joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018a0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x80
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
test cl, 1
cmovne eax, edx
shr ecx, 1
test cl, 1
je 0x100018c6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x100018d1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x100018dc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x100018e7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x100018f2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x100018fd
bts eax, 1
test cl, 2
je 0x10001906
bts eax, 0
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov ebx, ecx
and ebx, 0x80000000
neg ebx
lea eax, [ecx + ecx]
sbb ebx, ebx
and ebx, 0x4c11db7
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [edi + eax*4], ebx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
nop
test bl, 1
je 0x100019df
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x100019d0
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
mov edx, 0x80
cmp ecx, 0xff
jle 0x100018b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001a10
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x100c2390
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], ecx
push eax
or ebx, 0xffffffff
mov dword [ebp - 0x408], 0
call fcn.10093810
add esp, 0xc
test eax, eax
je 0x10001a67
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax]
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.10093b60
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov dword [ebp - 0x410], edi
mov edx, edi
test edi, edi
je 0x10001ac2
mov edi, dword [ebp - 0x40c]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [edi + ecx*4]
sub edx, 1
jne 0x10001aa6
mov edi, dword [ebp - 0x410]
cmp edi, 0x400
je 0x10001a70
push dword [ebp - 0x408]
call fcn.10093914
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 4
Function at 0x10001af0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x100c2398
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.10093857
add esp, 0xc
test eax, eax
je 0x10001b29
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.10093c10
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10001b55
call fcn.10093914
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.10093b60
add esp, 0x10
test eax, eax
je 0x10001baf
push esi
nop word [eax + eax]
mov esi, ebx
test eax, eax
je 0x10001b97
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10001b76
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call fcn.10093b60
add esp, 0x10
test eax, eax
jne 0x10001b70
pop esi
push ebx
call fcn.10093667
push dword [ebp + 0xc]
call fcn.10093914
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001bd0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x100c2390
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.10093810
add esp, 0xc
test eax, eax
je 0x10001c09
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.10093c10
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10001c35
call fcn.10093914
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.10093b60
add esp, 0x10
test eax, eax
je 0x10001c8f
push esi
nop word [eax + eax]
mov esi, ebx
test eax, eax
je 0x10001c77
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10001c56
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call fcn.10093b60
add esp, 0x10
test eax, eax
jne 0x10001c50
pop esi
push ebx
call fcn.10093667
push dword [ebp + 0xc]
call fcn.10093914
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001d00
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x100e41c4]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10001d43
xor al, al
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100e69ec], eax
cmp eax, 0xffffffff
je 0x10001d2d
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x100e69f0], eax
test eax, eax
je 0x10001d2d
mov ecx, dword [esp + 0x194]
mov al, 1
xor ecx, esp
mov dword [0x101e69fc], 0x1003b510
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 4

Function at 0x10001d90
Capabilities:
Connect socket
Create thread
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x100e41c4]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x100e69ec], 0xffffffff
push esi
mov esi, dword [ebp + 8]
jne 0x10001ddf
mov ecx, 0x100e4b70
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov eax, 2
mov word [esp + 8], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [esp + 0xa], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x10001e29
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10001e29
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [esp + 0x10]
push eax
call fcn.10090630
add esp, 0xc
push 0x10
