joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bd50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181dbec]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp dword [eax + 0x6b4], 0
je 0x41bd8c
push 0xff
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push edx
push ecx
call dword [0x83d688]
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ebx, word [eax + 0x2c]
xor esi, esi
mov ecx, dword [eax + 0x30]
xor edi, edi
shr ebx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea edx, [ecx + ebx*2]
cmp ecx, edx
cmova ebx, esi
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x41bdf5
mov eax, ebx
mov bl, byte [ecx]
lea ecx, [ecx + 2]
movsx esi, bl
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
cmova edx, esi
inc edi
xor edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
cmp edi, eax
jne 0x41bdc3
mov eax, dword [ebp - 8]
cmp edx, 0x8ec4c73b
je 0x41bdf9
mov eax, dword [eax]
jmp 0x41bd9b
mov ebx, dword [eax + 0x18]
mov eax, dword [0x181dff8]
mov dword [ebp - 8], ebx
test eax, eax
jne 0x41bebb
test ebx, ebx
je 0x41beb4
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
je 0x41beb6
mov ecx, dword [edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x41beb4
mov edi, dword [edx + 0x20]
add edi, ebx
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x41be84
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x41be53
cmp esi, 0xf0dcc1d0
je 0x41be94
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
add edi, 4
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x41beb4
mov ebx, dword [ebp - 8]
jmp 0x41be43
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x41beb6
xor eax, eax
mov dword [0x181dff8], eax
push 0xff
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call eax
mov ecx, eax
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
sete al
mov esp, ebp
pop ebp
ret
Function at 0x436100
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x180a1f0]
sub esp, 0x14
cmp eax, 2
jne 0x43625f
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ebx, word [eax + 0x2c]
xor esi, esi
mov ecx, dword [eax + 0x30]
xor edi, edi
shr ebx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea edx, [ecx + ebx*2]
cmp ecx, edx
cmova ebx, esi
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x436182
mov eax, ebx
nop dword [eax + eax]
mov bl, byte [ecx]
lea ecx, [ecx + 2]
movsx esi, bl
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
cmova edx, esi
inc edi
xor edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
cmp edi, eax
jne 0x436150
mov eax, dword [ebp - 8]
cmp edx, 0xa3e6f6c3
je 0x436186
mov eax, dword [eax]
jmp 0x436123
mov ebx, dword [eax + 0x18]
mov eax, dword [0x181e070]
mov dword [ebp - 8], ebx
test eax, eax
jne 0x436248
test ebx, ebx
je 0x436241
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
je 0x436243
mov ecx, dword [edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x436241
mov edi, dword [edx + 0x20]
add edi, ebx
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x436211
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x4361e0
cmp esi, 0xf20f44f9
je 0x436221
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
add edi, 4
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x436241
mov ebx, dword [ebp - 8]
jmp 0x4361d0
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x436243
xor eax, eax
mov dword [0x181e070], eax
call eax
xor ecx, ecx
cmp eax, 0xfde9
pop edi
sete cl
pop esi
mov dword [0x180a1f0], ecx
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x93cf44]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x900620]
mov eax, dword [0x900638]
xor ecx, ecx
cmp dword [0x1817094], 2
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0xc], eax
movq xmm0, qword [0x900630]
mov ax, word [0x90063c]
movq qword [ebp - 0x14], xmm0
mov word [ebp - 8], ax
jl 0x43a303
movaps xmm2, xmmword [0x9046b0]
mov eax, 5
movaps xmm4, xmmword [0x904770]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm5
mov eax, 0x1f
movaps xmm0, xmm1
movd xmm6, eax
mov eax, 0x900620
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x9046e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x9046c0]
paddd xmm2, xmmword [0x9046b0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x904710]
movq xmm0, qword [eax]
pxor xmm1, xmm0
movaps xmm0, xmm2
movq qword [ebp - 0x24], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x9046e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [ebp - 0x1c]
paddw xmm1, xmmword [0x904710]
pxor xmm1, xmm0
movq qword [ebp - 0x1c], xmm1
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax*8]
sub edx, eax
mov eax, ecx
shl edx, 3
sub eax, edx
add eax, 0x35
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
cmp ecx, 0xf
jl 0x43a303
cmp dword [0x181dd24], 8
lea eax, [ebp - 0x24]
mov edx, 0x181dd10
mov ecx, 0x80000001
cmovae edx, dword [0x181dd10]
push 0x1809b30
push eax
call fcn.0041bee0
mov ecx, dword [ebp - 4]
xor eax, eax
add esp, 8
cmp dword [0x1809b40], eax
setne al
xor ecx, ebp
call fcn.005c3e3a
mov esp, ebp
pop ebp
ret
Function at 0x43d9f0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.00430120
push 0
push 0
push esi
push 0x43b910
push 0
push 0
call fcn.006e3f80
add esp, 0x18
pop esi
ret
Function at 0x46a970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x93cf44]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x90184c]
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov ax, word [0x901850]
mov word [ebp - 8], ax
mov al, byte [0x901852]
mov byte [ebp - 6], al
nop dword [eax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, al
shl dl, 3
sub dl, al
mov al, cl
shl dl, 3
sub al, dl
add al, 0x35
xor byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 7
jl 0x46a9a0
push 0xf
lea eax, [ebp - 0xc]
push eax
call fcn.0046daf0
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.005c3e3a
mov esp, ebp
pop ebp
ret
Function at 0x46d020
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
push esi
mov dword [ebp - 0xc], eax
cmp dword [eax + 0x710], 0
jbe 0x46d19a
mov eax, dword fs:[0x30]
push ebx
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ebx, word [eax + 0x2c]
xor esi, esi
mov ecx, dword [eax + 0x30]
xor edi, edi
shr ebx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea edx, [ecx + ebx*2]
cmp ecx, edx
cmova ebx, esi
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x46d0a2
mov eax, ebx
nop
mov bl, byte [ecx]
lea ecx, [ecx + 2]
movsx esi, bl
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
cmova edx, esi
inc edi
xor edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
cmp edi, eax
jne 0x46d070
mov eax, dword [ebp - 8]
cmp edx, 0x8ec4c73b
je 0x46d0a6
mov eax, dword [eax]
jmp 0x46d047
mov ebx, dword [eax + 0x18]
mov eax, dword [0x181e000]
mov dword [ebp - 8], ebx
test eax, eax
jne 0x46d168
test ebx, ebx
je 0x46d161
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], edx
cmp edx, ebx
je 0x46d163
mov ecx, dword [edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x46d161
mov edi, dword [edx + 0x20]
add edi, ebx
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x46d131
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x46d100
cmp esi, 0xa4ae4da5
je 0x46d141
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
inc eax
add edi, 4
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x46d161
mov ebx, dword [ebp - 8]
jmp 0x46d0f0
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x46d163
xor eax, eax
mov dword [0x181e000], eax
mov esi, dword [ebp - 0xc]
add esi, 0x700
pop edi
mov ecx, esi
pop ebx
cmp dword [esi + 0x14], 8
jb 0x46d17d
mov ecx, dword [esi]
push ecx
call eax
test eax, eax
je 0x46d197
mov ecx, dword [ebp + 8]
push esi
call fcn.00404820
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add eax, 0x6d0
push eax
call fcn.00404820
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46d900
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x825920
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x5c
mov eax, dword [0x93cf44]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ax, word [0x90187c]
xorps xmm0, xmm0
mov esi, dword [ebx + 8]
xor ecx, ecx
mov word [ebp - 0x68], ax
mov al, byte [0x90187e]
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x66], al
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x6c], ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov cl, al
shl cl, 3
sub cl, al
mov al, byte [ebp - 0x6c]
shl cl, 3
sub al, cl
mov ecx, dword [ebp - 0x6c]
add al, 0x35
xor byte [ebp + ecx - 0x68], al
inc ecx
mov dword [ebp - 0x6c], ecx
cmp ecx, 3
jl 0x46d962
push dword [ebx + 0xc]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x34]
push 0x20
push eax
call dword [0x83d684]
mov ecx, esi
mov dword [ebp - 0x54], 0
add esp, 0x10
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d9c3
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x64]
call fcn.004062c0
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x181dde0
call fcn.004052c0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0
mov esi, eax
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46da05
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.004062c0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004052c0
mov esi, eax
cmp dword [esi + 8], 8
je 0x46da40
mov ecx, esi
call fcn.00405700
mov dword [esi + 8], 8
mov al, byte [ebx + 0x10]
mov byte [esi], al
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x46da75
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46da6b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46dad6
push edx
push ecx
call fcn.005c4046
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x46dab7
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46daad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46dadb
push edx
push ecx
call fcn.005c4046
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005c3e3a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
call fcn.006d2f99
call fcn.006d2f99
int3
Function at 0x46e360
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
mov dword [ebp - 0x18], eax
cmp dword [eax + 0x864], 0
je 0x46e4d5
mov dword [eax + 0x87c], 0
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ebx, word [eax + 0x2c]
xor esi, esi
mov ecx, dword [eax + 0x30]
xor edi, edi
shr ebx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea edx, [ecx + ebx*2]
cmp ecx, edx
cmova ebx, esi
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x46e3f2
mov eax, ebx
nop dword [eax]
mov bl, byte [ecx]
lea ecx, [ecx + 2]
movsx esi, bl
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
cmova edx, esi
inc edi
xor edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
cmp edi, eax
jne 0x46e3c0
mov eax, dword [ebp - 8]
cmp edx, 0x4f644736
je 0x46e3f6
mov eax, dword [eax]
jmp 0x46e391
mov ecx, dword [0x181e0d0]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 8], ebx
test ecx, ecx
jne 0x46e4ba
test ebx, ebx
je 0x46e4b2
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
je 0x46e4b2
mov ecx, dword [edx + 0x18]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x46e4b2
mov edi, dword [edx + 0x20]
add edi, ebx
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x46e482
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x46e451
cmp esi, 0xe03678e3
je 0x46e492
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
add edi, 4
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x46e4b2
mov ebx, dword [ebp - 8]
jmp 0x46e441
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
add ecx, edx
jmp 0x46e4b4
xor ecx, ecx
mov dword [0x181e0d0], ecx
mov esi, dword [ebp - 0x18]
lea eax, [esi + 0x868]
push eax
push 2
call ecx
pop edi
mov dword [esi + 0x864], 0
pop esi
pop ebx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4792a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x180a1f4]
sub esp, 0x14
cmp eax, 2
jne 0x4793ff
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ebx, word [eax + 0x2c]
xor esi, esi
mov ecx, dword [eax + 0x30]
xor edi, edi
shr ebx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea edx, [ecx + ebx*2]
cmp ecx, edx
cmova ebx, esi
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x479322
mov eax, ebx
nop dword [eax + eax]
mov bl, byte [ecx]
lea ecx, [ecx + 2]
movsx esi, bl
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
cmova edx, esi
inc edi
xor edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
cmp edi, eax
jne 0x4792f0
mov eax, dword [ebp - 8]
cmp edx, 0xa3e6f6c3
je 0x479326
mov eax, dword [eax]
jmp 0x4792c3
mov ebx, dword [eax + 0x18]
mov eax, dword [0x181e070]
mov dword [ebp - 8], ebx
test eax, eax
jne 0x4793e8
test ebx, ebx
je 0x4793e1
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
je 0x4793e3
mov ecx, dword [edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x4793e1
mov edi, dword [edx + 0x20]
add edi, ebx
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x4793b1
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x479380
cmp esi, 0xf20f44f9
je 0x4793c1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
add edi, 4
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x4793e1
mov ebx, dword [ebp - 8]
jmp 0x479370
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4793e3
xor eax, eax
mov dword [0x181e070], eax
call eax
xor ecx, ecx
cmp eax, 0xfde9
pop edi
sete cl
pop esi
mov dword [0x180a1f4], ecx
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47da10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x93cf44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x28]
mov esi, ecx
push eax
call fcn.006dd725
movups xmm0, xmmword [0x902fa4]
mov ax, word [0x902fbc]
add esp, 4
xor ecx, ecx
mov word [ebp - 8], ax
cmp dword [0x1817094], 2
movups xmmword [ebp - 0x20], xmm0
movq xmm0, qword [0x902fb4]
movq qword [ebp - 0x10], xmm0
jl 0x47db60
movaps xmm2, xmmword [0x9046b0]
mov eax, 5
movaps xmm4, xmmword [0x904760]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm5
mov eax, 0x1f
movaps xmm0, xmm1
movd xmm6, eax
mov eax, 0x902fa4
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x9046f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x9046c0]
paddd xmm2, xmmword [0x9046b0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x904710]
movq xmm0, qword [eax]
pxor xmm1, xmm0
movaps xmm0, xmm2
movq qword [ebp - 0x20], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x9046f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [ebp - 0x18]
paddw xmm1, xmmword [0x904710]
pxor xmm1, xmm0
movq qword [ebp - 0x18], xmm1
nop word [eax + eax]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul eax, eax, 0x39
sub edx, eax
add edx, 0x35
xor word [ebp + ecx*2 - 0x20], dx
inc ecx
cmp ecx, 0xd
jl 0x47db60
push dword [ebp - 0x24]
lea eax, [esi + 0x414]
push dword [ebp - 0x28]
push eax
lea eax, [esi + 0x20c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [esi + 4]
push eax
call dword [0x83da58]
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
call fcn.005c3e3a
mov esp, ebp
pop ebp
ret
Function at 0x485940
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebx + 4], eax
je 0x485ab3
cmp byte [ebx + 0x24], 0
je 0x485aa9
mov eax, dword fs:[0x30]
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ebx, word [eax + 0x2c]
xor esi, esi
mov ecx, dword [eax + 0x30]
xor edi, edi
shr ebx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea edx, [ecx + ebx*2]
cmp ecx, edx
cmova ebx, esi
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x4859ca
mov eax, ebx
mov bl, byte [ecx]
lea ecx, [ecx + 2]
movsx esi, bl
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
cmova edx, esi
inc edi
xor edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
cmp edi, eax
jne 0x485998
mov eax, dword [ebp - 8]
cmp edx, 0x39794115
je 0x4859ce
mov eax, dword [eax]
jmp 0x485970
mov ebx, dword [eax + 0x18]
mov eax, dword [0x181dbc0]
mov dword [ebp - 8], ebx
test eax, eax
jne 0x485a98
test ebx, ebx
je 0x485a91
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
mov eax, dword [eax + ebx + 0x7c]
add edx, ebx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
je 0x485a93
mov ecx, dword [edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x485a91
mov edi, dword [edx + 0x20]
add edi, ebx
nop dword [eax + eax]
mov edx, dword [edi]
mov esi, 0x811c9dc5
add edx, ebx
mov bl, byte [edx]
inc edx
test bl, bl
je 0x485a61
movsx ecx, bl
lea edx, [edx + 1]
sub bl, 0x41
mov eax, ecx
or eax, 0x20
cmp bl, 0x19
mov bl, byte [edx - 1]
cmova eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test bl, bl
jne 0x485a30
cmp esi, 0x6b36a56a
je 0x485a71
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
add edi, 4
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x485a91
mov ebx, dword [ebp - 8]
jmp 0x485a20
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x485a93
xor eax, eax
mov dword [0x181dbc0], eax
mov ebx, dword [ebp - 0x18]
push dword [ebx + 4]
call eax
mov eax, dword [ebp + 8]
pop edi
mov byte [ebx + 0x24], 0
pop esi
mov ecx, ebx
mov dword [ebx + 4], eax
call fcn.00485ac0
pop ebx
mov esp, ebp
pop ebp
ret 4