joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4190b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
push ebx
push esi
push edi
test eax, eax
je 0x4190cb
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
jmp 0x4190d2
mov dword [ebp - 0xc], 0
mov esi, dword [0x4fbe48]
test esi, esi
jne 0x419171
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp + 8], ecx
nop dword [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 4], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x419158
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 4]
imul eax, eax, 0x1000193
mov dword [ebp - 4], eax
cmp edi, ebx
jne 0x419120
cmp eax, 0x87a77597
je 0x41923d
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp + 8], ecx
cmp eax, edx
je 0x419169
cmp dword [ecx + 0x18], 0
jne 0x419100
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbdc8]
test eax, eax
jne 0x4191ff
test esi, esi
je 0x4191f8
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x4191f8
xor ecx, ecx
mov dword [ebp + 8], ecx
cmp dword [eax + 0x18], ecx
je 0x4191f8
mov eax, dword [eax + 0x20]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [eax]
mov edi, 0x811c9dc5
add edx, esi
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4191e6
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test bl, bl
jne 0x4191b5
mov ecx, dword [ebp + 8]
cmp edi, 0x250d0458
je 0x419248
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
inc ecx
add eax, 4
mov dword [ebp + 8], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x4191a5
xor eax, eax
mov dword [0x4fbdc8], eax
movss xmm0, dword [ebp + 0x10]
sub esp, 0x10
mov esi, dword [ebp - 0x18]
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp + 0xc]
movss dword [esp + 8], xmm0
movss dword [esp + 4], xmm3
movss dword [esp], xmm2
push dword [ebp - 0xc]
push dword [esi]
call eax
test eax, eax
je 0x419262
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x18]
jmp 0x41916b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4191fa
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x419270
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
push ebx
lea ecx, [eax + 4]
mov dword [ebp - 0x1c], eax
mov dword [ecx], 0
push esi
mov dword [eax], 0x404744
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], ecx
push edi
test esi, esi
jne 0x419325
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x41930c
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x4192d4
cmp eax, 0x87a77597
je 0x4193ce
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x41931d
cmp dword [ecx + 0x18], 0
jne 0x4192b6
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbe54]
test eax, eax
jne 0x4193ba
test esi, esi
je 0x4193b3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x4193b3
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x4193b3
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4193a1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x419370
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0xb649055b
je 0x4193d9
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x419360
xor eax, eax
mov dword [0x4fbe54], eax
push dword [ebp - 0x18]
call eax
mov ecx, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov dword [ecx + 8], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x41931f
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4193b5
Function at 0x4193f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
push ebx
push esi
push edi
mov dword [eax], 0x404744
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x4194a1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop word [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x419488
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x419450
cmp eax, 0x87a77597
je 0x419551
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x419499
cmp dword [ecx + 0x18], 0
jne 0x419430
xor esi, esi
mov dword [0x4fbe48], esi
mov ecx, dword [0x4fbda4]
test ecx, ecx
jne 0x41953b
test esi, esi
je 0x419533
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
xor ecx, ecx
mov dword [ebp - 4], eax
cmp eax, esi
je 0x419535
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x419533
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x419521
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x4194f0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0x56f830de
je 0x41955c
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x4194e0
xor ecx, ecx
mov dword [0x4fbda4], ecx
mov esi, dword [ebp - 0x18]
lea eax, [esi + 4]
push eax
call ecx
pop edi
mov dword [esi], 0x404740
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x41949b
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + esi]
add ecx, esi
jmp 0x419535
Function at 0x419580
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4fba14]
push ebx
push esi
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4fba10]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
push edi
test esi, esi
jne 0x419631
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x419618
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x4195e0
cmp eax, 0x87a77597
je 0x4196e4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x419629
cmp dword [ecx + 0x18], 0
jne 0x4195c2
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbe74]
test eax, eax
jne 0x4196ca
test esi, esi
je 0x4196c3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x4196c3
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x4196c3
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4196b1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x419680
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0x7ca60c73
je 0x4196ef
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x419670
xor eax, eax
mov dword [0x4fbe74], eax
push dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [esi + 4]
call eax
pop edi
mov dword [esi + 8], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x41962b
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4196c5
Function at 0x419710
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
push ebx
mov dword [ebp - 0x18], eax
push esi
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
push edi
test eax, eax
je 0x419733
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
jmp 0x41973a
mov dword [ebp - 0xc], 0
mov esi, dword [0x4fbe48]
test esi, esi
jne 0x4197d1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp + 0xc], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 4], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4197b8
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 4]
imul eax, eax, 0x1000193
mov dword [ebp - 4], eax
cmp edi, ebx
jne 0x419780
cmp eax, 0x87a77597
je 0x419884
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp + 0xc], ecx
cmp eax, edx
je 0x4197c9
cmp dword [ecx + 0x18], 0
jne 0x419760
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbe60]
test eax, eax
jne 0x41986a
test esi, esi
je 0x419863
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp + 0xc], eax
cmp eax, esi
je 0x419863
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x419863
mov eax, dword [eax + 0x20]
mov edx, dword [ebp + 0xc]
add eax, esi
mov dword [ebp - 8], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x419851
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x419820
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edi, 0xc9bb43f5
je 0x41988f
mov eax, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x419810
xor eax, eax
mov dword [0x4fbe60], eax
mov esi, dword [ebp - 0x18]
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call eax
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x18]
jmp 0x4197cb
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x419865
Function at 0x4198b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4fbe24]
sub esp, 0x14
push ebx
push esi
push edi
test eax, eax
jne 0x419a0c
mov esi, dword [0x4fbe48]
mov dword [0x4fbe24], 0x4fbe1c
test esi, esi
jne 0x419965
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x41994c
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x419914
cmp eax, 0x87a77597
je 0x419a13
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x41995d
cmp dword [ecx + 0x18], 0
jne 0x4198f6
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbe0c]
test eax, eax
jne 0x4199fa
test esi, esi
je 0x4199f3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x4199f3
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x4199f3
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4199e1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x4199b0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0x539d426d
je 0x419a1e
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x4199a0
xor eax, eax
mov dword [0x4fbe0c], eax
push 0x4fbe1c
call eax
mov ecx, dword [0x4fbe24]
mov dword [ecx + 4], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x41995f
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4199f5
Function at 0x419a40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], ecx
push edi
test esi, esi
jne 0x419ae1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x419ac8
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x419a90
cmp eax, 0x87a77597
je 0x419b88
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x419ad9
cmp dword [ecx + 0x18], 0
jne 0x419a72
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbd98]
test eax, eax
jne 0x419b7a
test esi, esi
je 0x419b73
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x419b73
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x419b73
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x419b61
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x419b30
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0xad86bb7d
je 0x419b93
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x419b20
xor eax, eax
mov dword [0x4fbd98], eax
mov ecx, dword [ebp - 0x18]
push dword [ecx]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x419adb
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4fbd98], eax
push dword [ecx]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419f40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], ecx
push edi
test esi, esi
jne 0x419fe1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x419fc8
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x419f90
cmp eax, 0x87a77597
je 0x41a088
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x419fd9
cmp dword [ecx + 0x18], 0
jne 0x419f72
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbdec]
test eax, eax
jne 0x41a07a
test esi, esi
je 0x41a073
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x41a073
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x41a073
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x41a061
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x41a030
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0x415ce011
je 0x41a093
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x41a020
xor eax, eax
mov dword [0x4fbdec], eax
mov ecx, dword [ebp - 0x18]
push dword [ecx]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x419fdb
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4fbdec], eax
push dword [ecx]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a0c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
push ebx
push esi
push edi
mov dword [eax], 0x404748
mov esi, dword [0x4fbe48]
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x41a171
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop word [eax + eax]
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x41a158
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x41a120
cmp eax, 0x87a77597
je 0x41a219
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x41a169
cmp dword [ecx + 0x18], 0
jne 0x41a100
xor esi, esi
mov dword [0x4fbe48], esi
mov eax, dword [0x4fbda0]
test eax, eax
jne 0x41a20a
test esi, esi
je 0x41a203
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
lea eax, [esi + ecx]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x41a203
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [eax + 0x18], ecx
je 0x41a203
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [eax]
mov edi, 0x811c9dc5
add eax, esi
mov bl, byte [eax]
inc eax
test bl, bl
je 0x41a1f1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x41a1c0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, 0x5ac41f35
je 0x41a224
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x41a1b0
xor eax, eax
mov dword [0x4fbda0], eax
mov ecx, dword [ebp - 0x18]
push dword [ecx + 4]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x18]
jmp 0x41a16b
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4fbda0], eax
push dword [ecx + 4]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret