joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bec90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100edfa8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x10015747
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x10015768
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10015754
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x100157e6
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x100157e6
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.10015040
add esp, 8
test al, al
mov eax, dword [ebp + 0xc]
je 0x10015790
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + 4]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10016450
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10015813
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1001582d
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1001584f
cmp eax, esi
jne 0x10015835
mov dword [ecx], edi
jmp 0x1001584f
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1001584f
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10016190
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100158b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100becb0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100edfa8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x100158f7
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x10015918
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10015904
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x10015978
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x10015978
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.10015040
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x10015940
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.100151e0
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10015a7c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100159ee
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x10015a08
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx + 4], edi
jmp 0x10015a2b
cmp eax, esi
jne 0x10015a10
mov dword [edx], edi
jmp 0x10015a2b
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x10015a2b
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10016190
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.100817f7
int3
Function at 0x10016d90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x10016dab
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x10016dc7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10016db6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x10016e00
cmp eax, edi
jne 0x10016df8
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x10016e08
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10016e08
cmp eax, edi
jne 0x10016e0b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10016450
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10016e40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 8
mov edi, dword [ebx + 0x10]
jb 0x10016e5a
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x10016e76
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10016e65
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp + 0xc], edx
mov esi, edx
mov dword [ebp - 4], eax
cmp edx, edi
jne 0x10016ea0
mov eax, edi
jmp 0x10016ea4
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10016ed5
lea eax, [esi + 8]
push ebx
push eax
call fcn.10015040
add esp, 8
test al, al
jne 0x10016ec3
mov esi, dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x10016e98
lea eax, [esi + 8]
push eax
push ebx
call fcn.10015040
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001e740
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push str.PPSSPP:_enter
call fcn.10005fc0
add esp, 4
call fcn.1001d740
cmp dword [0x100ed5dc], 9
jne 0x1001e778
cmp dword [0x100ed5e0], 9
jne 0x1001e778
cmp dword [0x100ed5e4], 0
jne 0x1001e778
call fcn.1001d450
call fcn.1001ba90
call fcn.1001c5a0
call fcn.1001c910
call fcn.1001c750
call fcn.1001c400
call fcn.1001cc90
call fcn.1001cfd0
cmp dword [0x100ed5dc], 9
jne 0x1001e7b7
cmp dword [0x100ed5e0], 8
jne 0x1001e7b7
call fcn.1001d140
call fcn.1001d2d0
push ebx
call fcn.1001c270
mov bl, al
call fcn.1001c090
call fcn.1001de10
call fcn.1001dc80
call fcn.1001bef0
call fcn.1001bd60
call fcn.1001d5a0
test bl, bl
pop ebx
jne 0x1001e7ec
call fcn.1001ce40
call fcn.1001caf0
push esi
push str.PPSSPP:_leave
call fcn.10005fc0
add esp, 4
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor esi, esi
cmp dword [ebp - 0x3c], esi
jbe 0x1001e8bc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call edi
test eax, eax
jne 0x1001e82b
add esi, dword [ebp - 0x44]
jmp 0x1001e8b2
mov eax, dword [ebp - 0x18]
cmp eax, 0x1f00000
jne 0x1001e8b0
cmp dword [ebp - 0x10], 4
jne 0x1001e8b0
cmp dword [ebp - 0xc], 0x40000
jne 0x1001e8b0
push str.PPSSPP_memory_found:_searching_for_hooks_should_yield_working_hook_codes
call fcn.10005fc0
mov dword [ebp - 8], 0x360ad83
add esp, 4
mov eax, dword [ebp - 8]
mov dword [0x100ed050], eax
mov word [ebp - 4], 0
mov ax, word [ebp - 4]
mov word [0x100ed054], ax
lea eax, [esi - 0x8000000]
mov dword [0x100ed090], eax
mov eax, dword [ebp - 0x18]
mov dword [0x100ed078], 6
mov dword [0x100ed07c], 0
mov dword [0x100ed098], 0
mov dword [0x100ed0a0], 0xffffffff
mov dword [0x100ed2c8], 0x1001ba60
add esi, eax
cmp esi, dword [ebp - 0x3c]
jb 0x1001e816
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10020b90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4
Function at 0x10021b00
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf508
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x100edfa8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.il2cpp_domain_get
push ebx
call esi
push str.il2cpp_thread_attach
push ebx
mov dword [ebp - 0x20], eax
call esi
push str.il2cpp_domain_get_assemblies
push ebx
mov edi, eax
call esi
push str.il2cpp_assembly_get_image
push dword [ebp + 8]
mov ebx, eax
call esi
push str.il2cpp_class_from_name
push dword [ebp + 8]
mov dword [ebp - 0x18], eax
call esi
push str.il2cpp_class_get_method_from_name
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
call esi
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x10021ca8
test edi, edi
je 0x10021ca8
cmp dword [ebp - 0x18], 0
je 0x10021ca8
test ebx, ebx
je 0x10021ca8
cmp dword [ebp - 0x10], 0
je 0x10021ca8
test ecx, ecx
je 0x10021ca8
call eax
mov esi, eax
push esi
call edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
call ebx
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
jbe 0x10021c94
nop dword [eax]
push dword [eax]
call dword [ebp - 0x18]
push str.String
push 0x100cde10
push eax
mov dword [ebp - 0x24], eax
call dword [ebp - 0x10]
add esp, 0x10
test eax, eax
je 0x10021c09
push dword [ebp + 8]
push eax
call fcn.10021660
add esp, 8
mov esi, dword [0x10c65270]
mov ebx, dword [0x10c65274]
cmp esi, ebx
je 0x10021c7b
nop dword [eax]
push esi
lea ecx, [ebp - 0x34]
call fcn.10020490
mov edi, dword [ebp - 0x34]
mov dword [ebp - 4], 0
push dword [edi + 4]
push dword [edi]
push dword [ebp - 0x24]
call dword [ebp - 0x10]
add esp, 0xc
test eax, eax
je 0x10021c65
push 1
push str.set_text
push eax
call dword [ebp - 0x28]
add esp, 0xc
test eax, eax
je 0x10021c65
push dword [edi + 4]
push dword [eax]
call dword [0x100ed5f8]
add esp, 8
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10008df0
add esi, 0xc
cmp esi, ebx
jne 0x10021c20
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
inc ebx
add eax, 4
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
cmp ebx, dword [ebp - 0x14]
jb 0x10021be0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c1a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f8
push ebx
push esi
push edi
push str.Engine.dll
push 0x78
push 0x100ed0a8
call fcn.100af310
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
add esp, 0xc
push 0x100f30a8
push 0x40
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0xc340
push 0x5f8
mov word [esi], ax
lea eax, [ebp - 0x5f8]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea esi, [ebp - 0x5f8]
add esp, 0xc
mov dword [ebp - 0x5f8], eax
mov ecx, 0x17e
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x478], 0x101
mov dword [ebp - 0x474], 0
push 0x100ce594
sub esp, 0x5f8
mov dword [ebp - 0x5f0], 4
mov edi, esp
mov dword [ebp - 0x458], 0x100256d0
rep movsd dword es:[edi], dword [esi]
call fcn.10006250
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [ebp - 0x5f8]
add esp, 0x5fc
mov dword [ebp - 0x5f8], edx
mov ecx, 0x17e
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x478], 3
mov bl, al
mov dword [ebp - 0x474], 0
push 0x100ce5a8
sub esp, 0x5f8
mov dword [ebp - 0x458], 0x10025e60
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10006250
add esp, 0x5fc
or al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002c300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1002c331
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1002c320
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10034580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c03c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100edfa8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x100345c4
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x100345e2
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x100345d0
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x1003463d
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x1003463d
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.10013eb0
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x10034605
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.10034500
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10034741
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100346b3
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x100346cd
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x100346f0
cmp eax, esi
jne 0x100346d5
mov dword [edx], edi
jmp 0x100346f0
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x100346f0
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10034e00
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.100817f7
int3
Function at 0x10034750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c03e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100edfa8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x10034794
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x100347b2
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x100347a0
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x1003482b
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x1003482b
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.10013eb0
add esp, 8
test al, al
mov eax, dword [ebp + 0xc]
je 0x100347d5
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + 4]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10034ea0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10034858
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x10034872
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x10034894
cmp eax, esi
jne 0x1003487a
mov dword [ecx], edi
jmp 0x10034894
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10034894
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10034e00
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10035370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x1003538b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x100353a7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10035396
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x100353e0
cmp eax, edi
jne 0x100353d8
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x100353e8
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100353e8
cmp eax, edi
jne 0x100353eb
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10034ea0
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10035420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x1003543a
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x10035456
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10035445
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp + 0xc], edx
mov esi, edx
mov dword [ebp - 4], eax
cmp edx, edi
jne 0x10035480
mov eax, edi
jmp 0x10035484
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x100354b5
lea eax, [esi + 8]
push ebx
push eax
call fcn.10013eb0
add esp, 8
test al, al
jne 0x100354a3
mov esi, dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x10035478
lea eax, [esi + 8]
push eax
push ebx
call fcn.10013eb0
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8