joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002ccd0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea edx, [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jle 0x1002ccf8
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x1002cd00
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
mov ecx, edx
test esi, esi
jle 0x1002cd1a
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jmp 0x1002cd22
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov ecx, edx
test esi, esi
jle 0x1002cd3c
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jmp 0x1002cd44
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ecx, edx
test esi, esi
jle 0x1002cd5e
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x1002cd66
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, esi
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x1002cda7
add dword [esp], 5
retf

Function at 0x1002ce30
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5cc
push ebx
push esi
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0x18], xmm0
push 0x33
call 0x1002ce60
add dword [esp], 5
retf

Function at 0x1002d170
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b865
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
mov edx, dword [0x100ad15c]
push ebx
push esi
mov esi, dword [0x100ad158]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edx
push edi
test esi, esi
jne 0x1002d1d0
test edx, edx
jne 0x1002d1c4
call fcn.1002ce30
mov esi, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
mov dword [0x100ad158], esi
mov dword [0x100ad15c], edx
test esi, esi
jne 0x1002d1d0
test edx, edx
je 0x1002d619
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], edx
push 0x33
call 0x1002d1e6
add dword [esp], 5
retf
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
xor edx, edx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e5ff
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100aa040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x1002e70a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1002e703
inc edi
cmp dword [ebp - 0x20], 0x10
jb 0x1002e6c7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1002e6c7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1002e6c7
mov edx, dword [esi]
test edx, edx
jne 0x1002e690
push 0x200
push edx
push dword [0x100acfb8]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1002e6ec
lea ebx, [esi + 8]
jmp 0x1002e6ba
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x1002e6ba
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x100acfb8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1002e71b
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1002e648
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1002e703
xor edi, edi
cmp dword [esi], edi
je 0x1002e703
push dword [esi]
push edi
push dword [0x100acfb8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10047c45
leave
ret
mov ebx, dword [ebp - 0x24]
jmp 0x1002e6ec

Function at 0x1002e720
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.1002e5ff
test eax, eax
jne 0x1002e744
push 9
pop esi
jmp 0x1002e78b
cmp dword [edi], esi
je 0x1002e78b
push ebx
mov ebx, esi
cmp dword [edi + 8], esi
jbe 0x1002e78a
mov eax, dword [edi]
push dword [eax + ebx*4]
push esi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
test eax, eax
je 0x1002e784
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.1002e4ac
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [edi + 8]
jb 0x1002e750
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x1002e791
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1002e7dd
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1002e7cc
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1002e7c5
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1002e7a2
pop ebx
push dword [esi]
push 0
push dword [0x100acfb8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x1002e7df
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
imul edi, ecx, 0x2c
add edi, dword [0x100ad2f0]
mov al, byte [edi + 0x14]
mov esi, dword [edi]
and al, 1
je 0x1002e7fb
sub esi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1002e81c
push 0xa
pop eax
jmp 0x1002e85b
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x1002e837
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002ed27
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x100ad2e4]
push esi
xor esi, esi
jmp 0x1002ed39
cmp dword [edx + 4], esi
jne 0x1002ed8d
mov edx, dword [edx]
test edx, edx
jne 0x1002ed32
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1002ed89
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x1002ed60
mov eax, dword [0x100ad2e4]
mov dword [edx], eax
mov dword [0x100ad2e4], edx
pop edi
test edx, edx
jne 0x1002ed8d
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x1004748c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.10051d92
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100474cb
sub eax, 1
je 0x100474c6
sub eax, 1
je 0x100474c2
xor eax, eax
leave
ret
push 3
jmp 0x100474cd
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x10058645
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10058684
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10058684
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10058684
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10058684
cmp dword [ecx + 0x74], 0xe
jbe 0x10058684
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1005d2fb
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008fe54
push 0x1008fe4c
push str.FlsAlloc
push 0x1f
call fcn.1005d166
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005d32f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006e23c]
call esi
jmp 0x1005d335
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1005d379
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008fe64
push 0x1008fe5c
push str.FlsGetValue
push 0x21
call fcn.1005d166
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005d3b0
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006e23c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1005d3b8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008fe6c
push 0x1008fe64
push str.FlsSetValue
push 0x22
call fcn.1005d166
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005d3f2
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1006e23c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100602c3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10060360
push ebx
push esi
call fcn.1006028c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005eb4a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1006030d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1006035f
push edi
push eax
call fcn.1005b49c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1006032d
call fcn.1005b28c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1006035e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005eb4a
add esp, 0x20
test eax, eax
jne 0x1006034c
push edi
call fcn.1005b28c
jmp 0x10060354
push ebx
call fcn.1005b28c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10060363
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10060374
pop esi
ret
push ebx
push edi
push esi
call fcn.1006028c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1005b49c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1006039c
push ebx
push esi
push edi
call fcn.10049400
add esp, 0xc
push 0
call fcn.1005b28c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1006076c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100603b1

Function at 0x10062c34
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100598dc
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10062ca3
cmp esi, dword [ebp - 4]
je 0x10062c9e
cmp dword [ebp + 0xc], 0
je 0x10062c9e
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10062c7b
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10062786
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10062ca5
xor eax, eax
inc eax
jmp 0x10062ca5
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10062d0a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100aa040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100598dc
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100598dc
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10062d81
cmp word [ecx], dx
je 0x10062d81
mov eax, dword [0x100904bc]
push edi
dec eax
push eax
push 0x100903a8
call fcn.10062ca9
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10062df4
cmp word [eax], dx
je 0x10062df4
mov eax, dword [edi]
test eax, eax
je 0x10062da5
cmp word [eax], dx
je 0x10062da5
lea eax, [ebp - 0x10]
push eax
call fcn.1006268c
jmp 0x10062dae
lea eax, [ebp - 0x10]
push eax
call fcn.10062727
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10062e1e
mov eax, dword [0x100903a4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10090098
call fcn.10062ca9
add esp, 0xc
test al, al
je 0x10062e1e
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10062de9
cmp word [eax], di
je 0x10062de9
lea eax, [ebp - 0x10]
push eax
call fcn.1006268c
pop ecx
jmp 0x10062e20
lea eax, [ebp - 0x10]
push eax
call fcn.10062727
jmp 0x10062de6
mov eax, dword [edi]
test eax, eax
je 0x10062e0b
cmp word [eax], dx
je 0x10062e0b
lea eax, [ebp - 0x10]
push eax
call fcn.10062641
pop ecx
jmp 0x10062e1e
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10062ee9
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10062b2e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10062ee9
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10062ee9
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10062ee9
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10062e76
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1005d594
test ebx, ebx
je 0x10062ee4
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1005d594
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10062ee9
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10062ee9
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10066aec
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10062eeb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10047c45
leave
ret
Function at 0x10068d70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10068d9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10068d9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
nop
mov ecx, 0x7561925
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x3cbe7166
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0xa4fe0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0xa50c0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0xa50c0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0xa502a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0xa5031
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0xa5010
jmp 0xa5033
mov esi, 0x1505
jmp 0xa5033
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0xa50c0
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0xa5064
inc edi
dec ebx
je 0xa50be
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0xa50be
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0xa5060
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.000ad830
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0xa5060
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.000ad850
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0xa5060
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0xa50c0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xa50d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0xa51d1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0xa51d1
push ebx
call fcn.000ad830
add esp, 4
test eax, eax
je 0xa512a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0xa5131
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0xa5110
jmp 0xa5133
mov esi, 0x1505
jmp 0xa5133
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0xa51d1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xa5164
inc ebp
dec ebx
je 0xa51cf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0xa51cf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0xa5160
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.000ad830
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xa5160
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.000ad850
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xa5160
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0xa51cf
cmp dword [eax + 4], 2
mov edi, 0
jne 0xa51d1
mov edi, dword [eax + 8]
jmp 0xa51d1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xa5330
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0xa5431
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0xa5431
push ebx
call fcn.000ad830
add esp, 4
test eax, eax
je 0xa538a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0xa5391
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0xa5370
jmp 0xa5393
mov esi, 0x1505
jmp 0xa5393
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0xa5431
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xa53c4
inc ebp
dec ebx
je 0xa542f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0xa542f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0xa53c0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.000ad830
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xa53c0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.000ad850
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xa53c0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0xa542f
cmp dword [eax + 4], 5
mov edi, 0
jne 0xa5431
mov edi, dword [eax + 8]
jmp 0xa5431
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xa5460
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0xa5564
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0xa5564
push ebx
call fcn.000ad830
add esp, 4
test eax, eax
je 0xa54ba
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0xa54c1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0xa54a0
jmp 0xa54c3
mov esi, 0x1505
jmp 0xa54c3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0xa5564
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xa54f4
inc ebp
dec ebx
je 0xa555f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0xa555f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0xa54f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.000ad830
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xa54f0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.000ad850
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xa54f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0xa555f
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0xa5564
mov edi, dword [eax + 8]
jmp 0xa5564
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret