joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ee20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1019c324]
sub esp, 8
mov ecx, dword [eax]
call fcn.10087df0
cmp eax, 9
je 0x1000f046
cmp eax, 8
je 0x1000f046
mov eax, dword [0x1019c324]
mov ecx, dword [eax]
call fcn.10011db0
mov eax, dword [eax]
mov dword [0x1019c8a4], eax
mov eax, dword [0x1019c324]
mov ecx, dword [eax]
call fcn.10012230
movss xmm0, dword [eax + 8]
mov eax, dword [0x1019c324]
movss dword [0x1019c8a8], xmm0
mov ecx, dword [eax]
call fcn.100120b0
movss xmm0, dword [eax]
movss dword [0x1015c028], xmm0
movss xmm0, dword [eax + 4]
movss dword [0x1015c02c], xmm0
movss xmm0, dword [eax + 8]
mov eax, dword [0x1019c324]
movss dword [0x1015c030], xmm0
mov ecx, dword [eax]
call fcn.10012230
mov ecx, dword [0x1019c838]
push str.sv_gravity
movss xmm0, dword [eax]
movss dword [0x1015c01c], xmm0
movss xmm0, dword [eax + 4]
movss dword [0x1015c020], xmm0
movss xmm0, dword [eax + 8]
movss dword [0x1015c024], xmm0
mov eax, dword [ecx]
mov eax, dword [eax + 0x44]
call eax
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x30]
call eax
fmul dword [0x100e4310]
mov eax, dword [0x1019c830]
mov ecx, dword [0x101a3f58]
fstp dword [ebp - 4]
movss xmm0, dword [ebp - 4]
mulss xmm0, dword [eax + 0x20]
mov eax, dword fs:[0x2c]
movss dword [0x1019c8ac], xmm0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1019ce04]
cmp eax, dword [ecx + 4]
jg 0x1000f04a
movss xmm0, dword [0x1019c8ac]
xorps xmm0, xmmword [0x100e4350]
comiss xmm0, dword [0x1019ce00]
jbe 0x1000efa5
mov eax, dword [0x1019c324]
mov ecx, dword [eax]
call fcn.10012230
push ecx
fld dword [eax + 8]
fstp dword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
fstp dword [ebp - 8]
fld dword [0x1019c8ac]
fstp dword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
movss xmm0, dword [ebp - 8]
add esp, 4
fstp dword [ebp - 4]
movss xmm1, dword [ebp - 4]
xorps xmm1, xmmword [0x100e4350]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1000efa5
mov eax, dword [0x1019c324]
mov ecx, dword [eax]
call fcn.10087df0
cmp eax, 9
je 0x1000efa5
mov al, 1
jmp 0x1000efa7
xor al, al
movss xmm0, dword [0x1019c8a8]
mov byte [0x1019c958], al
mov eax, dword [0x1019c324]
push esi
movss dword [0x1019ce00], xmm0
mov ecx, dword [eax]
call fcn.10011db0
mov esi, dword [ebp + 8]
mov ecx, 0
test byte [eax], 1
movzx eax, byte [0x1019c960]
cmovne eax, ecx
mov byte [0x1019c960], al
cmp byte [0x1019c95e], cl
je 0x1000f000
mov eax, dword [0x1019c324]
mov ecx, dword [eax]
call fcn.10011db0
test byte [eax], 1
jne 0x1000f000
or dword [esi + 0x30], 4
mov eax, dword [0x1019c324]
mov ecx, dword [eax]
call fcn.10011db0
push dword [0x1019c498]
mov ecx, 0
test byte [eax], 1
movzx eax, byte [0x1019c95f]
cmovne eax, ecx
mov byte [0x1019c95f], al
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000f045
cmp byte [0x1019c958], 0
je 0x1000f045
mov eax, dword [0x1019c8b4]
mov dword [esi + 0x30], eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x1019ce04
call fcn.100dc42f
add esp, 4
cmp dword [0x1019ce04], 0xffffffff
jne 0x1000ef2f
movss xmm0, dword [0x1019c8a8]
push 0x1019ce04
movss dword [0x1019ce00], xmm0
call fcn.100dc3e5
add esp, 4
jmp 0x1000ef2f
Function at 0x1000f0a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1019c830]
xor ecx, ecx
movss xmm0, dword [eax + 0x10]
comiss xmm0, dword [0x1019cdbc]
movzx eax, byte [0x1019c95c]
cmova eax, ecx
mov byte [0x1019c95c], al
cmp byte [0x1019c4ad], cl
jne 0x1000f0e2
push dword [0x1019c4e4]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000f170
test byte [ebp + 0xc], 1
je 0x1000f11a
mov eax, dword [0x1019c324]
mov ecx, dword [eax]
call fcn.10011db0
test byte [eax], 1
jne 0x1000f11a
mov eax, dword [0x1019c830]
movss xmm0, dword [eax + 0x10]
addss xmm0, dword [0x100e4304]
mov byte [0x1019c95c], 1
movss dword [0x1019cdbc], xmm0
cmp byte [0x1019c4ad], 0
je 0x1000f153
push dword [0x1019c4e4]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000f153
mov ecx, dword [0x1019c838]
push str.sv_standable_normal
mov eax, dword [ecx]
call dword [eax + 0x44]
push 0x100e41b4
lea ecx, [eax + 0x18]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop ebp
ret
mov ecx, dword [0x1019c838]
push str.sv_standable_normal
mov eax, dword [ecx]
call dword [eax + 0x44]
push 0x100e43e8
lea ecx, [eax + 0x18]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop ebp
ret
Function at 0x1000fed0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x1019c830]
xor edx, edx
movzx eax, byte [0x1019c95d]
movss xmm0, dword [ecx + 0x10]
comiss xmm0, dword [0x1019cdb8]
cmova eax, edx
mov byte [0x1019c95d], al
mov eax, dword [0x1019c324]
cmp dword [eax], edx
je 0x1000ff6b
cmp byte [0x1019c484], dl
je 0x1000ff6b
test byte [0x1019c8a4], 1
jne 0x1000ff1e
mov eax, dword [ecx + 0x1c]
add eax, dword [0x1019c4b4]
mov dword [0x1019c8c4], eax
push dword [0x1019c4cc]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000ff6b
test byte [0x1019c8a4], 1
je 0x1000ff6b
mov ecx, dword [0x1019c830]
mov eax, dword [0x1019c8c4]
movss xmm0, dword [ecx + 0x10]
addss xmm0, dword [0x100e4304]
mov byte [0x1019c95d], 1
movss dword [0x1019cdb8], xmm0
cmp eax, dword [ecx + 0x1c]
jl 0x1000ff6b
mov eax, dword [ebp + 8]
and dword [eax + 0x30], 0xfffffffd
pop ebp
ret
Function at 0x10023e50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x100df515
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x10023e7d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x10023ea2
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x10023e90
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10022b20
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10023ed2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x1002403c
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.100dbf73
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.100044d0
mov dword [edi + 0x20], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e6200]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100e6200]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10023fdb
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100dc740
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10023fbf
cmp eax, 0x200
jae 0x10023fbd
shl eax, 3
cmp eax, ecx
jae 0x10023fbf
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100251b0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10022b20
mov edx, dword [eax]
jmp 0x10023fde
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1002400a
mov dword [ecx + eax*8], edi
jmp 0x1002401c
cmp esi, edx
jne 0x10024013
mov dword [ecx + eax*8], edi
jmp 0x10024020
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10024020
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10030a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10030afc
cmp byte [esi + 0x3d], 0
je 0x10030afc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10030af4
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10030ac5
sub eax, 1
je 0x10030ac9
sub eax, 2
jne 0x10030af4
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10030ae7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10030af4
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10032890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100328ac
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100328d4
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx]
add ecx, eax
cmp eax, ecx
jae 0x100328d4
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100329b1
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100328fd
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10032927
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov byte [ebp - 4], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1003297c
sub eax, 1
je 0x1003297c
sub eax, 2
jne 0x100329b1
push dword [esi + 0x4c]
push dword [ebp - 4]
call fcn.1002c760
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x1003299a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100329b1
lea eax, [ebp - 4]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 8], eax
je 0x100329b1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100340b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x100340d4
jl 0x100340c8
test esi, esi
jne 0x100340d4
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100340ed
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov ecx, dword [eax]
test ecx, ecx
je 0x1003412b
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1003412b
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push ecx
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp + 8], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
jmp 0x10034131
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x100341b0
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1003415a
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp + 8]
cmp edi, 0xfff
jbe 0x1003419c
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp + 8]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp + 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x100341c3
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10034170
test edx, edx
je 0x100341b0
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100341e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10034205
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10034226
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10034228
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x100342a6
jg 0x1003423b
test esi, esi
je 0x100342a6
test ecx, ecx
jl 0x10034289
jg 0x10034245
test eax, eax
je 0x10034289
cmp edi, ecx
jg 0x10034257
jl 0x1003424f
cmp esi, eax
jae 0x10034257
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [ebp - 4]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x100342a6
jg 0x1003428c
test esi, esi
je 0x100342a6
jmp 0x1003428c
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100342a6
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003df30
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e065d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
push 2
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x1c], eax
push ecx
push eax
mov dword [ebp - 0x260], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1003df99
xor bl, bl
jmp 0x1003e099
push esi
push edi
nop dword [eax + eax]
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
lea edx, [eax + 2]
mov dword [ebp - 0x20], 7
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1003dfc0
sub eax, edx
lea ecx, [ebp - 0x34]
sar eax, 1
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.10031820
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x34]
mov esi, dword [ebp - 0x34]
cmp edi, 8
cmovae eax, esi
cmp dword [ebp - 0x24], 0xb
jne 0x1003e00c
push 0xb
push str.Spotify.exe
push eax
call fcn.100319e0
add esp, 0xc
test eax, eax
jne 0x1003e00c
mov bl, 1
jmp 0x1003e00e
xor bl, bl
cmp edi, 8
jb 0x1003e042
lea ecx, [edi*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x1003e038
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003e0c2
push ecx
push esi
call fcn.100dbfa3
add esp, 8
test bl, bl
je 0x1003e06c
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x10]
je 0x1003e05c
mov eax, dword [ebp - 0x258]
mov dword [ecx], eax
add dword [ebp - 0x14], 4
jmp 0x1003e06c
lea eax, [ebp - 0x258]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.10003dc0
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1003dfa0
lea eax, [ebp - 0x18]
push eax
push 0x1003c690
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
pop edi
setne bl
pop esi
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x1003e0d2
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1003e0c8
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003e0c8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100dbfa3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004ac70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [0x101a224c]
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [esi + 0x198c]
test al, 0x10
jne 0x1004ad9c
mov ebx, dword [edi + 0x10c]
test ebx, ebx
je 0x1004acb0
cmp dword [esi + 0x19ac], ebx
jne 0x1004ad93
cmp byte [esi + 0xe8], 0
je 0x1004ad93
test ebx, ebx
jne 0x1004ad46
test al, 8
je 0x1004ad93
mov al, byte [edi + 0x110]
and al, 1
mov byte [ebp - 1], al
jne 0x1004acf2
cmp dword [esi + 0x19ac], ebx
je 0x1004ad93
cmp dword [esi + 0x19d4], edi
jne 0x1004ad93
lea eax, [edi + 0x114]
mov ecx, edi
push eax
call fcn.1004ec80
mov ebx, eax
mov al, byte [ebp - 1]
mov dword [edi + 0x10c], ebx
test al, al
je 0x1004ad34
push ebx
call fcn.100571d0
add esp, 4
cmp byte [esi + 0x3d0], 0
je 0x1004ad31
push edi
push ebx
call fcn.10056d00
push edi
call fcn.1004e1b0
add esp, 0xc
mov al, byte [ebp - 1]
mov ecx, dword [esi + 0x19ac]
cmp ecx, ebx
jne 0x1004ad93
mov byte [esi + 0x19bd], al
jmp 0x1004ad53
mov ecx, dword [esi + 0x19ac]
mov byte [esi + 0x19bd], 0
cmp ecx, ebx
jne 0x1004ad93
mov ecx, dword [edi + 0x1c0]
mov eax, dword [edi + 0x1c8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 8], eax
mov eax, dword [0x101a224c]
cmp byte [eax + 0xe8], 0
je 0x1004ad93
movss xmm1, dword [eax + 0x30]
movss xmm0, dword [eax + 0x434]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
test al, al
jne 0x1004addc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
or ebx, 0xffffffff
mov edx, 0x100e8da1
mov al, 0x23
or esi, 0xffffffff
nop dword [eax + eax]
cmp al, 0x23
jne 0x1004adbe
cmp byte [edx], al
jne 0x1004adbe
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x100e8778]
test al, al
jne 0x1004adb0
mov esi, dword [ebp - 0xc]
not ebx
cmp byte [esi + 0x1c68], 0
jne 0x1004ae15
call fcn.1004bd50
mov eax, dword [ebp - 8]
mov dword [esi + 0x1c80], ebx
mov ebx, dword [ebp + 8]
mov dword [esi + 0x1c84], eax
mov byte [esi + 0x1c68], 1
mov dword [esi + 0x1c6c], ebx
mov dword [esi + 0x1c74], 0
jmp 0x1004ae18
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 0x1940]
mov dword [esi + 0x1c70], eax
mov byte [esi + 0x1c69], 1
test bl, 1
jne 0x1004ae5e
call fcn.1004b200
cmp dword [esi + 0x1cd0], 0
je 0x1004ae5e
test dword [esi + 0x1cc4], 0x1000
je 0x1004ae5e
mov eax, dword [esi + 0x198c]
mov byte [eax + 0x7f], 1
mov dword [eax + 0xa4], 1
test bl, 0x12
jne 0x1004ae6a
and dword [edi + 0x110], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004c3c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100e0d9d
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [0x101a224c]
test eax, eax
je 0x1004c3ea
inc dword [eax + 0x36c]
push esi
push edi
push dword [0x101a2254]
push 0x3a80
call dword [0x1015c178]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xd]
add esp, 8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1004c428
push dword [ebp + 8]
mov ecx, eax
call fcn.10044db0
mov edi, eax
mov dword [ebp - 0x14], eax
jmp 0x1004c42d
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, dword [0x101a224c]
mov esi, 0x100e8ccd
test eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0
cmove eax, edi
mov dword [ebp - 0x34], str.Window
mov dword [ebp - 0x18], eax
or edx, 0xffffffff
mov dword [0x101a224c], eax
or edi, 0xffffffff
mov al, 0x57
cmp al, 0x23
jne 0x1004c46f
cmp byte [esi], al
jne 0x1004c46f
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100e8778]
test al, al
jne 0x1004c461
mov edi, dword [ebp - 0x14]
not edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0x10057760
mov dword [ebp - 0x28], 0x100576a0
mov esi, dword [edi + 0x2c50]
mov ecx, dword [edi + 0x2c54]
mov dword [ebp - 0x24], 0x10057800
cmp esi, ecx
jne 0x1004c556
inc esi
test ecx, ecx
je 0x1004c4c9
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1004c4ce
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1004c556
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1004c4e4
inc dword [eax + 0x36c]
push dword [0x101a2254]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [0x1015c178]
mov edx, dword [edi + 0x2c58]
add esp, 8
mov dword [ebp - 0x18], eax
test edx, edx
je 0x1004c54a
mov ecx, dword [edi + 0x2c50]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2c58]
add esp, 0xc
test ecx, ecx
je 0x1004c537
mov eax, dword [0x101a224c]
test eax, eax
je 0x1004c537
dec dword [eax + 0x36c]
push dword [0x101a2254]
push ecx
call dword [0x1015c17c]
mov eax, dword [ebp - 0x18]
add esp, 8
mov dword [edi + 0x2c58], eax
mov dword [edi + 0x2c54], esi
mov eax, dword [edi + 0x2c50]
movups xmm0, xmmword [ebp - 0x34]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2c58]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + ecx*8 + 0x10], xmm0
mov eax, edi
inc dword [edi + 0x2c50]
mov ecx, dword [ebp - 0xc]
mov byte [edi], 1
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret