joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ff80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1001ffab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10015f40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001ffcd
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1001ffcf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10020053
jg 0x1001ffe4
test esi, esi
je 0x10020053
test ecx, ecx
jl 0x1002002d
jg 0x1001ffee
test eax, eax
je 0x1002002d
cmp edi, ecx
jg 0x10020002
jl 0x1001fff8
cmp esi, eax
jae 0x10020002
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.10084b80
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10020030
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10020053
jg 0x1002003a
test esi, esi
je 0x10020053
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10020053
push eax
push esi
push 1
push edx
call fcn.1008f16b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10020070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1002009b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10016020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x100200bd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x100200bf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x1002015e
jg 0x100200dc
test esi, esi
je 0x1002015e
test ecx, ecx
jl 0x10020129
jg 0x100200e6
test eax, eax
je 0x10020129
cmp ebx, ecx
jg 0x100200fa
jl 0x100200f0
cmp esi, eax
jae 0x100200fa
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.10084b80
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10020130
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x1002015e
jg 0x1002013a
test esi, esi
je 0x1002015e
cmp dword [edi + 0x4c], 0
je 0x1002015e
mov ecx, edi
call fcn.100207f0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.1008f753
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10020490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100204ac
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100204de
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100204de
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100205af
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10020506
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1002052f
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1008e7ee
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov byte [ebp - 4], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x100205af
cmp eax, 1
jle 0x10020582
cmp eax, 3
jne 0x100205af
push dword [esi + 0x4c]
push dword [ebp - 4]
call fcn.1001ea10
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x1002059f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1008f16b
add esp, 0x10
cmp edi, eax
jne 0x100205af
lea eax, [ebp - 4]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 8], eax
jne 0x100204d3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10020820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1002089f
cmp byte [esi + 0x3d], 0
je 0x1002089f
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10020869
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10020871
sub eax, 1
je 0x10020875
sub eax, 2
je 0x1002089f
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10020892
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1008f16b
add esp, 0x10
cmp edi, eax
jne 0x10020869
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100211a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c10a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx eax, byte [edx]
mov edi, dword [0x100fe7e4]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0x100fe7e0
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100fe7f8]
and ecx, eax
lea ebx, [ecx*8]
mov ecx, dword [0x100fe7ec]
cmp dword [ebx + ecx], edi
jne 0x10021210
mov esi, edi
jmp 0x10021216
mov esi, dword [ebx + ecx + 4]
mov esi, dword [esi]
cmp esi, dword [ebx + ecx]
je 0x10021243
mov esi, dword [esi + 4]
mov ax, word [edx]
cmp ax, word [esi + 8]
jne 0x10021216
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov edi, dword [edi]
push edx
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp + 0xc], eax
call fcn.100218b0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [0x100fe7e8]
sub ecx, eax
cmp ecx, 1
jb 0x10021347
inc eax
mov dword [0x100fe7e8], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], edx
mov dword [eax], edx
mov edx, dword [0x100fe7e4]
mov edi, dword [edx]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100212b7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [0x100fe7e4]
mov ecx, dword [0x100fe7ec]
add ecx, ebx
mov eax, dword [ecx]
cmp eax, edx
jne 0x100212d2
mov dword [ecx], edi
mov eax, dword [0x100fe7ec]
mov dword [ebx + eax + 4], edi
jmp 0x100212f7
cmp eax, esi
jne 0x100212da
mov dword [ecx], edi
jmp 0x100212f7
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100212f7
mov edx, dword [0x100fe7ec]
mov eax, dword [edx + ebx + 4]
mov eax, dword [eax + 4]
mov dword [edx + ebx + 4], eax
mov ecx, 0x100fe7e0
mov dword [ebp - 4], 2
call fcn.10021360
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.1006df8f
int3
Function at 0x10021400
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
mov ecx, dword [ebx + 0x18]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1002145b
cmp eax, edi
jne 0x10021453
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10021463
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10021463
cmp eax, edi
jne 0x10021466
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1006cd71
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10021490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c10b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 4], 0
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ecx]
mov edi, dword [ebx + 0x18]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [ecx + 1]
mov dword [ebp - 0x18], ebx
xor edx, eax
imul eax, edx, 0x1000193
and edi, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edi
mov edx, dword [eax + edi*8]
cmp esi, edx
je 0x10021541
mov esi, dword [eax + edi*8 + 4]
mov esi, dword [esi]
cmp esi, edx
je 0x10021541
mov esi, dword [esi + 4]
mov ax, word [ecx]
cmp ax, word [esi + 8]
jne 0x100214f5
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1006cd71
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1002156e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x10021589
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x100215ac
cmp eax, esi
jne 0x10021591
mov dword [ecx], edi
jmp 0x100215ac
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100215ac
mov eax, dword [ebx + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10021360
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100280c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
nop dword [eax]
cmp ebx, esi
jne 0x10028128
mov ecx, esi
jmp 0x1002812d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10028140
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1002813c
mov eax, dword [eax]
jmp 0x10028120
cmp eax, esi
jne 0x1002818a
mov esi, dword [esi]
lea eax, [ebp + 8]
push ecx
push eax
push ecx
mov dword [ebp + 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1002d520
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x5d1745c
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10028196
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002bba0
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1006df8f
int3

Function at 0x100285d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
nop dword [eax]
cmp ebx, esi
jne 0x10028638
mov ecx, esi
jmp 0x1002863d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10028650
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1002864c
mov eax, dword [eax]
jmp 0x10028630
cmp eax, esi
jne 0x1002869a
mov esi, dword [esi]
lea eax, [ebp + 8]
push ecx
push eax
push ecx
mov dword [ebp + 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1002d9f0
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x6666665
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x100286a6
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002c040
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1006df8f
int3
Function at 0x1002ac70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c21b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
cmp dword [ebx + 0x14], 0x10
mov esi, ebx
mov dword [ebp - 0x14], edi
jb 0x1002acaa
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x1002acc8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x1002acb6
mov eax, dword [edi + 0x18]
mov esi, dword [edi + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [edi + 0xc]
mov dword [ebp + 0xc], ecx
mov edi, dword [ecx + eax]
cmp esi, edi
je 0x1002ad3c
mov esi, dword [ecx + eax + 4]
mov esi, dword [esi]
nop word [eax + eax]
cmp esi, edi
je 0x1002ad3c
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x1002ad03
mov edx, dword [esi + 8]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x1002ad0d
mov ecx, dword [ebx]
push dword [esi + 0x18]
push edx
mov edx, dword [ebx + 0x10]
call fcn.1000ba70
add esp, 8
test al, al
je 0x1002acf0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
push ebx
mov eax, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x18], eax
call fcn.1002db50
mov ebx, dword [ebp - 0x14]
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1002ae39
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 4], edx
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1002adaf
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x1002adc9
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x1002adec
cmp eax, esi
jne 0x1002add1
mov dword [edx], edi
jmp 0x1002adec
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x1002adec
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1002b620
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.1006df8f
int3
Function at 0x1002af30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x1002af4c
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1002af68
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1002af57
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x1002af90
mov eax, ebx
jmp 0x1002af94
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1002b007
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x1002afa2
mov edx, dword [edi]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edi
cmp edi, 0x10
mov edi, dword [ebp + 0xc]
jb 0x1002afb6
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x14], eax
call fcn.1000ba70
add esp, 8
test al, al
jne 0x1002afd8
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x1002af88
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x1002afe3
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x1002afed
mov ecx, dword [edi]
push dword [ebp - 0x14]
mov edx, dword [edi + 0x10]
push eax
call fcn.1000ba70
add esp, 8
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x1002b00b
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x1002b061
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
push ecx
push eax
push ecx
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1002d590
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x6666665
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1002b073
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.1002b8a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.1006df8f
int3
Function at 0x1002b110
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x1002b12c
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1002b148
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1002b137
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x1002b170
mov eax, ebx
jmp 0x1002b174
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1002b1e7
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x1002b182
mov edx, dword [edi]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edi
cmp edi, 0x10
mov edi, dword [ebp + 0xc]
jb 0x1002b196
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x14], eax
call fcn.1000ba70
add esp, 8
test al, al
jne 0x1002b1b8
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x1002b168
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x1002b1c3
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x1002b1cd
mov ecx, dword [edi]
push dword [ebp - 0x14]
mov edx, dword [edi + 0x10]
push eax
call fcn.1000ba70
add esp, 8
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x1002b1eb
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x1002b241
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
push ecx
push eax
push ecx
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1002da20
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x3fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1002b253
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.1002c310
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.1006df8f
int3