joyce8/EMBER2024-capa huggingface dataset:
Function at 0x632196a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
test byte [0x6321d08c], 8
jne 0x632197b0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [esp + 8], 0x5c
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6321987f
mov dword [eax], str._G_cpy_cp_cpH_c_J_c
lea eax, [eax + 0x34]
lea edi, [ebx + 0x10]
mov dword [eax - 0x30], 0x63224560
mov dword [eax - 0x2c], 0x632244a0
mov dword [eax - 0x28], 0x632244e0
mov dword [eax - 0x24], 0x632243e0
mov dword [eax - 0x20], 0x63224440
mov dword [eax - 0x1c], 1
mov dword [eax + 0x1c], 0
mov dword [eax - 0x18], 0
mov dword [eax - 0x14], 0
mov dword [eax - 0x10], 0
mov dword [eax - 0xc], 0
mov dword [eax - 8], 1
mov dword [eax - 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [ebx + 0x34]
mov edx, dword [ebp + 0xc]
sub esp, 4
mov dword [eax + 0x18], str..._dlls_dplayx_dplobby.c:_IDirectPlayLobbyImpl.lock
lea eax, [ebx + 0x54]
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [ebx + 0x54], 0
mov dword [esp], edi
call dword [eax]
mov esi, eax
mov eax, dword [ebx + 0x10]
sub esp, 0xc
mov dword [esp], edi
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x63219878
mov eax, esi
shr eax, 0x10
je 0x63219860
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], 0x63223918
mov dword [esp + 4], eax
call fcn.632157e0
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x63223af0
mov dword [esp + 0x14], ecx
mov dword [esp + 8], str.dplobby_create
mov dword [esp + 4], 0x6321d08c
mov dword [esp], 3
call fcn.632158a0
jmp 0x632196b9
movzx eax, si
mov dword [esp], 0x63223907
mov dword [esp + 4], eax
call fcn.632157e0
jmp 0x63219825
mov eax, 0x632239d8
jmp 0x63219825
mov esi, 0x8007000e
jmp 0x632197a2
Function at 0x6321a500
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test byte [0x6321d09c], 8
jne 0x6321a590
mov dword [edi], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6321a65f
mov dword [eax], fcn.6321a290
mov dword [eax + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [ebx + 8], eax
call fcn.6321a290
mov esi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x6321a658
mov eax, esi
shr eax, 0x10
je 0x6321a640
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], 0x632245d8
mov dword [esp + 4], eax
call fcn.63219a60
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s___p__n
mov dword [esp + 8], str.dplobbysp_create
mov dword [esp + 4], 0x6321d09c
mov dword [esp], 3
call fcn.63219b20
jmp 0x6321a518
movzx eax, si
mov dword [esp], 0x632245c6
mov dword [esp + 4], eax
call fcn.63219a60
jmp 0x6321a605
mov eax, 0x632245bf
jmp 0x6321a605
mov esi, 0x8007000e
jmp 0x6321a583

Function at 0x6321a670
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
mov edi, dword fs:[0x18]
sub esp, 0x1c
mov eax, dword [eax + 0xc]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x10]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6321a8b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [esp + 4], 8
mov esi, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [edi + 0x10], eax
sub esp, 0xc
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sub.ucrtbase.dll_memcpy
Function at 0x6321a900
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
movzx eax, byte [0x6321d0ac]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test al, 8
jne 0x6321a9b8
test al, 1
jne 0x6321aa64
mov eax, dword [edi + 0x18]
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
add eax, 0x20
mov dword [ebp - 0x24], eax
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [edi + 4]
mov dword [ebp - 0x28], eax
add eax, dword [edi + 0x18]
sub esp, 0xc
mov dword [ebp - 0x20], edx
mov edx, ebx
shr edx, 7
mov dword [eax + 0x1c], ebx
and edx, 1
mov dword [eax], 0x79616c70
mov dword [ebp - 0x1c], edx
mov edx, dword [esi]
mov dword [eax + 4], 0xb0002
mov dword [eax + 8], edx
mov edx, dword [esi + 4]
mov dword [eax + 0x18], 0
mov dword [eax + 0xc], edx
mov edx, dword [esi + 8]
mov dword [eax + 0x10], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0x14], edx
mov eax, dword [edi]
lea edx, [ebp - 0x28]
mov dword [esp], edx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x6321aaa8
mov eax, esi
shr eax, 0x10
je 0x6321aa90
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call fcn.6321a6f0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.enumerating_for_guid__s_n
mov dword [esp + 8], str.NS_SendSessionRequestBroadcast
mov dword [esp + 4], 0x6321d0ac
mov dword [esp], 3
call fcn.6321a7b0
movzx eax, byte [0x6321d0ac]
test al, 1
je 0x6321a929
mov dword [esp + 0xc], str.:_not_all_data_fields_are_correct_n
mov dword [esp + 8], str.NS_SendSessionRequestBroadcast
mov dword [esp + 4], 0x6321d0ac
mov dword [esp], 0
call fcn.6321a7b0
jmp 0x6321a929
movzx eax, si
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call fcn.6321a6f0
jmp 0x6321aa2d
mov eax, str._null_
jmp 0x6321aa2d

Function at 0x6321ab40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp + 8]
sub esp, 0xc
mov dword [edx], eax
test eax, eax
je 0x6321ab98
lea edx, [eax + 4]
mov dword [eax + 4], 0
mov dword [eax + 8], edx
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov eax, 1
leave
ret
leave
xor eax, eax
ret
Function at 0x6321b070
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 0x14]
test byte [0x6321d0ac], 1
jne 0x6321b180
mov dword [esp + 0x14], 0
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [edi + 0x54]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x30]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call edx
mov ecx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [edi + 0x54]
sub esp, 0x18
mov eax, dword [eax + 0x48]
lea eax, [eax + esi*2 + 0x5c]
mov dword [ecx], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [ebp + 0xc]
sub esp, 0xc
mov dword [eax], ebx
mov edi, dword [edi + 0x54]
add ebx, dword [edi + 0x48]
mov dword [ebx], 0x79616c70
lea ecx, [ebx + 8]
add ebx, 0x5c
mov dword [ebx - 0x58], 0xb0001
mov eax, dword [edi + 0x1c]
mov edx, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], edx
call sub.ucrtbase.dll_memcpy
mov dword [ebx - 4], 0x5c
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x30]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call edx
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.:_few_fixed__need_to_check_request_for_response__might_need_UNICODE_input_ability._n
mov dword [esp + 8], str.NS_ReplyToEnumSessionsRequest
mov dword [esp + 4], 0x6321d0ac
mov dword [esp], 0
call fcn.6321a7b0
jmp 0x6321b089
Function at 0x6321bd00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x63238100]
test eax, eax
je 0x6321bdb8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x6321bd40
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6321bd2c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6321bded
mov dword [esp + 4], 0x6322ce8c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x63238100], eax
sub esp, 8
test eax, eax
jne 0x6321bd1d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6321bd2e
Function at 0xeffe44
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeffe4e
pushal
call 0xeffe54
pop ebp
sub ebp, 0x10
sub ebp, 0xaffe44
jmp 0xeffe6a
mov eax, 0xaffe44
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a7
mov edx, 0xa6afad62
xor byte [eax], dl
inc eax
dec ecx
jne 0xeffe81
jmp 0xeffe94
jmp 0x5fdbe848
Function at 0x100165d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x10016786
cmp dword [ebx + 0x1c], 0x10
lea edx, [ebx + 8]
mov eax, dword [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0x10]
jb 0x1001660b
mov edx, dword [edx]
xor ecx, ecx
push esi
mov esi, 0x811c9dc5
test eax, eax
je 0x10016635
mov ebp, eax
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebp
jb 0x10016620
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, ebx
mov ecx, dword [esp + 0x18]
and eax, esi
mov esi, dword [ebx]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
call fcn.1001b5d0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x10]
je 0x10016682
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x10016694
mov edx, esi
mov esi, dword [esi]
call fcn.1001b5d0
dec dword [edi + 8]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], eax
jne 0x10016664
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x14], ebx
jne 0x100166b9
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x100166bd
cmp dword [esp + 0x14], ebx
jne 0x1001677c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x1001677c
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
jb 0x100166e6
mov edx, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test eax, eax
je 0x1001670a
mov ebp, dword [esp + 0x2c]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, ebp
jb 0x100166f5
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, esi
mov ecx, dword [esp + 0x18]
and eax, ebx
mov ebx, dword [ecx + eax*8 + 4]
mov esi, dword [esi]
mov dword [esp + 0x14], ebx
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
call fcn.1001b5d0
dec dword [edi + 8]
cmp dword [esp + 0x24], ebx
je 0x1001674c
mov ebx, esi
cmp esi, ebp
je 0x10016776
mov edx, esi
mov esi, dword [esi]
call fcn.1001b5d0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
jne 0x10016734
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
cmp esi, ebp
jne 0x100166d0
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x10016c00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x10016d77
cmp dword [ecx + 0x1c], 0x10
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jb 0x10016c3e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10016c61
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10016c50
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10024540
push 0xc0
push edi
call fcn.100e94f6
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x10016cc4
cmp esi, dword [esp + 0x30]
jne 0x10016c80
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x10016d67
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x10016d67
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x10016cda
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x10016cde
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x10016d67
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jb 0x10016cfe
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10016d21
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10016d10
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10024540
push 0xc0
push edi
call fcn.100e94f6
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x10016d7e
cmp esi, dword [esp + 0x30]
jne 0x10016d36
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x10016cf0
jmp 0x10016d67
Function at 0x10016da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x10016f17
cmp dword [ecx + 0x1c], 0x10
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jb 0x10016dde
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10016e01
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10016df0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10024540
push 0x134
push edi
call fcn.100e94f6
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x10016e64
cmp esi, dword [esp + 0x30]
jne 0x10016e20
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x10016f07
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x10016f07
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x10016e7a
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x10016e7e
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x10016f07
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jb 0x10016e9e
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10016ec1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10016eb0
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10024540
push 0x134
push edi
call fcn.100e94f6
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x10016f1e
cmp esi, dword [esp + 0x30]
jne 0x10016ed6
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x10016e90
jmp 0x10016f07
Function at 0x10016f40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x100170b7
cmp dword [ecx + 0x1c], 0x10
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jb 0x10016f7e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10016fa1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10016f90
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10024540
push 0x154
push edi
call fcn.100e94f6
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x10017004
cmp esi, dword [esp + 0x30]
jne 0x10016fc0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x100170a7
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x100170a7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x1001701a
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1001701e
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x100170a7
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jb 0x1001703e
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10017061
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10017050
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10024540
push 0x154
push edi
call fcn.100e94f6
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x100170be
cmp esi, dword [esp + 0x30]
jne 0x10017076
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x10017030
jmp 0x100170a7