joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ee8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
mov ebx, ecx
movlpd qword [ebp - 8], xmm0
jb 0x407f37
ja 0x407f09
cmp dword [ebp + 8], 0
jbe 0x407f37
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov ecx, esi
mov edx, dword [ebp + 0x14]
and ecx, 7
shl ecx, 3
call fcn.004bea00
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0xc]
jb 0x407f0f
ja 0x407f37
cmp esi, dword [ebp + 8]
jb 0x407f0f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407f3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
mov ebx, ecx
movlpd qword [ebp - 8], xmm0
jb 0x407f94
ja 0x407f5d
cmp dword [ebp + 8], 0
jbe 0x407f94
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov ecx, esi
mov edx, dword [ebp + 0x14]
and ecx, 7
shl ecx, 3
call fcn.004bea00
mov ecx, 0xff
and ax, cx
xor word [ebx + esi*2], ax
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0xc]
jb 0x407f63
ja 0x407f94
cmp esi, dword [ebp + 8]
jb 0x407f63
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ff61
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4e5c34]
sub esp, 0x14
test eax, eax
jne 0x410031
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov ebx, dword [eax + edx + 0x78]
add ebx, edx
mov dword [ebp - 0xc], ebx
cmp ebx, edx
je 0x410011
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x410011
mov eax, dword [ebx + 0x20]
lea eax, [eax + esi*4]
add eax, edx
sub eax, 4
mov ecx, 0xaee8847d
dec esi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
mov edi, dword [eax]
add edi, edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x41000a
mov ebx, dword [ebp - 4]
movsx eax, cl
xor eax, ebx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov cl, byte [edi]
imul ebx, eax, 0x1000193
inc edi
test cl, cl
jne 0x40ffcc
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x4c4da0ef
mov ebx, dword [ebp - 0xc]
je 0x41003c
mov eax, dword [ebp - 0x10]
test esi, esi
jne 0x40ffaf
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp eax, dword [ebp - 0x14]
je 0x410027
cmp dword [ecx + 0x18], 0
jne 0x40ff8d
xor eax, eax
pop edi
pop esi
mov dword [0x4e5c34], eax
pop ebx
push 0
push dword [ebp + 8]
call eax
leave
ret 4
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x410029
Function at 0x4121f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e2040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
push 0xb
mov dword [ebp - 0x14], edi
mov esi, edi
movlpd qword [ebp - 0xc], xmm0
sub edx, edi
pop ecx
mov al, byte [edx + esi]
mov byte [esi], al
inc esi
sub ecx, 1
jne 0x41221f
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 5
jbe 0x412285
mov edx, dword [ebp + 8]
movzx eax, word [edx]
test ax, ax
je 0x412285
mov ecx, eax
movzx eax, cx
lea edx, [edx + 2]
push 0x10
mov dword [ebp - 0x10], eax
mov si, ax
pop edi
and eax, 1
shr si, 1
mov word [ebp - 0x10], si
lea ecx, [eax + ebx*2]
mov ebx, ecx
mov eax, ebx
xor ebx, 0x11021
test eax, 0x10000
cmove ebx, ecx
sub edi, 1
je 0x412278
mov eax, dword [ebp - 0x10]
jmp 0x41224f
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x412240
mov edi, dword [ebp - 0x14]
push 7
pop esi
mov dl, bl
and dl, 0xf
add dl, 0x30
cmp dl, 0x39
lea eax, [edx + 7]
movzx ecx, al
movzx eax, dl
cmovbe ecx, eax
shr ebx, 4
mov byte [ebp + esi - 0xc], cl
dec esi
test ebx, ebx
jne 0x412288
xor ecx, ecx
mov byte [ebp + esi - 0xc], 0x7e
pop ebx
test esi, esi
je 0x4122c2
cmp byte [edi + ecx], 0x20
je 0x4122c2
inc ecx
cmp ecx, esi
jb 0x4122b7
cmp esi, 8
jae 0x4122d1
lea eax, [ebp - 0xc]
add eax, esi
inc esi
mov al, byte [eax]
jmp 0x4122d3
mov al, 0x20
mov byte [edi + ecx], al
inc ecx
cmp ecx, 8
jb 0x4122c2
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b0ce6
leave
ret

Function at 0x4134ed
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov bh, dl
mov esi, ecx
mov bl, 1
test bh, bl
push 0
pop eax
setne al
xor esi, eax
mov edx, esi
mov ecx, esi
shr edx, 1
mov eax, edx
mov esi, edx
xor eax, 0xedb88320
test cl, 1
cmovne esi, eax
add bl, bl
jne 0x4134f5
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4135a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], edx
push edi
inc ebx
test ecx, ecx
push 0x10
pop edi
cmovne ebx, ecx
push 8
pop esi
mov edx, ebx
mov ecx, ebx
shr edx, 1
mov eax, edx
mov ebx, edx
xor eax, 0xa3000000
test cl, 1
cmovne ebx, eax
sub esi, 1
jne 0x4135bd
mov esi, dword [ebp - 4]
mov byte [esi], bl
inc esi
mov dword [ebp - 4], esi
sub edi, 1
jne 0x4135ba
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x416c55
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0xc], edi
cmp dword [edi + 4], ebx
je 0x416d47
mov eax, dword [0x4e5c5c]
test eax, eax
jne 0x416d37
mov eax, dword fs:[0x30]
push esi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x416d10
mov ebx, dword [ecx + 0x18]
test ebx, ebx
je 0x416d10
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + ebx*4]
add ecx, esi
sub ecx, 4
mov edx, 0xac2cb299
mov dword [ebp - 0x10], ecx
dec ebx
mov dword [ebp - 4], edx
mov ecx, dword [ecx]
add ecx, esi
mov dl, byte [ecx]
inc ecx
mov dword [ebp - 8], ecx
test dl, dl
je 0x416d09
mov edi, dword [ebp - 4]
mov esi, ecx
movsx ecx, dl
xor ecx, edi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [esi]
imul edi, ecx, 0x1000193
inc esi
test dl, dl
jne 0x416ccb
mov esi, dword [eax + 0x18]
mov dword [ebp - 4], edi
cmp dword [ebp - 4], 0xc312cdc0
mov edi, dword [ebp - 0xc]
je 0x416d17
mov ecx, dword [ebp - 0x10]
test ebx, ebx
jne 0x416ca9
mov eax, dword [eax]
jmp 0x416c87
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
xor ebx, ebx
mov dword [0x4e5c5c], eax
pop esi
push dword [edi + 4]
call eax
mov dword [edi + 4], ebx
mov byte [edi], bl
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
pop edi
pop ebx
leave
ret
Function at 0x416d4b
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4e2040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], ebx
cmp byte [ebx], 0
je 0x416e7f
test eax, eax
je 0x416e7f
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x416e7f
cmp dword [ebx + 0xc], 0
jg 0x416d96
jl 0x416d90
cmp dword [ebx + 8], ecx
jae 0x416d96
mov eax, dword [ebx + 8]
mov dword [ebp + 0xc], eax
and dword [ebp - 8], 0
mov eax, dword [0x4e5c58]
test eax, eax
jne 0x416e64
mov eax, dword fs:[0x30]
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x1c], ecx
cmp ecx, esi
je 0x416e3e
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x416e3e
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
sub ecx, 4
mov edx, 0xd183398b
mov dword [ebp - 0x18], ecx
dec edi
mov dword [ebp - 0xc], edx
mov ecx, dword [ecx]
add ecx, esi
mov dl, byte [ecx]
inc ecx
mov dword [ebp - 0x10], ecx
test dl, dl
je 0x416e37
mov ebx, dword [ebp - 0xc]
mov esi, ecx
movsx ecx, dl
xor ecx, ebx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [esi]
imul ebx, ecx, 0x1000193
inc esi
test dl, dl
jne 0x416df9
mov esi, dword [eax + 0x18]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], 0x2a672f6a
mov ebx, dword [ebp - 0x14]
je 0x416e45
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x416dd7
mov eax, dword [eax]
jmp 0x416db5
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
pop edi
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
mov dword [0x4e5c58], eax
pop esi
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push dword [ebp - 0x20]
push dword [ebx + 4]
call eax
cmp eax, 1
jne 0x416e7f
mov eax, dword [ebp - 8]
jmp 0x416e81
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b0ce6
leave
ret 8
Function at 0x4182ff
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4e5c78]
sub esp, 0xc
test eax, eax
jne 0x4183c9
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0xc], ecx
cmp ecx, esi
je 0x4183a2
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4183a2
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
sub ecx, 4
mov edx, 0x158e1629
dec edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov ebx, dword [ecx]
add ebx, esi
mov dl, byte [ebx]
inc ebx
test dl, dl
je 0x41839e
mov esi, dword [ebp - 4]
movsx ecx, dl
xor ecx, esi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [ebx]
imul esi, ecx, 0x1000193
inc ebx
test dl, dl
jne 0x418360
mov dword [ebp - 4], esi
cmp dword [ebp - 4], 0xc366dcf0
mov esi, dword [eax + 0x18]
je 0x4183a9
mov ecx, dword [ebp - 8]
test edi, edi
jne 0x418343
mov eax, dword [eax]
jmp 0x418321
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
pop edi
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
pop esi
mov dword [0x4e5c78], eax
pop ebx
xor ecx, ecx
push ecx
push ecx
push ecx
push 0x418044
push ecx
push ecx
call eax
