joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a690
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4af8d0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x47a837
mov ecx, dword [0x5ac7e4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x47a78c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.004793b0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0049cece
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0049cd95
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5aaf04
call fcn.0049ce03
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00479770
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0049cece
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0049cd95
lea ecx, [esp + 0xc]
call fcn.0049d2a9
mov ecx, dword [esp + 0xc]
push 0x5ab944
push ecx
call fcn.0048b6c4
add esp, 8
test eax, eax
je 0x47a7b4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x47a6ed
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0049cd95
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0049cd95
jmp 0x47a83b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.0047a430
test eax, eax
push 0
je 0x47a81f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.00478ad0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x47a805
cmp eax, 0x64
jg 0x47a7f3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [0x4b1224]
mov esi, eax
jmp 0x47a790
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [0x4b1224]
mov esi, eax
jmp 0x47a790
cmp eax, 0x64
jge 0x47a78c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [0x4b1224]
mov esi, eax
jmp 0x47a790
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.00478ad0
mov esi, eax
jmp 0x47a790
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x47a845
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10121348
push 0x100d6410
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x100011a6
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x1000122f
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x100011cd
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x1000122f
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x10001208
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x10001208
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x1000122f
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x1000122f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100012d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101627c0]
mov dword [ebp - 4], eax
jmp 0x100012e9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001306
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012e0
mov esp, ebp
pop ebp
ret
Function at 0x10001310
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101627d0], eax
je 0x1000132e
mov eax, 0x10dd
jmp 0x10001410
mov eax, dword [0x101627e0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100013ad
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x1000138b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x1000138b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001480
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.100d49ce
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x10001336
mov dword [0x101627e0], 0
call fcn.10001420
mov ecx, dword [0x101627dc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x100013fa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.100d49ce
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x100013c5
mov dword [0x101627dc], 0
mov dword [0x101627d0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001980
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001995
xor eax, eax
jmp 0x10001a0a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x100019c2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x10001a05
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x10001a03
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019ff
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10001a03
xor eax, eax
jmp 0x10001a0a
jmp 0x100019b9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001ac0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101627d4], 0
je 0x10001ad9
mov eax, dword [0x101627d4]
jmp 0x10001b79
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10001aeb
xor eax, eax
jmp 0x10001b79
push 8
call fcn.100d3795
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001b41
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10001b2a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100d49ce
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x101627d4], eax
mov dword [0x101627d8], 0
mov eax, dword [ebp - 8]
jmp 0x10001b79
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10001b0b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x101627dc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x101627dc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100023c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10002490
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000247c
cmp dword [ebp - 4], 0x50000000
jb 0x100023fc
cmp dword [ebp - 4], 0x80000000
ja 0x100023fc
mov dword [ebp - 4], 0x80010000
jmp 0x100023d5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.100d5cf0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10002422
jmp 0x1000247c
cmp dword [ebp - 0x10], 0x10000
jne 0x10002465
cmp dword [ebp - 0x14], 0x10000
jb 0x10002465
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10002458
