joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095f5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402ef3
and dword [ebp - 4], 0
cmp dword [0x44d054], 0
mov ebx, eax
jne 0x4096a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409757
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409757
push eax
call fcn.00402e81
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44d054], eax
call esi
push eax
call fcn.00402e81
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44d058], eax
call esi
push eax
call fcn.00402e81
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44d05c], eax
call esi
push eax
call fcn.00402e81
pop ecx
mov dword [0x44d064], eax
test eax, eax
je 0x4096a6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e81
pop ecx
mov dword [0x44d060], eax
mov eax, dword [0x44d060]
cmp eax, ebx
je 0x4096fe
cmp dword [0x44d064], ebx
je 0x4096fe
push eax
call fcn.00402efc
push dword [0x44d064]
mov esi, eax
call fcn.00402efc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4096fe
test edi, edi
je 0x4096fe
call esi
test eax, eax
je 0x4096f5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4096f5
test byte [ebp - 0xc], 1
jne 0x4096fe
or dword [ebp + 0x10], 0x200000
jmp 0x409737
mov eax, dword [0x44d058]
cmp eax, ebx
je 0x409737
push eax
call fcn.00402efc
pop ecx
test eax, eax
je 0x409737
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409737
mov eax, dword [0x44d05c]
cmp eax, ebx
je 0x409737
push eax
call fcn.00402efc
pop ecx
test eax, eax
je 0x409737
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44d054]
call fcn.00402efc
pop ecx
test eax, eax
je 0x409757
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409759
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10019950
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x1027056f
call fcn.101722b0
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1001997e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], ecx
jmp 0x100199ae
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.10019950
add esp, 8
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10247340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, 0x102712ae
call fcn.101722b0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10025957
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x1002595e
mov al, 1
jmp 0x10025a72
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x84], edx
call fcn.10026370
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 8]
call dword [ebp - 0x84]
mov dword [ebp - 0x7c], eax
call fcn.10026370
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x80]
push edx
call fcn.100263d0
add esp, 8
movzx eax, al
test eax, eax
je 0x100259b0
xor al, al
jmp 0x10025a72
mov dword [ebp - 0xc], 0x20
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x84], ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x40
push edx
mov ecx, dword [ebp - 0x84]
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x10025a05
cmp dword [ebp - 0x88], 1
je 0x10025a0c
cmp dword [ebp - 0x88], 3
je 0x10025a65
jmp 0x10025a70
mov eax, dword [ebp - 8]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
sub eax, ecx
mov dword [ebp - 0x38], eax
je 0x10025a3c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10025a3c
xor al, al
jmp 0x10025a72
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10025a53
mov dword [ebp - 0x84], 1
jmp 0x10025a5d
mov dword [ebp - 0x84], 0
mov al, byte [ebp - 0x84]
jmp 0x10025a72
mov eax, dword [ebp - 8]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x10025a72
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101722f0
mov esp, ebp
pop ebp
ret
Function at 0x10027ba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x102712ae
call fcn.101722b0
cmp dword [ebp + 0x10], 0
jg 0x10027bcd
jl 0x10027bc4
cmp dword [ebp + 0xc], 0
ja 0x10027bcd
xor eax, eax
xor edx, edx
jmp 0x10027d14
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10027bf0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x10027d14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x10027c62
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.10006f10
add esp, 8
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10010200
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x10027d05
mov ecx, dword [ebp - 4]
call fcn.10025ee0
mov dword [ebp - 0x1c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x10027cd3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
push 0xfff
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ucrtbased.dll_fread]
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x20]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x20], 0xfff
je 0x10027cd1
xor eax, eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sbb edx, eax
mov eax, ecx
jmp 0x10027d14
jmp 0x10027c7e
cmp dword [ebp - 8], 0
jbe 0x10027d05
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fread]
add esp, 0x10
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x68]
sub edx, dword [ebp - 0x64]
mov dword [ebp - 8], edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sbb edx, eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10027d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x102712ae
call fcn.101722b0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10027d59
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10027e3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0x10], 0
jl 0x10027df0
jg 0x10027d82
cmp dword [ebp + 0xc], 0
jbe 0x10027df0
cmp dword [ebp - 0x10], 0
jl 0x10027df0
jg 0x10027d90
cmp dword [ebp - 0x14], 0
jbe 0x10027df0
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
jg 0x10027dae
jl 0x10027da2
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x10027dae
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.10010200
add esp, 0xc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x10027e33
jg 0x10027dfe
cmp dword [ebp + 0xc], 0
jbe 0x10027e33
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x10027e33
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
sbb edx, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10052290
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101cbd15
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10247340]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, 0x102716f7
call fcn.101722b0
push str..json
lea eax, [ebp + 8]
push eax
push 0x101da9fc
lea ecx, [ebp - 0x6c]
push ecx
call fcn.100283c0
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x90]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.100282d0
add esp, 0xc
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
call fcn.100231f0
push eax
call dword [sym.imp.ucrtbased.dll_remove]
add esp, 4
lea ecx, [ebp - 0x88]
call fcn.10008530
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.10008530
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10008530
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101722f0
mov esp, ebp
pop ebp
ret
Function at 0x100b5130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov ecx, 0x10274270
call fcn.101722b0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fread]
add esp, 0x10
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b5170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov ecx, 0x10274270
call fcn.101722b0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b53f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov ecx, 0x10274270
call fcn.101722b0
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x101e2b20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x50], 0
je 0x100b545e
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
xor ecx, edx
mov edx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 4], ecx
jmp 0x100b5418
mov eax, dword [ebp - 4]
not eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b5470
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov ecx, 0x10274270
call fcn.101722b0
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x101e2b20
cmp dword [ebp + 0xc], 0
je 0x100b5536
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x54], 0
je 0x100b5534
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 0x4f], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 0x4f]
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 0xd]
cmp eax, 0x23
jne 0x100b5511
cmp dword [ebp + 0xc], 2
jb 0x100b5511
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x100b5511
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
cmp edx, 0x23
jne 0x100b5511
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, dword [ebp - 4]
and ecx, 0xff
movzx edx, byte [ebp - 0xd]
xor ecx, edx
mov edx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x100b54a8
jmp 0x100b55ac
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 0x4f], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 0x4f]
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x100b55ac
movzx eax, byte [ebp - 0xe]
cmp eax, 0x23
jne 0x100b558c
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x100b558c
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
cmp edx, 0x23
jne 0x100b558c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, dword [ebp - 4]
and ecx, 0xff
movzx edx, byte [ebp - 0xe]
xor ecx, edx
mov edx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x100b5536
mov eax, dword [ebp - 4]
not eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c6dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101cf823
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x10247340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, 0x102742ae
call fcn.101722b0
mov ecx, dword [ebp - 0x10]
call fcn.100a6980
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100a6980
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.100c6b30
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.1002a8c0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x10], xmm0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0xc], xmm0
mov eax, 0x3f
mov ecx, dword [ebp - 0x10]
mov word [ecx + 0x42], ax
mov eax, 0xffff
mov ecx, dword [ebp - 0x10]
mov word [ecx + 0x44], ax
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x58]
call fcn.1002a880
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x38], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], 0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov word [ecx + 0x40], ax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x58], 0
mov eax, dword [ebp - 0x10]
movss xmm0, dword [0x101d58f4]
movss dword [eax + 0x48], xmm0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x50], xmm0
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [ecx + 0x4c], xmm0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x54], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c6f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101cf866
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x10247340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, 0x102742ae
call fcn.101722b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.1002a8c0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.1002a8c0
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.100a6980
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.100c6b30
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.100c6b30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x5c]
call fcn.1002a880
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x64]
call fcn.1002a880
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], edx
mov dword [ebp - 0x14], 0
jmp 0x100c7033
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x100c7049
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax*4 + 0x58], 0xffffffff
jmp 0x100c702a
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10112e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d03e8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x10247340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, 0x10275535
call fcn.101722b0
mov ecx, dword [ebp - 0x10]
call fcn.10113070
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.Source::CLegitBot.0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0x10]
add eax, 0x14
mov dword [ebp - 0x54], eax
push 0
mov ecx, dword [ebp - 0x54]
call fcn.1010b500
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.10112df0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x2c], xmm0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.10134320
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.10134320
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x48], xmm0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x4c], xmm0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x50], xmm0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x54], xmm0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x58], xmm0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x5c], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x5d], 0
mov eax, dword [ebp - 0x10]
add eax, 0x60
mov dword [ebp - 0x54], eax
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
mov ecx, dword [ebp - 0x54]
call fcn.1016e4f0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x6c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret