joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4036ba
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, 0x4094e4
mov ecx, dword [ebp + 8]
mov dword [ebx + 8], ecx
jmp loc.00427826

Function at 0x4037ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
jmp loc.00426b4c

Function at 0x403dc2
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x20
mov edi, dword [ebp + 8]
pop ebx
or esi, 0xffffffff
cdq
mov ecx, ebx
mov dword [ebp - 4], 3
idiv ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
cdq
idiv ecx
and dword [ebp + 0xc], 0
mov ecx, edx
shl esi, cl
sub ebx, edx
not esi
mov eax, dword [edi]
mov ecx, eax
and ecx, esi
mov dword [ebp - 8], ecx
mov ecx, edx
shr eax, cl
or eax, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 8]
mov ecx, ebx
add edi, 4
shl eax, cl
dec dword [ebp - 4]
mov dword [ebp + 0xc], eax
jne 0x403df8
mov edi, dword [ebp - 0xc]
push 2
pop ebx
mov esi, edi
push 8
pop ecx
shl esi, 2

Function at 0x403e14
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x20
mov edi, dword [ebp + 8]
pop ebx
or esi, 0xffffffff
cdq
mov ecx, ebx
mov dword [ebp - 4], 3
idiv ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
cdq
idiv ecx
and dword [ebp + 0xc], 0
mov ecx, edx
shl esi, cl
sub ebx, edx
not esi
mov eax, dword [edi]
mov ecx, eax
and ecx, esi
mov dword [ebp - 8], ecx
mov ecx, edx
shr eax, cl
or eax, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 8]
mov ecx, ebx
add edi, 4
shl eax, cl
dec dword [ebp - 4]
mov dword [ebp + 0xc], eax
jne 0x403df8
mov edi, dword [ebp - 0xc]
push 2
pop ebx
mov esi, edi
push 8
pop ecx
shl esi, 2

Function at 0x404014
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00406b97
jmp loc.00424a54

Function at 0x4042c0
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
test edx, edx
je 0x404313
xor eax, eax
mov al, byte [esp + 8]
push edi
mov edi, ecx
cmp edx, 4
jb 0x404307
jmp loc.004288f0
mov byte [edi], al
inc edi
dec edx
jne 0x404307
mov eax, dword [esp + 8]
pop edi
ret
mov eax, dword [esp + 4]
ret

Function at 0x404660
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 4]
test ecx, 3
je fcn.00404680
mov al, byte [ecx]
inc ecx
test al, al
je 0x4046b3
test ecx, 3
jne 0x40466c
jmp loc.0042760a
Function at 0x40483e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp dword [eax*4 + 0x4097d0], 0
lea esi, [eax*4 + 0x4097d0]
jne 0x404894
push edi
push 0x18
call fcn.00404dd3
mov edi, eax
pop ecx
test edi, edi
jne 0x40486d
push 0x11
jmp loc.00426dbd
push 0x11
call fcn.0040483e
cmp dword [esi], 0
pop ecx
push edi
jne 0x404885
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi], edi
jmp 0x40488b
jmp loc.004230b8
push 0x11
call fcn.0040489f
pop ecx
pop edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
pop esi
pop ebp
ret

Function at 0x404b20
Capabilities:
Packed with generic packer

Disassembly:
push edi
push 0x40
pop ecx
xor eax, eax
mov edi, 0x40c6e0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov edi, 0x40c5d0
mov dword [0x40c5c8], eax
mov dword [0x40c5dc], eax
jmp loc.00423a92

Function at 0x404de5
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [esp + 4], 0xffffffe0
ja 0x404e0e
push dword [esp + 4]
jmp loc.00426d63
xor eax, eax
ret

Function at 0x405fed
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x8000
push 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [0x40b9b0], esi
jne fcn.00406012
mov eax, dword [esi + 4]
jmp loc.00424f52

Function at 0x406043
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x409994]
push edi
cmp dword [esi + 0x10], 0xffffffff
jmp loc.004254cd

Function at 0x406105
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 4]
mov edx, 0x409990
push esi
mov ecx, edx
cmp eax, dword [ecx + 0x10]
jbe 0x40611b
cmp eax, dword [ecx + 0x14]
jb 0x406123
mov ecx, dword [ecx]
cmp ecx, edx
je 0x406158
jmp 0x406111
test al, 0xf
jne 0x406158
mov esi, eax
mov edx, 0x100
and esi, 0xfff
cmp esi, edx
jb 0x406158
jmp 0x425355
xor eax, eax
pop esi
ret

Function at 0x406a17
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push esi
push dword [edi]
push dword [esi]
jmp loc.00428383

Function at 0x407f43
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [ebp + 8], 0xffff
je 0x407f83
cmp word [ebp + 8], 0x100
jae 0x407f67
movzx eax, word [ebp + 8]
mov ecx, dword [str.________________________________H]
mov ax, word [ecx + eax*2]
jmp 0x407f8a
push 0
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp + 8]
push 1
push eax
push 1
jmp loc.00428423
xor eax, eax
leave
ret
movzx ecx, word [ebp + 0xc]
movzx eax, ax
and eax, ecx
leave
ret

Function at 0x425b00
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0x60
push 0x4156e0
push eax
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x40bec1]
push eax
add esp, 0x18
leave
popal
popfd
call fcn.004067a7
jmp loc.00407438
Function at 0x429d00
Capabilities:
Terminate process

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0x1c
push 0x4114b0
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x404155]
push eax
add esp, 0x14
leave
popal
popfd
call fcn.00402b54
jmp loc.00402ab5

Function at 0x4e78ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x4e78ec
lcall 0x5de5, 0x8b10c483
jmp loc.00dd8144
Function at 0x6adc6f93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6adc6fd3
jmp 0x6adc7002
jmp 0x6adc7031
jmp 0x6adc7060
jmp 0x6adc708f
jmp 0x6adc70be
jmp 0x6adc70ed
jmp 0x6adc711c
jmp 0x6adc714b
jmp 0x6adc717a
jmp 0x6adc71a9
jmp 0x6adc71d8
jmp 0x6adc7207
jmp 0x6adc7236
jmp 0x6adc7265
jmp 0x6adc7294
jmp 0x6adc72c3
jmp 0x6adc72f2
jmp 0x6adc7321
jmp 0x6adc7350
jmp 0x6adc737f
jmp 0x6adc73ae
jmp 0x6adc73dd
jmp 0x6adc740c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6adc7441
jmp 0x6adc7470
jmp 0x6adc749f
jmp 0x6adc74ce
jmp 0x6adc74fd
jmp 0x6adc752c
jmp 0x6adc755b
jmp 0x6adc758a
jmp 0x6adc75b9
jmp 0x6adc75e8
jmp 0x6adc7617
jmp 0x6adc7646
jmp 0x6adc7675
jmp 0x6adc76a4
jmp 0x6adc76d3
jmp 0x6adc7702
jmp 0x6adc7731
jmp 0x6adc7760
jmp 0x6adc778f
jmp 0x6adc77be
jmp 0x6adc77ed
jmp 0x6adc781c
jmp 0x6adc784b
jmp 0x6adc787a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6adc78c3
jmp 0x6adc78f2
jmp 0x6adc7921
jmp 0x6adc7950
jmp 0x6adc797f
jmp 0x6adc79ae
jmp 0x6adc79dd
jmp 0x6adc7a0c
jmp 0x6adc7a3b
jmp 0x6adc7a6a
jmp 0x6adc7a99
jmp 0x6adc7ac8
jmp 0x6adc7af7
jmp 0x6adc7b26
jmp 0x6adc7b55
jmp 0x6adc7b84
jmp 0x6adc7bb3
jmp 0x6adc7be2
jmp 0x6adc7c11
jmp 0x6adc7c40
jmp 0x6adc7c6f
jmp 0x6adc7c9e
jmp 0x6adc7ccd
jmp 0x6adc7cfc
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6adc7d34
jmp 0x6adc7d63
jmp 0x6adc7d92
jmp 0x6adc7dc1
jmp 0x6adc7df0
jmp 0x6adc7e1f
jmp 0x6adc7e4e
jmp 0x6adc7e7d
jmp 0x6adc7eac
jmp 0x6adc7edb
jmp 0x6adc7f0a
jmp 0x6adc7f39
jmp 0x6adc7f68
jmp 0x6adc7f97
jmp 0x6adc7fc6
jmp 0x6adc7ff5
jmp 0x6adc8024
jmp 0x6adc8053
jmp 0x6adc8082
jmp 0x6adc80b1
jmp 0x6adc80e0
jmp 0x6adc810f
jmp 0x6adc813e
jmp 0x6adc816d
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6adc81b5
jmp 0x6adc81e4
jmp 0x6adc8213
jmp 0x6adc8242
jmp 0x6adc8271
jmp 0x6adc82a0
jmp 0x6adc82cf
jmp 0x6adc82fe
jmp 0x6adc832d
jmp 0x6adc835c
jmp 0x6adc838b
jmp 0x6adc83ba
jmp 0x6adc83e9
jmp 0x6adc8418
jmp 0x6adc8447
jmp 0x6adc8476
jmp 0x6adc84a5
jmp 0x6adc84d4
jmp 0x6adc8503
jmp 0x6adc8532
jmp 0x6adc8561
jmp 0x6adc8590
jmp 0x6adc85bf
jmp 0x6adc85ee
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x6adc8637
jmp 0x6adc8666
jmp 0x6adc8695
jmp 0x6adc86c4
jmp 0x6adc86f3
jmp 0x6adc8722
jmp 0x6adc8751
jmp 0x6adc8780
jmp 0x6adc87af
Function at 0x6add3f76
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6b8dc018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6b8dc018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6add3fc5
jmp 0x6add3ff4
jmp 0x6add4023
jmp 0x6add4052
jmp 0x6add4081
jmp 0x6add40b0
jmp 0x6add40df
jmp 0x6add410e
jmp 0x6add413d
jmp 0x6add416c
jmp 0x6add419b
jmp 0x6add41ca
jmp 0x6add41f9
jmp 0x6add4228
jmp 0x6add4257
jmp 0x6add4286
jmp 0x6add42b5
jmp 0x6add42e4
jmp 0x6add4313
jmp 0x6add4342
jmp 0x6add4371
jmp 0x6add43a0
jmp 0x6add43cf
jmp 0x6add43fe
mov dword [ebp - 0x14], 0
jmp 0x6add4434
jmp 0x6add4463
jmp 0x6add4492
jmp 0x6add44c1
jmp 0x6add44f0
jmp 0x6add451f
jmp 0x6add454e
jmp 0x6add457d
jmp 0x6add45ac
jmp 0x6add45db
jmp 0x6add460a
jmp 0x6add4639
jmp 0x6add4668
jmp 0x6add4697
jmp 0x6add46c6
jmp 0x6add46f5
jmp 0x6add4724
jmp 0x6add4753
jmp 0x6add4782
jmp 0x6add47b1
jmp 0x6add47e0
jmp 0x6add480f
jmp 0x6add483e
jmp 0x6add486d
mov dword [ebp - 0x18], 0
jmp 0x6add48a3
jmp 0x6add48d2
jmp 0x6add4901
jmp 0x6add4930
jmp 0x6add495f
jmp 0x6add498e
jmp 0x6add49bd
jmp 0x6add49ec
jmp 0x6add4a1b
jmp 0x6add4a4a
jmp 0x6add4a79
jmp 0x6add4aa8
jmp 0x6add4ad7
jmp 0x6add4b06
jmp 0x6add4b35
jmp 0x6add4b64
jmp 0x6add4b93
jmp 0x6add4bc2
jmp 0x6add4bf1
jmp 0x6add4c20
jmp 0x6add4c4f
jmp 0x6add4c7e
jmp 0x6add4cad
jmp 0x6add4cdc
mov dword [ebp - 0x10], 0
jmp 0x6add4d12
jmp 0x6add4d41
jmp 0x6add4d70
jmp 0x6add4d9f
jmp 0x6add4dce
jmp 0x6add4dfd
jmp 0x6add4e2c
jmp 0x6add4e5b
jmp 0x6add4e8a
jmp 0x6add4eb9
jmp 0x6add4ee8
jmp 0x6add4f17
jmp 0x6add4f46
jmp 0x6add4f75
jmp 0x6add4fa4
jmp 0x6add4fd3
jmp 0x6add5002
jmp 0x6add5031
jmp 0x6add5060
jmp 0x6add508f
jmp 0x6add50be
jmp 0x6add50ed
jmp 0x6add511c
jmp 0x6add514b
mov dword [ebp - 0x10], 0
jmp 0x6add67a7
jmp 0x6add5186
jmp 0x6add51b5
jmp 0x6add51e4
jmp 0x6add5213
jmp 0x6add5242
jmp 0x6add5271
jmp 0x6add52a0
jmp 0x6add52cf
jmp 0x6add52fe
jmp 0x6add532d
jmp 0x6add535c
jmp 0x6add538b
jmp 0x6add53ba
jmp 0x6add53e9
jmp 0x6add5418
jmp 0x6add5447
jmp 0x6add5476
jmp 0x6add54a5
jmp 0x6add54d4
jmp 0x6add5503
jmp 0x6add5532
jmp 0x6add5561
jmp 0x6add5590
jmp 0x6add55bf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6b8dc014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6add55ff
jmp 0x6add562e
jmp 0x6add565d
jmp 0x6add568c
jmp 0x6add56bb
jmp 0x6add56ea
jmp fcn.6add5719
mov eax, dword [0x6b8dc018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6add5157
nop
leave
ret
Function at 0x402e18
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 3], 0
je 0x402e36
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 2
jb 0x402e23
pop ebx
mov byte [edx + 3], 0
mov eax, edx
ret

Function at 0x402e39
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 7], 0
je 0x402e57
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 6
jb 0x402e44
pop ebx
mov byte [edx + 7], 0
mov eax, edx
ret

Function at 0x402e5a
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x10], 0
je 0x402e78
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0xf
jb 0x402e65
pop ebx
mov byte [edx + 0x10], 0
mov eax, edx
ret

Function at 0x402e7b
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 4], 0
je 0x402e99
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 3
jb 0x402e86
pop ebx
mov byte [edx + 4], 0
mov eax, edx
ret

Function at 0x402e9c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x12], 0
je 0x402eba
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x402ea7
pop ebx
mov byte [edx + 0x12], 0
mov eax, edx
ret
Function at 0x403ccd
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xe], 0
je 0x403ceb
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x403cd8
pop ebx
mov byte [edx + 0xe], 0
mov eax, edx
ret

Function at 0x404555
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x499e99
call fcn.0046c7ed
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], eax
push 0xffffffffffffffd2
mov dword [ebp - 4], 1
movaps xmm0, xmmword [0x4b6ae0]
pop esi
push 4
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x100
pop edi
lea eax, [esi - 1]
movd xmm2, esi
lea edx, [esi - 3]
movd xmm0, eax
movd xmm3, edx
lea ecx, [esi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [ebp + esi + 0xa]
punpcklbw xmm0, xmm0
movd xmm1, ecx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmmword [0x4b65b0]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebp + esi + 0xa], xmm3
add esi, 4
sub edi, 1
jne 0x404590
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp - 0x2c]
mov ecx, edi
push 0x4a6999
mov byte [ebp - 0x13], 0
mov dword [ebp - 0x30], esi
call fcn.0041437c
mov ecx, dword [edi + 0x10]
lea eax, [esi + esi]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], ecx
cmp ecx, eax
ja 0x404665
cmp dword [edi + 0x14], eax
je 0x404665
jae 0x404635
mov byte [ebp - 0x2c], 0
sub eax, ecx
push dword [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.004163e5
mov eax, dword [ebp - 0x38]
mov dword [edi + 0x10], eax
jmp 0x404665
cmp eax, 0xf
ja 0x404665
cmp dword [edi + 0x14], 0xf
jbe 0x404665
mov esi, dword [edi]
lea eax, [ecx + 1]
push eax
push esi
push edi
call fcn.0046da90
mov eax, dword [edi + 0x14]
inc eax
push eax
push esi
call fcn.00416bfd
mov esi, dword [ebp - 0x30]
add esp, 0x14
mov dword [edi + 0x14], 0xf
test esi, esi
je 0x4046a9
cmp dword [ebp + 0x20], 0xf
lea eax, [ebp + 0xc]
mov ecx, dword [ebp - 0x28]
cmova eax, dword [ebp + 0xc]
movzx esi, byte [eax + ecx]
mov ecx, edi
mov eax, esi
shr eax, 4
movzx eax, byte [ebp + eax - 0x24]
push eax
call fcn.0041424d
and esi, 0xf
mov ecx, edi
movzx eax, byte [ebp + esi - 0x24]
push eax
call fcn.0041424d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x30]
jb 0x404669
lea ecx, [ebp + 0xc]
call fcn.004151f6
mov eax, edi
call fcn.0046c79c
ret 0x1c
Function at 0x4046bb
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
mov eax, dword [0x4c7080]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword fs:[0x30]
and dword [esp + 4], 0
push ebx
push ebp
mov eax, dword [eax + 0xc]
push esi
push edi
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebp, dword [ecx + edx + 0x78]
add ebp, edx
cmp ebp, edx
je 0x404740
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x404740
mov ecx, dword [ebp + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov ecx, 0xc83c6fa6
mov esi, dword [ebx]
dec edi
add esi, edx
mov dword [esp + 0x18], ecx
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40473c
mov edx, dword [esp + 0x18]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x404719
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], 0xee5b3da9
mov edx, dword [eax + 0x18]
je 0x404744
test edi, edi
jne 0x4046fd
mov eax, dword [eax]
jmp 0x4046de
mov eax, dword [ebp + 0x24]
xor ebx, ebx
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
lea ecx, [esp + 0x18]
add esi, edx
mov dword [esp + 0x18], 0x8deaac
mov byte [esp + 0x1c], 1
call fcn.00402e7b
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push eax
call esi
mov ecx, dword [esp + 0x20]
neg eax
pop edi
pop esi
pop ebp
sbb eax, eax
and eax, dword [esp + 8]
pop ebx
xor ecx, esp
call fcn.0046be79
add esp, 0x14
ret
Function at 0x40537d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x40539b
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x405388
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret
Function at 0x405ad7
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xc], 0
je 0x405af5
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0xb
jb 0x405ae2
pop ebx
mov byte [edx + 0xc], 0
mov eax, edx
ret

Function at 0x405af8
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 8], 0
je 0x405b16
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 7
jb 0x405b03
pop ebx
mov byte [edx + 8], 0
mov eax, edx
ret

Function at 0x405b19
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xa], 0
je 0x405b37
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 9
jb 0x405b24
pop ebx
mov byte [edx + 0xa], 0
mov eax, edx
ret

Function at 0x405b3a
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x405b58
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x405b45
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x405b5b
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 6], 0
je 0x405b79
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 5
jb 0x405b66
pop ebx
mov byte [edx + 6], 0
mov eax, edx
ret

Function at 0x405b7c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x14], 0
je 0x405b9a
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x405b87
pop ebx
mov byte [edx + 0x14], 0
mov eax, edx
ret

Function at 0x405b9d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1b], 0
je 0x405bbb
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1a
jb 0x405ba8
pop ebx
mov byte [edx + 0x1b], 0
mov eax, edx
ret

Function at 0x405bbe
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x13], 0
je 0x405bdc
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x405bc9
pop ebx
mov byte [edx + 0x13], 0
mov eax, edx
ret
Function at 0x407082
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
mov eax, dword [0x4c7080]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebp, dword [ecx + edx + 0x78]
add ebp, edx
cmp ebp, edx
je 0x407102
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x407102
mov ecx, dword [ebp + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov ecx, 0xba5287af
mov esi, dword [ebx]
dec edi
add esi, edx
mov dword [esp + 0x14], ecx
mov cl, byte [esi]
inc esi
test cl, cl
je 0x4070fe
mov edx, dword [esp + 0x14]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x4070db
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], 0x28c8655a
mov edx, dword [eax + 0x18]
je 0x407106
test edi, edi
jne 0x4070bf
mov eax, dword [eax]
jmp 0x4070a0
mov eax, dword [ebp + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
lea ecx, [esp + 0x1c]
add esi, edx
mov dword [esp + 0x1c], 0xbca3b5a4
mov dword [esp + 0x20], 0xe4e6b8b6
mov dword [esp + 0x24], 0xb6b5bcf9
mov word [esp + 0x28], 0x100
call fcn.00412954
lea eax, [esp + 0x1c]
push eax
call esi
mov ecx, dword fs:[0x30]
mov dword [esp + 0x18], eax
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x18]
mov edx, dword [esi + 0x3c]
mov ebx, dword [edx + esi + 0x78]
add ebx, esi
cmp ebx, esi
je 0x4071be
mov edi, dword [ebx + 0x18]
test edi, edi
je 0x4071be
mov eax, dword [ebx + 0x20]
lea ebp, [eax + edi*4]
add ebp, esi
lea ebp, [ebp - 4]
mov eax, 0x462f085b
mov edx, dword [ebp]
dec edi
add edx, esi
mov dword [esp + 0x14], eax
mov al, byte [edx]
inc edx
test al, al
je 0x4071ba
mov esi, dword [esp + 0x14]
movsx eax, al
xor eax, esi
imul esi, eax, 0x1000193
mov al, byte [edx]
inc edx
test al, al
jne 0x407197
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], 0x9648dc6f
mov esi, dword [ecx + 0x18]
je 0x4071c2
test edi, edi
jne 0x40717a
mov ecx, dword [ecx]
jmp 0x40715b
mov eax, dword [ebx + 0x24]
movaps xmm0, xmmword [0x4b6d40]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + esi]
add edx, esi
mov dword [esp + 0x3c], 0x8cbe85b3
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x40], 0x808982
xor ecx, ecx
mov byte [esp + 0x44], 1
lea eax, [ecx - 0x31]
xor byte [esp + ecx + 0x2c], al
inc ecx
cmp ecx, 0x17
jb 0x4071fa
lea eax, [esp + 0x2c]
mov byte [esp + 0x44], 0
push eax
push dword [esp + 0x1c]
call edx
mov ecx, dword [esp + 0x48]
neg eax
pop edi
pop esi
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
neg eax
call fcn.0046be79
add esp, 0x3c
ret
Function at 0x40b907
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x26], 0
je 0x40b925
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x31]
xor byte [ecx], al
inc ebx
cmp ebx, 0x25
jb 0x40b912
pop ebx
mov byte [edx + 0x26], 0
mov eax, edx
ret