joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1106111
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x117334f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x11a8cdc], 1
push esi
jne 0x1106164
or dword [0x11a8cdc], 1
mov dword [0x11a3784], 0x646c7c66
mov dword [0x11a3788], 0x646c2664
mov word [0x11a378c], 0x864
xor eax, eax
mov cl, byte [eax + 0x11a3784]
xor cl, 8
mov byte [eax + 0x11a3984], cl
inc eax
cmp eax, 0xa
jb 0x1106166
push 0x11a3984
call dword [0x117a0cc]
mov esi, eax
test esi, esi
jne 0x11061d8
call dword [0x117a0a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0112a8c7
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.0110631f
push eax
lea eax, [esp + 0x28]
push eax
call fcn.01106b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.01105c58
push 0x11944a8
mov eax, esi
push eax
call fcn.01155926
call fcn.01106385
push eax
push esi
call dword [0x117a0c8]
test eax, eax
jne 0x1106235
call dword [0x117a0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0112a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.011063f7
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01106b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.01105c58
push 0x11944a8
mov eax, esi
jmp 0x11061d2
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x11062bd
cmp dword [esp + 4], 0x18
jne 0x11062bd
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x117a0c4]
test eax, eax
jne 0x110630c
call dword [0x117a0a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0112a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.01106537
push eax
lea eax, [esp + 0x94]
push eax
call fcn.01106b70
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.01105c58
push 0x11944a8
mov eax, esi
jmp 0x11061d2
call dword [0x117a0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0112a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.011064aa
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01106b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.01105c58
push 0x11944a8
mov eax, esi
jmp 0x11061d2
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x110631f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cd8], 1
jne 0x1106368
or dword [0x11a8cd8], 1
mov dword [0x11a3790], 0x6c696744
mov dword [0x11a3794], 0x7a6a6144
mov dword [0x11a3798], 0x28717a69
mov dword [0x11a379c], 0x6461696e
mov dword [0x11a37a0], 0x28326c6d
mov byte [0x11a37a4], 8
xor eax, eax
mov cl, byte [eax + 0x11a3790]
xor cl, 8
mov byte [eax + 0x11a3990], cl
inc eax
cmp eax, 0x15
jb 0x110636a
mov eax, 0x11a3990
ret
Function at 0x1106385
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cd4], 1
jne 0x11063da
or dword [0x11a8cd4], 1
mov dword [0x11a37a8], 0x7d597c46
mov dword [0x11a37ac], 0x41717a6d
mov dword [0x11a37b0], 0x7a676e66
mov dword [0x11a37b4], 0x617c6965
mov dword [0x11a37b8], 0x7a586667
mov dword [0x11a37bc], 0x7b6d6b67
mov word [0x11a37c0], 0x87b
xor eax, eax
mov cl, byte [eax + 0x11a37a8]
xor cl, 8
mov byte [eax + 0x11a39a8], cl
inc eax
cmp eax, 0x1a
jb 0x11063dc
mov eax, 0x11a39a8
ret

Function at 0x11063f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cd0], 1
jne 0x110648d
or dword [0x11a8cd0], 1
mov dword [0x11a37c4], 0x587c6d4f
mov dword [0x11a37c8], 0x496b677a
mov dword [0x11a37cc], 0x6d7a6c6c
mov dword [0x11a37d0], 0x6e287b7b
mov dword [0x11a37d4], 0x6d646169
mov dword [0x11a37d8], 0x4620286c
mov dword [0x11a37dc], 0x6d7d597c
mov dword [0x11a37e0], 0x6641717a
mov dword [0x11a37e4], 0x657a676e
mov dword [0x11a37e8], 0x67617c69
mov dword [0x11a37ec], 0x677a5866
mov dword [0x11a37f0], 0x7b7b6d6b
mov dword [0x11a37f4], 0x8283221
xor eax, eax
mov cl, byte [eax + 0x11a37c4]
xor cl, 8
mov byte [eax + 0x11a39c4], cl
inc eax
cmp eax, 0x34
jb 0x110648f
mov eax, 0x11a39c4
ret

Function at 0x11064aa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8ccc], 1
jne 0x110651a
or dword [0x11a8ccc], 1
mov dword [0x11a37f8], 0x7d597c46
mov dword [0x11a37fc], 0x41717a6d
mov dword [0x11a3800], 0x7a676e66
mov dword [0x11a3804], 0x617c6965
mov dword [0x11a3808], 0x7a586667
mov dword [0x11a380c], 0x7b6d6b67
mov dword [0x11a3810], 0x696e287b
mov dword [0x11a3814], 0x6c6d6461
mov word [0x11a3818], 0x2832
mov byte [0x11a381a], 8
xor eax, eax
mov cl, byte [eax + 0x11a37f8]
xor cl, 8
mov byte [eax + 0x11a39f8], cl
inc eax
cmp eax, 0x23
jb 0x110651c
mov eax, 0x11a39f8
ret

Function at 0x1106537
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cc8], 1
jne 0x1106580
or dword [0x11a8cc8], 1
mov dword [0x11a381c], 0x666d7847
mov dword [0x11a3820], 0x6b677a58
mov dword [0x11a3824], 0x287b7b6d
mov dword [0x11a3828], 0x6461696e
mov dword [0x11a382c], 0x28326c6d
mov byte [0x11a3830], 8
xor eax, eax
mov cl, byte [eax + 0x11a381c]
xor cl, 8
mov byte [eax + 0x11a3a1c], cl
inc eax
cmp eax, 0x15
jb 0x1106582
mov eax, 0x11a3a1c
ret
Function at 0x110659d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x11732fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x11a8cc4], 1
push esi
push edi
jne 0x11065fa
or dword [0x11a8cc4], 1
mov dword [0x11a3834], 0x667a6d63
mov dword [0x11a3838], 0x3a3b646d
mov dword [0x11a383c], 0x64646c26
mov byte [0x11a3840], 8
xor eax, eax
mov cl, byte [eax + 0x11a3834]
xor cl, 8
mov byte [eax + 0x11a3a34], cl
inc eax
cmp eax, 0xd
jb 0x11065fc
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x11a3a34
call edi
mov esi, eax
test esi, esi
jne 0x1106670
call dword [0x117a0a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0112a8c7
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.011067d2
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.01106b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.01105c58
push 0x11944a8
mov eax, esi
push eax
call fcn.01155926
call fcn.0110684f
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x110673d
call fcn.011068c2
push eax
call edi
mov edi, eax
test edi, edi
jne 0x11066e1
call dword [0x117a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0112a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.0110690c
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01106b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.01105c58
push 0x11944a8
mov eax, esi
jmp 0x110666a
call fcn.01106986
push eax
push edi
call esi
test eax, eax
jne 0x110673d
call dword [0x117a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0112a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.011069f6
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01106b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.01105c58
push 0x11944a8
mov eax, esi
jmp 0x110666a
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x110679f
call dword [0x117a0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0112a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.01106aaf
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01106b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.01105c58
push 0x11944a8
mov eax, esi
jmp 0x110666a
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.01104cde
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x11067d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cc0], 1
jne 0x1106832
or dword [0x11a8cc0], 1
mov dword [0x11a3844], 0x6c696744
mov dword [0x11a3848], 0x7a6a6144
mov dword [0x11a384c], 0x28717a69
mov dword [0x11a3850], 0x6461696e
mov dword [0x11a3854], 0x20286c6d
mov dword [0x11a3858], 0x667a6d63
mov dword [0x11a385c], 0x3a3b646d
mov dword [0x11a3860], 0x8283221
xor eax, eax
mov cl, byte [eax + 0x11a3844]
xor cl, 8
mov byte [eax + 0x11a3a44], cl
inc eax
cmp eax, 0x20
jb 0x1106834
mov eax, 0x11a3a44
ret
Function at 0x110684f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cbc], 1
jne 0x11068a5
or dword [0x11a8cbc], 1
mov dword [0x11a3864], 0x4f3a3b43
mov dword [0x11a3868], 0x7a587c6d
mov dword [0x11a386c], 0x7b6d6b67
mov dword [0x11a3870], 0x6965417b
mov dword [0x11a3874], 0x614e6d6f
mov dword [0x11a3878], 0x69466d64
mov dword [0x11a387c], 0x8496d65
xor eax, eax
mov cl, byte [eax + 0x11a3864]
xor cl, 8
mov byte [eax + 0x11a3a64], cl
inc eax
cmp eax, 0x1c
jb 0x11068a7
mov eax, 0x11a3a64
ret

