joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10d6391
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192ce8], 1
jne 0x10d63e6
or dword [0x1192ce8], 1
mov dword [0x118d7a8], 0xd8fcd9e3
mov dword [0x118d7ac], 0xe4d4dfc8
mov dword [0x118d7b0], 0xdfc2cbc3
mov dword [0x118d7b4], 0xc4d9ccc0
mov dword [0x118d7b8], 0xdffdc3c2
mov dword [0x118d7bc], 0xdec8cec2
mov word [0x118d7c0], 0xadde
xor eax, eax
mov cl, byte [eax + 0x118d7a8]
xor cl, 0xad
mov byte [eax + 0x118d9a8], cl
inc eax
cmp eax, 0x1a
jb 0x10d63e8
mov eax, 0x118d9a8
ret

Function at 0x10d6403
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192ce4], 1
jne 0x10d6499
or dword [0x1192ce4], 1
mov dword [0x118d7c4], 0xfdd9c8ea
mov dword [0x118d7c8], 0xeccec2df
mov dword [0x118d7cc], 0xc8dfc9c9
mov dword [0x118d7d0], 0xcb8ddede
mov dword [0x118d7d4], 0xc8c1c4cc
mov dword [0x118d7d8], 0xe3858dc9
mov dword [0x118d7dc], 0xc8d8fcd9
mov dword [0x118d7e0], 0xc3e4d4df
mov dword [0x118d7e4], 0xc0dfc2cb
mov dword [0x118d7e8], 0xc2c4d9cc
mov dword [0x118d7ec], 0xc2dffdc3
mov dword [0x118d7f0], 0xdedec8ce
mov dword [0x118d7f4], 0xad8d9784
xor eax, eax
mov cl, byte [eax + 0x118d7c4]
xor cl, 0xad
mov byte [eax + 0x118d9c4], cl
inc eax
cmp eax, 0x34
jb 0x10d649b
mov eax, 0x118d9c4
ret

Function at 0x10d64b6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192ce0], 1
jne 0x10d6526
or dword [0x1192ce0], 1
mov dword [0x118d7f8], 0xd8fcd9e3
mov dword [0x118d7fc], 0xe4d4dfc8
mov dword [0x118d800], 0xdfc2cbc3
mov dword [0x118d804], 0xc4d9ccc0
mov dword [0x118d808], 0xdffdc3c2
mov dword [0x118d80c], 0xdec8cec2
mov dword [0x118d810], 0xcccb8dde
mov dword [0x118d814], 0xc9c8c1c4
mov word [0x118d818], 0x8d97
mov byte [0x118d81a], 0xad
xor eax, eax
mov cl, byte [eax + 0x118d7f8]
xor cl, 0xad
mov byte [eax + 0x118d9f8], cl
inc eax
cmp eax, 0x23
jb 0x10d6528
mov eax, 0x118d9f8
ret

Function at 0x10d6543
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cdc], 1
jne 0x10d658c
or dword [0x1192cdc], 1
mov dword [0x118d81c], 0xc3c8dde2
mov dword [0x118d820], 0xcec2dffd
mov dword [0x118d824], 0x8ddedec8
mov dword [0x118d828], 0xc1c4cccb
mov dword [0x118d82c], 0x8d97c9c8
mov byte [0x118d830], 0xad
xor eax, eax
mov cl, byte [eax + 0x118d81c]
xor cl, 0xad
mov byte [eax + 0x118da1c], cl
inc eax
cmp eax, 0x15
jb 0x10d658e
mov eax, 0x118da1c
ret
Function at 0x10d65a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x115b26a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x1192cd8], 1
push esi
push edi
jne 0x10d6606
or dword [0x1192cd8], 1
mov dword [0x118d834], 0xc3dfc8c6
mov dword [0x118d838], 0x9f9ec1c8
mov dword [0x118d83c], 0xc1c1c983
mov byte [0x118d840], 0xad
xor eax, eax
mov cl, byte [eax + 0x118d834]
xor cl, 0xad
mov byte [eax + 0x118da34], cl
inc eax
cmp eax, 0xd
jb 0x10d6608
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x118da34
call edi
mov esi, eax
test esi, esi
jne 0x10d667c
call dword [0x11620a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.010fa914
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.010d67de
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.010d6b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.010d5c65
push 0x117ec28
mov eax, esi
push eax
call fcn.0113d8b5
call fcn.010d685b
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x10d6749
call fcn.010d68ce
push eax
call edi
mov edi, eax
test edi, edi
jne 0x10d66ed
call dword [0x11620a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.010fa914
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.010d6918
push eax
lea eax, [esp + 0x20]
push eax
call fcn.010d6b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.010d5c65
push 0x117ec28
mov eax, esi
jmp 0x10d6676
call fcn.010d6992
push eax
push edi
call esi
test eax, eax
jne 0x10d6749
call dword [0x11620a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.010fa914
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.010d6a02
push eax
lea eax, [esp + 0x20]
push eax
call fcn.010d6b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.010d5c65
push 0x117ec28
mov eax, esi
jmp 0x10d6676
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x10d67ab
call dword [0x11620a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.010fa914
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.010d6abb
push eax
lea eax, [esp + 0x20]
push eax
call fcn.010d6b7c
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.010d5c65
push 0x117ec28
mov eax, esi
jmp 0x10d6676
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.010d4d60
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10d67de
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cd4], 1
jne 0x10d683e
or dword [0x1192cd4], 1
mov dword [0x118d844], 0xc9ccc2e1
mov dword [0x118d848], 0xdfcfc4e1
mov dword [0x118d84c], 0x8dd4dfcc
mov dword [0x118d850], 0xc1c4cccb
mov dword [0x118d854], 0x858dc9c8
mov dword [0x118d858], 0xc3dfc8c6
mov dword [0x118d85c], 0x9f9ec1c8
mov dword [0x118d860], 0xad8d9784
xor eax, eax
mov cl, byte [eax + 0x118d844]
xor cl, 0xad
mov byte [eax + 0x118da44], cl
inc eax
cmp eax, 0x20
jb 0x10d6840
mov eax, 0x118da44
ret

Function at 0x10d685b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cd0], 1
jne 0x10d68b1
or dword [0x1192cd0], 1
mov dword [0x118d864], 0xea9f9ee6
mov dword [0x118d868], 0xdffdd9c8
mov dword [0x118d86c], 0xdec8cec2
mov dword [0x118d870], 0xccc0e4de
mov dword [0x118d874], 0xc4ebc8ca
mov dword [0x118d878], 0xcce3c8c1
mov dword [0x118d87c], 0xadecc8c0
xor eax, eax
mov cl, byte [eax + 0x118d864]
xor cl, 0xad
mov byte [eax + 0x118da64], cl
inc eax
cmp eax, 0x1c
jb 0x10d68b3
mov eax, 0x118da64
ret

Function at 0x10d68ce
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192ccc], 1
jne 0x10d68fb
or dword [0x1192ccc], 1
mov dword [0x118d880], 0xddccdedd
mov dword [0x118d884], 0xc1c983c4
mov word [0x118d888], 0xadc1
xor eax, eax
mov cl, byte [eax + 0x118d880]
xor cl, 0xad
mov byte [eax + 0x118da80], cl
inc eax
cmp eax, 0xa
jb 0x10d68fd
mov eax, 0x118da80
ret

Function at 0x10d6918
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cc8], 1
jne 0x10d6975
or dword [0x1192cc8], 1
mov dword [0x118d88c], 0xc9ccc2e1
mov dword [0x118d890], 0xdfcfc4e1
mov dword [0x118d894], 0x8dd4dfcc
mov dword [0x118d898], 0xc1c4cccb
mov dword [0x118d89c], 0x858dc9c8
mov dword [0x118d8a0], 0xddccdedd
mov dword [0x118d8a4], 0x8d9784c4
mov byte [0x118d8a8], 0xad
xor eax, eax
mov cl, byte [eax + 0x118d88c]
xor cl, 0xad
mov byte [eax + 0x118da8c], cl
inc eax
cmp eax, 0x1d
jb 0x10d6977
mov eax, 0x118da8c
ret

Function at 0x10d6992
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cc4], 1
jne 0x10d69e5
or dword [0x1192cc4], 1
mov dword [0x118d8ac], 0xfdd9c8ea
mov dword [0x118d8b0], 0xc8cec2df
mov dword [0x118d8b4], 0xc0e4dede
mov dword [0x118d8b8], 0xebc8cacc
mov dword [0x118d8bc], 0xe3c8c1c4
mov dword [0x118d8c0], 0xecc8c0cc
mov byte [0x118d8c4], 0xad
xor eax, eax
mov cl, byte [eax + 0x118d8ac]
xor cl, 0xad
mov byte [eax + 0x118daac], cl
inc eax
cmp eax, 0x19
jb 0x10d69e7
mov eax, 0x118daac
ret
Function at 0x10d6a02
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cc0], 1
jne 0x10d6a9e
or dword [0x1192cc0], 1
mov dword [0x118d8c8], 0xfdd9c8ea
mov dword [0x118d8cc], 0xeccec2df
mov dword [0x118d8d0], 0xc8dfc9c9
mov dword [0x118d8d4], 0xcb8ddede
mov dword [0x118d8d8], 0xc8c1c4cc
mov dword [0x118d8dc], 0xea858dc9
mov dword [0x118d8e0], 0xdffdd9c8
mov dword [0x118d8e4], 0xdec8cec2
mov dword [0x118d8e8], 0xccc0e4de
mov dword [0x118d8ec], 0xc4ebc8ca
mov dword [0x118d8f0], 0xcce3c8c1
mov dword [0x118d8f4], 0x84ecc8c0
mov word [0x118d8f8], 0x8d97
mov byte [0x118d8fa], 0xad
xor eax, eax
mov cl, byte [eax + 0x118d8c8]
xor cl, 0xad
mov byte [eax + 0x118dac8], cl
inc eax
cmp eax, 0x33
jb 0x10d6aa0
mov eax, 0x118dac8
ret

Function at 0x10d6abb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cbc], 1
jne 0x10d6b22
or dword [0x1192cbc], 1
mov dword [0x118d8fc], 0xfdd9c8ea
mov dword [0x118d900], 0xc8cec2df
mov dword [0x118d904], 0xc0e4dede
mov dword [0x118d908], 0xebc8cacc
mov dword [0x118d90c], 0xc3c8c1c4
mov dword [0x118d910], 0x8dc8c0cc
mov dword [0x118d914], 0xc1c4cccb
mov dword [0x118d918], 0x8d97c9c8
mov byte [0x118d91c], 0xad
xor eax, eax
mov cl, byte [eax + 0x118d8fc]
xor cl, 0xad
mov byte [eax + 0x118dafc], cl
inc eax
cmp eax, 0x21
jb 0x10d6b24
mov eax, 0x118dafc
ret

Function at 0x10d76d5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cb8], 1
jne 0x10d78bb
or dword [0x1192cb8], 1
mov dword [0x118db28], 0xdd80c1c7
mov dword [0x118db2c], 0xdbc1cada
mov dword [0x118db30], 0xcbdd94da
mov dword [0x118db34], 0xdbccd8da
mov dword [0x118db38], 0xc08986c8
mov dword [0x118db3c], 0xa48789c1
mov dword [0x118db40], 0xc5cdcfde
mov dword [0x118db44], 0x80cbc9cf
mov dword [0x118db48], 0xc6dacfde
mov dword [0x118db4c], 0x898e938e
mov dword [0x118db50], 0xcbdca489
mov dword [0x118db54], 0xdcc7dbdf
mov dword [0x118db58], 0xdd8986cb
mov dword [0x118db5c], 0xcdc7dcda
mov dword [0x118db60], 0xa48789da
mov dword [0x118db64], 0xcfcdc1c2
mov dword [0x118db68], 0x82dd8ec2
mov dword [0x118db6c], 0x938edc8e
mov dword [0x118db70], 0xcdded68e
mov dword [0x118db74], 0x86c2c2cf
mov dword [0x118db78], 0xcdc0dbc8
mov dword [0x118db7c], 0xc0c1c7da
mov dword [0x118db80], 0xdc8e8786
mov dword [0x118db84], 0xdcdbdacb
mov dword [0x118db88], 0xcbdc8ec0
mov dword [0x118db8c], 0xdcc7dbdf
mov dword [0x118db90], 0x8b8986cb
mov dword [0x118db94], 0x808789e3
mov dword [0x118db98], 0xc0c7cfc3
mov dword [0x118db9c], 0xcff1f186
mov dword [0x118dba0], 0x87ddc9dc
mov dword [0x118dba4], 0xcac0cb8e
mov dword [0x118dba8], 0xcbca8e82
mov dword [0x118dbac], 0x80c9dbcc
mov dword [0x118dbb0], 0xcdcfdcda
mov dword [0x118dbb4], 0xcdcfcccb
mov dword [0x118dbb8], 0xc7a487c5
mov dword [0x118dbbc], 0xc1c08ec8
mov dword [0x118dbc0], 0x8edd8eda
mov dword [0x118dbc4], 0xc0cbc6da
mov dword [0x118dbc8], 0xdcdccb8e
mov dword [0x118dbcc], 0xdc86dcc1
mov dword [0x118dbd0], 0xc0cb8e87
mov dword [0x118dbd4], 0xcbdca4ca
mov dword [0x118dbd8], 0xc0dcdbda
mov word [0x118dbdc], 0xdc8e
mov byte [0x118dbde], 0xae
xor eax, eax
mov cl, byte [eax + 0x118db28]
xor cl, 0xae
mov byte [eax + 0x118e120], cl
inc eax
cmp eax, 0xb7
jb 0x10d78bd
mov eax, 0x118e120
ret
Function at 0x10d78da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192cb4], 1
jne 0x10d7b60
or dword [0x1192cb4], 1
mov dword [0x118dbe0], 0xdd80c1c7
mov dword [0x118dbe4], 0xdbc1cada
mov dword [0x118dbe8], 0xcbdd94da
mov dword [0x118dbec], 0xdbccd8da
mov dword [0x118dbf0], 0xc08986c8
mov dword [0x118dbf4], 0xa48789c1
mov dword [0x118dbf8], 0xc5cdcfde
mov dword [0x118dbfc], 0x80cbc9cf
mov dword [0x118dc00], 0xc6dacfde
mov dword [0x118dc04], 0xa4898993
mov dword [0x118dc08], 0xdbdfcbdc
mov dword [0x118dc0c], 0x86cbdcc7
mov dword [0x118dc10], 0xdcdadd89
mov dword [0x118dc14], 0x89dacdc7
mov dword [0x118dc18], 0xc1c2a487
mov dword [0x118dc1c], 0x8ec2cfcd
mov dword [0x118dc20], 0x938ec2c3
mov dword [0x118dc24], 0xdfcbdc8e
mov dword [0x118dc28], 0xcbdcc7db
mov dword [0x118dc2c], 0xc2c38986
mov dword [0x118dc30], 0xc2a48789
mov dword [0x118dc34], 0xc2cfcdc1
mov dword [0x118dc38], 0xdc82dd8e
mov dword [0x118dc3c], 0x938ecb82
mov dword [0x118dc40], 0xcdded68e
mov dword [0x118dc44], 0x86c2c2cf
mov dword [0x118dc48], 0xcdc0dbc8
mov dword [0x118dc4c], 0xc0c1c7da
mov dword [0x118dc50], 0xdc8e8786
mov dword [0x118dc54], 0xdcdbdacb
mov dword [0x118dc58], 0xcbdc8ec0
mov dword [0x118dc5c], 0xdcc7dbdf
mov dword [0x118dc60], 0x8b8986cb
mov dword [0x118dc64], 0x808789e3
mov dword [0x118dc68], 0x8b86e88b
mov dword [0x118dc6c], 0xcb8e87ef
mov dword [0x118dc70], 0x8e82cac0
mov dword [0x118dc74], 0xdbcccbca
mov dword [0x118dc78], 0xdcda80c9
mov dword [0x118dc7c], 0xcccbcdcf
mov dword [0x118dc80], 0x87c5cdcf
mov dword [0x118dc84], 0x8ec8c7a4
mov dword [0x118dc88], 0x8edac1c0
mov dword [0x118dc8c], 0xc6da8edd
mov dword [0x118dc90], 0xdc8ec0cb
mov dword [0x118dc94], 0xdcdbdacb
mov dword [0x118dc98], 0xc7c08ec0
mov dword [0x118dc9c], 0xdc8e82c2
mov dword [0x118dca0], 0xcac0cb8e
mov dword [0x118dca4], 0x8ec8c7a4
mov dword [0x118dca8], 0x93d08edc
mov dword [0x118dcac], 0xc2c7c08e
mov dword [0x118dcb0], 0xcbc6da8e
mov dword [0x118dcb4], 0x8edc8ec0
mov dword [0x118dcb8], 0xc2c38e93
mov dword [0x118dcbc], 0xdaddda80
mov dword [0x118dcc0], 0xc9c0c7dc
mov dword [0x118dcc4], 0x8e87dc86
mov dword [0x118dcc8], 0xa4cac0cb
mov dword [0x118dccc], 0xdbdacbdc
mov dword [0x118dcd0], 0xdc8ec0dc
mov word [0x118dcd4], 0xcb82
mov byte [0x118dcd6], 0xae
xor eax, eax
mov cl, byte [eax + 0x118dbe0]
xor cl, 0xae
mov byte [eax + 0x118e1d8], cl
inc eax
cmp eax, 0xf7
jb 0x10d7b62
mov eax, 0x118e1d8
ret
Function at 0x10d7b7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x1192c74], 1
jne 0x10d7ba6
or dword [0x1192c74], 1
mov dword [0x118ddcc], 0xc5cdcfde
mov dword [0x118ddd0], 0xaecbc9cf
xor eax, eax
mov cl, byte [eax + 0x118ddcc]
xor cl, 0xae
mov byte [eax + 0x118e3c4], cl
inc eax
cmp eax, 8
jb 0x10d7ba8
push 0x118e3c4
push dword [ebp + 8]
call fcn.01120bd8
test byte [0x1192c70], 1
pop ecx
pop ecx
jne 0x10d7bf0
or dword [0x1192c70], 1
mov dword [0x118ddd4], 0xc2cbdcde
mov dword [0x118ddd8], 0xaecacfc1
xor eax, eax
mov cl, byte [eax + 0x118ddd4]
xor cl, 0xae
mov byte [eax + 0x118e3cc], cl
inc eax
cmp eax, 8
jb 0x10d7bf2
push esi
push 0x118e3cc
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.01120c4c
add esp, 0xc
cmp dword [0x1188be0], 0
mov esi, 0x1188be0
je 0x10d7c52
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.01120af8
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.01120e79
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x10d7c2b
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.0112034d
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x10d7ecc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x115ac94
call fcn.01159c78
sub esp, 0x64
test byte [0x1192c5c], 1
jne 0x10d7ef9
or dword [0x1192c5c], 1
mov word [0x118de04], 0xe38b
mov byte [0x118de06], 0xae
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x118de04]
xor cl, 0xae
mov byte [eax + 0x118e3fc], cl
inc eax
cmp eax, 3
jb 0x10d7f00
mov esi, 0x118e3fc
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10d7f2c
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.010d4ceb
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.010dd0c8
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.010d4d81
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x10d7f73
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.0111f74b
pop ecx
pop ecx
cmp eax, ebx
je 0x10d7fc4
cmp eax, 3
jne 0x10d7fb1
call fcn.010d80cb
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.01133995
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x117ec28
lea eax, [ebp - 0x1c]
push eax
call fcn.0113d8b5
cmp eax, 4
jne 0x10d7fbd
call fcn.010d817e
jmp 0x10d7f8d
call fcn.010d8231
jmp 0x10d7f8d
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.01121181
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x10d807b
push ebx
call fcn.010d82b5
push eax
push 0xffffffffffffffff
push esi
call fcn.0111fee2
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.010d4d60
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x10d8033
call fcn.010d82fc
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.010dd139
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.010d5c65
jmp 0x10d7fa3
cmp edi, 4
jne 0x10d8052
call fcn.010d835b
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.010dd139
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x10d8026
cmp edi, 6
jne 0x10d8071
call fcn.010d83c0
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.010dd139
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x10d8026
call fcn.010d8444
jmp 0x10d7f8d
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.0112053d
pop ecx
pop ecx
test eax, eax
je 0x10d809c
push ebx
push edi
push esi
call fcn.01120701
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.01120337
sub edi, eax
push edi
push esi
call fcn.0112034d
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.010d4d81
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10d80cb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c58], 1
jne 0x10d8161
or dword [0x1192c58], 1
mov dword [0x118de08], 0xc2c7cfe8
mov dword [0x118de0c], 0xda8ecacb
mov dword [0x118de10], 0xd8cb8ec1
mov dword [0x118de14], 0xcfdbc2cf
mov dword [0x118de18], 0xcc8ecbda
mov dword [0x118de1c], 0xdddac1c1
mov dword [0x118de20], 0xdecfdcda
mov dword [0x118de24], 0xcfdcc88e
mov dword [0x118de28], 0xc0cbc3c9
mov dword [0x118de2c], 0xdd8e82da
mov dword [0x118de30], 0xcfdac0d7
mov dword [0x118de34], 0xdccb8ed6
mov dword [0x118de38], 0xaedcc1dc
xor eax, eax
mov cl, byte [eax + 0x118de08]
xor cl, 0xae
mov byte [eax + 0x118e400], cl
inc eax
cmp eax, 0x34
jb 0x10d8163
mov eax, 0x118e400
ret

Function at 0x10d817e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c54], 1
jne 0x10d8214
or dword [0x1192c54], 1
mov dword [0x118de3c], 0xc2c7cfe8
mov dword [0x118de40], 0xda8ecacb
mov dword [0x118de44], 0xd8cb8ec1
mov dword [0x118de48], 0xcfdbc2cf
mov dword [0x118de4c], 0xcc8ecbda
mov dword [0x118de50], 0xdddac1c1
mov dword [0x118de54], 0xdecfdcda
mov dword [0x118de58], 0xcfdcc88e
mov dword [0x118de5c], 0xc0cbc3c9
mov dword [0x118de60], 0xc38e82da
mov dword [0x118de64], 0xdcc1c3cb
mov dword [0x118de68], 0xdccb8ed7
mov dword [0x118de6c], 0xaedcc1dc
xor eax, eax
mov cl, byte [eax + 0x118de3c]
xor cl, 0xae
mov byte [eax + 0x118e434], cl
inc eax
cmp eax, 0x34
jb 0x10d8216
mov eax, 0x118e434
ret

Function at 0x10d8231
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c50], 1
jne 0x10d8298
or dword [0x1192c50], 1
mov dword [0x118de70], 0xc0c5c0fb
mov dword [0x118de74], 0x8ec0d9c1
mov dword [0x118de78], 0xc1dcdccb
mov dword [0x118de7c], 0xc0c78edc
mov dword [0x118de80], 0xcfdbc28e
mov dword [0x118de84], 0xc1c2f1e2
mov dword [0x118de88], 0xdaddcacf
mov dword [0x118de8c], 0xc9c0c7dc
mov byte [0x118de90], 0xae
xor eax, eax
mov cl, byte [eax + 0x118de70]
xor cl, 0xae
mov byte [eax + 0x118e468], cl
inc eax
cmp eax, 0x21
jb 0x10d829a
mov eax, 0x118e468
ret

Function at 0x10d82b5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c4c], 1
jne 0x10d82df
or dword [0x1192c4c], 1
mov dword [0x118de94], 0xc0c1c092
mov word [0x118de98], 0x90cb
mov byte [0x118de9a], 0xae
xor eax, eax
mov cl, byte [eax + 0x118de94]
xor cl, 0xae
mov byte [eax + 0x118e48c], cl
inc eax
cmp eax, 7
jb 0x10d82e1
mov eax, 0x118e48c
ret

Function at 0x10d82fc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c48], 1
jne 0x10d833e
or dword [0x1192c48], 1
mov dword [0x118de9c], 0x8ecfdbe2
mov dword [0x118dea0], 0xdac0dbdc
mov dword [0x118dea4], 0x8ecbc3c7
mov dword [0x118dea8], 0xc1dcdccb
mov dword [0x118deac], 0xae8e94dc
xor eax, eax
mov cl, byte [eax + 0x118de9c]
xor cl, 0xae
mov byte [eax + 0x118e494], cl
inc eax
cmp eax, 0x14
jb 0x10d8340
mov eax, 0x118e494
ret
Function at 0x10d835b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c44], 1
jne 0x10d83a3
or dword [0x1192c44], 1
mov dword [0x118deb0], 0x8ecfdbe2
mov dword [0x118deb4], 0xc1c3cbc3
mov dword [0x118deb8], 0xcb8ed7dc
mov dword [0x118debc], 0xdcc1dcdc
mov word [0x118dec0], 0x8e94
mov byte [0x118dec2], 0xae
xor eax, eax
mov cl, byte [eax + 0x118deb0]
xor cl, 0xae
mov byte [eax + 0x118e4a8], cl
inc eax
cmp eax, 0x13
jb 0x10d83a5
mov eax, 0x118e4a8
ret

Function at 0x10d83c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c40], 1
jne 0x10d8427
or dword [0x1192c40], 1
mov dword [0x118dec4], 0x8ecfdbe2
mov dword [0x118dec8], 0xc1dcdccb
mov dword [0x118decc], 0xc0c78edc
mov dword [0x118ded0], 0xcbcac7dd
mov dword [0x118ded4], 0xdcdccb8e
mov dword [0x118ded8], 0xc68edcc1
mov dword [0x118dedc], 0xc2cac0cf
mov dword [0x118dee0], 0x8e94dccb
mov byte [0x118dee4], 0xae
xor eax, eax
mov cl, byte [eax + 0x118dec4]
xor cl, 0xae
mov byte [eax + 0x118e4bc], cl
inc eax
cmp eax, 0x21
jb 0x10d8429
mov eax, 0x118e4bc
ret

Function at 0x10d8444
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c3c], 1
jne 0x10d84a0
or dword [0x1192c3c], 1
mov dword [0x118dee8], 0xc0c5c0fb
mov dword [0x118deec], 0x8ec0d9c1
mov dword [0x118def0], 0xc1dcdccb
mov dword [0x118def4], 0xc0c78edc
mov dword [0x118def8], 0xcfdbc28e
mov dword [0x118defc], 0xcfcddef1
mov word [0x118df00], 0xc2c2
mov byte [0x118df02], 0xae
xor eax, eax
mov cl, byte [eax + 0x118dee8]
xor cl, 0xae
mov byte [eax + 0x118e4e0], cl
inc eax
cmp eax, 0x1b
jb 0x10d84a2
mov eax, 0x118e4e0
ret

Function at 0x10d86de
Capabilities:
Encode data using xor

Disassembly:
test byte [0x1192c38], 1
jne 0x10d8727
or dword [0x1192c38], 1
mov dword [0x118df04], 0xcbddcfec
mov dword [0x118df08], 0xca8e9a98
mov dword [0x118df0c], 0xcac1cdcb
mov dword [0x118df10], 0xcfc88ecb
mov dword [0x118df14], 0xcacbc2c7
mov byte [0x118df18], 0xae
xor eax, eax
mov cl, byte [eax + 0x118df04]
xor cl, 0xae
mov byte [eax + 0x118e4fc], cl
inc eax
cmp eax, 0x15
jb 0x10d8729
mov eax, 0x118e4fc
ret