joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4114e0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4f3798]
mov edx, ecx
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41158b
test edx, edx
jne 0x411507
xor eax, eax
mov dword [0x4f3798], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4114fc
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x411581
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x411572
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x411541
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x4dbc712f
je 0x41158f
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x411531
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f3798], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f3798], eax
mov esp, ebp
pop ebp
ret

Function at 0x4115c0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4f37bc]
mov edx, ecx
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41166b
test edx, edx
jne 0x4115e7
xor eax, eax
mov dword [0x4f37bc], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4115dc
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x411661
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x411652
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x411621
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xb8e4e945
je 0x41166f
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x411611
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f37bc], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f37bc], eax
mov esp, ebp
pop ebp
ret
Function at 0x4116a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x30]
xor edx, edx
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0x50e932b8
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x2c]
mov edi, dword [eax + 0x30]
add ecx, 0xfffffff8
mov dword [ebp - 0x10], eax
test edx, edx
je 0x411726
movzx edx, cx
xor ebx, ebx
shr edx, 1
mov esi, 0x811c9dc5
mov dword [ebp - 0xc], esi
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, ebx
mov dword [ebp - 0x14], edx
test edx, edx
je 0x41171b
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 0xc]
imul esi, ecx, 0x1000193
mov dword [ebp - 0xc], esi
cmp ebx, eax
jne 0x4116f1
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
cmp esi, edx
jne 0x411854
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x18], ecx
lea ecx, [edx + esi]
mov dword [ebp - 0xc], ecx
cmp ecx, esi
je 0x411851
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x411851
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
sub ecx, 4
dec edx
mov dword [ebp - 0x10], ecx
mov edi, 0x811c9dc5
mov dword [ebp - 0x14], edx
mov ecx, dword [ecx]
add ecx, esi
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x41179b
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x411772
mov edx, dword [ebp - 0x14]
mov esi, dword [eax + 0x18]
cmp edi, dword [ebp - 8]
je 0x4117b1
mov ecx, dword [ebp - 0x10]
test edx, edx
jne 0x411758
mov edx, dword [ebp - 4]
mov eax, dword [eax]
jmp 0x4116c1
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x24]
lea eax, [eax + edx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + esi]
add edx, esi
cmp edx, edi
jbe 0x41185b
mov eax, dword [ebp - 0x18]
add eax, edi
cmp edx, eax
jae 0x41185b
mov bl, byte [edx]
mov edi, 0x811c9dc5
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 8], esi
cmp bl, 0x2e
je 0x411817
movsx ecx, bl
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx + 1]
cmova eax, ecx
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp bl, 0x2e
jne 0x4117f2
mov dword [ebp - 4], edi
mov bl, byte [edx + 1]
inc edx
test bl, bl
je 0x411845
nop
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x411820
mov dword [ebp - 8], esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [eax]
jmp 0x4116c1
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411870
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x4118e7
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x4118b5
mov edi, dword [ebp - 8]
cmp ecx, 0xa3e6f6c3
je 0x411902
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x4118f9
cmp dword [edi + 0x18], 0
jne 0x411890
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411910
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x411987
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x411955
mov edi, dword [ebp - 8]
cmp ecx, 0x39794115
je 0x4119a2
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x411999
cmp dword [edi + 0x18], 0
jne 0x411930
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4119b0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x411a72
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x411a72
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x411a69
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x411a33
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x411a05
mov ecx, dword [ebp - 4]
cmp esi, 0x28737e55
je 0x411a47
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x411a69
mov ebx, dword [ebp - 0x10]
jmp 0x4119f5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411a80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x411af7
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x411ac5
mov edi, dword [ebp - 8]
cmp ecx, 0xc0323159
je 0x411b12
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x411b09
cmp dword [edi + 0x18], 0
jne 0x411aa0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411b20
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x411be2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x411be2
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x411bd9
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x411ba3
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x411b75
mov ecx, dword [ebp - 4]
cmp esi, 0xaeb3c6d5
je 0x411bb7
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x411bd9
mov ebx, dword [ebp - 0x10]
jmp 0x411b65
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411bf0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x411c67
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x411c35
mov edi, dword [ebp - 8]
cmp ecx, 0x174c966e
je 0x411c82
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x411c79
cmp dword [edi + 0x18], 0
jne 0x411c10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411c90
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x411d52
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x411d52
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x411d49
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x411d13
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x411ce5
mov ecx, dword [ebp - 4]
cmp esi, 0x1807f01a
je 0x411d27
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x411d49
mov ebx, dword [ebp - 0x10]
jmp 0x411cd5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411d60
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x411e22
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x411e22
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x411e19
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x411de3
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x411db5
mov ecx, dword [ebp - 4]
cmp esi, 0x1ed908f5
je 0x411df7
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x411e19
mov ebx, dword [ebp - 0x10]
jmp 0x411da5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411e30
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x411ef2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x411ef2
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x411ee9
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x411eb3
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x411e85
mov ecx, dword [ebp - 4]
cmp esi, 0xa83e21de
je 0x411ec7
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x411ee9
mov ebx, dword [ebp - 0x10]
jmp 0x411e75
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411f00
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x411fc2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x411fc2
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x411fb9
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x411f83
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x411f55
mov ecx, dword [ebp - 4]
cmp esi, 0x4dbc712f
je 0x411f97
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x411fb9
mov ebx, dword [ebp - 0x10]
jmp 0x411f45
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411fd0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x412092
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x412092
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x412089
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x412053
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x412025
mov ecx, dword [ebp - 4]
cmp esi, 0xb8e4e945
je 0x412067
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x412089
mov ebx, dword [ebp - 0x10]
jmp 0x412015
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4120a0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x412162
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x412162
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x412159
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x412123
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4120f5
mov ecx, dword [ebp - 4]
cmp esi, 0x805acd19
je 0x412137
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x412159
mov ebx, dword [ebp - 0x10]
jmp 0x4120e5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret