joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bc30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443d68
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x44c73b
lea ecx, [ebp - 0x28]
call fcn.00405a70
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0x34
push 0
mov ecx, dword [ebp + 8]
call fcn.00405040
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x42bd65
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 0
jne 0x42bcb6
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new___unsigned_int_]
add esp, 4
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], ecx
jmp 0x42bc98
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x34]
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.00405040
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x42bd52
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x30]
push edx
push 0x44ddb8
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x42bd52
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 8]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
push str._d._d._d._d
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x18
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
call fcn.00424280
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0041f590
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405470
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00440154
mov esp, ebp
pop ebp
ret
Function at 0x42c120
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443e18
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00405040
push eax
mov ecx, dword [ebp + 8]
call fcn.00405040
push eax
push str.createProcess_filename____s___param____s___show___d
push 0xed
push 0x44ea80
call fcn.00421b80
add esp, 0x18
mov ecx, dword [ebp + 8]
push ecx
mov edx, 0x44eaa0
lea ecx, [ebp - 0x58]
call fcn.0040be50
add esp, 4
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x64], edx
mov dword [ebp - 4], 0
push 0x44ea9c
mov edx, dword [ebp - 0x64]
lea ecx, [ebp - 0x28]
call fcn.0040bf40
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00403d10
mov ecx, dword [ebp + 0xc]
call fcn.00403cc0
movzx eax, al
test eax, eax
jne 0x42c204
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, 0x44eaa4
lea ecx, [ebp - 0x40]
call fcn.0040be50
add esp, 4
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x80], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x80]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404c80
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00403d10
mov dword [ebp - 0xc8], 0
push 0x40
push 0
lea ecx, [ebp - 0xc4]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0xc8], 0x44
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x9c], 1
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x42c264
mov dword [ebp - 0x5c], 5
jmp 0x42c26b
mov dword [ebp - 0x5c], 0
mov ax, word [ebp - 0x5c]
mov word [ebp - 0x98], ax
xor ecx, ecx
mov word [ebp - 0x96], cx
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x7c], 0
xor edx, edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x70], edx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0xc8]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00405040
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42c300
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x44eaa8
push 0xff
push str.utility::process::create
call fcn.00421b80
add esp, 0x10
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403d10
mov eax, dword [ebp - 0x60]
jmp 0x42c336
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0
je 0x42c318
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x84], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403d10
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00440154
mov esp, ebp
pop ebp
ret
Function at 0x42c350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42c396
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.kill32_h_is_null_pid___d_error___d
push 0x10e
push 0x44eb14
call fcn.00421b80
add esp, 0x14
xor al, al
jmp 0x42c3ea
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c3cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push eax
push str.kill32_progress_failed_pid___d_lasterror___d
push 0x114
push str.utility::process::kill32
call fcn.00421b80
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x42c3e3
mov byte [ebp - 1], 1
jmp 0x42c3e7
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x42c3f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443e58
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x58]
call fcn.0042c8d0
mov dword [ebp - 4], 0
push str.tskill.exe
lea ecx, [ebp - 0x28]
call fcn.00404fe0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.0042c830
add esp, 8
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x48], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0042c010
add esp, 0x10
mov byte [ebp - 0x41], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00403d10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00403d10
movzx eax, byte [ebp - 0x41]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.kill_pid:_d__bSucess:_d
push 0x16f
push 0x44ef08
call fcn.00421b80
add esp, 0x14
movzx edx, byte [ebp - 0x41]
test edx, edx
jne 0x42c503
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.tskill.exe_error_lastError___d
push 0x171
push str.utility::process::kill
call fcn.00421b80
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42c4f4
cmp dword [ebp + 0xc], 0xffffffff
jne 0x42c4ea
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42c4f4
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c350
add esp, 4
mov byte [ebp - 0x41], al
mov dl, byte [ebp - 0x41]
mov byte [ebp - 0x42], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0042c8a0
mov al, byte [ebp - 0x42]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00440154
mov esp, ebp
pop ebp
ret
Function at 0x4301f0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4443c0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x54], ecx
push 0
push 0
push 0
push 0
push 0x44f93c
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edx, dword [ebp - 0x44]
mov dword [edx], eax
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0
jne 0x430255
push 0
mov ecx, dword [ebp - 0x44]
call fcn.00430580
xor al, al
jmp 0x43033b
lea ecx, [ebp - 0x28]
call fcn.004053f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004053f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.004308e0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x4302bd
push 1
mov ecx, dword [ebp - 0x44]
call fcn.00430580
mov byte [ebp - 0x45], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403d10
mov al, byte [ebp - 0x45]
jmp 0x43033b
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.004048a0
mov ecx, dword [ebp - 0x44]
mov dx, word [ebp - 0x4c]
mov word [ecx + 0x1c], dx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x20
call fcn.004048a0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x38
call fcn.004048a0
push 8
push str.https:__
mov ecx, dword [ebp + 8]
call fcn.00405040
push eax
call dword [sym.imp.MSVCR120.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x430319
mov edx, dword [ebp - 0x44]
mov byte [edx + 0x50], 1
mov byte [ebp - 0x46], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403d10
mov al, byte [ebp - 0x46]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00440154
mov esp, ebp
pop ebp
ret 0xc

Function at 0x430700
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
push eax
push 0
push 3
push 0
push 0
movzx ecx, word [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00405040
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x430745
xor al, al
jmp 0x430747
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44052d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x44052b
lea ebx, [0xdd294cb6]
movzx eax, ax
mov al, 0x3d
call 0x44053b
imul edx, ebx, 0x194ee18c
dec ebx
mov esi, esi
cmp edi, 0xa86f
jbe 0x440552
lea edi, [0x9827a4e6]
xchg ecx, edx
sub ebp, esi
test eax, 0xdd46bf25
inc esi
mov cl, bh
not ebp
imul edx, esi
xor cl, al
movzx edx, bp
mov ch, 0x51
movsx ebp, di
bswap edx
push 0xfffff408
pop eax
test edi, eax
add eax, 0xbf8
imul edx, edi
sub eax, 0xfffffeb2
xor eax, 0x14e
test edx, ebx
add eax, 0xfff8d4b4
imul ebp, edi
add eax, 0x71da1
not ebp
lea edi, [eax]
mov dl, bh
add edi, 0xdab
xchg edx, ebp
bswap edx
add edi, 0xfffffad3
xor dl, 0x27
add edi, 0x52e
inc dl
cmp edi, 0x259
jb 0x4405a5
pop edx
adc ebp, esi
mov ebp, 0xb98a0155
mov ch, bl
dec al
and ebp, 0x66f55b14
lea ebp, [0x266]
sub ebp, 0x266
or ebp, ebx
mov eax, ebp
push eax
imul ebp, ebx
pop edi
bswap ebp
lea ecx, [edi]
test bh, 0x3c
inc eax
lea ebx, [ecx]
movzx ebp, di
mov cl, 0x11
push ebx
adc eax, 0xbc9aee51
pop esi
movd mm0, edx
test ch, ah
not cl
mov eax, 0x7328603d
pushal
sub byte [ebx - 0x73], dh
sbb eax, 0xf60f8b88
mov ecx, dword [edi]
div byte [eax]
fadd qword [ecx - 0x5ae78e2d]
inc eax
mov edi, 0xfffff935
test ebx, ecx
add edi, 0x6cb
mov bh, ch
or edi, 0xfff22d06
test cl, 0x8b
add edi, 0xec919
test ecx, ebp
sub esi, edi
jmp 0x440647
add esi, 0x645
test dh, bl
bswap ebp
push 0x689
or ch, 0x9b
pop edx
sub edx, 0x4b
dec edx
mov eax, eax
bswap esi
cmp edx, 0x14b
jae 0x440660
movd esi, mm0
mov bl, 0xf2
cmp edx, eax
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x53764133
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x709a72a7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x41b4a0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x4222a4]
imul eax, eax, 0x343fd
cmp dword [0x22c4e8c], 0x139e
mov dword [0x4222a4], eax
jne 0x41b4f3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x4222a4]
add eax, 0x269ec3
push esi
mov dword [0x4222a4], eax
movzx esi, word [0x4222a6]
and esi, 0x7fff
cmp dword [0x22c4e8c], 0x8e7
jne 0x41b528
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x41b5b0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4201f0]
push ebx
mov ebx, dword [0x22c4830]
push edi
mov edi, dword [0x22c4e8c]
call fcn.0041b540
cmp dword [0x22c4e8c], 0x2f
jne 0x41b615
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0041b570
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x41b970
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409150
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x41b999
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x41ba41
cmp dword [0x22c4e8c], 0xa5f
jne 0x41b9e5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.keminivefayosexerukugufebaponif
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x41ba0a
mov eax, dword [0x421010]
mov dword [0x22c4e8c], eax
mov ecx, dword [0x22c4e8c]
add ecx, 0xa231
mov dword [0x22c4e8c], ecx
cmp dword [0x22c4e8c], 0x141
jne 0x41ba3c
push str.renej_luwoyisawopab_dadabayegutenecisufoba_wozonotuwugewiropoxu_vogiwipeladoxakanahotucucuwi
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4222a8], 0xec58acac
mov dword [0x4222ac], 0xffffffff
jmp 0x41b990
call fcn.0041b630
jmp dword [0x22c4830]
Function at 0x401e80
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x401f67
test edx, edx
je 0x401f67
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x401eca
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x401ed1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x401eb0
jmp 0x401ed3
mov esi, 0x1505
jmp 0x401ed3
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x401f67
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x401f04
inc ebx
dec ebp
je 0x401f65
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401f65
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401f00
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408e10
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401f00
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408e30
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401f00
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x401f67
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4020b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x402118
mov esi, dword [esp + 0x30]
test esi, esi
je 0x402118
push esi
call fcn.00408e10
add esp, 4
test eax, eax
je 0x4020fa
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402101
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4020e0
jmp 0x402103
mov ebp, 0x1505
jmp 0x402103
mov ebp, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov edx, edi
sub edx, 1
jae 0x402124
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402144
inc ebx
dec edi
je 0x402118
mov eax, ebx
and eax, edx
mov esi, dword [esp + 0xc]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
je 0x402118
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x402140
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408e10
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402140
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x38]
call fcn.00408e30
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x402140
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x402118
cmp dword [eax + 4], 3
jne 0x402118
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x402118
Function at 0x4021f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x4022f9
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4022f9
push ebx
call fcn.00408e10
add esp, 4
test eax, eax
je 0x40224a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402251
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402230
jmp 0x402253
mov esi, 0x1505
jmp 0x402253
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x4022f9
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402284
inc ebp
dec ebx
je 0x4022f7
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4022f7
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402280
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408e10
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402280
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408e30
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402280
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4022f7
cmp dword [eax + 4], 5
mov edi, 0
jne 0x4022f9
mov edi, dword [eax + 8]
jmp 0x4022f9
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402310
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x40241c
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x40241c
push ebx
call fcn.00408e10
add esp, 4
test eax, eax
je 0x40236a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402371
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402350
jmp 0x402373
mov esi, 0x1505
jmp 0x402373
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x40241c
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x4023a4
inc ebp
dec ebx
je 0x402417
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402417
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4023a0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408e10
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4023a0
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408e30
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4023a0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402417
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x40241c
mov edi, dword [eax + 8]
jmp 0x40241c
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret