joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c806f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c80a7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c60fc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c60d4
jmp 0x4c80b3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c9761
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c97a3
call fcn.004cf214
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c97a3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c979a
xor eax, eax
jmp 0x4c97ab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c97b1
pop edi
pop esi
pop ebx
ret 4

Function at 0x4cf744
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4cf772
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4cf790
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cf6aa
jmp 0x4cf790
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4cf790
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cf6aa
test edi, edi
mov eax, edi
jne 0x4cf77a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x676642
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.006766c1
jae 0x67664e
xor ecx, ecx
call fcn.006766c1
jae 0x676678
xor eax, eax
call fcn.006766c1
jae 0x676689
mov al, 0x10
call fcn.006766c1
adc al, al
jae 0x67666a
jne 0x6766b6
stosb byte es:[edi], al
jmp 0x67664f
call fcn.006766cd
dec ecx
loop 0x676695
mov eax, ebp
call fcn.006766cb
jmp 0x6766b7
lodsb al, byte [esi]
shr eax, 1
je 0x6766dd
adc ecx, 2
mov ebp, eax
jmp 0x6766b7
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.006766cb
cmp eax, 0x7d00
jae 0x6766b5
cmp eax, 0x500
jae 0x6766b6
cmp eax, 0x7f
ja 0x6766b7
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x67664f
pop ebp
ret 8
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x4098ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4098bb
pop dword [ebp - 0x40]
mov eax, 0x4098bb
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x37631
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x3fd5
xor edx, edx
add edx, eax
mov esi, 0x4d3ecc
sub esi, 0xbc6cc
add esi, dword [ebp - 0x40]
mov ebx, 0xa48c81e0
xor dword [ebp - 0x2c], 0xa663460f
mov edi, dword [esi]
add dword [ebp - 8], edi
add edi, ebx
add dword [ebp - 0x28], esi
mov dword [edx], edi
xor dword [ebp - 0x38], esi
add edx, 4
add esi, 0x817d7441
add esi, 0x7e828bc3
loop 0x409906
add eax, 0xf227
xor ebx, ebx
add ebx, eax
add eax, 0xccd10e36
add eax, 0x332ef1cf
mov ecx, 0xd96f8460
add ecx, 0x26d07ba0
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401250
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426305
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x432008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x435b68
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x435b58
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0
push 0x1000
push 0x1000
push 1
push 1
push 3
push str..pipe_vortextestframework
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [0x435b60], eax
cmp eax, 0xffffffff
jne 0x401413
push 0x13
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x40]
push str.Failed_to_open_pipe
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.004014b0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea esi, [ebp - 0x13]
mov eax, 0xcccccccd
dec esi
mul ebx
shr edx, 3
mov al, dl
shl al, 2
lea ecx, [eax + edx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [esi], bl
mov ebx, edx
test ebx, ebx
jne 0x4012f8
lea eax, [ebp - 0x13]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x4c], ebx
mov edi, 0xf
mov dword [ebp - 0x48], edi
mov byte [ebp - 0x5c], bl
cmp esi, eax
je 0x401344
sub eax, esi
lea ecx, [ebp - 0x5c]
push eax
push esi
call fcn.004014b0
mov edi, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x4c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
mov esi, dword [ebp - 0x2c]
cmp edi, 0x10
mov edx, dword [ebp - 0x30]
mov eax, esi
cmovae ecx, dword [ebp - 0x5c]
sub eax, edx
push ebx
push ecx
cmp ebx, eax
ja 0x401384
lea eax, [edx + ebx]
cmp esi, 0x10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
lea esi, [eax + edx]
push esi
call fcn.00416e60
add esp, 0xc
mov byte [esi + ebx], 0
jmp 0x401397
mov byte [ebp - 0x44], 0
lea ecx, [ebp - 0x40]
push dword [ebp - 0x44]
push ebx
call fcn.004015f0
mov edi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
cmp edi, 0x10
jb 0x4013c8
inc edi
mov eax, ecx
cmp edi, 0x1000
jb 0x4013be
mov ecx, dword [eax - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401450
push edi
push ecx
call fcn.00414429
add esp, 8
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push 0x42cc08
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x401413
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401409
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401450
push ecx
push edx
call fcn.00414429
add esp, 8
push 0
push str.VWINDOW
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401434
push 0
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret
call fcn.004193e2
int3
Function at 0x401750
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x432008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp esi, eax
je 0x40177f
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x401774
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, esi
call fcn.004014b0
mov byte [esi + 0x1c], 0
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x40178d
mov eax, dword [esi]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x401809
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 2
jne 0x4017e5
cmp dword [esi + 0x14], 0x10
jb 0x4017c3
mov esi, dword [esi]
mov eax, str.ERROR:_Handle_was_not_attached._Reason:__s_not_available._n
push esi
push eax
call fcn.004010c0
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret 4
mov esi, ecx
mov eax, str.ERROR:__u_n
push esi
push eax
call fcn.004010c0
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
push ecx
push eax
movups xmmword [ebp - 0x24], xmm0
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetCommState]
test eax, eax
jne 0x40184b
push str.failed_to_get_current_serial_parameters_
call fcn.004010c0
add esp, 4
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x1c]
and eax, 0xffffffdf
mov dword [ebp - 0x20], 0x2580
or eax, 0x10
mov word [ebp - 0x12], 8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x18]
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
test eax, eax
jne 0x401899
push str.ALERT:_Could_not_set_Serial_Port_parameters
call fcn.004010c0
add esp, 4
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret 4
push 0xc
push dword [esi + 0x18]
mov byte [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004143eb
mov esp, ebp
pop ebp
ret 4
Function at 0x4019b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42634b
mov eax, dword fs:[0]
push eax
mov eax, 0x2054
call fcn.00425a80
mov eax, dword [0x432008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4339f0]
cmp byte [eax + 0x12a], 0
je 0x401c0d
mov eax, 0x2714
cmp word [ebp + 8], ax
jne 0x401c0d
push 0x30
lea eax, [ebp - 0x2048]
push 0
push eax
call fcn.004159c0
xorps xmm0, xmm0
mov dword [ebp - 0x2048], 0
add esp, 0xc
mov dword [ebp - 0x2038], 0
mov dword [ebp - 0x2034], 0xf
mov byte [ebp - 0x2048], 0
mov dword [ebp - 0x2030], 0
mov byte [ebp - 0x202c], 0
movq qword [ebp - 0x2028], xmm0
mov dword [ebp - 0x2020], 0
mov dword [ebp - 0x201c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2060]
push 8
mov dword [ebp - 0x2060], 0
push str..COM8
mov dword [ebp - 0x2050], 0
mov dword [ebp - 0x204c], 0xf
mov byte [ebp - 0x2060], 0
call fcn.004014b0
lea eax, [ebp - 0x2060]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2048]
call fcn.00401750
mov ecx, dword [ebp - 0x204c]
cmp ecx, 0x10
jb 0x401af7
mov edx, dword [ebp - 0x2060]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401aed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c29
push ecx
push edx
call fcn.00414429
add esp, 8
cmp byte [ebp - 0x202c], 0
je 0x401b0d
push str.Were_connected_n
call fcn.004010c0
add esp, 4
push 0x2000
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.004159c0
add esp, 0xc
mov dword [ebp - 0x2014], 0
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x201c]
push eax
push dword [ebp - 0x2030]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 0x2024]
test eax, eax
je 0x401b84
mov ecx, 4
cmp eax, ecx
push 0
cmova eax, ecx
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2030]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401b84
mov eax, dword [ebp - 0x2018]
jmp 0x401b86
xor eax, eax
push dword [ebp - 0x2014]
push eax
push str.Read__d_length:__u_n
call fcn.004010c0
mov edi, dword [ebp - 0x2014]
lea eax, [ebp - 0x2028]
add esp, 0xc
push eax
lea eax, [ebp - 0x201c]
push eax
push dword [ebp - 0x2030]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 0x2024]
test eax, eax
je 0x401bf2
push 0
cmp eax, edi
lea ecx, [ebp - 0x2018]
push ecx
cmova eax, edi
push eax
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x2030]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401bf2
mov eax, dword [ebp - 0x2018]
jmp 0x401bf4
xor eax, eax
push eax
push str.read:__d_n
call fcn.004010c0
add esp, 8
lea ecx, [ebp - 0x2048]
call fcn.004018d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret 8
call fcn.004193e2
int3
Function at 0x409610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4264bd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x432008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push 0
movq qword [ebp - 0x1c], xmm0
lea ecx, [ebp - 0x1c]
push 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.00411e20
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.004092d0
mov esi, dword [ebp - 0x1c]
test al, al
je 0x4096dc
test esi, esi
je 0x409693
mov eax, dword [esi]
cmp eax, 0x2000
ja 0x4096dc
lea ebx, [eax + 0xc]
jmp 0x409695
xor ebx, ebx
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push str.FlashStorage.flash
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x4096d5
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
mov bl, 1
jmp 0x4096de
xor bl, bl
test esi, esi
je 0x4096eb
push esi
call fcn.0041943e
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret
Function at 0x411da0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x411db4
mov al, 1
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ecx]
xor edx, edx
mov esi, 0x1505
test edi, edi
je 0x411ddd
push ebx
lea ebx, [ecx + 0xc]
movzx ecx, byte [ebx + edx]
mov eax, esi
shl eax, 5
inc edx
add esi, eax
add esi, ecx
cmp edx, edi
jb 0x411dc7
mov eax, dword [ebp - 4]
pop ebx
cmp eax, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x411e20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
test eax, eax
je 0x411e3c
push eax
call fcn.0041943e
add esp, 4
mov dword [esi], 0
mov edi, dword [ebp + 8]
mov dword [esi + 8], 0
mov dword [esi + 4], 0
test edi, edi
je 0x411eaf
mov ecx, edi
xor eax, eax
and ecx, 0xfffffffc
add ecx, 4
mov dword [esi + 8], ecx
add ecx, 0xc
setb al
neg eax
or eax, ecx
push eax
push 1
call fcn.00419433
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x411e84
mov dword [esi + 8], eax
xor al, al
pop edi
pop esi
pop ebp
ret 8
mov dword [eax], 0
mov eax, dword [esi]
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax + 8], 0
push dword [esi + 8]
mov eax, dword [esi]
add eax, 0xc
push 0
push eax
call fcn.004159c0
add esp, 0xc
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x411ef7
mov ecx, dword [esi]
test ecx, ecx
je 0x411ef7
push ebx
push edi
push eax
lea eax, [ecx + 0xc]
push eax
call fcn.00416e60
mov eax, dword [esi]
add esp, 0xc
xor edx, edx
mov dword [eax], edi
mov ebx, dword [esi]
mov esi, 0x1505
mov edi, dword [ebx]
test edi, edi
je 0x411ef3
nop
movzx ecx, byte [ebx + edx + 0xc]
mov eax, esi
shl eax, 5
inc edx
add esi, eax
add esi, ecx
cmp edx, edi
jb 0x411ee0
mov dword [ebx + 8], esi
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 8
Function at 0x411f00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x432008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], edi
cmp dword [edi], 0
jne 0x411f30
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret
push ecx
call fcn.00412220
mov ecx, dword [edi]
test ecx, ecx
je 0x411f55
test byte [ecx + 4], 1
je 0x411f55
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ecx]
cmp ecx, 0x7e000000
jbe 0x411f63
xor eax, eax
jmp 0x411f7b
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, 0x10
add eax, edx
add eax, ecx
push 0
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00411e20
mov ebx, dword [edi]
push 0x420
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
call fcn.00419464
mov esi, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x41207f
push ecx
push dword [ebp - 8]
lea ecx, [esi + 0xc]
push dword [ebp - 0x18]
lea edx, [ebx + 0xc]
push ecx
mov ecx, eax
call fcn.00412c20
push dword [ebp - 0x1c]
mov ebx, eax
call fcn.0041943e
add esp, 0x14
test ebx, ebx
jns 0x411fea
xor bl, bl
jmp 0x412081
je 0x41207f
mov eax, dword [edi]
cmp ebx, dword [eax]
jae 0x41207f
mov dword [esi], ebx
xor edx, edx
mov eax, dword [edi]
mov ebx, 0x1505
mov eax, dword [eax + 4]
or eax, 1
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x41202e
mov edi, ecx
movzx ecx, byte [esi + edx + 0xc]
mov eax, ebx
shl eax, 5
inc edx
add ebx, eax
add ebx, ecx
cmp edx, edi
jb 0x412016
mov edi, dword [ebp - 0x20]
mov ecx, dword [esi]
mov dword [esi + 8], ebx
mov ebx, dword [ebp - 8]
cmp ecx, ebx
je 0x412055
xor eax, eax
mov ebx, ecx
add ecx, 0xc
setb al
neg eax
or eax, ecx
push eax
push esi
call fcn.00419459
add esp, 8
test eax, eax
cmovne esi, eax
test esi, esi
je 0x41205e
lea eax, [esi + 0xc]
jmp 0x412060
xor eax, eax
push eax
push ebx
mov ecx, edi
call fcn.00411e20
mov ecx, dword [edi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edi]
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ecx, dword [edi]
mov eax, dword [esi]
mov dword [ecx], eax
mov bl, 1
test esi, esi
je 0x41208e
push esi
call fcn.0041943e
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004143eb
mov esp, ebp
pop ebp
ret
Function at 0x4120b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x432008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x18], ebx
mov esi, dword [ebx]
test esi, esi
je 0x412203
mov ecx, esi
call fcn.00411da0
test al, al
je 0x412203
test byte [esi + 4], 1
jne 0x4120f8
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov edi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00411e20
nop
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
add edi, edi
push 0
mov eax, dword [eax]
imul eax, edi
push eax
call fcn.00411e20
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebx]
push 0
push 0
lea eax, [esi + 0xc]
push eax
push 0
push 0
push 1
push dword [ebp - 8]
mov edx, eax
push dword [ecx]
add ecx, 0xc
call fcn.00412d20
add esp, 0x20
test eax, eax
jns 0x412165
cmp edi, 0xff
jb 0x412120
mov dword [esi], eax
xor edx, edx
mov eax, dword [ebx]
mov edi, 0x1505
mov eax, dword [eax + 4]
and eax, 0xfffffffe
mov dword [esi + 4], eax
mov ebx, dword [esi]
test ebx, ebx
je 0x412193
nop
movzx ecx, byte [esi + edx + 0xc]
mov eax, edi
shl eax, 5
inc edx
add edi, eax
add edi, ecx
cmp edx, ebx
jb 0x412180
mov dword [esi + 8], edi
mov edi, dword [ebp - 8]
cmp ebx, edi
je 0x4121ba
xor eax, eax
mov edi, ebx
add ebx, 0xc
setb al
neg eax
or eax, ebx
push eax
push esi
call fcn.00419459
add esp, 8
test eax, eax
cmovne esi, eax
test esi, esi
je 0x4121c3
lea eax, [esi + 0xc]
jmp 0x4121c5
xor eax, eax
push eax
push edi
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00411e20
mov ecx, dword [edi]
mov eax, dword [esi + 4]
push esi
mov dword [ecx + 4], eax
mov ecx, dword [edi]
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ecx, dword [edi]
mov eax, dword [esi]
mov dword [ecx], eax
call fcn.0041943e
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004143eb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.004143eb
mov esp, ebp
pop ebp
ret

Function at 0x412220
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push edi
mov dword [ebp - 4], eax
mov edi, dword [eax]
test edi, edi
je 0x412271
push ebx
mov ebx, dword [edi]
test ebx, ebx
je 0x412270
test byte [edi + 4], 2
je 0x412270
xor edx, edx
push esi
mov esi, 0x1505
test ebx, ebx
je 0x412266
nop dword [eax]
movzx ecx, byte [edi + edx + 0xc]
mov eax, esi
shl eax, 5
inc edx
add esi, eax
add esi, ecx
cmp edx, ebx
jb 0x412250
mov eax, dword [ebp - 4]
mov dword [edi + 8], esi
mov eax, dword [eax]
pop esi
and dword [eax + 4], 0xfffffffd
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4132f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x824
mov eax, dword [0x432008]
xor eax, esp
mov dword [esp + 0x820], eax
cmp byte [0x433a07], 0
push ebx
push esi
push edi
je 0x413400
push 0x800
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004159c0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0x34]
push 0x800
push eax
call fcn.00401080
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00419202
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0
add esp, 0x1c
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413376
sub ecx, edx
lea eax, [esp + 0x28]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.004014b0
cmp dword [esp + 0x24], 0x10
lea ebx, [esp + 0x10]
mov edi, dword [esp + 0x20]
cmovae ebx, dword [esp + 0x10]
xor esi, esi
mov dword [esp + 0xc], esi
push 0
lea eax, [esp + 0x10]
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [0x435b60]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4133ce
add esi, dword [esp + 0xc]
cmp esi, edi
jb 0x4133a6
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
jb 0x413400
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4133f6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413415
push ecx
push edx
call fcn.00414429
add esp, 8
mov ecx, dword [esp + 0x82c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004143eb
mov esp, ebp
pop ebp
ret
call fcn.004193e2
int3