joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100369a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10036a13
cmp ecx, eax
jne 0x10036a0b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10036a1b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10036a1b
cmp ecx, eax
jne 0x10036a1b
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [edi + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.10036e90
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x1003b0b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc9d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x1003b0f4
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x1003b112
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x1003b100
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x1003b1a4
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x1003b1a4
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x1003b14a
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x1003b154
mov ecx, dword [edi]
push edx
push eax
push dword [edi + 0x10]
push ecx
call fcn.1003b260
add esp, 0x10
test al, al
mov eax, dword [ebp + 0xc]
je 0x1003b135
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + 4]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.1003b800
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1003b1d1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1003b1eb
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1003b20d
cmp eax, esi
jne 0x1003b1f3
mov dword [ecx], edi
jmp 0x1003b20d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1003b20d
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1003b760
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003bd70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x1003bd8b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x1003bda7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1003bd96
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x1003bde0
cmp eax, edi
jne 0x1003bdd8
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x1003bde8
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1003bde8
cmp eax, edi
jne 0x1003bdeb
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.1003b800
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1003be20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], ebx
jb 0x1003be3f
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1003be61
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1003be50
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x1003be8b
mov eax, ebx
jmp 0x1003be8f
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1003befa
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x1003bea0
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 0x10
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x1003beb6
mov eax, dword [eax]
push dword [ebp - 4]
push ecx
push edx
push eax
call fcn.1003b260
add esp, 0x10
test al, al
jne 0x1003bed2
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x1003be83
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x1003bedd
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x1003bee5
mov edi, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [ebp - 4]
push edi
call fcn.1003b260
add esp, 0x10
test al, al
cmovne ebx, esi
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003d300
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcb40
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x1003d388
mov esi, edx
jmp 0x1003d390
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
nop
cmp esi, eax
je 0x1003d3bb
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x1003d390
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edx]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebx + 4]
push eax
call fcn.1003d2e0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1003d4bc
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1003d42e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x1003d448
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x1003d46b
cmp eax, esi
jne 0x1003d450
mov dword [edx], edi
jmp 0x1003d46b
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x1003d46b
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1003dbb0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.100a5e47
int3
Function at 0x1003d4d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcb60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 4]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x1003d5ab
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
nop
cmp esi, eax
je 0x1003d5ab
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x1003d560
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.100d26ef
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1003d5db
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1003d5f2
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x1003d614
cmp eax, esi
jne 0x1003d5fa
mov dword [ecx], edi
jmp 0x1003d614
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1003d614
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1003dbb0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003dc50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcba0
mov eax, dword fs:[0]
push eax
sub esp, 0xa08
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10cb94d0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10cb2c6c]
cmp eax, dword [ecx + 4]
jg 0x1003ddb1
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
mov edx, dword [0x10cb2c50]
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul esi, ecx, 0x1000193
mov ecx, dword [0x10cb2c58]
and esi, dword [0x10cb2c64]
mov edi, dword [ecx + esi*8]
mov eax, edi
cmp edi, edx
jne 0x1003dcee
mov ecx, edx
jmp 0x1003dcf4
mov ecx, dword [ecx + esi*8 + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003dd1f
cmp dword [eax + 8], ebx
je 0x1003dd07
mov eax, dword [eax]
mov ecx, dword [0x10cb2c58]
jmp 0x1003dce6
cmp eax, edx
je 0x1003dd1f
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
lea eax, [ebp + 8]
mov ecx, 0x10cb2c4c
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1003d300
push 0x198
lea eax, [ebp - 0xa0c]
push 0
push eax
call fcn.100d5410
push 0x85c
lea eax, [ebp - 0x870]
push 0
push eax
call fcn.100d5410
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xa14]
add esp, 0x18
mov dword [ebp - 0xa14], eax
mov ecx, 0x280
mov dword [ebp - 0xa10], 0
mov dword [ebp - 0x874], 0x1003e0b0
push str.attachCaller
sub esp, 0xa00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10006be0
add esp, 0xa04
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10cb2c6c
call fcn.100d28ed
add esp, 4
cmp dword [0x10cb2c6c], 0xffffffff
jne 0x1003dc9b
push 0
push 0
mov ecx, 0x10cb2c50
mov dword [ebp - 4], 0
call fcn.1003db80
mov dword [0x10cb2c50], eax
mov dword [0x10cb2c58], 0
mov dword [0x10cb2c5c], 0
mov dword [0x10cb2c60], 0
push 8
mov ecx, 0x10cb2c4c
mov byte [ebp - 4], 2
mov dword [0x10cb2c4c], 0x3f800000
call fcn.10008b40
push 0x10104270
call fcn.100d255d
push 0x10cb2c6c
mov dword [ebp - 4], 0xffffffff
call fcn.100d28a3
add esp, 8
jmp 0x1003dc9b
Function at 0x1003de50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1003dec3
cmp eax, edi
jne 0x1003debb
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1003decb
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1003decb
cmp eax, edi
jne 0x1003dece
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.100d26ef
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10044b80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x10044b9b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x10044bb7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10044ba6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x10044bf0
cmp eax, edi
jne 0x10044be8
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x10044bf8
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10044bf8
cmp eax, edi
jne 0x10044bfb
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10044820
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10044f50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 8], ebx
jb 0x10044f6f
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10044f91
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10044f80
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebp - 0x10], eax
cmp edx, ebx
jne 0x10044fbb
mov eax, ebx
jmp 0x10044fbf
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10045064
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov edx, edi
jb 0x10044fd4
mov edx, dword [edi]
cmp dword [eax + 0x14], 0x10
mov edi, dword [eax + 0x10]
jb 0x10044fdf
mov eax, dword [eax]
cmp edi, dword [ebp - 8]
jne 0x10045040
sub edi, 4
jb 0x10045001
nop dword [eax]
mov ecx, dword [eax]
cmp ecx, dword [edx]
jne 0x10045006
add eax, 4
add edx, 4
sub edi, 4
jae 0x10044ff0
cmp edi, 0xfffffffc
je 0x1004503a
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x10045033
cmp edi, 0xfffffffd
je 0x1004503a
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x10045033
cmp edi, 0xfffffffe
je 0x1004503a
mov cl, byte [eax + 2]
cmp cl, byte [edx + 2]
jne 0x10045033
cmp edi, 0xffffffff
je 0x1004503a
mov al, byte [eax + 3]
cmp al, byte [edx + 3]
je 0x1004503a
sbb eax, eax
or eax, 1
jmp 0x1004503c
xor eax, eax
test eax, eax
je 0x10045050
mov esi, dword [esi]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x10044fb3
mov ecx, dword [ebp - 4]
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.10044670
test al, al
cmove ebx, esi
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10053800
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
mov eax, ebx
lea edx, [edx + ecx*8]
cmp ebx, esi
jne 0x1005385e
mov ecx, esi
jmp 0x10053863
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10053876
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x10053872
mov eax, dword [eax]
jmp 0x10053856
cmp eax, esi
jne 0x100538ca
mov esi, dword [esi]
lea eax, [ebp + 0xb]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
mov edi, dword [esi + 4]
push eax
push 0x10107bb0
push edi
push esi
lea ecx, [ebx + 4]
call fcn.1001cbd0
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x100538d6
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000a2a0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.100a5e47
int3
Function at 0x10060b40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x1013a098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x80
push 3
push 0
push 1
push 1
push str.RIO.INI
mov dword [ebp - 0x250], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10060bfb
mov ecx, dword [0x10cb8040]
mov edx, ecx
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10060b90
sub edx, esi
sar edx, 1
cmp edx, 3
jbe 0x10060c59
lea esi, [ebp - 0x24c]
sub esi, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x10060bb0
push 0
push 0x80
push 3
push 0
push 1
push 1
lea eax, [ebp - 0x24c]
mov dword [ebp + edx*2 - 0x250], 0x69006e
mov ecx, 0x69
push eax
mov word [ebp + edx*2 - 0x252], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10060c59
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.100d5410
add esp, 0xc
lea eax, [ebp - 0x254]
push 0
push eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x44]
mov byte [ebp - 5], 0
push 0x1010cec0
push eax
call fcn.100d5f10
add esp, 8
test eax, eax
je 0x10060c59
lea ecx, [ebp - 0x250]
add eax, 3
push ecx
push 0x1010cec4
push eax
call fcn.100617d0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x250]
xor ecx, ebp
pop esi
call fcn.100d2719
mov esp, ebp
pop ebp
ret

Function at 0x100642b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x1505
push ebx
push esi
xor esi, esi
mov bl, byte [eax]
push edi
lea edi, [eax + 1]
test bl, bl
je 0x100642f1
nop dword [eax]
mov eax, ecx
lea edi, [edi + 1]
mov edx, esi
shld esi, ecx, 5
shl ecx, 5
add ecx, eax
movzx eax, bl
mov bl, byte [edi - 1]
adc esi, edx
cdq
add ecx, eax
adc esi, edx
test bl, bl
jne 0x100642d0
pop edi
mov edx, esi
mov eax, ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x10076cc0
Capabilities:
Link many functions at runtime
Write clipboard data

Disassembly:
jmp fcn.100964b0
mov ecx, dword [ecx + 4]
jmp 0x10026680