joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100033b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10055da4], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x1000346a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x10055da0], eax
inc ebx
cmp ebx, 0x100
jb 0x100033d0
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x10003496
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10055da0]
sub edi, 1
jne 0x10003475
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100034c8
nop dword [eax]
cmp cl, 0x23
jne 0x100034af
cmp byte [esi], cl
jne 0x100034af
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10055da0]
test cl, cl
jne 0x100034a0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10003ac0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x10003adf
push 0x59c
push str.D:_sources_src_2depsimguiimgui.cpp
push str.filename__file_open_mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edx, 0x100475a4
mov ecx, esi
call fcn.100038e0
mov esi, eax
test esi, esi
jne 0x10003af3
pop esi
ret
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push edi
push 2
push 0
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x10003b91
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x10003b91
push 0
push 0
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x10003b91
push dword [0x100561a0]
inc dword [0x10056360]
lea eax, [edi + 1]
push eax
call fcn.10002df0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10003b91
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x10003b7e
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [0x100561a0]
dec dword [0x10056360]
push ebx
call fcn.10002e10
add esp, 0xc
xor eax, eax
pop edi
pop ebx
pop esi
ret
mov byte [ebx + edi], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, ebx
pop edi
pop ebx
pop esi
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
ret
Function at 0x10008e20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100447ad
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1005500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x30], eax
mov edi, dword [0x100561a4]
mov dword [edi + 0x2968], 0
test eax, eax
je 0x10008f9c
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2968], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x29]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x29], 0
call fcn.1001d3a0
mov byte [ebp - 4], 2
xor esi, esi
mov eax, dword [edi + 0x2978]
mov ecx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test eax, eax
jle 0x10008f20
xor ebx, ebx
cmp esi, eax
jl 0x10008ef6
push 0x45d
push str.D:_sources_src_2depsimguiimgui.h
push str.i___Size
call ecx
add esp, 0xc
mov ecx, dword [edi + 0x2980]
lea edx, [ebp - 0x1c]
add ecx, ebx
push edx
push ecx
push edi
mov eax, dword [ecx + 0x10]
call eax
mov eax, dword [edi + 0x2978]
inc esi
mov ecx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
add ebx, 0x18
cmp esi, eax
jl 0x10008ef6
mov eax, dword [ebp - 0x1c]
test eax, eax
jg 0x10008f3e
push 0x47d
push str.D:_sources_src_2depsimguiimgui.h
push str.Size___0
call ecx
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov esi, dword [ebp - 0x14]
lea ebx, [eax - 1]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x30]
mov edx, 0x100475a8
mov byte [ebp - 4], 0
call fcn.100038e0
mov edi, eax
test edi, edi
je 0x10008f7c
push edi
push ebx
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
mov dword [ebp - 4], 4
test esi, esi
je 0x10008f9c
push dword [0x100561a0]
dec dword [0x10056360]
push esi
call fcn.10002e10
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100401be
mov esp, ebp
pop ebp
ret
Function at 0x10023870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
mov dword [ebp - 8], edx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
cmp dword [ebx + 0xc], eax
jle 0x10023a50
mov esi, dword [ebx + 8]
xorps xmm0, xmm0
add esi, 0x14
mov dword [ebp - 0x14], esi
nop dword [eax + eax]
movss xmm1, dword [esi - 0x14]
mov eax, 0x100
comiss xmm1, xmm0
jbe 0x10023903
mov esi, dword [edx + 4]
mov edi, dword [edx + 0x1c]
cwde
movzx ecx, byte [edi + esi + 6]
movsx ecx, cx
imul ecx, eax
movzx eax, byte [edi + esi + 7]
add cx, ax
mov eax, 0x100
movsx edx, cx
movzx ecx, byte [edi + esi + 4]
cwde
movsx ecx, cx
imul ecx, eax
movzx eax, byte [edi + esi + 5]
mov esi, dword [ebp - 0x14]
add cx, ax
movsx eax, cx
sub eax, edx
movd xmm0, eax
jmp 0x10023926
mov eax, dword [ebp - 8]
mov edx, dword [edx + 0x14]
xorps xmm1, xmmword [0x10050480]
mov eax, dword [eax + 4]
movzx ecx, byte [edx + eax + 0x12]
movzx eax, byte [edx + eax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov ecx, dword [ebp - 0xc]
xor edi, edi
cvtdq2ps xmm0, xmm0
movzx eax, byte [ecx + 0x18]
mov byte [esi], al
movzx eax, byte [ecx + 0x1c]
divss xmm1, xmm0
mov byte [esi + 1], al
mov eax, dword [ebp - 4]
movss dword [ebp - 0x18], xmm1
cmp dword [esi - 8], edi
jle 0x10023a3a
mov ecx, dword [ebx + 0x10]
shl eax, 4
add ecx, 6
add eax, ecx
mov dword [ebp - 0x10], eax
nop
mov edx, dword [esi - 0xc]
test edx, edx
jne 0x1002396e
mov edx, dword [esi - 0x10]
add edx, edi
jmp 0x10023971
mov edx, dword [edx + edi*4]
mov ecx, dword [ebp - 8]
call fcn.1001ecb0
mov ecx, dword [ebp - 0xc]
mov edx, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x1c]
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mov dword [esp + 4], 0
mov dword [esp], 0
addsd xmm0, qword [eax*8 + 0x10050430]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 8]
cvtpd2ps xmm3, xmm0
movd xmm0, eax
mulss xmm3, dword [ebp - 0x18]
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x10050430]
cvtpd2ps xmm2, xmm0
mulss xmm2, dword [ebp - 0x18]
call fcn.10021310
mov edx, dword [ebp - 0xc]
inc edi
mov esi, dword [ebp - 0x10]
add esp, 0x18
movzx eax, word [edx + 0x18]
sub ax, word [ebp - 0x1c]
movzx ecx, word [edx + 0x14]
dec ax
add ax, cx
dec cx
add ax, word [ebp - 0x20]
mov word [esi - 2], ax
movzx eax, word [edx + 0x1c]
sub ax, word [ebp - 0x24]
add ax, cx
mov ecx, esi
add ax, word [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov word [ecx], ax
add ecx, 0x10
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
cmp edi, dword [esi - 8]
jl 0x10023960
mov edx, dword [ebp - 8]
add esi, 0x18
sub dword [ebx + 0xc], 1
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
jne 0x100238b0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10028a20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044916
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1005500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 2
mov eax, 0x3f
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x3f800000
call fcn.10028b80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002a9a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1002a9cd
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1002a9b8
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push esi
push 0x1002a6e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
pop ebp
ret 0xc

Function at 0x1002ad40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1002ad6c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1002ad8e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1002ad90
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1002ae15
jg 0x1002ada5
test esi, esi
je 0x1002ae15
test ecx, ecx
jl 0x1002adf8
jg 0x1002adaf
test eax, eax
je 0x1002adf8
cmp edi, ecx
jg 0x1002adc3
jl 0x1002adb9
cmp esi, eax
jae 0x1002adc3
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x1002ae15
jg 0x1002adfb
test esi, esi
je 0x1002ae15
jmp 0x1002adfb
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1002ae15
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002ae30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x1002ae5c
jl 0x1002ae50
test esi, esi
jne 0x1002ae5c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1002ae75
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov edx, dword [eax]
test edx, edx
je 0x1002aead
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1002aead
cmp eax, dword [ebp + 0xc]
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x1002af30
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1002aed6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x1002af1c
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x1002af43
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1002aef0
test edx, edx
je 0x1002af30
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002b2b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1002b2e0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100401be
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1002b310
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1002b310
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100401be
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1002b3e6
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1002b339
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1002b345
movsx eax, bl
jmp 0x1002b37d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1002b3a7
sub eax, 1
je 0x1002b3a7
sub eax, 2
jne 0x1002b3e6
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100401be
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002b3c5
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002b3e6
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1002b3e6
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100401be
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100401be
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002b82c
cmp byte [esi + 0x3d], 0
je 0x1002b82c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002b81a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002b7e1
sub eax, 1
je 0x1002b7e5
sub eax, 2
jne 0x1002b81a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100401be
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002b803
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002b81a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100401be
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100401be
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100401be
mov esp, ebp
pop ebp
ret
Function at 0x100301e0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push esi
push edi
mov edi, 4
lea esi, [ebx + 4]
jmp dword [edi*4 + 0x10031288]

Function at 0x10031430
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
movss xmm0, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push ecx
movss dword [esp], xmm0
push esi
call dword [0x100561c4]
mov eax, 0xb60b60b7
imul esi
add edx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x5a
sub esi, eax
mov eax, dword [0x100562f4]
mov edi, esi
mov ecx, esi
shl edi, 6
shl ecx, 4
add edi, dword [eax + 0xc4]
add ecx, esi
mov eax, dword [eax + 0xc8]
lea ebx, [eax + ecx*4]
mov dword [ebp + 0xc], ebx
test edi, edi
je 0x1003162f
test ebx, ebx
je 0x1003162f
mov eax, dword [0x10056314]
mov ecx, dword [0x10056310]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [0x10056314]
push eax
call esi
mov dword [ebp + 0x10], eax
test eax, eax
je 0x1003161d
mov ecx, dword [0x10056314]
mov ecx, dword [ecx]
mov esi, dword [ecx + 0xc]
mov ecx, dword [0x10056310]
mov edx, dword [ecx]
call dword [edx + 0x30]
mov ecx, dword [0x10056314]
push eax
call esi
mov esi, eax
test esi, esi
je 0x10031525
cmp byte [0x1005534a], 0
je 0x10031525
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10031525
mov ax, word [0x100563d8]
test ax, ax
jne 0x10031518
mov ecx, 0x198555d0
call fcn.1002bf00
mov word [0x100563d8], ax
movzx eax, ax
test byte [eax + esi], 1
jne 0x10031525
and dword [edi + 0x24], 0xfffffffd
movsx eax, word [edi + 0x38]
xorps xmm1, xmm1
mov ebx, dword [0x1005632c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm1
jbe 0x10031546
mov dword [ebx], 0xffffffff
jmp 0x10031551
comiss xmm1, xmm0
jbe 0x10031551
mov dword [ebx], 1
mov eax, dword [0x10056314]
mov ecx, dword [0x10056310]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [0x10056314]
push eax
call esi
mov esi, eax
mov ax, word [0x100563d8]
test ax, ax
jne 0x1003158c
mov ecx, 0x198555d0
call fcn.1002bf00
mov word [0x100563d8], ax
movzx eax, ax
test byte [eax + esi], 1
jne 0x10031602
cmp byte [0x1005534d], 0
je 0x100315b5
cmp word [edi + 0x38], 0
jge 0x100315b5
or dword [edi + 0x24], 0x200
mov dword [edi + 0x1c], 0xc3c80000
jmp 0x100315d3
cmp byte [0x1005534c], 0
je 0x100315d3
cmp word [edi + 0x38], 0
jle 0x100315d3
or dword [edi + 0x24], 0x400
mov dword [edi + 0x1c], 0x43c80000
cmp byte [0x1005534e], 0
je 0x10031602
mov eax, dword [ebx]
test eax, eax
jle 0x100315f2
or dword [edi + 0x24], 0x200
mov dword [edi + 0x1c], 0xc3c80000
jmp 0x10031602
jns 0x10031602
or dword [edi + 0x24], 0x400
mov dword [edi + 0x1c], 0x43c80000
push edi
push dword [ebp + 0x10]
call fcn.1002ef00
push edi
call fcn.1002ee80
push dword [ebp + 0x14]
push edi
call fcn.1002d580
mov ebx, dword [ebp + 0xc]
push edi
mov ecx, ebx
call fcn.10030160
mov ecx, edi
call fcn.100301e0
mov dword [ebx + 0x40], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x10032400
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.CreateInterface
push str.client.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.CreateInterface
push str.engine.dll
mov ebx, eax
call edi
push eax
call esi
push str.CreateInterface
push str.vstdlib.dll
mov dword [ebp - 4], eax
call edi
push eax
call esi
push str.CreateInterface
push str.vphysics.dll
mov dword [ebp - 8], eax
call edi
push eax
call esi
push str.CreateInterface
push str.vguimatsurface.dll
mov dword [ebp - 0xc], eax
call edi
push eax
call esi
push 0
push str.VClient017
mov esi, eax
call ebx
push 0
push str.VClientEntityList003
mov dword [0x100562f0], eax
call ebx
push 0
push str.GameMovement001
mov dword [0x10056314], eax
call ebx
push 0
push str.VClientPrediction001
mov dword [0x10056304], eax
call ebx
mov ebx, dword [ebp - 4]
push 0
push str.VEngineClient014
mov dword [0x10056308], eax
call ebx
push 0
push str.VModelInfoClient006
mov dword [0x10056310], eax
call ebx
push 0
push str.EngineTraceClient003
mov dword [0x100562f8], eax
call ebx
push 0
push str.VDebugOverlay003
mov dword [0x1005631c], eax
call ebx
add esp, 0x40
mov dword [0x100562fc], eax
push 0
push str.VEngineCvar004
call dword [ebp - 8]
push 0
push str.VPhysicsSurfaceProps001
mov dword [0x100562e4], eax
call dword [ebp - 0xc]
push 0
push str.VEngineVGui001
mov dword [0x10056318], eax
call ebx
mov dword [0x100562e0], eax
push 0
push str.VGUI_Surface030
call esi
add esp, 0x20
mov dword [0x100562e8], eax
mov edx, str.8B_0D_________8B_01_FF_60_44
mov ecx, str.client.dll
call fcn.100400a0
mov edx, str.83_3D___________B8_________B9_________0F_4D_C1
mov ecx, str.engine.dll
mov eax, dword [eax + 2]
mov eax, dword [eax]
mov dword [0x100562f4], eax
call fcn.100400a0
mov edx, str.A1_________8D_53_08
mov ecx, str.shaderapidx9.dll
call fcn.100400a0
mov edx, str.FF_35_________50_8B_11_56
mov ecx, str.client.dll
mov eax, dword [eax + 1]
mov eax, dword [eax]
mov dword [0x100562ec], eax
mov eax, dword [0x100562f0]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov eax, dword [eax]
mov dword [0x1005630c], eax
call fcn.100400a0
pop edi
pop esi
pop ebx
mov eax, dword [eax + 2]
mov eax, dword [eax]
mov dword [0x10056300], eax
mov esp, ebp
pop ebp
ret