joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f1a
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push dword [esp + 0x10]
call fcn.0040323f
movzx eax, ax
pop ecx
test ax, ax
jns 0x402f37
or eax, 0xffffffff
jmp 0x403012
push ebx
push ebp
push esi
push edi
push 2
xor edi, edi
movsx ebp, ax
push edi
push ebp
call fcn.00416cd6
push 0x4aa814
mov esi, eax
call fcn.004161cb
xor edx, edx
push edi
push edi
lea ebx, [eax + 1]
mov eax, esi
mov ecx, ebx
shl ecx, 2
div ecx
push ebp
inc eax
mov dword [esp + 0x34], eax
call fcn.00416cd6
push 4
pop esi
push esi
push 0x44005c
push ebp
mov dword [esp + 0x3c], esi
call fcn.00416e6c
add esp, 0x28
mov word [0x49c242], ax
cmp ax, si
je 0x402f96
push 0xfffffffffffffffd
pop eax
jmp 0x40300e
mov esi, dword [esp + 0x24]
xor eax, eax
mov ecx, dword [esp + 0x28]
inc eax
test esi, esi
cmove esi, eax
mov eax, dword [0x44005c]
test ecx, ecx
cmove ecx, eax
push ecx
push eax
call fcn.00404e49
pop ecx
pop ecx
mov edi, eax
mov ecx, edi
imul ecx, ebx
push 0
add ecx, esi
shl ecx, 2
push ecx
push ebp
call fcn.00416cd6
push 4
pop eax
push eax
lea eax, [esp + 0x20]
push eax
push ebp
call fcn.00416e6c
mov ecx, dword [esp + 0x28]
xor edx, edx
add esp, 0x18
mov word [0x49c242], ax
cmp ax, word [esp + 0x14]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
cmp edi, dword [esp + 0x18]
jge 0x403001
inc edi
jmp 0x403004
xor edi, edi
inc esi
test ecx, ecx
jne 0x40300c
cmp esi, ebx
jl 0x402fbb
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x403016
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push dword [esp + 0x10]
call fcn.0040323f
movzx eax, ax
pop ecx
test ax, ax
jns 0x403033
or eax, 0xffffffff
jmp 0x40311f
push ebx
push ebp
push esi
xor esi, esi
movsx ebx, ax
push esi
push esi
push ebx
call fcn.00416cd6
push 4
pop ebp
push ebp
push 0x44005c
push ebx
mov dword [esp + 0x2c], ebp
call fcn.00416e6c
add esp, 0x18
mov word [0x49c242], ax
cmp ax, bp
je 0x40306c
push 0xfffffffffffffffd
pop eax
jmp 0x40311c
push edi
push 0x4aa814
call fcn.004161cb
push 2
push esi
push ebx
lea ebp, [eax + 1]
mov dword [esp + 0x24], ebp
call fcn.00416cd6
mov ecx, ebp
mov edi, dword [esp + 0x34]
shl ecx, 2
xor edx, edx
div ecx
add esp, 0x10
mov ebp, eax
test edi, edi
je 0x4030b7
cmp dword [esp + 0x28], esi
je 0x4030b7
push dword [esp + 0x28]
push dword [0x44005c]
call fcn.00404e49
pop ecx
mov esi, eax
jmp 0x4030c6
push 0x4aa814
call fcn.004161cb
mov edi, eax
lea esi, [ebp + 1]
pop ecx
mov ecx, esi
imul ecx, dword [esp + 0x14]
push 0
add ecx, edi
shl ecx, 2
push ecx
push ebx
call fcn.00416cd6
push 4
pop eax
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.00416e6c
mov ecx, dword [esp + 0x28]
xor edx, edx
add esp, 0x18
mov word [0x49c242], ax
cmp ax, word [esp + 0x18]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
test esi, esi
jle 0x40310d
dec esi
jmp 0x403111
lea esi, [ebp + 1]
dec edi
test ecx, ecx
jne 0x403119
test edi, edi
jg 0x4030c7
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x403123
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push 0x42b098
push dword [eax*4 + 0x440060]
call fcn.0040de24
movzx eax, ax
pop ecx
pop ecx
test ax, ax
jns 0x403146
or eax, 0xffffffff
ret
push ebx
push esi
push 0
movsx esi, ax
push 0
push esi
call fcn.00416cd6
push 4
pop ebx
push ebx
push 0x44005c
push esi
call fcn.00416e6c
add esp, 0x18
mov word [0x49c242], ax
cmp ax, bx
je 0x40317a
push 0xfffffffffffffffd
pop eax
jmp 0x40323c
push ebp
push edi
push 0x4aa814
call fcn.004161cb
mov ebx, dword [esp + 0x1c]
pop ecx
lea ebp, [eax + 1]
test ebx, ebx
je 0x40319a
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x4031ad
push 1
push dword [0x44005c]
call fcn.00404b3e
pop ecx
pop ecx
mov edi, eax
xor ebx, ebx
push 2
push 0
push esi
call fcn.00416cd6
push edi
push dword [0x44005c]
mov dword [esp + 0x28], eax
call fcn.00404e49
mov edi, eax
add esp, 0x14
mov eax, dword [esp + 0x14]
imul edi, ebp
add edi, ebx
shl edi, 2
cmp edi, eax
jle 0x40320c
mov ebx, edi
sub ebx, eax
push ebx
call fcn.00419225
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x4031f2
push 0xfffffffffffffffa
pop eax
jmp 0x40323a
push ebx
push 0
push ebp
call fcn.00415f20
push ebx
push ebp
push esi
call fcn.00419348
push ebp
call fcn.004191ed
add esp, 0x1c
push 0
push edi
push esi
call fcn.00416cd6
push 4
pop edi
push edi
lea eax, [esp + 0x30]
push eax
push esi
call fcn.00419348
add esp, 0x18
mov word [0x49c242], ax
xor edx, edx
cmp ax, di
push 0xfffffffffffffffd
pop ecx
cmove ecx, edx
mov eax, ecx
pop edi
pop ebp
pop esi
pop ebx
ret
Function at 0x40ff0c
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x23c
mov eax, dword [0x452cb0]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [esp + 0x244]
push ebx
push ebp
mov ebp, dword [esp + 0x248]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x254]
push edi
push 0x103
mov dword [esp + 0x20], eax
lea eax, [esp + 0x149]
push ebx
push eax
mov byte [esp + 0x150], bl
call fcn.00415f20
add esp, 0xc
mov dword [esp + 0x18], 0x104
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x44]
push eax
push ebx
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x16c]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push 0x42928d
push esi
mov edi, ebx
call fcn.00415fb0
pop ecx
pop ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x7d
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x18], 0x7d
push eax
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xd8]
push eax
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push dword [esp + 0x1c]
mov ebx, eax
inc edi
lea eax, [esp + 0xc8]
push eax
call fcn.004160b0
pop ecx
pop ecx
test eax, eax
jne 0x41000c
push 0x100
push esi
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
test ebx, ebx
pop ebx
je 0x40ffb0
mov ecx, dword [esp + 0x248]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004161e8
add esp, 0x23c
ret

Function at 0x41033b
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, 0x454ed8
push edi
xor edi, edi
test esi, esi
je 0x41035a
push ebx
push esi
call fcn.004160b0
pop ecx
pop ecx
test eax, eax
je 0x410391
mov eax, dword [0x454ed4]
test eax, eax
je 0x410370
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x454ed4], edi
test esi, esi
je 0x4103ec
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x454ed4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push ebx
call fcn.00415fb0
pop ecx
pop ecx
mov eax, dword [esp + 0x14]
cmp eax, 2
jne 0x4103b1
push 0xffffffffffffffff
push dword [0x454ed4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
je 0x41039a
jmp 0x4103ec
cmp eax, 1
je 0x4103e0
cmp eax, 3
jne 0x4103ca
push edi
push dword [0x454ed4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4103ec
cmp eax, 4
jne 0x4103ec
push edi
push dword [0x454ed4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
js 0x4103ec
push dword [0x454ed4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x41091b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
imul eax, dword [ebp + 0x10]
push 0
push eax
push dword [ebp + 8]
call fcn.00416cd6
add esp, 0xc
test eax, eax
jns 0x41093d
push 0xfffffffffffffffe
pop eax
pop ebp
ret
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00416e6c
mov ecx, eax
add esp, 0xc
test ecx, ecx
jns 0x410958
push 0xfffffffffffffffd
jmp 0x41093a
xor eax, eax
cmp ecx, dword [ebp + 0x10]
push 0xfffffffffffffffb
pop edx
cmovne eax, edx
pop ebp
ret

Function at 0x410df8
Capabilities:
Move file

Disassembly:
push dword [esp + 8]
call fcn.004192b7
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0041b2b3
add esp, 0xc
cwde
ret

Function at 0x412405
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x452cb0]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [0x4560b0]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x14], edi
test eax, eax
je 0x412436
push eax
call fcn.004191ed
and dword [0x4560b0], 0
pop ecx
push 0x1b6
push 0
push str.var_overflow.164
call fcn.0041002e
pop ecx
push eax
call fcn.00403726
add esp, 0xc
mov esi, eax
push 0x16
pop ebp
test esi, esi
js 0x4124a3
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0041b758
mov ebx, dword [esp + 0x34]
test eax, eax
cmovs ebx, ebp
mov eax, ebx
mov dword [esp + 0x34], ebx
cdq
idiv ebp
mov dword [0x4560b4], eax
lea eax, [ebx + 5]
push eax
call fcn.00419225
add esp, 0xc
mov dword [0x4560b0], eax
test eax, eax
je 0x41249c
push ebx
push eax
push esi
call fcn.00416e6c
add esp, 0xc
push esi
call fcn.004161f7
pop ecx
mov ebx, dword [0x4560b0]
test ebx, ebx
je 0x4125a4
and dword [esp + 0x10], 0
cmp dword [0x4560b4], 0
jle 0x4125a4
imul ebp, edi, 3
add ebp, 0x4575a0
lea eax, [ebx + 0xb]
push eax
call fcn.004161cb
pop ecx
cmp dword [esp + 0x50], eax
jne 0x41257f
push 6
push ebx
call fcn.00410fb2
push dword [esp + 0x5c]
mov esi, eax
call fcn.004056bb
add esp, 0xc
cmp eax, esi
jne 0x41257f
lea eax, [ebx + 6]
push 2
push eax
call fcn.00410f61
imul esi, eax, 0x3c
lea eax, [ebx + 8]
push 2
push eax
call fcn.00410f61
push dword [esp + 0x6c]
add eax, esi
push dword [esp + 0x6c]
movzx esi, ax
push esi
call fcn.0040514b
add esp, 0x1c
test eax, eax
je 0x41257f
cmp edi, 0x32
jge 0x41257f
push 6
push ebx
mov word [edi*2 + 0x457520], si
call fcn.00410fb2
mov dword [edi*4 + 0x457640], eax
movsx ax, byte [ebx + 0x11]
push ebp
mov word [edi*2 + 0x4573a0], ax
mov al, byte [ebx + 0x12]
mov byte [ebp], al
mov al, byte [ebx + 0x13]
mov byte [ebp + 1], al
mov byte [ebp + 2], 0
call fcn.004119f7
add esp, 0xc
mov word [edi*2 + 0x4574a0], ax
inc edi
add ebp, 3
mov eax, dword [esp + 0x10]
add ebx, 0x16
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [0x4560b4]
jl 0x4124cc
cmp edi, dword [esp + 0x14]
jle 0x4125a4
push edi
call fcn.00412acb
pop ecx
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004161e8
add esp, 0x3c
ret
Function at 0x423c0e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x452cb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041e1dc
mov dword [ebp - 0x14], eax
cmp dword [0x456f80], esi
jne 0x423d01
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x423c8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x423de1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x423de1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x423de1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x456f80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x456f84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x456f88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x456f90], eax
test eax, eax
je 0x423cfe
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x456f8c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x423d26
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x423d19
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x423d3b
push 4
pop eax
jmp 0x423de3
cmp dword [ebp - 0x14], esi
je 0x423d3b
push dword [0x456f80]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x423d20
mov eax, dword [0x456f8c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x423d99
cmp dword [0x456f90], edi
je 0x423d99
push eax
call ebx
push dword [0x456f90]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x423d99
test eax, eax
je 0x423d99
call ecx
test eax, eax
je 0x423d8e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x423d8e
test byte [ebp - 8], 1
jne 0x423d99
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x423dc9
mov eax, dword [0x456f84]
cmp eax, edi
je 0x423dc6
push eax
call ebx
test eax, eax
je 0x423dc6
call eax
mov esi, eax
test esi, esi
je 0x423dc6
mov eax, dword [0x456f88]
cmp eax, edi
je 0x423dc6
push eax
call ebx
test eax, eax
je 0x423dc6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x456f80]
call ebx
test eax, eax
je 0x423de1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x423de3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004161e8
mov esp, ebp
pop ebp
ret
Function at 0x1476424
Capabilities:
Encode data using xor

Disassembly:
jmp 0x147642e
pushal
call 0x1476434
pop ebp
sub ebp, 0x10
sub ebp, 0x1076424
jmp 0x147644a
mov eax, 0x1076424
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d8
mov edx, 0xdb7794b8
xor byte [eax], dl
inc eax
dec ecx
jne 0x1476461
jmp 0x1476474
xor esi, dword [ebp + 0x33]
xor dword [eax + edi*4 + 0x7939b8b8], eax
inc eax
mov eax, 0x75bbb8b8
add byte [ebp + 0x2b8b8b8], bh
nop
mov eax, 0x5a4fb8b8
mov ebx, 0xb4393370
mov eax, 0x7dbbb8b8
xor eax, 0x31449cdc
mov esp, 0x20d0e89c
adc eax, 0x31d0b894
push cs
bound edi, qword [eax - 0x2f636b47]
aas
invalid
Function at 0x401485
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8dc
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0x8d8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0x70
lea eax, [esp + 0x78]
push eax
push 9
push ebx
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x4014da
cmp dword [esp + 0x10], 0x70
jne 0x4014da
xor eax, eax
inc eax
jmp 0x4014dc
xor eax, eax
push str.Job_information_querying_failed
push eax
call fcn.0040110b
or dword [esp + 0x88], 0x3000
pop ecx
pop ecx
push 0x70
lea eax, [esp + 0x74]
push eax
push 9
push ebx
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
push str.Job_information_setting_failed
push eax
call fcn.0040110b
push 0x44
pop esi
push esi
lea eax, [esp + 0x34]
push edi
push eax
call fcn.004063b0
add esp, 0x14
mov dword [esp + 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
push eax
lea eax, [esp + 0x64]
call fcn.0040142d
mov dword [esp], str.stdin_duplication_failed
push eax
call fcn.0040110b
pop ecx
pop ecx
push 0xfffffffffffffff5
call esi
push eax
lea eax, [esp + 0x68]
call fcn.0040142d
mov dword [esp], str.stdout_duplication_failed
push eax
call fcn.0040110b
pop ecx
pop ecx
push 0xfffffffffffffff4
call esi
push eax
lea eax, [esp + 0x6c]
call fcn.0040142d
mov dword [esp], str.stderr_duplication_failed
push eax
call fcn.0040110b
pop ecx
pop ecx
push 1
push 0x401465
mov dword [esp + 0x5c], 0x100
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push dword [esp + 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
jne 0x4015f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ecx, 0x400
push ecx
lea edx, [esp + 0xe8]
push edx
push ecx
push eax
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [esp + 0xe0]
push eax
push dword [esp + 0x18]
push str.Unable_to_create_process_using__ls:__ls
push edi
call fcn.004010b2
add esp, 0x10
push dword [esp + 0x18]
mov eax, dword [esp + 0x24]
push ebx
mov dword [0x412570], eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push str.Failed_to_get_exit_code_of_process
push eax
call fcn.0040110b
pop ecx
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4017a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x401880
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x401880
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4017ea
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4017f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4017d0
jmp 0x4017f3
mov esi, 0x1505
jmp 0x4017f3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401880
mov eax, edi
or eax, 1
mov ebx, edi
or ebx, 0xfffffffe
add ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401824
inc ebx
dec edi
je 0x40187e
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40187e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401820
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.00408340
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401820
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.00408360
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x401820
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x401880
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401cf0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x401e43
mov esi, dword [esp + 0x28]
test esi, esi
je 0x401e43
cmp dword [esp + 0x2c], 0
je 0x401e43
push esi
call fcn.00408340
add esp, 4
test eax, eax
je 0x401d5a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x401d61
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x401d40
jmp 0x401d63
mov ebx, 0x1505
jmp 0x401d63
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401de5
mov dword [esp], eax
mov eax, edi
or eax, 1
mov esi, edi
or esi, 0xfffffffe
add esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401d94
inc esi
dec edi
je 0x401de5
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401dea
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x401d90
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00408340
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401d90
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00408360
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401d90
mov eax, 0xffffffff
jmp 0x401e43
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x401e2f
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x401e43
call fcn.00401ef0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x401e4b
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.00408340
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401ede
mov eax, edi
or eax, 1
mov esi, edi
or esi, 0xfffffffe
add esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401e84
inc esi
dec edi
je 0x401ede
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401df2
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x401e80
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408340
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401e80
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00408360
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401e80
jmp 0x401df2
mov ebp, 0xffffffff
jmp 0x401df2
Function at 0x4025d0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402786
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov eax, ecx
not eax
or eax, 0xffff
lea edi, [ecx + eax]
inc edi
shr ecx, 0x10
test esi, esi
je 0x40277f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402665
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40277f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x4026e5
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402680
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40262d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402730
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402710
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402620
jmp 0x40273f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402620
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402750
jmp 0x402620
shl ecx, 0x10
add ecx, edi
jmp 0x40278b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret