joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d750
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp ebx, eax
je 0x1001d8f6
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop word [eax + eax]
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [esi]
lea ecx, [ebx + 0xc]
call fcn.100162e0
mov eax, dword [ebx + 0xc]
push 8
push eax
mov dword [ebx + 0xc], 0
call fcn.10122308
push 0x20
push ebx
call fcn.10122308
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [ebp - 0x18]
dec dword [edx + 8]
cmp ebx, eax
je 0x1001d832
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1001d7d0
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1001d8ec
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1001d846
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edi], eax
jmp 0x1001d849
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x1001d8ec
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x20]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov ebx, esi
mov dword [ebp - 0x18], esi
mov esi, dword [esi]
lea ecx, [ebx + 0xc]
call fcn.100162e0
mov eax, dword [ebx + 0xc]
push 8
push eax
mov dword [ebx + 0xc], 0
call fcn.10122308
push 0x20
push ebx
call fcn.10122308
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [ebp - 0x1c]
dec dword [edx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x1001d8fd
cmp esi, eax
jne 0x1001d8a7
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x1001d860
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001d930
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10124105
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push esi
push eax
call fcn.1001e100
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001d9b1
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x101c91b8], 0x7ffffff
jne 0x1001d9c8
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101c91b4
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x18], 0
call fcn.10121fbe
mov ecx, dword [esi]
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea esi, [edi + 0xc]
mov dword [esi], 0
mov dword [edi + 8], ecx
push 8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.10121fbe
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov dword [ebp - 4], 1
mov ecx, dword [0x101c91b8]
mov esi, dword [0x101c91cc]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10197f30]
mov eax, esi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x10197f30]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x101c91b0]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x1001dad5
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1000f8a0
call fcn.10123350
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x1001dab7
cmp esi, 0x200
jae 0x1001dab5
shl esi, 3
cmp esi, ecx
jae 0x1001dab7
mov esi, ecx
push esi
call fcn.1001def0
push ebx
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1001e100
mov ecx, dword [0x101c91b8]
mov edx, dword [eax]
jmp 0x1001dad8
mov edx, dword [ebp - 0x14]
mov esi, dword [edx + 4]
inc ecx
mov dword [0x101c91b8], ecx
mov dword [edi], edx
mov dword [edi + 4], esi
mov dword [esi], edi
mov dword [edx + 4], edi
mov eax, dword [0x101c91c8]
mov ecx, dword [0x101c91bc]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x101c91b4]
jne 0x1001db09
mov dword [ecx + eax*8], edi
jmp 0x1001db18
cmp ebx, edx
jne 0x1001db12
mov dword [ecx + eax*8], edi
jmp 0x1001db1c
cmp dword [ecx + eax*8 + 4], esi
jne 0x1001db1c
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001def0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1001df1c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x101c91b4]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101c91bc
lea eax, [edi + edi]
push eax
call fcn.10014500
mov eax, dword [0x101c91b4]
lea ebx, [edi - 1]
mov dword [0x101c91c8], ebx
mov dword [0x101c91cc], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1001e056
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101c91bc]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x1001dfb4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1001e021
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1001dfee
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x1001dfe6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x1001e021
cmp ebx, edx
je 0x1001dffe
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1001e032
cmp ebx, edx
jne 0x1001dff2
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1001e056
mov ebx, dword [0x101c91c8]
jmp 0x1001df62
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1001e021
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101242ad
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x40
push esi
mov esi, dword [ebx + 8]
push edi
mov edi, esi
cmp dword [esi + 0x14], 0x10
jb 0x1001f45e
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x1001f482
nop word [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x1001f470
push edx
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.10021670
mov ecx, dword [0x101c9a38]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
cmp ecx, dword [0x101c9a38]
jne 0x1001f4aa
xor al, al
jmp 0x1001f5e4
push esi
lea eax, [ebp - 0x38]
push eax
call fcn.10020f90
push 8
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x11]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c], eax
call fcn.10121fbe
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], eax
add esp, 4
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [ebp - 0x50], eax
mov esi, dword [ebx + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], esi
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 0xc]
add eax, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 1
cmp edi, eax
je 0x1001f5a5
mov edx, dword [ebp - 0x40]
mov eax, edi
nop dword [eax]
mov ecx, dword [esi + 8]
dec ecx
and ecx, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
lea eax, [edx + 1]
cmp ecx, eax
ja 0x1001f558
push ecx
lea ecx, [ebp - 0x50]
call fcn.100219d0
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
dec ecx
and eax, ecx
mov dword [ebp - 0x44], eax
add eax, edx
and ecx, eax
lea esi, [ecx*4]
mov ecx, dword [ebp - 0x4c]
cmp dword [esi + ecx], 0
jne 0x1001f588
push 0x18
call fcn.10121fbe
mov ecx, dword [ebp - 0x4c]
add esp, 4
mov dword [esi + ecx], eax
mov ecx, dword [ebp - 0x4c]
push dword [ebp - 0x18]
mov ecx, dword [esi + ecx]
call fcn.10020b40
mov edx, dword [ebp - 0x40]
inc edi
mov esi, dword [ebx + 0xc]
inc edx
mov eax, edi
mov dword [ebp - 0x40], edx
cmp eax, dword [ebp - 0x1c]
jne 0x1001f530
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 2
mov ecx, dword [ecx + 0x44]
test ecx, ecx
jne 0x1001f5bc
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
mov eax, dword [ecx]
lea edx, [ebp - 0x50]
push edx
call dword [eax + 8]
lea ecx, [ebp - 0x50]
call fcn.10020c30
mov eax, dword [ebp - 0x50]
push 8
push eax
mov dword [ebp - 0x50], 0
call fcn.10122308
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x10020f90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10124405
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x10020fbe
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10020fe1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10020fd0
push esi
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.10021670
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1002100f
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x101c9a3c], 0x38e38e3
jne 0x10021026
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101c9a38
mov dword [ebp - 4], 0
push 0x48
mov dword [ebp - 0x18], 0
call fcn.10121fbe
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
push ebx
call fcn.10020b40
mov dword [edi + 0x44], 0
mov dword [ebp - 4], 1
mov edx, dword [0x101c9a3c]
mov ebx, dword [0x101c9a50]
lea eax, [edx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10197f30]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x10197f30]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x101c9a34]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x10021104
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1000f8a0
call fcn.10123350
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100210e6
cmp ebx, 0x200
jae 0x100210e4
shl ebx, 3
cmp ebx, ecx
jae 0x100210e6
mov ebx, ecx
push ebx
call fcn.10021270
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10021670
mov edx, dword [0x101c9a3c]
mov ecx, dword [eax]
jmp 0x10021107
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ecx + 4]
inc edx
mov dword [0x101c9a3c], edx
mov dword [edi], ecx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [ecx + 4], edi
and esi, dword [0x101c9a4c]
mov eax, dword [0x101c9a40]
mov edx, dword [eax + esi*8]
cmp edx, dword [0x101c9a38]
jne 0x10021136
mov dword [eax + esi*8], edi
jmp 0x10021145
cmp edx, ecx
jne 0x1002113f
mov dword [eax + esi*8], edi
jmp 0x10021149
cmp dword [eax + esi*8 + 4], ebx
jne 0x10021149
mov dword [eax + esi*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10025450
Capabilities:
Hash data using fnv

Disassembly:
mov al, byte [ecx]
test al, al
jne 0x10025459
mov eax, edx
ret
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
jmp fcn.10025450

Function at 0x10026cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10026d1c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10026d44
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10026d4a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10026db2
jg 0x10026d61
test esi, esi
je 0x10026db2
test ecx, ecx
jl 0x10026dad
jg 0x10026d6b
test eax, eax
je 0x10026dad
cmp edi, ecx
jg 0x10026d7f
jl 0x10026d75
cmp esi, eax
jae 0x10026d7f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10026db5
mov ecx, dword [ebp + 8]
jmp 0x10026dbf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10026dd9
jg 0x10026dbf
test esi, esi
je 0x10026dd9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10026dd9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10026df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x10026e14
jl 0x10026e09
test ecx, ecx
jne 0x10026e14
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10026e2e
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10026e7a
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x10026e80
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10026e80
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x10026ef6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10026eac
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10026ee4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10026ef6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10026ec0
test edi, edi
je 0x10026ef6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10027340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1002735c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10027384
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx]
add ecx, eax
cmp eax, ecx
jae 0x10027384
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10027448
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100273ad
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100273b9
movsx eax, bl
jmp 0x100273f1
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10027411
sub eax, 1
je 0x10027411
sub eax, 2
jne 0x10027448
movsx eax, byte [ebp - 1]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x1002742f
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10027448
lea ecx, [ebp - 1]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 8], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100277f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002787c
cmp byte [esi + 0x3d], 0
je 0x1002787c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10027874
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10027845
sub eax, 1
je 0x10027849
sub eax, 2
jne 0x10027874
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10027867
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10027874
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10029290
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101cf110]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x102b94bc]
cmp eax, dword [ecx + 4]
jle 0x100292e7
push 0x102b94bc
call fcn.10121ee8
add esp, 4
cmp dword [0x102b94bc], 0xffffffff
jne 0x100292e7
push 0x102b94bc
mov dword [0x102b94b8], 0
mov dword [0x102b94b4], 0x101a70c4
call fcn.10121e9e
add esp, 4
cmp byte [0x101cf74d], 0
jne 0x10029366
cmp byte [0x101cf74e], 0
jne 0x10029366
cmp byte [0x101cf74c], 0
jne 0x10029366
mov eax, dword [0x101cf750]
cmp eax, dword [0x101a70b8]
jl 0x10029366
cmp dword [0x101cf6f8], 0
je 0x10029321
cmp byte [0x101cf6e6], 0
jne 0x10029366
cmp byte [0x101cf550], 0
jne 0x10029366
mov eax, dword [0x101cf6ec]
sub eax, 0
je 0x1002936d
sub eax, 2
je 0x1002933e
sub eax, 1
jmp 0x10029398
mov eax, dword [0x102b94b4]
mov eax, dword [eax]
test eax, eax
jne 0x10029350
mov dword [0x102b94b8], eax
jmp 0x1002939a
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
movzx eax, al
mov dword [0x102b94b8], eax
je 0x1002939a
xor al, al
pop ecx
pop ebp
ret 4
mov eax, dword [0x102b94b4]
mov eax, dword [eax]
test eax, eax
jne 0x10029384
mov dword [0x102b94b8], eax
xor al, al
pop ecx
pop ebp
ret 4
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
movzx eax, al
mov dword [0x102b94b8], eax
je 0x10029366
cmp byte [0x101cf6e5], 0
je 0x100293b0
mov ecx, dword [ebp + 8]
call fcn.10010d70
pop ecx
pop ebp
ret 4
mov al, 1
pop ecx
pop ebp
ret 4