lea eax, [esp + 8]
push eax
push dword [0x100e69ec]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x10001e8b
call esi
cmp eax, 0x2733
je 0x10001e8b
call esi
mov ecx, 0x100e5670
push eax
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
add esp, 0x10
mov ecx, 0x100e69e8
call fcn.10001f30
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 8
push 0x23
push dword [0x100e69f0]
push dword [0x100e69ec]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10001ead
call esi
mov ecx, 0x100e5270
jmp 0x10001e57
push 0x80000
push 0
push 0x100e69f4
call fcn.10090bb0
add esp, 0xc
mov dword [0x101669f4], 0
push 0x80000
push 0
push 0x101669f8
call fcn.10090bb0
add esp, 0xc
mov dword [0x101e69f8], 0
push 0x101ef8dc
push 0
push 0x100e69e8
push 0x10002470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x14]
pop esi
mov dword [0x101e6a1c], eax
xor ecx, esp
mov byte [0x101e6a20], 1
mov al, 1
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 8
Function at 0x10001f30
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x100034], 0
je 0x10001f6a
push 0
mov dword [0x101ef8dc], 0xffffffff
push dword [esi + 0x100034]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x100034]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x100034], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10001f80
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x10001f95
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
mov byte [esi + 0x100038], 0
pop esi
ret
Function at 0x10001fb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
push 0
mov eax, 0x80000
mov edx, dword [edi + 0x8000c]
sub eax, edx
push eax
lea eax, [edi + 0xc]
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10002072
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x10002170
call esi
push eax
mov ecx, 0x100e4e70
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
add esp, 0x10
mov ecx, edi
call fcn.10001f30
cmp dword [0x100e69ec], 0xffffffff
je 0x10002037
cmp byte [0x101e6a20], 0
jne 0x100021d3
push ecx
call fcn.10001d00
test al, al
je 0x100021d3
movzx eax, word [0x101e6cf8]
mov ecx, 0x100e69e8
push eax
push 0x101e6d5d
call fcn.10001d90
test al, al
je 0x100021d3
call fcn.1003c960
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [edi + 0x8000c], eax
cmp dword [edi + 0x8000c], 4
jl 0x10002170
xor ecx, ecx
lea esi, [edi + 0xc]
lea eax, [esi + ecx]
mov dword [ebp - 0xc], eax
mov al, byte [eax]
cmp al, 0xc1
jne 0x100020a3
movzx ebx, byte [ecx + edi + 0xd]
mov dl, al
mov al, byte [ecx + edi + 0xf]
jmp 0x100020c4
cmp al, 0xc2
jne 0x100021ac
mov dl, al
movzx eax, byte [ecx + edi + 0xd]
shl ax, 8
movzx ebx, ax
movzx eax, byte [ecx + edi + 0xe]
or ebx, eax
mov al, byte [ecx + edi + 0x10]
cmp ebx, 4
jl 0x10002179
cmp ebx, 0x80000
jg 0x10002179
cmp ebx, dword [edi + 0x8000c]
jg 0x10002147
lea esi, [ecx + edi]
cmp dl, 0xc1
jne 0x100020ff
movzx eax, byte [ecx + edi + 0xe]
lea edx, [ebx - 3]
push eax
lea ecx, [esi + 0xf]
call fcn.10087290
mov al, byte [esi + 0xf]
jmp 0x10002113
movzx eax, byte [ecx + edi + 0xf]
lea edx, [ebx - 4]
push eax
lea ecx, [esi + 0x10]
call fcn.10087290
mov al, byte [esi + 0x10]
add esp, 4
mov byte [ebp - 4], al
mov eax, dword [edi + 0x100014]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
call eax
mov ecx, dword [ebp - 8]
add esp, 0xc
sub dword [edi + 0x8000c], ebx
add ecx, ebx
cmp dword [edi + 0x8000c], 0
mov dword [ebp - 8], ecx
jle 0x10002170
jmp 0x10002087
test ecx, ecx
jle 0x10002170
mov eax, dword [edi + 0x8000c]
test eax, eax
jle 0x10002170
mov edx, 0x80000
sub edx, ecx
cmp eax, edx
jg 0x10002170
push eax
lea eax, [edi + 0xc]
add eax, ecx
push eax
push esi
call fcn.1008f9b0
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, al
mov ecx, 0x100e4c70
push eax
movzx eax, dl
push ebx
push eax
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
add esp, 0x18
mov ecx, edi
call fcn.10001f30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [ecx + edi + 0xc]
mov ecx, str.rjj
push eax
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
add esp, 0x10
mov ecx, edi
call fcn.10001f30
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100021e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8000c
call fcn.1008ec00
mov eax, dword [0x100e41c4]
xor eax, esp
mov dword [esp + 0x80008], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x101e6a04
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x100e69ec]
cmp ebx, 0xffffffff
je 0x10002299
cmp byte [0x101e6a20], 0
je 0x10002299
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push esi
push edi
push eax
call fcn.10090630
add esp, 0xc
cmp byte [esp + 0x10], 0xc1
jne 0x10002249
push dword [esp + 0x12]
lea edx, [esi - 3]
lea ecx, [esp + 0x17]
jmp 0x10002254
push dword [esp + 0x13]
lea edx, [esi - 4]
lea ecx, [esp + 0x18]
call fcn.10087330
mov eax, dword [0x101e69f8]
add esp, 4
test eax, eax
jle 0x100022fc
lea ecx, [eax + esi]
cmp ecx, 0x80000
jle 0x100022bd
push ecx
mov ecx, 0x100e5770
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
add esp, 0x10
mov ecx, 0x100e69e8
call fcn.10001f30
push 0x101e6a04
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 8
push esi
lea ecx, [esp + 0x14]
push ecx
lea eax, [eax + 0x101669f8]
push eax
call fcn.10090630
add esp, 0xc
add dword [0x101e69f8], esi
push 0x101e6a04
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 8
xor edi, edi
test esi, esi
jle 0x100022d8
push 0
push esi
lea eax, [esp + 0x18]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10002328
sub esi, eax
add edi, eax
test esi, esi
jle 0x100022d8
mov ebx, dword [0x100e69ec]
jmp 0x10002302
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x10002393
mov ecx, dword [0x101e69f8]
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10002352
push eax
mov ecx, 0x100e4f70
jmp 0x1000227a
lea eax, [esp + 0x10]
add eax, edi
push esi
push eax
lea eax, [ecx + 0x101669f8]
push eax
call fcn.10090630
add dword [0x101e69f8], esi
add esp, 0xc
push 0x101e6a04
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x80014]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 8
call ebx
push eax
mov ecx, 0x100e5170
jmp 0x1000227a
Function at 0x100023a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10001c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 0x100010], edi
jle 0x100023f2
lea eax, [esi + 0x80010]
push 0
push dword [esi + 0x100010]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100023ff
sub dword [esi + 0x100010], eax
add edi, eax
cmp dword [esi + 0x100010], 0
lea eax, [esi + 0x80010]
jg 0x100023c2
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10002437
push dword [esi + 0x100010]
lea eax, [esi + 0x80010]
add eax, edi
push eax
lea eax, [esi + 0x80010]
push eax
call fcn.1008f9b0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, 0x100e5570
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
add esp, 0x10
mov ecx, esi
call fcn.10001f30
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x10008560
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100085ac
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000858f
cmp edi, 2
jb 0x1000858f
cmp byte [esi], cl
jne 0x1000858f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c5648]
test edi, edi
jne 0x10008575
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100085db
cmp cl, 0x23
jne 0x100085c2
cmp byte [esi], cl
jne 0x100085c2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100c5648]
test cl, cl
jne 0x100085b3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x100087a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x100087c3
push 0x705
push 0x100ca27c
push str.filename__mode
call fcn.1009dd6d
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x100087d0
mov dword [edi], 0
mov edx, 0x100c2398
mov ecx, esi
call fcn.100085f0
mov esi, eax
test esi, esi
je 0x100087fa
mov ecx, esi
call fcn.10008740
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x10008801
push esi
call fcn.10093914
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [0x101eec48]
test ecx, ecx
je 0x10008811
inc dword [ecx + 0xa8]
push eax
call fcn.10093c10
add esp, 4
mov ebx, eax
push esi
test ebx, ebx
je 0x100087f2
push dword [ebp + 8]
push 1
push ebx
call fcn.10093b60
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000885c
call fcn.10093914
mov eax, dword [0x101eec48]
add esp, 4
test eax, eax
je 0x1000884c
dec dword [eax + 0xa8]
push ebx
call fcn.10093667
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10093914
add esp, 4
test edi, edi
je 0x1000886d
mov eax, dword [ebp + 8]
mov dword [edi], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x1000a5a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0xc8], 0
jg 0x1000a5c8
push 0x712
push str.f:3_supper_tools_bandicam_bdcam_2024_srcclientiantihackd3dhook_imguiimguiimgui.h
push str.Size___0
call fcn.1009dd6d
add esp, 0xc
mov eax, dword [ebx + 0xc8]
lea edx, [ebp + 8]
mov ebx, dword [ebx + 0xd0]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100c5648]
sub esi, 1
jne 0x1000a5e2
mov eax, dword [0x101eec48]
not ebx
cmp dword [eax + 0x3e50], ebx
jne 0x1000a61c
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1001c810
add esp, 8
pop esi
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x1001b0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, edx
mov dword [esp + 0xc], eax
cmp dword [edi + 0x524c], 0
je 0x1001b174
mov ebx, dword [edi + 0x5254]
lea esi, [edi + 0x5250]
test ebx, ebx
jns 0x1001b132
je 0x1001b11a
mov eax, ebx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
add ecx, ebx
jmp 0x1001b11f
mov ecx, 8
xor eax, eax
test ecx, ecx
cmovg eax, ecx
mov ecx, esi
push eax
call fcn.1001d340
mov eax, dword [esp + 0xc]
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push eax
call fcn.10008ed0
mov edx, dword [esi]
test edx, edx
je 0x1001b14c
dec edx
jmp 0x1001b14e
xor edx, edx
push dword [edi + 0x524c]
mov eax, dword [esi + 8]
mov ecx, 0x101eec44
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.100952dc
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
lea ecx, [edi + 0x5250]
push eax
call fcn.10008ed0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001bb60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x101eec48]
push esi
mov esi, ecx
push edi
mov dword [eax + 0x5200], 0
test esi, esi
je 0x1001bbb3
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.1001bbc0
mov edx, 0x100ce038
mov ecx, esi
mov edi, eax
call fcn.100085f0
mov esi, eax
test esi, esi
je 0x1001bbb3
push esi
push dword [ebp - 4]
push 1
push edi
call fcn.100952dc
push esi
call fcn.10093914
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10024eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10024ee6
mov eax, dword [0x101eec48]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10024ed6
dec dword [eax + 0xa8]
push ecx
call fcn.10093667
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10024f1a
mov eax, dword [0x101eec48]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x10024f0a
dec dword [eax + 0xa8]
push ecx
call fcn.10093667
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10024f4e
mov eax, dword [0x101eec48]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x10024f3e
dec dword [eax + 0xa8]
push ecx
call fcn.10093667
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10024f9e
mov eax, dword [0x101eec48]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10024f8e
dec dword [eax + 0xa8]
push ecx
call fcn.10093667
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10024fd2
mov eax, dword [0x101eec48]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10024fc2
dec dword [eax + 0xa8]
push ecx
call fcn.10093667
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10025006
mov eax, dword [0x101eec48]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10024ff6
dec dword [eax + 0xa8]
push ecx
call fcn.10093667
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10027c60
Function at 0x1002e210
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x101eec48]
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax + 0x2ec0], 0
je 0x1002e248
push 0xa0
call esi
shr eax, 0xf
test al, 1
jne 0x1002e248
push ecx
push 0xa0
xor dl, dl
mov ecx, 0x210
call fcn.1002e170
add esp, 8
mov eax, dword [0x101eec48]
cmp byte [eax + 0x2f00], 0
je 0x1002e279
push 0xa1
call esi
shr eax, 0xf
test al, 1
jne 0x1002e279
push ecx
push 0xa1
xor dl, dl
mov ecx, 0x214
call fcn.1002e170
add esp, 8
mov eax, dword [0x101eec48]
cmp byte [eax + 0x2ee0], 0
je 0x1002e2a4
push 0x5b
call esi
shr eax, 0xf
test al, 1
jne 0x1002e2a4
push ecx
push 0x5b
xor dl, dl
mov ecx, 0x212
call fcn.1002e170
add esp, 8
mov eax, dword [0x101eec48]
cmp byte [eax + 0x2f20], 0
je 0x1002e2cf
push 0x5c
call esi
shr eax, 0xf
test al, 1
jne 0x1002e2cf
push ecx
push 0x5c
xor dl, dl
mov ecx, 0x216
call fcn.1002e170
add esp, 8
pop esi
ret

Function at 0x1002e2e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101eec48]
sub esp, 8
push esi
push edi
test eax, eax
jne 0x1002e30d
push 0xe89
push 0x100ca27c
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1009dd6d
mov eax, dword [0x101eec48]
add esp, 0xc
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
lea esi, [eax + 8]
push 0x11
call edi
shr eax, 0xf
and al, 1
mov byte [ebp - 4], al
je 0x1002e32e
movss xmm3, dword [0x100d673c]
jmp 0x1002e331
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x281
call fcn.10007e50
push 0x10
call edi
shr eax, 0xf
and al, 1
mov byte [ebp - 4], al
je 0x1002e358
movss xmm3, dword [0x100d673c]
jmp 0x1002e35b
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x282
call fcn.10007e50
push 0x12
call edi
shr eax, 0xf
and al, 1
mov byte [ebp - 4], al
je 0x1002e382
movss xmm3, dword [0x100d673c]
jmp 0x1002e385
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x283
call fcn.10007e50
push 0x5d
call edi
shr eax, 0xf
and al, 1
mov byte [ebp - 4], al
je 0x1002e3ac
movss xmm0, dword [0x100d673c]
jmp 0x1002e3af
xorps xmm0, xmm0
push dword [ebp - 4]
movaps xmm3, xmm0
mov ecx, esi
push 0x284
call fcn.10007e50
pop edi
pop esi
mov esp, ebp
pop ebp
ret