mov eax, dword [ebp - 0x24]
jmp 0x1000247e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10002477
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10002490
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100023d5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100024d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100025a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10002594
cmp dword [ebp - 4], 0x50000000
jb 0x10002511
cmp dword [ebp - 4], 0x80000000
ja 0x10002511
mov dword [ebp - 4], 0x4fff0000
jmp 0x100024ea
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.100d5cf0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10002537
jmp 0x10002594
cmp dword [ebp - 0x10], 0x10000
jne 0x1000257a
cmp dword [ebp - 0x14], 0x10000
jb 0x1000257a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000256d
mov eax, dword [ebp - 0x24]
jmp 0x10002596
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000258f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.100025a0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100024ea
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100034b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
call fcn.10010be0
call fcn.10010c30
call fcn.10001240
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001ac0
push 0x10003560
push 0x1015d020
call fcn.10001b80
push 0x10003570
push 0x1015d028
call fcn.10001b80
push 0x10003510
push 0x1015d024
call fcn.10001b80
call fcn.100014c0
jmp fcn.10011aa0
Function at 0x10012450
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
call fcn.10074740
add eax, 0x228
push eax
push 0
call fcn.1007bae0
push dword [ebp + 8]
call fcn.100ac1b0
push 1
call fcn.1007b650
push 0
call fcn.100757f0
add esp, 0x14
test al, al
je 0x1001251a
push 0
push 0
call fcn.10075a20
add esp, 8
test al, al
je 0x100124ad
push 5
push 0
push 0
push dword [ebp + 0xc]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.10074740
movups xmm0, xmmword [eax + 0x228]
lea eax, [ebp - 0x10]
push eax
movups xmmword [ebp - 0x20], xmm0
call fcn.10074060
lea eax, [ebp - 8]
push eax
call fcn.10074040
movss xmm0, dword [ebp - 4]
movss dword [ebp - 0xc], xmm0
call fcn.10074950
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call fcn.10069d40
add esp, 8
mov ecx, esi
mov dword [esp], 0x3f800000
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10086c10
push dword [ebp + 0xc]
push str.Open_in_browser_n_t__s
call fcn.1007faf0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.10074740
movups xmm0, xmmword [eax + 0x218]
lea eax, [ebp - 8]
push eax
movups xmmword [ebp - 0x20], xmm0
call fcn.10074060
lea eax, [ebp - 0x10]
push eax
call fcn.10074040
movss xmm0, dword [ebp - 0xc]
movss dword [ebp - 4], xmm0
call fcn.10074950
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call fcn.10069d40
add esp, 8
mov ecx, esi
mov dword [esp], 0x3f800000
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10086c10
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100128b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
lea eax, [ecx + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.10010830
test al, al
je 0x100128f7
push 0x70
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x100128dd
cmp byte [0x10160248], 0
sete byte [0x10160248]
push 0x71
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x100128f7
cmp byte [0x10160223], 0
sete byte [0x10160223]
pop ebp
ret 4

Function at 0x10013650
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
mov eax, dword [eax]
cdq
push edx
push eax
push 0xfff0b9d8
push esi
call fcn.100b2aa0
push 0xffffffffffffffff
push esi
call fcn.100b3330
push 0xfffffffffffffffe
push esi
mov ebx, eax
call fcn.100b2fe0
movzx ecx, bl
add esp, 0x20
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
mov ecx, ebx
shr ecx, 8
movzx eax, cl
pop esi
xor edx, eax
mov eax, ebx
imul ecx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
pop ebx
pop ebp
ret 4
Function at 0x100163e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
push edi
mov edi, dword [eax + 0xc]
mov esi, 0x811c9dc5
mov ebx, dword [eax + 8]
mov dword [ebp - 4], ecx
test edi, edi
je 0x10016411
nop
movzx ecx, byte [ebx + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, edi
jb 0x10016400
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x1001643e
cmp esi, eax
jne 0x10016435
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x10016447
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x10016447
cmp esi, eax
jne 0x1001644a
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [ebx + 8]
mov ecx, dword [eax + 4]
push 0x1c
mov dword [ecx], esi
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push dword [ebp + 0xc]
call fcn.100d37c5
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10019a80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 2
push esi
call fcn.100b33f0
mov edi, dword [ebp + 0x10]
add esp, 8
cmp eax, 4
jne 0x10019b27
lea eax, [ebp - 4]
push eax
push 2
push esi
call fcn.100b3250
mov ebx, dword [ebp - 4]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea eax, [edi + 0x18]
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10019ae7
mov esi, dword [ebp - 0x10]
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10019ad0
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0x18]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.10013b50
mov eax, dword [eax + 4]
test eax, eax
jne 0x10019b01
mov eax, dword [edi + 0x1c]
xor edx, edx
lea ecx, [eax + 0x10]
cmp eax, dword [edi + 0x1c]
cmove ecx, edx
test ecx, ecx
je 0x10019c06
push dword [ecx + 8]
mov eax, dword [ecx + 4]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x10019c06
cmp eax, 0xffffffff
je 0x10019c06
push 2
push esi
call fcn.100b1d10
push eax
push esi
mov dword [ebp - 0xc], esi
call fcn.100b29a0
push 0xfff0b9d8
push esi
call fcn.100b4830
add esp, 0x18
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
lea ecx, [edi + 0x38]
push eax
call fcn.10013650
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x38]
call fcn.10013a30
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10019b88
mov ebx, dword [edi + 0x3c]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10019ba6
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xfffffffe
je 0x10019ba6
push ecx
push 0xfff0b9d8
push eax
call fcn.100b4fb0
add esp, 0xc
mov eax, dword [ebp - 4]
add ebx, 0x10
xor ecx, ecx
cmp eax, dword [edi + 0x3c]
cmove ebx, ecx
test ebx, ebx
je 0x10019c06
push 3
push esi
mov dword [ebp - 0xc], esi
call fcn.100b29a0
push 0xfff0b9d8
push esi
call fcn.100b4830
add esp, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.1001f5c0
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x10019bfd
mov eax, dword [ebp - 0x10]
cmp eax, 0xfffffffe
je 0x10019bfd
push eax
push 0xfff0b9d8
push ecx
call fcn.100b4fb0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0xbc]
mov eax, dword [edi + 0xb4]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019c20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 2
push esi
call fcn.100b33f0
mov edi, dword [ebp + 0x10]
add esp, 8
cmp eax, 4
jne 0x10019cc7
lea eax, [ebp - 4]
push eax
push 2
push esi
call fcn.100b3250
mov ebx, dword [ebp - 4]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea eax, [edi + 0x18]
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10019c87
mov esi, dword [ebp - 0x10]
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10019c70
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0x18]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.10013b50
mov eax, dword [eax + 4]
test eax, eax
jne 0x10019ca1
mov eax, dword [edi + 0x1c]
xor edx, edx
lea ecx, [eax + 0x10]
cmp eax, dword [edi + 0x1c]
cmove ecx, edx
test ecx, ecx
je 0x10019da6
push dword [ecx + 8]
mov eax, dword [ecx + 4]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x10019da6
cmp eax, 0xffffffff
je 0x10019da6
push 2
push esi
call fcn.100b1d10
push eax
push esi
mov dword [ebp - 0xc], esi
call fcn.100b29a0
push 0xfff0b9d8
push esi
call fcn.100b4830
add esp, 0x18
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
lea ecx, [edi + 0x38]
push eax
call fcn.10013650
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x38]
call fcn.10013a30
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10019d28
mov ebx, dword [edi + 0x3c]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10019d46
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xfffffffe
je 0x10019d46
push ecx
push 0xfff0b9d8
push eax
call fcn.100b4fb0
add esp, 0xc
mov eax, dword [ebp - 4]
add ebx, 0x10
xor ecx, ecx
cmp eax, dword [edi + 0x3c]
cmove ebx, ecx
test ebx, ebx
je 0x10019da6
push 3
push esi
mov dword [ebp - 0xc], esi
call fcn.100b29a0
push 0xfff0b9d8
push esi
call fcn.100b4830
add esp, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.1001f5c0
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x10019d9d
mov eax, dword [ebp - 0x10]
cmp eax, 0xfffffffe
je 0x10019d9d
push eax
push 0xfff0b9d8
push ecx
call fcn.100b4fb0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0xac]
mov eax, dword [edi + 0xa4]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 2
push esi
call fcn.100b33f0
mov edi, dword [ebp + 0x10]
add esp, 8
cmp eax, 4
jne 0x10019e5e
lea eax, [ebp - 4]
push eax
push 2
push esi
call fcn.100b3250
mov ebx, dword [ebp - 4]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea eax, [edi + 0x18]
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10019e1f
mov esi, dword [ebp - 0x10]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10019e08
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0x18]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.10013b50
mov eax, dword [eax + 4]
test eax, eax
jne 0x10019e39
mov eax, dword [edi + 0x1c]
xor edx, edx
lea ecx, [eax + 0x10]
cmp eax, dword [edi + 0x1c]
cmove ecx, edx
test ecx, ecx
je 0x10019ef7
push dword [ecx + 8]
mov eax, dword [ecx]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x10019ef7
cmp eax, 0xffffffff
je 0x10019ef7
push 2
push esi
call fcn.100b1d10
push eax
push esi
mov dword [ebp - 4], esi
call fcn.100b29a0
push 0xfff0b9d8
push esi
call fcn.100b4830
add esp, 0x18
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
lea ecx, [edi + 0x38]
push eax
call fcn.10013650
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x38]
call fcn.10013a30
mov ebx, dword [eax + 4]
test ebx, ebx
jne 0x10019eb9
mov ebx, dword [edi + 0x3c]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10019ed7
mov ecx, dword [ebp - 8]
cmp ecx, 0xfffffffe
je 0x10019ed7
push ecx
push 0xfff0b9d8
push eax
call fcn.100b4fb0
add esp, 0xc
xor ecx, ecx
lea eax, [ebx + 0x10]
cmp ebx, dword [edi + 0x3c]
cmove eax, ecx
test eax, eax
je 0x10019ef7
push eax
push esi
call fcn.100146a0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0xb8]
mov eax, dword [edi + 0xb0]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret