joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x100199ac
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100199c8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100199b7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x10019a01
cmp eax, edi
jne 0x100199f9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10019a09
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10019a09
cmp eax, edi
jne 0x10019a09
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.100185f0
push 0x44
push edi
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10019ab0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x10019b23
cmp eax, edi
jne 0x10019b1b
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10019b2b
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10019b2b
cmp eax, edi
jne 0x10019b2b
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x10]
dec dword [ebx + 8]
call fcn.100173a0
push 0x80
push edi
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10019bc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x10019c33
cmp eax, edi
jne 0x10019c2b
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10019c3b
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10019c3b
cmp eax, edi
jne 0x10019c3b
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x10]
dec dword [ebx + 8]
call fcn.10017270
push 0x68
push edi
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10019cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x10019d0c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10019d28
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10019d17
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x10019d61
cmp eax, edi
jne 0x10019d59
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10019d69
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10019d69
cmp eax, edi
jne 0x10019d69
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.10019e40
push 0x40
push edi
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001b630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1001b65b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100112c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001b67d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1001b67f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1001b703
jg 0x1001b694
test esi, esi
je 0x1001b703
test ecx, ecx
jl 0x1001b6dd
jg 0x1001b69e
test eax, eax
je 0x1001b6dd
cmp edi, ecx
jg 0x1001b6b2
jl 0x1001b6a8
cmp esi, eax
jae 0x1001b6b2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.10075a70
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1001b6e0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1001b703
jg 0x1001b6ea
test esi, esi
je 0x1001b703
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1001b703
push eax
push esi
push 1
push edx
call fcn.1008005b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001b720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1001b74b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100113a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001b76d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1001b76f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x1001b80e
jg 0x1001b78c
test esi, esi
je 0x1001b80e
test ecx, ecx
jl 0x1001b7d9
jg 0x1001b796
test eax, eax
je 0x1001b7d9
cmp ebx, ecx
jg 0x1001b7aa
jl 0x1001b7a0
cmp esi, eax
jae 0x1001b7aa
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.10075a70
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x1001b7e0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x1001b80e
jg 0x1001b7ea
test esi, esi
je 0x1001b80e
cmp dword [edi + 0x4c], 0
je 0x1001b80e
mov ecx, edi
call fcn.1001bea0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.10080643
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001bb40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001bb5c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001bb8e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001bb8e
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1001bc5f
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001bbb6
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001bbdf
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1007f6de
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov byte [ebp - 4], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x1001bc5f
cmp eax, 1
jle 0x1001bc32
cmp eax, 3
jne 0x1001bc5f
push dword [esi + 0x4c]
push dword [ebp - 4]
call fcn.1001a0b0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x1001bc4f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1008005b
add esp, 0x10
cmp edi, eax
jne 0x1001bc5f
lea eax, [ebp - 4]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 8], eax
jne 0x1001bb83
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001bed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1001bf4f
cmp byte [esi + 0x3d], 0
je 0x1001bf4f
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1001bf19
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1001bf21
sub eax, 1
je 0x1001bf25
sub eax, 2
je 0x1001bf4f
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001bf42
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1008005b
add esp, 0x10
cmp edi, eax
jne 0x1001bf19
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001c890
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx eax, byte [edx]
mov edi, dword [0x100e85c4]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0x100e85c0
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100e85d8]
and ecx, eax
lea ebx, [ecx*8]
mov ecx, dword [0x100e85cc]
cmp dword [ebx + ecx], edi
jne 0x1001c900
mov esi, edi
jmp 0x1001c906
mov esi, dword [ebx + ecx + 4]
mov esi, dword [esi]
cmp esi, dword [ebx + ecx]
je 0x1001c933
mov esi, dword [esi + 4]
mov ax, word [edx]
cmp ax, word [esi + 8]
jne 0x1001c906
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov edi, dword [edi]
push edx
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp + 0xc], eax
call fcn.1001cfa0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [0x100e85c8]
sub ecx, eax
cmp ecx, 1
jb 0x1001ca37
inc eax
mov dword [0x100e85c8], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], edx
mov dword [eax], edx
mov edx, dword [0x100e85c4]
mov edi, dword [edx]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001c9a7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [0x100e85c4]
mov ecx, dword [0x100e85cc]
add ecx, ebx
mov eax, dword [ecx]
cmp eax, edx
jne 0x1001c9c2
mov dword [ecx], edi
mov eax, dword [0x100e85cc]
mov dword [ebx + eax + 4], edi
jmp 0x1001c9e7
cmp eax, esi
jne 0x1001c9ca
mov dword [ecx], edi
jmp 0x1001c9e7
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1001c9e7
mov edx, dword [0x100e85cc]
mov eax, dword [edx + ebx + 4]
mov eax, dword [eax + 4]
mov dword [edx + ebx + 4], eax
mov ecx, 0x100e85c0
mov dword [ebp - 4], 2
call fcn.1001ca50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x1001caf0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
mov ecx, dword [ebx + 0x18]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1001cb4b
cmp eax, edi
jne 0x1001cb43
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1001cb53
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1001cb53
cmp eax, edi
jne 0x1001cb56
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1001cb80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b13a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 4], 0
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ecx]
mov edi, dword [ebx + 0x18]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [ecx + 1]
mov dword [ebp - 0x18], ebx
xor edx, eax
imul eax, edx, 0x1000193
and edi, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edi
mov edx, dword [eax + edi*8]
cmp esi, edx
je 0x1001cc31
mov esi, dword [eax + edi*8 + 4]
mov esi, dword [esi]
cmp esi, edx
je 0x1001cc31
mov esi, dword [esi + 4]
mov ax, word [ecx]
cmp ax, word [esi + 8]
jne 0x1001cbe5
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1005cbc1
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001cc5e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1001cc79
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x1001cc9c
cmp eax, esi
jne 0x1001cc81
mov dword [ecx], edi
jmp 0x1001cc9c
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1001cc9c
mov eax, dword [ebx + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1001ca50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001ffc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
nop dword [eax]
cmp ebx, esi
jne 0x10020028
mov ecx, esi
jmp 0x1002002d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10020040
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1002003c
mov eax, dword [eax]
jmp 0x10020020
cmp eax, esi
jne 0x1002008a
mov esi, dword [esi]
lea eax, [ebp + 8]
push ecx
push eax
push ecx
mov dword [ebp + 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10022d90
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10020096
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10021e20
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1005dddf
int3
Function at 0x10021780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1cc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
cmp dword [ebx + 0x14], 0x10
mov esi, ebx
mov dword [ebp - 0x14], edi
jb 0x100217ba
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x100217d8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x100217c6
mov eax, dword [edi + 0x18]
mov esi, dword [edi + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [edi + 0xc]
mov dword [ebp + 0xc], ecx
mov edi, dword [ecx + eax]
cmp esi, edi
je 0x1002184c
mov esi, dword [ecx + eax + 4]
mov esi, dword [esi]
nop word [eax + eax]
cmp esi, edi
je 0x1002184c
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x10021813
mov edx, dword [esi + 8]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x1002181d
mov ecx, dword [ebx]
push dword [esi + 0x18]
push edx
mov edx, dword [ebx + 0x10]
call fcn.10008560
add esp, 8
test al, al
je 0x10021800
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
push ebx
mov eax, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x18], eax
call fcn.100231d0
mov ebx, dword [ebp - 0x14]
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10021949
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 4], edx
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100218bf
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x100218d9
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x100218fc
cmp eax, esi
jne 0x100218e1
mov dword [edx], edi
jmp 0x100218fc
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x100218fc
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10021c60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.1005dddf
int3