joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404530
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404610
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404610
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40457a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404581
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404560
jmp 0x404583
mov esi, 0x1505
jmp 0x404583
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x404610
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4045b4
inc edi
dec ebx
je 0x40460e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40460e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4045b0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040cff0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4045b0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040d010
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4045b0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404610
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404620
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x404721
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404721
push ebx
call fcn.0040cff0
add esp, 4
test eax, eax
je 0x40467a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404681
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x404660
jmp 0x404683
mov esi, 0x1505
jmp 0x404683
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404721
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4046b4
inc ebp
dec ebx
je 0x40471f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40471f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4046b0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cff0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4046b0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040d010
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4046b0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40471f
cmp dword [eax + 4], 2
mov edi, 0
jne 0x404721
mov edi, dword [eax + 8]
jmp 0x404721
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404750
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x4047bb
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4047bb
push esi
call fcn.0040cff0
add esp, 4
test eax, eax
je 0x40479a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4047a1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x404780
jmp 0x4047a3
mov ebp, 0x1505
jmp 0x4047a3
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x4047c7
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4047e4
inc ebx
dec edi
je 0x4047bb
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4047bb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x4047e0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cff0
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x4047e0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.0040d010
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4047e0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4047bb
cmp dword [eax + 4], 3
jne 0x4047bb
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x4047bb

Function at 0x404880
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x404981
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404981
push ebx
call fcn.0040cff0
add esp, 4
test eax, eax
je 0x4048da
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4048e1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4048c0
jmp 0x4048e3
mov esi, 0x1505
jmp 0x4048e3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404981
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404914
inc ebp
dec ebx
je 0x40497f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40497f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404910
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cff0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404910
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040d010
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404910
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40497f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x404981
mov edi, dword [eax + 8]
jmp 0x404981
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4049b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404ab4
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404ab4
push ebx
call fcn.0040cff0
add esp, 4
test eax, eax
je 0x404a0a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404a11
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4049f0
jmp 0x404a13
mov esi, 0x1505
jmp 0x404a13
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404ab4
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404a44
inc ebp
dec ebx
je 0x404aaf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x404aaf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404a40
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cff0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404a40
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040d010
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404a40
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x404aaf
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x404ab4
mov edi, dword [eax + 8]
jmp 0x404ab4
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404ac0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.0040d060
add esp, 8
test eax, eax
je 0x404b24
mov esi, eax
jmp 0x404b04
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.0040d060
add esp, 8
mov esi, eax
test eax, eax
je 0x404b24
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.00404530
add esp, 0xc
xor edi, edi
test eax, eax
je 0x404af0
cmp dword [eax + 4], 4
jne 0x404af0
mov edi, dword [eax + 8]
jmp 0x404af0
xor eax, eax
test edi, edi
je 0x404b8b
test ebp, ebp
je 0x404b8b
push ebp
call fcn.0040cff0
add esp, 4
test eax, eax
je 0x404b6b
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x404b72
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x404b50
jmp 0x404b74
mov esi, 0x1505
jmp 0x404b74
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x404b93
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x404bb4
inc ebx
dec ecx
je 0x404b89
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x404b89
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x404bb0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.0040cff0
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x404bb0
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.0040d010
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x404bb0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x404b8b
Function at 0x404cb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x404d1d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404d1d
push esi
call fcn.0040cff0
add esp, 4
test eax, eax
je 0x404cfa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404d01
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404ce0
jmp 0x404d03
mov ebx, 0x1505
jmp 0x404d03
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x404d25
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404d34
inc ebp
dec edi
je 0x404d1b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x404d1b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x404d30
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cff0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404d30
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040d010
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404d30
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x404d1d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x404d1d
Function at 0x405270
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405382
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405382
cmp dword [esp + 0x2c], 0
je 0x405382
push esi
call fcn.0040cff0
add esp, 4
test eax, eax
je 0x4052da
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4052e1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4052c0
jmp 0x4052e3
mov ebx, 0x1505
jmp 0x4052e3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x40538a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405347
call fcn.00406010
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405382
push ecx
call fcn.0040cff0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x4053fd
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4053a8
inc edi
dec esi
je 0x4052fc
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405301
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4053a0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cff0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4053a0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040d010
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4053a0
mov eax, 0xffffffff
jmp 0x405382
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405418
inc edi
dec esi
je 0x405342
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405347
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405410
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cff0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405410
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040d010
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405410
jmp 0x405347
Function at 0x405d60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405f4a
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x405f4a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405f4a
cmp dword [ecx], 0
jne 0x405f4a
push edi
call fcn.0040cff0
add esp, 4
test eax, eax
je 0x405dca
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [edi + ebx]
test edx, edx
je 0x405dd1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x405db0
jmp 0x405dd3
mov esi, 0x1505
jmp 0x405dd3
mov esi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov edi, edx
sub edi, 1
mov dword [esp + 0xc], edi
jae 0x405ead
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov ebx, dword [esp + 0x2c]
jb 0x405e31
call fcn.00406010
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405f4a
push ebx
call fcn.0040cff0
add esp, 4
lea edi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push edi
push esi
push eax
call fcn.00405f60
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040cff0
add esp, 4
mov ebx, eax
and eax, 1
mov ecx, ebx
xor ecx, 1
lea eax, [ecx + eax*2]
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x405f45
mov edi, eax
mov byte [eax + ebx], 0
push ebx
push dword [esp + 0x30]
push eax
call fcn.0040cf10
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov edi, dword [esp + 0x30]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [edi], eax
xor eax, eax
jmp 0x405f4a
mov dword [esp], eax
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405ec8
inc ebx
dec edx
je 0x405dec
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x405df1
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x405ec0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cff0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405ec0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040d010
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405ec0
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.00404e10
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + edi*4], ecx
mov edi, ecx
jmp 0x405ea2
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406ff0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4071c6
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
movzx edi, si
shr esi, 0x10
test ebx, ebx
je 0x4071bf
mov ecx, 0x5e6ea9af
mov eax, ebx
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ecx, eax
jmp 0x407086
mov ecx, dword [esp + 4]
mov eax, ecx
sub eax, dword [esp]
add ebp, eax
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ebx, dword [esp + 0xc]
sub ebx, ecx
mov ecx, 0x15b0
je 0x4071bf
xor edx, edx
cmp ecx, 8
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
jb 0x407129
and ecx, 0x1ff8
mov dword [esp], ecx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add esi, eax
movzx ecx, byte [ebp + edx + 1]
mov edi, eax
xor edi, ecx
and eax, ecx
lea ecx, [edi + eax*2]
mov eax, ecx
xor eax, esi
and esi, ecx
lea eax, [eax + esi*2]
movzx edi, byte [ebp + edx + 2]
add edi, ecx
mov esi, eax
xor esi, edi
and eax, edi
movzx ecx, byte [ebp + edx + 3]
add ecx, edi
movzx edi, byte [ebp + edx + 4]
add edi, ecx
movzx ebx, byte [ebp + edx + 5]
add ebx, edi
add edi, ecx
add edi, esi
movzx ecx, byte [ebp + edx + 6]
add ecx, ebx
add edi, ebx
lea eax, [edi + eax*2]
add eax, ecx
movzx edi, byte [ebp + edx + 7]
add edi, ecx
mov ecx, eax
xor ecx, edi
and eax, edi
lea esi, [ecx + eax*2]
mov ecx, dword [esp + 4]
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ecx
jb 0x4070b0
add ebp, eax
mov edx, dword [esp]
mov ebx, edx
sub ebx, ecx
jae 0x40704b
mov eax, ecx
and eax, 3
mov dword [esp], edx
je 0x407171
mov dword [esp + 8], ebx
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx]
inc edx
add edi, ecx
add esi, edi
dec ebx
cmp eax, ebx
jne 0x407150
mov eax, dword [esp]
sub eax, ebx
mov ebx, dword [esp + 8]
cmp ebx, 0xfffffffc
ja 0x407040
jmp 0x40717e
mov eax, edx
mov edx, ebp
cmp ebx, 0xfffffffc
ja 0x407040
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [edx + eax + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 3]
add edi, ecx
add esi, edi
add eax, 4
cmp ebx, eax
jne 0x407190
jmp 0x407040
shl esi, 0x10
or esi, edi
jmp 0x4071cb
mov esi, 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4071e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40720e
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
not ecx
test ebx, ebx
je 0x4072aa
test bl, 1
jne 0x407215
mov edx, ebx
cmp ebx, 1
jne 0x407246
jmp 0x4072aa
xor eax, eax
jmp 0x4072b1
lea edx, [ebx - 1]
movzx esi, byte [eax]
mov edi, ecx
shr edi, 4
xor ecx, esi
and ecx, 0xf
xor edi, dword [ecx*4 + 0x447c50]
inc eax
mov ecx, edi
shr ecx, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor ecx, dword [esi*4 + 0x447c50]
cmp ebx, 1
je 0x4072aa
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax + esi]
mov ebx, ecx
shr ebx, 4
xor ecx, edi
and ecx, 0xf
xor ebx, dword [ecx*4 + 0x447c50]
mov ecx, ebx
shr ecx, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor ecx, dword [edi*4 + 0x447c50]
movzx edi, byte [eax + esi + 1]
mov ebx, ecx
shr ebx, 4
xor ecx, edi
and ecx, 0xf
xor ebx, dword [ecx*4 + 0x447c50]
mov ecx, ebx
shr ecx, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor ecx, dword [edi*4 + 0x447c50]
add esi, 2
cmp edx, esi
jne 0x407250
lea eax, [ecx + ecx]
not eax
add eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x40f970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x4507f0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40fa1e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44ad54]
mov eax, dword [0x44ad68]
nop
nop
nop
nop
nop
nop
jmp eax
Function at 0x41d240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1100
call fcn.0040ce40
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41d260
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x451b28]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d294
mov eax, 0xffffffff
jmp 0x41d297
lea eax, [ebx + ebx]
push eax
call fcn.0040cee0
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x451b28]
mov eax, dword [esp + 0x30]
mov ecx, eax
add ecx, 0xd
js 0x41d2cc
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cee0
add esp, 4
mov edi, eax
mov dword [esp + 0xfc], 0x33e631d4
mov dword [esp + 0x100], 0x3fcd3ddd
mov dword [esp + 0x104], 0x3b1a39c4
mov dword [esp + 0x108], 0xc72bc51a
mov dword [esp + 0x10c], 0xc331c132
mov dword [esp + 0x110], 0xcf39cd25
mov dword [esp + 0x114], 0xcbcac93e
mov dword [esp + 0x118], 0
mov eax, 0x5222574
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x5222478]
xor ecx, eax
mov edx, ecx
and edx, 0x3b
xor ecx, 0xe65544bb
lea edx, [ecx + edx*2]
and ecx, 1
xor edx, 1
lea ecx, [edx + ecx*2]
mov byte [esp + eax - 0x5222478], cl
inc eax
cmp eax, 0x5222594
jne 0x41d340
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41d3a1
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d390
mov word [eax], 0
movzx ecx, word [esp + 0xfc]
test cx, cx
je 0x41d3d1
lea edx, [esp + 0xfe]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d3c0
mov word [eax], 0
lea eax, [esp + 0x90]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00445330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c69c]