joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025c20
Capabilities:
Delete user account
Query or enumerate registry value

Disassembly:
sub esp, 0xb4
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 1
call fcn.10010bb0
mov ebx, eax
mov byte [esp + 0x13], 0
push ebx
call fcn.100245f0
add esp, 4
mov esi, eax
push esi
push 0
call sub.NETAPI32.dll_NetUserDel
push esi
mov edi, eax
call sub.MFC42.DLL_operatordelete
add esp, 4
test edi, edi
jne 0x10025c81
lea eax, [esp + 0x13]
push 1
push eax
mov ecx, ebp
mov byte [esp + 0x1b], 0xa0
call fcn.10010b00
mov ecx, ebp
call fcn.10025700
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb4
ret
cmp edi, 0x8ad
je 0x10025d36
push ebx
lea ecx, [esp + 0x48]
push str.SAMSAMDomainsAccountUsersNames_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
xor esi, esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x44]
push edx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x10025cce
push 0x32
call edi
inc esi
cmp esi, 0x64
jg 0x10025d3d
jmp 0x10025ca9
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0x1012b044
push ecx
mov dword [esp + 0x34], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
push str._08X
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, ebp
push ebx
call fcn.10025950
test eax, eax
je 0x10025d36
lea edx, [esp + 0x24]
mov ecx, ebp
push edx
call fcn.10025730
test eax, eax
jne 0x10025d3d
mov ecx, ebp
call fcn.10025700
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb4
ret

Function at 0x10025d50
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
push esi
push edi
push 0x14
call sub.MFC42.DLL_operatornew
mov esi, eax
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xc]
add esp, 4
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0x14
call fcn.1002d130
add eax, 1
adc edx, 0
push edx
push eax
push 0x1011fe0c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, esi
pop edi
pop esi
add esp, 0x40
ret
Function at 0x10029fb0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x2c
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp], eax
push ecx
mov dword [esp + 8], eax
mov byte [esp + 4], 3
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
lea ecx, [esp]
push 0xc
push ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 9], edx
mov dword [esp + 0xd], eax
call fcn.10010b00
add esp, 0x2c
ret

Function at 0x1002a180
Capabilities:
Get session information
Get session user name

Disassembly:
sub esp, 8
push ebx
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0xc]
push ecx
push edx
xor eax, eax
push 5
push 0xffffffffffffffff
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x1002a216
mov edx, dword [esp + 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x18]
push edx
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.WTSAPI32.dll_WTSFreeMemory
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x1002a20a
mov edi, 0x101201c4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 8
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
mov edi, 0x101201c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x1002adf0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
mov dword [esp + 8], 0x50
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.Favorites
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x2710
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x1012d1d4], eax
mov byte [eax], 0x94
lea eax, [esp + 0x10]
mov dword [0x10120110], 1
push eax
call fcn.1002ab10
mov ecx, dword [0x10120110]
mov edx, dword [0x1012d1d4]
add esp, 4
push 0x42
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [0x1012d1d4], eax
pop edi
add esp, 0x110
ret
Function at 0x1002c070
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x13c
push esi
push edi
mov ecx, 0xa
mov esi, str.C:ProgramDataMicrosoft_DriveBITS.sys
lea edi, [esp + 0x40]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, 0x37
lea edi, [esp + 0x6c]
push 0x80
push 4
push eax
rep stosd dword es:[edi], eax
push 2
lea eax, [esp + 0x54]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [esp + 0x14c]
lea ecx, [esp + 8]
push 0
push ecx
push esi
mov edi, eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [str.TGByteSetup]
mov eax, dword [0x100fb06c]
mov ecx, dword [0x100fb070]
mov dword [esp + 0xc], edx
mov dl, byte [0x100fb074]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], dl
push 0
rep stosd dword es:[edi], eax
push esi
stosb byte es:[edi], al
call dword [0x1012d1d8]
push eax
push esi
push 1
lea eax, [esp + 0x1c]
push str.BITS
push eax
push reloc.WS2_32.dll_accept
call fcn.10014ca0
add esp, 0x1c
pop edi
pop esi
add esp, 0x13c
ret
Function at 0x1002ca20
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x2104
call fcn.1002d080
mov eax, dword [esp + 0x2108]
push ebx
push ebp
push esi
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
push edi
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x1012f1e4]
test al, al
je 0x1002cb42
mov edi, dword [sym.imp.WS2_32.dll_recv]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 1
xor eax, eax
lea ecx, [esp + 0x14]
cmp dword [ecx], ebx
je 0x1002ca87
inc eax
add ecx, 4
cmp eax, 1
jb 0x1002ca7a
cmp eax, 1
jne 0x1002ca98
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 2
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x1002cb42
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1002caf4
push 0
lea edx, [esp + 0x118]
push 0x2000
push edx
push ebp
call edi
mov esi, eax
test esi, esi
jle 0x1002cb42
lea eax, [esp + 0x114]
push esi
push eax
push ebx
call fcn.1002c9d0
add esp, 0xc
test eax, eax
je 0x1002cb42
cmp eax, esi
jne 0x1002cb42
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1002cb35
push 0
lea edx, [esp + 0x118]
push 0x2000
push edx
push ebx
call edi
mov esi, eax
test esi, esi
jle 0x1002cb42
lea eax, [esp + 0x114]
push esi
push eax
push ebp
call fcn.1002c9d0
add esp, 0xc
test eax, eax
je 0x1002cb42
cmp eax, esi
jne 0x1002cb42
mov al, byte [0x1012f1e4]
test al, al
jne 0x1002ca68
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push ebp
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2104
ret 4

Function at 0x1002cb60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1002cb7e
xor eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov word [esp + 8], 2
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1002cbbe
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x1002cc90
Capabilities:
Create thread
Receive data
Receive data on socket

Disassembly:
mov eax, 0x1038
call fcn.1002d080
push ebx
push ebp
push esi
push edi
mov ecx, 0x40c
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x18], 0x100b7a10
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1054]
lea ecx, [esp + 0x1c]
push eax
push 0x100fbcd8
push 0x20
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [esp + 0x1060]
mov ecx, dword [esp + 0x105c]
mov dx, word [esp + 0x1068]
push eax
push ecx
mov word [esp + 0x54], dx
call fcn.1002cbd0
mov edi, eax
add esp, 0x18
test edi, edi
jbe 0x1002cdb0
mov al, byte [0x1012f1e4]
mov dword [esp + 0x40], edi
test al, al
je 0x1002cdb0
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea edx, [esp + 0x16]
push 2
push edx
push edi
call ebx
test eax, eax
jle 0x1002cdb0
mov edx, dword [0x1012e1e0]
mov eax, dword [esp + 0x44]
inc edx
cmp eax, 0x800
mov dword [0x1012e1e0], edx
jge 0x1002cd5e
mov cx, word [esp + 0x12]
inc eax
mov dword [esp + 0x44], eax
mov word [esp + eax*2 + 0x48], cx
mov edx, dword [0x1012f1e8]
lea eax, [esp + 0x18]
inc edx
mov dword [0x1012f1e8], edx
lea edx, [esp + 0x14]
push edx
push 0
push eax
push 0x1002cbf0
push 0
push 0
call esi
mov ecx, dword [0x1012f1e8]
test eax, eax
mov dword [ecx*4 + 0x1012e1e4], eax
je 0x1002cd98
push eax
call ebp
jmp 0x1002cda3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x1012f1e4]
test al, al
jne 0x1002cd27
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1038
ret 0x10

Function at 0x1002cdd0
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x80
mov byte [0x1012f1e4], 0
push esi
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1012e1dc]
test eax, eax
je 0x1002ce33
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x1012e1dc]
lea ecx, [esp + 8]
push eax
push str.nsocket_di:_d
push ecx
call esi
mov edx, dword [0x1012e1dc]
add esp, 0xc
mov eax, dword [edx*4 + 0x1012d1dc]
cmp eax, 0xffffffff
je 0x1002ce26
push eax
call edi
mov eax, dword [0x1012e1dc]
dec eax
mov dword [0x1012e1dc], eax
jne 0x1002cdfc
mov eax, dword [0x1012f1e8]
test eax, eax
je 0x1002ce72
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1012f1e8]
mov eax, dword [eax*4 + 0x1012e1e4]
cmp eax, 0xffffffff
je 0x1002ce65
push 0
push eax
call esi
push 0x1012e1e4
call edi
mov eax, dword [0x1012f1e8]
dec eax
mov dword [0x1012f1e8], eax
jne 0x1002ce48
pop edi
mov dword [0x1012f1e8], 0
mov dword [0x1012e1dc], 0
mov byte [0x1012f1e4], 1
pop esi
add esp, 0x80
ret
Function at 0x1003dca0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x101218d4]
push esi
cmp eax, 0xffffffff
push edi
jne 0x1003dde0
call fcn.10042a80
push str.JSIMD_FORCEMMX
mov dword [0x101218d4], eax
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x1003dce4
mov esi, eax
mov edi, 0x100faf08
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003dce4
and dword [0x101218d4], 1
push str.JSIMD_FORCE3DNOW
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x1003dd0e
mov edi, 0x100faf08
mov esi, eax
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003dd0e
and dword [0x101218d4], 3
push str.JSIMD_FORCESSE
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x1003dd38
mov esi, eax
mov edi, 0x100faf08
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003dd38
and dword [0x101218d4], 5
push str.JSIMD_FORCESSE2
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x1003dd62
mov edi, 0x100faf08
mov esi, eax
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003dd62
and dword [0x101218d4], 8
push str.JSIMD_FORCEAVX2
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x1003dd8f
mov esi, eax
mov edi, 0x100faf08
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003dd8f
and dword [0x101218d4], 0x80
push str.JSIMD_FORCENONE
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x1003ddb8
mov edi, 0x100faf08
mov esi, eax
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003ddb8
mov dword [0x101218d4], edx
push str.JSIMD_NOHUFFENC
call sub.MSVCRT.dll_getenv
add esp, 4
test eax, eax
je 0x1003dde0
mov esi, eax
mov edi, 0x100faf08
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003dde0
mov dword [0x101218d8], eax
pop edi
pop esi
ret
Function at 0x4045e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4046c0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4046c0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40462a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404631
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404610
jmp 0x404633
mov esi, 0x1505
jmp 0x404633
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
mov ebx, edi
sub ebx, 1
jb 0x4046c0
and ebx, esi
mov eax, edi
xor eax, 1
mov edx, edi
and edx, 0xfffffffe
add edx, edx
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404664
inc ebx
dec edi
je 0x4046be
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4046be
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x404660
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c970
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x404660
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c990
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x404660
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4046c0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404e40
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404f44
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404f44
cmp dword [esp + 0x2c], 0
je 0x404f44
push esi
call fcn.0040c970
add esp, 4
test eax, eax
je 0x404eaa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404eb1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404e90
jmp 0x404eb3
mov ebx, 0x1505
jmp 0x404eb3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
mov esi, edi
sub esi, 1
jae 0x404f4c
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x404f09
call fcn.00405c20
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x404f44
push ecx
call fcn.0040c970
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
mov esi, edi
sub esi, 1
jae 0x404fd0
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and esi, ebx
mov eax, edi
xor eax, 1
mov edx, edi
and edx, 0xfffffffe
add edx, edx
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404f78
inc esi
dec edi
je 0x404ec5
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404eca
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404f70
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040c970
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404f70
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040c990
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404f70
mov eax, 0xffffffff
jmp 0x404f44
and esi, ebx
mov eax, edi
xor eax, 1
mov edx, edi
and edx, 0xfffffffe
add edx, edx
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404ff8
inc esi
dec edi
je 0x404f04
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404f09
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404ff0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040c970
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404ff0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040c990
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404ff0
jmp 0x404f09
Function at 0x405970
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405b58
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405b58
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405b58
cmp dword [ecx], 0
jne 0x405b58
push esi
call fcn.0040c970
add esp, 4
test eax, eax
je 0x4059da
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x4059e1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x4059c0
jmp 0x4059e3
mov edi, 0x1505
jmp 0x4059e3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
mov esi, edx
sub esi, 1
jae 0x405aad
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405a3a
call fcn.00405c20
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405b58
push esi
call fcn.0040c970
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405b60
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040c970
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x444004]
add esp, 4
test eax, eax
je 0x405b53
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c890
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405b58
mov dword [esp], eax
and esi, edi
mov eax, edx
xor eax, 1
mov ebx, edx
and ebx, 0xfffffffe
add ebx, ebx
sub ebx, eax
mov dword [esp + 0xc], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405ad8
inc esi
dec edx
je 0x4059f5
mov ebp, esi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x4059fa
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x405ad0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c970
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405ad0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c990
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405ad0
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.004049f0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ebx*4], esi
jmp 0x405aa2
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406c10
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406de6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406ddf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x406ca6
mov eax, dword [esp + 4]
sub eax, dword [esp]
add ebp, eax
mov esi, dword [esp + 0xc]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x406ddf
xor edx, edx
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 0xc], esi
jb 0x406d4b
and ebx, 0x1ff8
mov dword [esp], ebx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx ebx, byte [ebp + edx + 2]
add ebx, esi
mov eax, ecx
and eax, ebx
mov dword [esp + 8], eax
xor ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
mov eax, ebp
movzx ebp, byte [ebp + edx + 4]
add ebp, edi
movzx esi, byte [eax + edx + 5]
mov ebx, ebp
and ebx, esi
xor esi, ebp
lea esi, [esi + ebx*2]
mov ebx, dword [esp + 4]
add edi, ecx
mov ecx, dword [esp + 8]
lea ecx, [edi + ecx*2]
add ecx, ebp
mov ebp, eax
movzx eax, byte [eax + edx + 6]
add eax, esi
add ecx, esi
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x406cd0
add ebp, eax
mov esi, dword [esp + 0xc]
mov edx, dword [esp]
mov eax, edx
sub eax, ebx
jae 0x406c6d
mov dword [esp + 8], eax
mov eax, ebx
and eax, 3
mov dword [esp], edx
je 0x406d8f
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406d70
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 8], 0xfffffffc
ja 0x406c60
jmp 0x406d9e
mov eax, edx
mov edx, ebp
cmp dword [esp + 8], 0xfffffffc
ja 0x406c60
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406db0
jmp 0x406c60
shl ecx, 0x10
or ecx, edi
jmp 0x406deb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret