1f
jb 0x112b837
mov eax, 0x11a7f90
ret

Function at 0x112bb3c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86b8], 1
jne 0x112bba2
or dword [0x11a86b8], 1
mov dword [0x11a77e0], 0x7471795e
mov dword [0x11a77e4], 0x6c387c7d
mov dword [0x11a77e8], 0x7d7f3877
mov dword [0x11a77ec], 0x7d6c386c
mov dword [0x11a77f0], 0x7e386875
mov dword [0x11a77f4], 0x7d7c7477
mov dword [0x11a77f8], 0x7968386a
mov word [0x11a77fc], 0x706c
mov byte [0x11a77fe], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a77e0]
xor cl, 0x18
mov byte [eax + 0x11a7fb0], cl
inc eax
cmp eax, 0x1f
jb 0x112bba4
mov eax, 0x11a7fb0
ret

Function at 0x112bd14
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86b4], 1
jne 0x112bd66
or dword [0x11a86b4], 1
mov dword [0x11a7800], 0x5e6c7d5f
mov dword [0x11a7804], 0x7d7c7477
mov dword [0x11a7808], 0x6c79486a
mov dword [0x11a780c], 0x797e3870
mov dword [0x11a7810], 0x7c7d7471
mov word [0x11a7814], 0x3822
mov byte [0x11a7816], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a7800]
xor cl, 0x18
mov byte [eax + 0x11a7fd0], cl
inc eax
cmp eax, 0x17
jb 0x112bd68
mov eax, 0x11a7fd0
ret

Function at 0x112c030
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86b0], 1
mov edx, 0x8718
jne 0x112c0c7
or dword [0x11a86b0], 1
lea ecx, [edx + 0x25]
mov eax, ecx
mov word [0x11a7818], ax
add eax, 0xb
mov word [0x11a781a], ax
push esi
lea eax, [edx + 0x52]
mov esi, eax
add eax, 0xf
mov word [0x11a7824], ax
lea eax, [edx + 0x5d]
mov word [0x11a7826], ax
add eax, 0xffffffda
mov word [0x11a7828], ax
lea eax, [edx + 0x16]
mov word [0x11a781c], si
add esi, 0xd
mov word [0x11a782a], ax
add eax, 0xfffffffe
mov word [0x11a782c], ax
lea eax, [edx + 0x13]
mov word [0x11a782e], ax
mov eax, edx
mov word [0x11a781e], si
mov dword [0x11a7820], 0x876a877f
mov dword [0x11a7830], 0x873d872a
mov word [0x11a7834], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x11a7818]
add eax, 2
mov word [eax + 0x11a7fe6], cx
cmp eax, 0x1e
jb 0x112c0c9
mov eax, 0x11a7fe8
ret

Function at 0x112c0e7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86ac], 1
mov ecx, 0x8718
jne 0x112c128
or dword [0x11a86ac], 1
lea eax, [ecx + 0x4b]
mov word [0x11a7838], ax
add eax, 5
mov word [0x11a783a], ax
lea eax, [ecx + 0x66]
mov word [0x11a783c], ax
add eax, 0xffffffe7
mov word [0x11a783e], ax
mov eax, ecx
mov word [0x11a7840], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a7838]
add eax, 2
mov word [eax + 0x11a8006], dx
cmp eax, 0xa
jb 0x112c12a
mov eax, 0x11a8008
ret
Function at 0x112c148
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86a8], 1
mov ecx, 0x8718
jne 0x112c19b
or dword [0x11a86a8], 1
lea eax, [ecx + 0x4b]
mov word [0x11a7844], ax
add eax, 5
mov word [0x11a7846], ax
lea eax, [ecx + 0x66]
mov word [0x11a7848], ax
add eax, 0xffffffad
mov word [0x11a784a], ax
lea eax, [ecx + 0x12]
mov word [0x11a784c], ax
add eax, 0x3b
mov word [0x11a784e], ax
mov eax, ecx
mov word [0x11a7850], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a7844]
add eax, 2
mov word [eax + 0x11a8012], dx
cmp eax, 0xe
jb 0x112c19d
mov eax, 0x11a8014
ret

Function at 0x112c1bb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86a4], 1
mov ecx, 0x8718
jne 0x112c20e
or dword [0x11a86a4], 1
lea eax, [ecx + 0x4b]
mov word [0x11a7854], ax
add eax, 5
mov word [0x11a7856], ax
lea eax, [ecx + 0x66]
mov word [0x11a7858], ax
add eax, 0xffffffb0
mov word [0x11a785a], ax
lea eax, [ecx + 0x14]
mov word [0x11a785c], ax
add eax, 0x39
mov word [0x11a785e], ax
mov eax, ecx
mov word [0x11a7860], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a7854]
add eax, 2
mov word [eax + 0x11a8022], dx
cmp eax, 0xe
jb 0x112c210
mov eax, 0x11a8024
ret

Function at 0x112c22e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a86a0], 1
mov ecx, 0x8718
jne 0x112c26f
or dword [0x11a86a0], 1
lea eax, [ecx + 0x4b]
mov word [0x11a7864], ax
add eax, 5
mov word [0x11a7866], ax
lea eax, [ecx + 0x66]
mov word [0x11a7868], ax
add eax, 0xffffffe7
mov word [0x11a786a], ax
mov eax, ecx
mov word [0x11a786c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a7864]
add eax, 2
mov word [eax + 0x11a8032], dx
cmp eax, 0xa
jb 0x112c271
mov eax, 0x11a8034
ret

Function at 0x112c28f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a869c], 1
mov ecx, 0x8718
jne 0x112c2e2
or dword [0x11a869c], 1
lea eax, [ecx + 0x4b]
mov word [0x11a7870], ax
add eax, 5
mov word [0x11a7872], ax
lea eax, [ecx + 0x66]
mov word [0x11a7874], ax
add eax, 0xffffffad
mov word [0x11a7876], ax
lea eax, [ecx + 0x12]
mov word [0x11a7878], ax
add eax, 0x3b
mov word [0x11a787a], ax
mov eax, ecx
mov word [0x11a787c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a7870]
add eax, 2
mov word [eax + 0x11a803e], dx
cmp eax, 0xe
jb 0x112c2e4
mov eax, 0x11a8040
ret
Function at 0x112c3dc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8698], 1
mov ecx, 0x8718
jne 0x112c5f9
or dword [0x11a8698], 1
lea eax, [ecx + 0x10]
mov word [0x11a7888], ax
inc eax
mov word [0x11a788a], ax
lea eax, [ecx + 0x12]
mov word [0x11a788c], ax
inc eax
mov word [0x11a788e], ax
lea eax, [ecx + 0x14]
mov word [0x11a7890], ax
inc eax
mov word [0x11a7892], ax
lea eax, [ecx + 0x16]
mov word [0x11a7894], ax
inc eax
mov word [0x11a7896], ax
lea eax, [ecx + 8]
mov word [0x11a7898], ax
inc eax
mov word [0x11a789a], ax
lea eax, [ecx + 0x41]
mov word [0x11a789c], ax
inc eax
mov word [0x11a789e], ax
lea eax, [ecx + 0x43]
mov word [0x11a78a0], ax
inc eax
mov word [0x11a78a2], ax
lea eax, [ecx + 0x45]
mov word [0x11a78a4], ax
inc eax
mov word [0x11a78a6], ax
lea eax, [ecx + 0x47]
mov word [0x11a78a8], ax
add eax, 0xfffffff1
mov word [0x11a78aa], ax
lea eax, [ecx + 0x39]
mov word [0x11a78ac], ax
inc eax
mov word [0x11a78ae], ax
lea eax, [ecx + 0x3b]
mov word [0x11a78b0], ax
inc eax
mov word [0x11a78b2], ax
lea eax, [ecx + 0x3d]
mov word [0x11a78b4], ax
inc eax
mov word [0x11a78b6], ax
lea eax, [ecx + 0x3f]
mov word [0x11a78b8], ax
add eax, 0xfffffff1
mov word [0x11a78ba], ax
lea eax, [ecx + 0x31]
mov word [0x11a78bc], ax
inc eax
mov word [0x11a78be], ax
lea eax, [ecx + 0x33]
mov word [0x11a78c0], ax
inc eax
mov word [0x11a78c2], ax
lea eax, [ecx + 0x35]
mov word [0x11a78c4], ax
inc eax
mov word [0x11a78c6], ax
lea eax, [ecx + 0x37]
mov word [0x11a78c8], ax
add eax, 0xfffffff1
mov word [0x11a78ca], ax
lea eax, [ecx + 0x29]
mov word [0x11a78cc], ax
inc eax
mov word [0x11a78ce], ax
lea eax, [ecx + 0x61]
mov word [0x11a78d0], ax
inc eax
mov word [0x11a78d2], ax
lea eax, [ecx + 0x63]
mov word [0x11a78d4], ax
inc eax
mov word [0x11a78d6], ax
lea eax, [ecx + 0x65]
mov word [0x11a78d8], ax
inc eax
mov word [0x11a78da], ax
lea eax, [ecx + 0x67]
mov word [0x11a78dc], ax
add eax, 0xfffffff1
mov word [0x11a78de], ax
lea eax, [ecx + 0x59]
mov word [0x11a78e0], ax
inc eax
mov word [0x11a78e2], ax
lea eax, [ecx + 0x5b]
mov word [0x11a78e4], ax
inc eax
mov word [0x11a78e6], ax
lea eax, [ecx + 0x5d]
mov word [0x11a78e8], ax
inc eax
mov word [0x11a78ea], ax
lea eax, [ecx + 0x5f]
mov word [0x11a78ec], ax
add eax, 0xfffffff1
mov word [0x11a78ee], ax
lea eax, [ecx + 0x51]
mov word [0x11a78f0], ax
inc eax
mov word [0x11a78f2], ax
lea eax, [ecx + 0x53]
mov word [0x11a78f4], ax
inc eax
mov word [0x11a78f6], ax
lea eax, [ecx + 0x55]
mov word [0x11a78f8], ax
inc eax
mov word [0x11a78fa], ax
lea eax, [ecx + 0x57]
mov word [0x11a78fc], ax
add eax, 0xfffffff1
mov word [0x11a78fe], ax
lea eax, [ecx + 0x49]
mov word [0x11a7900], ax
inc eax
mov word [0x11a7902], ax
mov eax, ecx
mov word [0x11a7904], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a7888]
add eax, 2
mov word [eax + 0x11a804e], dx
cmp eax, 0x7e
jb 0x112c5fb
mov eax, 0x11a8050
ret
Function at 0x112cccb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8694], 1
jne 0x112cd32
or dword [0x11a8694], 1
mov dword [0x11a7908], 0x62476275
mov dword [0x11a790c], 0x6a476871
mov dword [0x11a7910], 0x7d7c797d
mov dword [0x11a7914], 0x7671476a
mov dword [0x11a7918], 0x7e476c71
mov dword [0x11a791c], 0x307d7471
mov dword [0x11a7920], 0x797e3831
mov dword [0x11a7924], 0x7c7d7471
mov byte [0x11a7928], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a7908]
xor cl, 0x18
mov byte [eax + 0x11a80d0], cl
inc eax
cmp eax, 0x21
jb 0x112cd34
mov eax, 0x11a80d0
ret

Function at 0x112cd4f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8690], 1
jne 0x112cdb6
or dword [0x11a8690], 1
mov dword [0x11a792c], 0x62476275
mov dword [0x11a7930], 0x6a476871
mov dword [0x11a7934], 0x7d7c797d
mov dword [0x11a7938], 0x717e476a
mov dword [0x11a793c], 0x6b477d74
mov dword [0x11a7940], 0x306c796c
mov dword [0x11a7944], 0x797e3831
mov dword [0x11a7948], 0x7c7d7471
mov byte [0x11a794c], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a792c]
xor cl, 0x18
mov byte [eax + 0x11a80f4], cl
inc eax
cmp eax, 0x21
jb 0x112cdb8
mov eax, 0x11a80f4
ret

Function at 0x112cdd3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a868c], 1
jne 0x112ce51
or dword [0x11a868c], 1
mov dword [0x11a7950], 0x62476275
mov dword [0x11a7954], 0x6a476871
mov dword [0x11a7958], 0x7d7c797d
mov dword [0x11a795c], 0x607d476a
mov dword [0x11a7960], 0x7b796a6c
mov dword [0x11a7964], 0x717e476c
mov dword [0x11a7968], 0x6c477d74
mov dword [0x11a796c], 0x7d704777
mov dword [0x11a7970], 0x31306879
mov dword [0x11a7974], 0x71797e38
mov dword [0x11a7978], 0x187c7d74
xor eax, eax
mov cl, byte [eax + 0x11a7950]
xor cl, 0x18
mov byte [eax + 0x11a8118], cl
inc eax
cmp eax, 0x2c
jb 0x112ce53
mov eax, 0x11a8118
ret

Function at 0x112ce6e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8688], 1
jne 0x112ced8
or dword [0x11a8688], 1
mov dword [0x11a797c], 0x7471795e
mov dword [0x11a7980], 0x6c387c7d
mov dword [0x11a7984], 0x6a7b3877
mov dword [0x11a7988], 0x7d6c797d
mov dword [0x11a798c], 0x6b7d7c38
mov dword [0x11a7990], 0x7976716c
mov dword [0x11a7994], 0x7677716c
mov dword [0x11a7998], 0x6c796838
mov dword [0x11a799c], 0x18382270
xor eax, eax
mov cl, byte [eax + 0x11a797c]
xor cl, 0x18
mov byte [eax + 0x11a8144], cl
inc eax
cmp eax, 0x24
jb 0x112ceda
mov eax, 0x11a8144
ret

Function at 0x112cef5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8684], 1
jne 0x112cf5b
or dword [0x11a8684], 1
mov dword [0x11a79a0], 0x7471795e
mov dword [0x11a79a4], 0x6c387c7d
mov dword [0x11a79a8], 0x6a7b3877
mov dword [0x11a79ac], 0x7d6c797d
mov dword [0x11a79b0], 0x6c6d7738
mov dword [0x11a79b4], 0x386c6d68
mov dword [0x11a79b8], 0x7d74717e
mov word [0x11a79bc], 0x3822
mov byte [0x11a79be], 0x18
xor eax, eax
mov cl, byte [eax + 0x11a79a0]
xor cl, 0x18
mov byte [eax + 0x11a8168], cl
inc eax
cmp eax, 0x1f
jb 0x112cf5d
mov eax, 0x11a8168
ret