joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c4b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x45e750], 0x44
push eax
xor eax, eax
push 0x45e750
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405c8a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405d2c
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00406133
mov edi, eax
cmp edi, 0xffffffff
je 0x405d6d
test byte [esp + 0x10], 1
push esi
je 0x405d4f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x405d55
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405d5e
xor eax, eax
inc eax
jmp 0x405d6f
test byte [esp + 0x10], 4
jne 0x405d6d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405d74
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040603f
test bl, 8
mov dword [ebp - 8], eax
je 0x405db3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4702e8], eax
jmp 0x405f30
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405dcd
test eax, eax
je 0x405ede
test bl, 2
je 0x405ede
mov esi, 0x456750
push edi
push esi
call fcn.00406668
cmp dword [ebp + 8], 0
je 0x405dec
push 0x40a59c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405df2
push edi
call fcn.00405f83
cmp word [edi], 0
jne 0x405e02
cmp word [0x456750], 0x5c
jne 0x405e0d
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ed3
cmp word [ebp - 0x22c], 0x2e
jne 0x405e57
cmp word [ebp - 0x22a], 0
je 0x405eb6
cmp word [ebp - 0x22a], 0x2e
jne 0x405e57
cmp word [ebp - 0x228], 0
je 0x405eb6
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406668
test byte [ebp - 0x258], 0x10
je 0x405e82
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405eb6
push dword [ebp + 0xc]
push edi
call fcn.00405d74
jmp 0x405eb6
push dword [ebp - 4]
push edi
call fcn.00405d2c
test eax, eax
jne 0x405eae
cmp dword [ebp - 4], eax
je 0x405ea6
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push 0
push edi
call fcn.00406428
jmp 0x405eb6
inc dword [0x4702e8]
jmp 0x405eb6
push edi
push 0xfffffffffffffff2
call fcn.004056ca
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405e2f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405ede
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405f30
cmp dword [ebp - 8], esi
jne 0x405ef2
inc dword [0x4702e8]
jmp 0x405f30
push edi
call fcn.0040699e
test eax, eax
je 0x405f30
push edi
call fcn.00405f37
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405d2c
test eax, eax
jne 0x405f28
cmp dword [ebp - 4], esi
je 0x405eea
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push esi
push edi
call fcn.00406428
jmp 0x405f30
push edi
push 0xffffffffffffffe5
call fcn.004056ca
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40603f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x45a750
push esi
call fcn.00406668
push esi
call fcn.00405fe2
mov edi, eax
test edi, edi
jne 0x406060
xor eax, eax
jmp 0x4060b8
push edi
call fcn.004068ef
test byte [0x470278], 0x80
je 0x40607d
mov ax, word [edi]
test ax, ax
je 0x40605c
cmp ax, 0x5c
je 0x40605c
sub edi, esi
sar edi, 1
jmp 0x406097
call fcn.0040699e
test eax, eax
je 0x406091
test byte [eax], 0x10
je 0x40605c
push esi
call fcn.00405f83
push esi
call sub.KERNEL32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x406083
call fcn.00405f37
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x406133
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406152
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406158
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x406187
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a5a8]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a5ac]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4061d7
test edi, edi
jne 0x406194
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x4061d1
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x45fdec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x45fde8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x45fde8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x10031570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1011dc04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003162c
cmp byte [esi + 0x3d], 0
je 0x1003162c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003161a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100315e1
sub eax, 1
je 0x100315e5
sub eax, 2
jne 0x1003161a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b5aae
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031603
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003161a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b5aae
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b5aae
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100b5aae
mov esp, ebp
pop ebp
ret
Function at 0x10032040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test ecx, ecx
jg 0x1003206a
jl 0x1003205e
test eax, eax
jne 0x1003206a
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10032083
push ecx
push eax
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov ecx, ebx
mov edi, eax
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov ecx, eax
test ecx, ecx
je 0x100320c8
mov esi, dword [ebp + 0xc]
cmp ecx, esi
cmovb esi, ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
mov edi, dword [ebp - 4]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add edi, esi
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, ebx
mov edi, dword [ebp + 0xc]
sub edi, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov esi, dword [ebp - 4]
cmp dword [ebx + 0x4c], 0
je 0x10032138
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x100320ed
push dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
mov ecx, ebx
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10032126
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x10032138
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10032100
test ecx, ecx
je 0x10032138
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10032150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10032175
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x100321e0
jg 0x1003219b
test esi, esi
je 0x100321e0
test ecx, ecx
jl 0x1003221a
jg 0x100321a5
test eax, eax
je 0x1003221a
cmp edi, ecx
jg 0x100321b5
jl 0x100321af
cmp esi, eax
jae 0x100321b5
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x10032207
jg 0x100321ed
test esi, esi
je 0x10032207
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x10032207
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x100321ed
Function at 0x10032420
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10032436
jmp dword [edi*4 + 0x100325cc]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x10032479
sub ecx, 1
je 0x10032466
sub ecx, 1
jne 0x1003248c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1003250e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x100c4270]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
sub edx, 1
jne 0x10032495
and edi, 7
jmp 0x10032431
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x1003254f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10032436
jmp dword [edi*4 + 0x100325cc]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x10032479
sub ecx, 1
je 0x10032466
sub ecx, 1
jne 0x1003248c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1003250e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x100c4270]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
sub edx, 1
jne 0x10032495
and edi, 7
jmp 0x10032431
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c4270]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c4270]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x10034490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1011c078], 0
push ebx
push esi
push edi
je 0x10034633
mov ecx, dword [0x1012613c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10034633
mov esi, dword [0x101261c0]
xor ebx, ebx
mov dword [ebp - 4], esi
mov eax, dword [esi + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10034633
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [esi + 0x28]
jl 0x100344f7
push 0x410
push str.C:UserspeytoOneDriveDesktopjunkcsgo_naphackbyapache_mainutlvector.h
push str.i___m_Size
call eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
cmp dword [esi + 0x24], 0xfffffffe
jne 0x10034511
push 0x272
push str.C:UserspeytoOneDriveDesktopjunkcsgo_naphackbyapache_mainutlvector.h
push str._IsReadOnly__
call eax
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x10034527
xor edx, edx
test ecx, ecx
je 0x1003454d
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10034534
cmp edi, 0x5ff56dc5
je 0x1003455f
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10034633
mov esi, dword [ebp - 4]
jmp 0x100344d4
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [edi + 0x28]
jl 0x10034581
push 0x410
push str.C:UserspeytoOneDriveDesktopjunkcsgo_naphackbyapache_mainutlvector.h
push str.i___m_Size
call esi
add esp, 0xc
cmp dword [edi + 0x24], 0xfffffffe
jne 0x1003459b
push 0x272
push str.C:UserspeytoOneDriveDesktopjunkcsgo_naphackbyapache_mainutlvector.h
push str._IsReadOnly__
call esi
add esp, 0xc
mov eax, dword [edi + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10034633
mov eax, dword [edi + 0x88]
mov dword [ebp - 8], eax
test eax, eax
je 0x10034633
xor esi, esi
test eax, eax
jle 0x10034633
xor ebx, ebx
cmp esi, dword [edi + 0x88]
jl 0x100345e2
push 0x410
push str.C:UserspeytoOneDriveDesktopjunkcsgo_naphackbyapache_mainutlvector.h
push str.i___m_Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
cmp dword [edi + 0x84], 0xfffffffe
jne 0x10034603
push 0x272
push str.C:UserspeytoOneDriveDesktopjunkcsgo_naphackbyapache_mainutlvector.h
push str._IsReadOnly__
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [edi + 0x7c]
movss xmm0, dword [ecx + ebx + 0x418]
ucomiss xmm0, dword [0x100c475c]
lahf
test ah, 0x44
jp 0x10034627
mov dword [ecx + ebx + 0x418], 0x7f7fffff
inc esi
add ebx, 0x420
cmp esi, dword [ebp - 8]
jl 0x100345c2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034880
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7f35
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1011dc04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.10036b10
mov ecx, dword [0x10126134]
test ecx, ecx
je 0x10034a3b
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x10034a3b
nop
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
xor ecx, ecx
mov dword [ebp - 0x28], eax
inc ecx
cmp byte [ecx + esi], 0
jne 0x100348e0
xor edx, edx
test ecx, ecx
je 0x10034901
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x100348f0
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x10], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
mov ebx, dword [ebp - 0x1c]
imul esi, eax, 0x1000193
mov ecx, ebx
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10032810
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10034a2a
cmp dword [ebx + 8], 0xfffffff
je 0x10034a4d
lea eax, [ebx + 4]
mov dword [ebp - 0x30], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
call fcn.100b5748
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
add eax, 8
mov dword [ebp - 0x20], eax
mov dword [eax], ecx
mov dword [eax + 4], 0
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x100c47f0]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c47f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
seta al
test al, al
je 0x10034a0d
mov ecx, ebx
call fcn.10036480
push esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.10032810
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x10034a10
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0
push ecx
push esi
mov ecx, ebx
call fcn.10036420
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x100348d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3