leave
ret
Function at 0x42afa4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4e2040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x40], eax
push edi
mov dword [ebp - 0x2c], esi
call fcn.0042b169
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp byte [ebx + 0x40], al
je 0x42afef
push 0xf7b7db1
push 0xbd9327c7
push eax
push 0x20
mov ecx, ebx
call fcn.00407f3c
add esp, 0x10
xor eax, eax
mov byte [ebx + 0x40], al
mov ecx, ebx
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42aff6
mov eax, dword [esi + 0x40]
sub ecx, edx
sub eax, 0xffffff80
sar ecx, 1
add eax, dword [esi + 0x28]
add eax, dword [esi + 0x10]
push ecx
add eax, ecx
lea ecx, [ebp - 0x20]
push eax
call fcn.0040c1ba
mov ecx, dword [0x4e761c]
test ecx, ecx
jne 0x42b105
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0x78]
add eax, edx
mov dword [ebp - 0x38], eax
cmp eax, edx
je 0x42b0c5
mov edi, dword [eax + 0x18]
test edi, edi
je 0x42b0c5
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, edx
sub eax, 4
mov ecx, 0x6d9976d1
dec edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], eax
mov ebx, dword [eax]
add ebx, edx
mov cl, byte [ebx]
inc ebx
test cl, cl
je 0x42b0be
mov esi, dword [ebp - 0x24]
movsx eax, cl
xor eax, esi
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov cl, byte [ebx]
imul esi, eax, 0x1000193
inc ebx
test cl, cl
jne 0x42b080
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], 0x2435811b
mov esi, dword [ebp - 0x2c]
je 0x42b0de
mov eax, dword [ebp - 0x30]
test edi, edi
jne 0x42b063
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x34]
je 0x42b0f8
xor eax, eax
cmp dword [ecx + 0x18], eax
jne 0x42b041
jmp 0x42b0fa
mov ebx, dword [ebp - 0x38]
mov eax, dword [ebx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
add ecx, edx
jmp 0x42b0fc
xor eax, eax
mov ecx, eax
mov ebx, dword [ebp - 0x3c]
mov dword [0x4e761c], ecx
lea edi, [esi + 0x30]
cmp dword [edi + 0x14], 7
jbe 0x42b110
mov edi, dword [edi]
lea edx, [esi + 0x18]
cmp dword [edx + 0x14], 7
jbe 0x42b11b
mov edx, dword [edx]
cmp dword [esi + 0x14], 7
jbe 0x42b123
mov esi, dword [esi]
cmp dword [ebp - 0xc], 7
lea eax, [ebp - 0x20]
push edi
cmova eax, dword [ebp - 0x20]
push edx
push esi
push ebx
push eax
call ecx
add esp, 0x14
lea ecx, [ebp - 0x20]
cmp dword [ebp - 0xc], 7
cmova ecx, dword [ebp - 0x20]
push eax
push ecx
mov ecx, dword [ebp - 0x40]
call fcn.0040c221
lea ecx, [ebp - 0x20]
call fcn.0040c4e8
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x40]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004b0ce6
leave
ret 4
Function at 0x42b297
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4e2040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x58], eax
push edi
mov dword [ebp - 0x50], ebx
call fcn.0042b448
mov ecx, eax
call fcn.0042aaf9
mov edi, eax
xor edx, edx
mov esi, edi
mov dword [ebp - 0x54], edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x42b2cd
sub esi, ecx
lea eax, [ebp - 0x38]
push eax
mov ecx, ebx
sar esi, 1
call fcn.0042afa4
mov eax, dword [ebx + 0x58]
sub eax, 0xffffff80
add eax, dword [ebp - 0x28]
push ecx
add eax, esi
lea ecx, [ebp - 0x20]
push eax
call fcn.0040c1ba
mov esi, dword [0x4e7a74]
test esi, esi
jne 0x42b3cc
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], ecx
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x3c]
mov ebx, dword [eax + edx + 0x78]
add ebx, edx
mov dword [ebp - 0x44], ebx
cmp ebx, edx
je 0x42b3a8
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x42b3a8
mov eax, dword [ebx + 0x20]
lea eax, [eax + esi*4]
add eax, edx
sub eax, 4
mov ecx, 0x7c03493a
dec esi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], eax
mov edi, dword [eax]
add edi, edx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x42b3a1
mov ebx, dword [ebp - 0x3c]
movsx eax, cl
xor eax, ebx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov cl, byte [edi]
imul ebx, eax, 0x1000193
inc edi
test cl, cl
jne 0x42b35f
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], 0xc1e6e3c7
mov ebx, dword [ebp - 0x44]
je 0x42b42e
mov eax, dword [ebp - 0x48]
test esi, esi
jne 0x42b342
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x40], eax
cmp eax, dword [ebp - 0x4c]
je 0x42b3be
cmp dword [ecx + 0x18], 0
jne 0x42b320
xor esi, esi
mov ebx, dword [ebp - 0x50]
mov edi, dword [ebp - 0x54]
mov dword [0x4e7a74], esi
lea edx, [ebx + 0x48]
push 7
pop ebx
cmp dword [edx + 0x14], ebx
jbe 0x42b3d9
mov edx, dword [edx]
cmp dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x38]
push edx
cmova ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
push ecx
cmova eax, dword [ebp - 0x20]
push edi
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
cmova ecx, dword [ebp - 0x20]
push eax
push ecx
mov ecx, dword [ebp - 0x58]
call fcn.0040c221
lea ecx, [ebp - 0x20]
call fcn.0040c4e8
lea ecx, [ebp - 0x38]
call fcn.0040c4e8
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x58]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004b0ce6
leave
ret 4
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
jmp 0x42b3c0
Function at 0x42e29e
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
test edx, edx
jne 0x42e2a9
xor eax, eax
pop edi
ret
push esi
lea esi, [edx - 1]
test esi, esi
je 0x42e2d2
mov edx, edi
push ebx
mov ebx, dword [edx]
xor ecx, ecx
mov eax, 0x25f86653
shl eax, cl
xor ebx, eax
inc ecx
cmp ecx, 3
jb 0x42e2b8
mov dword [edx], ebx
add edx, 4
sub esi, 1
jne 0x42e2b4
pop ebx
pop esi
mov eax, edi
pop edi
ret
Function at 0x434527
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4e2040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x34], edx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x30], ecx
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
cmp dword [ebp - 0xc], ebx
je 0x43469e
test eax, eax
jne 0x43469e
push dword [ebp - 0xc]
push 8
push dword [0x4e7ed4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x43469e
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
test eax, eax
jne 0x43469e
cmp dword [ebp - 8], ebx
jbe 0x434697
lea esi, [edi + 0x30]
mov dword [ebp - 0x18], esi
mov eax, dword [0x4e6d80]
test eax, eax
jne 0x43467c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x2c], ecx
cmp ecx, esi
je 0x434652
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x434652
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, esi
sub ecx, 4
mov dword [ebp - 0x24], 0xd9aaec5c
mov dword [ebp - 0x28], ecx
dec edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ecx]
add ecx, esi
mov dl, byte [ecx]
inc ecx
mov dword [ebp - 0x20], ecx
mov cl, dl
mov byte [ebp - 0xd], dl
mov edx, dword [ebp - 0x14]
test cl, cl
je 0x43464b
mov edi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x434611
mov edi, dword [ebp - 0x1c]
cmp edx, 0xd8a806de
je 0x434659
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
test edx, edx
jne 0x4345e4
mov eax, dword [eax]
jmp 0x4345c2
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
mov esi, dword [ebp - 0x18]
mov dword [0x4e6d80], eax
push dword [ebp - 0x30]
push dword [esi]
call eax
test eax, eax
je 0x4346b0
inc ebx
add esi, 0x4c
mov dword [ebp - 0x18], esi
cmp ebx, dword [ebp - 8]
jb 0x4345a9
mov ecx, edi
call fcn.00416e90
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b0ce6
leave
ret
mov ecx, dword [ebp - 0x1c]
imul esi, ebx, 0x4c
add esi, edi
mov edi, dword [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00416e90
mov eax, ebx
jmp 0x4346a1
Function at 0x438719
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4e7a60]
mov dword [ebp - 0x10], ecx
test eax, eax
jne 0x4387e6
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0xc], ecx
cmp ecx, esi
je 0x4387bf
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4387bf
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
sub ecx, 4
mov edx, 0x83b1f568
dec edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov ebx, dword [ecx]
add ebx, esi
mov dl, byte [ebx]
inc ebx
test dl, dl
je 0x4387bb
mov esi, dword [ebp - 4]
movsx ecx, dl
xor ecx, esi
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
mov dl, byte [ebx]
imul esi, ecx, 0x1000193
inc ebx
test dl, dl
jne 0x43877d
mov dword [ebp - 4], esi
cmp dword [ebp - 4], 0x98c7bb5e
mov esi, dword [eax + 0x18]
je 0x4387c6
mov ecx, dword [ebp - 8]
test edi, edi
jne 0x438760
mov eax, dword [eax]
jmp 0x43873e
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
pop edi
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
pop esi
mov dword [0x4e7a60], eax
pop ebx
push dword [ebp - 0x10]
call eax
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
leave
ret