joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026ea
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [0x494808], 0
push ebx
push esi
push edi
je 0x40289a
mov ecx, dword [0x49403c]
test ecx, ecx
jle 0x4027c3
mov eax, dword [0x494830]
test eax, eax
jne 0x4027b7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x402793
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x402793
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0x895ee950
dec esi
mov dword [ebp - 0xc], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x40278f
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x40276b
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x3c0b040
mov edx, dword [eax + 0x18]
je 0x402797
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x402746
mov eax, dword [eax]
jmp 0x402727
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [0x49403c]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494830], eax
push ecx
call eax
test ax, ax
jns 0x40289a
call fcn.00401700
mov ecx, eax
call fcn.00401c5b
test al, al
jne 0x4027e9
call fcn.00401594
test al, al
jne 0x4027e9
call fcn.0040154f
test al, al
je 0x40289a
call fcn.00401700
add eax, dword [0x4947ac]
mov ecx, eax
call fcn.00401312
lea ecx, [eax - 1]
cmp ecx, 0x1f
ja 0x40289a
lea ecx, [eax - 1]
shl ecx, 4
add ecx, dword [0x4947b0]
add ecx, dword [0x494704]
call fcn.00401312
mov esi, eax
test esi, esi
je 0x40289a
mov ecx, esi
call fcn.00401c5b
test al, al
je 0x40289a
mov ecx, dword [0x49475c]
add ecx, esi
call fcn.00401e35
test al, al
jne 0x40289a
call fcn.00401700
cmp esi, eax
je 0x40289a
mov ecx, esi
call fcn.00401c8a
test al, al
je 0x40289a
mov ecx, dword [0x494754]
lea ecx, [ecx + esi]
call fcn.00401312
mov edx, dword [0x494038]
mov ecx, dword [0x494034]
call fcn.0044b6c1
cdq
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
call fcn.004013f4
mov esi, dword [sym.imp.USER32.dll_mouse_event]
xor edi, edi
push edi
push edi
push edi
push edi
push 2
call esi
push edi
push edi
push edi
push edi
push 4
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402fab
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x49480c], 0
push ebx
push esi
push edi
je 0x4030cf
call fcn.00401700
mov ecx, eax
call fcn.00401c5b
test al, al
jne 0x402fe7
call fcn.00401594
test al, al
jne 0x402fe7
call fcn.0040154f
test al, al
je 0x4030cf
call fcn.00401700
add eax, dword [0x49479c]
mov ecx, eax
call fcn.00401312
mov dword [0x4947e4], eax
cmp eax, dword [0x495d1c]
jle 0x4030c5
mov dword [0x495d1c], eax
mov eax, dword [0x4947f0]
test eax, eax
jne 0x4030b2
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x403094
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x403094
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0xbe0452e2
dec esi
mov dword [ebp - 0xc], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x403090
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x40306c
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xe7bff1b6
mov edx, dword [eax + 0x18]
je 0x403098
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x403047
mov eax, dword [eax]
jmp 0x403028
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4947f0], eax
push 0x20001
push 0
push str.hitsound.wav
call eax
mov eax, dword [0x4947e4]
test eax, eax
jne 0x4030cf
and dword [0x495d1c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031f3
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4947fd], 0
push ebx
push esi
push edi
je 0x403356
mov eax, dword [0x494828]
test eax, eax
jne 0x4032b6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x403298
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x403298
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 0x18], 0x23b50de9
dec esi
mov dword [ebp - 0x1c], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 0x11], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x403294
mov cl, byte [ebp - 0x11]
mov edx, dword [ebp - 0x18]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x403270
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x81a26069
mov edx, dword [eax + 0x18]
je 0x40329c
mov ecx, dword [ebp - 0x1c]
test esi, esi
jne 0x40324b
mov eax, dword [eax]
jmp 0x40322c
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494828], eax
push 0x20
call eax
test ax, ax
je 0x403356
call fcn.00401700
mov ecx, eax
call fcn.00401c5b
test al, al
jne 0x4032e5
call fcn.00401594
test al, al
jne 0x4032e5
call fcn.0040154f
test al, al
je 0x403356
call fcn.00401700
mov ecx, dword [0x494758]
add ecx, eax
call fcn.00401e35
test al, 1
jne 0x403356
mov ecx, dword [0x49470c]
mov edx, dword [0x49473c]
lea edx, [edx + ecx]
lea ecx, [ebp - 0x10]
call fcn.0040197a
movss xmm0, dword [ebp - 0xc]
movss xmm1, dword [0x494854]
comiss xmm0, xmm1
jbe 0x403332
mov ecx, dword [0x494704]
add ecx, dword [0x4947cc]
jmp 0x403343
comiss xmm1, xmm0
jbe 0x40334b
mov ecx, dword [0x494704]
add ecx, dword [0x4947a8]
push 6
pop edx
call fcn.00403680
mov edi, 0x494850
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cc96
leave
ret
Function at 0x403365
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [0x494805], 0
push ebx
push esi
push edi
je 0x4034e8
mov ecx, dword [0x49470c]
add ecx, dword [0x494740]
call fcn.00401312
test eax, eax
jne 0x4034e8
mov eax, dword [0x494734]
mov ecx, dword [0x494704]
add eax, 7
add ecx, eax
call fcn.00401312
mov ecx, eax
call fcn.00401312
mov dword [0x4947e0], eax
test eax, eax
je 0x4034da
cmp dword [0x4947dc], eax
je 0x4033db
xor cl, cl
mov dword [0x4947dc], eax
xor al, al
mov byte [0x4947e9], cl
mov byte [0x4947e8], al
jmp 0x4033e6
mov cl, byte [0x4947e9]
mov al, byte [0x4947e8]
test cl, cl
jne 0x403409
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov byte [0x4947e9], 1
mov dword [ebp - 0x10], 0x1388
call fcn.004013f4
jmp 0x4034e8
test al, al
jne 0x4034e8
mov ecx, dword [0x494704]
add ecx, dword [0x494734]
mov byte [0x4947e8], 1
call fcn.004474cd
mov eax, dword [0x4947d8]
test eax, eax
jne 0x4034cc
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x4034ae
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x4034ae
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0xa1c41522
dec esi
mov dword [ebp - 0xc], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x4034aa
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x403486
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xb60228da
mov edx, dword [eax + 0x18]
je 0x4034b2
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x403461
mov eax, dword [eax]
jmp 0x403442
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4947d8], eax
push 0x320
push 0x1f4
call eax
jmp 0x4034e8
mov byte [0x4947e9], 0
mov byte [0x4947e8], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4034ed
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [0x494825], 0
push ebx
push esi
push edi
je 0x40367b
mov eax, dword [0x494790]
test eax, eax
jne 0x4035a6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x403588
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x403588
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0xc838cfd9
dec esi
mov dword [ebp - 0xc], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x403584
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x403560
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xdb55d3b9
mov edx, dword [eax + 0x18]
je 0x40358c
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x40353b
mov eax, dword [eax]
jmp 0x40351c
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494790], eax
push 1
call eax
test ax, ax
je 0x40367b
call fcn.00401700
mov ecx, eax
call fcn.00401c5b
test al, al
jne 0x4035d9
call fcn.00401594
test al, al
jne 0x4035d9
call fcn.0040154f
test al, al
je 0x40367b
call fcn.00401700
add eax, dword [0x4947d0]
mov ecx, eax
call fcn.00401312
mov ecx, dword [0x494704]
and eax, 0xfff
shl eax, 4
add ecx, 0xfffffff0
add eax, dword [0x4947b0]
add ecx, eax
call fcn.00401312
test eax, eax
je 0x40367b
mov ecx, dword [0x4947b8]
add ecx, eax
call fcn.00403d04
movsx edx, ax
mov ecx, edx
call fcn.004015fb
test al, al
je 0x40367b
cmp edx, 0x1e
jg 0x403645
je 0x403654
sub edx, 1
je 0x403654
sub edx, 1
je 0x403654
sub edx, 1
je 0x403654
sub edx, 1
je 0x403654
jmp 0x40367b
cmp edx, 0x20
je 0x403654
cmp edx, 0x24
je 0x403654
cmp edx, 0x3d
jne 0x40367b
mov ecx, dword [0x494704]
add ecx, dword [0x4947c0]
push 6
pop edx
call fcn.00403680
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf
call fcn.004013f4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403680
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x49401c], 0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], ecx
je 0x4036a9
xor al, al
jmp 0x403764
mov eax, dword [0x494744]
test eax, eax
jne 0x40374c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x40372e
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x40372e
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 0x10], 0x9c51f0b
dec esi
mov dword [ebp - 0x14], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 9], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x40372a
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x403706
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xfc01b22c
mov edx, dword [eax + 0x18]
je 0x403732
mov ecx, dword [ebp - 0x14]
test esi, esi
jne 0x4036e1
mov eax, dword [eax]
jmp 0x4036c2
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494744], eax
push 0
push 4
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0x18]
push dword [0x4946fc]
call eax
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cc96
leave
ret
Function at 0x403773
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x49401c], 0
push ebx
push esi
push edi
movss dword [ebp - 8], xmm1
mov dword [ebp - 0x18], ecx
je 0x40379e
xor al, al
jmp 0x403859
mov eax, dword [0x494744]
test eax, eax
jne 0x403841
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x403823
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x403823
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 0x10], 0x9c51f0b
dec esi
mov dword [ebp - 0x14], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 9], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x40381f
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x4037fb
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xfc01b22c
mov edx, dword [eax + 0x18]
je 0x403827
mov ecx, dword [ebp - 0x14]
test esi, esi
jne 0x4037d6
mov eax, dword [eax]
jmp 0x4037b7
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494744], eax
push 0
push 4
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0x18]
push dword [0x4946fc]
call eax
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cc96
leave
ret
Function at 0x403868
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x49401c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0xc], 1
je 0x403892
xor al, al
jmp 0x40394d
mov eax, dword [0x494744]
test eax, eax
jne 0x403935
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x403917
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x403917
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 0x10], 0x9c51f0b
dec esi
mov dword [ebp - 0x14], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 8], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x403913
mov cl, byte [ebp - 8]
mov edx, dword [ebp - 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x4038ef
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xfc01b22c
mov edx, dword [eax + 0x18]
je 0x40391b
mov ecx, dword [ebp - 0x14]
test esi, esi
jne 0x4038ca
mov eax, dword [eax]
jmp 0x4038ab
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494744], eax
push 0
push 1
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 0x18]
push dword [0x4946fc]
call eax
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cc96
leave
ret
Function at 0x40395c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x38
push 0
push dword [ebp + 8]
mov dword [ebp - 0x10], ecx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x494700]
add esp, 0xc
test eax, eax
jne 0x403a1a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x4039fc
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x4039fc
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0x14c9ad8a
dec esi
mov dword [ebp - 0xc], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x4039f8
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 8]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x4039d4
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x7e095e78
mov edx, dword [eax + 0x18]
je 0x403a00
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x4039af
mov eax, dword [eax]
jmp 0x403990
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494700], eax
push 0
push 0x38
push dword [ebp + 8]
push dword [ebp - 0x10]
push dword [0x4946fc]
call eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403a34
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x49400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x49401c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x50], ecx
lea esi, [ebp + 8]
push 0xe
pop ecx
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
je 0x403a65
xor al, al
jmp 0x403b20
mov eax, dword [0x494744]
test eax, eax
jne 0x403b08
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x403aea
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x403aea
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 0x48], 0x9c51f0b
dec esi
mov dword [ebp - 0x4c], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 0x41], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x403ae6
mov cl, byte [ebp - 0x41]
mov edx, dword [ebp - 0x48]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x403ac2
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 0xfc01b22c
mov edx, dword [eax + 0x18]
je 0x403aee
mov ecx, dword [ebp - 0x4c]
test esi, esi
jne 0x403a9d
mov eax, dword [eax]
jmp 0x403a7e
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494744], eax
push 0
push 0x38
lea ecx, [ebp - 0x40]
push ecx
push dword [ebp - 0x50]
push dword [0x4946fc]
call eax
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cc96
leave
ret
Function at 0x403b2f
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], ecx
mov word [edi], ax
mov byte [edi + 2], al
mov eax, dword [0x494700]
test eax, eax
jne 0x403bef
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x10], ecx
cmp ecx, edx
je 0x403bce
mov esi, dword [ecx + 0x18]
test esi, esi
je 0x403bce
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 8], 0x14c9ad8a
dec esi
mov dword [ebp - 0xc], ecx
mov ebx, dword [ecx]
add ebx, edx
mov dl, byte [ebx]
inc ebx
mov byte [ebp - 1], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x403bca
mov cl, byte [ebp - 1]
mov edi, dword [ebp - 8]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x403ba6
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0x7e095e78
mov edi, dword [ebp + 8]
je 0x403bd2
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x403b81
mov eax, dword [eax]
jmp 0x403b5f
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494700], eax
push 0
push 3
push edi
push dword [ebp - 0x14]
push dword [0x4946fc]
call eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403c06
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x49401c], 0
mov ax, word [ebp + 8]
push ebx
mov word [ebp - 8], ax
mov al, byte [ebp + 0xa]
push esi
push edi
mov dword [ebp - 0x18], ecx
mov byte [ebp - 6], al
je 0x403c3a
xor al, al
jmp 0x403cf5
mov eax, dword [0x494744]
test eax, eax
jne 0x403cdd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x403cbf
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x403cbf
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 0x10], 0x9c51f0b
dec esi
mov dword [ebp - 0x14], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 9], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x403cbb
mov cl, byte [ebp - 9]
mov edx, dword [ebp - 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x403c97
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xfc01b22c
mov edx, dword [eax + 0x18]
je 0x403cc3
mov ecx, dword [ebp - 0x14]
test esi, esi
jne 0x403c72
mov eax, dword [eax]
jmp 0x403c53
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x494744], eax
push 0
push 3
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0x18]
push dword [0x4946fc]
call eax
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cc96
leave
ret