joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462560
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x65bfd4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov dword [edi], 0
movq xmm0, qword [str.Data_Buffer]
mov eax, dword [0x62f760]
movq qword [ebp - 0x24], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
push 0x3c
mov esi, eax
call fcn.005b5958
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x24]
push 0x3e8
push 0x3c
push ebx
push 0
push 0x20
push eax
push 0xee9f5836
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x4625ed
mov eax, dword [ebx + 8]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a909b
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a909b
mov esp, ebp
pop ebp
ret 8

Function at 0x465991
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x4659db
call fcn.0047def9
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4659d8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x465a2b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x465a08
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5eba80]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x465a08
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x465a29
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x5eba80]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x472ec7
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x472f1a
push esi
push dword [ebp + 8]
call fcn.004730b0
mov edi, eax
test edi, edi
je 0x472f15
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x472f15
mov eax, dword [ebp - 8]
jmp 0x472f2c
mov eax, dword [ebp + 0x10]
jmp 0x472f2c
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x476a65
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x476aaa
call fcn.0047def9
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x476aaa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x476ac6
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0047f55b
mov ebx, eax
test edi, edi
je 0x476ac4
test esi, esi
je 0x476ac4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4774bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x47757a
cmp dword [esi + 0x20], 0
je 0x47757a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47757a
cmp dword [ebp + 8], 0
je 0x47757a
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0047def9
push 0x5eeaa8
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x47754b
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47757a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004fcd0c
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x47756b
test edi, edi
je 0x47756b
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x477576
mov ecx, esi
call fcn.0047725e
mov eax, ebx
jmp 0x47757c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x47be7e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5dcd71
call fcn.005a99af
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x47bea4
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x47bf04
call fcn.00462ac9
push eax
lea ecx, [ebp - 0x10]
call fcn.004022f9
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5eba80]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005baa98
push eax
call fcn.00403312
add esp, 0x14
test esi, esi
je 0x47bef7
push esi
call fcn.005ba921
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402322
mov eax, ebx
call fcn.005a9978
ret 8
Function at 0x47e251
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x47e27c
cmp dword [ebx + 0x80], 0
jne 0x47e27c
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.0047def9
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.0047e512
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x47e2b6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0047def9
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47e2ed
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0047e30c
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x47fed8
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x5dddb0
call fcn.005a99af
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0047ffbb
and dword [ebp - 4], 0
mov dword [ebx], vtable.CHttpConnection.0
call fcn.00462ac9
push eax
lea ecx, [ebx + 0x18]
call fcn.004022f9
push dword [ebp + 0xc]
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
call fcn.004030a1
push dword [ebx + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 4], eax
test eax, eax
je 0x47ff5d
push dword [ebx + 0xc]
mov ecx, 0x663a84
push eax
call fcn.004810c7
mov eax, ebx
call fcn.005a9978
ret 0x18
push 0
push dword [ebx + 8]
call fcn.004806b7
int3

Function at 0x4800cd
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x4800f6
call fcn.0047def9
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x480123
push esi
push eax
mov ecx, 0x663a84
call fcn.004810c7
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.004806b7
int3
Function at 0x49737b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x497395
call fcn.0047def9
mov esi, dword [eax + 0xc]
push 0x5f0494
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4973eb
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4973eb
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4973ca
xor esi, esi
jmp 0x4973e0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004973f4
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x4973ed
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4fe74c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x4fe7a2
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4fe77b
call fcn.0047ce04
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4fe790
call fcn.0047ce04
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4fe7a2
call fcn.0047ce04
call fcn.0047def9
cmp dword [eax + 0x3c], 0
je 0x4fe7b7
push edi
mov ecx, ebx
call fcn.004fde7c
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004fe989
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4fe7e0
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4fe7ec
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x506814
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.0047ba5b
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.00506a2d
cmp esi, 3
je 0x506852
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x50689b
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x506875
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00464f96
jmp 0x506886
push 0xff
mov ecx, esi
call fcn.0040202d
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00464fb9
jmp 0x5068bf
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x5068bf
push dword [esi]
push dword [ebp - 4]
call fcn.0048498d
pop edi
pop esi
leave
ret 0xc

Function at 0x506984
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00506a2d
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x5069cc
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00464f96
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00464fb9
jmp 0x5069d7
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0048498d
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x5716f2
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.005a47be
call fcn.0047df4d
cmp dword [eax + 0x14], 0
jne 0x57170d
mov ecx, esi
pop esi
jmp fcn.00570a1c
pop esi
ret

Function at 0x57e6a8
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401f00
call fcn.0047df4d
cmp dword [eax + 0x14], 0
jne 0x57e6c3
mov ecx, esi
pop esi
jmp fcn.0057df24
pop esi
ret

Function at 0x5827ac
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005c0efa
pop ecx
test eax, eax
jne 0x5827ee
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004733e5
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5827b4
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x5ca984
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ca647
Function at 0x5ca98f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ca7c8

Function at 0x5cbd02
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005cb9c2
Function at 0x9518b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x9519b1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x9519b1
push ebx
call fcn.009599d0
add esp, 4
test eax, eax
je 0x95190a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x951911
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x9518f0
jmp 0x951913
mov esi, 0x1505
jmp 0x951913
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x9519b1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x951944
inc ebp
dec ebx
je 0x9519af
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x9519af
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x951940
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.009599d0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x951940
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.009599f0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x951940
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x9519af
cmp dword [eax + 4], 2
mov edi, 0
jne 0x9519b1
mov edi, dword [eax + 8]
jmp 0x9519b1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x9519e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x951a4b
mov esi, dword [esp + 0x30]
test esi, esi
je 0x951a4b
push esi
call fcn.009599d0
add esp, 4
test eax, eax
je 0x951a2a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x951a31
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x951a10
jmp 0x951a33
mov ebp, 0x1505
jmp 0x951a33
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x951a57
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x951a74
inc ebx
dec edi
je 0x951a4b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x951a4b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x951a70
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.009599d0
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x951a70
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.009599f0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x951a70
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x951a4b
cmp dword [eax + 4], 3
jne 0x951a4b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x951a4b
Function at 0x951b10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x951c11
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x951c11
push ebx
call fcn.009599d0
add esp, 4
test eax, eax
je 0x951b6a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x951b71
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x951b50
jmp 0x951b73
mov esi, 0x1505
jmp 0x951b73
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x951c11
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x951ba4
inc ebp
dec ebx
je 0x951c0f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x951c0f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x951ba0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.009599d0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x951ba0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.009599f0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x951ba0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x951c0f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x951c11
mov edi, dword [eax + 8]
jmp 0x951c11
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x951f40
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x951fad
mov esi, dword [esp + 0x28]
test esi, esi
je 0x951fad
push esi
call fcn.009599d0
add esp, 4
test eax, eax
je 0x951f8a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x951f91
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x951f70
jmp 0x951f93
mov ebx, 0x1505
jmp 0x951f93
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x951fb5
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x951fc4
inc ebp
dec edi
je 0x951fab
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x951fab
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x951fc0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.009599d0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x951fc0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.009599f0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x951fc0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x951fad
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x951fad
Function at 0x959f00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x99abfc]
cmp eax, 0x270
jne 0x959f5f
mov eax, 0xfffff640
mov edx, dword [0x99ac00]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x99b5c4]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x99bbf4]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x99bf80], esi
add eax, 4
jne 0x959f20
mov eax, 0x270
jmp 0x959f75
cmp eax, 0x4e0
jb 0x959f75
mov ecx, 0x99abfc
call fcn.0095a140
mov eax, dword [0x99abfc]
lea ecx, [eax + 1]
mov dword [0x99abfc], ecx
mov eax, dword [eax*4 + 0x99ac00]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x99bf80]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret

Function at 0x95a140
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 - 0x630]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0x95a150
mov eax, 0x353
mov edx, 0x80000000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax - 0x270]
mov ebx, dword [ecx + eax*4 + 4]
and ebx, edx
and esi, 1
mov edi, eax
or edi, 1
add edi, esi
mov esi, dword [ecx + edi*4 + 4]
mov edi, esi
and edi, 0x7ffffffe
or edi, ebx
shr edi, 1
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [ecx + eax*4 - 0xd48]
xor esi, edi
mov dword [ecx + eax*4 - 0x9bc], esi
inc eax
cmp eax, 0x4df
jne 0x95a1a0
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov edx, dword [ecx + 4]
mov eax, edx
and eax, 0x7ffffffe
or eax, esi
shr eax, 1
and edx, 1
neg edx
xor eax, dword [ecx + 0x634]
and edx, 0x9908b0df
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret