joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push esi
mov eax, ecx
push edi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002c730
sub eax, esi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x1002c754
movsx esi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, esi
cmp ecx, eax
jne 0x1002c744
mov eax, dword [ebx + 0x20]
mov edi, eax
and edi, edx
cmp dword [ebx + 0x24], edi
ja 0x1002c769
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add edi, ecx
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + edi*8]
nop
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x1002c783
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x1002c7fe
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x1002c7a5
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.1011db46
add esp, 8
test eax, eax
je 0x1002c7af
mov esi, dword [esi]
jmp 0x1002c770
push 0x80004005
call fcn.10002670
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x1002c7c5
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x1002c7e7
mov eax, dword [esi + 8]
test eax, eax
je 0x1002c7a5
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
push eax
push ecx
call fcn.1011db46
add esp, 8
test eax, eax
jne 0x1002c7e7
mov esi, dword [esi]
jmp 0x1002c7b2
mov ecx, dword [ebp - 4]
cmp ecx, esi
je 0x1002c7fe
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 4], esi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1002ca60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov al, byte [ecx]
push esi
push edi
mov esi, 0x811c9dc5
test al, al
je 0x1002ca92
lea edx, [eax - 0x41]
inc ecx
cmp dl, 0x19
ja 0x1002ca81
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x1002ca76
mov eax, dword [ebx + 0x20]
mov edi, eax
and edi, esi
cmp dword [ebx + 0x24], edi
ja 0x1002caa7
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add edi, ecx
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + edi*8]
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x1002cac3
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x1002cb43
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x1002cae5
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.1011dd71
add esp, 8
test eax, eax
je 0x1002caf2
mov esi, dword [esi]
jmp 0x1002cab0
push 0x80004005
mov dword [ebp - 4], esi
call fcn.10002670
mov eax, dword [esi + 8]
mov dword [ebp - 4], esi
test eax, eax
jne 0x1002cb06
push 0x80004005
call fcn.10002670
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.1011dd71
add esp, 8
test eax, eax
je 0x1002cb31
mov edx, dword [ebx + 4]
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 8]
pop edi
mov dword [ebp - 4], esi
mov dword [eax], edx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1002cb60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov al, byte [ecx]
push esi
push edi
mov esi, 0x811c9dc5
test al, al
je 0x1002cb92
lea edx, [eax - 0x41]
inc ecx
cmp dl, 0x19
ja 0x1002cb81
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x1002cb76
mov eax, dword [ebx + 0x20]
mov edi, eax
and edi, esi
cmp dword [ebx + 0x24], edi
ja 0x1002cba7
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add edi, ecx
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + edi*8]
lea ecx, [ecx]
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x1002cbc3
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x1002cc3e
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x1002cbe5
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.1011dd71
add esp, 8
test eax, eax
je 0x1002cbef
mov esi, dword [esi]
jmp 0x1002cbb0
push 0x80004005
call fcn.10002670
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x1002cc05
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x1002cc27
mov eax, dword [esi + 8]
test eax, eax
je 0x1002cbe5
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
push eax
push ecx
call fcn.1011dd71
add esp, 8
test eax, eax
jne 0x1002cc27
mov esi, dword [esi]
jmp 0x1002cbf2
mov ecx, dword [ebp - 4]
cmp ecx, esi
je 0x1002cc3e
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 4], esi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1002ce20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 8]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002ce31
sub eax, ebx
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x1002ce55
movsx ebx, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, eax
jne 0x1002ce45
mov ecx, dword [edi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [edi + 0x24], eax
ja 0x1002ce6a
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [edi + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x1002ce93
cmp dword [ecx], esi
jne 0x1002ce8b
mov edx, dword [edi + 4]
mov dword [ecx], edx
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0x10]
mov dword [edx + eax*8 + 4], ecx
jmp 0x1002ce9b
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x1002ce9b
cmp dword [ecx], esi
jne 0x1002ce9e
mov edx, dword [esi]
mov dword [ecx], edx
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
mov ebx, esi
cmp esi, dword [edi + 4]
je 0x1002cece
mov edx, dword [esi + 4]
mov dword [edx], ecx
mov edx, dword [esi + 4]
mov ecx, dword [ebx]
lea esi, [ebx + 8]
mov dword [ecx + 4], edx
call fcn.1001b330
push ebx
call fcn.1011baa9
mov ecx, dword [ebp - 4]
add esp, 4
dec dword [edi + 8]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1002cf70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 8]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002cf80
sub eax, ebx
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x1002cfa4
movsx ebx, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, eax
jne 0x1002cf94
mov ecx, dword [esi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [esi + 0x24], eax
ja 0x1002cfb9
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [esi + 0x10]
cmp dword [ecx + eax*8 + 4], edi
lea ecx, [ecx + eax*8]
jne 0x1002cfe2
cmp dword [ecx], edi
jne 0x1002cfda
mov edx, dword [esi + 4]
mov dword [ecx], edx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x1002cfea
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1002cfea
cmp dword [ecx], edi
jne 0x1002cfed
mov edx, dword [edi]
mov dword [ecx], edx
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi]
cmp edi, dword [esi + 4]
je 0x1002d014
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, edi
call fcn.1002db00
push edi
call fcn.1011baa9
add esp, 4
dec dword [esi + 8]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ebx
pop ebx
pop ebp
ret 8
Function at 0x1002d020
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 8]
mov al, byte [ecx]
mov edx, 0x811c9dc5
test al, al
je 0x1002d052
lea ebx, [eax - 0x41]
inc ecx
cmp bl, 0x19
ja 0x1002d041
add al, 0x20
imul edx, edx, 0x1000193
movsx eax, al
xor edx, eax
mov al, byte [ecx]
test al, al
jne 0x1002d036
mov ecx, dword [esi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [esi + 0x24], eax
ja 0x1002d067
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [esi + 0x10]
cmp dword [ecx + eax*8 + 4], edi
lea ecx, [ecx + eax*8]
jne 0x1002d090
cmp dword [ecx], edi
jne 0x1002d088
mov edx, dword [esi + 4]
mov dword [ecx], edx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x1002d098
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1002d098
cmp dword [ecx], edi
jne 0x1002d09b
mov edx, dword [edi]
mov dword [ecx], edx
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi]
cmp edi, dword [esi + 4]
je 0x1002d0c2
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, edi
call fcn.1002db60
push edi
call fcn.1011baa9
add esp, 4
dec dword [esi + 8]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ebx
pop ebx
pop ebp
ret 8
Function at 0x1002de00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
mov eax, ecx
push edi
mov dword [esp + 0x14], esi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002de20
sub eax, edi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x1002de44
movsx edi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, edi
cmp ecx, eax
jne 0x1002de34
mov eax, dword [esi + 0x20]
mov ebx, eax
and ebx, edx
cmp dword [esi + 0x24], ebx
ja 0x1002de59
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 4]
mov ecx, dword [eax + ebx*8]
lea edx, [esi + 4]
lea eax, [eax + ebx*8]
mov dword [esp + 0x10], edx
cmp edi, ecx
je 0x1002dea9
mov eax, dword [eax + 4]
mov edi, dword [eax]
cmp edi, ecx
je 0x1002dea9
lea esp, [esp]
mov edi, dword [edi + 4]
mov eax, dword [edi + 8]
test eax, eax
je 0x1002def8
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.1011db46
add esp, 8
test eax, eax
je 0x1002deef
mov edx, dword [esi + 0x10]
cmp edi, dword [edx + ebx*8]
jne 0x1002de80
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp edi, eax
je 0x1002decc
push eax
push ecx
push edi
mov eax, 1
mov esi, edx
call fcn.1002d8f0
mov ecx, dword [ebp + 0x10]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x14], eax
lea eax, [edx + ebx*8]
mov edx, dword [eax]
mov dword [esp + 0x10], ecx
cmp edx, dword [esp + 0x14]
jne 0x1002df3b
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov dword [eax + ebx*8 + 4], ecx
jmp 0x1002df61
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x1002df02
push 0x80004005
call fcn.10002670
mov ecx, dword [edi + 8]
push eax
push ecx
call fcn.1011db46
add esp, 8
test eax, eax
je 0x1002df17
mov edi, dword [edi]
jmp 0x1002dea5
mov ecx, dword [ebp + 0x10]
mov ebx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.1002d370
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, edi
jne 0x1002df43
mov dword [eax], ecx
jmp 0x1002df61
mov edx, dword [eax + 4]
mov ecx, dword [edx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x10]
je 0x1002df61
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, esi
call fcn.1002e340
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002df80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
mov eax, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002dfa0
sub eax, edi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x1002dfc4
movsx edi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, edi
cmp ecx, eax
jne 0x1002dfb4
mov eax, dword [esi + 0x20]
mov ebx, eax
and ebx, edx
cmp dword [esi + 0x24], ebx
ja 0x1002dfd9
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + ebx*8]
mov edi, dword [esi + 4]
lea eax, [edx + ebx*8]
lea edx, [esi + 4]
mov dword [esp + 0x14], edx
cmp edi, ecx
je 0x1002e035
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov edi, eax
mov dword [esp + 0x10], eax
cmp edi, ecx
je 0x1002e035
nop
mov esi, dword [edi + 4]
mov eax, dword [esi + 8]
mov dword [esp + 0x10], esi
test eax, eax
je 0x1002e082
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
push eax
push ecx
call fcn.1011db46
add esp, 8
test eax, eax
je 0x1002e07c
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x10]
mov edi, esi
cmp esi, dword [edx + ebx*8]
jne 0x1002e000
mov esi, ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp edi, eax
je 0x1002e058
push eax
push ecx
push edi
mov eax, 1
mov esi, edx
call fcn.1002d960
mov ecx, dword [ebp + 0x10]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x10]
mov esi, dword [eax + ebx*8]
lea eax, [eax + ebx*8]
mov dword [esp + 0x14], ecx
cmp esi, dword [edx]
jne 0x1002e0ce
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x10]
mov eax, dword [esp + 0x14]
mov dword [edx + ebx*8 + 4], eax
jmp 0x1002e0f8
mov eax, dword [edi]
test eax, eax
jne 0x1002e08c
push 0x80004005
call fcn.10002670
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.1011db46
add esp, 8
test eax, eax
je 0x1002e0ab
mov eax, dword [esi]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov edi, eax
jmp 0x1002e031
mov ecx, dword [ebp + 0x10]
mov edi, dword [esp + 0x14]
push ecx
lea ebx, [esp + 0x18]
call fcn.1002d3c0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, edi
jne 0x1002e0d6
mov dword [eax], ecx
jmp 0x1002e0f8
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x14]
je 0x1002e0f8
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, dword [esp + 0xc]
call fcn.1002e410
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002e120
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov ecx, dword [eax]
mov al, byte [ecx]
push ebx
push esi
push edi
mov dword [esp + 0x10], edx
mov esi, 0x811c9dc5
test al, al
je 0x1002e15e
lea ebx, [eax - 0x41]
inc ecx
cmp bl, 0x19
ja 0x1002e14d
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x1002e142
mov eax, dword [edx + 0x20]
mov ebx, eax
and ebx, esi
cmp dword [edx + 0x24], ebx
ja 0x1002e173
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8]
mov esi, dword [edx + 4]
lea eax, [eax + ebx*8]
lea edi, [edx + 4]
cmp esi, ecx
je 0x1002e1b8
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, ecx
je 0x1002e1b8
mov esi, dword [esi + 4]
mov eax, dword [esi + 8]
test eax, eax
je 0x1002e201
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.1011dd71
add esp, 8
test eax, eax
je 0x1002e1f8
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
cmp esi, dword [eax + ebx*8]
jne 0x1002e18f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp esi, eax
je 0x1002e1d4
push eax
push ecx
push esi
mov ecx, edi
mov edx, edi
call fcn.1002e5b0
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + ebx*8]
lea eax, [eax + ebx*8]
mov dword [esp + 0x14], ecx
cmp edx, dword [edi]
jne 0x1002e243
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x10]
mov eax, dword [esp + 0x14]
mov dword [edx + ebx*8 + 4], eax
jmp 0x1002e26d
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x1002e20b
push 0x80004005
call fcn.10002670
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.1011dd71
add esp, 8
test eax, eax
je 0x1002e224
mov esi, dword [esi]
mov edx, dword [esp + 0x10]
jmp 0x1002e1b8
mov edx, dword [ebp + 0x10]
push edx
lea ebx, [esp + 0x18]
call fcn.1002d410
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, esi
jne 0x1002e24b
mov dword [eax], ecx
jmp 0x1002e26d
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x14]
je 0x1002e26d
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, dword [esp + 0x10]
call fcn.1002e4e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002f4f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x20]
push edi
mov edi, ebx
or edi, ecx
cdq
jne 0x1002f560
mov ebx, eax
mov ecx, edx
movzx edx, byte [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [esi], 0
setne al
and edx, 7
mov edi, 2
add eax, eax
add eax, eax
add eax, eax
or eax, edx
movzx edx, byte [ebp + 0x10]
shl eax, 4
and edx, 0xf
or eax, edx
mov edx, dword [ebp + 0x14]
mov dword [esi], eax
xor eax, eax
test edx, edx
setne al
shl eax, 0xf
or dword [esi], eax
test ecx, ecx
ja 0x1002f5a2
jb 0x1002f553
cmp ebx, 0x7e
jae 0x1002f578
movzx ecx, bl
and ecx, 0x7f
shl ecx, 8
or dword [esi], ecx
jmp 0x1002f5ce
cmp ecx, edx
ja 0x1002f509
jb 0x1002f56a
cmp ebx, eax
jae 0x1002f509
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop ebx
pop ebp
ret
test ecx, ecx
ja 0x1002f5a2
jb 0x1002f586
cmp ebx, 0xffff
ja 0x1002f5a2
or dword [esi], 0x7e00
push ebx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
shl edx, 0x10
or dword [esi], edx
mov edi, 4
jmp 0x1002f5cb
mov edi, dword [sym.imp.WS2_32.dll_htonl]
or dword [esi], 0x7f00
push ecx
call edi
push ebx
mov dword [ebp + 0x20], eax
call edi
xor ecx, ecx
or ecx, dword [ebp + 0x20]
mov edx, eax
xor eax, eax
or edx, eax
mov dword [esi + 2], ecx
mov dword [esi + 6], edx
lea edi, [eax + 0xa]
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x1002f5f7
mov eax, dword [edx]
mov dword [edi + esi], eax
xor eax, eax
cmp dword [ebp + 0x1c], eax
jle 0x1002f5f4
mov edi, edi
mov ecx, eax
and ecx, 3
mov bl, byte [ecx + edx]
mov ecx, dword [ebp + 0x18]
xor byte [eax + ecx], bl
inc eax
cmp eax, dword [ebp + 0x1c]
jl 0x1002f5e0
add edi, 4
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
mov dword [eax + 8], ecx
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x1002fb40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1002fb52
sub ecx, esi
add ecx, eax
mov edx, eax
mov esi, 0x811c9dc5
cmp eax, ecx
je 0x1002fb80
jmp 0x1002fb70
movsx ebx, byte [edx]
imul esi, esi, 0x1000193
inc edx
xor esi, ebx
cmp edx, ecx
jne 0x1002fb70
mov edx, dword [edi + 0x20]
mov ecx, edx
and ecx, esi
cmp dword [edi + 0x24], ecx
ja 0x1002fb95
shr edx, 1
or esi, 0xffffffff
sub esi, edx
add ecx, esi
mov edx, dword [edi + 0x10]
mov edi, dword [edi + 4]
lea ecx, [edx + ecx*8]
mov edx, dword [ecx]
mov esi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], esi
jmp 0x1002fbb0
cmp edx, edi
jne 0x1002fbb8
mov ecx, edi
jmp 0x1002fbbd
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x1002fc62
mov ecx, dword [esi + 8]
mov edx, eax
lea ebx, [ebx]
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x1002fbf0
test bl, bl
je 0x1002fbec
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x1002fbf0
add ecx, 2
add edx, 2
test bl, bl
jne 0x1002fbd0
xor ecx, ecx
jmp 0x1002fbf5
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x1002fc03
mov esi, dword [esi]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
jmp 0x1002fbb0
mov edx, dword [esi + 8]
mov dword [ebp - 4], esi
mov ecx, eax
jmp 0x1002fc10
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x1002fc30
test bl, bl
je 0x1002fc2c
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x1002fc30
add ecx, 2
add edx, 2
test bl, bl
jne 0x1002fc10
xor ecx, ecx
jmp 0x1002fc35
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x1002fc4f
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
pop edi
lea ecx, [ebp - 0xc]
mov edx, dword [ecx]
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop edi
lea ecx, [ebp - 4]
mov edx, dword [ecx]
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ebp - 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4