Function at 0x11068c2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cb8], 1
jne 0x11068ef
or dword [0x11a8cb8], 1
mov dword [0x11a3880], 0x78697b78
mov dword [0x11a3884], 0x646c2661
mov word [0x11a3888], 0x864
xor eax, eax
mov cl, byte [eax + 0x11a3880]
xor cl, 8
mov byte [eax + 0x11a3a80], cl
inc eax
cmp eax, 0xa
jb 0x11068f1
mov eax, 0x11a3a80
ret

Function at 0x110690c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cb4], 1
jne 0x1106969
or dword [0x11a8cb4], 1
mov dword [0x11a388c], 0x6c696744
mov dword [0x11a3890], 0x7a6a6144
mov dword [0x11a3894], 0x28717a69
mov dword [0x11a3898], 0x6461696e
mov dword [0x11a389c], 0x20286c6d
mov dword [0x11a38a0], 0x78697b78
mov dword [0x11a38a4], 0x28322161
mov byte [0x11a38a8], 8
xor eax, eax
mov cl, byte [eax + 0x11a388c]
xor cl, 8
mov byte [eax + 0x11a3a8c], cl
inc eax
cmp eax, 0x1d
jb 0x110696b
mov eax, 0x11a3a8c
ret

Function at 0x1106986
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cb0], 1
jne 0x11069d9
or dword [0x11a8cb0], 1
mov dword [0x11a38ac], 0x587c6d4f
mov dword [0x11a38b0], 0x6d6b677a
mov dword [0x11a38b4], 0x65417b7b
mov dword [0x11a38b8], 0x4e6d6f69
mov dword [0x11a38bc], 0x466d6461
mov dword [0x11a38c0], 0x496d6569
mov byte [0x11a38c4], 8
xor eax, eax
mov cl, byte [eax + 0x11a38ac]
xor cl, 8
mov byte [eax + 0x11a3aac], cl
inc eax
cmp eax, 0x19
jb 0x11069db
mov eax, 0x11a3aac
ret

Function at 0x11069f6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8cac], 1
jne 0x1106a92
or dword [0x11a8cac], 1
mov dword [0x11a38c8], 0x587c6d4f
mov dword [0x11a38cc], 0x496b677a
mov dword [0x11a38d0], 0x6d7a6c6c
mov dword [0x11a38d4], 0x6e287b7b
mov dword [0x11a38d8], 0x6d646169
mov dword [0x11a38dc], 0x4f20286c
mov dword [0x11a38e0], 0x7a587c6d
mov dword [0x11a38e4], 0x7b6d6b67
mov dword [0x11a38e8], 0x6965417b
mov dword [0x11a38ec], 0x614e6d6f
mov dword [0x11a38f0], 0x69466d64
mov dword [0x11a38f4], 0x21496d65
mov word [0x11a38f8], 0x2832
mov byte [0x11a38fa], 8
xor eax, eax
mov cl, byte [eax + 0x11a38c8]
xor cl, 8
mov byte [eax + 0x11a3ac8], cl
inc eax
cmp eax, 0x33
jb 0x1106a94
mov eax, 0x11a3ac8
ret
Function at 0x1106aaf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8ca8], 1
jne 0x1106b16
or dword [0x11a8ca8], 1
mov dword [0x11a38fc], 0x587c6d4f
mov dword [0x11a3900], 0x6d6b677a
mov dword [0x11a3904], 0x65417b7b
mov dword [0x11a3908], 0x4e6d6f69
mov dword [0x11a390c], 0x666d6461
mov dword [0x11a3910], 0x286d6569
mov dword [0x11a3914], 0x6461696e
mov dword [0x11a3918], 0x28326c6d
mov byte [0x11a391c], 8
xor eax, eax
mov cl, byte [eax + 0x11a38fc]
xor cl, 8
mov byte [eax + 0x11a3afc], cl
inc eax
cmp eax, 0x21
jb 0x1106b18
mov eax, 0x11a3afc
ret

Function at 0x11076e4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8ca4], 1
jne 0x11078ca
or dword [0x11a8ca4], 1
mov dword [0x11a3b28], 0x7a276660
mov dword [0x11a3b2c], 0x7c666d7d
mov dword [0x11a3b30], 0x6c7a337d
mov dword [0x11a3b34], 0x7c6b7f7d
mov dword [0x11a3b38], 0x672e216f
mov dword [0x11a3b3c], 0x3202e66
mov dword [0x11a3b40], 0x626a6879
mov dword [0x11a3b44], 0x276c6e68
mov dword [0x11a3b48], 0x617d6879
mov dword [0x11a3b4c], 0x2e293429
mov dword [0x11a3b50], 0x6c7b032e
mov dword [0x11a3b54], 0x7b607c78
mov dword [0x11a3b58], 0x7a2e216c
mov dword [0x11a3b5c], 0x6a607b7d
mov dword [0x11a3b60], 0x3202e7d
mov dword [0x11a3b64], 0x686a6665
mov dword [0x11a3b68], 0x257a2965
mov dword [0x11a3b6c], 0x34297b29
mov dword [0x11a3b70], 0x6a797129
mov dword [0x11a3b74], 0x21656568
mov dword [0x11a3b78], 0x6a677c6f
mov dword [0x11a3b7c], 0x6766607d
mov dword [0x11a3b80], 0x7b292021
mov dword [0x11a3b84], 0x7b7c7d6c
mov dword [0x11a3b88], 0x6c7b2967
mov dword [0x11a3b8c], 0x7b607c78
mov dword [0x11a3b90], 0x2c2e216c
mov dword [0x11a3b94], 0x27202e44
mov dword [0x11a3b98], 0x67606864
mov dword [0x11a3b9c], 0x68565621
mov dword [0x11a3ba0], 0x207a6e7b
mov dword [0x11a3ba4], 0x6d676c29
mov dword [0x11a3ba8], 0x6c6d2925
mov dword [0x11a3bac], 0x276e7c6b
mov dword [0x11a3bb0], 0x6a687b7d
mov dword [0x11a3bb4], 0x6a686b6c
mov dword [0x11a3bb8], 0x60032062
mov dword [0x11a3bbc], 0x6667296f
mov dword [0x11a3bc0], 0x297a297d
mov dword [0x11a3bc4], 0x676c617d
mov dword [0x11a3bc8], 0x7b7b6c29
mov dword [0x11a3bcc], 0x7b217b66
mov dword [0x11a3bd0], 0x676c2920
mov dword [0x11a3bd4], 0x6c7b036d
mov dword [0x11a3bd8], 0x677b7c7d
mov word [0x11a3bdc], 0x7b29
mov byte [0x11a3bde], 9
xor eax, eax
mov cl, byte [eax + 0x11a3b28]
xor cl, 9
mov byte [eax + 0x11a4118], cl
inc eax
cmp eax, 0xb7
jb 0x11078cc
mov eax, 0x11a4118
ret
Function at 0x11078e9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8ca0], 1
jne 0x1107b6f
or dword [0x11a8ca0], 1
mov dword [0x11a3be0], 0x7a276660
mov dword [0x11a3be4], 0x7c666d7d
mov dword [0x11a3be8], 0x6c7a337d
mov dword [0x11a3bec], 0x7c6b7f7d
mov dword [0x11a3bf0], 0x672e216f
mov dword [0x11a3bf4], 0x3202e66
mov dword [0x11a3bf8], 0x626a6879
mov dword [0x11a3bfc], 0x276c6e68
mov dword [0x11a3c00], 0x617d6879
mov dword [0x11a3c04], 0x32e2e34
mov dword [0x11a3c08], 0x7c786c7b
mov dword [0x11a3c0c], 0x216c7b60
mov dword [0x11a3c10], 0x7b7d7a2e
mov dword [0x11a3c14], 0x2e7d6a60
mov dword [0x11a3c18], 0x66650320
mov dword [0x11a3c1c], 0x2965686a
mov dword [0x11a3c20], 0x34296564
mov dword [0x11a3c24], 0x786c7b29
mov dword [0x11a3c28], 0x6c7b607c
mov dword [0x11a3c2c], 0x65642e21
mov dword [0x11a3c30], 0x6503202e
mov dword [0x11a3c34], 0x65686a66
mov dword [0x11a3c38], 0x7b257a29
mov dword [0x11a3c3c], 0x34296c25
mov dword [0x11a3c40], 0x6a797129
mov dword [0x11a3c44], 0x21656568
mov dword [0x11a3c48], 0x6a677c6f
mov dword [0x11a3c4c], 0x6766607d
mov dword [0x11a3c50], 0x7b292021
mov dword [0x11a3c54], 0x7b7c7d6c
mov dword [0x11a3c58], 0x6c7b2967
mov dword [0x11a3c5c], 0x7b607c78
mov dword [0x11a3c60], 0x2c2e216c
mov dword [0x11a3c64], 0x27202e44
mov dword [0x11a3c68], 0x2c214f2c
mov dword [0x11a3c6c], 0x6c292048
mov dword [0x11a3c70], 0x29256d67
mov dword [0x11a3c74], 0x7c6b6c6d
mov dword [0x11a3c78], 0x7b7d276e
mov dword [0x11a3c7c], 0x6b6c6a68
mov dword [0x11a3c80], 0x20626a68
mov dword [0x11a3c84], 0x296f6003
mov dword [0x11a3c88], 0x297d6667
mov dword [0x11a3c8c], 0x617d297a
mov dword [0x11a3c90], 0x7b29676c
mov dword [0x11a3c94], 0x7b7c7d6c
mov dword [0x11a3c98], 0x60672967
mov dword [0x11a3c9c], 0x7b292565
mov dword [0x11a3ca0], 0x6d676c29
mov dword [0x11a3ca4], 0x296f6003
mov dword [0x11a3ca8], 0x3477297b
mov dword [0x11a3cac], 0x65606729
mov dword [0x11a3cb0], 0x6c617d29
mov dword [0x11a3cb4], 0x297b2967
mov dword [0x11a3cb8], 0x65642934
mov dword [0x11a3cbc], 0x7d7a7d27
mov dword [0x11a3cc0], 0x6e67607b
mov dword [0x11a3cc4], 0x29207b21
mov dword [0x11a3cc8], 0x36d676c
mov dword [0x11a3ccc], 0x7c7d6c7b
mov dword [0x11a3cd0], 0x7b29677b
mov word [0x11a3cd4], 0x6c25
mov byte [0x11a3cd6], 9
xor eax, eax
mov cl, byte [eax + 0x11a3be0]
xor cl, 9
mov byte [eax + 0x11a41d0], cl
inc eax
cmp eax, 0xf7
jb 0x1107b71
mov eax, 0x11a41d0
ret
Function at 0x1107b8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x11a8c64], 1
jne 0x1107bb5
or dword [0x11a8c64], 1
mov dword [0x11a3dc8], 0x626a6879
mov dword [0x11a3dcc], 0x96c6e68
xor eax, eax
mov cl, byte [eax + 0x11a3dc8]
xor cl, 9
mov byte [eax + 0x11a43b8], cl
inc eax
cmp eax, 8
jb 0x1107bb7
push 0x11a43b8
push dword [ebp + 8]
call fcn.01138c75
test byte [0x11a8c60], 1
pop ecx
pop ecx
jne 0x1107bff
or dword [0x11a8c60], 1
mov dword [0x11a3dd0], 0x656c7b79
mov dword [0x11a3dd4], 0x96d6866
xor eax, eax
mov cl, byte [eax + 0x11a3dd0]
xor cl, 9
mov byte [eax + 0x11a43c0], cl
inc eax
cmp eax, 8
jb 0x1107c01
push esi
push 0x11a43c0
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.01138ce9
add esp, 0xc
cmp dword [0x119ebe0], 0
mov esi, 0x119ebe0
je 0x1107c61
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.01138b95
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.01138f16
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x1107c3a
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.011383ea
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x1107edb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1172d38
call fcn.01171cf8
sub esp, 0x64
test byte [0x11a8c4c], 1
jne 0x1107f08
or dword [0x11a8c4c], 1
mov word [0x11a3e00], 0x442c
mov byte [0x11a3e02], 9
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x11a3e00]
xor cl, 9
mov byte [eax + 0x11a43f0], cl
inc eax
cmp eax, 3
jb 0x1107f0f
mov esi, 0x11a43f0
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1107f3b
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.01104c69
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.0110d0cc
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.01104cff
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x1107f82
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.011377e8
pop ecx
pop ecx
cmp eax, ebx
je 0x1107fd3
cmp eax, 3
jne 0x1107fc0
call fcn.011080da
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0114ba25
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x11944a8
lea eax, [ebp - 0x1c]
push eax
call fcn.01155926
cmp eax, 4
jne 0x1107fcc
call fcn.0110818d
jmp 0x1107f9c
call fcn.01108240
jmp 0x1107f9c
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0113921e
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x110808a
push ebx
call fcn.011082c4
push eax
push 0xffffffffffffffff
push esi
call fcn.01137f7f
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.01104cde
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x1108042
call fcn.0110830b
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0110d13d
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.01105c58
jmp 0x1107fb2
cmp edi, 4
jne 0x1108061
call fcn.0110836a
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0110d13d
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x1108035
cmp edi, 6
jne 0x1108080
call fcn.011083cf
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0110d13d
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x1108035
call fcn.01108453
jmp 0x1107f9c
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.011385da
pop ecx
pop ecx
test eax, eax
je 0x11080ab
push ebx
push edi
push esi
call fcn.0113879e
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.011383d4
sub edi, eax
push edi
push esi
call fcn.011383ea
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.01104cff
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x11080da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c48], 1
jne 0x1108170
or dword [0x11a8c48], 1
mov dword [0x11a3e04], 0x6560684f
mov dword [0x11a3e08], 0x7d296d6c
mov dword [0x11a3e0c], 0x7f6c2966
mov dword [0x11a3e10], 0x687c6568
mov dword [0x11a3e14], 0x6b296c7d
mov dword [0x11a3e18], 0x7a7d6666
mov dword [0x11a3e1c], 0x79687b7d
mov dword [0x11a3e20], 0x687b6f29
mov dword [0x11a3e24], 0x676c646e
mov dword [0x11a3e28], 0x7a29257d
mov dword [0x11a3e2c], 0x687d6770
mov dword [0x11a3e30], 0x7b6c2971
mov dword [0x11a3e34], 0x97b667b
xor eax, eax
mov cl, byte [eax + 0x11a3e04]
xor cl, 9
mov byte [eax + 0x11a43f4], cl
inc eax
cmp eax, 0x34
jb 0x1108172
mov eax, 0x11a43f4
ret

Function at 0x110818d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c44], 1
jne 0x1108223
or dword [0x11a8c44], 1
mov dword [0x11a3e38], 0x6560684f
mov dword [0x11a3e3c], 0x7d296d6c
mov dword [0x11a3e40], 0x7f6c2966
mov dword [0x11a3e44], 0x687c6568
mov dword [0x11a3e48], 0x6b296c7d
mov dword [0x11a3e4c], 0x7a7d6666
mov dword [0x11a3e50], 0x79687b7d
mov dword [0x11a3e54], 0x687b6f29
mov dword [0x11a3e58], 0x676c646e
mov dword [0x11a3e5c], 0x6429257d
mov dword [0x11a3e60], 0x7b66646c
mov dword [0x11a3e64], 0x7b6c2970
mov dword [0x11a3e68], 0x97b667b
xor eax, eax
mov cl, byte [eax + 0x11a3e38]
xor cl, 9
mov byte [eax + 0x11a4428], cl
inc eax
cmp eax, 0x34
jb 0x1108225
mov eax, 0x11a4428
ret

Function at 0x1108240
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c40], 1
jne 0x11082a7
or dword [0x11a8c40], 1
mov dword [0x11a3e6c], 0x6762675c
mov dword [0x11a3e70], 0x29677e66
mov dword [0x11a3e74], 0x667b7b6c
mov dword [0x11a3e78], 0x6760297b
mov dword [0x11a3e7c], 0x687c6529
mov dword [0x11a3e80], 0x66655645
mov dword [0x11a3e84], 0x7d7a6d68
mov dword [0x11a3e88], 0x6e67607b
mov byte [0x11a3e8c], 9
xor eax, eax
mov cl, byte [eax + 0x11a3e6c]
xor cl, 9
mov byte [eax + 0x11a445c], cl
inc eax
cmp eax, 0x21
jb 0x11082a9
mov eax, 0x11a445c
ret

Function at 0x11082c4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c3c], 1
jne 0x11082ee
or dword [0x11a8c3c], 1
mov dword [0x11a3e90], 0x67666735
mov word [0x11a3e94], 0x376c
mov byte [0x11a3e96], 9
xor eax, eax
mov cl, byte [eax + 0x11a3e90]
xor cl, 9
mov byte [eax + 0x11a4480], cl
inc eax
cmp eax, 7
jb 0x11082f0
mov eax, 0x11a4480
ret

Function at 0x110830b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11a8c38], 1
jne 0x110834d
or dword [0x11a8c38], 1
mov dword [0x11a3e98], 0x29687c45
mov dword [0x11a3e9c], 0x7d677c7b
mov dword [0x11a3ea0], 0x296c6460
mov dword [0x11a3ea4], 0x667b7b6c
mov dword [0x11a3ea8], 0x929337b
xor eax, eax
mov cl, byte [eax + 0x11a3e98]
xor cl, 9
mov byte [eax + 0x11a4488], cl
inc eax
cmp eax, 0x14
jb 0x110834f
mov eax, 0x11a4488
ret