joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008b00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100d5134]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
xorps xmm0, xmm0
push ebx
push esi
push edi
mov byte [eax + 0x64], 1
movups xmmword [eax + 8], xmm0
mov dword [eax + 0x60], 0
movups xmmword [eax + 0x18], xmm0
mov dword [eax + 0x5c], 0
movups xmmword [eax + 0x28], xmm0
push 8
movups xmmword [eax + 0x38], xmm0
mov dword [ebp - 0x114], eax
movups xmmword [eax + 0x48], xmm0
mov dword [eax + 0x58], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 0
mov dword [eax + 4], 0
mov dword [eax], 0
call fcn.10080ea7
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10c], ebx
xorps xmm0, xmm0
mov edi, dword [0x100d7aec]
push 0x100c70c0
push 0x6c
movq qword [ebx], xmm0
push edi
mov dword [ebx], 0
mov dword [ebx + 4], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
mov dword [0x100d7ab4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.d3d9.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1008afc9
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
lea eax, [ebx + 0x128000]
cmp ebx, eax
jae 0x10008c35
mov edx, 0x6c7
mov ecx, 0x8689
inc ebx
cmp word [ebx], dx
jne 0x10008c2b
cmp word [ebx + 6], cx
jne 0x10008c2b
cmp word [ebx + 0xc], cx
je 0x10008ce0
lea eax, [ebx + 0x128000]
cmp ebx, eax
jb 0x10008c15
inc ebx
push str.Initializing_renderer
mov dword [ebp - 0x10c], ebx
call fcn.10007770
mov edi, dword [ebx]
lea eax, [ebp - 0x110]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
add edi, 0x40
push eax
mov esi, dword [edi]
push 0x40
push 4
push edi
call ebx
lea eax, [ebp - 0x110]
mov dword [edi], 0x10007f30
push eax
push dword [ebp - 0x110]
push 4
push edi
call ebx
mov eax, dword [ebp - 0x114]
mov edi, dword [ebp - 0x10c]
mov dword [eax], esi
lea eax, [ebp - 0x10c]
mov edi, dword [edi]
push eax
push 0x40
add edi, 0x44
push 4
push edi
mov esi, dword [edi]
call ebx
lea eax, [ebp - 0x10c]
mov dword [edi], 0x100080e0
push eax
push dword [ebp - 0x10c]
push 4
push edi
call ebx
mov ebx, dword [ebp - 0x114]
push str.Initialized_renderer
mov dword [ebx + 4], esi
call fcn.10007770
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10080e96
mov esp, ebp
pop ebp
ret
add ebx, 2
jmp 0x10008c36
Function at 0x1000e130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab83d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100d5134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.10009830
mov edx, dword [ebp + 0x1c]
lea eax, [ebp + 8]
mov edi, dword [ebp + 8]
lea ebx, [ebp + 8]
cmp edx, 0x10
lea esi, [ebp + 8]
cmovae eax, edi
cmovae ebx, edi
add eax, dword [ebp + 0x18]
cmp edx, 0x10
cmovae esi, edi
cmp esi, eax
je 0x1000e1ad
sub ebx, esi
mov edi, eax
movsx eax, byte [esi]
push eax
call fcn.1008b364
mov byte [ebx + esi], al
add esp, 4
inc esi
cmp esi, edi
jne 0x1000e193
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea esi, [ebp + 8]
cmp edx, 0x10
mov ecx, 0x811c9dc5
cmovae esi, edi
xor edx, edx
test ebx, ebx
je 0x1000e1d5
movzx eax, byte [edx + esi]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, ebx
jb 0x1000e1c4
push ecx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10012fe0
mov ecx, dword [ebp + 0x1c]
cmp dword [eax + 4], 0
setne bl
cmp ecx, 0x10
jb 0x1000e21a
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x1000e210
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e230
push ecx
push edi
call fcn.100811f1
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.10086331
int3
Function at 0x1000e240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab875
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x100d5134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.10009830
mov edx, dword [ebp + 0x1c]
lea eax, [ebp + 8]
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
cmp edx, 0x10
lea esi, [ebp + 8]
cmovae eax, edi
cmovae ecx, edi
add eax, dword [ebp + 0x18]
cmp edx, 0x10
mov dword [ebp - 0x18], eax
cmovae esi, edi
cmp esi, eax
je 0x1000e2c0
sub ecx, esi
mov edi, ecx
movsx eax, byte [esi]
push eax
call fcn.1008b364
mov byte [edi + esi], al
add esp, 4
inc esi
cmp esi, dword [ebp - 0x18]
jne 0x1000e2a5
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
lea esi, [ebp + 8]
mov edx, 0x811c9dc5
cmovae esi, edi
xor ecx, ecx
cmp dword [ebp + 0x18], ecx
jbe 0x1000e2ec
mov edi, dword [ebp + 0x18]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1000e2d8
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 8]
push edx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10012fe0
mov esi, dword [eax + 4]
test esi, esi
je 0x1000e314
mov eax, dword [ebp - 0x10]
cmp esi, dword [eax + 4]
je 0x1000e314
mov esi, dword [esi + 0x20]
jmp 0x1000e3d6
mov edi, dword [ebp - 0x10]
mov eax, 0x2aaaaaab
mov ecx, dword [edi + 0x24]
sub ecx, dword [edi + 0x20]
imul ecx
lea eax, [ebp + 8]
mov ecx, edi
sar edx, 3
mov esi, edx
shr esi, 0x1f
push eax
add esi, edx
call fcn.10010a30
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [eax], esi
mov eax, edi
mov byte [ebp - 4], 1
mov edi, dword [eax + 0x24]
cmp edi, dword [eax + 0x28]
je 0x1000e38f
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.10007330
movups xmm0, xmmword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
movups xmmword [edi + 0x18], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [edi + 0x28], xmm0
add dword [eax + 0x24], 0x30
jmp 0x1000e3d3
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp + 8]
push ecx
push edi
lea ecx, [eax + 0x20]
call fcn.10011bc0
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x1000e3d0
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000e3c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e426
push edx
push ecx
call fcn.100811f1
add esp, 8
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov eax, dword [eax + 0x20]
lea esi, [esi + esi*2]
shl esi, 4
add esi, eax
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x1000e410
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x1000e406
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e426
push ecx
push edi
call fcn.100811f1
add esp, 8
lea eax, [esi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.10086331
int3
Function at 0x1000e430
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab8bd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x100d5134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.10009830
mov edx, dword [ebp + 0x1c]
lea eax, [ebp + 8]
mov edi, dword [ebp + 8]
lea ebx, [ebp + 8]
cmp edx, 0x10
lea esi, [ebp + 8]
cmovae eax, edi
cmovae ebx, edi
add eax, dword [ebp + 0x18]
cmp edx, 0x10
cmovae esi, edi
cmp esi, eax
je 0x1000e4ad
sub ebx, esi
mov edi, eax
movsx eax, byte [esi]
push eax
call fcn.1008b364
mov byte [esi + ebx], al
add esp, 4
inc esi
cmp esi, edi
jne 0x1000e493
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea esi, [ebp + 8]
cmp edx, 0x10
mov edx, 0x811c9dc5
cmovae esi, edi
xor ecx, ecx
test ebx, ebx
je 0x1000e4d5
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1000e4c4
mov ebx, dword [ebp - 0x10]
lea eax, [ebp + 8]
push edx
push eax
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.10012fe0
mov esi, dword [eax + 4]
test esi, esi
je 0x1000e4fc
cmp esi, dword [ebx + 4]
je 0x1000e4fc
mov esi, dword [esi + 0x20]
jmp 0x1000e597
mov ecx, dword [ebx + 0x24]
mov eax, 0x78787879
sub ecx, dword [ebx + 0x20]
imul ecx
lea eax, [ebp + 8]
mov ecx, ebx
sar edx, 5
mov esi, edx
shr esi, 0x1f
push eax
add esi, edx
call fcn.10010a30
lea ecx, [ebp - 0x44]
mov dword [eax], esi
call fcn.10010250
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
mov edi, dword [eax + 0x24]
cmp edi, dword [eax + 0x28]
je 0x1000e570
lea eax, [ebp + 8]
mov dword [ebp - 0x14], edi
push eax
mov ecx, edi
call fcn.10007330
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x18]
call fcn.100139a0
add dword [ebx + 0x24], 0x44
jmp 0x1000e581
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 8]
push eax
push edi
lea ecx, [ebx + 0x20]
call fcn.10011db0
lea ecx, [ebp - 0x24]
call fcn.10010660
lea ecx, [ebp - 0x44]
call fcn.1000c530
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x20]
mov ecx, esi
shl ecx, 4
add ecx, esi
lea esi, [eax + ecx*4]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x1000e5d1
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x1000e5c7
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e5e8
push ecx
push edi
call fcn.100811f1
add esp, 8
lea eax, [esi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.10086331
int3
Function at 0x1000e9d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x1000eab8
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x1000eaa7
jg 0x1000ea10
test edx, edx
je 0x1000eaa7
nop dword [eax]
call fcn.10010210
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000ea64
jg 0x1000ea27
test esi, esi
je 0x1000ea64
cmp ebx, eax
jg 0x1000ea37
jl 0x1000ea31
cmp edi, esi
jae 0x1000ea37
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.10082c30
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x1000ea8b
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x1000eaa1
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x1000ea10
jl 0x1000eaa1
test edi, edi
jne 0x1000ea10
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1000eada
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1000eadc
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x1000eb5a
jg 0x1000eaef
test esi, esi
je 0x1000eb5a
test eax, eax
jl 0x1000eb3e
jg 0x1000eaf9
test ebx, ebx
je 0x1000eb3e
cmp edi, eax
jg 0x1000eb09
jl 0x1000eb03
cmp esi, ebx
jae 0x1000eb09
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.10082c30
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x1000eb5a
jg 0x1000eb41
test esi, esi
je 0x1000eb5a
jmp 0x1000eb41
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1000eb5a
push eax
push esi
push 1
push edx
call fcn.1008c02b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000eb70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1000eba2
jl 0x1000eb95
test ecx, ecx
jne 0x1000eba2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000ec62
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10010230
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000ec0e
jg 0x1000ebcd
test esi, esi
je 0x1000ec0e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1000ebe5
mov eax, dword [esp + 0x10]
jl 0x1000ebdf
cmp eax, esi
jae 0x1000ebe5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10082c30
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000ec2f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1000ec4b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1000ebb4
jl 0x1000ec4b
test ecx, ecx
jne 0x1000ebb4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1000eca1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1000eca1
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.10082c30
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x1000ed10
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x1000ecc7
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x1000ecf9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1008c63f
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1000ed24
cmp edi, eax
ja 0x1000ecd5
test ecx, ecx
je 0x1000ed10
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1008c63f
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000f0a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100d5134]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1000f0d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f10c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1000f10c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1000f1f6
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1000f134
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000f167
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1008b05b
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1000f1c9
sub eax, 1
je 0x1000f1c9
sub eax, 2
jne 0x1000f1f6
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.1008b05b
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000f1e6
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1008c02b
add esp, 0x10
cmp edi, eax
jne 0x1000f1f6
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1000f0f7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10080e96
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fe50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100d5134]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1000ff0c
cmp byte [esi + 0x3d], 0
je 0x1000ff0c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000fefa
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1000fec2
sub eax, 1
je 0x1000fec6
sub eax, 2
jne 0x1000fefa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000fee3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1008c02b
add esp, 0x10
cmp edi, eax
jne 0x1000fefa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10080e96
mov esp, ebp
pop ebp
ret

Function at 0x10010100
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab9e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100d5134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 8
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10080ea7
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1007fb0c
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x18], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x18]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x18]
mov dword [edx], 0
mov edx, dword [0x100d7b7c]
mov dword [ecx], 0
mov ecx, dword [0x100d7b78]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015cb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10015cfc
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10015cdf
cmp edi, 2
jb 0x10015cdf
cmp byte [esi], cl
jne 0x10015cdf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c3058]
test edi, edi
jne 0x10015cc5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10015d2b
cmp cl, 0x23
jne 0x10015d12
cmp byte [esi], cl
jne 0x10015d12
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100c3058]
test cl, cl
jne 0x10015d03
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10015ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10015ee3
push 0x5f8
push str.D:AVSProject_voiceClientImGUIimgui.cpp
push str.filename__mode
call fcn.10086073
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10015ef0
mov dword [edi], 0
mov edx, 0x100ca020
mov ecx, esi
call fcn.10015d40
mov esi, eax
test esi, esi
je 0x10015fdb
push esi
call fcn.1008d06e
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x10015fd2
push 2
push 0
push esi
call fcn.1008c9d0
add esp, 0xc
test eax, eax
jne 0x10015fd2
push esi
call fcn.1008d06e
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10015fd2
push 0
push dword [ebp + 8]
push esi
call fcn.1008c9d0
add esp, 0xc
test eax, eax
jne 0x10015fd2
mov eax, dword [0x100d7adc]
test eax, eax
je 0x10015f65
inc dword [eax + 0x370]
push dword [0x100d7ad4]
push ebx
call fcn.100155f0
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x10015fd2
push esi
push ebx
push 1
push eax
call fcn.1008c63f
add esp, 0x10
push esi
cmp eax, ebx
je 0x10015fbc
call fcn.1008b1dc
mov eax, dword [0x100d7adc]
add esp, 4
test eax, eax
je 0x10015fa4
dec dword [eax + 0x370]
push dword [0x100d7ad4]
push dword [ebp + 8]
call fcn.10015600
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.1008b1dc
add esp, 4
test edi, edi
je 0x10015fca
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.1008b1dc
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret