joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7537b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x31], 0
je 0x7537d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x30
jb 0x7537c0
mov byte [esi + 0x31], 0
pop esi
ret

Function at 0x7537e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x35], 0
je 0x753802
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x34
jb 0x7537f0
mov byte [esi + 0x35], 0
pop esi
ret

Function at 0x753900
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x753922
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x1d
jb 0x753910
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x753b40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x33], 0
je 0x753b62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x32
jb 0x753b50
mov byte [esi + 0x33], 0
pop esi
ret

Function at 0x753b70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x57], 0
je 0x753b92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x56
jb 0x753b80
mov byte [esi + 0x57], 0
pop esi
ret

Function at 0x753ba0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x753bc2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x753bb0
mov byte [esi + 0x21], 0
pop esi
ret

Function at 0x753bf0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x23], 0
je 0x753c12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x22
jb 0x753c00
mov byte [esi + 0x23], 0
pop esi
ret

Function at 0x753c20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x753c42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x1a
jb 0x753c30
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x753c50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5a], 0
je 0x753c72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x59
jb 0x753c60
mov byte [esi + 0x5a], 0
pop esi
ret

Function at 0x753c80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x25], 0
je 0x753ca2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x24
jb 0x753c90
mov byte [esi + 0x25], 0
pop esi
ret
Function at 0x753cb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x753cd2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x753cc0
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x753ce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5c], 0
je 0x753d02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x5b
jb 0x753cf0
mov byte [esi + 0x5c], 0
pop esi
ret

Function at 0x753d10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x27], 0
je 0x753d32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x26
jb 0x753d20
mov byte [esi + 0x27], 0
pop esi
ret

Function at 0x753d60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0x753d82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0x753d70
mov byte [esi + 0x2e], 0
pop esi
ret

Function at 0x753d90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x753db2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x753da0
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x753fa0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x753fc2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x753fb0
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x753fd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x753ff2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x753fe0
mov byte [esi + 7], 0
pop esi
ret

Function at 0x754000
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x754022
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x33
jb 0x754010
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x754030
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x754052
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x754040
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x754060
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x754082
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x754070
mov byte [esi + 0x22], 0
pop esi
ret
Function at 0x754090
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x7540b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x7540a0
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x7540c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x7540e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x7540d0
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x7540f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x754112
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x754100
mov byte [esi + 0x1c], 0
pop esi
ret

Function at 0x754120
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x754142
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x754130
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x754150
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
je 0x754172
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x2c
jb 0x754160
mov byte [esi + 0x2d], 0
pop esi
ret

Function at 0x754180
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x7541a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x754190
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x7541b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x7541d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x7541c0
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x7541e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x754202
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x7541f0
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x754210
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x754232
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x754220
mov byte [esi + 9], 0
pop esi
ret

Function at 0x754240
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x754262
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x754250
mov byte [esi + 0x10], 0
pop esi
ret
Function at 0x754270
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x754292
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x754280
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x7542a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x7542c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x7542b0
mov byte [esi + 0xc], 0
pop esi
ret

Function at 0x7542d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x7542f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x7542e0
mov byte [esi + 8], 0
pop esi
ret

Function at 0x754300
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x754322
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x754310
mov byte [esi + 5], 0
pop esi
ret

Function at 0x754390
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x7543b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x7543a0
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x7543c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x7543e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x7543d0
mov byte [esi + 0x16], 0
pop esi
ret

Function at 0x7543f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x754412
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x754400
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x754420
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x754442
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x754430
mov byte [esi + 0x19], 0
pop esi
ret

Function at 0x754450
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x754472
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x754460
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x754480
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x7544a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x754490
mov byte [esi + 3], 0
pop esi
ret
Function at 0x7544c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2f], 0
je 0x7544e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x2e
jb 0x7544d0
mov byte [esi + 0x2f], 0
pop esi
ret

Function at 0x7544f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x754512
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x1f
jb 0x754500
mov byte [esi + 0x20], 0
pop esi
ret

Function at 0x754520
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x754542
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x754530
mov byte [esi + 6], 0
pop esi
ret

Function at 0x754550
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x754572
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x754560
mov byte [esi + 4], 0
pop esi
ret

Function at 0x759240
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f3970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], 0x7fdce8
call fcn.007ce1b0
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.007ccfbe
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x10], esi
mov dword [ebx], 0x7fdd28
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 0x4c], 0
mov eax, dword [0x8275f0]
mov ecx, dword [0x8275f4]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x38], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x7593f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7fa55d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
push 0
mov eax, dword [ebx]
push 0
mov dword [ebp - 0x14], ebx
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x811d68
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.006f47b0
push 8
call fcn.007ce1b0
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.007ccfbe
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.0075a950
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov edx, dword [edx + 0x20]
call edx
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp + 0xb], al
call dword [edx + 8]
test eax, eax
je 0x759506
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x759522
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.006f47b0
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x75a680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f3970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], 0x7fdce8
call fcn.007ce1b0
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.007ccfbe
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x75bea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], eax
jb 0x75bebe
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x75bee4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x75bed0
mov eax, dword [ebp - 8]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00762500
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
pop ebx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x7641a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x7fae05
push eax
mov dword fs:[0], esp
sub esp, 0x18
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x7641cd
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x7641f2
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x7641e0
push esi
push edx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.00762500
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x764222
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x764373
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x1c], 0
call fcn.007ce1b0
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00757180
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x815f20]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x815f20]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x764316
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.007f32f0
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.007f3ee0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x7642fa
cmp eax, 0x200
jae 0x7642f8
shl eax, 3
cmp eax, ecx
jae 0x7642fa
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00767e70
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00762500
mov edx, dword [eax]
jmp 0x764319
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x764341
mov dword [ecx + eax*8], edi
jmp 0x764353
cmp esi, edx
jne 0x76434a
mov dword [ecx + eax*8], edi
jmp 0x764357
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x764357
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x812dd4
call fcn.007cc60b
int3
Function at 0x76f640
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7fb435
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push eax
call fcn.0076ff50
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], eax
test al, al
je 0x76f69b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 4], 0x4924924
je 0x76f733
mov ebx, dword [esi]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x14], 0
call fcn.007ce1b0
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.00757180
mov edx, dword [ebp + 0xc]
push edi
push dword [ebp - 0x24]
mov al, byte [edx + 0x18]
push dword [ebp - 0x28]
mov byte [edi + 0x28], al
mov ecx, dword [edx + 0x24]
mov eax, dword [edx + 0x20]
mov dword [edi + 0x34], ecx
mov ecx, dword [ebp - 0x10]
mov dword [edi + 0x30], eax
mov byte [edx + 0x18], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov word [edi + 0xc], 0
call fcn.0075e150
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.006f89a0
int3