joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cd7b
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x47a88c
call fcn.004492cf
mov eax, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
mov edx, 0x4947d0
mov ecx, eax
call fcn.0043fb0d
mov esi, eax
mov ecx, esi
call fcn.0043deca
pop ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push 0x100001
mov ecx, eax
call fcn.0042597a
push esi
mov ebx, 0x100000
push ebx
push 1
push dword [ebp - 0x28]
call fcn.00458369
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, ebx
ja 0x43ce56
push esi
call fcn.0045c9c1
pop ecx
test eax, eax
je 0x43cdfb
push 0x133
jmp 0x43ce5b
push esi
call fcn.0045c995
pop ecx
test eax, eax
jne 0x43ce0d
push 0x13b
jmp 0x43ce5b
mov ebx, dword [ebp - 0x28]
mov ecx, ebx
mov edx, dword [ebp - 0x10]
call fcn.0043cd47
mov ecx, dword [ebp - 0x10]
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebx + ecx]
cmp ebx, eax
je 0x43ce3b
push ecx
push ebx
mov ecx, edi
call fcn.00404a74
lea ecx, [ebp - 0x28]
call fcn.0040c077
test esi, esi
je 0x43ce4e
push esi
call fcn.0045745f
pop ecx
mov eax, edi
call fcn.00449298
ret
push 0xc8
lea ecx, [ebp - 0x38]
call fcn.0041251e
push 0x4a6034
lea eax, [ebp - 0x38]
push eax
call fcn.0044c6b7
int3
Function at 0x43dcd9
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x80]
sub esp, 0x80
push 0xffffffffffffffff
push 0x47ab59
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4a9068]
xor eax, ebp
mov dword [ebp + 0x7c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ecx + 0x30], 0
je 0x43de5e
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov dword [ebp - 4], eax
call fcn.0043d792
mov edi, dword [ebp - 0x14]
mov eax, edi
mov ebx, dword [ebp - 0x18]
sub eax, ebx
push 0x18
cdq
pop ecx
idiv ecx
imul esi, eax, 0x18
add esi, ebx
jmp 0x43dd4f
push esi
lea ecx, [esi - 0x18]
call fcn.00403dcf
add esi, 0x18
cmp esi, edi
jne 0x43dd43
add edi, 0xffffffe8
mov ecx, edi
call fcn.004049ff
mov dword [ebp - 0x14], edi
cmp ebx, edi
je 0x43de39
and dword [ebp + 0x74], 0
lea ecx, [ebp + 0x64]
and dword [ebp + 0x78], 0
lea esi, [ebx + 0x18]
push ebx
call fcn.00404b71
mov byte [ebp - 4], 1
jmp 0x43de29
push esi
mov edx, 0x48e7f4
lea ecx, [ebp + 0x18]
call fcn.00409fe9
pop ecx
mov byte [ebp - 4], 2
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x43dda2
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp + 0x64]
call fcn.00404b18
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 1
call fcn.004049ff
lea eax, [ebp + 0x64]
push eax
lea ecx, [ebp + 0x30]
call fcn.0043d682
mov byte [ebp - 4], 3
lea ecx, [ebp]
cmp dword [ebp + 0x5c], 8
lea eax, [ebp + 0x48]
push ecx
cmovae eax, dword [ebp + 0x48]
push eax
call fcn.0045d9ce
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x43de12
cmp dword [ebp + 0x5c], 8
lea eax, [ebp + 0x48]
cmovae eax, dword [ebp + 0x48]
push eax
call fcn.0045cf96
pop ecx
cmp eax, 0xffffffff
jne 0x43de12
call fcn.004521e1
push 0x137
push 0x11
pop ecx
mov edx, dword [eax]
call fcn.0043c677
pop ecx
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 1
call fcn.004049d1
lea ecx, [ebp + 0x30]
call fcn.004049ff
add esi, 0x18
cmp esi, edi
jne 0x43dd85
lea ecx, [ebp + 0x64]
call fcn.004049ff
lea ecx, [ebp - 0x18]
call fcn.00413ab1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7c]
xor ecx, ebp
call fcn.004489ea
sub ebp, 0xffffff80
leave
ret
push str.canonicalized_file_name_expected
lea ecx, [ebp - 0x18]
call fcn.004180c1
push 0x4a6070
lea eax, [ebp - 0x18]
push eax
call fcn.0044c6b7
int3
Function at 0x4401b5
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x47b038
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4a9068]
xor eax, ebp
mov dword [ebp + 0x238], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [ebp + 0x30]
mov dword [ebp - 0x10], edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x44028f
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp]
call fcn.0041d2ed
mov esi, eax
mov dword [ebp - 4], ebx
mov ebx, str.OracleJavajava.settings.cfg
push ebx
call fcn.00452316
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.004270e9
xor ecx, ecx
mov byte [ebp - 0x10], cl
push dword [ebp - 0x10]
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
lea ecx, [ebp + 0x18]
push eax
call fcn.0041d3c6
lea edx, [ebp + 0x18]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.0043f8f5
lea ecx, [ebp + 0x18]
call fcn.004049d1
lea ecx, [ebp]
call fcn.004049d1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.004489ea
add ebp, 0x23c
leave
ret
push 0xc8
lea ecx, [ebp - 0x20]
call fcn.0041251e
push 0x4a6034
lea eax, [ebp - 0x20]
push eax
call fcn.0044c6b7
int3

Function at 0x442cb1
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x24]
mov ebp, SysReAllocString
test edi, edi
jl 0x442d34
jg 0x442cdd
test esi, esi
je 0x442d34
test edi, edi
jg 0x442cdd
jl 0x442cd9
cmp esi, ebp
jae 0x442cdd
mov eax, esi
jmp 0x442cdf
mov eax, ebp
and dword [esp + 0x20], 0
cmp dword [esp + 0x18], 0xffffffff
je 0x442d25
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x442d0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x442d2f
jmp 0x442d25
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x442d20
add ebx, eax
cdq
sub esi, eax
sbb edi, edx
jmp 0x442cc5
cmp eax, 0xffffffff
jne 0x442d2f
call fcn.004521e1
cmp dword [eax], 4
je 0x442cc5
or eax, 0xffffffff
jmp 0x442d36
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x465f76
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00465dec

Function at 0x468a7c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004689fe
Function at 0x4025f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x4026d7
test edx, edx
je 0x4026d7
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x40263a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402641
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402620
jmp 0x402643
mov esi, 0x1505
jmp 0x402643
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x4026d7
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402674
inc ebx
dec ebp
je 0x4026d5
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4026d5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402670
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00409470
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402670
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004094a0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402670
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4026d7
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4026e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x4027e9
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4027e9
push ebx
call fcn.00409470
add esp, 4
test eax, eax
je 0x40273a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402741
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402720
jmp 0x402743
mov esi, 0x1505
jmp 0x402743
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x4027e9
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402774
inc ebp
dec ebx
je 0x4027e7
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4027e7
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402770
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409470
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402770
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.004094a0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402770
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4027e7
cmp dword [eax + 4], 2
mov edi, 0
jne 0x4027e9
mov edi, dword [eax + 8]
jmp 0x4027e9
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402820
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x402888
mov esi, dword [esp + 0x30]
test esi, esi
je 0x402888
push esi
call fcn.00409470
add esp, 4
test eax, eax
je 0x40286a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402871
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402850
jmp 0x402873
mov ebp, 0x1505
jmp 0x402873
mov ebp, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov edx, edi
sub edx, 1
jae 0x402894
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x4028b4
inc ebx
dec edi
je 0x402888
mov eax, ebx
and eax, edx
mov esi, dword [esp + 0xc]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
je 0x402888
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x4028b0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409470
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4028b0
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x38]
call fcn.004094a0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4028b0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x402888
cmp dword [eax + 4], 3
jne 0x402888
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x402888
Function at 0x402960
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402a69
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402a69
push ebx
call fcn.00409470
add esp, 4
test eax, eax
je 0x4029ba
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4029c1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4029a0
jmp 0x4029c3
mov esi, 0x1505
jmp 0x4029c3
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402a69
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x4029f4
inc ebp
dec ebx
je 0x402a67
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402a67
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4029f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409470
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4029f0
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.004094a0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4029f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402a67
cmp dword [eax + 4], 5
mov edi, 0
jne 0x402a69
mov edi, dword [eax + 8]
jmp 0x402a69
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402aa0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x402bac
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402bac
push ebx
call fcn.00409470
add esp, 4
test eax, eax
je 0x402afa
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402b01
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402ae0
jmp 0x402b03
mov esi, 0x1505
jmp 0x402b03
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402bac
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402b34
inc ebp
dec ebx
je 0x402ba7
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402ba7
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402b30
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409470
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402b30
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.004094a0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402b30
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402ba7
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x402bac
mov edi, dword [eax + 8]
jmp 0x402bac
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402bc0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push 0x2e
push edi
call fcn.004094f0
add esp, 8
test eax, eax
je 0x402c26
mov ebx, eax
jmp 0x402c04
mov edi, ebx
inc edi
push 0x2e
push edi
call fcn.004094f0
add esp, 8
mov ebx, eax
test eax, eax
je 0x402c26
mov eax, ebx
sub eax, edi
mov ecx, esi
mov edx, edi
push eax
call fcn.004025f0
add esp, 4
xor esi, esi
test eax, eax
je 0x402bf0
cmp dword [eax + 4], 4
jne 0x402bf0
mov esi, dword [eax + 8]
jmp 0x402bf0
xor eax, eax
test esi, esi
je 0x402c86
test edi, edi
je 0x402c86
push edi
call fcn.00409470
add esp, 4
test eax, eax
je 0x402c6a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ebp]
test edx, edx
je 0x402c71
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc ebp
mov ecx, ebx
cmp eax, ebp
jne 0x402c50
jmp 0x402c73
mov ebx, 0x1505
jmp 0x402c73
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esi + 0x20]
lea ebp, [ecx - 1]
mov edx, ecx
sub edx, 1
jae 0x402c8e
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov dword [esp], esi
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 4], edx
jmp 0x402ca4
inc ebp
dec ecx
je 0x402c84
mov eax, ebp
and eax, edx
mov esi, dword [esp + 0x14]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
je 0x402c84
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + esi*4], ebx
jne 0x402ca0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 0x10], ecx
call fcn.00409470
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
add esp, 4
cmp eax, dword [esp + 8]
jne 0x402ca0
push dword [esp + 8]
push dword [esp + 0x14]
push edi
call fcn.004094a0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x402ca0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + esi*4]
jmp 0x402c86
Function at 0x402db0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x402e1d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x402e1d
push esi
call fcn.00409470
add esp, 4
test eax, eax
je 0x402dfa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x402e01
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x402de0
jmp 0x402e03
mov ebx, 0x1505
jmp 0x402e03
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x402e25
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x402e34
inc ebp
dec edi
je 0x402e1b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x402e1b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x402e30
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409470
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402e30
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.004094a0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402e30
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x402e1d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x402e1d
Function at 0x403040
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x403148
mov esi, edx
test edx, edx
je 0x403148
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x403148
push esi
call fcn.00409470
add esp, 4
test eax, eax
je 0x40309a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4030a1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x403080
jmp 0x4030a3
mov ebp, 0x1505
jmp 0x4030a3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x403150
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40310a
call fcn.00403240
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x403148
push ecx
call fcn.00409470
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x4031bf
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403168
inc ebx
dec esi
je 0x4030bf
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x4030c4
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403160
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00409470
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403160
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.004094a0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403160
mov eax, 0xffffffff
jmp 0x403148
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4031d8
inc ebx
dec esi
je 0x403105
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40310a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4031d0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00409470
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4031d0
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.004094a0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4031d0
jmp 0x40310a
Function at 0x403990
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403b36
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x403b2f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x403a21
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 0xc]
mov eax, 0x15b0
je 0x403b2f
xor edx, edx
cmp eax, 8
mov dword [esp + 8], esi
jb 0x403a9c
mov edx, eax
and edx, 0x1ff8
mov dword [esp], edx
mov edx, 7
nop
nop
nop
nop
mov ebx, eax
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 5]
mov edi, eax
and edi, esi
xor eax, esi
lea eax, [eax + edi*2]
add ecx, eax
movzx esi, byte [ebp + 6]
add esi, eax
mov eax, ebx
add ecx, esi
movzx edi, byte [ebp + 7]
add edi, esi
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x403a40
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov ebx, eax
sub ebx, edx
mov dword [esp + 0xc], eax
jbe 0x4039e8
mov dword [esp], edx
not edx
add edx, eax
mov dword [esp + 4], edx
mov edx, eax
and edx, 3
mov dword [esp + 0x10], ebx
je 0x403ae4
neg edx
xor eax, eax
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx]
inc ebx
add edi, esi
add ecx, edi
dec eax
cmp edx, eax
jne 0x403ad0
mov edx, dword [esp]
sub edx, eax
jmp 0x403ae9
mov ebx, ebp
mov edx, dword [esp]
mov eax, dword [esp + 4]
cmp eax, 3
jb 0x4039e0
mov eax, dword [esp + 0xc]
sub eax, edx
xor edx, edx
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403b00
jmp 0x4039e0
shl ecx, 0x10
or ecx, edi
jmp 0x403b3b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret