joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415540
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbd68]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x4155fa
test edx, edx
jne 0x415576
xor eax, eax
mov dword [0x4fbd68], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41556b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4155f0
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4155e1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4155b0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x96853c81
je 0x4155fe
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x4155a0
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbd68], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbd68], eax
mov esp, ebp
pop ebp
ret

Function at 0x415630
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x4156f2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4156f2
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4156e9
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4156b3
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415685
mov ecx, dword [ebp - 4]
cmp esi, 0x63d033cf
je 0x4156c7
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x4156e9
mov ebx, dword [ebp - 0x10]
jmp 0x415675
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415700
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x415777
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x415745
mov edi, dword [ebp - 8]
cmp ecx, 0x36cd2cc2
je 0x415792
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x415789
cmp dword [edi + 0x18], 0
jne 0x415720
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4157a0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x415862
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x415862
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415859
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415823
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4157f5
mov ecx, dword [ebp - 4]
cmp esi, 0xf6d230c
je 0x415837
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x415859
mov ebx, dword [ebp - 0x10]
jmp 0x4157e5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4158f0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbd80]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x4159aa
test edx, edx
jne 0x415926
xor eax, eax
mov dword [0x4fbd80], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41591b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4159a0
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415991
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415960
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xf9e5b8
je 0x4159ae
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415950
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbd80], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbd80], eax
mov esp, ebp
pop ebp
ret
Function at 0x4159e0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4fbd90]
mov edx, ecx
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415a8b
test edx, edx
jne 0x415a07
xor eax, eax
mov dword [0x4fbd90], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4159fc
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415a81
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415a72
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415a41
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x5bfa25f0
je 0x415a8f
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415a31
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbd90], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbd90], eax
mov esp, ebp
pop ebp
ret
Function at 0x415ac0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbd84]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415b7a
test edx, edx
jne 0x415af6
xor eax, eax
mov dword [0x4fbd84], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x415aeb
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415b70
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415b61
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415b30
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xe221ffb5
je 0x415b7e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415b20
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbd84], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbd84], eax
mov esp, ebp
pop ebp
ret
Function at 0x415bb0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbd8c]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415c6a
test edx, edx
jne 0x415be6
xor eax, eax
mov dword [0x4fbd8c], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x415bdb
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415c60
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415c51
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415c20
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x2664a1e2
je 0x415c6e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415c10
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbd8c], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbd8c], eax
mov esp, ebp
pop ebp
ret
Function at 0x415ca0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbd88]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415d5a
test edx, edx
jne 0x415cd6
xor eax, eax
mov dword [0x4fbd88], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x415ccb
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415d50
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415d41
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415d10
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xcf3839c9
je 0x415d5e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415d00
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbd88], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbd88], eax
mov esp, ebp
pop ebp
ret
Function at 0x415d90
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4fbd7c]
mov edx, ecx
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x415e3b
test edx, edx
jne 0x415db7
xor eax, eax
mov dword [0x4fbd7c], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x415dac
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x415e31
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415e22
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x415df1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xece9190e
je 0x415e3f
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x415de1
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbd7c], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbd7c], eax
mov esp, ebp
pop ebp
ret
Function at 0x415e70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], ecx
push edi
test esi, esi
jne 0x415f11
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x415ef8
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x415ec0
cmp eax, 0x87a77597
je 0x415fb6
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x415f09
cmp dword [ecx + 0x18], 0
jne 0x415ea2
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbdf8]
test eax, eax
jne 0x415faa
test esi, esi
je 0x415fa3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x415fa3
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x415fa3
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x415f91
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x415f60
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0xad367f5
je 0x415fc1
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x415f50
xor eax, eax
mov dword [0x4fbdf8], eax
push dword [ebp - 0x18]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x415f0b
mov eax, dword [edx + 0x24]
push dword [ebp - 0x18]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4fbdf8], eax
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415ff0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], ecx
push edi
test esi, esi
jne 0x416091
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x416078
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x416040
cmp eax, 0x87a77597
je 0x416136
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x416089
cmp dword [ecx + 0x18], 0
jne 0x416022
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbdb4]
test eax, eax
jne 0x41612a
test esi, esi
je 0x416123
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x416123
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x416123
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x416111
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x4160e0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0x1a3d706c
je 0x416141
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x4160d0
xor eax, eax
mov dword [0x4fbdb4], eax
push dword [ebp - 0x18]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x41608b
mov eax, dword [edx + 0x24]
push dword [ebp - 0x18]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4fbdb4], eax
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416240
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
push ebx
push esi
push edi
mov dword [eax], 0x404738
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x4162f1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop word [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4162d8
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x4162a0
cmp eax, 0x87a77597
je 0x416399
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x4162e9
cmp dword [ecx + 0x18], 0
jne 0x416280
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbdbc]
test eax, eax
jne 0x41638a
test esi, esi
je 0x416383
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x416383
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x416383
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x416371
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x416340
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0xdea9dbd4
je 0x4163a4
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x416330
xor eax, eax
mov dword [0x4fbdbc], eax
mov ecx, dword [ebp - 0x18]
push dword [ecx + 4]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x4162eb
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4fbdbc], eax
push dword [ecx + 4]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret