joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011300
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x10011515
push ebx
push edi
cmp eax, 0x7c
je 0x10011513
cmp eax, 0x29
jne 0x10011341
cmp dword [esi + 0x10], 0
jne 0x10011513
cmp eax, eax
jne 0x10011341
test dword [esi + 0x50], 0x10000000
je 0x10011522
jmp 0x100114cc
cmp eax, 0x2e
jne 0x1001139b
push 5
lea ecx, [esi + 0x24]
call fcn.10013ff0
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x1001138f
cmp byte [eax], 0x5c
jne 0x1001138c
lea ecx, [eax + 1]
cmp ecx, edx
je 0x1001138c
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x10011379
mov bl, byte [ecx]
cmp bl, 0x28
je 0x1001138a
cmp bl, 0x29
je 0x1001138a
test dl, 0x10
jne 0x1001138c
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x1001138a
cmp dl, 0x7d
jne 0x1001138c
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.100143f0
jmp 0x100114fe
cmp eax, 0x5c
jne 0x100113f7
mov ecx, esi
call fcn.10014060
test byte [esi + 0x50], 0x80
je 0x100113eb
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x100113ca
push 4
lea ecx, [esi + 0x24]
call fcn.10013ff0
mov ecx, esi
call fcn.10014060
jmp 0x10011505
cmp al, 0x42
jne 0x100113eb
push 4
lea ecx, [esi + 0x24]
call fcn.10013ff0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10014060
jmp 0x10011505
mov ecx, esi
call fcn.10011540
jmp 0x100114fe
cmp eax, 0x5b
jne 0x10011458
mov ecx, esi
call fcn.10014060
lea ecx, [esi + 0x24]
call fcn.10010900
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x10011424
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10014060
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x10011442
cmp eax, 0x5d
jne 0x10011442
push eax
lea ecx, [esi + 0x24]
call fcn.10010890
mov ecx, esi
call fcn.10014060
mov ecx, esi
call fcn.10012230
cmp dword [esi + 0x4c], 0x5d
jne 0x1001152b
jmp 0x100114f7
cmp eax, 0x28
jne 0x10011488
mov ecx, esi
call fcn.10014060
mov ecx, esi
call fcn.100145f0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x10011522
mov ecx, esi
call fcn.10014060
test bl, bl
je 0x10011505
jmp 0x100114fe
cmp eax, 0x5e
jne 0x100114a0
push 2
lea ecx, [esi + 0x24]
call fcn.10013ff0
mov ecx, esi
call fcn.10014060
jmp 0x10011505
cmp eax, 0x24
jne 0x100114b8
push 3
lea ecx, [esi + 0x24]
call fcn.10013ff0
mov ecx, esi
call fcn.10014060
jmp 0x10011505
cmp eax, 0x2a
je 0x10011519
cmp eax, 0x2b
je 0x10011519
cmp eax, 0x3f
je 0x10011519
cmp eax, 0x7b
je 0x10011519
cmp eax, 0x7d
jne 0x100114dc
test dword [esi + 0x50], 0x10000000
je 0x10011534
jmp 0x100114ea
cmp eax, 0x5d
jne 0x100114ea
test dword [esi + 0x50], 0x10000000
je 0x1001152b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10010780
mov ecx, esi
call fcn.10014060
mov ecx, esi
call fcn.100140c0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10011313
pop edi
pop ebx
mov al, cl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.10013660
push 5
mov ecx, esi
call fcn.10013660
push 4
mov ecx, esi
call fcn.10013660
push 6
mov ecx, esi
call fcn.10013660
int3
Function at 0x10014b60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10014b91
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10014b80
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1001b090
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ece40
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10129fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x1001b0d7
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x1001b0f8
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001b0e4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x1001b158
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x1001b158
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.1001abb0
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x1001b120
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.1001acd0
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1001b25c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001b1ce
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x1001b1e8
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x1001b20b
cmp eax, esi
jne 0x1001b1f0
mov dword [edx], edi
jmp 0x1001b20b
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x1001b20b
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1001bdb0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.10097647
int3
Function at 0x1001b270
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ece60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10129fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x1001b2b7
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x1001b2d8
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001b2c4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x1001b356
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x1001b356
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.1001abb0
add esp, 8
test al, al
mov eax, dword [ebp + 0xc]
je 0x1001b300
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + 4]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.1001c080
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001b383
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1001b39d
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1001b3bf
cmp eax, esi
jne 0x1001b3a5
mov dword [ecx], edi
jmp 0x1001b3bf
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1001b3bf
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1001bdb0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001b420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ece80
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10129fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x1001b467
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x1001b488
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001b474
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x1001b4e8
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x1001b4e8
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.1001abb0
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x1001b4b0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.1001ad50
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1001b5ec
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001b55e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x1001b578
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx + 4], edi
jmp 0x1001b59b
cmp eax, esi
jne 0x1001b580
mov dword [edx], edi
jmp 0x1001b59b
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x1001b59b
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1001bdb0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.10097647
int3
Function at 0x1001c9d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x1001c9eb
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x1001ca07
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1001c9f6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x1001ca40
cmp eax, edi
jne 0x1001ca38
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x1001ca48
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1001ca48
cmp eax, edi
jne 0x1001ca4b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.1001c080
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001ca80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 8
mov edi, dword [ebx + 0x10]
jb 0x1001ca9a
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x1001cab6
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001caa5
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp + 0xc], edx
mov esi, edx
mov dword [ebp - 4], eax
cmp edx, edi
jne 0x1001cae0
mov eax, edi
jmp 0x1001cae4
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1001cb15
lea eax, [esi + 8]
push ebx
push eax
call fcn.1001abb0
add esp, 8
test al, al
jne 0x1001cb03
mov esi, dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x1001cad8
lea eax, [esi + 8]
push eax
push ebx
call fcn.1001abb0
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002cab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
push ebx
push esi
push edi
push str.Engine.dll
push 0x78
push 0x101290a8
call fcn.100cf2b5
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
add esp, 0xc
push 0x101308a8
push 0x40
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0xc340
push 0xa08
mov word [esi], ax
lea eax, [ebp - 0xa08]
push 0
push eax
call fcn.100c6c10
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea esi, [ebp - 0xa08]
add esp, 0xc
mov dword [ebp - 0xa08], eax
mov ecx, 0x282
mov dword [ebp - 0x888], 0x22
mov dword [ebp - 0x884], 0
mov dword [ebp - 0xa00], 4
push 0x100fa634
sub esp, 0xa08
mov dword [ebp - 0x868], 0x10026050
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.100056d0
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [ebp - 0xa08]
add esp, 0xa0c
mov dword [ebp - 0xa08], edx
mov ecx, 0x282
mov dword [ebp - 0x888], 0x24
mov dword [ebp - 0x884], 0
mov bl, al
mov dword [ebp - 0x868], 0x100267b0
push 0x100fa648
sub esp, 0xa08
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.100056d0
add esp, 0xa0c
or al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002cc00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1002cc31
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1002cc20
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10032d20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10032d93
cmp ecx, eax
jne 0x10032d8b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10032d9b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10032d9b
cmp ecx, eax
jne 0x10032d9b
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [edi + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.100331d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x10036b00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ee580
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10129fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x10036b44
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x10036b62
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x10036b50
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x10036bbd
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x10036bbd
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.100369f0
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x10036b85
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.10036a80
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10036cc1
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10036c33
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x10036c4d
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x10036c70
cmp eax, esi
jne 0x10036c55
mov dword [edx], edi
jmp 0x10036c70
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x10036c70
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10037290
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.10097647
int3
Function at 0x10036cd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ee5a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10129fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x10036d14
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x10036d32
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x10036d20
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x10036dab
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x10036dab
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.100369f0
add esp, 8
test al, al
mov eax, dword [ebp + 0xc]
je 0x10036d55
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + 4]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10037330
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10036dd8
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x10036df2
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x10036e14
cmp eax, esi
jne 0x10036dfa
mov dword [ecx], edi
jmp 0x10036e14
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10036e14
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10037290
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc