joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b09b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push esi
push edi
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x14], 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.1000ab60
push 8
call fcn.1005cb91
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.1005e266
add esp, 8
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov ecx, edi
mov byte [ebp - 4], 0
mov dword [edi + 0x30], esi
push 0x20
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
call fcn.10012110
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x10011eeb
mov eax, dword [edi + 0xc]
mov ecx, edi
or eax, 4
push 0
push eax
call fcn.1000ab60
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10011f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100b09c0
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1005cb91
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1005e266
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0b10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x18]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax + edx*8]
cmp esi, ecx
je 0x1001435a
mov esi, dword [eax + edx*8 + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, ecx
je 0x1001435a
mov esi, dword [esi + 4]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
jne 0x10014310
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001438a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x100143a2
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x100143c5
cmp eax, esi
jne 0x100143aa
mov dword [ecx], edi
jmp 0x100143c5
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100143c5
mov eax, dword [ebx + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10014420
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100179a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp + 0xc], ebx
jb 0x100179bc
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100179d8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100179c7
and edx, dword [0x100e8678]
mov ecx, dword [0x100e866c]
lea eax, [edx + edx]
mov esi, dword [ecx + edx*8]
lea eax, [eax + 1]
mov edx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
nop word [eax + eax]
mov ecx, dword [0x100e8664]
cmp edx, ecx
jne 0x10017a0e
mov eax, ecx
jmp 0x10017a12
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10017a90
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x10017a20
mov ecx, dword [edi]
mov edx, dword [esi + 0x1c]
lea ebx, [esi + 8]
mov dword [ebp - 0xc], edx
cmp edx, 0x10
jb 0x10017a31
mov ebx, dword [esi + 8]
push dword [ebp + 0xc]
mov eax, dword [esi + 0x18]
mov edx, eax
push ecx
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.10008560
add esp, 8
test al, al
jne 0x10017a55
mov esi, dword [esi]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x10017a00
cmp dword [ebp - 0xc], 0x10
lea eax, [esi + 8]
jb 0x10017a60
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x10017a68
mov edi, dword [edi]
push dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.10008560
add esp, 8
test al, al
mov eax, dword [ebp + 8]
cmove esi, dword [0x100e8664]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x10017aa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [0x100e868c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100e8698]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8684]
nop dword [eax + eax]
cmp edi, edx
jne 0x10017b08
mov ecx, edx
jmp 0x10017b0d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10017b20
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x10017b1c
mov eax, dword [eax]
jmp 0x10017b00
mov ecx, eax
jmp 0x10017b24
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10017b78
push ecx
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10019a40
mov edx, eax
mov ecx, 0x1fffffe
mov eax, dword [0x100e8688]
sub ecx, eax
cmp ecx, 1
jb 0x10017b84
inc eax
mov ecx, 0x100e8680
mov dword [0x100e8688], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x100e8684]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10019330
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0x10
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1005dddf
int3

Function at 0x10017b90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x100e864c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100e8658]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8644]
nop dword [eax + eax]
cmp edi, edx
jne 0x10017bf8
mov ecx, edx
jmp 0x10017bfd
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10017c10
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x10017c0c
mov eax, dword [eax]
jmp 0x10017bf0
mov ecx, eax
jmp 0x10017c14
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10017c68
push ecx
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10019b60
mov edx, eax
mov ecx, 0x2762761
mov eax, dword [0x100e8648]
sub ecx, eax
cmp ecx, 1
jb 0x10017c74
inc eax
mov ecx, 0x100e8640
mov dword [0x100e8648], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x100e8644]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10019540
mov eax, dword [ebp - 0xc]
pop edi
pop esi
add eax, 0x10
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x100186a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1120
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 0x18]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and esi, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], esi
mov ecx, dword [eax + esi*8]
cmp ecx, edx
jne 0x1001871b
mov esi, edx
jmp 0x10018721
mov esi, dword [eax + esi*8 + 4]
mov esi, dword [esi]
cmp esi, ecx
je 0x1001874b
mov esi, dword [esi + 4]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
jne 0x10018721
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edx]
push edi
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.100144d0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1001884b
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100187bb
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0xc]
lea edx, [eax + edx*8]
mov eax, dword [edx]
cmp eax, ecx
jne 0x100187d8
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx*8 + 4], edi
jmp 0x100187fe
cmp eax, esi
jne 0x100187e0
mov dword [edx], edi
jmp 0x100187fe
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x100187fe
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10014420
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x10018860
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [0x100e868c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100e8698]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8684]
cmp edi, edx
jne 0x100188c0
mov ecx, edx
jmp 0x100188c5
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100188d8
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100188d4
mov eax, dword [eax]
jmp 0x100188b8
mov ecx, eax
jmp 0x100188dc
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10018936
push ecx
mov dword [ebp + 0xc], esi
lea eax, [ebp + 0xc]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10019a40
mov edx, eax
mov ecx, 0x1fffffe
mov eax, dword [0x100e8688]
sub ecx, eax
cmp ecx, 1
jb 0x10018948
inc eax
mov ecx, 0x100e8680
mov dword [0x100e8688], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [0x100e8684]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.10019330
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 0
pop ebp
ret 8
push str.list_T__too_long
call fcn.1005dddf
int3

Function at 0x10018960
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [0x100e864c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100e8658]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8644]
cmp edi, edx
jne 0x100189c0
mov ecx, edx
jmp 0x100189c5
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100189d8
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100189d4
mov eax, dword [eax]
jmp 0x100189b8
mov ecx, eax
jmp 0x100189dc
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10018a36
push ecx
mov dword [ebp + 0xc], esi
lea eax, [ebp + 0xc]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10019b60
mov edx, eax
mov ecx, 0x2762761
mov eax, dword [0x100e8648]
sub ecx, eax
cmp ecx, 1
jb 0x10018a48
inc eax
mov ecx, 0x100e8640
mov dword [0x100e8648], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [0x100e8644]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.10019540
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 0
pop ebp
ret 8
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x10018a60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x10018a79
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10018a95
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10018a84
and edx, dword [0x100e8678]
mov ecx, dword [0x100e866c]
mov ebx, dword [0x100e8664]
lea eax, [edx + edx]
mov esi, dword [ecx + edx*8]
lea eax, [eax + 1]
mov edx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
nop dword [eax]
cmp edx, ebx
jne 0x10018ac8
mov eax, ebx
jmp 0x10018acc
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10018b42
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x10018add
mov ecx, dword [edi]
mov edx, dword [eax + 0x14]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], edx
cmp edx, 0x10
jb 0x10018af0
mov edx, dword [eax]
mov dword [ebp + 0xc], edx
push dword [edi + 0x10]
mov eax, dword [eax + 0x10]
mov edx, eax
push ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.10008560
add esp, 8
test al, al
jne 0x10018b15
mov esi, dword [esi]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x10018ac0
cmp dword [ebp - 0xc], 0x10
lea eax, [esi + 8]
jb 0x10018b20
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x10018b2a
mov ecx, dword [edi]
push dword [ebp - 0x10]
mov edx, dword [edi + 0x10]
push eax
call fcn.10008560
add esp, 8
test al, al
cmove esi, ebx
mov eax, esi
jmp 0x10018b46
mov esi, ebx
mov eax, ebx
cmp eax, ebx
jne 0x10018ba2
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
push ecx
push eax
push ecx
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10019c70
mov edx, eax
mov ecx, 0x3fffffe
mov eax, dword [0x100e8668]
sub ecx, eax
cmp ecx, 1
jb 0x10018bb4
inc eax
mov ecx, 0x100e8660
mov dword [0x100e8668], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [0x100e8664]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.10019750
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x10018bc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x10018bdc
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10018bf8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10018be7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x10018c20
mov eax, ebx
jmp 0x10018c24
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10018c97
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x10018c32
mov edx, dword [edi]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edi
cmp edi, 0x10
mov edi, dword [ebp + 0xc]
jb 0x10018c46
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x14], eax
call fcn.10008560
add esp, 8
test al, al
jne 0x10018c68
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x10018c18
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x10018c73
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x10018c7d
mov ecx, dword [edi]
push dword [ebp - 0x14]
mov edx, dword [edi + 0x10]
push eax
call fcn.10008560
add esp, 8
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x10018c9b
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x10018cf1
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
push ecx
push eax
push ecx
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10019da0
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x3c3c3c2
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10018d03
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.100190f0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x10018f10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [0x100e868c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100e8698]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8684]
nop word [eax + eax]
cmp edi, edx
jne 0x10018f78
mov ecx, edx
jmp 0x10018f7d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10018f9a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x10018f8c
mov eax, dword [eax]
jmp 0x10018f70
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8

Function at 0x10018fb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [0x100e864c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100e8658]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100e8644]
nop word [eax + eax]
cmp edi, edx
jne 0x10019018
mov ecx, edx
jmp 0x1001901d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1001903a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1001902c
mov eax, dword [eax]
jmp 0x10019010
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8