joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110836a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c34], 1
jne 0x11083b2
or dword [0x11a8c34], 1
mov dword [0x11a3eac], 0x29687c45
mov dword [0x11a3eb0], 0x66646c64
mov dword [0x11a3eb4], 0x6c29707b
mov dword [0x11a3eb8], 0x7b667b7b
mov word [0x11a3ebc], 0x2933
mov byte [0x11a3ebe], 9
xor eax, eax
mov cl, byte [eax + 0x11a3eac]
xor cl, 9
mov byte [eax + 0x11a449c], cl
inc eax
cmp eax, 0x13
jb 0x11083b4
mov eax, 0x11a449c
ret

Function at 0x11083cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c30], 1
jne 0x1108436
or dword [0x11a8c30], 1
mov dword [0x11a3ec0], 0x29687c45
mov dword [0x11a3ec4], 0x667b7b6c
mov dword [0x11a3ec8], 0x6760297b
mov dword [0x11a3ecc], 0x6c6d607a
mov dword [0x11a3ed0], 0x7b7b6c29
mov dword [0x11a3ed4], 0x61297b66
mov dword [0x11a3ed8], 0x656d6768
mov dword [0x11a3edc], 0x29337b6c
mov byte [0x11a3ee0], 9
xor eax, eax
mov cl, byte [eax + 0x11a3ec0]
xor cl, 9
mov byte [eax + 0x11a44b0], cl
inc eax
cmp eax, 0x21
jb 0x1108438
mov eax, 0x11a44b0
ret

Function at 0x1108453
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c2c], 1
jne 0x11084af
or dword [0x11a8c2c], 1
mov dword [0x11a3ee4], 0x6762675c
mov dword [0x11a3ee8], 0x29677e66
mov dword [0x11a3eec], 0x667b7b6c
mov dword [0x11a3ef0], 0x6760297b
mov dword [0x11a3ef4], 0x687c6529
mov dword [0x11a3ef8], 0x686a7956
mov word [0x11a3efc], 0x6565
mov byte [0x11a3efe], 9
xor eax, eax
mov cl, byte [eax + 0x11a3ee4]
xor cl, 9
mov byte [eax + 0x11a44d4], cl
inc eax
cmp eax, 0x1b
jb 0x11084b1
mov eax, 0x11a44d4
ret

Function at 0x11086ed
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c28], 1
jne 0x1108736
or dword [0x11a8c28], 1
mov dword [0x11a3f00], 0x6c7a684b
mov dword [0x11a3f04], 0x6d293d3f
mov dword [0x11a3f08], 0x6d666a6c
mov dword [0x11a3f0c], 0x686f296c
mov dword [0x11a3f10], 0x6d6c6560
mov byte [0x11a3f14], 9
xor eax, eax
mov cl, byte [eax + 0x11a3f00]
xor cl, 9
mov byte [eax + 0x11a44f0], cl
inc eax
cmp eax, 0x15
jb 0x1108738
mov eax, 0x11a44f0
ret
Function at 0x1108753
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1174a1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0112c73c
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0112ab2c
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.01104e3d
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.0110acc6
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x11087e0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0112f744
add esp, 0x10
test al, al
jne 0x1108825
call fcn.0110889c
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.0114ba25
push 0x11944a8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.01155926
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.0110acc6
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x1108865
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x1108844
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.0110a131
lea esi, [esp + 0x20]
call fcn.01104bf7
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.01104cff
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x110889c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c24], 1
jne 0x11088e5
or dword [0x11a8c24], 1
mov dword [0x11a3f18], 0x6c7a684b
mov dword [0x11a3f1c], 0x6d293d3f
mov dword [0x11a3f20], 0x6d666a6c
mov dword [0x11a3f24], 0x686f296c
mov dword [0x11a3f28], 0x6d6c6560
mov byte [0x11a3f2c], 9
xor eax, eax
mov cl, byte [eax + 0x11a3f18]
xor cl, 9
mov byte [eax + 0x11a4508], cl
inc eax
cmp eax, 0x15
jb 0x11088e7
mov eax, 0x11a4508
ret

Function at 0x1108fda
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c20], 1
jne 0x110902f
or dword [0x11a8c20], 1
mov dword [0x11a3f30], 0x657c664a
mov dword [0x11a3f34], 0x6667296d
mov dword [0x11a3f38], 0x7966297d
mov dword [0x11a3f3c], 0x6a29676c
mov dword [0x11a3f40], 0x617a687b
mov dword [0x11a3f44], 0x647c6d29
mov word [0x11a3f48], 0x979
xor eax, eax
mov cl, byte [eax + 0x11a3f30]
xor cl, 9
mov byte [eax + 0x11a4520], cl
inc eax
cmp eax, 0x1a
jb 0x1109031
mov eax, 0x11a4520
ret
Function at 0x110904c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c18], 1
jne 0x110906f
or dword [0x11a8c18], 1
mov dword [0x11a3f50], 0x6e666526
mov word [0x11a3f54], 0x926
xor eax, eax
mov cl, byte [eax + 0x11a3f50]
xor cl, 9
mov byte [eax + 0x11a4540], cl
inc eax
cmp eax, 6
jb 0x1109071
mov eax, 0x11a4540
ret

Function at 0x110908c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c14], 1
jne 0x1109107
or dword [0x11a8c14], 1
mov dword [0x11a3f58], 0x797d7d61
mov dword [0x11a3f5c], 0x68262633
mov dword [0x11a3f60], 0x70656867
mov dword [0x11a3f64], 0x7a6a607d
mov dword [0x11a3f68], 0x7d6c6e27
mov dword [0x11a3f6c], 0x677e666d
mov dword [0x11a3f70], 0x7d7a6c7d
mov dword [0x11a3f74], 0x64666a27
mov dword [0x11a3f78], 0x263b7f26
mov dword [0x11a3f7c], 0x266e6665
mov byte [0x11a3f80], 9
xor eax, eax
mov cl, byte [eax + 0x11a3f58]
xor cl, 9
mov byte [eax + 0x11a4548], cl
inc eax
cmp eax, 0x29
jb 0x1109109
mov eax, 0x11a4548
ret

Function at 0x1109124
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c10], 1
jne 0x110914f
or dword [0x11a8c10], 1
mov dword [0x11a3f84], 0x7a2f346a
mov dword [0x11a3f88], 0x347d2f34
mov byte [0x11a3f8c], 9
xor eax, eax
mov cl, byte [eax + 0x11a3f84]
xor cl, 9
mov byte [eax + 0x11a4574], cl
inc eax
cmp eax, 9
jb 0x1109151
mov eax, 0x11a4574
ret

Function at 0x110916c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c00], 1
jne 0x11091f4
or dword [0x11a8c00], 1
mov dword [0x11a3fa0], 0x7d67664a
mov dword [0x11a3fa4], 0x247d676c
mov dword [0x11a3fa8], 0x6c79705d
mov dword [0x11a3fac], 0x79682933
mov dword [0x11a3fb0], 0x6a606579
mov dword [0x11a3fb4], 0x66607d68
mov dword [0x11a3fb8], 0x24712667
mov dword [0x11a3fbc], 0x247e7e7e
mov dword [0x11a3fc0], 0x647b666f
mov dword [0x11a3fc4], 0x657b7c24
mov dword [0x11a3fc8], 0x666a676c
mov dword [0x11a3fcc], 0x96d6c6d
xor eax, eax
mov cl, byte [eax + 0x11a3fa0]
xor cl, 9
mov byte [eax + 0x11a4590], cl
inc eax
cmp eax, 0x30
jb 0x11091f6
mov eax, 0x11a4590
ret

Function at 0x1109211
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bfc], 1
jne 0x110923c
or dword [0x11a8bfc], 1
mov dword [0x11a3fd0], 0x5d5a4659
mov dword [0x11a3fd4], 0x29667d29
mov byte [0x11a3fd8], 9
xor eax, eax
mov cl, byte [eax + 0x11a3fd0]
xor cl, 9
mov byte [eax + 0x11a45c0], cl
inc eax
cmp eax, 9
jb 0x110923e
mov eax, 0x11a45c0
ret

Function at 0x1109259
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bf8], 1
jne 0x11092a2
or dword [0x11a8bf8], 1
mov dword [0x11a3fdc], 0x60686f29
mov dword [0x11a3fe0], 0x296d6c65
mov dword [0x11a3fe4], 0x617d607e
mov dword [0x11a3fe8], 0x687d7a29
mov dword [0x11a3fec], 0x297a7c7d
mov byte [0x11a3ff0], 9
xor eax, eax
mov cl, byte [eax + 0x11a3fdc]
xor cl, 9
mov byte [eax + 0x11a45cc], cl
inc eax
cmp eax, 0x15
jb 0x11092a4
mov eax, 0x11a45cc
ret
Function at 0x11092d9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x117329a
call fcn.01171cf8
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x110948a
cmp dword [ebp + 0x10], ebx
je 0x110948a
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.0110a627
push eax
push 0x1192c70
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.01105493
push 0x1192c6c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.011054c9
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.01104e3d
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.01104e3d
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x11093e5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.0110a627
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.0110a649
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1109399
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0110e0c4
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.01104e3d
inc bl
jne 0x1109451
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.01104e3d
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x1109360
test byte [0x11a8bf0], 1
jne 0x1109412
or dword [0x11a8bf0], 1
mov dword [0x11a4000], 0x297d6647
mov dword [0x11a4004], 0x677c666f
mov word [0x11a4008], 0x96d
xor eax, eax
mov cl, byte [eax + 0x11a4000]
xor cl, 9
mov byte [eax + 0x11a45f0], cl
inc eax
cmp eax, 0xa
jb 0x1109414
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x11a45f0
call fcn.0114ba25
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x11944a8
lea eax, [ebp - 0x44]
push eax
call fcn.01155926
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.0110a649
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.01104e3d
push 1
lea esi, [ebp - 0x2c]
call fcn.01104e3d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.011094af
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.0114ba25
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x11944a8
lea eax, [ebp - 0x38]
jmp 0x110944b

Function at 0x11094af
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bf4], 1
jne 0x11094dc
or dword [0x11a8bf4], 1
mov dword [0x11a3ff4], 0x297d6647
mov dword [0x11a3ff8], 0x677c666f
mov word [0x11a3ffc], 0x96d
xor eax, eax
mov cl, byte [eax + 0x11a3ff4]
xor cl, 9
mov byte [eax + 0x11a45e4], cl
inc eax
cmp eax, 0xa
jb 0x11094de
mov eax, 0x11a45e4
ret
Function at 0x1109c93
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bec], 1
mov ecx, 0x8709
jne 0x1109d1d
or dword [0x11a8bec], 1
lea eax, [ecx + 0x61]
mov word [0x11a400c], ax
add eax, 0x11
mov edx, eax
mov word [0x11a400e], dx
lea edx, [ecx + 0x5f]
mov word [0x11a4010], dx
add edx, 0x12
mov word [0x11a4012], dx
lea edx, [ecx + 0x58]
mov word [0x11a4014], dx
add edx, 0xfffffff5
mov word [0x11a4016], dx
mov edx, eax
mov word [0x11a4018], dx
lea edx, [ecx + 0x63]
lea eax, [ecx + 0x74]
mov word [0x11a401a], dx
mov word [0x11a4022], ax
add edx, 0xd
mov eax, ecx
mov word [0x11a401c], dx
mov dword [0x11a401e], 0x877b8766
mov word [0x11a4024], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a400c]
add eax, 2
mov word [eax + 0x11a45fa], dx
cmp eax, 0x1a
jb 0x1109d1f
mov eax, 0x11a45fc
ret

Function at 0x1109d3d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8be8], 1
jne 0x1109d68
or dword [0x11a8be8], 1
mov dword [0x11a4028], 0x677b6c62
mov dword [0x11a402c], 0x3b3a656c
mov byte [0x11a4030], 9
xor eax, eax
mov cl, byte [eax + 0x11a4028]
xor cl, 9
mov byte [eax + 0x11a4618], cl
inc eax
cmp eax, 9
jb 0x1109d6a
mov eax, 0x11a4618
ret

Function at 0x1109d85
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8be4], 1
jne 0x1109dee
or dword [0x11a8be4], 1
mov dword [0x11a4034], 0x597d6c5a
mov dword [0x11a4038], 0x6c6a667b
mov dword [0x11a403c], 0x7a5c7a7a
mov dword [0x11a4040], 0x66447b6c
mov dword [0x11a4044], 0x714c6c6d
mov dword [0x11a4048], 0x7d796c6a
mov dword [0x11a404c], 0x59676660
mov dword [0x11a4050], 0x6a606566
mov word [0x11a4054], 0x970
xor eax, eax
mov cl, byte [eax + 0x11a4034]
xor cl, 9
mov byte [eax + 0x11a4624], cl
inc eax
cmp eax, 0x22
jb 0x1109df0
mov eax, 0x11a4624
ret

Function at 0x1109e0b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8be0], 1
jne 0x1109e74
or dword [0x11a8be0], 1
mov dword [0x11a4058], 0x597d6c4e
mov dword [0x11a405c], 0x6c6a667b
mov dword [0x11a4060], 0x7a5c7a7a
mov dword [0x11a4064], 0x66447b6c
mov dword [0x11a4068], 0x714c6c6d
mov dword [0x11a406c], 0x7d796c6a
mov dword [0x11a4070], 0x59676660
mov dword [0x11a4074], 0x6a606566
mov word [0x11a4078], 0x970
xor eax, eax
mov cl, byte [eax + 0x11a4058]
xor cl, 9
mov byte [eax + 0x11a4648], cl
inc eax
cmp eax, 0x22
jb 0x1109e76
mov eax, 0x11a4648
ret

Function at 0x1109e91
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bdc], 1
jne 0x1109ee7
or dword [0x11a8bdc], 1
mov dword [0x11a407c], 0x296c6546
mov dword [0x11a4080], 0x7d606760
mov dword [0x11a4084], 0x60656860
mov dword [0x11a4088], 0x607d6873
mov dword [0x11a408c], 0x6f296766
mov dword [0x11a4090], 0x6c656068
mov dword [0x11a4094], 0x929336d
xor eax, eax
mov cl, byte [eax + 0x11a407c]
xor cl, 9
mov byte [eax + 0x11a466c], cl
inc eax
cmp eax, 0x1c
jb 0x1109ee9
mov eax, 0x11a466c
ret
Function at 0x1109f04
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bd8], 1
mov ecx, 0x8709
jne 0x1109f33
or dword [0x11a8bd8], 1
lea eax, [ecx + 0x5f]
mov word [0x11a4098], ax
add eax, 0xffffffd3
mov word [0x11a409a], ax
mov eax, ecx
mov word [0x11a409c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a4098]
add eax, 2
mov word [eax + 0x11a4686], dx
cmp eax, 6
jb 0x1109f35
mov eax, 0x11a4688
ret

Function at 0x1109f53
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bd0], 1
jne 0x1109fc3
or dword [0x11a8bd0], 1
mov dword [0x11a40a8], 0x6560684f
mov dword [0x11a40ac], 0x7d296d6c
mov dword [0x11a40b0], 0x67602966
mov dword [0x11a40b4], 0x68607d60
mov dword [0x11a40b8], 0x6c736065
mov dword [0x11a40bc], 0x7f676c29
mov dword [0x11a40c0], 0x67667b60
mov dword [0x11a40c4], 0x7d676c64
mov word [0x11a40c8], 0x2933
mov byte [0x11a40ca], 9
xor eax, eax
mov cl, byte [eax + 0x11a40a8]
xor cl, 9
mov byte [eax + 0x11a4698], cl
inc eax
cmp eax, 0x23
jb 0x1109fc5
mov eax, 0x11a4698
ret

Function at 0x1109fe0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bc8], 1
jne 0x110a02b
or dword [0x11a8bc8], 1
mov dword [0x11a40d4], 0x6861675c
mov dword [0x11a40d8], 0x6c656d67
mov dword [0x11a40dc], 0x716c296d
mov dword [0x11a40e0], 0x7d796c6a
mov dword [0x11a40e4], 0x33676660
mov word [0x11a40e8], 0x929
xor eax, eax
mov cl, byte [eax + 0x11a40d4]
xor cl, 9
mov byte [eax + 0x11a46c4], cl
inc eax
cmp eax, 0x16
jb 0x110a02d
mov eax, 0x11a46c4
ret

Function at 0x110a048
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bc4], 1
jne 0x110a09b
or dword [0x11a8bc4], 1
mov dword [0x11a40ec], 0x6861675c
mov dword [0x11a40f0], 0x6c656d67
mov dword [0x11a40f4], 0x716c296d
mov dword [0x11a40f8], 0x7d796c6a
mov dword [0x11a40fc], 0x33676660
mov dword [0x11a4100], 0x37a2c29
mov byte [0x11a4104], 9
xor eax, eax
mov cl, byte [eax + 0x11a40ec]
xor cl, 9
mov byte [eax + 0x11a46dc], cl
inc eax
cmp eax, 0x19
jb 0x110a09d
mov eax, 0x11a46dc
ret

Function at 0x110a0b8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bc0], 1
jne 0x110a0f0
or dword [0x11a8bc0], 1
mov dword [0x11a4108], 0x6b7c7d5a
mov dword [0x11a410c], 0x60716c29
mov dword [0x11a4110], 0x2c21297d
mov dword [0x11a4114], 0x903206d
xor eax, eax
mov cl, byte [eax + 0x11a4108]
xor cl, 9
mov byte [eax + 0x11a46f8], cl
inc eax
cmp eax, 0x10
jb 0x110a0f2
mov eax, 0x11a46f8
ret
Function at 0x110bae8
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1172a99
call fcn.01171cf8
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x110bbcc
cmp byte [edi + 0x49], bl
je 0x110bbcc
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x110bb1f
xor al, al
jmp 0x110bbce
push esi
lea esi, [ebp - 0x2c]
call fcn.0110b5e1
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x110bb6f
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x110bb74
dec eax
je 0x110bb78
dec eax
dec eax
je 0x110bbc8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.01104cff
mov al, bl
pop esi
jmp 0x110bbce
mov edx, dword [ebp - 0x2c]
jmp 0x110bb39
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x110bb84
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x110bbaa
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x110bb97
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0114d7fe
add esp, 0x10
cmp esi, eax
jne 0x110bb5c
cmp byte [edi + 0x49], 0
je 0x110bbc8
test esi, esi
jne 0x110bb2b
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0110b6ba
jmp 0x110bb2b
mov bl, 1
jmp 0x110bb5e
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x11103d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bbc], 1
jne 0x1110446
or dword [0x11a8bbc], 1
mov dword [0x11a4718], 0x667f6549
mov dword [0x11a471c], 0x65642a6e
mov dword [0x11a4720], 0x6f6d2a7e
mov dword [0x11a4724], 0x636e2a7e
mov dword [0x11a4728], 0x6e637a79
mov dword [0x11a472c], 0x2a6c652a
mov dword [0x11a4730], 0x627e6f67
mov dword [0x11a4734], 0x2d2a6e65
mov dword [0x11a4738], 0x66666b69
mov dword [0x11a473c], 0xa2a302d
xor eax, eax
mov cl, byte [eax + 0x11a4718]
xor cl, 0xa
mov byte [eax + 0x11a485c], cl
inc eax
cmp eax, 0x28
jb 0x1110448
mov eax, 0x11a485c
ret

Function at 0x1110463
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bb8], 1
jne 0x11104ca
or dword [0x11a8bb8], 1
mov dword [0x11a4740], 0x66636b4c
mov dword [0x11a4744], 0x7e2a6e6f
mov dword [0x11a4748], 0x64632a65
mov dword [0x11a474c], 0x6f61657c
mov dword [0x11a4750], 0x7e6f672a
mov dword [0x11a4754], 0x2a6e6562
mov dword [0x11a4758], 0x666b692d
mov dword [0x11a475c], 0x2a302d66
mov byte [0x11a4760], 0xa
xor eax, eax
mov cl, byte [eax + 0x11a4740]
xor cl, 0xa
mov byte [eax + 0x11a4884], cl
inc eax
cmp eax, 0x21
jb 0x11104cc
mov eax, 0x11a4884
ret
Function at 0x11104e7
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x11a8bb4], 1
jne 0x1110549
or dword [0x11a8bb4], 1
mov dword [0x11a4764], 0x65785a00
mov dword [0x11a4768], 0x66686b68
mov dword [0x11a476c], 0x7f6e2a73
mov dword [0x11a4770], 0x657e2a6f
mov dword [0x11a4774], 0x7869792a
mov dword [0x11a4778], 0x2a7e7a63
mov dword [0x11a477c], 0x6578786f
mov dword [0x11a4780], 0xa2a3078
mov cl, byte [eax + 0x11a4764]
xor cl, 0xa
mov byte [eax + 0x11a48a8], cl
inc eax
cmp eax, 0x20
jb 0x1110549
mov eax, 0x11a48a8
ret

Function at 0x1110b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x1110c69
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x11a8bb0], 1
jne 0x1110b86
or dword [0x11a8bb0], 1
mov eax, 0x8779
mov word [0x11a4784], ax
add eax, 0xfffffff6
mov word [0x11a4786], ax
mov eax, 0x8764
mov word [0x11a4788], ax
add eax, 0xa
mov word [0x11a478a], ax
mov eax, 0x870a
mov word [0x11a478c], ax
xor eax, eax
mov ecx, 0x870a
xor cx, word [eax + 0x11a4784]
add eax, 2
mov word [eax + 0x11a48c6], cx
cmp eax, 0xa
jb 0x1110b88
mov eax, dword [ebx + edi]
mov ecx, 0x11a48c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1110bcf
test dx, dx
je 0x1110bcb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1110bcf
add eax, esi
add ecx, esi
test dx, dx
jne 0x1110bab
xor eax, eax
jmp 0x1110bd4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1110be0
mov dword [edi], 0x385
jmp 0x1110c58
call fcn.01110c79
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1110c0c
test dx, dx
je 0x1110c08
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1110c0c
add ecx, esi
add eax, esi
test dx, dx
jne 0x1110be8
xor eax, eax
jmp 0x1110c11
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1110c1d
mov dword [edi], 0x386
jmp 0x1110c58
call fcn.01110d4c
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1110c49
test dx, dx
je 0x1110c45
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1110c49
add ecx, esi
add eax, esi
test dx, dx
jne 0x1110c25
xor eax, eax
jmp 0x1110c4e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1110c72
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x1110b43
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x1110c6b
Function at 0x1110c79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8bac], 1
jne 0x1110d29
or dword [0x11a8bac], 1
mov eax, 0x876b
mov word [0x11a4790], ax
add eax, 3
mov ecx, eax
mov word [0x11a4794], ax
mov eax, 0x874f
mov word [0x11a4796], ax
add eax, 0x2d
mov word [0x11a4798], ax
mov eax, 0x876f
mov word [0x11a4792], cx
mov ecx, eax
lea edx, [eax - 0xb]
mov word [0x11a479a], cx
mov ecx, edx
push edi
mov word [0x11a479c], cx
add ecx, 0x1a
mov edi, ecx
mov word [0x11a479e], di
lea edi, [eax - 0x29]
mov word [0x11a47a0], di
add edi, 0x1d
mov ecx, eax
add eax, 9
mov word [0x11a47ae], ax
lea eax, [ecx - 0x65]
mov word [0x11a47a2], di
mov dword [0x11a47a4], 0x877e8779
mov word [0x11a47a8], cx
mov dword [0x11a47aa], 0x876f8764
mov word [0x11a47b0], ax
pop edi
xor eax, eax
mov ecx, 0x870a
xor cx, word [eax + 0x11a4790]
add eax, 2
mov word [eax + 0x11a48d2], cx
cmp eax, 0x22
jb 0x1110d2b
mov eax, 0x11a48d4
ret

Function at 0x1110d4c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8ba8], 1
mov ecx, 0x870a
jne 0x1110da6
or dword [0x11a8ba8], 1
lea eax, [ecx + 0x72]
mov word [0x11a47b4], ax
add eax, 0xfffffff3
mov word [0x11a47b6], ax
lea eax, [ecx + 0x6e]
mov word [0x11a47b8], ax
inc eax
mov word [0x11a47ba], ax
lea eax, [ecx + 0x59]
mov word [0x11a47bc], ax
add eax, 2
mov word [0x11a47be], ax
lea eax, [ecx + 0x5a]
mov word [0x11a47c0], ax
mov eax, ecx
mov word [0x11a47c2], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11a47b4]
add eax, 2
mov word [eax + 0x11a48f6], dx
cmp eax, 0x10
jb 0x1110da8
mov eax, 0x11a48f8
ret

Function at 0x1111765
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8ba4], 1
mov edx, 0x870a
jne 0x11117c8
or dword [0x11a8ba4], 1
lea ecx, [edx + 0x65]
mov eax, ecx
mov word [0x11a47c4], ax
add eax, 9
push esi
mov esi, eax
lea eax, [edx + 0x3c]
mov word [0x11a47ce], ax
add eax, 0x1d
mov word [0x11a47d0], ax
mov eax, edx
mov word [0x11a47c6], si
mov word [0x11a47c8], si
mov dword [0x11a47ca], 0x87788765
mov dword [0x11a47d2], 0x876f8764
mov word [0x11a47d6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x11a47c4]
add eax, 2
mov word [eax + 0x11a4906], cx
cmp eax, 0x14
jb 0x11117ca
mov eax, 0x11a4908
ret

Function at 0x11117e8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8ba0], 1
jne 0x1111884
or dword [0x11a8ba0], 1
mov edx, 0x876f
mov eax, edx
mov word [0x11a47d8], ax
add eax, 9
mov ecx, eax
mov word [0x11a47da], cx
mov word [0x11a47dc], cx
lea ecx, [edx - 0xa]
mov word [0x11a47de], cx
mov ecx, eax
mov word [0x11a47e0], cx
lea ecx, [edx - 0x26]
mov word [0x11a47e2], cx
add ecx, 0x19
mov word [0x11a47e4], cx
lea ecx, [edx - 4]
push edi
mov edi, ecx
mov word [0x11a47e6], di
mov edi, eax
mov word [0x11a47ea], cx
mov word [0x11a47f2], ax
add ecx, 0xfffffffe
lea eax, [edx - 0x65]
mov word [0x11a47e8], di
mov word [0x11a47ec], cx
mov dword [0x11a47ee], 0x876f877e
mov word [0x11a47f4], ax
pop edi
xor eax, eax
mov ecx, 0x870a
xor cx, word [eax + 0x11a47d8]
add eax, 2
mov word [eax + 0x11a491a], cx
cmp eax, 0x1e
jb 0x1111886
mov eax, 0x11a491c
ret