joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565316
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
add dl, cl
jnp 0x565330
mov edx, dword [esp]
jmp 0x56531a
mov ecx, ebp
jmp 0x5652f9
rdtsc
mov edx, 0xb8b67a80
add edx, 0x95335ab6
jmp 0x565466
mov edx, dword [esp]
rdtsc
mov edx, 0xb8b67a80
add edx, 0x95335ab6
xchg ah, bl
call fcn.00565380
imul esi, ebp, 0x43ff0c65
xchg edi, eax
dec byte [edi - 0x72fddbbc]
and al, 2
xchg ah, bl
jmp 0x565342

Function at 0x58aecf
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x16
jmp 0x58aed8
lea ebx, reloc.WINMM.dll_midiStreamStop
push esp
jmp 0x58af3b
lea esp, [esp + 2]
jmp 0x58af25
mov eax, edi
bsr di, cx
xchg di, dx
jmp 0x58aff8
pop word [esp]
lea esp, [esp + 2]
lea esp, [esp + 4]
lea esp, [esp + 0x40]
jmp 0x5578a7
mov edi, edx
call 0x58af73
jns 0x58af95
int1
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x58afb9
mov byte [esp], ah
lea edi, [esi + edi]
mov di, 0x2436
mov di, 0x2436
lea esp, [esp + 1]
shr ecx, 8
jmp 0x58af6b
shr edi, 0x10
jmp 0x58afd4
mov ecx, dword [ecx*4 + reloc.WINMM.dll_midiStreamStop]
sub esp, 0x1e
push word [esp + 5]
pop word [esp + 0x11]
pop word [esp + 0xc]
jmp 0x58afa3
and edi, esi
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
lea esp, [esp + 0x58]
jmp 0x58b04f
mov edx, dword [eax + 0xc]
setl cl
mov ecx, edx
sub esp, 0x15
jmp 0x58af90
bswap edi
call fcn.0058b005
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
lea edi, [ebp*4]
jmp 0x58b01b

Function at 0x58af73
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x16
jmp 0x58aed8
lea ebx, reloc.WINMM.dll_midiStreamStop
push esp
jmp 0x58af3b
lea esp, [esp + 2]
jmp 0x58af25
mov eax, edi
bsr di, cx
xchg di, dx
jmp 0x58aff8
pop word [esp]
lea esp, [esp + 2]
lea esp, [esp + 4]
lea esp, [esp + 0x40]
jmp 0x5578a7
mov edi, edx
call 0x58af73
jns 0x58af95
int1
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x58afb9
mov byte [esp], ah
lea edi, [esi + edi]
mov di, 0x2436
mov di, 0x2436
lea esp, [esp + 1]
shr ecx, 8
jmp 0x58af6b
shr edi, 0x10
jmp 0x58afd4
mov ecx, dword [ecx*4 + reloc.WINMM.dll_midiStreamStop]
sub esp, 0x1e
push word [esp + 5]
pop word [esp + 0x11]
pop word [esp + 0xc]
jmp 0x58afa3
and edi, esi
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
lea esp, [esp + 0x58]
jmp 0x58b04f
mov edx, dword [eax + 0xc]
setl cl
mov ecx, edx
sub esp, 0x15
jmp 0x58af90
bswap edi
call fcn.0058b005
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
lea edi, [ebp*4]
jmp 0x58b01b

Function at 0x58b005
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
jmp 0x58b038
and edx, esi
call fcn.0058b022
sbb al, 0x99
or dword [eax - 0x65], ebp
pop ebx
jle 0x58b041
push 0x5b3ffa0f
mov dl, 0xad
mov esp, 0xe181
inc dword [eax]
Function at 0x58b022
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
push word [esp + 1]
pop word [esp]
jmp 0x58b091
movzx edi, byte [edi*4 + 0x562b08]
xor ecx, edi
stc
and edx, ebp
jmp 0x58b079
xor ecx, edx
mov edx, dword [esp]
bswap edx
jmp 0x58b0b7
lea esp, [esp + 3]
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
shr edi, 0x18
jmp 0x58b066
lea esp, [esp + 4]
xor ecx, dword [ebx]
or dx, si
pushal
call fcn.0058b0a1
lea esp, [esp + 0x24]
lea edi, [eax + 0x10]
mov edx, dword [esp]
jmp 0x58b8b2
mov dword [eax + 0x14], edx
call int.0058b0fb
lea esp, [esp + 4]
pop ebp
bswap ebx
setge bl
jmp 0x58b1de
pop ebx
ret
mov edx, dword [eax + 4]
xor edx, ecx
bt cx, sp
mov ch, al
xchg ch, cl
jmp 0x58b1a8
add ebx, 4
mov dword [edi], ecx
mov dx, 0xc996
lea edx, [eax - 0xb8]
jmp 0x58b316
xor ecx, dword [eax]
lea edx, [ecx + ebp]
bswap edx
bt edx, ecx
jmp 0x58b390
Function at 0x58b2d1
Capabilities:
Encrypt data using aes

Disassembly:
cmp eax, 1
pushal
jmp 0x58b3f2
lea ebx, reloc.WINMM.dll_midiStreamStop
inc edi
lea edi, [eax + esi]
jmp 0x58b487
mov edi, dword [esp]
lea esi, reloc.WINMM.dll_midiStreamStop
jmp 0x58b9d4
not ax
xchg di, ax
jmp 0x58b22c
mov eax, dword [edi]
pop edi
call 0x58b2d1
push esi
mov word [esp + 1], ax
mov dword [esp], esi
add esp, 2
lea esp, [esp + 2]
jmp 0x58b2f8
lea esp, [esp + 3]
lea esp, [esp + 1]
popal
add edi, 0xfffffffc
jmp 0x58b2c8
push ebx
mov ebx, edx
add ebx, 0xfffffff8
jmp 0x58b356
mov eax, dword [edx]
stc
sub esp, 0x1f
lea esp, [esp + 0xe]
lea esp, [esp + 1]
jmp 0x58b378
mov dword [ecx - 4], eax
mov eax, edi
setle al
lea eax, reloc.WINMM.dll_midiStreamStop
jmp 0x58b328
mov dword [ebx], edi
pop ebx
bsr di, si
mov edi, dword [ecx - 4]
jmp 0x58b33e
mov edi, dword [ecx]
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x58b821
mov dword [edx - 4], edi
lea edi, [esi*4]
ror di, cl
bswap edi
mov di, bp
jmp 0x58b362
add ecx, 0x10
sub esp, 0x10
mov word [esp + 0xd], bp
jmp 0x58b3dc
mov dword [edx + 4], edi
lea esp, [esp + 0x58]
sub ebx, 4
jmp 0x58b3a4
jl 0x558006
lea eax, [eax*4]
not eax
jmp 0x58b3e8
lea esp, [esp + 0x10]
sub edx, 0x10
cmp dword [ebp - 4], ebx
jmp 0x58b3c6
mov ah, 0xd2
mov eax, dword [ebp - 8]
jmp 0x557f81
mov word [esp + 0xd], di
lea esp, [esp + 0x20]
jle 0x557fbe
xchg ecx, edx
mov bl, byte [esp]
jmp 0x58b434
mov edi, ecx
add edi, 4
mov dword [edi], eax
pop edi
jmp 0x58b3ba
mov dword [ebp - 4], ecx
xchg ch, dl
xchg cx, dx
jmp 0x58b473
lea edi, [ecx + esi]
mov dx, di
lea ecx, [eax - 1]
inc dl
pushal
jmp 0x58b41e
lea esp, [esp + 0x20]
jmp 0x557fa7
add ecx, 0x95d3e08e
cmc
lea esp, [esp + 0xc]
jmp 0x58b442
mov ecx, 0x6a2c2071
pushfd
push word [esp + 1]
sub esp, 8
lea esp, [esp + 2]
jmp 0x58b458
movzx ebx, byte [esi + 0x11]
rol edi, 0xa
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
neg edx
call 0x58b501
mov di, bx
jmp 0x58b4d4
mov edi, ebx
mov edi, dword [ecx + 4]
pushal
push edi
jmp 0x58b414
mov edx, dword [esi]
bts edi, ebx
jmp 0x58b4e3
lea esp, [esp + 4]
add esi, 0x10
mov edx, edi
mov di, word [esp]
jmp 0x58b4be
mov edi, edx
call 0x58b4eb
cmp al, cl
out dx, eax
sbb bl, ch
jno 0x58b500
xchg ebp, eax
add eax, 0x9f2e9f6c
push es
xchg esp, eax
push cs
mov edx, 0x88691e37
sub ebp, ebx
cdq
push ebx
mov ebx, edx
mov dword [ebx], edi
pop ebx
jmp 0x58b4b2
mov dword [ecx], eax
lea eax, [ebx*4]
sub al, 0xc9
mov eax, dword [edx + 4]
jmp 0x58b5d0
lea esp, [esp + 4]
pop esi
lea ebx, [edx + edi]
not ebx
mov bl, al
jmp 0x58ba12
pop ebx
leave
ret
Function at 0x58b2e7
Capabilities:
Encrypt data using aes

Disassembly:
cmp eax, 1
pushal
jmp 0x58b3f2
lea ebx, reloc.WINMM.dll_midiStreamStop
inc edi
lea edi, [eax + esi]
jmp 0x58b487
mov edi, dword [esp]
lea esi, reloc.WINMM.dll_midiStreamStop
jmp 0x58b9d4
not ax
xchg di, ax
jmp 0x58b22c
mov eax, dword [edi]
pop edi
call 0x58b2d1
push esi
mov word [esp + 1], ax
mov dword [esp], esi
add esp, 2
lea esp, [esp + 2]
jmp 0x58b2f8
lea esp, [esp + 3]
lea esp, [esp + 1]
popal
add edi, 0xfffffffc
jmp 0x58b2c8
push ebx
mov ebx, edx
add ebx, 0xfffffff8
jmp 0x58b356
mov eax, dword [edx]
stc
sub esp, 0x1f
lea esp, [esp + 0xe]
lea esp, [esp + 1]
jmp 0x58b378
mov dword [ecx - 4], eax
mov eax, edi
setle al
lea eax, reloc.WINMM.dll_midiStreamStop
jmp 0x58b328
mov dword [ebx], edi
pop ebx
bsr di, si
mov edi, dword [ecx - 4]
jmp 0x58b33e
mov edi, dword [ecx]
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x58b821
mov dword [edx - 4], edi
lea edi, [esi*4]
ror di, cl
bswap edi
mov di, bp
jmp 0x58b362
add ecx, 0x10
sub esp, 0x10
mov word [esp + 0xd], bp
jmp 0x58b3dc
mov dword [edx + 4], edi
lea esp, [esp + 0x58]
sub ebx, 4
jmp 0x58b3a4
jl 0x558006
lea eax, [eax*4]
not eax
jmp 0x58b3e8
lea esp, [esp + 0x10]
sub edx, 0x10
cmp dword [ebp - 4], ebx
jmp 0x58b3c6
mov ah, 0xd2
mov eax, dword [ebp - 8]
jmp 0x557f81
mov word [esp + 0xd], di
lea esp, [esp + 0x20]
jle 0x557fbe
xchg ecx, edx
mov bl, byte [esp]
jmp 0x58b434
mov edi, ecx
add edi, 4
mov dword [edi], eax
pop edi
jmp 0x58b3ba
mov dword [ebp - 4], ecx
xchg ch, dl
xchg cx, dx
jmp 0x58b473
lea edi, [ecx + esi]
mov dx, di
lea ecx, [eax - 1]
inc dl
pushal
jmp 0x58b41e
lea esp, [esp + 0x20]
jmp 0x557fa7
add ecx, 0x95d3e08e
cmc
lea esp, [esp + 0xc]
jmp 0x58b442
mov ecx, 0x6a2c2071
pushfd
push word [esp + 1]
sub esp, 8
lea esp, [esp + 2]
jmp 0x58b458
movzx ebx, byte [esi + 0x11]
rol edi, 0xa
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
neg edx
call 0x58b501
mov di, bx
jmp 0x58b4d4
mov edi, ebx
mov edi, dword [ecx + 4]
pushal
push edi
jmp 0x58b414
mov edx, dword [esi]
bts edi, ebx
jmp 0x58b4e3
lea esp, [esp + 4]
add esi, 0x10
mov edx, edi
mov di, word [esp]
jmp 0x58b4be
mov edi, edx
call 0x58b4eb
cmp al, cl
out dx, eax
sbb bl, ch
jno 0x58b500
xchg ebp, eax
add eax, 0x9f2e9f6c
push es
xchg esp, eax
push cs
mov edx, 0x88691e37
sub ebp, ebx
cdq
push ebx
mov ebx, edx
mov dword [ebx], edi
pop ebx
jmp 0x58b4b2
mov dword [ecx], eax
lea eax, [ebx*4]
sub al, 0xc9
mov eax, dword [edx + 4]
jmp 0x58b5d0
lea esp, [esp + 4]
pop esi
lea ebx, [edx + edi]
not ebx
mov bl, al
jmp 0x58ba12
pop ebx
leave
ret

Function at 0x58b5db
Capabilities:
Encrypt data using aes

Disassembly:
pushal
jmp 0x58b6e8
add esp, 0x12
call fcn.0058b613
mov edx, dword [esi]
pop esi
pushfd
and edx, ecx
sub esp, 0x1c
jmp 0x58b636
push esi
mov esi, edx
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_midiStreamStop
jmp 0x58b686

Function at 0x58b613
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 0x34]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
sub esp, 1
jmp 0x58b5fd
Function at 0x58b7bd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp]
call fcn.0058b7a7
lea esp, [esp + 2]
push eax
mov eax, edi
jmp 0x58b808
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x58b7f2
lea eax, [eax*4]
lea eax, reloc.WINMM.dll_midiStreamStop
mov edi, dword [eax]
pop eax
push ecx
jmp 0x58b7cf
Function at 0x58b986
Capabilities:
Encrypt data using aes

Disassembly:
push edi
mov edi, esi
jmp 0x58b6c6
add edi, 6
movzx ebx, byte [edi]
pop edi
sub esp, 2
add esp, 1
jmp 0x58b793
clc
jmp 0x58b730
movzx ebx, byte [esi + 9]
stc
and edx, ecx
clc
jmp 0x58b6fa
lea edx, [esi + ebp]
jmp 0x58b742
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
and edx, ecx
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x58b71a
mov edx, dword [esi + 8]
push ebx
mov ebx, esi
jmp 0x58b770
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
lea edi, [ebx + edi]
jmp 0x58b7e7
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
stc
jmp 0x58b710
add ebx, 4
mov dword [ebx], edi
pop ebx
bsf di, ax
bsf edi, esp
jmp 0x58b74a
lea esp, [esp + 1]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
stc
push di
lea esp, [esp + 2]
jmp 0x58b760
mov edi, edx
cmc
shr edi, 0x18
call fcn.0058b7bd
and edi, ecx
clc
cmc
push ebx
jmp 0x58b862
movzx ebx, byte [esi + 0xa]
stc
stc
jmp 0x58b884
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
dec ebx
jmp 0x58b834
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
and ebx, ecx
push ebx
jmp 0x58b84a
and ebx, ecx
jmp 0x58b895
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
push eax
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x58b86e
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
bsf ebx, eax
not ebx
inc bh
jmp 0x58bb9a
mov edi, edx
jmp 0x58b8fe
mov dword [esi + 8], edi
dec edi
mov di, 0xc6e3
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x58b8c1
mov bx, cx
bsf si, di
mov cl, byte [esp]
mov ch, dh
mov dword [esp + 8], edi
jmp 0x58b91b
shr edi, 0x18
push ebp
pushal
jmp 0x58b8e8
pop ebp
push edi
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x58b92f
clc
popal
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamStop
mov edi, dword [ebp]
jmp 0x58b905
and edi, ecx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x58b967
mov ebx, esi
add ebx, 0xc
mov edx, dword [ebx]
pop ebx
jmp 0x58b8d7
mov ebx, dword [esp]
mov bh, byte [esp]
jmp 0x58b979
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
mov bl, byte [esp]
jmp 0x58b951
movzx ebx, byte [esi + 0xe]
sub esp, 0x1c
call 0x58b986
mov esi, 0x5244488
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x58baff
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
push ebx
jmp 0x58b947
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
pushfd
push word [esp + 2]
call fcn.0058ba3d
jg 0x58ba09
int1
invalid
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
and edx, ecx
jmp 0x58b9af
lea esp, [esp + 0x24]
jne 0x557fa7
je 0x557fbe
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte ss:[esi]
ret
dec ebp
cld
push esp
mov dword [esi + 0xc], edi
pushal
jmp 0x58b9ea
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
and ebx, ecx
jmp 0x58b9c5
and edx, ecx
sub esp, 9
sub esp, 0x1c
sub esp, 0x16
lea esp, [esp + 3]
jmp 0x58b9a1
movzx ebx, byte [esi + 0xd]
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x58bb52
Function at 0x58ba3d
Capabilities:
Encrypt data using aes

Disassembly:
dec dword [ebp - 4]
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp 0x58ba08
Function at 0x6413f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 7]
xchg dword [esp + 9], ecx
pop eax
jmp 0x64121a

Function at 0x6419a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dx
xchg byte [esp + 0xd], ch
btr ax, bx
jmp 0x6419b2
pop cx
push ebp
inc ah
mov edx, dword [esp + 0x10]
neg ecx
mov cl, byte [esp + 8]
jmp 0x641a0d
xchg byte [esp + 0xa], al
mov cx, 0x7ab2
rol dh, 2
push edx
cld
xchg byte [esp + 0x22], ch
jmp 0x641a33
rdtsc
mov cx, 0x131
mov word [esp + 9], bx
mov edx, dword [esp + 0xb]
cld
pushfd
call fcn.00641a1d
jle 0x641a55
call 0xf5a19e
add byte [eax], al
lea eax, [edi + 0x91]
rcl cl, cl
rdtsc
pushal
cmc
neg edx
jmp 0x6419e1
clc
mov eax, dword [esp + 0x1e]
mov al, 0x2b
xchg ch, cl
mov ah, 0xdf
xchg cl, dl
jmp 0x6419f4
xchg al, dh
jmp 0x641b68
mov dword [esp + 4], esi
xchg ecx, edx
pop dword [esp + 2]
push word [esp + 9]
jmp 0x641abb
lea edx, [edx + edi]
xchg ecx, eax
rdtsc
mov edx, 0x269ad840
xchg cl, ch
mov edx, dword [esp + 0xb]
jmp 0x641a79
bswap ecx
not cx
mov dh, 0x6e
mov word [esp + 5], ax
mov ecx, ebp
xchg dword [esp + 5], eax
jmp 0x641a8f
lea eax, [eax + edx]
mov ax, bx
pop cx
lea eax, [esi*4]
lea edx, [esp + ebp]
setle cl
jmp 0x641b03
pop eax
pop word [esp + 0xf]
cmc
lea edx, reloc.WINMM.dll_midiStreamStop
pop word [esp + 3]
clc
jmp 0x641aa7
push dword [esp + 8]
mov ah, byte [esp + 4]
lea ecx, [ecx + ebx]
jmp 0x641b2d
lea ecx, [esp + edi]
inc ax
mov dword [esp + 1], ebp
xchg dword [esp + 6], edx
mov ecx, dword [esp]
bswap edx
jmp 0x641aed
mov cx, word [esp + 3]
mov word [esp + 0xc], cx
pop word [esp + 0xb]
jmp 0x641b44
lea ecx, [edi*4]
bsf edx, esi
mov cx, ax
mov dword [esp + 1], esp
mov cl, 0x2a
bswap edx
jmp 0x641b17
mov byte [esp + 7], dl
stc
xchg cx, ax
mov eax, 0x4bea9af3
clc
lea esp, [esp + 0xb]
jmp 0x641f4f
lea esp, [esp]
push sp
or ax, si
pop dx
lea ecx, [ecx + edi]
sub esp, 0x17
jmp 0x641ad8

Function at 0x641b7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 2
bsr ax, bp
not edx
jmp 0x641bb5
mov cx, word [esp + 0x13]
lea edx, [eax + 0xcf]
push word [esp + 3]
mov eax, 0xb314644e
mov cx, di
lea eax, [edi*4]
jmp 0x641b9f

Function at 0x64602d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.00645027
push word [esp]
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
jmp 0x64606f
pop word [esp]
mov byte [esp], cl
jmp 0x646017
mov eax, dword [eax]
jmp 0x64607d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x646059
mov eax, dword [eax + 8]
push eax
jmp 0x645022
Function at 0x402bb0
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test ecx, ecx
je 0x402c98
test edx, edx
je 0x402c98
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], ecx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402bfa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402c01
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402be0
jmp 0x402c03
mov esi, 0x1505
jmp 0x402c03
mov esi, ecx
mov dword [esp + 4], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
mov dword [esp + 0x10], edx
jb 0x402c91
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402c34
inc ebx
dec ebp
je 0x402c8f
mov eax, ebx
and eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x402c8f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402c30
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.004098f0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402c30
push dword [esp + 0x28]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00409910
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402c30
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402c91
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402ca0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402da1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402da1
push ebx
call fcn.004098f0
add esp, 4
test eax, eax
je 0x402cfa
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402d01
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402ce0
jmp 0x402d03
mov esi, 0x1505
jmp 0x402d03
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x402da1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x402d34
inc ebp
dec ebx
je 0x402d9f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x402d9f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402d30
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.004098f0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402d30
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409910
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402d30
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402d9f
cmp dword [eax + 4], 2
mov edi, 0
jne 0x402da1
mov edi, dword [eax + 8]
jmp 0x402da1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402dd0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x402e3b
mov esi, dword [esp + 0x30]
test esi, esi
je 0x402e3b
push esi
call fcn.004098f0
add esp, 4
test eax, eax
je 0x402e1a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402e21
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402e00
jmp 0x402e23
mov ebp, 0x1505
jmp 0x402e23
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x402e47
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x402e64
inc ebx
dec edi
je 0x402e3b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x402e3b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x402e60
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.004098f0
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x402e60
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.00409910
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x402e60
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x402e3b
cmp dword [eax + 4], 3
jne 0x402e3b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x402e3b

Function at 0x402f00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x403001
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x403001
push ebx
call fcn.004098f0
add esp, 4
test eax, eax
je 0x402f5a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402f61
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402f40
jmp 0x402f63
mov esi, 0x1505
jmp 0x402f63
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x403001
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x402f94
inc ebp
dec ebx
je 0x402fff
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x402fff
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402f90
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.004098f0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402f90
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409910
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402f90
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402fff
cmp dword [eax + 4], 5
mov edi, 0
jne 0x403001
mov edi, dword [eax + 8]
jmp 0x403001
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403030
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403134
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x403134
push ebx
call fcn.004098f0
add esp, 4
test eax, eax
je 0x40308a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x403091
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x403070
jmp 0x403093
mov esi, 0x1505
jmp 0x403093
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x403134
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4030c4
inc ebp
dec ebx
je 0x40312f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40312f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4030c0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.004098f0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4030c0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409910
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4030c0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40312f
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x403134
mov edi, dword [eax + 8]
jmp 0x403134
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret