joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e4df0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100e4e1c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x1028f794]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1028f79c
lea eax, [edi + edi]
push eax
call fcn.10093aa0
mov eax, dword [0x1028f794]
lea ebx, [edi - 1]
mov dword [0x1028f7a8], ebx
mov dword [0x1028f7ac], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100e4f56
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1028f79c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x100e4eb4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100e4f21
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100e4eee
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x100e4ee6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x100e4f21
cmp ebx, edx
je 0x100e4efe
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100e4f32
cmp ebx, edx
jne 0x100e4ef2
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x100e4f56
mov ebx, dword [0x1028f7a8]
jmp 0x100e4e62
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100e4f21
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100e4ff0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp ebx, eax
je 0x100e5161
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.100937d0
push 0x18
push edi
call fcn.10160098
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x100e50bd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100e5070
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100e5157
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x100e50d1
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edi], eax
jmp 0x100e50d4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100e5157
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.100937d0
push 0x18
push edi
call fcn.10160098
mov edx, dword [ebp - 0x10]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x100e5168
cmp esi, eax
jne 0x100e5127
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100e50e0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100ef420
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10166a1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x10
push esi
mov esi, ecx
xorps xmm0, xmm0
push edi
mov edi, dword [ebx + 8]
mov dword [ebp - 0x18], esi
mov edx, dword [edi]
mov eax, edx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea ecx, [eax + 1]
mov dword [ebp - 0x14], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ef477
sub eax, dword [ebp - 0x14]
mov ecx, esi
push eax
push edx
call fcn.10095460
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [ebp - 0x14], eax
push esi
mov ecx, eax
call fcn.100936c0
push 0x10
mov byte [ebp - 4], 1
call fcn.101600a6
mov edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 2
mov esi, dword [esi + 0x18]
push 0x48
call fcn.101600a6
add esp, 8
mov dword [edi + 4], eax
mov byte [ebp - 4], 3
mov ecx, edi
push esi
mov dword [edi + 0xc], 0
call fcn.100f0d50
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x30], edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x100f00b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100f00dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x100f0104
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x100f010a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x100f0172
jg 0x100f0121
test esi, esi
je 0x100f0172
test ecx, ecx
jl 0x100f016d
jg 0x100f012b
test eax, eax
je 0x100f016d
cmp edi, ecx
jg 0x100f013f
jl 0x100f0135
cmp esi, eax
jae 0x100f013f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x100f0175
mov ecx, dword [ebp + 8]
jmp 0x100f017f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x100f0199
jg 0x100f017f
test esi, esi
je 0x100f0199
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100f0199
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100f01b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x100f01d4
jl 0x100f01c9
test ecx, ecx
jne 0x100f01d4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100f01ee
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x100f0234
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x100f023a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp + 8], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100f023a
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x100f02a9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100f0266
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x100f0297
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100f02a9
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100f0273
test edi, edi
je 0x100f02a9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100f0700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100f071c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100f074e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100f074e
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100f0811
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100f0776
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100f0782
movsx eax, bl
jmp 0x100f07ba
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100f07da
sub eax, 1
je 0x100f07da
sub eax, 2
jne 0x100f0811
movsx eax, byte [ebp - 1]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x100f07f8
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100f0811
lea ecx, [ebp - 1]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 8], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100f0a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100f0b1c
cmp byte [esi + 0x3d], 0
je 0x100f0b1c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100f0b14
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100f0ae5
sub eax, 1
je 0x100f0ae9
sub eax, 2
jne 0x100f0b14
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100f0b07
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100f0b14
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100f5bc0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016717f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x10
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
push esi
push edi
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea esi, [eax + 0x18]
mov dword [ebp - 4], 0
add ecx, 0x18
push esi
mov dword [ebp - 0x18], ecx
call fcn.100936c0
push 0x10
mov byte [ebp - 4], 1
call fcn.101600a6
mov edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 2
mov esi, dword [esi + 0x18]
push 0x48
call fcn.101600a6
add esp, 8
mov dword [edi + 4], eax
mov byte [ebp - 4], 3
mov ecx, edi
push esi
mov dword [edi + 0xc], 0
call fcn.100f0d50
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x30], edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x1010fe10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [0x1034101d], 0
push esi
je 0x10110068
cmp byte [0x10340f84], 0
xorps xmm2, xmm2
mov esi, dword [0x10292678]
je 0x1010fe84
movd xmm0, dword [0x10340f7c]
movd xmm1, dword [0x10340f80]
or dword [esi + 0x470c], 1
cvtdq2ps xmm0, xmm0
mov dword [esi + 0x4710], 1
cvtdq2ps xmm1, xmm1
movss dword [esi + 0x471c], xmm0
movss dword [esi + 0x4720], xmm1
movss dword [esi + 0x4724], xmm2
movss dword [esi + 0x4728], xmm2
mov byte [0x10340f84], 0
movss xmm1, dword [esi + 0x3788]
lea eax, [ebp - 0x10]
movss xmm0, dword [esi + 0x378c]
lea ecx, [esi + 0x4778]
push eax
mov dword [ebp - 0x10], 2
movss dword [ebp - 0xc], xmm1
movss dword [ebp - 8], xmm0
call fcn.1005a360
mov dword [esi + 0x3788], 0x40800000
lea eax, [ebp - 0x10]
mov dword [esi + 0x378c], 0x40800000
mov esi, dword [0x10292678]
push eax
mov dword [ebp - 0x10], 4
movss xmm0, dword [esi + 0x3794]
lea ecx, [esi + 0x4778]
movss dword [ebp - 0xc], xmm0
call fcn.1005a360
mov eax, dword [0x10292678]
xor edx, edx
mov dword [esi + 0x3794], 0
mov ecx, str.Keybinds
push 0x23
or dword [eax + 0x470c], 2
mov dword [eax + 0x472c], 0x43480000
mov dword [eax + 0x4730], 0
mov dword [eax + 0x4714], 1
call fcn.1004a530
add esp, 4
test al, al
je 0x1011005e
cmp byte [0x103404bd], 0
mov eax, dword [0x10340470]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
je 0x1010ff64
test eax, eax
je 0x1010ff5e
push eax
call esi
test ax, ax
jns 0x1010ff64
mov byte [ebp - 4], 1
jmp 0x1010ff68
mov byte [ebp - 4], 0
push dword [ebp - 4]
push str.Aimbot
call fcn.10110070
movzx eax, byte [0x10340449]
push eax
push str.Auto_Shoot
call fcn.10110070
cmp byte [0x10342ca1], 0
je 0x1010ffac
cmp dword [0x10342cc8], 1
jne 0x1010ffa6
push dword [0x10342b8c]
call esi
test ax, ax
jns 0x1010ffac
mov byte [ebp - 4], 1
jmp 0x1010ffb0
mov byte [ebp - 4], 0
push dword [ebp - 4]
push str.Double_Tap
call fcn.10110070
movzx eax, byte [0x10342edd]
push eax
push str.Anti_Aim
call fcn.10110070
cmp byte [0x10342aed], 0
je 0x1010fff4
cmp dword [0x10342b14], 1
jne 0x1010ffee
push dword [0x103429b8]
call esi
test ax, ax
jns 0x1010fff4
mov byte [ebp - 4], 1
jmp 0x1010fff8
mov byte [ebp - 4], 0
push dword [ebp - 4]
push str.Fakelag
call fcn.10110070
cmp byte [0x10340ddd], 0
mov eax, dword [0x10340db8]
je 0x10110025
test eax, eax
je 0x1011001f
push eax
call esi
test ax, ax
jns 0x10110025
mov byte [ebp - 4], 1
jmp 0x10110029
mov byte [ebp - 4], 0
push dword [ebp - 4]
push str.Triggerbot
call fcn.10110070
mov eax, dword [0x10292678]
mov eax, dword [eax + 0x3e58]
movss xmm0, dword [eax + 0x18]
cvttss2si eax, dword [eax + 0x14]
mov dword [0x10340f7c], eax
cvttss2si eax, xmm0
mov dword [0x10340f80], eax
call fcn.1004cd60
mov ecx, 2
call fcn.10042260
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10112240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x10167f55
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0xf
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x1011226d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x10112292
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x10112280
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.100966f0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x101122c2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
jne 0x101122d6
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.101600a6
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.100936c0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1027e510]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1027e510]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x101123a4
divss xmm0, xmm3
call fcn.1005ae30
call fcn.10162010
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10112388
cmp eax, 0x200
jae 0x10112386
shl eax, 3
cmp eax, ecx
jae 0x10112388
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100a8310
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100966f0
mov edx, dword [eax]
jmp 0x101123a7
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x101123cf
mov dword [ecx + eax*8], edi
jmp 0x101123e1
cmp esi, edx
jne 0x101123d8
mov dword [ecx + eax*8], edi
jmp 0x101123e5
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x101123e5
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10112410
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164185
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10113340
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10112491
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1033e760], 0xfffffff
jne 0x101124a8
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1033e75c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.101600a6
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x1033e760]
mov edi, dword [0x1033e774]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1027e510]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x1027e510]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x1033e758]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x10112582
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1005ae30
call fcn.10162010
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x10112564
cmp edi, 0x200
jae 0x10112562
shl edi, 3
cmp edi, ecx
jae 0x10112564
mov edi, ecx
push edi
call fcn.101131d0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10113340
mov ecx, dword [0x1033e760]
mov edx, dword [eax]
jmp 0x10112585
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1033e760], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1033e770]
mov ecx, dword [0x1033e764]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x1033e75c]
jne 0x101125b6
mov dword [ecx + eax*8], esi
jmp 0x101125c5
cmp ebx, edx
jne 0x101125bf
mov dword [ecx + eax*8], esi
jmp 0x101125c9
cmp dword [ecx + eax*8 + 4], edi
jne 0x101125c9
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8