joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10106f24
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10106fc1
push ebx
push esi
call fcn.10106eed
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10106e81
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10106f6e
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10106fc0
push edi
push eax
call fcn.10107edf
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10106f8e
call fcn.101059c9
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10106fbf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10106e81
add esp, 0x20
test eax, eax
jne 0x10106fad
push edi
call fcn.101059c9
jmp 0x10106fb5
push ebx
call fcn.101059c9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1010722e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10191cd0
push 0x10191cc8
push str.FlsAlloc
push 0x1f
call fcn.1010714a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10107262
push dword [ebp + 8]
mov ecx, esi
call dword [0x10119204]
call esi
jmp 0x10107268
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x101072ac
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10191ce0
push 0x10191cd8
push str.FlsGetValue
push 0x21
call fcn.1010714a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101072e3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10119204]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x101072eb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10191ce8
push 0x10191ce0
push str.FlsSetValue
push 0x22
call fcn.1010714a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10107325
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10119204]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x1010c9c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1010c9ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1010c9ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1c4530
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x1c4610
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x1c4610
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x1c457a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x1c4581
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x1c4560
jmp 0x1c4583
mov esi, 0x1505
jmp 0x1c4583
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x1c4610
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x1c45b4
inc edi
dec ebx
je 0x1c460e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x1c460e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x1c45b0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.001cce90
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x1c45b0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.001cceb0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x1c45b0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x1c4610
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c4620
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x1c4721
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x1c4721
push ebx
call fcn.001cce90
add esp, 4
test eax, eax
je 0x1c467a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x1c4681
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x1c4660
jmp 0x1c4683
mov esi, 0x1505
jmp 0x1c4683
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x1c4721
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1c46b4
inc ebp
dec ebx
je 0x1c471f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x1c471f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x1c46b0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.001cce90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1c46b0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.001cceb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1c46b0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x1c471f
cmp dword [eax + 4], 2
mov edi, 0
jne 0x1c4721
mov edi, dword [eax + 8]
jmp 0x1c4721
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c4750
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x1c47bb
mov esi, dword [esp + 0x30]
test esi, esi
je 0x1c47bb
push esi
call fcn.001cce90
add esp, 4
test eax, eax
je 0x1c479a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x1c47a1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x1c4780
jmp 0x1c47a3
mov ebp, 0x1505
jmp 0x1c47a3
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x1c47c7
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1c47e4
inc ebx
dec edi
je 0x1c47bb
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x1c47bb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x1c47e0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.001cce90
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x1c47e0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.001cceb0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x1c47e0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x1c47bb
cmp dword [eax + 4], 3
jne 0x1c47bb
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x1c47bb

Function at 0x1c4880
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x1c4981
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x1c4981
push ebx
call fcn.001cce90
add esp, 4
test eax, eax
je 0x1c48da
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x1c48e1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x1c48c0
jmp 0x1c48e3
mov esi, 0x1505
jmp 0x1c48e3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x1c4981
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1c4914
inc ebp
dec ebx
je 0x1c497f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x1c497f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x1c4910
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.001cce90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1c4910
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.001cceb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1c4910
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x1c497f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x1c4981
mov edi, dword [eax + 8]
jmp 0x1c4981
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c49b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x1c4ab4
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x1c4ab4
push ebx
call fcn.001cce90
add esp, 4
test eax, eax
je 0x1c4a0a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x1c4a11
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x1c49f0
jmp 0x1c4a13
mov esi, 0x1505
jmp 0x1c4a13
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x1c4ab4
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1c4a44
inc ebp
dec ebx
je 0x1c4aaf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x1c4aaf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x1c4a40
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.001cce90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1c4a40
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.001cceb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1c4a40
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x1c4aaf
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x1c4ab4
mov edi, dword [eax + 8]
jmp 0x1c4ab4
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c4ac0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.001ccf00
add esp, 8
test eax, eax
je 0x1c4b24
mov esi, eax
jmp 0x1c4b04
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.001ccf00
add esp, 8
mov esi, eax
test eax, eax
je 0x1c4b24
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.001c4530
add esp, 0xc
xor edi, edi
test eax, eax
je 0x1c4af0
cmp dword [eax + 4], 4
jne 0x1c4af0
mov edi, dword [eax + 8]
jmp 0x1c4af0
xor eax, eax
test edi, edi
je 0x1c4b8b
test ebp, ebp
je 0x1c4b8b
push ebp
call fcn.001cce90
add esp, 4
test eax, eax
je 0x1c4b6b
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x1c4b72
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x1c4b50
jmp 0x1c4b74
mov esi, 0x1505
jmp 0x1c4b74
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x1c4b93
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x1c4bb4
inc ebx
dec ecx
je 0x1c4b89
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x1c4b89
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x1c4bb0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.001cce90
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x1c4bb0
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.001cceb0
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x1c4bb0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x1c4b8b
Function at 0x1c4cb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x1c4d1d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x1c4d1d
push esi
call fcn.001cce90
add esp, 4
test eax, eax
je 0x1c4cfa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x1c4d01
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x1c4ce0
jmp 0x1c4d03
mov ebx, 0x1505
jmp 0x1c4d03
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x1c4d25
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1c4d34
inc ebp
dec edi
je 0x1c4d1b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x1c4d1b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x1c4d30
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.001cce90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1c4d30
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.001cceb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1c4d30
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x1c4d1d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x1c4d1d
Function at 0x1c5260
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x1c5372
mov esi, dword [esp + 0x28]
test esi, esi
je 0x1c5372
cmp dword [esp + 0x2c], 0
je 0x1c5372
push esi
call fcn.001cce90
add esp, 4
test eax, eax
je 0x1c52ca
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x1c52d1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x1c52b0
jmp 0x1c52d3
mov ebx, 0x1505
jmp 0x1c52d3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x1c537a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x1c5337
call fcn.001c5fa0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x1c5372
push ecx
call fcn.001cce90
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x1c53ed
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x1c5398
inc edi
dec esi
je 0x1c52ec
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x1c52f1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x1c5390
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.001cce90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1c5390
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.001cceb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1c5390
mov eax, 0xffffffff
jmp 0x1c5372
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x1c5408
inc edi
dec esi
je 0x1c5332
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x1c5337
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x1c5400
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.001cce90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1c5400
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.001cceb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1c5400
jmp 0x1c5337
Function at 0x1c5cf0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x1c5eda
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x1c5eda
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x1c5eda
cmp dword [ecx], 0
jne 0x1c5eda
push esi
call fcn.001cce90
add esp, 4
test eax, eax
je 0x1c5d5a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x1c5d61
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x1c5d40
jmp 0x1c5d63
mov edi, 0x1505
jmp 0x1c5d63
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x1c5e34
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x1c5dc1
call fcn.001c5fa0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x1c5eda
push esi
call fcn.001cce90
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.001c5ef0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.001cce90
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x210008]
add esp, 4
test eax, eax
je 0x1c5ed5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.001ccca0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x1c5eda
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1c5e58
inc ebx
dec edx
je 0x1c5d7c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x1c5d81
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x1c5e50
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.001cce90
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x1c5e50
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.001cceb0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x1c5e50
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.001c4e10
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x1c5e29
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c6fa0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x1c7166
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x1c715f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x1c7043
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0x1c715f
xor eax, eax
cmp edx, 8
mov dword [esp + 0xc], ebp
jb 0x1c70c2
mov eax, edx
and eax, 0x1ff8
mov dword [esp + 4], eax
mov ebp, edx
xor edx, edx
nop
nop
nop
mov eax, edx
movzx edx, byte [ebx + edx]
mov esi, edi
and esi, edx
xor edi, edx
lea edx, [edi + esi*2]
add ecx, edx
movzx esi, byte [ebx + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x1c7060
add ebx, edx
mov edx, ebp
mov eax, dword [esp + 4]
mov esi, eax
sub esi, edx
mov dword [esp], edx
jae 0x1c6ffb
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0x1c7112
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x1c70f0
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0x1c6ff0
jmp 0x1c711f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0x1c6ff0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x1c7130
jmp 0x1c6ff0
shl ecx, 0x10
or ecx, edi
jmp 0x1c716b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1cccf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x1ccd4e
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x1ccd4e
test ebx, ebx
je 0x1ccded
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x1ccd92
mov ebp, ebx
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov byte [edx + esi], bl
dec esi
cmp edi, esi
jne 0x1ccd30
add ecx, esi
add edx, esi
mov ebx, ebp
add esi, ebp
cmp ebx, 8
jae 0x1ccd99
jmp 0x1ccded
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
xor ecx, 3
mov ebp, ebx
or ebp, 0xfffffffc
and ebp, ecx
lea edx, [eax + ebp]
add ebp, esi
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov esi, ebp
mov edi, edx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x1ccded
and ebx, 2
movzx ecx, byte [ebp + ebx]
mov byte [edx + ebx], cl
jmp 0x1ccded
mov esi, ebx
cmp ebx, 8
jb 0x1ccded
neg esi
xor edi, edi
nop
nop
nop
movzx ebx, byte [ecx + edi]
mov byte [edx + edi], bl
movzx ebx, byte [ecx + edi - 1]
mov byte [edx + edi - 1], bl
movzx ebx, byte [ecx + edi - 2]
mov byte [edx + edi - 2], bl
movzx ebx, byte [ecx + edi - 3]
mov byte [edx + edi - 3], bl
movzx ebx, byte [ecx + edi - 4]
mov byte [edx + edi - 4], bl
movzx ebx, byte [ecx + edi - 5]
mov byte [edx + edi - 5], bl
movzx ebx, byte [ecx + edi - 6]
mov byte [edx + edi - 6], bl
movzx ebx, byte [ecx + edi - 7]
mov byte [edx + edi - 7], bl
add edi, 0xfffffff8
cmp esi, edi
jne 0x1ccda0
pop esi
pop edi
pop ebx
pop ebp
ret