joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408e54
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x156c1c0f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x64bb79f2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10001f80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048895
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10053040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10002300
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1000200c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1014ee5c], 0xfffffff
jne 0x10002023
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1014ee58
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.1004781e
mov ecx, dword [edi]
mov esi, eax
mov edx, dword [edi + 4]
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov ecx, dword [0x1014ee5c]
mov edi, dword [0x1014ee70]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, edi
addsd xmm0, qword [eax*8 + 0x10050550]
cvtdq2pd xmm1, xmm1
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x10050550]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x1014ee54]
comiss xmm2, xmm1
jbe 0x100020f9
divss xmm0, xmm1
call fcn.10001190
call fcn.10048720
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x100020db
cmp edi, 0x200
jae 0x100020d9
shl edi, 3
cmp edi, ecx
jae 0x100020db
mov edi, ecx
push edi
call fcn.10002180
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10002300
mov ecx, dword [0x1014ee5c]
mov edx, dword [eax]
jmp 0x100020fc
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1014ee5c], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1014ee6c]
mov ecx, dword [0x1014ee60]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x1014ee58]
jne 0x1000212d
mov dword [ecx + eax*8], esi
jmp 0x1000213c
cmp ebx, edx
jne 0x10002136
mov dword [ecx + eax*8], esi
jmp 0x10002140
cmp dword [ecx + eax*8 + 4], edi
jne 0x10002140
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002180
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100021ac
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x1014ee58]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1014ee60
lea eax, [edi + edi]
push eax
call fcn.10001e80
mov eax, dword [0x1014ee58]
lea ebx, [edi - 1]
mov dword [0x1014ee6c], ebx
mov dword [0x1014ee70], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100022e6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1014ee60]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x10002244
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100022b1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1000227e
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x10002276
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x100022b1
cmp ebx, edx
je 0x1000228e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100022c2
cmp ebx, edx
jne 0x10002282
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x100022e6
mov ebx, dword [0x1014ee6c]
jmp 0x100021f2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100022b1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100488f0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10053040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
lea edi, [esi + 0x38]
mov dword [esi + 8], 0
lea eax, [edi + 0x10]
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
movups xmmword [esi], xmm0
mov dword [ebp - 0x10], edi
movups xmmword [esi + 0x10], xmm0
movq qword [esi + 0x20], xmm0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov ecx, dword [eax + 4]
test ecx, ecx
jns 0x1000270a
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.1001bc50
lea eax, [edi + 0x10]
mov dword [eax], 0
xorps xmm0, xmm0
mov dword [edi + 0x2c], 0
mov eax, esi
mov dword [edi + 0x30], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004e20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10004e81
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10004e64
cmp edi, 2
jb 0x10004e64
cmp byte [esi], cl
jne 0x10004e64
cmp byte [esi + 1], cl
jne 0x10004e64
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1004b580]
jmp 0x10004e35
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1004b580]
test edi, edi
jne 0x10004e35
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10004eb0
cmp cl, 0x23
jne 0x10004e97
cmp byte [esi], cl
jne 0x10004e97
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1004b580]
test cl, cl
jne 0x10004e88
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10004f60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10004f73
mov dword [ebx], 0
mov edx, 0x1004b174
call fcn.10004ec0
mov esi, eax
test esi, esi
je 0x10005093
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x10005089
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10005089
push esi
call edi
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x10005089
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10005089
mov ecx, edi
call fcn.10007c50
mov dword [ebp + 8], eax
test eax, eax
je 0x10005089
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x10005072
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [0x10100b74]
add esp, 4
test ecx, ecx
je 0x1000505f
movsx edx, word [ecx + 0x5e30]
lea eax, [ecx + 0x5e34]
mov esi, dword [ecx + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], esi
je 0x10005055
lea eax, [edx + 1]
mov edi, 6
cdq
idiv edi
movzx eax, dx
mov word [ecx + 0x5e30], ax
cwde
lea eax, [eax*8 + 0x5e34]
add eax, ecx
xor edx, edx
mov dword [eax], esi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5e2c]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x10005081
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10009760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x10100b74]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
mov eax, dword [esi + 0x49ec]
mov edx, dword [eax]
inc dword [esi + 0xa4]
mov ecx, dword [edi + 0x26c]
mov dword [ebp - 4], edx
cmp dword [ecx + 0x7c], 1
jle 0x1000979f
push ecx
add ecx, 0x78
call fcn.100274c0
mov edx, dword [ebp - 4]
mov edi, dword [edi + 0x26c]
mov esi, dword [edx + ebx*4 + 0x70]
mov eax, dword [edi]
test eax, eax
je 0x10009812
cmp eax, 1
jne 0x100097c3
mov eax, dword [edi + 8]
cmp dword [eax + 0x1c], 0
jne 0x100097c3
cmp dword [eax + 0x20], 0
je 0x10009812
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x100097f9
lea edx, [eax + 1]
mov dword [ebp - 8], edx
test ecx, ecx
je 0x100097e4
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp - 8]
sar eax, 1
add eax, ecx
jmp 0x100097e9
mov eax, 8
cmp eax, edx
mov ecx, esi
cmovg edx, eax
push edx
call fcn.1001bc50
mov edx, dword [ebp - 4]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov dword [eax + ecx*4], edi
inc dword [esi]
inc dword [edx + 0x3c]
mov eax, dword [edi + 0x18]
add dword [edx + 0x44], eax
mov eax, dword [edi + 0xc]
add dword [edx + 0x40], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x190]
mov eax, dword [eax + 0x188]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x10009852
nop dword [eax + eax]
mov ecx, dword [esi]
cmp byte [ecx + 0xae], 0
je 0x1000984b
cmp byte [ecx + 0xb5], 0
jne 0x1000984b
mov edx, ebx
call fcn.10009760
add esi, 4
cmp esi, edi
jne 0x10009830
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b200
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000b23f
cmp bl, 0x23
jne 0x1000b221
cmp byte [esi], bl
jne 0x1000b221
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x1004b580]
test bl, bl
jne 0x1000b212
mov ecx, dword [0x10100b74]
not eax
mov esi, dword [ecx + 0x3f70]
mov edi, dword [ecx + 0x3f78]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000b27e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000b278
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000b27a
mov esi, edx
test esi, esi
jne 0x1000b260
cmp edi, ebx
je 0x1000b28d
cmp dword [edi], eax
jne 0x1000b28d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10011e50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10100b74]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov eax, dword [eax + 0x3f88]
mov esi, 4
mov ebx, dword [eax + 0xf4]
lea edi, [eax + 0xec]
mov dword [ebp - 8], eax
mov eax, dword [edi]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1004b580]
sub esi, 1
jne 0x10011e90
mov eax, dword [ebp - 8]
not ebx
mov eax, dword [eax]
cmp dword [eax + 0x3fc0], ebx
jne 0x10011eca
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1001b3e0
add esp, 8
mov ecx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ecx
jne 0x10011ef5
inc esi
test ecx, ecx
je 0x10011ee3
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10011ee8
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.1001bc50
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5da0], 0
lea esi, [edi + 0x5da4]
je 0x10019e92
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x10019e4c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1001c040
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.100053a0
mov edx, dword [esi]
mov ecx, 0x10100b7c
push dword [edi + 0x5da0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5dac]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100053a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001a2a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x10100b74]
test bl, bl
je 0x1001a2e6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001a2c7
cmp byte [esi], bl
jne 0x1001a2c7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x1004b580]
test bl, bl
jne 0x1001a2b8
mov edi, dword [0x10100b74]
mov ecx, dword [edi + 0x5d44]
not eax
mov edx, dword [edi + 0x5d4c]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x1001a30d
cmp dword [edx + 4], eax
je 0x1001a310
add edx, 0x24
cmp edx, ecx
jne 0x1001a301
xor eax, eax
ret
mov eax, edx
ret
Function at 0x1002ca70
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10053040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x10100b74]
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1002cc1d
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1002cc1d
push esi
push edi
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, dword [0x10100b74]
add esp, 4
mov edi, eax
test esi, esi
je 0x1002cb14
movsx edx, word [esi + 0x5e30]
lea eax, [esi + 0x5e34]
mov ecx, dword [esi + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], ecx
je 0x1002cb0a
lea eax, [edx + 1]
mov dword [ebp - 0x1c], 6
cdq
idiv dword [ebp - 0x1c]
movzx eax, dx
mov word [esi + 0x5e30], ax
cwde
lea eax, [eax*8 + 0x5e34]
add eax, esi
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
inc word [eax + 4]
inc dword [esi + 0x5e28]
test edi, edi
je 0x1002cb27
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x1002cb29
xor edi, edi
or dword [ebx + 0xc], 6
mov dword [ebx + 0x70], edi
mov dword [ebx + 0x68], str.imgui_impl_win32
mov ebx, dword [ebp - 0x24]
mov dword [edi], ebx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x1002cb64
mov esi, dword [esi + 0x70]
jmp 0x1002cb66
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1002cb89
mov dword [esi], eax
mov eax, dword [0x10100b74]
xor esi, esi
mov dword [ebp - 0x18], str.xinput1_4.dll
mov dword [ebp - 0x14], str.xinput1_3.dll
mov dword [ebp - 0x10], str.xinput9_1_0.dll
mov eax, dword [eax + 0x49ec]
mov dword [ebp - 0xc], str.xinput1_2.dll
mov dword [ebp - 8], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x24], ebx
mov byte [edi + 0x29], 1
push dword [ebp + esi*4 - 0x18]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x1002cbeb
inc esi
cmp esi, 5
jl 0x1002cbc2
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047730
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047730
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop ebx
call fcn.10047730
mov esp, ebp
pop ebp
ret
Function at 0x1003d170
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10053040]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x120], ecx
jne 0x1003d1a8
push dword [0x100e0bd0]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1003d3cb
call fcn.1003a630
test eax, eax
je 0x1003d3b7
cmp dword [0x10072088], 0xffffffff
jne 0x1003d1ec
cmp dword [0x100e0bf4], 0
je 0x1003d3cb
mov eax, dword [0x1007208c]
push esi
mov dword [0x10100b88], eax
call fcn.1003ce50
add esp, 4
mov dword [0x10072088], eax
cmp eax, 0xffffffff
je 0x1003d3cb
cmp dword [0x100e0bf4], 0
je 0x1003d3cb
mov ecx, dword [0x1014edd0]
mov eax, dword [ecx]
call dword [eax + 0xec]
mov esi, eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1003d3cb
test esi, esi
je 0x1003d3cb
mov ecx, dword [esi + 0x184]
mov eax, dword [0x10072088]
push 4
mov esi, dword [ecx + eax*4]
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1003d3a1
test esi, esi
je 0x1003d3a1
mov eax, dword [0x10100ba0]
cmp eax, 1
jne 0x1003d286
mov ecx, dword [0x1014edc8]
lea edx, [ebp - 0x11c]
push 1
push edx
push 8
mov eax, dword [ecx]
push dword [esi + 0x10]
call dword [eax + 0x40]
movss xmm0, dword [ebp - 0x118]
addss xmm0, dword [0x100501c4]
movss dword [ebp - 0x118], xmm0
jmp 0x1003d300
cmp eax, 2
jne 0x1003d298
push 1
lea edx, [ebp - 0x11c]
push edx
push 6
jmp 0x1003d2f2
cmp eax, 3
jne 0x1003d2d0
mov ecx, dword [0x1014edc8]
lea edx, [ebp - 0x11c]
push 1
push edx
push 4
mov eax, dword [ecx]
push dword [esi + 0x10]
call dword [eax + 0x40]
movss xmm0, dword [ebp - 0x118]
subss xmm0, dword [0x100501c4]
movss dword [ebp - 0x118], xmm0
jmp 0x1003d300
cmp eax, 4
jne 0x1003d2e2
push 1
lea edx, [ebp - 0x11c]
push edx
push 0x22
jmp 0x1003d2f2
cmp eax, 5
jne 0x1003d300
push 1
lea edx, [ebp - 0x11c]
push edx
push 0x15
mov ecx, dword [0x1014edc8]
push dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x40]
mov esi, dword [0x1014edf4]
sub esp, 0xc
mov ecx, esp
sub esp, 0xc
mov eax, dword [esi + 0x13c]
movq xmm0, qword [eax + 0x10]
mov eax, dword [eax + 0x18]
movq qword [ecx], xmm0
movq xmm0, qword [ebp - 0x11c]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [ebp - 0x114]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x12c]
call fcn.1003c2e0
movss xmm0, dword [ebp - 0x128]
add esp, 0x18
cmp dword [ebp + 0xc], 0
mulss xmm0, dword [0x10050100]
movss dword [esi + 0x58], xmm0
movss xmm0, dword [ebp - 0x12c]
mulss xmm0, dword [0x10050100]
movss dword [esi + 0x54], xmm0
je 0x1003d396
mov esi, dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push 0
push 0
push 2
call esi
push 0
push 0
push 0
push 0
push 4
call esi
cmp dword [ebp - 0x120], 1
jne 0x1003d3cb
jmp 0x1003d3b7
cmp dword [ebp + 0x14], 0
jne 0x1003d3b7
cmp dword [ebp + 8], 0
mov dword [0x100e0bf4], 0
je 0x1003d3c1
mov dword [0x100e0bf4], 1
mov dword [0x10072088], 0xffffffff
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.10047730
mov esp, ebp
pop ebp
ret