joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100037e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 6], 0x69
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x2c], 0x43
mov byte [ebp - 0x2b], 0x6c
mov byte [ebp - 0x2a], 0x6f
mov byte [ebp - 0x29], 0x73
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x48
mov byte [ebp - 0x26], 0x61
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x18]
push eax
call fcn.100035e0
add esp, 4
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.100035e0
add esp, 4
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x2c]
push edx
call fcn.100035e0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0
push 0x80
push 4
push 0
push 1
push 0x10000000
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x100038c1
xor al, al
jmp 0x100038e6
mov dword [ebp - 0x38], 0
push 0
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
push edx
call dword [ebp - 0x1c]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x100038f0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
xor eax, eax
je 0x100039aa
mov byte [ebp - 0x111], 0
mov dword [ebp - 0x11c], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x10003951
mov ecx, dword [ebp - 0x118]
and ecx, 1
je 0x10003941
mov edx, dword [ebp - 0x11c]
add edx, 1
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x118]
shr eax, 1
mov dword [ebp - 0x118], eax
jmp 0x1000391e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x105], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100039c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0x24], 0x43
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x73
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x48
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0
lea eax, [ebp - 0x24]
push eax
call fcn.100035e0
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.100035e0
add esp, 4
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x10002d50
push 0
push 0
call dword [ebp - 4]
mov dword [ebp - 0x28], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x28]
push eax
call dword [ebp - 0x18]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10003a90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.dll_Process32First
lea edx, [ebp - 0x104]
push edx
call fcn.10003430
add esp, 4
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp + 8]
jne 0x10003aed
mov eax, dword [ebp - 0x120]
jmp 0x10003b06
lea ecx, [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x12c]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10003ac5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10003b10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10003b38
xor eax, eax
jmp 0x10003bad
mov dword [ebp - 0x230], 0x224
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x10003b64
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10003bad
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.100036e0
add esp, 8
test eax, eax
jne 0x10003b8d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x214]
jmp 0x10003bad
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x10003b64
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10003bc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x13c], 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.10003b10
add esp, 8
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x10003d74
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x134], ecx
mov edx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x138], edx
push 0x34102a7f
call fcn.100035b0
add esp, 4
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x120]
push eax
push 0
push 0x2a
call dword [ebp - 0x140]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x10003d74
push 0x1c29179f
call fcn.100035b0
add esp, 4
mov dword [ebp - 0x154], eax
push 4
push 0x1000
push 8
push 0
mov ecx, dword [ebp - 0x144]
push ecx
call dword [ebp - 0x154]
mov dword [ebp - 0x13c], eax
push 0x6328d74d
call fcn.100035b0
add esp, 4
mov dword [ebp - 0x148], eax
push 0
push 8
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call dword [ebp - 0x148]
push 0x40
push 0x1000
push 0x800
push 0
mov edx, dword [ebp - 0x144]
push edx
call dword [ebp - 0x154]
mov dword [ebp - 0x150], eax
push 0
push 0x800
push 0x10003410
mov eax, dword [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call dword [ebp - 0x148]
push 0x2c7f4aee
call fcn.100035b0
add esp, 4
mov dword [ebp - 0x158], eax
push 0
push 0
mov edx, dword [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0x150]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x144]
push ecx
call dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
push 0x70ebfb28
call fcn.100035b0
add esp, 4
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x144]
push edx
call dword [ebp - 0x14c]
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10003bf5
mov esp, ebp
pop ebp
ret
Function at 0x10003da0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x10]
push eax
push 9
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10003dda
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10003ee1
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10003e3c
cmp dword [ebp - 0xc], 0xea
je 0x10003e3c
cmp dword [ebp - 0xc], 0x7a
je 0x10003e3c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
jmp 0x10003ee1
mov edx, dword [ebp - 0x24]
lea eax, [edx + edx + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x38], 0
jne 0x10003e64
mov dword [ebp - 0x20], 8
jmp 0x10003e2a
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x24]
add edx, 1
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x10003ea5
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10003da0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x10003ea5
jmp 0x10003eae
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x3c], 0x103
je 0x10003ebf
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1c]
jb 0x10003e6b
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret 8

Function at 0x10008175
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000e9f0]
jne 0x1000817f
repz ret
jmp fcn.1000972d
Function at 0x10009228
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100041c6
and dword [ebp - 4], 0
cmp dword [0x10015400], 0
mov ebx, eax
jne 0x100092d9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000938a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000938a
push eax
call fcn.10004154
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10015400], eax
call esi
push eax
call fcn.10004154
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10015404], eax
call esi
push eax
call fcn.10004154
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10015408], eax
call esi
push eax
call fcn.10004154
pop ecx
mov dword [0x10015410], eax
test eax, eax
je 0x100092d9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10004154
pop ecx
mov dword [0x1001540c], eax
mov eax, dword [0x1001540c]
cmp eax, ebx
je 0x10009331
cmp dword [0x10015410], ebx
je 0x10009331
push eax
call fcn.100041cf
push dword [0x10015410]
mov esi, eax
call fcn.100041cf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10009331
test edi, edi
je 0x10009331
call esi
test eax, eax
je 0x10009328
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10009328
test byte [ebp - 0xc], 1
jne 0x10009331
or dword [ebp + 0x10], 0x200000
jmp 0x1000936a
mov eax, dword [0x10015404]
cmp eax, ebx
je 0x1000936a
push eax
call fcn.100041cf
pop ecx
test eax, eax
je 0x1000936a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000936a
mov eax, dword [0x10015408]
cmp eax, ebx
je 0x1000936a
push eax
call fcn.100041cf
pop ecx
test eax, eax
je 0x1000936a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10015400]
call fcn.100041cf
pop ecx
test eax, eax
je 0x1000938a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000938c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bf74
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40c028
jmp 0x40c01d
cmp dword [esi + 0x10], 0x1000
jne 0x40c009
test byte [esi + 0x15], 1
jne 0x40c009
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40bfc8
cmp eax, 2
je 0x40bfc8
cmp eax, 0x10
je 0x40bfc8
cmp eax, 0x20
jne 0x40bfdd
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40bfdd
mov bl, 1
xor ebp, ebp
jmp 0x40bfee
mov eax, dword [esi]
add eax, ebp
call fcn.0040bf6c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40bfe1
test bl, bl
je 0x40c009
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40c028
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40bfa0
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x404380
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404460
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x404460
mov esi, 0x1505
cmp dword [esp + 0x28], 0
je 0x4043d0
xor ebx, ebx
nop
nop
movzx ecx, byte [ebp + ebx]
test ecx, ecx
je 0x4043d0
mov edx, esi
shl edx, 5
mov edi, edx
and edi, esi
xor edx, esi
add edx, ecx
lea esi, [edx + edi*2]
inc ebx
cmp dword [esp + 0x28], ebx
jne 0x4043b0
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
test ebx, ebx
je 0x404460
lea edx, [ebx - 1]
mov eax, esi
not eax
mov dword [esp + 8], edx
or eax, edx
mov edx, dword [ecx + 4]
mov dword [esp + 4], edx
lea edi, [esi + eax]
inc edi
jmp 0x404404
inc edi
dec ebx
je 0x40445e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40445e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x404400
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c9b0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x404400
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c9d0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x404400
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404460
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4049c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x404bda
cmp dword [esp + 0x1c], 0
jle 0x404b81
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [edx + eax]
mov dword [esp], ecx
jmp 0x404a18
cmp esi, 0xc0
jne 0x404bd8
and ebx, 0x1ff800
cmp ebx, 0xd800
mov ecx, dword [esp]
je 0x404bd8
add edx, ebp
cmp edx, ecx
jae 0x404b81
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x404bd8
mov eax, ebx
and al, 0xfe
cmp al, 0xc0
je 0x404bd8
mov eax, ebx
and eax, 0xffffffc0
cmp eax, 0x80
je 0x404bd8
mov ebp, 1
test bl, bl
jns 0x404a0e
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x404a7a
movzx edi, byte [edx + 1]
mov eax, edi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x404bd8
and ebx, 0x1f
shl ebx, 6
mov ebp, 2
jmp 0x404ac6
mov eax, ebx
and eax, 0xfffffff0
cmp eax, 0xe0
jne 0x404aca
movzx eax, byte [edx + 1]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404bd8
movzx edi, byte [edx + 2]
mov ecx, edi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404bd8
shl ebx, 0xc
and eax, 0x3f
shl eax, 6
add ebx, eax
add ebx, 0xfff20000
mov ebp, 3
xor ecx, ecx
jmp 0x404b44
mov eax, ebx
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x404bd8
movzx ecx, byte [edx + 1]
mov eax, ecx
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x404bd8
movzx eax, byte [edx + 2]
mov edi, eax
xor edi, 0xffffff3f
mov ebp, eax
or ebp, 0xc0
and ebp, edi
cmp ebp, 0x80
jne 0x404bd8
movzx edi, byte [edx + 3]
mov ebp, edi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x404bd8
and ebx, 7
shl ebx, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
and eax, 0x3f
or eax, ecx
shl eax, 6
mov cl, 1
mov ebp, 4
mov ebx, eax
and edi, 0x3f
or edi, ebx
cmp edi, 0x80
jb 0x404bd8
cmp edi, 0x7ff
jbe 0x4049ed
cmp edi, 0xffff
ja 0x404b73
test cl, cl
je 0x4049f9
jmp 0x404bd8
cmp edi, 0x10ffff
jbe 0x4049f9
jmp 0x404bd8
mov edi, dword [esp + 0x1c]
lea eax, [edi + 1]
push eax
call dword [0x447008]
add esp, 4
test eax, eax
je 0x404bd8
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040c7a0
add esp, 0xc
push 0x10
call dword [0x447008]
add esp, 4
test eax, eax
je 0x404bce
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x404bda
push esi
call dword [0x447004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405670
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405846
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x405846
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405846
cmp dword [ecx], 0
jne 0x405846
push edi
call fcn.0040c9b0
add esp, 4
mov ebx, 0x1505
test eax, eax
je 0x4056dd
xor ebp, ebp
nop
nop
nop
nop
movzx ecx, byte [edi + ebp]
test ecx, ecx
je 0x4056dd
mov edx, ebx
shl edx, 5
mov esi, edx
and esi, ebx
xor edx, ebx
add edx, ecx
lea ebx, [edx + esi*2]
inc ebp
cmp eax, ebp
jne 0x4056c0
mov ecx, dword [esp + 0x28]
mov esi, dword [ecx + 0x20]
test esi, esi
mov dword [esp], ebx
je 0x405786
mov dword [esp + 4], eax
lea edx, [esi - 1]
mov eax, ebx
not eax
mov dword [esp + 0xc], edx
or eax, edx
mov edx, dword [ecx + 4]
mov dword [esp + 8], edx
add ebx, eax
inc ebx
jmp 0x405714
inc ebx
dec esi
je 0x405786
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x40578b
mov eax, dword [ecx + 8]
mov edx, dword [esp]
cmp dword [eax + edi*4], edx
jne 0x405710
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.0040c9b0
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x405710
push dword [esp + 4]
push ebp
push dword [esp + 0x34]
call fcn.0040c9d0
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405710
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.00404790
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [ecx + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + edi*4], edx
mov edi, edx
jmp 0x405839
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
jb 0x4057d6
mov ecx, dword [esp + 0x28]
call fcn.00405910
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405846
push ebx
call fcn.0040c9b0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push esi
push dword [esp + 4]
push eax
call fcn.00405850
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040c9b0
add esp, 4
mov esi, ebx
mov ebx, eax
inc eax
push eax
call dword [0x447008]
add esp, 4
test eax, eax
je 0x405841
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c7a0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov esi, dword [esp]
mov dword [eax + ecx*4], esi
mov ecx, edx
inc dword [edx + 0x18]
mov eax, dword [ecx]
mov dword [edi], eax
xor eax, eax
jmp 0x405846
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret