joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12a19f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x12a1a5b
mov esi, dword [esp + 0x30]
test esi, esi
je 0x12a1a5b
push esi
call fcn.012a8900
add esp, 4
test eax, eax
je 0x12a1a3a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x12a1a41
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x12a1a20
jmp 0x12a1a43
mov ebp, 0x1505
jmp 0x12a1a43
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x12a1a67
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x12a1a84
inc ebx
dec edi
je 0x12a1a5b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x12a1a5b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x12a1a80
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.012a8900
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x12a1a80
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.012a8930
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x12a1a80
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x12a1a5b
cmp dword [eax + 4], 3
jne 0x12a1a5b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x12a1a5b
Function at 0x12a1b20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x12a1c21
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x12a1c21
push ebx
call fcn.012a8900
add esp, 4
test eax, eax
je 0x12a1b7a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x12a1b81
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x12a1b60
jmp 0x12a1b83
mov esi, 0x1505
jmp 0x12a1b83
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x12a1c21
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x12a1bb4
inc ebp
dec ebx
je 0x12a1c1f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x12a1c1f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x12a1bb0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.012a8900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x12a1bb0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.012a8930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x12a1bb0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x12a1c1f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x12a1c21
mov edi, dword [eax + 8]
jmp 0x12a1c21
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12a1c50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x12a1d54
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x12a1d54
push ebx
call fcn.012a8900
add esp, 4
test eax, eax
je 0x12a1caa
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x12a1cb1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x12a1c90
jmp 0x12a1cb3
mov esi, 0x1505
jmp 0x12a1cb3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x12a1d54
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x12a1ce4
inc ebp
dec ebx
je 0x12a1d4f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x12a1d4f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x12a1ce0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.012a8900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x12a1ce0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.012a8930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x12a1ce0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x12a1d4f
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x12a1d54
mov edi, dword [eax + 8]
jmp 0x12a1d54
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12a1f50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x12a1fbd
mov esi, dword [esp + 0x28]
test esi, esi
je 0x12a1fbd
push esi
call fcn.012a8900
add esp, 4
test eax, eax
je 0x12a1f9a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x12a1fa1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x12a1f80
jmp 0x12a1fa3
mov ebx, 0x1505
jmp 0x12a1fa3
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x12a1fc5
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x12a1fd4
inc ebp
dec edi
je 0x12a1fbb
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x12a1fbb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x12a1fd0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.012a8900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x12a1fd0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.012a8930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x12a1fd0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x12a1fbd
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x12a1fbd
Function at 0x12a9150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x12a91bc
mov eax, 0x270
mov edx, 0x80000000
mov esi, 0x270
nop
nop
nop
nop
mov ebp, dword [ecx + esi*4 - 0x9bc]
and ebp, edx
mov edi, dword [ecx + esi*4 - 0x9b8]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 - 0x388]
shr ebx, 1
xor edi, ebx
mov dword [ecx + esi*4 + 4], edi
mov edi, esi
and edi, 1
xor esi, 1
lea esi, [esi + edi*2]
cmp esi, 0x4e0
jb 0x12a9170
jmp 0x12a928f
cmp eax, 0x4e0
jb 0x12a928f
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
mov edi, dword [ecx + eax*4 + 0x9c8]
and esi, 0x80000000
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x12a91d0
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edx, dword [ecx + eax*4 + 4]
xor edx, edi
mov dword [ecx + eax*4 + 0x390], edx
inc eax
cmp eax, 0x18c
jne 0x12a9220
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12b8670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [esp + 0x14]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], cl
mov byte [esi + 9], al
movzx edx, byte [ebx]
test dl, dl
je 0x12b86ea
lea ecx, [ebx + 1]
xor eax, eax
jmp 0x12b86b9
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x12b86ec
movzx edi, dl
mov ebp, edi
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x12b86b0
test dl, dl
jns 0x12b86b0
mov edx, edi
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x12b86b0
and edi, 0xfffffff8
cmp edi, 0xf0
jne 0x12b86b1
add eax, 2
jmp 0x12b86b1
xor eax, eax
mov edi, dword [esp + 0x18]
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebp, [eax + ecx*2]
test ebp, ebp
jns 0x12b8706
mov eax, 0xffffffff
jmp 0x12b870d
lea eax, [ebp*2]
push eax
call fcn.012a86e0
add esp, 4
mov dword [esi], eax
push 0
push ebx
push ebp
push eax
call fcn.012aafb0
add esp, 0x10
movzx edx, byte [edi]
test dl, dl
je 0x12b8786
lea ecx, [edi + 1]
xor eax, eax
jmp 0x12b8749
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x12b877a
movzx ebx, dl
mov ebp, ebx
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x12b8740
test dl, dl
jns 0x12b8740
mov edx, ebx
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x12b8740
and ebx, 0xfffffff8
cmp ebx, 0xf0
jne 0x12b8741
add eax, 2
jmp 0x12b8741
mov ebx, eax
inc ebx
jns 0x12b8792
mov eax, 0xffffffff
jmp 0x12b8799
mov eax, 2
mov ebx, 1
jmp 0x12b8799
lea eax, [eax*2 + 2]
push eax
call fcn.012a86e0
add esp, 4
mov dword [esi + 4], eax
push 0
push edi
push ebx
push eax
call fcn.012aafb0
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x12bcfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov dword [esp + 8], 0x49dc4b1d
mov dword [esp + 0xc], 0x45d747c5
mov dword [esp + 0x10], 0x414243d6
mov dword [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov edx, 0xc
sub edx, eax
lea esi, [eax + 0xf3]
and esi, 0xc6
mov edi, edx
and edi, 0x39
or edi, esi
mov esi, 0x58d40c
sub esi, eax
xor edi, esi
xor edi, 0xc6
and edx, esi
or edx, edi
mov ebx, esi
xor ebx, ecx
and edx, ecx
not ecx
and ecx, esi
add ebx, esi
not ebx
add ebx, ecx
or ebx, edx
add bl, 0x41
mov byte [esp + eax + 8], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x10
jb 0x12bcff0
mov dword [esp + 0x34], 0xf19a0fa4
mov dword [esp + 0x38], 0xf562f364
mov dword [esp + 0x3c], 0xf927f72e
mov dword [esp + 0x40], 0xfd56fb29
mov dword [esp + 0x44], 0xe15bff6d
mov dword [esp + 0x48], 0xe54ee343
mov dword [esp + 0x4c], 0xe977e74c
mov dword [esp + 0x50], 0xed7eeb7d
mov dword [esp + 0x54], 0xd1eeef36
mov word [esp + 0x58], 0
mov byte [esp + 0x5a], 0
mov eax, 0xfd
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0xc9]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xf
mov byte [esp + eax - 0xc9], dl
inc eax
dec ecx
cmp eax, 0x124
jne 0x12bd0b0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14c]
test cx, cx
je 0x12bd103
lea edx, [esp + 0x36]
mov esi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x12bd0f0
jmp 0x12bd106
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x12bd131
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x12bd120
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x12bd161
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x12bd150
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x34], 0x959090ca
mov byte [esp + 0x38], 0x38
mov dword [esp + 0x39], 0
mov byte [esp + 0x3d], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xcb
xor cl, byte [esp + eax + 0x34]
add cl, 9
mov byte [esp + eax + 0x34], cl
inc eax
cmp eax, 0xa
jne 0x12bd190
movzx eax, byte [esp + 0x34]
test al, al
je 0x12bd1cb
lea ecx, [esp + 0x35]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x12bd1c0
mov byte [esi], 0
lea eax, [esp + 0x140]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x14c]
push eax
push ecx
push edx
call fcn.012ab6e0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x12e69b8]
mov ecx, 0x40ba4041
xor ecx, dword [0x12e69c0]
add eax, ecx
inc eax
jmp eax
Function at 0x12c0cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x12c0ce0
sar ebp, 1
lea esi, [esp + 0x1c]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [fcn.012ecd18]
mov dword [esp + 8], 0xf13e3f19
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov ecx, 0x77f33335
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x77f3332d]
xor edx, ecx
add edx, 0xa9e267ef
mov ebx, edx
xor ebx, 6
and edx, 6
lea edx, [ebx + edx*2]
add dl, 2
mov byte [esp + ecx - 0x77f3332d], dl
inc ecx
cmp ecx, 0x77f3333c
jne 0x12c0d20
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x12e6cb8]
Function at 0x15b8ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
movzx eax, word [edi]
mov dword [esp], 0xf10eb5c3
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xa
mov ebx, edx
xor ebx, 0xfd
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0xf
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 7
jne 0x15b8cd0
xor ecx, ecx
cmp dword [esp], eax
setne cl
jmp dword [ecx*4 + 0x12ea530]

Function at 0x15b9950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov eax, 0x3d
mov edx, 0x5b2fb6c2
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3d]
mov ebx, edx
or ebx, ecx
not ecx
or ecx, eax
and ecx, ebx
mov ebx, 0xc7ee91cd
sub ebx, ecx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
mov byte [esp + eax - 0x3d], cl
inc eax
dec edx
cmp eax, 0x43
jne 0x15b9980
mov eax, dword [esp]
mov edx, dword [0x12ecd1c]
test edx, edx
je 0x15b9a08
xor ebx, ebx
mov ecx, dword [0x12ecd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x15b99e0
inc ebx
cmp edx, ebx
jne 0x15b99d0
jmp 0x15b9a08
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x15b9a08
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x12ecd24]
call fcn.015b7070
add esp, 0x20
test edi, edi
je 0x15b9a12
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x15b9a1e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x99768c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9976b3
call fcn.00939c18
mov dword [eax], esi
call fcn.00939c05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093a85a
mov eax, esi
jmp 0x997708
test dword [ebp + 0xc], 0xfffffff9
jne 0x997699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9976e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00939c2b
pop ecx
call fcn.00939c05
mov eax, dword [eax]
jmp 0x997708
test al, 0x10
jne 0x997706
test al, 1
je 0x997706
test byte [ebp + 0xc], 2
je 0x997706
call fcn.00939c18
mov dword [eax], 5
call fcn.00939c05
mov dword [eax], 0xd
jmp 0x9976d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x438caa
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
add ecx, 1
or ebx, ebx
sub ebx, ecx
call fcn.00438ce5
dec ebx
xor dword [edx], edi
add ecx, ebx
push 0x6c24a861
pop ebx
inc ebx
inc edx
sub ebx, 0xb802acc
add ecx, 0x32c30ccb
cmp edx, eax
jne fcn.00438caa
dec ebx
sub ebx, ecx
ret
Function at 0xc618b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0xc619b1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0xc619b1
push ebx
call fcn.00c699d0
add esp, 4
test eax, eax
je 0xc6190a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0xc61911
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0xc618f0
jmp 0xc61913
mov esi, 0x1505
jmp 0xc61913
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0xc619b1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xc61944
inc ebp
dec ebx
je 0xc619af
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0xc619af
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0xc61940
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00c699d0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xc61940
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00c699f0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xc61940
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0xc619af
cmp dword [eax + 4], 2
mov edi, 0
jne 0xc619b1
mov edi, dword [eax + 8]
jmp 0xc619b1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xc619e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0xc61a4b
mov esi, dword [esp + 0x30]
test esi, esi
je 0xc61a4b
push esi
call fcn.00c699d0
add esp, 4
test eax, eax
je 0xc61a2a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0xc61a31
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0xc61a10
jmp 0xc61a33
mov ebp, 0x1505
jmp 0xc61a33
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0xc61a57
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xc61a74
inc ebx
dec edi
je 0xc61a4b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0xc61a4b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0xc61a70
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00c699d0
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0xc61a70
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.00c699f0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0xc61a70
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0xc61a4b
cmp dword [eax + 4], 3
jne 0xc61a4b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0xc61a4b
Function at 0xc61b10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0xc61c11
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0xc61c11
push ebx
call fcn.00c699d0
add esp, 4
test eax, eax
je 0xc61b6a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0xc61b71
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0xc61b50
jmp 0xc61b73
mov esi, 0x1505
jmp 0xc61b73
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0xc61c11
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xc61ba4
inc ebp
dec ebx
je 0xc61c0f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0xc61c0f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0xc61ba0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00c699d0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xc61ba0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00c699f0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xc61ba0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0xc61c0f
cmp dword [eax + 4], 5
mov edi, 0
jne 0xc61c11
mov edi, dword [eax + 8]
jmp 0xc61c11
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xc61f40
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0xc61fad
mov esi, dword [esp + 0x28]
test esi, esi
je 0xc61fad
push esi
call fcn.00c699d0
add esp, 4
test eax, eax
je 0xc61f8a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0xc61f91
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0xc61f70
jmp 0xc61f93
mov ebx, 0x1505
jmp 0xc61f93
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0xc61fb5
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xc61fc4
inc ebp
dec edi
je 0xc61fab
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0xc61fab
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0xc61fc0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00c699d0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xc61fc0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00c699f0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xc61fc0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0xc61fad
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0xc61fad