joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100102c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 8], ebx
jb 0x100102df
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10010301
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100102f0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebp - 0x10], eax
cmp edx, ebx
jne 0x1001032b
mov eax, ebx
jmp 0x1001032f
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x100103d4
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov edx, edi
jb 0x10010344
mov edx, dword [edi]
cmp dword [eax + 0x14], 0x10
mov edi, dword [eax + 0x10]
jb 0x1001034f
mov eax, dword [eax]
cmp edi, dword [ebp - 8]
jne 0x100103b0
sub edi, 4
jb 0x10010371
nop dword [eax]
mov ecx, dword [eax]
cmp ecx, dword [edx]
jne 0x10010376
add eax, 4
add edx, 4
sub edi, 4
jae 0x10010360
cmp edi, 0xfffffffc
je 0x100103aa
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x100103a3
cmp edi, 0xfffffffd
je 0x100103aa
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x100103a3
cmp edi, 0xfffffffe
je 0x100103aa
mov cl, byte [eax + 2]
cmp cl, byte [edx + 2]
jne 0x100103a3
cmp edi, 0xffffffff
je 0x100103aa
mov al, byte [eax + 3]
cmp al, byte [edx + 3]
je 0x100103aa
sbb eax, eax
or eax, 1
jmp 0x100103ac
xor eax, eax
test eax, eax
je 0x100103c0
mov esi, dword [esi]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x10010323
mov ecx, dword [ebp - 4]
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.1000fc80
test al, al
cmove ebx, esi
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100142a0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100144b5
push ebx
push edi
cmp eax, 0x7c
je 0x100144b3
cmp eax, 0x29
jne 0x100142e1
cmp dword [esi + 0x10], 0
jne 0x100144b3
cmp eax, eax
jne 0x100142e1
test dword [esi + 0x50], 0x10000000
je 0x100144c2
jmp 0x1001446c
cmp eax, 0x2e
jne 0x1001433b
push 5
lea ecx, [esi + 0x24]
call fcn.10016f90
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x1001432f
cmp byte [eax], 0x5c
jne 0x1001432c
lea ecx, [eax + 1]
cmp ecx, edx
je 0x1001432c
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x10014319
mov bl, byte [ecx]
cmp bl, 0x28
je 0x1001432a
cmp bl, 0x29
je 0x1001432a
test dl, 0x10
jne 0x1001432c
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x1001432a
cmp dl, 0x7d
jne 0x1001432c
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.10017390
jmp 0x1001449e
cmp eax, 0x5c
jne 0x10014397
mov ecx, esi
call fcn.10017000
test byte [esi + 0x50], 0x80
je 0x1001438b
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x1001436a
push 4
lea ecx, [esi + 0x24]
call fcn.10016f90
mov ecx, esi
call fcn.10017000
jmp 0x100144a5
cmp al, 0x42
jne 0x1001438b
push 4
lea ecx, [esi + 0x24]
call fcn.10016f90
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10017000
jmp 0x100144a5
mov ecx, esi
call fcn.100144e0
jmp 0x1001449e
cmp eax, 0x5b
jne 0x100143f8
mov ecx, esi
call fcn.10017000
lea ecx, [esi + 0x24]
call fcn.100138a0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x100143c4
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10017000
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x100143e2
cmp eax, 0x5d
jne 0x100143e2
push eax
lea ecx, [esi + 0x24]
call fcn.10013830
mov ecx, esi
call fcn.10017000
mov ecx, esi
call fcn.100151d0
cmp dword [esi + 0x4c], 0x5d
jne 0x100144cb
jmp 0x10014497
cmp eax, 0x28
jne 0x10014428
mov ecx, esi
call fcn.10017000
mov ecx, esi
call fcn.10017590
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x100144c2
mov ecx, esi
call fcn.10017000
test bl, bl
je 0x100144a5
jmp 0x1001449e
cmp eax, 0x5e
jne 0x10014440
push 2
lea ecx, [esi + 0x24]
call fcn.10016f90
mov ecx, esi
call fcn.10017000
jmp 0x100144a5
cmp eax, 0x24
jne 0x10014458
push 3
lea ecx, [esi + 0x24]
call fcn.10016f90
mov ecx, esi
call fcn.10017000
jmp 0x100144a5
cmp eax, 0x2a
je 0x100144b9
cmp eax, 0x2b
je 0x100144b9
cmp eax, 0x3f
je 0x100144b9
cmp eax, 0x7b
je 0x100144b9
cmp eax, 0x7d
jne 0x1001447c
test dword [esi + 0x50], 0x10000000
je 0x100144d4
jmp 0x1001448a
cmp eax, 0x5d
jne 0x1001448a
test dword [esi + 0x50], 0x10000000
je 0x100144cb
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10013720
mov ecx, esi
call fcn.10017000
mov ecx, esi
call fcn.10017060
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x100142b3
pop edi
pop ebx
mov al, cl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.10016600
push 5
mov ecx, esi
call fcn.10016600
push 4
mov ecx, esi
call fcn.10016600
push 6
mov ecx, esi
call fcn.10016600
int3
Function at 0x10017920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10017951
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10017940
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x100219c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101024c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10143118]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x10021a07
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x10021a28
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10021a14
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x10021a88
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x10021a88
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.100214e0
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x10021a50
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.10021600
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10021b8c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10021afe
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x10021b18
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x10021b3b
cmp eax, esi
jne 0x10021b20
mov dword [edx], edi
jmp 0x10021b3b
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x10021b3b
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.100226d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.100aca27
int3
Function at 0x10021ba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101024e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10143118]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x10021be7
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x10021c08
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10021bf4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x10021c86
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x10021c86
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.100214e0
add esp, 8
test al, al
mov eax, dword [ebp + 0xc]
je 0x10021c30
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + 4]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10022990
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10021cb3
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x10021ccd
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x10021cef
cmp eax, esi
jne 0x10021cd5
mov dword [ecx], edi
jmp 0x10021cef
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10021cef
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.100226d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10021d50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10102500
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10143118]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x10021d97
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x10021db8
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10021da4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x10021e18
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x10021e18
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.100214e0
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x10021de0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.10021680
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10021f1c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10021e8e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x10021ea8
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx + 4], edi
jmp 0x10021ecb
cmp eax, esi
jne 0x10021eb0
mov dword [edx], edi
jmp 0x10021ecb
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x10021ecb
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.100226d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.100aca27
int3
Function at 0x10023310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x1002332b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x10023347
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10023336
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x10023380
cmp eax, edi
jne 0x10023378
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x10023388
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10023388
cmp eax, edi
jne 0x1002338b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10022990
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100233c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 8
mov edi, dword [ebx + 0x10]
jb 0x100233da
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x100233f6
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100233e5
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp + 0xc], edx
mov esi, edx
mov dword [ebp - 4], eax
cmp edx, edi
jne 0x10023420
mov eax, edi
jmp 0x10023424
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10023455
lea eax, [esi + 8]
push ebx
push eax
call fcn.100214e0
add esp, 8
test al, al
jne 0x10023443
mov esi, dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x10023418
lea eax, [esi + 8]
push eax
push ebx
call fcn.100214e0
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10033810
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa00
push ebx
push esi
push edi
push str.Engine.dll
push 0x78
push 0x101420a8
call fcn.100e4685
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
add esp, 0xc
push 0x1014a0d8
push 0x40
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0xc340
push 0x174
mov word [esi], ax
lea eax, [ebp - 0x9f4]
push 0
push eax
call fcn.100dbff0
push 0x85c
xorps xmm0, xmm0
lea eax, [ebp - 0x85c]
push 0
push eax
movups xmmword [ebp - 0x878], xmm0
movq qword [ebp - 0x868], xmm0
call fcn.100dbff0
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea esi, [ebp - 0xa00]
add esp, 0x18
mov dword [ebp - 0xa00], eax
mov ecx, 0x280
mov dword [ebp - 0x9fc], 0
mov dword [ebp - 0x880], 0x22
mov dword [ebp - 0x87c], 0
push 0x101116a4
sub esp, 0xa00
mov dword [ebp - 0x9f8], 4
mov edi, esp
mov dword [ebp - 0x860], 0x1002cd80
rep movsd dword es:[edi], dword [esi]
call fcn.10007ff0
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [ebp - 0xa00]
add esp, 0xa04
mov dword [ebp - 0xa00], edx
mov ecx, 0x280
mov dword [ebp - 0x9fc], 0
mov dword [ebp - 0x880], 0x24
mov bl, al
mov dword [ebp - 0x87c], 0
push 0x101116b8
sub esp, 0xa00
mov dword [ebp - 0x860], 0x1002d4f0
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10007ff0
add esp, 0xa04
or al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10033990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x100339c1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x100339b0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10039690
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10039703
cmp ecx, eax
jne 0x100396fb
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1003970b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1003970b
cmp ecx, eax
jne 0x1003970b
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [edi + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.10039b80
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x1003ddc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10103730
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10143118]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x1003de04
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x1003de22
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x1003de10
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x1003deb4
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x1003deb4
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x1003de5a
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x1003de64
mov ecx, dword [edi]
push edx
push eax
push dword [edi + 0x10]
push ecx
call fcn.1003df70
add esp, 0x10
test al, al
mov eax, dword [ebp + 0xc]
je 0x1003de45
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + 4]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.1003e510
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1003dee1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1003defb
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1003df1d
cmp eax, esi
jne 0x1003df03
mov dword [ecx], edi
jmp 0x1003df1d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1003df1d
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1003e470
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc