joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1114739
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d2c], 1
jne 0x11147b3
or dword [0x11d2d2c], 1
mov dword [0x11ccfbc], 0xadafba9d
mov dword [0x11ccfc0], 0xbbaaeea5
mov dword [0x11ccfc4], 0xabeebea3
mov dword [0x11ccfc8], 0xbca1bcbc
mov dword [0x11ccfcc], 0xb79deef4
mov dword [0x11ccfd0], 0xa7a087a3
mov dword [0x11ccfd4], 0xa2afa7ba
mov dword [0x11ccfd8], 0xeeabb4a7
mov dword [0x11ccfdc], 0xa2a7afa8
mov word [0x11ccfe0], 0xaaab
mov byte [0x11ccfe2], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccfbc]
xor cl, 0xce
mov byte [eax + 0x11cd668], cl
inc eax
cmp eax, 0x27
jb 0x11147b5
mov eax, 0x11cd668
ret

Function at 0x11147d0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d28], 1
jne 0x1114836
or dword [0x11d2d28], 1
mov dword [0x11ccfe4], 0xa7a5bdf2
mov dword [0x11ccfe8], 0xaaabbebe
mov dword [0x11ccfec], 0xafbca8ee
mov dword [0x11ccff0], 0xeee2aba3
mov dword [0x11ccff4], 0xb9ee8d9e
mov dword [0x11ccff8], 0xa0eebdaf
mov dword [0x11ccffc], 0xf0a2a2bb
mov word [0x11cd000], 0xc4c3
mov byte [0x11cd002], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccfe4]
xor cl, 0xce
mov byte [eax + 0x11cd690], cl
inc eax
cmp eax, 0x1f
jb 0x1114838
mov eax, 0x11cd690
ret

Function at 0x1114853
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d24], 1
jne 0x11148e6
or dword [0x11d2d24], 1
mov dword [0x11cd004], 0xa7a5bdf2
mov dword [0x11cd008], 0xaaabbebe
mov dword [0x11cd00c], 0xafbca8ee
mov dword [0x11cd010], 0xeee2aba3
mov dword [0x11cd014], 0xb9ee8d9e
mov dword [0x11cd018], 0xbdeebdaf
mov dword [0x11cd01c], 0xeeaba3af
mov dword [0x11cd020], 0xbceebdaf
mov dword [0x11cd024], 0xbcbbbaab
mov dword [0x11cd028], 0xaaafeea0
mov dword [0x11cd02c], 0xbdabbcaa
mov dword [0x11cd030], 0xc4c3f0bd
mov byte [0x11cd034], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cd004]
xor cl, 0xce
mov byte [eax + 0x11cd6b0], cl
inc eax
cmp eax, 0x31
jb 0x11148e8
mov eax, 0x11cd6b0
ret
Function at 0x1114903
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.01186ab0
push ebx
push esi
push edi
call dword [0x11a2094]
test byte [0x11d2d20], 1
mov dword [ebp - 4], eax
jne 0x111494a
or dword [0x11d2d20], 1
mov dword [0x11cd038], 0xaaa1a3f2
mov dword [0x11cd03c], 0xf1aba2bb
mov dword [0x11cd040], 0xcef0f1f1
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x11cd038]
xor cl, 0xce
mov byte [eax + 0x11cd6e4], cl
inc eax
cmp eax, 0xc
jb 0x111494e
test byte [0x11d2d1c], 1
mov dword [ebp - 8], 0x11cd6e4
jne 0x1114998
or dword [0x11d2d1c], 1
mov dword [0x11cd044], 0xa3b7bdf2
mov dword [0x11cd048], 0xf1a2a1ac
mov dword [0x11cd04c], 0xcef0f1f1
xor eax, eax
mov cl, byte [eax + 0x11cd044]
xor cl, 0xce
mov byte [eax + 0x11cd6f0], cl
inc eax
cmp eax, 0xc
jb 0x111499a
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0x11cd6f0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.01176f70
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0x11a23b0]
test eax, eax
je 0x11149ff
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.01176f70
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0x11a23bc]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0x1114a4b
mov ecx, dword [ebp - 0x1c]
test byte [0x11d2d18], 1
jne 0x1114a82
or dword [0x11d2d18], 1
mov dword [0x11cd050], 0xebeebeeb
mov dword [0x11cd054], 0xbdebefbd
mov dword [0x11cd058], 0xebb6fee5
mov word [0x11cd05c], 0xceb6
xor eax, eax
mov dl, byte [eax + 0x11cd050]
xor dl, 0xce
mov byte [eax + 0x11cd6fc], dl
inc eax
cmp eax, 0xe
jb 0x1114a84
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x11cd6fc
push dword [ebp + 0xc]
call fcn.0117419d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0x11a23a4]
test eax, eax
je 0x1114afb
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.01114b48
push eax
push dword [ebp + 0xc]
call fcn.0117419d
add esp, 0x14
test byte [0x11d2d10], 1
jne 0x1114b1b
or dword [0x11d2d10], 1
mov word [0x11cd070], 0xc4c3
mov byte [0x11cd072], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cd070]
xor cl, 0xce
mov byte [eax + 0x11cd71c], cl
inc eax
cmp eax, 3
jb 0x1114b1d
push dword [ebp + 0xc]
push 0x11cd71c
call fcn.01173e11
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1114b48
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d14], 1
jne 0x1114b80
or dword [0x11d2d14], 1
mov dword [0x11cd060], 0xbdebe6ee
mov dword [0x11cd064], 0xeeaaebf4
mov dword [0x11cd068], 0xb6feeee5
mov dword [0x11cd06c], 0xcee7b6eb
xor eax, eax
mov cl, byte [eax + 0x11cd060]
xor cl, 0xce
mov byte [eax + 0x11cd70c], cl
inc eax
cmp eax, 0x10
jb 0x1114b82
mov eax, 0x11cd70c
ret

Function at 0x1115df8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d04], 1
jne 0x1115e4d
or dword [0x11d2d04], 1
mov dword [0x11cd740], 0x94829198
mov dword [0x11cd744], 0x95829187
mov dword [0x11cd748], 0x8093918c
mov dword [0x11cd74c], 0x83948c99
mov dword [0x11cd750], 0x868c8494
mov dword [0x11cd754], 0x8f889f92
mov word [0x11cd758], 0xd08f
xor eax, eax
mov cl, byte [eax + 0x11cd740]
xor cl, 0xd0
mov byte [eax + 0x11cd940], cl
inc eax
cmp eax, 0x1a
jb 0x1115e4f
mov eax, 0x11cd940
ret

Function at 0x1115f5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d00], 1
jne 0x1115f88
or dword [0x11d2d00], 1
mov dword [0x11cd75c], 0xb1879d86
mov word [0x11cd760], 0xb5a2
mov byte [0x11cd762], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd75c]
xor cl, 0xd0
mov byte [eax + 0x11cd95c], cl
inc eax
cmp eax, 7
jb 0x1115f8a
mov eax, 0x11cd95c
ret

Function at 0x1115fa5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cfc], 1
jne 0x1115fd2
or dword [0x11d2cfc], 1
mov dword [0x11cd764], 0xa4a2b986
mov dword [0x11cd768], 0x80bcb1a5
mov word [0x11cd76c], 0xd093
xor eax, eax
mov cl, byte [eax + 0x11cd764]
xor cl, 0xd0
mov byte [eax + 0x11cd964], cl
inc eax
cmp eax, 0xa
jb 0x1115fd4
mov eax, 0x11cd964
ret

Function at 0x1115fef
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cf8], 1
jne 0x1116023
or dword [0x11d2cf8], 1
mov dword [0x11cd770], 0xa4a2b986
mov dword [0x11cd774], 0x92bcb1a5
mov word [0x11cd778], 0xa8bf
mov byte [0x11cd77a], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd770]
xor cl, 0xd0
mov byte [eax + 0x11cd970], cl
inc eax
cmp eax, 0xb
jb 0x1116025
mov eax, 0x11cd970
ret

Function at 0x1116040
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cf4], 1
jne 0x1116064
or dword [0x11d2cf4], 1
mov dword [0x11cd77c], 0xb5beb597
mov dword [0x11cd780], 0xd0b3b9a2
xor eax, eax
mov cl, byte [eax + 0x11cd77c]
xor cl, 0xd0
mov byte [eax + 0x11cd97c], cl
inc eax
cmp eax, 8
jb 0x1116066
mov eax, 0x11cd97c
ret
Function at 0x1116081
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x119b2df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x11d2cf0], 1
push esi
jne 0x11160d4
or dword [0x11d2cf0], 1
mov dword [0x11cd784], 0xbcb4a4be
mov dword [0x11cd788], 0xbcb4febc
mov word [0x11cd78c], 0xd0bc
xor eax, eax
mov cl, byte [eax + 0x11cd784]
xor cl, 0xd0
mov byte [eax + 0x11cd984], cl
inc eax
cmp eax, 0xa
jb 0x11160d6
push 0x11cd984
call dword [0x11a20cc]
mov esi, eax
test esi, esi
jne 0x1116148
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0113a918
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.0111628f
push eax
lea eax, [esp + 0x28]
push eax
call fcn.01116ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.01115bc9
push 0x11bec28
mov eax, esi
push eax
call fcn.0117d8c5
call fcn.011162f5
push eax
push esi
call dword [0x11a20c8]
test eax, eax
jne 0x11161a5
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0113a918
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.01116367
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01116ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.01115bc9
push 0x11bec28
mov eax, esi
jmp 0x1116142
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x111622d
cmp dword [esp + 4], 0x18
jne 0x111622d
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x11a20c4]
test eax, eax
jne 0x111627c
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0113a918
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.011164a7
push eax
lea eax, [esp + 0x94]
push eax
call fcn.01116ae0
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.01115bc9
push 0x11bec28
mov eax, esi
jmp 0x1116142
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0113a918
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.0111641a
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01116ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.01115bc9
push 0x11bec28
mov eax, esi
jmp 0x1116142
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x111628f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cec], 1
jne 0x11162d8
or dword [0x11d2cec], 1
mov dword [0x11cd790], 0xb4b1bf9c
mov dword [0x11cd794], 0xa2b2b99c
mov dword [0x11cd798], 0xf0a9a2b1
mov dword [0x11cd79c], 0xbcb9b1b6
mov dword [0x11cd7a0], 0xf0eab4b5
mov byte [0x11cd7a4], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd790]
xor cl, 0xd0
mov byte [eax + 0x11cd990], cl
inc eax
cmp eax, 0x15
jb 0x11162da
mov eax, 0x11cd990
ret
Function at 0x11162f5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2ce8], 1
jne 0x111634a
or dword [0x11d2ce8], 1
mov dword [0x11cd7a8], 0xa581a49e
mov dword [0x11cd7ac], 0x99a9a2b5
mov dword [0x11cd7b0], 0xa2bfb6be
mov dword [0x11cd7b4], 0xb9a4b1bd
mov dword [0x11cd7b8], 0xa280bebf
mov dword [0x11cd7bc], 0xa3b5b3bf
mov word [0x11cd7c0], 0xd0a3
xor eax, eax
mov cl, byte [eax + 0x11cd7a8]
xor cl, 0xd0
mov byte [eax + 0x11cd9a8], cl
inc eax
cmp eax, 0x1a
jb 0x111634c
mov eax, 0x11cd9a8
ret

Function at 0x1116367
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2ce4], 1
jne 0x11163fd
or dword [0x11d2ce4], 1
mov dword [0x11cd7c4], 0x80a4b597
mov dword [0x11cd7c8], 0x91b3bfa2
mov dword [0x11cd7cc], 0xb5a2b4b4
mov dword [0x11cd7d0], 0xb6f0a3a3
mov dword [0x11cd7d4], 0xb5bcb9b1
mov dword [0x11cd7d8], 0x9ef8f0b4
mov dword [0x11cd7dc], 0xb5a581a4
mov dword [0x11cd7e0], 0xbe99a9a2
mov dword [0x11cd7e4], 0xbda2bfb6
mov dword [0x11cd7e8], 0xbfb9a4b1
mov dword [0x11cd7ec], 0xbfa280be
mov dword [0x11cd7f0], 0xa3a3b5b3
mov dword [0x11cd7f4], 0xd0f0eaf9
xor eax, eax
mov cl, byte [eax + 0x11cd7c4]
xor cl, 0xd0
mov byte [eax + 0x11cd9c4], cl
inc eax
cmp eax, 0x34
jb 0x11163ff
mov eax, 0x11cd9c4
ret

Function at 0x111641a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2ce0], 1
jne 0x111648a
or dword [0x11d2ce0], 1
mov dword [0x11cd7f8], 0xa581a49e
mov dword [0x11cd7fc], 0x99a9a2b5
mov dword [0x11cd800], 0xa2bfb6be
mov dword [0x11cd804], 0xb9a4b1bd
mov dword [0x11cd808], 0xa280bebf
mov dword [0x11cd80c], 0xa3b5b3bf
mov dword [0x11cd810], 0xb1b6f0a3
mov dword [0x11cd814], 0xb4b5bcb9
mov word [0x11cd818], 0xf0ea
mov byte [0x11cd81a], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd7f8]
xor cl, 0xd0
mov byte [eax + 0x11cd9f8], cl
inc eax
cmp eax, 0x23
jb 0x111648c
mov eax, 0x11cd9f8
ret

Function at 0x11164a7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cdc], 1
jne 0x11164f0
or dword [0x11d2cdc], 1
mov dword [0x11cd81c], 0xbeb5a09f
mov dword [0x11cd820], 0xb3bfa280
mov dword [0x11cd824], 0xf0a3a3b5
mov dword [0x11cd828], 0xbcb9b1b6
mov dword [0x11cd82c], 0xf0eab4b5
mov byte [0x11cd830], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd81c]
xor cl, 0xd0
mov byte [eax + 0x11cda1c], cl
inc eax
cmp eax, 0x15
jb 0x11164f2
mov eax, 0x11cda1c
ret
Function at 0x111650d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x119b28c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x11d2cd8], 1
push esi
push edi
jne 0x111656a
or dword [0x11d2cd8], 1
mov dword [0x11cd834], 0xbea2b5bb
mov dword [0x11cd838], 0xe2e3bcb5
mov dword [0x11cd83c], 0xbcbcb4fe
mov byte [0x11cd840], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd834]
xor cl, 0xd0
mov byte [eax + 0x11cda34], cl
inc eax
cmp eax, 0xd
jb 0x111656c
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x11cda34
call edi
mov esi, eax
test esi, esi
jne 0x11165e0
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0113a918
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.01116742
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.01116ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.01115bc9
push 0x11bec28
mov eax, esi
push eax
call fcn.0117d8c5
call fcn.011167bf
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x11166ad
call fcn.01116832
push eax
call edi
mov edi, eax
test edi, edi
jne 0x1116651
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0113a918
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.0111687c
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01116ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.01115bc9
push 0x11bec28
mov eax, esi
jmp 0x11165da
call fcn.011168f6
push eax
push edi
call esi
test eax, eax
jne 0x11166ad
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0113a918
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.01116966
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01116ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.01115bc9
push 0x11bec28
mov eax, esi
jmp 0x11165da
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x111670f
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0113a918
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.01116a1f
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01116ae0
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.01115bc9
push 0x11bec28
mov eax, esi
jmp 0x11165da
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.01114cc4
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1116742
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cd4], 1
jne 0x11167a2
or dword [0x11d2cd4], 1
mov dword [0x11cd844], 0xb4b1bf9c
mov dword [0x11cd848], 0xa2b2b99c
mov dword [0x11cd84c], 0xf0a9a2b1
mov dword [0x11cd850], 0xbcb9b1b6
mov dword [0x11cd854], 0xf8f0b4b5
mov dword [0x11cd858], 0xbea2b5bb
mov dword [0x11cd85c], 0xe2e3bcb5
mov dword [0x11cd860], 0xd0f0eaf9
xor eax, eax
mov cl, byte [eax + 0x11cd844]
xor cl, 0xd0
mov byte [eax + 0x11cda44], cl
inc eax
cmp eax, 0x20
jb 0x11167a4
mov eax, 0x11cda44
ret

Function at 0x11167bf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cd0], 1
jne 0x1116815
or dword [0x11d2cd0], 1
mov dword [0x11cd864], 0x97e2e39b
mov dword [0x11cd868], 0xa280a4b5
mov dword [0x11cd86c], 0xa3b5b3bf
mov dword [0x11cd870], 0xb1bd99a3
mov dword [0x11cd874], 0xb996b5b7
mov dword [0x11cd878], 0xb19eb5bc
mov dword [0x11cd87c], 0xd091b5bd
xor eax, eax
mov cl, byte [eax + 0x11cd864]
xor cl, 0xd0
mov byte [eax + 0x11cda64], cl
inc eax
cmp eax, 0x1c
jb 0x1116817
mov eax, 0x11cda64
ret

Function at 0x1116832
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2ccc], 1
jne 0x111685f
or dword [0x11d2ccc], 1
mov dword [0x11cd880], 0xa0b1a3a0
mov dword [0x11cd884], 0xbcb4feb9
mov word [0x11cd888], 0xd0bc
xor eax, eax
mov cl, byte [eax + 0x11cd880]
xor cl, 0xd0
mov byte [eax + 0x11cda80], cl
inc eax
cmp eax, 0xa
jb 0x1116861
mov eax, 0x11cda80
ret

Function at 0x111687c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cc8], 1
jne 0x11168d9
or dword [0x11d2cc8], 1
mov dword [0x11cd88c], 0xb4b1bf9c
mov dword [0x11cd890], 0xa2b2b99c
mov dword [0x11cd894], 0xf0a9a2b1
mov dword [0x11cd898], 0xbcb9b1b6
mov dword [0x11cd89c], 0xf8f0b4b5
mov dword [0x11cd8a0], 0xa0b1a3a0
mov dword [0x11cd8a4], 0xf0eaf9b9
mov byte [0x11cd8a8], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd88c]
xor cl, 0xd0
mov byte [eax + 0x11cda8c], cl
inc eax
cmp eax, 0x1d
jb 0x11168db
mov eax, 0x11cda8c
ret

Function at 0x11168f6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cc4], 1
jne 0x1116949
or dword [0x11d2cc4], 1
mov dword [0x11cd8ac], 0x80a4b597
mov dword [0x11cd8b0], 0xb5b3bfa2
mov dword [0x11cd8b4], 0xbd99a3a3
mov dword [0x11cd8b8], 0x96b5b7b1
mov dword [0x11cd8bc], 0x9eb5bcb9
mov dword [0x11cd8c0], 0x91b5bdb1
mov byte [0x11cd8c4], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd8ac]
xor cl, 0xd0
mov byte [eax + 0x11cdaac], cl
inc eax
cmp eax, 0x19
jb 0x111694b
mov eax, 0x11cdaac
ret
Function at 0x1116966
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cc0], 1
jne 0x1116a02
or dword [0x11d2cc0], 1
mov dword [0x11cd8c8], 0x80a4b597
mov dword [0x11cd8cc], 0x91b3bfa2
mov dword [0x11cd8d0], 0xb5a2b4b4
mov dword [0x11cd8d4], 0xb6f0a3a3
mov dword [0x11cd8d8], 0xb5bcb9b1
mov dword [0x11cd8dc], 0x97f8f0b4
mov dword [0x11cd8e0], 0xa280a4b5
mov dword [0x11cd8e4], 0xa3b5b3bf
mov dword [0x11cd8e8], 0xb1bd99a3
mov dword [0x11cd8ec], 0xb996b5b7
mov dword [0x11cd8f0], 0xb19eb5bc
mov dword [0x11cd8f4], 0xf991b5bd
mov word [0x11cd8f8], 0xf0ea
mov byte [0x11cd8fa], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd8c8]
xor cl, 0xd0
mov byte [eax + 0x11cdac8], cl
inc eax
cmp eax, 0x33
jb 0x1116a04
mov eax, 0x11cdac8
ret

Function at 0x1116a1f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cbc], 1
jne 0x1116a86
or dword [0x11d2cbc], 1
mov dword [0x11cd8fc], 0x80a4b597
mov dword [0x11cd900], 0xb5b3bfa2
mov dword [0x11cd904], 0xbd99a3a3
mov dword [0x11cd908], 0x96b5b7b1
mov dword [0x11cd90c], 0xbeb5bcb9
mov dword [0x11cd910], 0xf0b5bdb1
mov dword [0x11cd914], 0xbcb9b1b6
mov dword [0x11cd918], 0xf0eab4b5
mov byte [0x11cd91c], 0xd0
xor eax, eax
mov cl, byte [eax + 0x11cd8fc]
xor cl, 0xd0
mov byte [eax + 0x11cdafc], cl
inc eax
cmp eax, 0x21
jb 0x1116a88
mov eax, 0x11cdafc
ret
Function at 0x1117666
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cb8], 1
jne 0x111786d
or dword [0x11d2cb8], 1
or al, 0xff
mov word [0x11cdb28], 0xbeb8
mov byte [0x11cdb2a], al
mov dword [0x11cdb2b], 0xbeb5a5a2
mov dword [0x11cdb2f], 0xa2eba5a4
mov dword [0x11cdb33], 0xb3a7a5b4
mov dword [0x11cdb37], 0xf6f9b7a4
mov dword [0x11cdb3b], 0xf8f6bebf
mov dword [0x11cdb3f], 0xb2b0a1db
mov dword [0x11cdb43], 0xb4b6b0ba
mov byte [0x11cdb47], al
mov dword [0x11cdb48], 0xb9a5b0a1
mov dword [0x11cdb4c], 0xf6f1ecf1
mov dword [0x11cdb50], 0xb4a3dbf6
mov dword [0x11cdb54], 0xa3b8a4a0
mov dword [0x11cdb58], 0xa2f6f9b4
mov dword [0x11cdb5c], 0xb2b8a3a5
mov dword [0x11cdb60], 0xdbf8f6a5
mov dword [0x11cdb64], 0xb0b2bebd
mov dword [0x11cdb68], 0xfda2f1bd
mov dword [0x11cdb6c], 0xecf1a3f1
mov dword [0x11cdb70], 0xb2a1a9f1
mov dword [0x11cdb74], 0xf9bdbdb0
mov dword [0x11cdb78], 0xb2bfa4b7
mov dword [0x11cdb7c], 0xbfbeb8a5
mov dword [0x11cdb80], 0xa3f1f8f9
mov dword [0x11cdb84], 0xa3a4a5b4
mov dword [0x11cdb88], 0xb4a3f1bf
mov dword [0x11cdb8c], 0xa3b8a4a0
mov dword [0x11cdb90], 0xf4f6f9b4
mov word [0x11cdb94], 0xf69c
mov byte [0x11cdb96], 0xf8
mov byte [0x11cdb97], al
mov dword [0x11cdb98], 0xbfb8b0bc
mov dword [0x11cdb9c], 0xb08e8ef9
mov dword [0x11cdba0], 0xf8a2b6a3
mov dword [0x11cdba4], 0xb5bfb4f1
mov dword [0x11cdba8], 0xb4b5f1fd
mov word [0x11cdbac], 0xa4b3
mov byte [0x11cdbae], 0xb6
mov byte [0x11cdbaf], al
mov dword [0x11cdbb0], 0xb2b0a3a5
mov dword [0x11cdbb4], 0xb2b0b3b4
mov dword [0x11cdbb8], 0xb8dbf8ba
mov dword [0x11cdbbc], 0xbebff1b7
mov dword [0x11cdbc0], 0xf1a2f1a5
mov dword [0x11cdbc4], 0xbfb4b9a5
mov dword [0x11cdbc8], 0xa3a3b4f1
mov dword [0x11cdbcc], 0xa3f9a3be
mov dword [0x11cdbd0], 0xbfb4f1f8
mov dword [0x11cdbd4], 0xb4a3dbb5
mov dword [0x11cdbd8], 0xbfa3a4a5
mov word [0x11cdbdc], 0xa3f1
mov byte [0x11cdbde], 0xd1
xor eax, eax
mov cl, byte [eax + 0x11cdb28]
xor cl, 0xd1
mov byte [eax + 0x11ce120], cl
inc eax
cmp eax, 0xb7
jb 0x111786f
mov eax, 0x11ce120
ret
Function at 0x111788c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2cb4], 1
jne 0x1117b31
or dword [0x11d2cb4], 1
or al, 0xff
mov word [0x11cdbe0], 0xbeb8
mov byte [0x11cdbe2], al
mov dword [0x11cdbe3], 0xbeb5a5a2
mov dword [0x11cdbe7], 0xa2eba5a4
mov dword [0x11cdbeb], 0xb3a7a5b4
mov dword [0x11cdbef], 0xf6f9b7a4
mov dword [0x11cdbf3], 0xf8f6bebf
mov dword [0x11cdbf7], 0xb2b0a1db
mov dword [0x11cdbfb], 0xb4b6b0ba
mov byte [0x11cdbff], al
mov dword [0x11cdc00], 0xb9a5b0a1
mov dword [0x11cdc04], 0xdbf6f6ec
mov dword [0x11cdc08], 0xa4a0b4a3
mov dword [0x11cdc0c], 0xf9b4a3b8
mov dword [0x11cdc10], 0xa3a5a2f6
mov dword [0x11cdc14], 0xf6a5b2b8
mov dword [0x11cdc18], 0xbebddbf8
mov dword [0x11cdc1c], 0xf1bdb0b2
mov dword [0x11cdc20], 0xecf1bdbc
mov dword [0x11cdc24], 0xa0b4a3f1
mov dword [0x11cdc28], 0xb4a3b8a4
mov dword [0x11cdc2c], 0xbdbcf6f9
mov dword [0x11cdc30], 0xbddbf8f6
mov dword [0x11cdc34], 0xbdb0b2be
mov dword [0x11cdc38], 0xa3fda2f1
mov dword [0x11cdc3c], 0xecf1b4fd
mov dword [0x11cdc40], 0xb2a1a9f1
mov dword [0x11cdc44], 0xf9bdbdb0
mov dword [0x11cdc48], 0xb2bfa4b7
mov dword [0x11cdc4c], 0xbfbeb8a5
mov dword [0x11cdc50], 0xa3f1f8f9
mov dword [0x11cdc54], 0xa3a4a5b4
mov dword [0x11cdc58], 0xb4a3f1bf
mov dword [0x11cdc5c], 0xa3b8a4a0
mov dword [0x11cdc60], 0xf4f6f9b4
mov word [0x11cdc64], 0xf69c
mov byte [0x11cdc66], 0xf8
mov byte [0x11cdc67], al
mov dword [0x11cdc68], 0xf4f997f4
mov dword [0x11cdc6c], 0xb4f1f890
mov dword [0x11cdc70], 0xf1fdb5bf
mov dword [0x11cdc74], 0xa4b3b4b5
mov byte [0x11cdc78], 0xb6
mov byte [0x11cdc79], al
mov dword [0x11cdc7a], 0xb2b0a3a5
mov dword [0x11cdc7e], 0xb2b0b3b4
mov dword [0x11cdc82], 0xb8dbf8ba
mov dword [0x11cdc86], 0xbebff1b7
mov dword [0x11cdc8a], 0xf1a2f1a5
mov dword [0x11cdc8e], 0xbfb4b9a5
mov dword [0x11cdc92], 0xa5b4a3f1
mov dword [0x11cdc96], 0xf1bfa3a4
mov dword [0x11cdc9a], 0xfdbdb8bf
mov dword [0x11cdc9e], 0xb4f1a3f1
mov dword [0x11cdca2], 0xb8dbb5bf
mov dword [0x11cdca6], 0xf1a3f1b7
mov dword [0x11cdcaa], 0xbff1ecaf
mov dword [0x11cdcae], 0xa5f1bdb8
mov dword [0x11cdcb2], 0xf1bfb4b9
mov dword [0x11cdcb6], 0xf1ecf1a3
mov word [0x11cdcba], 0xbdbc
mov byte [0x11cdcbc], al
mov dword [0x11cdcbd], 0xa3a5a2a5
mov dword [0x11cdcc1], 0xf9b6bfb8
mov dword [0x11cdcc5], 0xb4f1f8a3
mov dword [0x11cdcc9], 0xa3dbb5bf
mov dword [0x11cdccd], 0xa3a4a5b4
mov dword [0x11cdcd1], 0xfda3f1bf
mov word [0x11cdcd5], 0xd1b4
xor eax, eax
mov cl, byte [eax + 0x11cdbe0]
xor cl, 0xd1
mov byte [eax + 0x11ce1d8], cl
inc eax
cmp eax, 0xf7
jb 0x1117b33
mov eax, 0x11ce1d8
ret