joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14d5c930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
cmp edi, dword [esi + 0x18]
jb 0x14d5c980
cmp dword [esi], 0
mov edx, dword [esi + 4]
je 0x14d5c973
mov ebx, dword [esi + 8]
mov ecx, edi
shr ecx, 4
mov eax, edi
sub eax, ecx
cmp ebx, eax
jb 0x14d5c973
mov eax, 0x15555554
nop dword [eax]
mov ecx, eax
lea eax, [ecx - 1]
and eax, ecx
jne 0x14d5c960
cmp edx, ecx
jne 0x14d5c971
cmp edi, ebx
jne 0x14d5c973
add edx, edx
push dword [ebp + 0x10]
mov ecx, esi
push 1
push edx
call fcn.14d5e110
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov edx, ebx
mov eax, 0x811c9dc5
lea ecx, [ebx + 4]
cmp ecx, ebx
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
cmp edx, ecx
ja 0x14d5c9b3
nop dword [eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, ebx
jne 0x14d5c9a0
mov ecx, dword [esi + 4]
imul edx, eax, 0x3874e607
dec ecx
mov dword [ebp + 0x10], ecx
and edx, ecx
mov ecx, dword [esi]
lea eax, [edx + edx*2]
lea ecx, [ecx + eax*4]
mov eax, dword [ecx + 4]
cmp eax, 1
ja 0x14d5ca22
cmp ecx, dword [esi + 0x10]
je 0x14d5ca22
cmp ecx, dword [esi + 0x14]
je 0x14d5ca22
test eax, eax
jne 0x14d5ca1d
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
cmp edx, 1
ja 0x14d5ca07
xor eax, eax
test edx, edx
setne al
lea eax, [eax*4 + 0x10]
mov dword [eax + esi], ecx
mov eax, dword [ebp + 8]
inc dword [esi + 8]
inc dword [esi + 0xc]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
mov ebx, dword [ebp + 0xc]
jmp 0x14d5ca3b
mov ebx, dword [ebp + 0xc]
cmp eax, dword [ebx]
jne 0x14d5ca39
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
pop ebp
ret 0xc
xor ecx, ecx
mov edi, 1
add edx, edi
and edx, dword [ebp + 0x10]
mov dword [ebp + 0xc], edx
lea eax, [edx + edx*2]
mov edx, dword [esi]
lea edx, [edx + eax*4]
mov eax, dword [edx + 4]
cmp eax, 1
ja 0x14d5ca72
cmp edx, dword [esi + 0x10]
je 0x14d5ca72
cmp edx, dword [esi + 0x14]
je 0x14d5ca72
test eax, eax
je 0x14d5ca7c
test ecx, ecx
jne 0x14d5ca76
mov ecx, edx
inc edi
mov edx, dword [ebp + 0xc]
jmp 0x14d5ca40
cmp eax, dword [ebx]
je 0x14d5cac5
mov edx, dword [ebp + 0xc]
inc edi
jmp 0x14d5ca40
mov edi, edx
test ecx, ecx
je 0x14d5ca86
mov edx, ecx
mov edi, ecx
mov eax, dword [ebx]
mov dword [edx + 4], eax
mov dword [edx + 8], 0
mov ebx, dword [edi + 4]
cmp ebx, 1
ja 0x14d5caab
xor eax, eax
test ebx, ebx
setne al
lea eax, [eax*4 + 0x10]
mov dword [eax + esi], edi
inc dword [esi + 8]
test ecx, ecx
jne 0x14d5cab5
inc dword [esi + 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov byte [eax + 4], 1
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov byte [eax + 4], 0
pop ebp
ret 0xc
Function at 0x14d5cc80
Capabilities:
Encode data using xor

Disassembly:
jp 0x14d5cc81
jmp dword [edi - 0x6150ca7b]
cmpsd dword [esi], dword es:[edi]
test dword [0xf92a9eaf], esi
out dx, al
lodsb al, byte [esi]
daa
xor eax, dword [ebp + 0x71f80766]
std
dec ebp
mov esi, 0xd9be7a90
mov edx, dword [ebp + 2]
dec ebp
popfd
xor bl, byte [edx + 0x74c8a94a]
dec edx
rcr dword [0x71d9104], 1
popfd
and al, 0x6a
or byte es:[ecx + 0xe], bh
in eax, 0x24
invalid
Function at 0x14d5dc10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 8], 0
je 0x14d5dd6a
mov ecx, ebx
call fcn.14d5d8a0
mov edx, dword [ebx]
mov ecx, eax
mov dword [ebp - 4], ecx
test edx, edx
je 0x14d5dc43
mov eax, dword [ebx + 4]
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
jmp 0x14d5dc45
xor eax, eax
mov dword [ebp - 8], eax
cmp ecx, eax
je 0x14d5dd6a
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
lea ebx, [ecx + 4]
xor edi, edi
lea edx, [ebx + 4]
mov esi, ebx
cmp edx, ebx
mov eax, 0x811c9dc5
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
mov dword [ebp - 0xc], ebx
lea ebx, [ecx + 4]
cmp ebx, edx
mov ebx, dword [ebp + 8]
ja 0x14d5dc96
mov ebx, dword [ebp - 0xc]
nop
movzx edx, byte [esi]
lea esi, [esi + 1]
xor edx, eax
inc edi
imul eax, edx, 0x1000193
cmp edi, ebx
jne 0x14d5dc80
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
imul edi, eax, 0x3874e607
mov edx, dword [esi + 4]
dec edx
and edi, edx
mov dword [ebp - 0xc], edx
mov edx, dword [esi]
lea eax, [edi + edi*2]
cmp dword [edx + eax*4 + 4], 0
lea edx, [edx + eax*4]
jne 0x14d5dcc1
cmp edx, dword [esi + 0x10]
je 0x14d5dcc1
cmp edx, dword [esi + 0x14]
jne 0x14d5dcf9
mov ebx, dword [ebp + 0xc]
mov esi, 1
mov ecx, dword [ebp - 0xc]
nop dword [eax]
mov edx, dword [ebx]
add edi, esi
and edi, ecx
lea eax, [edi + edi*2]
cmp dword [edx + eax*4 + 4], 0
lea edx, [edx + eax*4]
jne 0x14d5dced
cmp edx, dword [ebx + 0x10]
je 0x14d5dced
cmp edx, dword [ebx + 0x14]
jne 0x14d5dcf0
inc esi
jmp 0x14d5dcd0
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov edi, dword [edx + 4]
cmp edi, 1
ja 0x14d5dd1e
xor eax, eax
test edi, edi
setne al
lea eax, [eax*4 + 0x10]
mov dword [eax + esi], edx
inc dword [esi + 8]
inc dword [esi + 0xc]
cmp dword [ebp + 0x10], ecx
mov eax, dword [ebx + 4]
cmovne edx, dword [ebp + 0x10]
add ecx, 0xc
mov edi, edx
mov dword [ebp - 4], ecx
mov dword [ebp + 0x10], edi
lea edx, [eax + eax*2]
mov eax, dword [ebx]
lea eax, [eax + edx*4]
cmp ecx, eax
je 0x14d5dd5f
cmp dword [ecx + 4], 1
ja 0x14d5dd5c
cmp ecx, dword [ebx + 0x10]
je 0x14d5dd5c
cmp ecx, dword [ebx + 0x14]
je 0x14d5dd5c
add ecx, 0xc
cmp ecx, eax
jne 0x14d5dd45
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp - 8]
jne 0x14d5dc56
jmp 0x14d5dd70
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebx]
test edx, edx
je 0x14d5dd8e
mov ecx, dword [ebx + 4]
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*4]
cmp edi, ecx
je 0x14d5dd8e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 4]
pop edi
lea ecx, [eax + eax*2]
mov eax, dword [esi]
pop esi
pop ebx
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x14d5ddb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 8], 0
je 0x14d5def6
mov ecx, ebx
call fcn.14d5d8f0
mov edx, dword [ebx]
mov ecx, eax
mov dword [ebp - 4], ecx
test edx, edx
je 0x14d5dde0
mov eax, dword [ebx + 4]
lea eax, [edx + eax*8]
jmp 0x14d5dde2
xor eax, eax
mov dword [ebp - 8], eax
cmp ecx, eax
je 0x14d5def6
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
lea ebx, [ecx + 4]
xor edi, edi
lea edx, [ebx + 4]
