joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460a12
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebp, dword [ecx + edx + 0x78]
add ebp, edx
cmp ebp, edx
je 0x45f84e
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x45f84e
mov ecx, dword [ebp + 0x20]
lea ebx, [ecx + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov ecx, 0xab283143
mov edi, dword [ebx]
dec esi
add edi, edx
mov dword [esp + 0x10], ecx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x45f84a
mov edx, dword [esp + 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x45f827
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], 0xbfa5d8b0
mov edx, dword [eax + 0x18]
je 0x45f852
test esi, esi
jne 0x45f80b
mov eax, dword [eax]
jmp 0x45f7ec
mov eax, dword [ebp + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
xor ecx, ecx
mov eax, dword [eax + edx]
push ecx
push ecx
push ecx
push 0x41275a
push ecx
add eax, edx
push ecx
call eax
add esp, 0x18
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
jmp 0x45f7db
Function at 0x460a17
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x2c
mov eax, 0x49cacd
call fcn.0046c7ed
mov dword [ebp - 0x38], ecx
sub esp, 0x18
mov dword [ebp - 0x34], esp
mov edi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4a69e8
call fcn.0041437c
sub esp, 0x18
lea ecx, [ebp - 0x2c]
xor ebx, ebx
mov esi, esp
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0xb18ebdb9
mov dword [ebp - 0x28], 0xbfb0b0bc
mov dword [ebp - 0x24], 0x100acb9
call fcn.0040537d
push eax
mov ecx, esi
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.00466e43
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf2bda3e4
mov word [ebp - 0x14], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
mov esi, 0x4c7b50
mov ecx, esi
call fcn.0046612c
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xe7e0a8fe
mov word [ebp - 0x1c], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.0041437c
mov ecx, esi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45f7d5
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
mov dword [ebp - 0x20], edi
cmp edi, edx
je 0x45f798
mov esi, dword [edi + 0x18]
test esi, esi
je 0x45f798
mov eax, dword [edi + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov eax, 0xef26a6d7
mov ecx, dword [ebx]
dec esi
add ecx, edx
mov dword [ebp - 0x30], eax
mov al, byte [ecx]
inc ecx
test al, al
je 0x45f78f
mov edi, dword [ebp - 0x30]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45f76e
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], 0x1a6f8d17
mov edi, dword [ebp - 0x20]
je 0x45f7bc
test esi, esi
jne 0x45f754
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x34]
je 0x45f7a9
cmp dword [ecx + 0x18], ebx
jne 0x45f732
mov eax, ebx
push ebx
call eax
mov eax, dword [ebp - 0x38]
pop ecx
mov eax, dword [eax]
mov eax, dword [eax]
call fcn.0046c79c
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
xor ebx, ebx
jmp 0x45f7ab
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45f642
Function at 0x460a27
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x2c
mov eax, 0x49cacd
call fcn.0046c7ed
mov dword [ebp - 0x38], ecx
sub esp, 0x18
mov dword [ebp - 0x34], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4a69e8
call fcn.0041437c
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0xba8ebdb9
mov dword [ebp - 0x28], 0xbeb6a7ba
mov word [ebp - 0x24], 0x100
call fcn.004128c4
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
push ebx
push esi
call fcn.00466e43
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf2bda3e4
mov word [ebp - 0x14], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
mov esi, 0x4c7b50
mov ecx, esi
call fcn.0046612c
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xe6e0a8fe
mov word [ebp - 0x1c], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.0041437c
mov ecx, esi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45f1db
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
mov dword [ebp - 0x20], edi
cmp edi, edx
je 0x45f19e
mov esi, dword [edi + 0x18]
test esi, esi
je 0x45f19e
mov eax, dword [edi + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov eax, 0x8d402413
mov ecx, dword [ebx]
dec esi
add ecx, edx
mov dword [ebp - 0x30], eax
mov al, byte [ecx]
inc ecx
test al, al
je 0x45f195
mov edi, dword [ebp - 0x30]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45f174
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], 0x38ecb143
mov edi, dword [ebp - 0x20]
je 0x45f1c2
test esi, esi
jne 0x45f15a
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x34]
je 0x45f1af
cmp dword [ecx + 0x18], ebx
jne 0x45f138
mov eax, ebx
push ebx
call eax
mov eax, dword [ebp - 0x38]
pop ecx
mov eax, dword [eax]
mov eax, dword [eax]
call fcn.0046c79c
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
xor ebx, ebx
jmp 0x45f1b1
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45f048
Function at 0x460a34
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x2c
mov eax, 0x49cacd
call fcn.0046c7ed
mov dword [ebp - 0x38], ecx
sub esp, 0x18
mov dword [ebp - 0x34], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4a69e8
call fcn.0041437c
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0xb18ebdb9
mov dword [ebp - 0x28], 0xbdb6b1bb
mov word [ebp - 0x24], 0x100
call fcn.004128c4
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
push ebx
push esi
call fcn.00466e43
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf2bda3e4
mov word [ebp - 0x14], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
mov esi, 0x4c7b50
mov ecx, esi
call fcn.0046612c
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xe1e0a8fe
mov word [ebp - 0x1c], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.0041437c
mov ecx, esi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45f042
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
mov dword [ebp - 0x20], edi
cmp edi, edx
je 0x45f005
mov esi, dword [edi + 0x18]
test esi, esi
je 0x45f005
mov eax, dword [edi + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov eax, 0xbaa13097
mov ecx, dword [ebx]
dec esi
add ecx, edx
mov dword [ebp - 0x30], eax
mov al, byte [ecx]
inc ecx
test al, al
je 0x45effc
mov edi, dword [ebp - 0x30]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45efdb
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], 0x967b40d7
mov edi, dword [ebp - 0x20]
je 0x45f029
test esi, esi
jne 0x45efc1
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x34]
je 0x45f016
cmp dword [ecx + 0x18], ebx
jne 0x45ef9f
mov eax, ebx
push ebx
call eax
mov eax, dword [ebp - 0x38]
pop ecx
mov eax, dword [eax]
mov eax, dword [eax]
call fcn.0046c79c
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
xor ebx, ebx
jmp 0x45f018
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45eeaf
Function at 0x460a41
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x30
mov eax, 0x49ca91
call fcn.0046c7ed
mov dword [ebp - 0x3c], ecx
sub esp, 0x18
mov dword [ebp - 0x38], esp
mov edi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4a69e8
call fcn.0041437c
sub esp, 0x18
lea ecx, [ebp - 0x30]
xor ebx, ebx
mov esi, esp
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0xbdbcb5bd
mov dword [ebp - 0x2c], 0xa58ab1a7
mov dword [ebp - 0x28], 0xb3aaabb2
mov dword [ebp - 0x24], 0x100b2b4
call fcn.00405b3a
push eax
mov ecx, esi
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.00466e43
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf2bda3e4
mov word [ebp - 0x14], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
mov esi, 0x4c7b50
mov ecx, esi
call fcn.0046612c
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xe0e0a8fe
mov word [ebp - 0x1c], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.0041437c
mov ecx, esi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45eea9
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
mov dword [ebp - 0x20], edi
cmp edi, edx
je 0x45ee6c
mov esi, dword [edi + 0x18]
test esi, esi
je 0x45ee6c
mov eax, dword [edi + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov eax, 0x9ad4dc5e
mov ecx, dword [ebx]
dec esi
add ecx, edx
mov dword [ebp - 0x34], eax
mov al, byte [ecx]
inc ecx
test al, al
je 0x45ee63
mov edi, dword [ebp - 0x34]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45ee42
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], 0x39312fe6
mov edi, dword [ebp - 0x20]
je 0x45ee90
test esi, esi
jne 0x45ee28
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x38]
je 0x45ee7d
cmp dword [ecx + 0x18], ebx
jne 0x45ee06
mov eax, ebx
push ebx
call eax
mov eax, dword [ebp - 0x3c]
pop ecx
mov eax, dword [eax]
mov eax, dword [eax]
call fcn.0046c79c
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
xor ebx, ebx
jmp 0x45ee7f
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45ed0f
Function at 0x460a51
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x30
mov eax, 0x49ca91
call fcn.0046c7ed
mov dword [ebp - 0x3c], ecx
sub esp, 0x18
mov dword [ebp - 0x38], esp
mov edi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4a69e8
call fcn.0041437c
sub esp, 0x18
lea ecx, [ebp - 0x30]
xor ebx, ebx
mov esi, esp
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0xa28ebdb9
mov dword [ebp - 0x2c], 0xb3b6bba1
mov dword [ebp - 0x28], 0xa8b6aba4
mov word [ebp - 0x24], 0xa8
mov byte [ebp - 0x22], 1
call fcn.00403ccd
push eax
mov ecx, esi
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.00466e43
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf2bda3e4
mov word [ebp - 0x14], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
mov esi, 0x4c7b50
mov ecx, esi
call fcn.0046612c
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xe3e0a8fe
mov word [ebp - 0x1c], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.0041437c
mov ecx, esi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45e465
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
mov dword [ebp - 0x20], edi
cmp edi, edx
je 0x45e428
mov esi, dword [edi + 0x18]
test esi, esi
je 0x45e428
mov eax, dword [edi + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov eax, 0xb4178dee
mov ecx, dword [ebx]
dec esi
add ecx, edx
mov dword [ebp - 0x34], eax
mov al, byte [ecx]
inc ecx
test al, al
je 0x45e41f
mov edi, dword [ebp - 0x34]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45e3fe
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], 0x881511b6
mov edi, dword [ebp - 0x20]
je 0x45e44c
test esi, esi
jne 0x45e3e4
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x38]
je 0x45e439
cmp dword [ecx + 0x18], ebx
jne 0x45e3c2
mov eax, ebx
push ebx
call eax
mov eax, dword [ebp - 0x3c]
pop ecx
mov eax, dword [eax]
mov eax, dword [eax]
call fcn.0046c79c
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
xor ebx, ebx
jmp 0x45e43b
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45e2c8
Function at 0x460a61
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x30
mov eax, 0x49ca91
call fcn.0046c7ed
mov dword [ebp - 0x3c], ecx
sub esp, 0x18
mov dword [ebp - 0x38], esp
mov edi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4a69e8
call fcn.0041437c
sub esp, 0x18
lea ecx, [ebp - 0x30]
xor ebx, ebx
mov esi, esp
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0xb68ebdb9
mov dword [ebp - 0x2c], 0xa0bea7ba
mov dword [ebp - 0x28], 0xb7acb4b8
mov word [ebp - 0x24], 0xbe
mov byte [ebp - 0x22], 1
call fcn.00403ccd
push eax
mov ecx, esi
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.00466e43
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf2bda3e4
mov word [ebp - 0x14], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
mov esi, 0x4c7b50
mov ecx, esi
call fcn.0046612c
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xe2e0a8fe
mov word [ebp - 0x1c], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.0041437c
mov ecx, esi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45da65
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
mov dword [ebp - 0x20], edi
cmp edi, edx
je 0x45da28
mov esi, dword [edi + 0x18]
test esi, esi
je 0x45da28
mov eax, dword [edi + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov eax, 0x3b24aab9
mov ecx, dword [ebx]
dec esi
add ecx, edx
mov dword [ebp - 0x34], eax
mov al, byte [ecx]
inc ecx
test al, al
je 0x45da1f
mov edi, dword [ebp - 0x34]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45d9fe
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], 0x9f062799
mov edi, dword [ebp - 0x20]
je 0x45da4c
test esi, esi
jne 0x45d9e4
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x38]
je 0x45da39
cmp dword [ecx + 0x18], ebx
jne 0x45d9c2
mov eax, ebx
push ebx
call eax
mov eax, dword [ebp - 0x3c]
pop ecx
mov eax, dword [eax]
mov eax, dword [eax]
call fcn.0046c79c
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
xor ebx, ebx
jmp 0x45da3b
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45d8c8
Function at 0x460a71
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x30
mov eax, 0x49c823
call fcn.0046c7ed
mov dword [ebp - 0x3c], ecx
sub esp, 0x18
mov dword [ebp - 0x38], esp
mov edi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x4a69e8
call fcn.0041437c
sub esp, 0x18
lea ecx, [ebp - 0x2c]
xor ebx, ebx
mov esi, esp
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0xa08ebdb9
mov dword [ebp - 0x28], 0xbfa6b9b2
mov dword [ebp - 0x24], 0x100bdad
call fcn.0040537d
push eax
mov ecx, esi
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.00466e43
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf2bda3e4
mov word [ebp - 0x14], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
mov edi, 0x4c7b50
mov ecx, edi
call fcn.0046612c
sub esp, 0x18
mov dword [ebp - 0x20], 0xe8a8fe
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x1c], 1
mov esi, esp
call fcn.00402e7b
push eax
mov ecx, esi
call fcn.0041437c
mov ecx, edi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45d09e
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
mov dword [ebp - 0x34], edi
cmp edi, edx
je 0x45d061
mov esi, dword [edi + 0x18]
test esi, esi
je 0x45d061
mov eax, dword [edi + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov eax, 0x569b2a97
mov ecx, dword [ebx]
dec esi
add ecx, edx
mov dword [ebp - 0x30], eax
mov al, byte [ecx]
inc ecx
test al, al
je 0x45d058
mov edi, dword [ebp - 0x30]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45d037
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], 0x6e9adad7
mov edi, dword [ebp - 0x34]
je 0x45d085
test esi, esi
jne 0x45d01d
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x38]
je 0x45d072
cmp dword [ecx + 0x18], ebx
jne 0x45cffb
mov eax, ebx
push ebx
call eax
mov eax, dword [ebp - 0x3c]
pop ecx
mov eax, dword [eax]
mov eax, dword [eax]
call fcn.0046c79c
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
xor ebx, ebx
jmp 0x45d074
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45cf0e
Function at 0x460abf
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x30
mov eax, 0x49c823
call fcn.0046c7ed
mov dword [ebp - 0x3c], ecx
sub esp, 0x18
mov dword [ebp - 0x38], esp
mov edi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x4a69e8
call fcn.0041437c
sub esp, 0x18
lea ecx, [ebp - 0x2c]
xor ebx, ebx
mov esi, esp
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0xbc8ebdb9
mov dword [ebp - 0x28], 0xb4b9a6
mov byte [ebp - 0x24], 1
call fcn.00405af8
push eax
mov ecx, esi
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.00466e43
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf2bda3e4
mov word [ebp - 0x14], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.0041437c
or dword [ebp - 4], 0xffffffff
mov edi, 0x4c7b50
mov ecx, edi
call fcn.0046612c
sub esp, 0x18
mov dword [ebp - 0x20], 0xe6a8fe
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x1c], 1
mov esi, esp
call fcn.00402e7b
push eax
mov ecx, esi
call fcn.0041437c
mov ecx, edi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45b6c5
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
mov dword [ebp - 0x34], edi
cmp edi, edx
je 0x45b688
mov esi, dword [edi + 0x18]
test esi, esi
je 0x45b688
mov eax, dword [edi + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov eax, 0x96f231da
mov ecx, dword [ebx]
dec esi
add ecx, edx
mov dword [ebp - 0x30], eax
mov al, byte [ecx]
inc ecx
test al, al
je 0x45b67f
mov edi, dword [ebp - 0x30]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45b65e
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], 0x6ecd7252
mov edi, dword [ebp - 0x34]
je 0x45b6ac
test esi, esi
jne 0x45b644
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x38]
je 0x45b699
cmp dword [ecx + 0x18], ebx
jne 0x45b622
mov eax, ebx
push ebx
call eax
mov eax, dword [ebp - 0x3c]
pop ecx
mov eax, dword [eax]
mov eax, dword [eax]
call fcn.0046c79c
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
xor ebx, ebx
jmp 0x45b69b
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45b538