joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62e723f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], pe_nt_image_headers32
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.62e71a4c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.62e71a01
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.62e71a3c
xor ebp, ebp
fstp dword [eax + eax*4 - 0x5335b]
inc dword [eax]
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.62e71a4c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.62e71a01
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.62e71a3c
xchg byte [ebx], bl
fucom st(3)
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
invalid
invalid
invalid

Function at 0x62e72990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edx + 0x21fffffc], ebx
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.62e71a4c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.62e71a01
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.62e71a3c
leave
invalid
Function at 0x62e7fdc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov edi, dword [esp + 0x70]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov esi, dword [esp + 0x7c]
mov dword [esp + 0x48], 0
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x4c], 0
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0xffffffff
test edi, edi
je 0x62e7ff78
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x62e7ff40
lea eax, [esp + 0x38]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x48]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp], esi
call dbg.libfdata_tree_node_get_sub_nodes_data_range
cmp eax, 1
jne 0x62e7fec0
mov eax, ebp
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x2c], ebx
movzx ebp, al
mov eax, dword [esp + 0x38]
mov dword [esp + 8], esi
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [edi + 0x1c]
cmp eax, 1
jne 0x62e7fef8
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov dword [esp + 0x10], str.libfdata_tree_read_sub_nodes
mov dword [esp + 0xc], 0x62f24f90
mov dword [esp + 8], 6
mov dword [esp + 4], 0x72
call dbg.libcerror_error_set
add esp, 0x5c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 0x10], str.libfdata_tree_read_sub_nodes
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], str._s:_unable_to_read_sub_nodes_at_offset:__lli.
mov dword [esp + 8], 4
mov dword [esp + 4], 0x49
call dbg.libcerror_error_set
add esp, 0x5c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov dword [esp + 0x10], str.libfdata_tree_read_sub_nodes
mov dword [esp + 0xc], str._s:_invalid_tree___missing_read_sub_nodes_function.
mov dword [esp + 8], 1
mov dword [esp + 4], 0x72
call dbg.libcerror_error_set
add esp, 0x5c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], str.libfdata_tree_read_sub_nodes
mov dword [esp + 0xc], 0x62f24bad
mov dword [esp + 8], 1
mov dword [esp + 4], 0x61
mov dword [esp], ebx
call dbg.libcerror_error_set
mov eax, 0xffffffff
jmp 0x62e7feb0
Function at 0x62e81e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov dword [esp + 0x3c], 0
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x28], eax
mov edi, dword [esp + 0x78]
mov dword [esp + 0x2c], edx
test ebx, ebx
je 0x62e82040
movzx eax, byte [ebx + 0x14]
and eax, 0xa
cmp al, 8
je 0x62e82000
mov eax, dword [esp + 0x80]
mov dword [esp + 8], ebx
lea ebp, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sym.cygewf_2.dll_libfdata_tree_node_initialize
cmp eax, 1
je 0x62e81f20
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], str.libfdata_tree_node_append_sub_node
mov dword [esp + 0xc], str._s:_unable_to_create_sub_node.
mov dword [esp + 8], 3
mov dword [esp + 4], 0x72
mov dword [esp], eax
call dbg.libcerror_error_set
mov eax, dword [esp + 0x3c]
mov esi, 0xffffffff
test eax, eax
je 0x62e81f14
mov dword [esp + 4], 0
mov dword [esp], ebp
call dbg.libfdata_tree_node_free
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x80]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sym.cygewf_2.dll_libfdata_tree_node_set_data_range
cmp eax, 1
jne 0x62e81fc8
mov eax, dword [esp + 0x80]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call dbg.libcdata_array_append_entry
mov esi, eax
cmp eax, 1
je 0x62e81f14
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], str.libfdata_tree_node_append_sub_node
mov dword [esp + 0xc], str._s:_unable_to_append_sub_node_to_sub_nodes_array.
mov dword [esp + 8], 8
mov dword [esp + 4], 0x72
mov dword [esp], eax
call dbg.libcerror_error_set
jmp 0x62e81ef7
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], str.libfdata_tree_node_append_sub_node
mov dword [esp + 0xc], str._s:_unable_to_set_sub_node_data_range.
mov dword [esp + 8], 7
mov dword [esp + 4], 0x72
mov dword [esp], eax
call dbg.libcerror_error_set
jmp 0x62e81ef7
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], str.libfdata_tree_node_append_sub_node
mov esi, 0xffffffff
mov dword [esp + 0xc], str._s:_invalid_tree_node___node_is_a_leaf.
mov dword [esp], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x72
call dbg.libcerror_error_set
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], str.libfdata_tree_node_append_sub_node
mov esi, 0xffffffff
mov dword [esp + 0xc], str._s:_invalid_node.
mov dword [esp + 8], 1
mov dword [esp + 4], 0x61
mov dword [esp], eax
call dbg.libcerror_error_set
jmp 0x62e81f14
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x52b7412d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x13335bc9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1000fc8b
Capabilities:
Encode data using base64
Encrypt data using aes

Disassembly:
mov edi, eax
dec eax
test edi, edi
mov byte [ecx + esi], dl
je fcn.100109d3
jne 0x1000be7a
lea ecx, [ebx + 0xcc483f0]
je 0x10004752
test esi, esi
jne 0x1000db5e
test byte [edi], 0x85
add eax, 0xf000094
test ah, al
pop edx
add byte [eax], al
je 0x1000a223
jmp [ebx - 0x40]
xor dl, 0x6b
mov edi, eax
lea ecx, [ebp + 0x80]
push ecx
call 0x1000a22f
push dword [esp]
pushfd
add dword [esp + 4], 0x13f50
add dword [esp + 8], 0x1d
add dword [esp + 4], 0xc
popfd
ret
xor dl, 0xb7
call 0x1000be82
push dword [esp]
pushfd
add dword [esp + 4], 0x1297e
add dword [esp + 8], 0x1b
add dword [esp + 4], 0xc
popfd
ret
aaa
mov edi, eax
dec eax
test edi, edi
mov byte [ecx + esi], dl
je 0x1000a158
jne 0x100147a7
imul esi, dword [ecx], 0xffffffb2
xor dl, 0x4e
mov edi, eax
dec eax
test edi, edi
mov byte [ecx + esi], dl
je fcn.100109d3
jne 0x1001d558
jmp 0x9c8cc5d7
xor dl, 0xd1
mov edi, eax
dec eax
test edi, edi
mov byte [ecx + esi], dl
je 0x1000a158
jne 0x10005145
mov dword [eax + 0xe8b2f2], 0xff000000
xor al, 0x24
xor dl, 0x55
jmp 0x10004735
Function at 0x101795e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x10179612
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x10179619
cmp ebx, dword [eax + 4]
jae 0x10179619
xor eax, eax
jmp 0x10179809
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x1017962a
xor eax, eax
inc eax
jmp 0x10179808
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10179640
cmp ecx, edx
jae 0x10179785
cmp dword [eax + 4], 0
je 0x10179649
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x10179631
cmp dword [ebp + 8], 0
je 0x1017966b
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x10179785
cmp eax, esi
jae 0x10179785
mov eax, dword [0x101a1fe8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x10179690
cmp dword [esi*4 + 0x101a1ff0], edi
je 0x10179789
inc esi
cmp esi, eax
jl 0x1017967e
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
dec eax
call 0x101aa2bd
test eax, eax
je 0x10179805
cmp dword [ebp - 8], 0x1000000
jne 0x10179805
test byte [ebp - 0xc], 0xcc
je 0x1017970e
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x10179805
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10179805
cmp word [eax + 0x18], 0x10b
jne 0x10179805
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x10179805
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x1017970e
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x1017970e
test byte [ecx + 0x27], 0x80
jne 0x10179785
push 1
push 0x101a2030
cld
call 0x101aa2ac
test eax, eax
jne 0x10179622
mov ecx, dword [0x101a1fe8]
test ecx, ecx
mov edx, ecx
jle 0x10179742
lea eax, [ecx*4 + 0x101a1fec]
cmp dword [eax], edi
je 0x10179742
dec edx
sub eax, 4
test edx, edx
jg 0x10179736
test edx, edx
jne 0x10179773
push 0xf
pop ebx
cmp ecx, ebx
jg 0x1017974f
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x10179767
lea eax, [edx*4 + 0x101a1ff0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x10179755
cmp ecx, 0x10
jge 0x10179773
inc ecx
mov dword [0x101a1fe8], ecx
push 0
push 0x101a2030
call 0x101aa2ac
jmp 0x10179622
xor eax, eax
jmp 0x10179808
test esi, esi
jle 0x10179622
push 0x101a96ac
pop ebx
push 1
push 0x101a2030
call ebx
test eax, eax
jne 0x10179622
cmp dword [esi*4 + 0x101a1ff0], edi
je 0x101797df
mov eax, dword [0x101a1fe8]
lea esi, [eax - 1]
test esi, esi
jl 0x101797cd
cmp dword [esi*4 + 0x101a1ff0], edi
je 0x101797c9
dec esi
jns 0x101797bd
test esi, esi
jge 0x101797dd
cmp eax, 0x10
jge 0x101797d8
inc eax
mov dword [0x101a1fe8], eax
lea esi, [eax - 1]
jmp 0x101797df
je 0x101797f7
xor ecx, ecx
test esi, esi
jl 0x101797f7
lea eax, [ecx*4 + 0x101a1ff0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x101797e5
push 0
push 0x101a2030
call ebx
jmp 0x10179622
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418d10
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, eax
mov edx, edi
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418d20
sub eax, edi
dec eax
mov ebp, 0
mov esi, ebp
je 0x418d4e
mov cl, byte [esi + edi]
cmp cl, 0xd
je 0x418d49
cmp cl, 0xa
jne 0x418d46
inc ebp
mov byte [edx], 0
jmp 0x418d48
mov byte [edx], cl
inc edx
inc esi
cmp esi, eax
jb 0x418d33
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._n_n_n
mov byte [edx], 0
call ebx
xor eax, eax
test ebp, ebp
jle 0x418d9f
push edi
lea esi, [eax + 1]
push esi
lea edx, [esp + 0x18]
push str._3d:__s_n
push edx
call fcn.00626a10
mov eax, dword [eax]
add esp, 0x10
push eax
call ebx
mov eax, dword [esp + 0x10]
call fcn.00626990
mov eax, edi
jmp 0x418d90
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418d90
mov edi, eax
mov eax, esi
cmp eax, ebp
jl 0x418d64
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41c1a0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0xc6c]
mov ecx, eax
not eax
and eax, 1
shl eax, 5
push edi
lea edi, [eax + esi + 0xc2c]
mov eax, dword [edi + 0x18]
and ecx, 1
shl ecx, 5
test eax, eax
lea ebx, [ecx + esi + 0xc2c]
jne 0x41c1d7
or dword [edi + 0x1c], 2
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x737cac
mov dword [0x9440cc], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [esp + 0xc]
mul dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push ecx
push edx
push eax
call fcn.006875c0
test edx, edx
ja 0x41c21f
cmp eax, 0xffffffff
jbe 0x41c222
or eax, 0xffffffff
mov dword [edi + 0x14], eax
mov dword [ebx + 0x14], eax
inc dword [esi + 0xc6c]
mov eax, 1
mov dword [esi + 0xf08], eax
mov dword [esi + 0xf0c], eax
mov eax, dword [esi]
and eax, 0xfffffffd
mov dword [esi + 0xef8], 0
mov dword [esi], eax
add esi, 0xf88
call fcn.0041c670
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x43a910
Capabilities:
Hash data using djb2

Disassembly:
movsx ecx, byte [edx]
test ecx, ecx
mov eax, 0x1505
je 0x43a93a
lea esp, [esp]
inc edx
cmp ecx, 0x61
jl 0x43a92e
cmp ecx, 0x7a
jg 0x43a92e
sub ecx, 0x20
imul eax, eax, 0x21
xor eax, ecx
movsx ecx, byte [edx]
test ecx, ecx
jne 0x43a920
xor edx, edx
mov ecx, 0x52f
div ecx
mov ax, dx
ret

Function at 0x43a950
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov eax, dword [esi + 0xa6c]
mov ecx, dword [esi + 0xa68]
or ebx, 0xffffffff
cmp ecx, eax
push edi
jne 0x43aa45
add eax, 0x400
mov dword [esi + 0xa6c], eax
imul eax, eax, 0x98
push eax
mov eax, dword [esi + 0xa64]
push eax
call fcn.0062a3e0
mov ecx, dword [esi + 0xa68]
mov edx, dword [esi + 0xa6c]
sub edx, ecx
imul ecx, ecx, 0x98
imul edx, edx, 0x98
push edx
add ecx, eax
push 0
push ecx
mov dword [esi + 0xa64], eax
call fcn.00626100
mov cx, word [esi + 0xa6c]
mov edx, dword [esi + 0xa68]
add esp, 0x14
dec cx
movsx eax, cx
cmp eax, edx
jl 0x43aa45
mov edx, dword [esi + 0xa64]
imul eax, eax, 0x98
mov dword [eax + edx + 0x80], 0
mov edx, dword [esi + 0xa64]
mov di, word [esi + 0xa60]
mov word [eax + edx + 0x8e], di
mov edx, dword [esi + 0xa64]
mov word [eax + edx + 0x90], bx
mov ax, word [esi + 0xa60]
cmp ax, bx
je 0x43aa30
mov edx, dword [esi + 0xa64]
movsx eax, ax
imul eax, eax, 0x98
mov word [eax + edx + 0x90], cx
mov word [esi + 0xa60], cx
mov edx, dword [esi + 0xa68]
dec ecx
movsx eax, cx
cmp eax, edx
jge 0x43a9d3
mov di, word [esi + 0xa60]
mov eax, dword [esi + 0xa68]
mov edx, dword [esi + 0xa64]
movsx ecx, di
imul ecx, ecx, 0x98
inc eax
mov dword [esi + 0xa68], eax
mov ax, word [ecx + edx + 0x8e]
cmp ax, bx
mov word [esi + 0xa60], ax
je 0x43aa8d
movsx eax, ax
imul eax, eax, 0x98
mov word [eax + edx + 0x90], bx
mov edx, dword [esi + 0xa64]
mov word [ecx + edx + 0x8e], bx
mov eax, dword [esi + 0xa64]
mov word [ecx + eax + 0x90], bx
mov ax, word [esi + 0xa5e]
cmp ax, bx
je 0x43aacc
movsx edx, ax
mov eax, dword [esi + 0xa64]
imul edx, edx, 0x98
mov word [edx + eax + 0x90], di
mov ax, word [esi + 0xa5e]
mov edx, dword [esi + 0xa64]
mov word [ecx + edx + 0x8e], ax
mov edx, dword [esi + 0xa64]
mov word [esi + 0xa5e], di
mov dword [ecx + edx + 0x80], 1
mov eax, dword [esi + 0xa64]
mov word [ecx + eax + 0x8c], 0
mov edx, dword [esi + 0xa64]
mov word [ecx + edx + 0x94], bx
mov eax, dword [esi + 0xa64]
mov word [ecx + eax + 0x92], bx
movsx edx, byte [ebp]
test edx, edx
mov ebx, ebp
mov eax, 0x1505
je 0x43ab4e
inc ebx
cmp edx, 0x61
jl 0x43ab42
cmp edx, 0x7a
jg 0x43ab42
sub edx, 0x20
imul eax, eax, 0x21
xor eax, edx
movsx edx, byte [ebx]
test edx, edx
jne 0x43ab34
xor edx, edx
mov ebx, 0x52f
div ebx
mov eax, dword [esi + 0xa64]
mov word [ecx + eax + 0x92], dx
movsx edx, dx
lea eax, [esi + edx*2]
mov edx, dword [esi + 0xa64]
mov si, word [eax]
mov word [ecx + edx + 0x94], si
mov word [eax], di
mov ax, di
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x43b7e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6de65a
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 6
mov eax, dword [esi + 0x6c]
xor ebx, ebx
push eax
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x70]
push eax
call fcn.00685b4c
push ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x70]
push eax
call fcn.00685b4c
mov byte [esp + 0x20], 5
mov eax, dword [esi + 0x5c]
push eax
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x60]
push eax
call fcn.00685b4c
push ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x60]
push eax
call fcn.00685b4c
mov byte [esp + 0x30], 4
mov eax, dword [esi + 0x4c]
push eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x50]
push eax
call fcn.00685b4c
push ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x50]
push eax
call fcn.00685b4c
mov byte [esp + 0x40], 3
mov eax, dword [esi + 0x3c]
push eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x40]
push eax
call fcn.00685b4c
push ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x40]
push eax
call fcn.00685b4c
add esp, 0x40
mov byte [esp + 0x10], 2
mov eax, dword [esi + 0x2c]
push eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x30]
push eax
call fcn.00685b4c
push ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x30]
push eax
call fcn.00685b4c
mov byte [esp + 0x20], 1
mov eax, dword [esi + 0x1c]
push eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x20]
push eax
call fcn.00685b4c
push ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call fcn.00685b4c
mov eax, dword [esi + 0x20]
push eax
call fcn.00685b4c
mov byte [esp + 0x30], bl
mov eax, dword [esi + 0xc]
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00685b4c
mov ecx, dword [esi + 0x10]
push ecx
call fcn.00685b4c
push ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00685b4c
mov edx, dword [esi + 0x10]
push edx
call fcn.00685b4c
mov ecx, dword [esp + 0x38]
add esp, 0x30
mov dword [esi], 0x70cac4
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4