joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4288ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4288bb
pop dword [ebp - 0x38]
mov eax, 0x28cb34ca
add eax, 0xd77753f1
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa9f2c4aa
add dword [ebp - 0x48], 0xa45f80a1
mov dword [ebp - 0x44], 0x808f1625
sub dword [ebp - 0x44], 0x4e5bc9e0
mov dword [ebp - 0x40], 0xbd5768cc
sub dword [ebp - 0x40], 0x710b249e
mov dword [ebp - 0x3c], 0x32394311
sub dword [ebp - 0x3c], 0x32394311
lea eax, [ebp - 0x48]
push eax
mov eax, 0xc53ea01c
sub eax, 0xc4fa0e08
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x2d7eca27
sub dword [ebp - 0x48], 0xb90c60d1
mov dword [ebp - 0x44], 0xecbdb150
add dword [ebp - 0x44], 0x54aeb025
mov dword [ebp - 0x40], 0x9bc7630d
add dword [ebp - 0x40], 0xc7a8095f
mov dword [ebp - 0x3c], 0x73165cf
add dword [ebp - 0x3c], 0xf8ce9a31
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xde2bdbb0
sub eax, 0xdde748b0
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x4c708
push 0
call eax
mov ecx, 0x7373179b
add ecx, 0x8c8d3ce5
mov ebx, eax
mov esi, 0x55548551
add esi, 0xaaf3aeaf
add esi, dword [ebp - 0x38]
mov edi, 0x26c9191
add edi, 0x5f36a474
sub dword [ebp - 8], edx
mov edx, dword [esi]
add dword [ebp - 0x34], 0xb4f71927
xor edx, edi
add dword [ebp - 0x30], 0xf93ed4b8
mov dword [ebx], edx
add ebx, 0xa71367f7
add ebx, 0x58ec980d
add esi, 0xd0f43e04
sub esi, 0xd0f43e00
loop 0x4289dd
add eax, 0xc8d8635e
sub eax, 0xc8d71e8b
xor ebx, ebx
add ebx, eax
add eax, 0x2ad85041
sub eax, 0x2ad8503c
mov ecx, 0x4522c917
sub ecx, 0x44e2c917
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret
Function at 0x4604b4
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push edi
push dword [0x1deddcc]
xor edi, edi
call fcn.0048244e
mov ebx, eax
cmp dword [esp + 0x10], edi
je 0x4605a8
push ebp
push esi
push 0x60
push 8
push dword [0x1debc34]
call dword [0x1de930c]
push dword [esp + 0x18]
mov esi, eax
xor ebp, ebp
inc ebp
or dword [esi + 4], 0xffffffff
mov dword [esi], ebp
call fcn.00440adf
mov dword [esi + 8], eax
mov dword [esp], str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
call fcn.00440adf
pop ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [ebx]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 4]
mov ebx, dword [esp + 0x20]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], eax
test cl, 1
je 0x460596
test ebx, ebx
je 0x460560
push ebx
push edi
push dword [0x1debc34]
call dword [0x1de930c]
mov dword [esi + 0x48], eax
test eax, eax
je 0x46055b
push ebx
push dword [esp + 0x20]
push eax
call fcn.00440a55
add esp, 0xc
cmp dword [esi + 0x48], edi
je 0x46058d
lea eax, [esp + 0x18]
push eax
push edi
push esi
push 0x4605af
push 0x10000
push edi
call dword [0x1de9304]
test eax, eax
je 0x460585
push eax
call dword [0x1de92c4]
jmp 0x460589
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x4605a4
push esi
call fcn.0045fffe
pop ecx
jmp 0x4605a6
mov eax, dword [esp + 0x1c]
push esi
mov dword [esi + 0x48], eax
call fcn.0046008f
pop ecx
mov edi, esi
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
ret 0x18
Function at 0x46ed40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x34
cdq
and edx, 0xf
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
lea edi, [edx + eax]
sar edi, 4
and ebp, 0x8000000f
jns 0x46ed6a
dec ebp
or ebp, 0xfffffff0
inc ebp
mov dword [esp + 0x1c], ebp
je 0x46ed7f
test edi, edi
jne 0x46ed7e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret
dec edi
mov eax, dword [esp + 0x58]
mov esi, dword [eax + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x4c], esi
mov esi, dword [eax + 0xc]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
test edi, edi
je 0x46ee12
mov ebp, dword [esp + 0x48]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x50], eax
push esi
push ebx
push dword [ebp + 4]
lea eax, [ebp + 0xf8]
push eax
call fcn.0046daa0
mov eax, dword [esp + 0x24]
add esp, 0x10
xor dword [esi], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
xor dword [esi + 8], eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x10]
xor dword [esi + 0xc], ecx
mov ecx, dword [ebx]
mov eax, dword [eax + esi + 8]
add esi, 0x10
mov edx, dword [ebx + 4]
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 0xc]
add ebx, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
dec edi
jne 0x46edb2
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
test ebp, ebp
je 0x46eeda
mov edi, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], eax
mov dword [ebp], edi
mov edi, ebp
mov dword [esp + 0x2c], ecx
mov dword [edi + 4], edx
lea edx, [esp + 0x34]
push edx
mov dword [edi + 0xc], eax
lea edx, [esp + 0x28]
mov eax, dword [esp + 0x4c]
push edx
mov dword [edi + 8], ecx
push dword [eax + 4]
lea ecx, [eax + 0xf8]
push ecx
mov dword [esp + 0x30], ecx
call fcn.0046daa0
mov ebp, dword [esp + 0x2c]
add esp, 0x10
test ebp, ebp
je 0x46ee9a
mov eax, esi
lea edi, [ebx + 0x10]
sub eax, ebx
lea edx, [esp + 0x34]
mov dword [esp + 0x50], eax
mov ebx, eax
mov al, byte [edi]
lea edi, [edi + 1]
mov cl, byte [edx]
lea edx, [edx + 1]
xor cl, al
mov byte [edx - 1], al
mov byte [ebx + edi - 1], cl
dec ebp
jne 0x46ee84
push esi
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x50]
push dword [eax + 4]
push dword [esp + 0x2c]
call fcn.0046daa0
mov eax, dword [esp + 0x24]
add esp, 0x10
xor dword [esi], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
xor dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
xor dword [esi + 0xc], ecx
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
pop edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
pop esi
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
pop ebp
mov dword [eax + 4], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x48]
pop ebx
add esp, 0x34
ret
Function at 0x47a315
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x47a329
mov esi, ebx
jmp 0x47a333
push 0
call dword [0x1de9690]
mov esi, eax
test esi, esi
je 0x47a424
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [0x1de96d0]
test eax, eax
je 0x47a419
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.00440010
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [0x1de96ec]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x47a418
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [0x1de9708]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x47a418
mov ebx, dword [esp + 0x10]
push 3
pop ebp
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
add eax, ecx
movzx ecx, byte [ebx]
add eax, ecx
cdq
idiv ebp
mov byte [ebx], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebx, dword [esp + 0x10]
add ebx, ebp
mov dword [esp + 0x10], ebx
dec edi
jne 0x47a3e1
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x47a424
push esi
call dword [0x1de967c]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x483bf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, edx
mov edx, dword [esp + 0x18]
push ebp
push esi
push edi
movzx esi, word [edx]
mov ebp, ecx
mov edi, dword [esp + 0x28]
mov eax, esi
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov ecx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [esp + 0x28], eax
movzx eax, word [edx + 0x10]
mov esi, dword [esp + 0x28]
shr eax, 4
mov dword [esp + 0x1c], ecx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x483c8a
lea ebx, [ebp + 4]
mov esi, edx
mov ebp, dword [esp + 0x14]
lea ebx, [ebx]
push edi
push ebx
push ecx
push esi
call fcn.00487960
push edi
lea eax, [ebx + 0x20]
push eax
push dword [esp + 0x30]
lea eax, [esi + 0x10]
push eax
call fcn.00487960
mov ecx, dword [esp + 0x3c]
add esp, 0x20
add ebx, 0x440
add esi, 0x20
dec ebp
jne 0x483c50
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
cmp ebx, 0x10
jbe 0x483d60
lea eax, [ebp + 0x44]
add ebx, 0xfffffff1
mov dword [esp + 0x18], eax
movzx eax, word [edx + 0x10]
xor eax, 0x7f0
shr ebx, 1
shr eax, 4
lea ebp, [ebx + 0x180]
add esi, dword [edi + eax*4]
lea ebp, [edx + ebp*2]
mov dword [esp + 0x28], esi
mov edi, edi
dec ebx
lea ebp, [ebp - 2]
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [esp + 0x24]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x483cd2
movzx ecx, word [ebp]
mov ebx, dword [esp + 0x1c]
mov eax, ecx
mov edx, dword [esp + 0x18]
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [esp + 0x28]
mov dword [edx + ebx*8 + 4], eax
test ebx, ebx
jne 0x483cc0
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ebx, [eax*4 - 0x40]
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x483d60
add esi, 0x484
lea edi, [eax - 1]
push ebx
push edx
push esi
call fcn.00440a55
mov edx, dword [esp + 0x24]
add esp, 0xc
add esi, 0x440
dec edi
jne 0x483d48
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x4af8f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x4af92b
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
lea ebx, [ebx]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0x1de7990]
mov dword [eax + 0x260], edx
dec esi
jne 0x4af910
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
dec ecx
je 0x4af9b2
dec ecx
je 0x4af997
dec ecx
je 0x4af98b
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov esi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
inc dword [eax + 0x44]
pop esi
pop ebx
ret
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7e0f1994
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x194b3a88
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x43121a
Function at 0x401e00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x401ef7
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x401ef7
push ebx
call fcn.00408a70
add esp, 4
test eax, eax
je 0x401e5a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x401e61
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x401e40
jmp 0x401e63
mov esi, 0x1505
jmp 0x401e63
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x401ef7
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x401e94
inc ebp
dec ebx
je 0x401ef5
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401ef5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401e90
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408a70
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x401e90
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408a90
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401e90
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edi*4]
jmp 0x401ef7
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401f10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x401ff7
test edx, edx
je 0x401ff7
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x401f5a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x401f61
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x401f40
jmp 0x401f63
mov esi, 0x1505
jmp 0x401f63
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x401ff7
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x401f94
inc ebx
dec ebp
je 0x401ff5
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401ff5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401f90
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408a70
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401f90
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408a90
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401f90
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x401ff7
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4024d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x4025d8
mov esi, edx
test edx, edx
je 0x4025d8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x4025d8
push esi
call fcn.00408a70
add esp, 4
test eax, eax
je 0x40252a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402531
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402510
jmp 0x402533
mov ebp, 0x1505
jmp 0x402533
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x4025e0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40259a
call fcn.004026d0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x4025d8
push ecx
call fcn.00408a70
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x40264f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4025f8
inc ebx
dec esi
je 0x40254f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402554
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4025f0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408a70
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4025f0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408a90
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4025f0
mov eax, 0xffffffff
jmp 0x4025d8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402668
inc ebx
dec esi
je 0x402595
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40259a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402660
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408a70
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402660
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408a90
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402660
jmp 0x40259a
Function at 0x402de0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x402f96
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x402f8f
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x402e73
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0x402f8f
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x402eed
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x402e90
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
mov dword [esp + 0x10], ebx
jbe 0x402e38
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0xc], eax
je 0x402f43
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x402f20
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x402e30
jmp 0x402f55
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x402e30
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x402f60
jmp 0x402e30
shl ecx, 0x10
or ecx, edi
jmp 0x402f9b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402fb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
not ecx
cmp ebx, 4
jb 0x403049
nop
nop
nop
nop
nop
nop
mov esi, ecx
shr esi, 8
movzx edx, byte [eax]
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
movzx ecx, cl
xor esi, dword [ecx*4 + 0x436928]
movzx ecx, byte [eax + 1]
mov edx, esi
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, esi
mov edi, ebx
mov ebx, esi
shr ebx, 8
mov edx, ecx
xor edx, 0x3fffff00
or ecx, 0xff
and ecx, edx
xor ebx, dword [ecx*4 + 0x436928]
mov edx, ebx
xor bl, byte [eax + 2]
shr edx, 8
movzx ecx, bl
mov ebx, edi
xor edx, dword [ecx*4 + 0x436928]
mov ecx, edx
xor dl, byte [eax + 3]
shr ecx, 8
movzx edx, dl
xor ecx, dword [edx*4 + 0x436928]
add eax, 4
add ebx, 0xfffffffc
cmp ebx, 3
ja 0x402fd0
test ebx, ebx
je 0x4030ae
test bl, 1
jne 0x40305b
mov esi, ebx
cmp ebx, 1
jne 0x403076
jmp 0x4030ae
movzx edx, byte [eax]
xor dl, cl
movzx edx, dl
lea esi, [ebx - 1]
inc eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x436928]
cmp ebx, 1
je 0x4030ae
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
xor bl, cl
movzx edi, bl
shr ecx, 8
xor ecx, dword [edi*4 + 0x436928]
movzx ebx, byte [eax + edx + 1]
xor bl, cl
movzx edi, bl
shr ecx, 8
xor ecx, dword [edi*4 + 0x436928]
add edx, 2
cmp esi, edx
jne 0x403080
lea eax, [ecx + ecx]
not eax
add eax, ecx
pop esi
pop edi
pop ebx
ret