mov esi, ebx
cmp edx, ebx
mov eax, 0x811c9dc5
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
mov dword [ebp - 0xc], ebx
lea ebx, [ecx + 4]
cmp ebx, edx
mov ebx, dword [ebp + 8]
ja 0x14d5de36
mov ebx, dword [ebp - 0xc]
nop dword [eax]
movzx edx, byte [esi]
lea esi, [esi + 1]
xor edx, eax
inc edi
imul eax, edx, 0x1000193
cmp edi, ebx
jne 0x14d5de20
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
imul esi, eax, 0x3874e607
mov edx, dword [edi + 4]
mov eax, dword [edi]
dec edx
and esi, edx
mov dword [ebp - 0xc], edx
cmp dword [eax + esi*8 + 4], 0
lea edx, [eax + esi*8]
jne 0x14d5de5e
cmp edx, dword [edi + 0x10]
je 0x14d5de5e
cmp edx, dword [edi + 0x14]
jne 0x14d5de91
mov ebx, dword [ebp - 0xc]
mov eax, 1
mov ecx, dword [edi]
nop dword [eax + eax]
add esi, eax
and esi, ebx
cmp dword [ecx + esi*8 + 4], 0
lea edx, [ecx + esi*8]
jne 0x14d5de88
cmp edx, dword [edi + 0x10]
je 0x14d5de88
cmp edx, dword [edi + 0x14]
jne 0x14d5de8b
inc eax
jmp 0x14d5de70
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov esi, dword [ecx + 4]
mov dword [edx + 4], esi
cmp esi, 1
ja 0x14d5dead
xor eax, eax
test esi, esi
setne al
lea eax, [eax*4 + 0x10]
mov dword [eax + edi], edx
inc dword [edi + 8]
inc dword [edi + 0xc]
cmp dword [ebp + 0x10], ecx
mov eax, dword [ebx]
cmovne edx, dword [ebp + 0x10]
add ecx, 8
mov esi, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 0x10], esi
lea eax, [eax + edx*8]
cmp ecx, eax
je 0x14d5deeb
cmp dword [ecx + 4], 1
ja 0x14d5dee8
cmp ecx, dword [ebx + 0x10]
je 0x14d5dee8
cmp ecx, dword [ebx + 0x14]
je 0x14d5dee8
add ecx, 8
cmp ecx, eax
jne 0x14d5ded1
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp - 8]
jne 0x14d5ddf3
jmp 0x14d5defc
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
test edx, edx
je 0x14d5df17
mov ecx, dword [ebx + 4]
lea ecx, [edx + ecx*8]
cmp esi, ecx
je 0x14d5df17
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 4]
mov eax, dword [edi]
pop edi
pop esi
pop ebx
lea eax, [eax + ecx*8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x14d5e700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 8], 0
je 0x14d5e7d6
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov esi, ecx
mov eax, 0x811c9dc5
lea edx, [ecx + 4]
cmp edx, ecx
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 4
cmp esi, edx
ja 0x14d5e745
mov edx, ecx
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, edx
jne 0x14d5e732
mov edi, dword [ebx + 4]
mov edx, dword [ebx]
imul esi, eax, 0x3874e607
lea ecx, [edi - 1]
mov dword [ebp - 4], ecx
and esi, ecx
lea eax, [esi + esi*2]
lea ecx, [edx + eax*4]
mov eax, dword [ecx + 4]
cmp eax, 1
ja 0x14d5e793
cmp ecx, dword [ebx + 0x10]
je 0x14d5e793
cmp ecx, dword [ebx + 0x14]
je 0x14d5e793
test eax, eax
jne 0x14d5e7ab
test edx, edx
je 0x14d5e7fd
lea eax, [edi + edi*2]
lea ecx, [edx + eax*4]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 0xc]
cmp eax, dword [edi]
jne 0x14d5e7ae
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 0xc]
mov edx, 1
mov ecx, dword [ebx]
add esi, edx
and esi, dword [ebp - 4]
lea eax, [esi + esi*2]
lea ecx, [ecx + eax*4]
mov eax, dword [ecx + 4]
cmp eax, 1
ja 0x14d5e7f6
cmp ecx, dword [ebx + 0x10]
je 0x14d5e7f6
cmp ecx, dword [ebx + 0x14]
je 0x14d5e7f6
test eax, eax
jne 0x14d5e7fa
mov ecx, dword [ebx]
test ecx, ecx
je 0x14d5e7fd
mov eax, dword [ebx + 4]
pop edi
pop esi
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, dword [edi]
je 0x14d5e7ff
inc edx
jmp 0x14d5e7b3
xor ecx, ecx
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x14d6fa90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
cmp edi, dword [esi + 0x18]
jb 0x14d6fae0
cmp dword [esi], 0
mov edx, dword [esi + 4]
je 0x14d6fad3
mov ebx, dword [esi + 8]
mov ecx, edi
shr ecx, 4
mov eax, edi
sub eax, ecx
cmp ebx, eax
jb 0x14d6fad3
mov eax, 0x1ffffffe
nop dword [eax]
mov ecx, eax
lea eax, [ecx - 1]
and eax, ecx
jne 0x14d6fac0
cmp edx, ecx
jne 0x14d6fad1
cmp edi, ebx
jne 0x14d6fad3
add edx, edx
push dword [ebp + 0x10]
mov ecx, esi
push 1
push edx
call fcn.14d87bb0
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov edx, ebx
mov eax, 0x811c9dc5
lea ecx, [ebx + 4]
cmp ecx, ebx
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
cmp edx, ecx
ja 0x14d6fb13
nop dword [eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, ebx
jne 0x14d6fb00
mov ecx, dword [esi + 4]
imul eax, eax, 0x3874e607
dec ecx
mov dword [ebp + 0x10], ecx
and eax, ecx
mov ecx, dword [esi]
mov edx, dword [ecx + eax*8 + 4]
lea ecx, [ecx + eax*8]
cmp edx, 1
ja 0x14d6fb79
cmp ecx, dword [esi + 0x10]
je 0x14d6fb79
cmp ecx, dword [esi + 0x14]
je 0x14d6fb79
test edx, edx
jne 0x14d6fb74
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov dword [ecx + 4], eax
cmp edx, 1
ja 0x14d6fb5e
xor eax, eax
test edx, edx
setne al
lea eax, [eax*4 + 0x10]
mov dword [eax + esi], ecx
mov eax, dword [ebp + 8]
inc dword [esi + 8]
inc dword [esi + 0xc]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
mov ebx, dword [ebp + 0xc]
jmp 0x14d6fb92
mov ebx, dword [ebp + 0xc]
cmp edx, dword [ebx]
jne 0x14d6fb90
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
pop ebp
ret 0xc
xor ecx, ecx
mov edi, 1
mov edx, dword [esi]
add eax, edi
and eax, dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
lea edx, [edx + eax*8]
mov eax, dword [edx + 4]
cmp eax, 1
ja 0x14d6fbc6
cmp edx, dword [esi + 0x10]
je 0x14d6fbc6
cmp edx, dword [esi + 0x14]
je 0x14d6fbc6
test eax, eax
je 0x14d6fbd0
test ecx, ecx
jne 0x14d6fbca
mov eax, dword [ebp + 0xc]
mov ecx, edx
inc edi
jmp 0x14d6fb97
cmp eax, dword [ebx]
je 0x14d6fc12
mov eax, dword [ebp + 0xc]
inc edi
jmp 0x14d6fb97
mov edi, edx
test ecx, ecx
je 0x14d6fbda
mov edx, ecx
mov edi, ecx
mov eax, dword [ebx]
mov dword [edx + 4], eax
mov ebx, dword [edi + 4]
cmp ebx, 1
ja 0x14d6fbf8
xor eax, eax
test ebx, ebx
setne al
lea eax, [eax*4 + 0x10]
mov dword [eax + esi], edi
inc dword [esi + 8]
test ecx, ecx
jne 0x14d6fc02
inc dword [esi + 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov byte [eax + 4], 1
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov byte [eax + 4], 0
pop ebp
ret 0xc
Function at 0x14d7e6f0
Capabilities:
Encode data using xor

Disassembly:
fdiv qword [edx - 0x35]
xchg dh, ch
adc edi, ecx
mov edx, 0x6680b8c9
movsb byte es:[edi], byte [esi]
pushfd
call 0xbc2bf5d7
test dword [edi - 0x49023920], edx
inc esp
pop esp
adc byte [ebx + 0x3a4d8e7], cl
inc ecx
outsd dx, dword [esi]
xor al, 0x60
jle 0x14d7e642
pop ecx
out 0x88, eax
xor al, 0x6a
mov dword [edx + 0x14], ebp
cld
adc eax, 0xdcbf9d1b
dec esp
dec esp
or byte [esi - 0x67], 0xe4
fcomp dword [eax]
push 0xd345c49e
inc ebp
lahf
jns 0x14d7e6db
cmp al, 0xee
movsb byte es:[edi], byte [esi]
ljmp 0xd054
push 0x2e4d71c
dec ecx
cmpsb byte [esi], byte es:[edi]
sahf
aam 0xb3
jp 0x14d7e61f
mov edi, 0xd71ab173
push ds
fdiv dword [0xf5322881]
pop eax
add bl, dl
and dword [ecx + 0x31bba9ce], ebp
pop edi
sbb eax, 0x18fb27e9
xchg ebx, eax
retf 0x1ad0
dec ecx
inc esp
lcall 0x4e1, 0xf68f3c44
xlatb
int3
adc ch, al
popfd
std
jne 0x14d7e74e
lcall 0x2255, 0x75122aea
jp 0x14d7e686
mov edx, 0x23fe748c
ret
arpl word [ecx + 0x69], bx
fsubr st(7)
and byte [edi], 0x7c
push 0xa4adeef3
xor al, dh
imul ebp, dword [ecx], 0x31
mov dh, 0x67
pop ebp
lodsd eax, dword [esi]
sub si, word [edi + 0x317532df]
sbb edx, ebp
xor dword [esi], ebp
sbb edx, ebp
popal
test eax, 0xa5d3dbc5
and eax, dword cs:[ecx]
dec ebx
lock sub ecx, dword [ebp + 0x5a]
sbb bx, bx
xor byte [edx - 0x55371452], dl
push ebx
cmpsb byte [esi], byte es:[edi]
push ds
leave
stc
ja 0x14d7e732
sbb byte [edx + 0x6a48a660], al
mov edx, 0x9c51911a
inc sp
nop
jns 0x14d7e7b9
test eax, 0xe82b79ae
movsb byte es:[edi], byte [esi]
mov word [esi], es
leave
insb byte es:[edi], dx
add byte [edi], dl
aad 0x7c
mov bh, 0xdb
sub esi, dword [edx + ebx*2 - 0x616269c9]
aas
jae 0x14d7e748
pop es
stc
and eax, 0xfba8a047
pop ss
cmpsd dword [esi], dword es:[edi]
int1
leave
adc edi, ebx
sub esi, dword [ebx + 0x49496d71]
in al, 0x68
pop esp
cmp eax, 0x677fc1ec
xchg ebx, eax
lds edx, [edi + ecx]
invalid
Function at 0x14d83bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
cmp dword [ebx + 8], 0
je 0x14d83d50
mov ecx, ebx
call fcn.14d81130
mov edx, dword [ebx]
mov ecx, eax
mov dword [ebp - 4], ecx
test edx, edx
je 0x14d83c22
mov eax, dword [ebx + 4]
lea eax, [eax + eax*2]
lea eax, [edx + eax*8]
jmp 0x14d83c24
xor eax, eax
mov dword [ebp - 8], eax
cmp ecx, eax
je 0x14d83d50
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
push edi
lea ebx, [ecx + 8]
xor edi, edi
lea edx, [ebx + 8]
mov dword [ebp - 0xc], ebx
cmp edx, ebx
mov esi, ebx
mov eax, 0x811c9dc5
sbb ebx, ebx
and ebx, 0xfffffff8
add ebx, 8
cmp esi, edx
ja 0x14d83c69
movzx edx, byte [esi]
lea esi, [esi + 1]
xor edx, eax
inc edi
imul eax, edx, 0x1000193
cmp edi, ebx
jne 0x14d83c56
mov ebx, dword [ebp + 0xc]
imul edi, eax, 0x3874e607
mov edx, dword [ebx + 4]
dec edx
and edi, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebx]
lea eax, [edi + edi*2]
lea edx, [edx + eax*8]
mov eax, dword [edx + 8]
or eax, dword [edx + 0xc]
jne 0x14d83c95
cmp edx, dword [ebx + 0x10]
je 0x14d83c95
cmp edx, dword [ebx + 0x14]
jne 0x14d83cc4
mov ecx, dword [ebx + 0x10]
mov esi, 1
nop dword [eax]
mov edx, dword [ebx]
add edi, esi
and edi, dword [ebp - 0xc]
lea eax, [edi + edi*2]
lea edx, [edx + eax*8]
mov eax, dword [edx + 8]
or eax, dword [edx + 0xc]
jne 0x14d83cbe
cmp edx, ecx
je 0x14d83cbe
cmp edx, dword [ebx + 0x14]
jne 0x14d83cc1
inc esi
jmp 0x14d83ca0
mov ecx, dword [ebp - 4]
movups xmm0, xmmword [ecx + 8]
movups xmmword [edx + 8], xmm0
mov esi, dword [edx + 0xc]
mov eax, dword [edx + 8]
test esi, esi
ja 0x14d83cee
jb 0x14d83cdd
cmp eax, 1
ja 0x14d83cee
or eax, esi
mov eax, 0x10
je 0x14d83ceb
mov eax, 0x14
mov dword [eax + ebx], edx
inc dword [ebx + 8]
inc dword [ebx + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0x10], ecx
cmovne edx, dword [ebp + 0x10]
add ecx, 0x18
mov eax, dword [ebx + 4]
mov esi, edx
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ecx
lea edx, [eax + eax*2]
mov eax, dword [ebx]
lea edx, [eax + edx*8]
cmp ecx, edx
je 0x14d83d44
lea eax, [ecx + 8]
nop dword [eax + eax]
cmp dword [eax + 4], 0
ja 0x14d83d41
jb 0x14d83d2d
cmp dword [eax], 1
ja 0x14d83d41
cmp ecx, dword [ebx + 0x10]
je 0x14d83d41
cmp ecx, dword [ebx + 0x14]
je 0x14d83d41
add ecx, 0x18
add eax, 0x18
cmp ecx, edx
jne 0x14d83d20
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp - 8]
jne 0x14d83c36
pop edi
jmp 0x14d83d53
mov esi, dword [ebp + 0x10]
mov edx, dword [ebx]
test edx, edx
je 0x14d83d70
mov ecx, dword [ebx + 4]
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*8]
cmp esi, ecx
je 0x14d83d70
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
pop esi
pop ebx
mov eax, dword [edx + 4]
lea ecx, [eax + eax*2]
mov eax, dword [edx]
lea eax, [eax + ecx*8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x14d8a960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 4], ebx
cmp dword [ebx + 8], 0
je 0x14d8aa75
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov eax, 0x811c9dc5
mov esi, ecx
lea edx, [ecx + 8]
cmp edx, ecx
sbb ebx, ebx
and ebx, 0xfffffff8
add ebx, 8
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
cmp ecx, edx
ja 0x14d8a9b6
mov ebx, dword [ebp - 8]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, ebx
jne 0x14d8a9a0
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
dec ecx
imul edi, eax, 0x3874e607
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
and edi, ecx
lea eax, [edi + edi*2]
mov esi, dword [edx + eax*8 + 0xc]
lea eax, [edx + eax*8]
mov ecx, dword [eax + 8]
test esi, esi
ja 0x14d8aa14
jb 0x14d8a9e2
cmp ecx, 1
ja 0x14d8aa14
cmp eax, dword [ebx + 0x10]
je 0x14d8aa14
cmp eax, dword [ebx + 0x14]
je 0x14d8aa14
or ecx, esi
jne 0x14d8aa33
test edx, edx
je 0x14d8aaa6
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 8]
pop edi
pop esi
lea eax, [eax + eax*2]
lea eax, [edx + eax*8]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
cmp ecx, dword [edx]
jne 0x14d8aa36
cmp esi, dword [edx + 4]
jne 0x14d8aa36
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], ebx
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov esi, 1
nop dword [eax + eax]
mov ecx, dword [ebp - 0xc]
add edi, esi
and edi, dword [ebp - 8]
lea eax, [edi + edi*2]
mov ebx, dword [ecx + eax*8 + 0xc]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 8]
test ebx, ebx
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 4]
ja 0x14d8aa97
jb 0x14d8aa66
cmp ecx, 1
ja 0x14d8aa97
cmp eax, dword [ebx + 0x10]
je 0x14d8aa97
cmp eax, dword [ebx + 0x14]
je 0x14d8aa97
or ecx, dword [ebp + 0xc]
jne 0x14d8aaa3
mov ecx, dword [ebx]
test ecx, ecx
je 0x14d8aaa6
mov eax, dword [ebx + 4]
pop edi
pop esi
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp ecx, dword [edx]
jne 0x14d8aaa3
mov ecx, dword [eax + 0xc]
cmp ecx, dword [edx + 4]
je 0x14d8aaa8
inc esi
jmp 0x14d8aa40
xor eax, eax
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], ebx
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x14d91e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov dword [ebp - 4], ecx
mov eax, 0x811c9dc5
mov ecx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
lea edx, [ecx + 4]
cmp edx, ecx
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
cmp ecx, edx
ja 0x14d91e46
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, ebx
jne 0x14d91e30
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
imul esi, eax, 0x3874e607
mov edx, dword [ebx + 4]
mov edi, dword [ebx]
mov dword [ebp - 8], edx
dec edx
and esi, edx
mov dword [ebp - 0xc], edx
mov edx, dword [edi + esi*8 + 4]
lea eax, [edi + esi*8]
cmp edx, 1
ja 0x14d91e8a
cmp eax, dword [ebx + 0x10]
je 0x14d91e8a
cmp eax, dword [ebx + 0x14]
je 0x14d91e8a
test edx, edx
jne 0x14d91e8e
test edi, edi
je 0x14d91eb6
mov eax, dword [ebp - 8]
lea eax, [edi + eax*8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edx, dword [ecx]
je 0x14d91eb8
mov edx, 1
add esi, edx
and esi, dword [ebp - 0xc]
mov ecx, dword [edi + esi*8 + 4]
lea eax, [edi + esi*8]
cmp ecx, 1
ja 0x14d91ec1
cmp eax, dword [ebx + 0x10]
je 0x14d91ec1
cmp eax, dword [ebx + 0x14]
je 0x14d91ec1
test ecx, ecx
jne 0x14d91ecb
test edi, edi
jne 0x14d91e7b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
cmp ecx, dword [ebx]
mov ebx, dword [ebp - 4]
je 0x14d91eb8
inc edx
jmp 0x14d91e93
Function at 0x4014a3
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x228]
sub esp, 0x24c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [0x473be8]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
or eax, 8
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x4015c7
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea edi, [ebp - 0x222]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x228]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x22c]
sub esp, 0x10
test eax, eax
jne 0x401561
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x228]
je 0x401546
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, 1
jmp 0x4015c7
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004014a3
sub esp, 0xc
test eax, eax
je 0x4014fc
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 3
call fcn.00408bda
test eax, eax
push edi
je 0x4015a2
mov edx, dword [0x473be8]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x4015c7
cmp dword [0x473be8], 0
mov eax, 1
jne 0x4015c7
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
push edx
push edx
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc