joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4762ae
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4762dc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4762fa
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00476214
jmp 0x4762fa
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4762fa
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00476214
test edi, edi
mov eax, edi
jne 0x4762e4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x66b30bab
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x35c42011
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x453850
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x441015
lea edi, [esi - 0x40015]
push edi
or ebp, 0xffffffff
jmp 0x453872
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x453879
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453868
mov eax, 1
add ebx, ebx
jne 0x45388b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45389c
jne 0x4538bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4538bb
dec eax
add ebx, ebx
jne 0x4538a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x453880
add ebx, ebx
jne 0x4538b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45390d
xor ecx, ecx
sub eax, 3
jb 0x4538d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x453942
sar eax, 1
mov ebp, eax
jmp 0x4538de
add ebx, ebx
jne 0x4538de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4538ac
inc ecx
add ebx, ebx
jne 0x4538ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4538ac
add ebx, ebx
jne 0x4538f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4538ee
jne 0x45390a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4538ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45392c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45391e
jmp 0x45386e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45392c
add edi, ecx
jmp 0x45386e
pop esi
mov edi, esi
mov ecx, 0xaca
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45394a
cmp byte [edi], 7
jne 0x45394a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45394f
lea edi, [esi + 0x51000]
mov eax, dword [edi]
or eax, eax
je 0x4539c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7246c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7250c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45397c
mov ecx, edi
jns 0x4539ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x72510]
or eax, eax
je 0x4539c1
mov dword [ebx], eax
add ebx, 4
jmp 0x453999
call dword [esi + 0x72520]
mov ebp, dword [esi + 0x72514]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4539fb
sub esp, 0xffffff80
jmp 0x412a92
Function at 0x10011a20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push edi
push ecx
push str.Enabled
mov ebx, edx
mov dword [esp + 0x1c], eax
call fcn.1001ff00
add esp, 4
mov edx, ebx
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 1]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.Only_During_Freeze_Time
call fcn.1001ff00
add esp, 4
lea edx, [ebx + 1]
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 2]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.Show_Prices
call fcn.1001ff00
add esp, 4
lea edx, [ebx + 2]
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 3]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.No_Title_Bar
call fcn.1001ff00
add esp, 4
lea edx, [ebx + 3]
mov ecx, eax
call fcn.100200a0
mov ecx, dword [esp + 0x10]
push str.Mode
call fcn.1001ff00
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x14], eax
cmp esi, dword [edi + 0xc]
je 0x10011b19
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x20]
push dword [esp + 0x18]
xorps xmm0, xmm0
movq qword [esp + 0x24], xmm0
call fcn.1001cdd0
mov ebx, dword [esp + 0x14]
mov eax, esi
cdq
mov cl, byte [ebx]
mov byte [ebx], 5
mov esi, dword [ebx + 0xc]
mov byte [esp + 0x14], cl
push dword [esp + 0x14]
mov byte [esp + 0x1c], cl
mov ecx, dword [ebx + 8]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x24]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov dword [esp + 0x28], esi
call fcn.1001cdd0
or ecx, 0xffffffff
mov esi, 0x1015c965
mov al, 0x50
or edi, 0xffffffff
cmp al, 0x23
jne 0x10011b34
cmp byte [esi], al
jne 0x10011b34
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x10179b80]
test al, al
jne 0x10011b26
not ecx
call fcn.100f0790
test eax, eax
je 0x10011bae
add eax, 0xc
lea ecx, [esp + 0x18]
push eax
call fcn.10022000
mov ecx, dword [esp + 0x10]
push 0x1015c068
call fcn.1001ff00
mov cl, byte [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x20]
mov dl, byte [edi]
mov byte [edi], cl
mov esi, dword [edi + 0xc]
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x14], dl
push dword [esp + 0x14]
mov byte [esp + 0x1c], dl
mov edx, dword [edi + 8]
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0x24]
mov dword [edi + 8], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
call fcn.1001cdd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10011bc0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push edi
push ecx
push str.Enabled
mov ebx, edx
mov dword [esp + 0x18], eax
call fcn.1001ff00
add esp, 4
mov edx, ebx
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 1]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Steam_ID
call fcn.1001ff00
add esp, 4
lea edx, [ebx + 1]
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 2]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Rank
call fcn.1001ff00
add esp, 4
lea edx, [ebx + 2]
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 3]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Wins
call fcn.1001ff00
add esp, 4
lea edx, [ebx + 3]
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 4]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Money
call fcn.1001ff00
add esp, 4
lea edx, [ebx + 4]
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 5]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push 0x1015c090
call fcn.1001ff00
add esp, 4
lea edx, [ebx + 5]
mov ecx, eax
call fcn.100200a0
lea eax, [edi + 6]
push eax
push ecx
lea esi, [ebx + 6]
mov ebx, dword [esp + 0x14]
push str.Armor
mov ecx, ebx
call fcn.1001ff00
add esp, 4
mov edx, esi
mov ecx, eax
call fcn.100200a0
or ecx, 0xffffffff
mov esi, 0x1015c971
mov al, 0x50
or edi, 0xffffffff
cmp al, 0x23
jne 0x10011cce
cmp byte [esi], al
jne 0x10011cce
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x10179b80]
test al, al
jne 0x10011cc0
not ecx
call fcn.100f0790
test eax, eax
je 0x10011d46
add eax, 0xc
lea ecx, [esp + 0x10]
push eax
call fcn.10022000
push 0x1015c068
mov ecx, ebx
call fcn.1001ff00
mov cl, byte [esp + 0x10]
mov edi, eax
mov eax, dword [esp + 0x18]
mov dl, byte [edi]
mov byte [edi], cl
mov esi, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0xc], dl
push dword [esp + 0xc]
mov byte [esp + 0x14], dl
mov edx, dword [edi + 8]
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0x1c]
mov dword [edi + 8], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
call fcn.1001cdd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001e6d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x1001e886
cmp dword [ebx + 0x1c], 0xf
lea edx, [ebx + 8]
mov eax, dword [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0x10]
jbe 0x1001e70b
mov edx, dword [edx]
xor ecx, ecx
push esi
mov esi, 0x811c9dc5
test eax, eax
je 0x1001e735
mov ebp, eax
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebp
jb 0x1001e720
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, ebx
mov ecx, dword [esp + 0x18]
and eax, esi
mov esi, dword [ebx]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
call fcn.10024580
dec dword [edi + 8]
cmp ebx, dword [esp + 0x10]
je 0x1001e782
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x1001e794
mov edx, esi
mov esi, dword [esi]
call fcn.10024580
dec dword [edi + 8]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], eax
jne 0x1001e764
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x14], ebx
jne 0x1001e7b9
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1001e7bd
cmp dword [esp + 0x14], ebx
jne 0x1001e87c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x1001e87c
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
jbe 0x1001e7e6
mov edx, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test eax, eax
je 0x1001e80a
mov ebp, dword [esp + 0x2c]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, ebp
jb 0x1001e7f5
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, esi
mov ecx, dword [esp + 0x18]
and eax, ebx
mov ebx, dword [ecx + eax*8 + 4]
mov esi, dword [esi]
mov dword [esp + 0x14], ebx
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
call fcn.10024580
dec dword [edi + 8]
cmp dword [esp + 0x24], ebx
je 0x1001e84c
mov ebx, esi
cmp esi, ebp
je 0x1001e876
mov edx, esi
mov esi, dword [esi]
call fcn.10024580
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
jne 0x1001e834
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
cmp esi, ebp
jne 0x1001e7d0
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x1001ee70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x1001efe7
cmp dword [ecx + 0x1c], 0xf
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jbe 0x1001eeae
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x1001eed1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x1001eec0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1002e180
push 0xc0
push edi
call fcn.10127383
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x1001ef34
cmp esi, dword [esp + 0x30]
jne 0x1001eef0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x1001efd7
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x1001efd7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x1001ef4a
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1001ef4e
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x1001efd7
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x1001ef6e
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1001ef91
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1001ef80
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1002e180
push 0xc0
push edi
call fcn.10127383
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x1001efee
cmp esi, dword [esp + 0x30]
jne 0x1001efa6
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x1001ef60
jmp 0x1001efd7
Function at 0x1001f010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x1001f187
cmp dword [ecx + 0x1c], 0xf
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jbe 0x1001f04e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x1001f071
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x1001f060
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1002e180
push 0x130
push edi
call fcn.10127383
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x1001f0d4
cmp esi, dword [esp + 0x30]
jne 0x1001f090
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x1001f177
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x1001f177
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x1001f0ea
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1001f0ee
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x1001f177
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x1001f10e
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1001f131
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1001f120
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1002e180
push 0x130
push edi
call fcn.10127383
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x1001f18e
cmp esi, dword [esp + 0x30]
jne 0x1001f146
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x1001f100
jmp 0x1001f177
Function at 0x1001f1b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x1001f327
cmp dword [ecx + 0x1c], 0xf
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jbe 0x1001f1ee
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x1001f211
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x1001f200
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1002e180
push 0xd8
push edi
call fcn.10127383
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x1001f274
cmp esi, dword [esp + 0x30]
jne 0x1001f230
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x1001f317
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x1001f317
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x1001f28a
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1001f28e
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x1001f317
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x1001f2ae
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1001f2d1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1001f2c0
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1002e180
push 0xd8
push edi
call fcn.10127383
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x1001f32e
cmp esi, dword [esp + 0x30]
jne 0x1001f2e6
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x1001f2a0
jmp 0x1001f317