joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415310
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8c7c]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x4153ca
test edx, edx
jne 0x415346
xor eax, eax
mov dword [0x4f8c7c], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41533b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4153c0
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4153b1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415380
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xb0bac3c4
je 0x4153ce
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415370
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8c7c], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8c7c], eax
mov esp, ebp
pop ebp
ret
Function at 0x415400
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8c98]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x4154ba
test edx, edx
jne 0x415436
xor eax, eax
mov dword [0x4f8c98], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41542b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4154b0
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4154a1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415470
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x78d48481
je 0x4154be
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415460
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8c98], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8c98], eax
mov esp, ebp
pop ebp
ret
Function at 0x4154f0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8c68]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x4155aa
test edx, edx
jne 0x415526
xor eax, eax
mov dword [0x4f8c68], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41551b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4155a0
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415591
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415560
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x97085561
je 0x4155ae
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415550
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8c68], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8c68], eax
mov esp, ebp
pop ebp
ret

Function at 0x4155e0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x4156a2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4156a2
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415699
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415663
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415635
mov ecx, dword [ebp - 4]
cmp esi, 0x13e849c
je 0x415677
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x415699
mov ebx, dword [ebp - 0x10]
jmp 0x415625
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4156b0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x415772
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x415772
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415769
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415733
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415705
mov ecx, dword [ebp - 4]
cmp esi, 0x25b2bbbc
je 0x415747
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x415769
mov ebx, dword [ebp - 0x10]
jmp 0x4156f5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415780
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8d64]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41583a
test edx, edx
jne 0x4157b6
xor eax, eax
mov dword [0x4f8d64], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4157ab
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415830
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415821
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4157f0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x11f16acf
je 0x41583e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x4157e0
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8d64], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8d64], eax
mov esp, ebp
pop ebp
ret
Function at 0x415870
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8d48]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41592a
test edx, edx
jne 0x4158a6
xor eax, eax
mov dword [0x4f8d48], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41589b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415920
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415911
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4158e0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x1cbc853e
je 0x41592e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x4158d0
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8d48], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8d48], eax
mov esp, ebp
pop ebp
ret
Function at 0x415960
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8d50]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415a1a
test edx, edx
jne 0x415996
xor eax, eax
mov dword [0x4f8d50], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41598b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415a10
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415a01
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4159d0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x9dc82fc1
je 0x415a1e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x4159c0
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8d50], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8d50], eax
mov esp, ebp
pop ebp
ret
Function at 0x415a50
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8d54]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415b0a
test edx, edx
jne 0x415a86
xor eax, eax
mov dword [0x4f8d54], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x415a7b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415b00
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415af1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415ac0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xf8ad295a
je 0x415b0e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415ab0
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8d54], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8d54], eax
mov esp, ebp
pop ebp
ret
Function at 0x415b40
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8d58]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415bfa
test edx, edx
jne 0x415b76
xor eax, eax
mov dword [0x4f8d58], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x415b6b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415bf0
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415be1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415bb0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x96853c81
je 0x415bfe
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415ba0
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8d58], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8d58], eax
mov esp, ebp
pop ebp
ret

Function at 0x415c30
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x415cf2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x415cf2
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415ce9
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415cb3
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415c85
mov ecx, dword [ebp - 4]
cmp esi, 0x63d033cf
je 0x415cc7
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x415ce9
mov ebx, dword [ebp - 0x10]
jmp 0x415c75
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415d00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x415d77
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x415d45
mov edi, dword [ebp - 8]
cmp ecx, 0x36cd2cc2
je 0x415d92
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x415d89
cmp dword [edi + 0x18], 0
jne 0x415d20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415da0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x415e62
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x415e62
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415e59
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415e23
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415df5
mov ecx, dword [ebp - 4]
cmp esi, 0xf6d230c
je 0x415e37
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x415e59
mov ebx, dword [ebp - 0x10]
jmp 0x415de5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415f00
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f8d70]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415fba
test edx, edx
jne 0x415f36
xor eax, eax
mov dword [0x4f8d70], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x415f2b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415fb0
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415fa1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415f70
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xf9e5b8
je 0x415fbe
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415f60
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8d70], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8d70], eax
mov esp, ebp
pop ebp
ret
Function at 0x415ff0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4f8d80]
mov edx, ecx
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41609b
test edx, edx
jne 0x416017
xor eax, eax
mov dword [0x4f8d80], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41600c
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x416091
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x416082
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x416051
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x5bfa25f0
je 0x41609f
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x416041
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f8d80], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f8d80], eax
mov esp, ebp
pop ebp
ret