joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412de0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x412ea2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x412ea2
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x412e99
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x412e63
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x412e35
mov ecx, dword [ebp - 4]
cmp esi, 0x89eabb08
je 0x412e77
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x412e99
mov ebx, dword [ebp - 0x10]
jmp 0x412e25
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412ef0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f384c]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x412faa
test edx, edx
jne 0x412f26
xor eax, eax
mov dword [0x4f384c], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x412f1b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x412fa0
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x412f91
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x412f60
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xe054604a
je 0x412fae
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x412f50
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f384c], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f384c], eax
mov esp, ebp
pop ebp
ret
Function at 0x412fe0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f3844]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41309a
test edx, edx
jne 0x413016
xor eax, eax
mov dword [0x4f3844], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41300b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413090
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413081
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413050
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x4245c933
je 0x41309e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x413040
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f3844], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f3844], eax
mov esp, ebp
pop ebp
ret
Function at 0x4130d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f3850]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41318a
test edx, edx
jne 0x413106
xor eax, eax
mov dword [0x4f3850], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4130fb
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413180
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413171
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413140
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xe6762c9d
je 0x41318e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x413130
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f3850], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f3850], eax
mov esp, ebp
pop ebp
ret
Function at 0x4131c0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f3848]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41327a
test edx, edx
jne 0x4131f6
xor eax, eax
mov dword [0x4f3848], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4131eb
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413270
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413261
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413230
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xf45eac07
je 0x41327e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x413220
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f3848], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f3848], eax
mov esp, ebp
pop ebp
ret
Function at 0x4132b0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4f383c]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41336a
test edx, edx
jne 0x4132e6
xor eax, eax
mov dword [0x4f383c], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4132db
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413360
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413351
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413320
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xbc45bd19
je 0x41336e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x413310
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4f383c], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4f383c], eax
mov esp, ebp
pop ebp
ret
Function at 0x4133e0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbb7c]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41349a
test edx, edx
jne 0x413416
xor eax, eax
mov dword [0x4fbb7c], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41340b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413490
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413481
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413450
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xea4fd18f
je 0x41349e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x413440
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbb7c], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbb7c], eax
mov esp, ebp
pop ebp
ret
Function at 0x4134d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbb88]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41358a
test edx, edx
jne 0x413506
xor eax, eax
mov dword [0x4fbb88], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4134fb
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413580
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413571
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413540
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xc2455c18
je 0x41358e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x413530
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbb88], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbb88], eax
mov esp, ebp
pop ebp
ret
Function at 0x4135c0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4fbbac]
mov edx, ecx
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41366b
test edx, edx
jne 0x4135e7
xor eax, eax
mov dword [0x4fbbac], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4135dc
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413661
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413652
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413621
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xe95da064
je 0x41366f
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x413611
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbbac], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbbac], eax
mov esp, ebp
pop ebp
ret

Function at 0x4136a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4fbbdc]
sub esp, 0x10
push ebx
push esi
push edi
test eax, eax
jne 0x413740
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop dword [eax]
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x413727
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x4136f5
mov edi, dword [ebp - 8]
cmp ecx, 0x4f644736
je 0x413747
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x413739
cmp dword [edi + 0x18], 0
jne 0x4136d0
xor eax, eax
mov dword [0x4fbbdc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
mov dword [0x4fbbdc], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413760
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbb98]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41381a
test edx, edx
jne 0x413796
xor eax, eax
mov dword [0x4fbb98], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41378b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413810
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413801
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4137d0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x67f5c42d
je 0x41381e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x4137c0
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbb98], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbb98], eax
mov esp, ebp
pop ebp
ret
Function at 0x413850
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [0x4fbbbc]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x41390a
test edx, edx
jne 0x413886
xor eax, eax
mov dword [0x4fbbbc], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x41387b
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413900
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4138f1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4138c0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xb6aa067a
je 0x41390e
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x4138b0
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbbbc], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbbbc], eax
mov esp, ebp
pop ebp
ret

Function at 0x413940
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
nop
movzx edx, word [edi + 0x2c]
xor esi, esi
mov eax, dword [edi + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [eax + edx*2]
cmp eax, ecx
cmova edx, esi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x4139b7
mov edi, edx
mov dl, byte [eax]
lea eax, [eax + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, edi
jne 0x413985
mov edi, dword [ebp - 8]
cmp ecx, 0x4f644736
je 0x4139d2
mov eax, dword [edi]
mov edi, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
je 0x4139c9
cmp dword [edi + 0x18], 0
jne 0x413960
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4139e0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x413aa2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [edx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x413aa2
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413a99
mov edi, dword [eax + 0x20]
add edi, ebx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, ebx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413a63
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413a35
mov ecx, dword [ebp - 4]
cmp esi, 0x52a4cf3a
je 0x413a77
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
je 0x413a99
mov ebx, dword [ebp - 0x10]
jmp 0x413a25
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413b30
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4fbbf8]
mov edx, ecx
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x413bdb
test edx, edx
jne 0x413b57
xor eax, eax
mov dword [0x4fbbf8], eax
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x413b4c
push ebx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x413bd1
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x413bc2
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x413b91
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xd16c1932
je 0x413bdf
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x413b81
pop edi
xor eax, eax
pop esi
pop ebx
mov dword [0x4fbbf8], eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4fbbf8], eax
mov esp, ebp
pop ebp
ret