joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fe4a
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10132fb8], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x1001001f
mov ecx, dword [0x10131360]
mov eax, dword [0x10132fd0]
cmp ecx, 3
ja case.0x1000fe22.0
jmp dword [ecx*4 + 0x10010024]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x1000fe5a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1000fe5a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001001f
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001001f
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1001001f
mov ebx, dword [0x10132ac8]
test ebx, ebx
je 0x1001001f
mov eax, dword [0x10132ac4]
test eax, eax
jne 0x1000fed1
mov edx, 0xe80c2f78
mov ecx, 0x101114a5
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132ac4], eax
cmp dword [eax + ebx], 0
jle 0x1001001f
call fcn.1000a160
cmp eax, 8
je 0x1001001f
call fcn.1000a160
cmp eax, 9
je 0x1001001f
call fcn.1000a160
cmp eax, 0xa
je 0x1001001f
test byte [0x1013303c], 1
je 0x10010018
mov eax, dword [0x10132af8]
mov ebx, dword [0x10132ac8]
test eax, eax
jne 0x1000ff4f
mov edx, 0xe80c2f78
mov ecx, 0x101115e9
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132af8], eax
test byte [eax + ebx], 1
jne 0x10010018
cmp byte [0x10132fe0], 0
je 0x10010009
cmp byte [0x10132fd8], 0
je 0x10010009
mov eax, dword [0x10132fc4]
test al, al
je 0x1000ff9c
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x10132fc4]
test ah, ah
je 0x1000ffbb
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc6], 0
je 0x1000ffe2
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc7], 0
je 0x10010009
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
or dword [edi + 0x30], 2
mov byte [0x10133029], 1
pop edi
pop esi
pop ebx
ret
mov byte [0x10133029], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10010040
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10132fe7], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1001028b
push dword [0x10132f7c]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x1001028b
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001028b
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1001028b
mov edi, dword [0x10132ac8]
test edi, edi
je 0x1001028b
mov eax, dword [0x10132ac4]
test eax, eax
jne 0x100100d9
mov edx, 0xe80c2f78
mov ecx, 0x101114a5
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132ac4], eax
cmp dword [eax + edi], 0
jle 0x1001028b
call fcn.1000a160
cmp eax, 8
je 0x1001028b
call fcn.1000a160
cmp eax, 9
je 0x1001028b
call fcn.1000a160
cmp eax, 0xa
je 0x1001028b
test byte [0x1013303c], 1
je 0x1001025d
mov eax, dword [0x10132af8]
mov edi, dword [0x10132ac8]
test eax, eax
jne 0x10010157
mov edx, 0xe80c2f78
mov ecx, 0x101115e9
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132af8], eax
test byte [eax + edi], 1
jne 0x1001025d
mov eax, dword [ebx + 8]
add eax, 2
mov byte [0x1013843c], 1
mov dword [0x1013845c], eax
mov eax, dword [ebx + 0x30]
or eax, 4
mov byte [0x1013302a], 1
mov dword [ebx + 0x30], eax
mov ecx, eax
cmp byte [0x10132f98], 0
je 0x1001019d
cmp byte [0x10132fe4], 0
je 0x1001019d
or ecx, 2
mov dword [ebx + 0x30], ecx
cmp byte [0x10132fe0], 0
lea eax, [ebx + 8]
lea edx, [ebx + 0x30]
je 0x10010273
cmp byte [0x10132fdb], 0
lea eax, [ebx + 8]
lea edx, [ebx + 0x30]
je 0x10010273
mov eax, dword [0x10132fc4]
test al, al
je 0x100101ee
and ecx, 0xfffffff7
mov dword [ebx + 0x30], ecx
mov ecx, dword [0x10132a7c]
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x10132fc4]
test ah, ah
je 0x1001020d
mov ecx, dword [0x10132a7c]
and dword [ebx + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc6], 0
je 0x10010234
mov ecx, dword [0x10132a7c]
and dword [ebx + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc7], 0
je 0x10010264
mov ecx, dword [0x10132a7c]
and dword [ebx + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
jmp 0x10010264
mov byte [0x1013302a], 0
cmp byte [0x1013843c], 0
lea edx, [ebx + 0x30]
lea eax, [ebx + 8]
je 0x10010284
mov eax, dword [eax]
cmp eax, dword [0x1013845c]
jge 0x10010284
or dword [edx], 4
pop edi
pop esi
pop ebx
ret
mov byte [0x1013843c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10010290
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10132fa0], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x100104c5
mov ecx, dword [0x10131374]
mov eax, dword [0x10132ff8]
cmp ecx, 3
ja case.0x100102b2.0
jmp dword [ecx*4 + 0x100104cc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x100102ea
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100102ea
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100104c5
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100104c5
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100104c5
mov ebx, dword [0x10132ac8]
test ebx, ebx
je 0x100104c5
mov eax, dword [0x10132ac4]
test eax, eax
jne 0x10010361
mov edx, 0xe80c2f78
mov ecx, 0x101114a5
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132ac4], eax
cmp dword [eax + ebx], 0
jle 0x100104c5
call fcn.1000a160
cmp eax, 8
je 0x100104c5
call fcn.1000a160
cmp eax, 9
je 0x100104c5
call fcn.1000a160
cmp eax, 0xa
je 0x100104c5
test byte [0x1013303c], 1
je 0x100104be
mov eax, dword [0x10132af8]
mov ebx, dword [0x10132ac8]
test eax, eax
jne 0x100103df
mov edx, 0xe80c2f78
mov ecx, 0x101115e9
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132af8], eax
test byte [eax + ebx], 1
jne 0x100104be
cmp byte [0x10132fe0], 0
je 0x10010499
cmp byte [0x10132fd9], 0
je 0x10010499
mov eax, dword [0x10132fc4]
test al, al
je 0x1001042c
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x10132fc4]
test ah, ah
je 0x1001044b
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc6], 0
je 0x10010472
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc7], 0
je 0x10010499
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132f98], 0
je 0x100104af
cmp byte [0x10132fe5], 0
je 0x100104af
or dword [edi + 0x30], 2
or dword [edi + 0x30], 4
mov byte [0x1013302c], 1
pop edi
pop esi
pop ebx
ret
mov byte [0x1013302c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x100102b9
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10132fa0], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x100104c5
mov ecx, dword [0x10131374]
mov eax, dword [0x10132ff8]
cmp ecx, 3
ja case.0x100102b2.0
jmp dword [ecx*4 + 0x100104cc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x100102ea
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100102ea
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100104c5
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100104c5
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100104c5
mov ebx, dword [0x10132ac8]
test ebx, ebx
je 0x100104c5
mov eax, dword [0x10132ac4]
test eax, eax
jne 0x10010361
mov edx, 0xe80c2f78
mov ecx, 0x101114a5
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132ac4], eax
cmp dword [eax + ebx], 0
jle 0x100104c5
call fcn.1000a160
cmp eax, 8
je 0x100104c5
call fcn.1000a160
cmp eax, 9
je 0x100104c5
call fcn.1000a160
cmp eax, 0xa
je 0x100104c5
test byte [0x1013303c], 1
je 0x100104be
mov eax, dword [0x10132af8]
mov ebx, dword [0x10132ac8]
test eax, eax
jne 0x100103df
mov edx, 0xe80c2f78
mov ecx, 0x101115e9
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132af8], eax
test byte [eax + ebx], 1
jne 0x100104be
cmp byte [0x10132fe0], 0
je 0x10010499
cmp byte [0x10132fd9], 0
je 0x10010499
mov eax, dword [0x10132fc4]
test al, al
je 0x1001042c
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x10132fc4]
test ah, ah
je 0x1001044b
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc6], 0
je 0x10010472
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc7], 0
je 0x10010499
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132f98], 0
je 0x100104af
cmp byte [0x10132fe5], 0
je 0x100104af
or dword [edi + 0x30], 2
or dword [edi + 0x30], 4
mov byte [0x1013302c], 1
pop edi
pop esi
pop ebx
ret
mov byte [0x1013302c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x100102cb
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10132fa0], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x100104c5
mov ecx, dword [0x10131374]
mov eax, dword [0x10132ff8]
cmp ecx, 3
ja case.0x100102b2.0
jmp dword [ecx*4 + 0x100104cc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x100102ea
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100102ea
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100104c5
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100104c5
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100104c5
mov ebx, dword [0x10132ac8]
test ebx, ebx
je 0x100104c5
mov eax, dword [0x10132ac4]
test eax, eax
jne 0x10010361
mov edx, 0xe80c2f78
mov ecx, 0x101114a5
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132ac4], eax
cmp dword [eax + ebx], 0
jle 0x100104c5
call fcn.1000a160
cmp eax, 8
je 0x100104c5
call fcn.1000a160
cmp eax, 9
je 0x100104c5
call fcn.1000a160
cmp eax, 0xa
je 0x100104c5
test byte [0x1013303c], 1
je 0x100104be
mov eax, dword [0x10132af8]
mov ebx, dword [0x10132ac8]
test eax, eax
jne 0x100103df
mov edx, 0xe80c2f78
mov ecx, 0x101115e9
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132af8], eax
test byte [eax + ebx], 1
jne 0x100104be
cmp byte [0x10132fe0], 0
je 0x10010499
cmp byte [0x10132fd9], 0
je 0x10010499
mov eax, dword [0x10132fc4]
test al, al
je 0x1001042c
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x10132fc4]
test ah, ah
je 0x1001044b
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc6], 0
je 0x10010472
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc7], 0
je 0x10010499
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132f98], 0
je 0x100104af
cmp byte [0x10132fe5], 0
je 0x100104af
or dword [edi + 0x30], 2
or dword [edi + 0x30], 4
mov byte [0x1013302c], 1
pop edi
pop esi
pop ebx
ret
mov byte [0x1013302c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x100102da
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10132fa0], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x100104c5
mov ecx, dword [0x10131374]
mov eax, dword [0x10132ff8]
cmp ecx, 3
ja case.0x100102b2.0
jmp dword [ecx*4 + 0x100104cc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x100102ea
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100102ea
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100104c5
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100104c5
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100104c5
mov ebx, dword [0x10132ac8]
test ebx, ebx
je 0x100104c5
mov eax, dword [0x10132ac4]
test eax, eax
jne 0x10010361
mov edx, 0xe80c2f78
mov ecx, 0x101114a5
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132ac4], eax
cmp dword [eax + ebx], 0
jle 0x100104c5
call fcn.1000a160
cmp eax, 8
je 0x100104c5
call fcn.1000a160
cmp eax, 9
je 0x100104c5
call fcn.1000a160
cmp eax, 0xa
je 0x100104c5
test byte [0x1013303c], 1
je 0x100104be
mov eax, dword [0x10132af8]
mov ebx, dword [0x10132ac8]
test eax, eax
jne 0x100103df
mov edx, 0xe80c2f78
mov ecx, 0x101115e9
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132af8], eax
test byte [eax + ebx], 1
jne 0x100104be
cmp byte [0x10132fe0], 0
je 0x10010499
cmp byte [0x10132fd9], 0
je 0x10010499
mov eax, dword [0x10132fc4]
test al, al
je 0x1001042c
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x10132fc4]
test ah, ah
je 0x1001044b
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc6], 0
je 0x10010472
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132fc7], 0
je 0x10010499
mov ecx, dword [0x10132a7c]
and dword [edi + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x10132f98], 0
je 0x100104af
cmp byte [0x10132fe5], 0
je 0x100104af
or dword [edi + 0x30], 2
or dword [edi + 0x30], 4
mov byte [0x1013302c], 1
pop edi
pop esi
pop ebx
ret
mov byte [0x1013302c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x100104e0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x10132fc0], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x100106db
mov ecx, dword [0x10131278]
mov eax, dword [0x10132fb4]
cmp ecx, 3
ja case.0x10010502.0
jmp dword [ecx*4 + 0x100106e0]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x1001053a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001053a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100106db
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100106db
mov ecx, dword [0x10132a7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100106db
mov ebx, dword [0x10132ac8]
test ebx, ebx
je 0x100106db
mov eax, dword [0x10132ac4]
test eax, eax
jne 0x100105b1
mov edx, 0xe80c2f78
mov ecx, 0x101114a5
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132ac4], eax
cmp dword [eax + ebx], 0
jle 0x100106db
call fcn.1000a160
cmp eax, 8
je 0x100106db
call fcn.1000a160
cmp eax, 0xa
je 0x100106db
mov eax, dword [0x10132af8]
mov ebx, dword [0x10132ac8]
test eax, eax
jne 0x10010614
mov edx, 0xe80c2f78
mov ecx, 0x101115e9
call fcn.10004930
mov edx, 0xc10bf213
mov ecx, 0x101113bd
mov esi, eax
call fcn.10004930
mov edx, esi
mov ecx, eax
call fcn.1007b050
mov dword [0x10132af8], eax
test byte [eax + ebx], 1
jne 0x100106db
call fcn.1000a160
mov ecx, edi
mov esi, eax
call fcn.100151c0
call fcn.10015770
call fcn.1000a160
mov ecx, eax
mov eax, dword [0x10132a9c]
cmp esi, 9
jne 0x10010696
cmp ecx, 9
je 0x10010696
cmp byte [0x10132f98], 0
mov ecx, dword [eax + 0x1c]
mov dword [0x10138454], ecx
je 0x10010666
cmp byte [0x10132fe6], 0
je 0x10010666
or dword [edi + 0x30], 2
cmp byte [0x10132fe0], 0
je 0x1001068d
cmp byte [0x10132fdc], 0
je 0x1001068d
and dword [edi + 0x30], 0xfffff9e7
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov byte [0x10133031], 1
jmp 0x1001069c
mov ecx, dword [0x10138454]
mov eax, dword [eax + 0x1c]
sub eax, ecx
sub eax, 2
cmp eax, 0xc
ja 0x100106db
cmp byte [0x10132fe0], 0
je 0x100106d0
cmp byte [0x10132fdc], 0
je 0x100106d0
and dword [edi + 0x30], 0xfffff9e7
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
or dword [edi + 0x30], 4
mov byte [0x10133031], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10014740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov edx, ebx
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0xf
mov edi, dword [ebx + 0x10]
jbe 0x10014758
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10014774
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10014763
push esi
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.10014ce0
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x1001488e
cmp dword [0x10131d70], 0x4ec4ec4
jne 0x100147a3
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
push 0x34
call fcn.100d6b73
mov edi, eax
add esp, 4
lea ebp, [edi + 8]
push ebx
mov ecx, ebp
call fcn.100148a0
xorps xmm0, xmm0
movups xmmword [ebp + 0x18], xmm0
mov dword [ebp + 0x28], 0
mov edx, dword [0x10131d70]
lea eax, [edx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1012cb50]
mov eax, dword [0x10131d84]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1012cb50]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x10131d68]
jbe 0x1001482e
call fcn.100149e0
push esi
push ebp
lea eax, [esp + 0x20]
push eax
call fcn.10014ce0
mov edx, dword [0x10131d70]
mov ecx, dword [eax]
jmp 0x10014832
mov ecx, dword [esp + 0x10]
mov ebx, dword [ecx + 4]
inc edx
mov dword [0x10131d70], edx
mov dword [edi], ecx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [ecx + 4], edi
and esi, dword [0x10131d80]
mov eax, dword [0x10131d74]
mov edx, dword [eax + esi*8]
cmp edx, dword [0x10131d6c]
jne 0x10014870
mov dword [eax + esi*8], edi
mov dword [eax + esi*8 + 4], edi
lea eax, [edi + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
cmp edx, ecx
jne 0x10014884
mov dword [eax + esi*8], edi
lea eax, [edi + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
cmp dword [eax + esi*8 + 4], ebx
jne 0x1001488e
mov dword [eax + esi*8 + 4], edi
lea eax, [edi + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x10014b50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push ebp
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [esp + 0x18]
push edi
cmp ecx, eax
jbe 0x10014b7b
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [0x10131d6c]
push eax
mov dword [esp + 0x20], eax
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x10131d74
lea eax, [esi + esi]
push eax
call fcn.10004310
mov edi, dword [0x10131d6c]
lea eax, [esi - 1]
mov ecx, dword [esp + 0x1c]
mov dword [0x10131d80], eax
mov dword [0x10131d84], esi
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x10014cab
cmp dword [edi + 0x1c], 0xf
lea ebp, [edi + 8]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebp
jbe 0x10014bdf
mov edx, dword [ebp]
mov dword [esp + 0x14], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ebp + 0x10], edx
jbe 0x10014c06
mov ecx, dword [esp + 0x14]
nop
movzx esi, byte [ecx + edx]
inc edx
xor esi, ebx
imul ebx, esi, 0x1000193
cmp edx, dword [ebp + 0x10]
jb 0x10014bf0
mov ecx, dword [esp + 0x1c]
and ebx, dword [0x10131d80]
mov edx, dword [0x10131d74]
lea edx, [edx + ebx*8]
mov ebx, dword [edx]
mov dword [esp + 0x14], edx
cmp ebx, ecx
jne 0x10014c26
mov dword [edx], edi
mov dword [edx + 4], edi
jmp 0x10014ca1
mov esi, dword [edx + 4]
mov ecx, ebp
lea edx, [esi + 8]
call fcn.1000ec30
test al, al
je 0x10014c62
mov ecx, dword [esi]
mov eax, dword [esp + 0x10]
cmp ecx, edi
je 0x10014c59
mov ebx, dword [edi + 4]
mov dword [ebx], eax
mov esi, dword [eax + 4]
mov dword [esi], ecx
mov edx, dword [ecx + 4]
mov dword [edx], edi
mov dword [ecx + 4], esi
mov dword [eax + 4], ebx
mov dword [edi + 4], edx
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], edi
jmp 0x10014c9d
cmp ebx, esi
je 0x10014c7b
mov esi, dword [esi + 4]
mov ecx, ebp
lea edx, [esi + 8]
call fcn.1000ec30
test al, al
jne 0x10014cb5
cmp ebx, esi
jne 0x10014c66
mov ebx, dword [edi + 4]
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
mov edx, dword [eax + 4]
mov dword [edx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov dword [esi + 4], edx
mov dword [eax + 4], ebx
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx], edi
mov ecx, dword [esp + 0x1c]
mov edi, eax
cmp eax, ecx
jne 0x10014bc5
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x10014c9d