joyce8/EMBER2024-capa huggingface dataset:
Function at 0x111110c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x11111b9
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0x1111160
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x11111a8
mov esi, dword [ebp - 4]
jns 0x1111187
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x1111197
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0x1111169
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0x1111140
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x11111d2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov ebx, edx
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 0x18], ebx
push ebx
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0x1111024]
lea eax, [ebx - 1]
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0x1111254
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 1]
mov dword [ebp - 4], eax
sub edi, esi
lea ecx, [edi + eax]
mov eax, edx
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov al, byte [edx + esi]
mov esi, dword [ebp - 4]
mov byte [esi], al
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, 0xffffcfc7
mov byte [edx + esi], cl
imul edx, eax, 0xeeb9eb65
mov eax, dword [ebp - 4]
and edx, 0x7fffffff
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
dec ebx
jne 0x1111214
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x111253b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2e20], 1
mov ecx, 0xcfce
jne 0x11125c2
or dword [0x11d2e20], 1
lea eax, [ecx + 0x1d]
mov edx, eax
add eax, 0xffffffa7
mov word [0x11cc9d4], ax
mov word [0x11cc9c8], dx
add edx, 0xffffffaf
lea eax, [ecx - 0x24]
mov word [0x11cc9d6], ax
add eax, 0x11
mov word [0x11cc9d8], ax
mov word [0x11cc9ca], dx
lea edx, [ecx - 0x43]
lea eax, [ecx - 0x2b]
mov word [0x11cc9da], ax
mov word [0x11cc9cc], dx
add edx, 0xfffffff8
add eax, 0x1b
mov word [0x11cc9dc], ax
lea eax, [ecx - 0x3d]
mov word [0x11cc9de], ax
mov eax, ecx
mov word [0x11cc9ce], dx
mov dword [0x11cc9d0], 0xcfebcf9e
mov word [0x11cc9e0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11cc9c8]
add eax, 2
mov word [eax + 0x11cd072], dx
cmp eax, 0x1a
jb 0x11125c4
mov eax, 0x11cd074
ret

Function at 0x11125e2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2e18], 1
jne 0x1112610
or dword [0x11d2e18], 1
mov dword [0x11cc9f0], 0xaaa1a3f2
mov dword [0x11cc9f4], 0xf1aba2bb
mov dword [0x11cc9f8], 0xcef0f1f1
xor eax, eax
mov cl, byte [eax + 0x11cc9f0]
xor cl, 0xce
mov byte [eax + 0x11cd09c], cl
inc eax
cmp eax, 0xc
jb 0x1112612
mov eax, 0x11cd09c
ret

Function at 0x111262d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2e14], 1
mov edx, 0xcfce
jne 0x11126ed
push esi
lea ecx, [edx + 0x1e]
mov eax, ecx
mov word [0x11cc9fc], ax
add eax, 2
or dword [0x11d2e14], 1
mov word [0x11cc9fe], ax
lea eax, [edx + 0x15]
mov esi, eax
mov word [0x11cca00], si
mov word [0x11cca02], ax
add eax, 0xffffffca
mov word [0x11cca04], ax
lea eax, [edx - 0x12]
mov esi, eax
mov word [0x11cca06], si
add esi, 0xfffffff3
mov word [0x11cca08], si
lea esi, [edx - 0x11]
mov word [0x11cca0a], si
add esi, 0xffffffe9
mov word [0x11cca0c], si
lea esi, [edx - 0x3d]
mov word [0x11cca0e], si
mov esi, eax
mov word [0x11cca10], si
add esi, 0xffffffef
add eax, 0xfffffffe
mov word [0x11cca12], si
lea esi, [edx - 0x10]
mov word [0x11cca1a], ax
mov eax, edx
mov word [0x11cca14], si
mov dword [0x11cca16], 0xcfbccfa1
mov dword [0x11cca1c], 0xcfeccff3
mov word [0x11cca20], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x11cc9fc]
add eax, 2
mov word [eax + 0x11cd0a6], cx
cmp eax, 0x26
jb 0x11126ef
mov eax, 0x11cd0a8
ret
Function at 0x11127d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0x11d2e10], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0xcfce
jne 0x111280e
or dword [0x11d2e10], 1
lea eax, [ecx - 0x15]
mov word [0x11cca24], ax
add eax, 0xfffffff3
mov word [0x11cca26], ax
mov eax, ecx
mov word [0x11cca28], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x11cca24]
add eax, 2
mov word [eax + 0x11cd0ce], dx
cmp eax, 6
jb 0x1112812
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x1112835
mov eax, dword [eax]
push 0x11cd0d0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.011738b7
add esp, 0xc
test eax, eax
jne 0x1112900
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.01113563
push dword [esp + 0x10]
call fcn.01112909
push eax
call fcn.01173e11
push dword [esp + 0x18]
call fcn.0117439c
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.01176f70
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0x11a208c]
test eax, eax
jne 0x11128ee
call dword [0x11a20a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0113a918
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x11128d2
mov eax, dword [eax]
push eax
call fcn.01112949
push eax
call fcn.011740e0
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.01114ce5
jmp 0x1112900
push dword [esp + 0x18]
mov esi, dword [0x11a20bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1112909
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2e0c], 1
jne 0x111292c
or dword [0x11d2e0c], 1
mov dword [0x11cca2c], 0x808bc4c3
mov word [0x11cca30], 0xce8a
xor eax, eax
mov cl, byte [eax + 0x11cca2c]
xor cl, 0xce
mov byte [eax + 0x11cd0d8], cl
inc eax
cmp eax, 6
jb 0x111292e
mov eax, 0x11cd0d8
ret

Function at 0x1112949
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2e08], 1
jne 0x11129ce
or dword [0x11d2e08], 1
mov dword [0x11cca34], 0xa2a7af88
mov dword [0x11cca38], 0xbaeeaaab
mov dword [0x11cca3c], 0xbcadeea1
mov dword [0x11cca40], 0xabbaafab
mov dword [0x11cca44], 0xafbcadee
mov dword [0x11cca48], 0xbceea6bd
mov dword [0x11cca4c], 0xbca1beab
mov dword [0x11cca50], 0xeebcabba
mov dword [0x11cca54], 0xada1bcbe
mov dword [0x11cca58], 0xf4bdbdab
mov dword [0x11cca5c], 0xc4bdebee
mov byte [0x11cca60], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cca34]
xor cl, 0xce
mov byte [eax + 0x11cd0e0], cl
inc eax
cmp eax, 0x2d
jb 0x11129d0
mov eax, 0x11cd0e0
ret
Function at 0x1113a98
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2da8], 1
jne 0x1113acd
or dword [0x11d2da8], 1
mov dword [0x11ccce0], 0xbbaaa183
mov dword [0x11ccce4], 0xeef4aba2
mov dword [0x11ccce8], 0xc4c3bdeb
mov byte [0x11cccec], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccce0]
xor cl, 0xce
mov byte [eax + 0x11cd38c], cl
inc eax
cmp eax, 0xd
jb 0x1113acf
mov eax, 0x11cd38c
ret

Function at 0x1113aea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2da4], 1
jne 0x1113b29
or dword [0x11d2da4], 1
mov dword [0x11cccf0], 0xabbca69a
mov dword [0x11cccf4], 0xeef4aaaf
mov dword [0x11cccf8], 0xb6ebb6fe
mov dword [0x11cccfc], 0xc4c3c4c3
mov byte [0x11ccd00], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cccf0]
xor cl, 0xce
mov byte [eax + 0x11cd39c], cl
inc eax
cmp eax, 0x11
jb 0x1113b2b
mov eax, 0x11cd39c
ret

Function at 0x1113b46
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2da0], 1
jne 0x1113b84
or dword [0x11d2da0], 1
mov dword [0x11ccd04], 0xabadb68b
mov dword [0x11ccd08], 0xa1a7babe
mov dword [0x11ccd0c], 0xaaebeea0
mov word [0x11ccd10], 0xc4c3
mov byte [0x11ccd12], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccd04]
xor cl, 0xce
mov byte [eax + 0x11cd3b0], cl
inc eax
cmp eax, 0xf
jb 0x1113b86
mov eax, 0x11cd3b0
ret

Function at 0x1113ba1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d9c], 1
jne 0x1113bdf
or dword [0x11d2d9c], 1
mov dword [0x11ccd14], 0xafada182
mov dword [0x11ccd18], 0xa0a1a7ba
mov dword [0x11ccd1c], 0xbeebeef4
mov word [0x11ccd20], 0xc4c3
mov byte [0x11ccd22], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccd14]
xor cl, 0xce
mov byte [eax + 0x11cd3c0], cl
inc eax
cmp eax, 0xf
jb 0x1113be1
mov eax, 0x11cd3c0
ret

Function at 0x1113bfc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d98], 1
jne 0x1113c3d
or dword [0x11d2d98], 1
mov dword [0x11ccd24], 0xabbeb79a
mov dword [0x11ccd28], 0xbdebeef4
mov dword [0x11ccd2c], 0xb6fee6ee
mov dword [0x11ccd30], 0xc3e7b6eb
mov word [0x11ccd34], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x11ccd24]
xor cl, 0xce
mov byte [eax + 0x11cd3d0], cl
inc eax
cmp eax, 0x12
jb 0x1113c3f
mov eax, 0x11cd3d0
ret

Function at 0x1113c5a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d94], 1
jne 0x1113ce2
or dword [0x11d2d94], 1
mov dword [0x11ccd38], 0xafbaab8a
mov dword [0x11ccd3c], 0xf4bda2a7
mov dword [0x11ccd40], 0xa7bc9aee
mov dword [0x11ccd44], 0xbaeeaaab
mov dword [0x11ccd48], 0xabbceea1
mov dword [0x11ccd4c], 0xa8eeaaaf
mov dword [0x11ccd50], 0xeea3a1bc
mov dword [0x11ccd54], 0xa1a3aba3
mov dword [0x11ccd58], 0xafeeb7bc
mov dword [0x11ccd5c], 0xabbcaaaa
mov dword [0x11ccd60], 0xebeebdbd
mov dword [0x11ccd64], 0xcec4c3be
xor eax, eax
mov cl, byte [eax + 0x11ccd38]
xor cl, 0xce
mov byte [eax + 0x11cd3e4], cl
inc eax
cmp eax, 0x30
jb 0x1113ce4
mov eax, 0x11cd3e4
ret
Function at 0x1113cff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d90], 1
jne 0x1113d91
or dword [0x11d2d90], 1
mov dword [0x11ccd68], 0xafbaab8a
mov dword [0x11ccd6c], 0xf4bda2a7
mov dword [0x11ccd70], 0xa7bc9aee
mov dword [0x11ccd74], 0xbaeeaaab
mov dword [0x11ccd78], 0xbcb9eea1
mov dword [0x11ccd7c], 0xeeabbaa7
mov dword [0x11ccd80], 0xa3eea1ba
mov dword [0x11ccd84], 0xbca1a3ab
mov dword [0x11ccd88], 0xaaafeeb7
mov dword [0x11ccd8c], 0xbdabbcaa
mov dword [0x11ccd90], 0xbeebeebd
mov word [0x11ccd94], 0xc4c3
mov byte [0x11ccd96], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccd68]
xor cl, 0xce
mov byte [eax + 0x11cd414], cl
inc eax
cmp eax, 0x2f
jb 0x1113d93
mov eax, 0x11cd414
ret

Function at 0x1113dae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d8c], 1
jne 0x1113e41
or dword [0x11d2d8c], 1
mov dword [0x11ccd98], 0xafbaab8a
mov dword [0x11ccd9c], 0xf4bda2a7
mov dword [0x11ccda0], 0xa7bc9aee
mov dword [0x11ccda4], 0xbaeeaaab
mov dword [0x11ccda8], 0xb6abeea1
mov dword [0x11ccdac], 0xbabbadab
mov dword [0x11ccdb0], 0xaba3eeab
mov dword [0x11ccdb4], 0xb7bca1a3
mov dword [0x11ccdb8], 0xeebaafee
mov dword [0x11ccdbc], 0xbcaaaaaf
mov dword [0x11ccdc0], 0xeebdbdab
mov dword [0x11ccdc4], 0xc4c3beeb
mov byte [0x11ccdc8], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccd98]
xor cl, 0xce
mov byte [eax + 0x11cd444], cl
inc eax
cmp eax, 0x31
jb 0x1113e43
mov eax, 0x11cd444
ret

Function at 0x1113e5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d88], 1
jne 0x1113e95
or dword [0x11d2d88], 1
mov dword [0x11ccdcc], 0xa9afa288
mov dword [0x11ccdd0], 0xfeeef4bd
mov dword [0x11ccdd4], 0xc3b6ebb6
mov word [0x11ccdd8], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x11ccdcc]
xor cl, 0xce
mov byte [eax + 0x11cd478], cl
inc eax
cmp eax, 0xe
jb 0x1113e97
mov eax, 0x11cd478
ret

Function at 0x1113eb2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d84], 1
jne 0x1113ee9
or dword [0x11d2d84], 1
mov dword [0x11ccddc], 0xafbcaf9e
mov dword [0x11ccde0], 0xabbaaba3
mov dword [0x11ccde4], 0xc3f4bdbc
mov word [0x11ccde8], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x11ccddc]
xor cl, 0xce
mov byte [eax + 0x11cd488], cl
inc eax
cmp eax, 0xe
jb 0x1113eeb
mov eax, 0x11cd488
ret

Function at 0x1113f06
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d80], 1
jne 0x1113f4f
or dword [0x11d2d80], 1
mov dword [0x11ccdec], 0xbcaf9ec7
mov dword [0x11ccdf0], 0xbaaba3af
mov dword [0x11ccdf4], 0xeb95bcab
mov dword [0x11ccdf8], 0xeef493aa
mov dword [0x11ccdfc], 0xc4c3beeb
mov byte [0x11cce00], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccdec]
xor cl, 0xce
mov byte [eax + 0x11cd498], cl
inc eax
cmp eax, 0x15
jb 0x1113f51
mov eax, 0x11cd498
ret

Function at 0x1113f6c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d7c], 1
jne 0x1113fa4
or dword [0x11d2d7c], 1
mov dword [0x11cce04], 0xee868b9d
mov dword [0x11cce08], 0xa2afa08f
mov dword [0x11cce0c], 0xbda7bdb7
mov dword [0x11cce10], 0xcec4c3f4
xor eax, eax
mov cl, byte [eax + 0x11cce04]
xor cl, 0xce
mov byte [eax + 0x11cd4b0], cl
inc eax
cmp eax, 0x10
jb 0x1113fa6
mov eax, 0x11cd4b0
ret
Function at 0x1113fc1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d78], 1
jne 0x1114009
or dword [0x11d2d78], 1
mov dword [0x11cce14], 0xa4ac81c7
mov dword [0x11cce18], 0xeebaadab
mov dword [0x11cce1c], 0xabbeb7ba
mov dword [0x11cce20], 0xbdebeef4
mov word [0x11cce24], 0xc4c3
mov byte [0x11cce26], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cce14]
xor cl, 0xce
mov byte [eax + 0x11cd4c0], cl
inc eax
cmp eax, 0x13
jb 0x111400b
mov eax, 0x11cd4c0
ret

Function at 0x1114026
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d74], 1
jne 0x111408f
or dword [0x11d2d74], 1
mov dword [0x11cce28], 0xa7af88c7
mov dword [0x11cce2c], 0xeeaaaba2
mov dword [0x11cce30], 0xa8eea1ba
mov dword [0x11cce34], 0xa1a2a2a1
mov dword [0x11cce38], 0xa1beeeb9
mov dword [0x11cce3c], 0xabbaa0a7
mov dword [0x11cce40], 0xa6adeebc
mov dword [0x11cce44], 0xc3a0a7af
mov word [0x11cce48], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x11cce28]
xor cl, 0xce
mov byte [eax + 0x11cd4d4], cl
inc eax
cmp eax, 0x22
jb 0x1114091
mov eax, 0x11cd4d4
ret

Function at 0x11140ac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d70], 1
jne 0x11140cf
or dword [0x11d2d70], 1
mov dword [0x11cce4c], 0xaababd8e
mov word [0x11cce50], 0xce8e
xor eax, eax
mov cl, byte [eax + 0x11cce4c]
xor cl, 0xce
mov byte [eax + 0x11cd4f8], cl
inc eax
cmp eax, 6
jb 0x11140d1
mov eax, 0x11cd4f8
ret

Function at 0x11140ec
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d6c], 1
jne 0x1114123
or dword [0x11d2d6c], 1
mov dword [0x11cce54], 0xbaa0bbbc
mov dword [0x11cce58], 0x91aba3a7
mov dword [0x11cce5c], 0xa1bcbcab
mov word [0x11cce60], 0xcebc
xor eax, eax
mov cl, byte [eax + 0x11cce54]
xor cl, 0xce
mov byte [eax + 0x11cd500], cl
inc eax
cmp eax, 0xe
jb 0x1114125
mov eax, 0x11cd500
ret

Function at 0x1114140
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d68], 1
jne 0x111416e
or dword [0x11d2d68], 1
mov dword [0x11cce64], 0xa9a0afbc
mov dword [0x11cce68], 0xbcab91ab
mov dword [0x11cce6c], 0xcebca1bc
xor eax, eax
mov cl, byte [eax + 0x11cce64]
xor cl, 0xce
mov byte [eax + 0x11cd510], cl
inc eax
cmp eax, 0xc
jb 0x1114170
mov eax, 0x11cd510
ret

Function at 0x111418b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d64], 1
jne 0x11141c9
or dword [0x11d2d64], 1
mov dword [0x11cce70], 0xbcabb8a1
mov dword [0x11cce74], 0xb9a1a2a8
mov dword [0x11cce78], 0xbcbcab91
mov word [0x11cce7c], 0xbca1
mov byte [0x11cce7e], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cce70]
xor cl, 0xce
mov byte [eax + 0x11cd51c], cl
inc eax
cmp eax, 0xf
jb 0x11141cb
mov eax, 0x11cd51c
ret

Function at 0x11141e6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d60], 1
jne 0x111421e
or dword [0x11d2d60], 1
mov dword [0x11cce80], 0xabaaa0bb
mov dword [0x11cce84], 0xa1a2a8bc
mov dword [0x11cce88], 0xbcab91b9
mov dword [0x11cce8c], 0xcebca1bc
xor eax, eax
mov cl, byte [eax + 0x11cce80]
xor cl, 0xce
mov byte [eax + 0x11cd52c], cl
inc eax
cmp eax, 0x10
jb 0x1114220
mov eax, 0x11cd52c
ret
Function at 0x111423b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d5c], 1
jne 0x1114269
or dword [0x11d2d5c], 1
mov dword [0x11cce90], 0xa7a9a1a2
mov dword [0x11cce94], 0xbcab91ad
mov dword [0x11cce98], 0xcebca1bc
xor eax, eax
mov cl, byte [eax + 0x11cce90]
xor cl, 0xce
mov byte [eax + 0x11cd53c], cl
inc eax
cmp eax, 0xc
jb 0x111426b
mov eax, 0x11cd53c
ret

Function at 0x1114286
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d58], 1
jne 0x11142bb
or dword [0x11d2d58], 1
mov dword [0x11cce9c], 0xafa3a1aa
mov dword [0x11ccea0], 0xab91a0a7
mov dword [0x11ccea4], 0xbca1bcbc
mov byte [0x11ccea8], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cce9c]
xor cl, 0xce
mov byte [eax + 0x11cd548], cl
inc eax
cmp eax, 0xd
jb 0x11142bd
mov eax, 0x11cd548
ret

Function at 0x11142d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d54], 1
jne 0x1114317
or dword [0x11d2d54], 1
mov dword [0x11cceac], 0xafb8a0a7
mov dword [0x11cceb0], 0x91aaa7a2
mov dword [0x11cceb4], 0xbba9bcaf
mov dword [0x11cceb8], 0xbaa0aba3
mov byte [0x11ccebc], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cceac]
xor cl, 0xce
mov byte [eax + 0x11cd558], cl
inc eax
cmp eax, 0x11
jb 0x1114319
mov eax, 0x11cd558
ret

Function at 0x1114334
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d50], 1
jne 0x1114369
or dword [0x11d2d50], 1
mov dword [0x11ccec0], 0xa9a0aba2
mov dword [0x11ccec4], 0xab91a6ba
mov dword [0x11ccec8], 0xbca1bcbc
mov byte [0x11ccecc], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccec0]
xor cl, 0xce
mov byte [eax + 0x11cd56c], cl
inc eax
cmp eax, 0xd
jb 0x111436b
mov eax, 0x11cd56c
ret

Function at 0x1114386
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d4c], 1
jne 0x11143bb
or dword [0x11d2d4c], 1
mov dword [0x11cced0], 0x91babba1
mov dword [0x11cced4], 0xbc91a8a1
mov dword [0x11cced8], 0xaba9a0af
mov byte [0x11ccedc], 0xce
xor eax, eax
mov cl, byte [eax + 0x11cced0]
xor cl, 0xce
mov byte [eax + 0x11cd57c], cl
inc eax
cmp eax, 0xd
jb 0x11143bd
mov eax, 0x11cd57c
ret

Function at 0x11143d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d48], 1
jne 0x1114405
or dword [0x11d2d48], 1
mov dword [0x11ccee0], 0xabadb6ab
mov dword [0x11ccee4], 0xa1a7babe
mov word [0x11ccee8], 0xcea0
xor eax, eax
mov cl, byte [eax + 0x11ccee0]
xor cl, 0xce
mov byte [eax + 0x11cd58c], cl
inc eax
cmp eax, 0xa
jb 0x1114407
mov eax, 0x11cd58c
ret

Function at 0x1114422
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d44], 1
jne 0x1114481
or dword [0x11d2d44], 1
mov dword [0x11cceec], 0xaababdc7
mov dword [0x11ccef0], 0xb6abf4f4
mov dword [0x11ccef4], 0xbabeabad
mov dword [0x11ccef8], 0xf4a0a1a7
mov dword [0x11ccefc], 0xafa6b9f4
mov dword [0x11ccf00], 0xf4e7e6ba
mov dword [0x11ccf04], 0xc3bdebee
mov word [0x11ccf08], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x11cceec]
xor cl, 0xce
mov byte [eax + 0x11cd598], cl
inc eax
cmp eax, 0x1e
jb 0x1114483
mov eax, 0x11cd598
ret
Function at 0x111449e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d40], 1
jne 0x1114512
or dword [0x11d2d40], 1
mov dword [0x11ccf0c], 0xa7af88c7
mov dword [0x11ccf10], 0xeeaaaba2
mov dword [0x11ccf14], 0xa9eea1ba
mov dword [0x11ccf18], 0xbdeebaab
mov dword [0x11ccf1c], 0xf4f4aaba
mov dword [0x11ccf20], 0xabadb6ab
mov dword [0x11ccf24], 0xa1a7babe
mov dword [0x11ccf28], 0xb9f4f4a0
mov dword [0x11ccf2c], 0xe6baafa6
mov dword [0x11ccf30], 0xcec4c3e7
xor eax, eax
mov cl, byte [eax + 0x11ccf0c]
xor cl, 0xce
mov byte [eax + 0x11cd5b8], cl
inc eax
cmp eax, 0x28
jb 0x1114514
mov eax, 0x11cd5b8
ret

Function at 0x111452f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d3c], 1
jne 0x1114563
or dword [0x11d2d3c], 1
mov dword [0x11ccf34], 0xa3a1ad91
mov dword [0x11ccf38], 0xbcbcab91
mov word [0x11ccf3c], 0xbca1
mov byte [0x11ccf3e], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccf34]
xor cl, 0xce
mov byte [eax + 0x11cd5e0], cl
inc eax
cmp eax, 0xb
jb 0x1114565
mov eax, 0x11cd5e0
ret

Function at 0x1114580
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d38], 1
jne 0x11145e9
or dword [0x11d2d38], 1
mov dword [0x11ccf40], 0xa1ad91c7
mov dword [0x11ccf44], 0xbcab91a3
mov dword [0x11ccf48], 0xf4bca1bc
mov dword [0x11ccf4c], 0xbcbc8bf4
mov dword [0x11ccf50], 0xab83bca1
mov dword [0x11ccf54], 0xa9afbdbd
mov dword [0x11ccf58], 0xf4e7e6ab
mov dword [0x11ccf5c], 0xc3bdebee
mov word [0x11ccf60], 0xcec4
xor eax, eax
mov cl, byte [eax + 0x11ccf40]
xor cl, 0xce
mov byte [eax + 0x11cd5ec], cl
inc eax
cmp eax, 0x22
jb 0x11145eb
mov eax, 0x11cd5ec
ret

Function at 0x1114606
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d34], 1
jne 0x1114684
or dword [0x11d2d34], 1
mov dword [0x11ccf64], 0xa7af88c7
mov dword [0x11ccf68], 0xeeaaaba2
mov dword [0x11ccf6c], 0xa9eea1ba
mov dword [0x11ccf70], 0x91eebaab
mov dword [0x11ccf74], 0x91a3a1ad
mov dword [0x11ccf78], 0xa1bcbcab
mov dword [0x11ccf7c], 0x8bf4f4bc
mov dword [0x11ccf80], 0xbca1bcbc
mov dword [0x11ccf84], 0xbdbdab83
mov dword [0x11ccf88], 0xe6aba9af
mov dword [0x11ccf8c], 0xcec4c3e7
xor eax, eax
mov cl, byte [eax + 0x11ccf64]
xor cl, 0xce
mov byte [eax + 0x11cd610], cl
inc eax
cmp eax, 0x2c
jb 0x1114686
mov eax, 0x11cd610
ret

Function at 0x11146a1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x11d2d30], 1
jne 0x111471c
or dword [0x11d2d30], 1
mov dword [0x11ccf90], 0xadafba9d
mov dword [0x11ccf94], 0xbbaaeea5
mov dword [0x11ccf98], 0xabeebea3
mov dword [0x11ccf9c], 0xbca1bcbc
mov dword [0x11ccfa0], 0xa18deef4
mov dword [0x11ccfa4], 0xb6abbaa0
mov dword [0x11ccfa8], 0xadab9cba
mov dword [0x11ccfac], 0xeeaabca1
mov dword [0x11ccfb0], 0xeebdafb9
mov dword [0x11ccfb4], 0xa2a2bba0
mov byte [0x11ccfb8], 0xce
xor eax, eax
mov cl, byte [eax + 0x11ccf90]
xor cl, 0xce
mov byte [eax + 0x11cd63c], cl
inc eax
cmp eax, 0x29
jb 0x111471e
mov eax, 0x11cd63c
ret