joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40026cf
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x400a058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor edi, edi
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], esi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp ebx, edi
je 0x400283d
mov eax, dword [ebx + 0xc]
cmp eax, edi
je 0x400283d
cmp esi, edi
je 0x400283d
push eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.04001ea1
xor ecx, ecx
test eax, eax
setge cl
mov edi, ecx
test edi, edi
je 0x400283d
push 0x4001174
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.04001f65
xor ecx, ecx
test eax, eax
setge cl
mov edi, ecx
test edi, edi
je 0x400283d
mov esi, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x218], eax
jmp 0x400279c
mov ebx, dword [ebp - 0x214]
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x400283d
push dword [ebp - 0x210]
xor eax, eax
mov word [esi], ax
add ebx, 0x14
push dword [ebx]
call fcn.04001c00
test eax, eax
jne 0x400282d
push dword [ebp - 0x210]
mov eax, dword [ebp - 0x218]
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp + eax*2 - 0x20c]
push eax
call fcn.04001ea1
xor ecx, ecx
test eax, eax
setge cl
mov edi, ecx
test edi, edi
je 0x400282d
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
test edi, edi
je 0x400281d
push dword [ebp - 0x210]
push ebx
call fcn.0400248f
mov edi, eax
jmp 0x400282d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x400282d
xor edi, edi
inc edi
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
test edi, edi
jne 0x4002796
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0400347f
leave
ret 8
Function at 0x4002fa3
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x18
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x400309e
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
push ebx
push 0x40
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi], eax
test eax, eax
je 0x4003091
push dword [ebp + 8]
push ebx
push eax
call fcn.04001edb
test eax, eax
jl 0x400308b
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.04002322
mov dword [esi + 4], eax
test eax, eax
je 0x400308b
call fcn.04001c32
mov dword [ebp + 8], eax
test eax, eax
je 0x4003086
call fcn.04001d9a
mov dword [esi + 0xc], eax
test eax, eax
je 0x4003081
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push eax
call ebx
test eax, eax
je 0x4003072
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.04002390
mov dword [esi + 8], eax
test eax, eax
je 0x400306d
push esi
call fcn.04002ad7
test eax, eax
je 0x4003061
push dword [ebp + 0xc]
push esi
call fcn.04002f14
push esi
mov dword [ebp - 4], eax
call fcn.0400250c
jmp 0x4003068
mov dword [ebp - 4], 0x80000020
push dword [esi + 8]
call edi
push dword [ebp + 8]
call ebx
push 6
push dword [esi + 0xc]
call fcn.04002062
push dword [esi + 0xc]
call edi
push dword [ebp + 8]
call edi
push dword [esi + 4]
call edi
push dword [esi]
call edi
jmp 0x4003098
mov dword [ebp - 4], 0x80000004
push esi
call edi
pop ebx
jmp 0x40030a5
mov dword [ebp - 4], 0x80000004
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x4003464
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x4008cc0
call fcn.04003624
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x400b6ac
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x400321f
cmp eax, esi
jne 0x4003212
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4003222
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40031f9
xor esi, esi
inc esi
mov eax, dword [0x400b6a8]
cmp eax, esi
jne 0x4003235
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4003264
mov eax, dword [0x400b6a8]
test eax, eax
jne 0x400325e
mov dword [0x400b6a8], esi
push 0x4001144
push 0x4001138
call fcn.0400315b
pop ecx
pop ecx
test eax, eax
je 0x4003264
jmp 0x4003388
mov dword [0x400a0d4], esi
mov eax, dword [0x400b6a8]
cmp eax, esi
jne 0x4003288
push 0x4001134
push 0x400112c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x400b6a8], 2
cmp dword [ebp - 0x20], ebx
jne 0x4003295
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x400b6b0], ebx
je 0x40032b6
push 0x400b6b0
call fcn.04003599
pop ecx
test eax, eax
je 0x40032b6
push ebx
push 2
push ebx
call dword [0x400b6b0]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x4003388
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x4003320
cmp cx, bx
je 0x40032db
cmp dword [ebp - 0x1c], ebx
jne 0x4003320
movzx ecx, word [eax]
cmp cx, bx
je 0x40032f0
cmp cx, 0x20
ja 0x40032f0
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x40032db
test byte [ebp - 0x40], 1
je 0x40032fc
movzx ecx, word [ebp - 0x3c]
jmp 0x40032ff
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x4000000
call main
mov dword [0x400a0d0], eax
cmp dword [0x400a0c4], ebx
jne 0x4003365
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x4003331
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x40032c5
cmp dword [0x400a0d4], ebx
jne 0x4003373
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x400a0d0]
jmp 0x4003394
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.04003669
ret
call fcn.04003771
jmp 0x40031bc
Function at 0x4004cf1
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x4004d32
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x4004d0b
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x4004d50
dec esi
je 0x4004d47
dec esi
jne 0x4004d55
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x809da1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xor ecx, edx
cmc
sub dh, dh
mov dx, sp
not edx
jmp 0x809d30
and edx, ebp
cmc
lea edi, [esi + edi]
jmp 0x809d50

Function at 0x80a2e1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
inc bl
lea esp, [esp + 4]
movzx ebx, byte [esi + 0x11]
neg dx
jmp 0x80a302
bts edi, ebx
bswap edx
mov dh, 0x7e
jmp 0x80a421
shr edi, 0x18
sub esp, 0x10
cmc
push dword [esp + 2]
jmp 0x80a3a4
btc edi, edi
lea edi, [ebx + edi]
bsf di, ax
mov edi, edx
push edx
jmp 0x80a32f
mov edi, dword [edi*4 + 0x7e65b8]
jmp 0x80a388
lea esp, [esp + 2]
and edi, ecx
sub esp, 0xc
sub esp, 0x10
mov byte [esp + 6], bh
jmp 0x80a35d
and ebx, ecx
lea esp, [esp + 0x54]
xor edi, dword [ebx*4 + 0x7e6db8]
mov bx, 0x7825
jmp 0x80a407
mov edi, dword [edi*4 + 0x7e61b8]
push esp
mov dword [esp], esi
push word [esp + 3]
sub esp, 0x1c
jmp 0x80a376
lea esp, [esp + 0x10]
add esi, 0x10
mov dl, byte [esp]
bswap edx
mov edx, dword [esi]
jmp 0x80a34e
neg bx
movzx ebx, byte [esi + 2]
stc
call fcn.0080a3e1
cmp dword [eax + 0x62a05136], esp
inc ecx
fisttp qword [ebp + 0x14]
out 0x55, eax
lodsb al, byte [esi]
mov ebx, dword [ebx*4 + 0x7e61b8]
sub dh, dh
mov dh, ch
sub esp, 0x10
jmp 0x80a3ce

Function at 0x80a3e1
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], bx
pop word [esp]
jmp 0x80a3ef
lea esp, [esp + 2]
jmp 0x80a5e4
and edx, ecx
mov edx, dword [edx*4 + 0x7e61b8]
sub esp, 0x18
sub esp, 0
jmp 0x80a469
movzx ebx, byte [esi + 5]
clc
clc
sub esp, 0x14
add esp, 5
lea esp, [esp + 3]
jmp 0x80a431
mov byte [esp + 0x11], bh
lea esp, [esp + 0x13]
lea esp, [esp + 1]
jmp 0x80a4da
add esp, 9
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x7e69b8]
jmp 0x80a457
and edx, ecx
call fcn.0080a4b5
mov ebx, dword [ebx*4 + 0x7e61b8]
inc di
bswap edi
dec edi
lea edi, [edi + edi]
jmp 0x80a557
mov dword [esp + 0xc], edi
lea esp, [esp + 4]
popal
jmp 0x80a533
push ebp
pushal
bswap eax
push edx
mov cl, ch
jmp 0x80a50e
lea ebp, [ebp*4]
lea ebp, [ebp + 0x7e61b8]
mov edi, dword [ebp]
pop ebp
call fcn.0080a55f
scasb al, byte es:[edi]
and al, 0xba
invalid
mov edi, edx
push esp
shr edi, 0x18
jmp 0x80a52a
lea esp, [esp + 2]
and ebx, ecx
clc
sub esp, 0x1c
sub esp, 4
jmp 0x80a487
mov ebx, dword [ebx*4 + 0x7e61b8]
push esp
mov word [esp], di
pop word [esp]
sub esp, 8
jmp 0x80a579

Function at 0x80a4b5
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [edx*4 + 0x7e71b8]
jmp 0x80a4c2
mov dword [esp], esi
push dword [esp + 2]
lea esp, [esp + 0x18]
jmp 0x80a49b
mov edx, dword [esi + 4]
sub esp, 0
sub esp, 0x18
mov byte [esp + 0xe], dh
jmp 0x80a4ff
mov dword [esi], edi
not di
push edx
lea edi, [edx*4]
jmp 0x80a4e1

Function at 0x80a64b
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [ebx*4 + 0x7e6db8]
movzx ebx, byte [esi + 6]
push edx
add esp, 1
call fcn.0080a612
popfd
add eax, 0xcb0ffc95
sub eax, 0xbe4324b6
jp 0x80a671
dec esi
cmc
lea esp, [esp + 0x38]
jmp 0x80a629

Function at 0x80a721
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0x7e61b8]
jmp 0x80a747
Function at 0x80a861
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
call 0x80a861
jmp 0x24f5a7cb

Function at 0x80a9e8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
jmp 0x80aa13
lea esp, [esp + 8]
dec dword [ebp - 4]
push edx
jmp 0x80aa35
xor edi, dword [edx*4 + 0x7e71b8]
push esp
push esp
jmp 0x80a9ee

Function at 0x80aa3e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and ebx, ecx
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x7e69b8]
stc
jmp 0x80aa2b
lea esp, [esp + 2]
and edx, ecx
mov edx, dword [edx*4 + 0x7e61b8]
jmp 0x80a9d8
and edx, ecx
clc
clc
clc
call fcn.0080a9e8
mov dword [esi + 0xc], edi
call 0x80aa3e
inc ebx
push esp
lea esp, [esp + 0xc]
and al, 0xc
jne 0x7dc111
je 0x7dc09a
std
js 0x80aa40
mov dword [eax - 0x33], edi
aad 0x44
neg esi
jmp 0x80aa04

Function at 0x80aa59
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and ebx, ecx
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x7e69b8]
stc
jmp 0x80aa2b
lea esp, [esp + 2]
and edx, ecx
mov edx, dword [edx*4 + 0x7e61b8]
jmp 0x80a9d8
and edx, ecx
clc
clc
clc
call fcn.0080a9e8
mov dword [esi + 0xc], edi
call 0x80aa3e
inc ebx
push esp
lea esp, [esp + 0xc]
and al, 0xc
jne 0x7dc111
je 0x7dc09a
std
js 0x80aa40
mov dword [eax - 0x33], edi
aad 0x44
neg esi
jmp 0x80aa04
Function at 0x404220
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404300
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404300
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40426a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404271
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404250
jmp 0x404273
mov esi, 0x1505
jmp 0x404273
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x404300
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4042a4
inc edi
dec ebx
je 0x4042fe
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4042fe
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4042a0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040cba0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4042a0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040cbc0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4042a0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404300
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404310
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x404411
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404411
push ebx
call fcn.0040cba0
add esp, 4
test eax, eax
je 0x40436a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404371
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x404350
jmp 0x404373
mov esi, 0x1505
jmp 0x404373
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404411
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4043a4
inc ebp
dec ebx
je 0x40440f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40440f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4043a0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cba0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4043a0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cbc0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4043a0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40440f
cmp dword [eax + 4], 2
mov edi, 0
jne 0x404411
mov edi, dword [eax + 8]
jmp 0x404411
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404440
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x4044ab
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4044ab
push esi
call fcn.0040cba0
add esp, 4
test eax, eax
je 0x40448a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x404491
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x404470
jmp 0x404493
mov ebp, 0x1505
jmp 0x404493
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x4044b7
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4044d4
inc ebx
dec edi
je 0x4044ab
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4044ab
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x4044d0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x4044d0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.0040cbc0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4044d0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4044ab
cmp dword [eax + 4], 3
jne 0x4044ab
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x4044ab

Function at 0x404570
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x404671
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404671
push ebx
call fcn.0040cba0
add esp, 4
test eax, eax
je 0x4045ca
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4045d1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4045b0
jmp 0x4045d3
mov esi, 0x1505
jmp 0x4045d3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404671
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404604
inc ebp
dec ebx
je 0x40466f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40466f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404600
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cba0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404600
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cbc0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404600
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40466f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x404671
mov edi, dword [eax + 8]
jmp 0x404671
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4046a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4047a4
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4047a4
push ebx
call fcn.0040cba0
add esp, 4
test eax, eax
je 0x4046fa
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404701
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4046e0
jmp 0x404703
mov esi, 0x1505
jmp 0x404703
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x4047a4
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404734
inc ebp
dec ebx
je 0x40479f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40479f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404730
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cba0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404730
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cbc0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404730
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40479f
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x4047a4
mov edi, dword [eax + 8]
jmp 0x4047a4
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4047b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.0040cc10
add esp, 8
test eax, eax
je 0x404814
mov esi, eax
jmp 0x4047f4
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.0040cc10
add esp, 8
mov esi, eax
test eax, eax
je 0x404814
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.00404220
add esp, 0xc
xor edi, edi
test eax, eax
je 0x4047e0
cmp dword [eax + 4], 4
jne 0x4047e0
mov edi, dword [eax + 8]
jmp 0x4047e0
xor eax, eax
test edi, edi
je 0x40487b
test ebp, ebp
je 0x40487b
push ebp
call fcn.0040cba0
add esp, 4
test eax, eax
je 0x40485b
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x404862
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x404840
jmp 0x404864
mov esi, 0x1505
jmp 0x404864
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x404883
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x4048a4
inc ebx
dec ecx
je 0x404879
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x404879
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x4048a0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.0040cba0
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4048a0
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.0040cbc0
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x4048a0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x40487b
Function at 0x4049a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x404a0d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404a0d
push esi
call fcn.0040cba0
add esp, 4
test eax, eax
je 0x4049ea
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4049f1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4049d0
jmp 0x4049f3
mov ebx, 0x1505
jmp 0x4049f3
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x404a15
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404a24
inc ebp
dec edi
je 0x404a0b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x404a0b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x404a20
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cba0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404a20
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cbc0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404a20
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x404a0d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x404a0d