joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d2af0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5d2b92
cmp dword [ebx + 0xac], 0
jne 0x5d2b8c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d2a2c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5d2b8c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d2b52
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d2b8c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004ad390
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d2b61
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d2dd0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5f2724]
cmp dword [eax + 0x188], 0
je 0x5d2f4a
test bl, bl
jne 0x5d2e95
cmp dword [esi + 0xb4], 0
jne 0x5d2e8a
mov eax, esi
call fcn.005d5d94
push eax
push 0x5d2cc4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5d2e5b
mov eax, dword [0x5f2724]
cmp byte [eax + 0xeb], 0
je 0x5d2e5b
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5d2e3c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d2e5b
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d2e44
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d2e8a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004ad390
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d2e6a
inc dword [esi + 0xb4]
jmp 0x5d2f4a
cmp dword [esi + 0xb4], 0
jle 0x5d2f4a
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5d2f4a
cmp dword [esi + 0x58], 0
je 0x5d2eff
mov eax, dword [0x5f2724]
cmp byte [eax + 0xeb], 0
je 0x5d2eff
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5d2ee0
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d2eff
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d2ee8
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d2f2e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004ad390
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d2f0e
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5c4a60]
call fcn.0040b4f4
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5d3ba4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5d3c01
cmp byte [ebx + 0xeb], 0
jne 0x5d3c01
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409568
mov eax, dword [esi]
test eax, eax
je 0x5d3bee
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5d3c0e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004097c0
jmp 0x5d3c0e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004097c0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d54c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5d5531
mov eax, esi
call fcn.0052a978
test al, al
je 0x5d5531
mov eax, dword [ebx + 0x98]
call fcn.0052a5a8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d5531
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x114]
test al, al
je 0x5d5522
push 0
mov eax, dword [ebx + 0x98]
call fcn.0052a5a8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.005212a0
jmp 0x5d5531
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005d52f8
pop esi
pop ebx
ret
Function at 0x5d9e18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5d9e92
mov eax, dword [ebx + 8]
call fcn.0052a5a8
mov ecx, eax
mov dl, 1
mov eax, dword [0x53683c]
call fcn.00524968
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.0053aff0
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5d9710
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0052a5a8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0052a5a8
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d9f08
mov eax, dword [ebx + 8]
call fcn.0052a5a8
mov ecx, eax
mov dl, 1
mov eax, dword [0x53683c]
call fcn.00524968
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.0053aff0
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5d975c
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052a5a8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052a5a8
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5d9f74
mov eax, dword [ebx + 8]
call fcn.0052a5a8
mov ecx, eax
mov dl, 1
mov eax, dword [0x5372b0]
call fcn.00524968
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052a5a8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052a5a8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5dd098
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x20
call fcn.00407138
test esi, esi
je 0x5dd159
mov dword [ebx], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
cmp word [eax], 0x5a4d
jne 0x5dd159
push ebp
mov eax, dword [eax + 0x3c]
call fcn.005dd084
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
jne 0x5dd159
push ebp
mov eax, 4
call fcn.005dd084
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
push ebp
mov eax, 0x14
call fcn.005dd084
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebx + 0x10], eax
push ebp
mov eax, 0xe0
call fcn.005dd084
pop ecx
mov eax, dword [ebx + 0xc]
movzx esi, word [eax + 2]
mov dword [ebx + 0x18], esi
push esi
lea eax, [ebx + 0x1c]
mov ecx, 1
mov edx, dword [0x5dcf2c]
call fcn.0040b3d0
add esp, 4
mov esi, dword [ebx + 0x18]
dec esi
test esi, esi
jb 0x5dd159
inc esi
xor edi, edi
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebp - 4]
mov dword [eax + edi*4], edx
push ebp
mov eax, 0x28
call fcn.005dd084
pop ecx
inc edi
dec esi
jne 0x5dd140
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5dd3dc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x20]
mov edx, dword [0x5dcf70]
call fcn.0040a784
lea eax, [ebp - 0x40]
mov edx, dword [0x5dcf70]
call fcn.0040a784
xor eax, eax
push ebp
push 0x5dd56f
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x44]
call fcn.005dd098
mov eax, dword [ebp - 0x14]
cmp word [eax], 0x14c
je 0x5dd43f
mov ecx, 0x5dd590
mov dl, 1
mov eax, dword [0x41b198]
call fcn.004282f0
call fcn.00408a5c
push 0x40
push 0x3000
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x38]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x5dd54e
mov eax, dword [ebx + 0x38]
mov edx, dword [ebp - 0x48]
xor ecx, ecx
xchg edx, eax
call fcn.00407138
mov eax, dword [ebx + 0x3c]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
xchg ecx, eax
call fcn.004069a0
mov edi, dword [ebp - 8]
dec edi
test edi, edi
jb 0x5dd4ce
inc edi
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x4c]
mov ebx, dword [eax + edx*4]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x5dd4c8
cmp dword [ebx + 0x10], 0
je 0x5dd4c8
mov esi, eax
add esi, dword [ebp - 0x48]
mov eax, dword [ebx + 0x10]
mov edx, esi
xor ecx, ecx
xchg edx, eax
call fcn.00407138
mov eax, dword [ebx + 0x14]
add eax, dword [ebp - 0x44]
mov edx, dword [ebx + 0x10]
mov ecx, esi
xchg edx, ecx
call fcn.004069a0
inc dword [ebp - 0x4c]
dec edi
jne 0x5dd48e
mov eax, dword [ebp - 0x10]
push dword [eax + 0x1c]
mov ebx, dword [ebp - 0x48]
mov eax, ebx
pop edx
sub eax, edx
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x48]
call fcn.005dd098
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x1c], ebx
lea eax, [ebp - 0x40]
call fcn.005dd194
cmp dword [ebp - 0x54], 0
jne 0x5dd507
cmp dword [ebp - 0x58], 0
je 0x5dd514
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x58]
call fcn.005dd2e4
mov eax, dword [ebp - 0x30]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x5dd54b
xor ecx, ecx
push ebp
push 0x5dd541
push dword fs:[ecx]
mov dword fs:[ecx], esp
add edx, ebx
mov eax, edx
push 0
push 1
push ebx
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5dd54b
mov esi, dword [ebp - 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dd576
lea eax, [ebp - 0x40]
mov edx, dword [0x5dcf70]
mov ecx, 2
call fcn.0040a8ac
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x6a63fda
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x7f8b3f07
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0xfcdfbc
Capabilities:
Encode data using xor

Disassembly:
cmc
invalid
jmp 0xfcdfc6
pushal
call 0xfcdfcc
pop ebp
sub ebp, 0x10
sub ebp, 0xbcdfbc
jmp 0xfcdfe2
mov eax, 0xbcdfbc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c7
mov edx, 0xebb69c80
xor byte [eax], dl
inc eax
dec ecx
jne 0xfcdff9
jmp 0xfce00c
or ecx, dword [ebp + 0xb]
or dword [eax + eax*4 + 0x41018080], edi
js 0xfcdf98
add byte [eax - 0x7bc7b27d], 0x80
add byte [eax - 0x7f7f57c6], 0x80
ja 0xfce08a
or dword [eax + 0xb], 1
mov word [eax + 0x45838080], es
ror byte [0x97ca4e4], 1
test byte [eax + ebp*8 - 0x7f5f4214], ah
call 0x81190312
sub dword [esp - 0x5f8e0f18], 0x808568ba
add byte [eax - 0x7f7f4997], 0x80
or eax, 0x97ca4e4
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
or eax, 0xb80a4ec
add eax, 0x80808088
or edx, dword [0x8080808c]
or ecx, dword [0x80808090]
inc ecx
imul eax, dword [edx + 0x420382b1], 0x58fc984
je 0xfce0ff
jg 0xfce101
or ebp, dword [esp - 0x7b5b1bf3]
inc edx
mov word [eax - 0x7b5bf3f5], es
add byte [eax - 0x42131780], 0xa0
sub al, 0xce
and bl, byte [eax + eax*4]
sub dword [esp - 0x7f7a972f], 0xc5698080
add byte [eax - 0x5b1bf280], 0x7c
or dword [esp - 0xa80222c], ebp
invalid
add dword [ecx + 0x26], esi
jne 0xfce105
push esp
add dword [ecx + 0x26], esi
jne 0xfce10b
push esp
mov bl, 0x49
mov bl, 0x52
add ebp, dword [eax - 0x7b]
enter 0x48f, 0xffffffffffffffce
add byte [eax - 0x37f77080], 0x80
add byte [eax - 0x4663f41a], 0
jnp 0xfce154
push 0x809a048f
add byte [eax - 0x70968500], 4
xchg ecx, eax
pop dword [edx + ebx*4]
add byte [eax + 0x697b0080], 0x8f
add al, 0x91
add byte [eax + 0x7b01e680], 0x7f
movsd dword es:[edi], dword [esi]
pop dword [edx*4 - 0x3e7f7f80]
imul ecx, dword [edi + edi*2 + 0x7f], 0xb9cca97f
add dword [ebx], 0x68038541
test byte [ecx + 0x3d], ch
jg 0xfce199
add al, 0x95
add byte [eax + 0x4c69c180], 0x7f
jg 0xfce18b
add cl, 0x69
dec esp
jg 0xfce18a
jg 0xfce0b6
test eax, 0x381b9cc
inc ecx
test dword [ebx], eax
push 0x7f3d6984
jg 0xfce19a
int3
jg 0xfce0c5
test eax, 0x382b9d4
inc ecx
aam 0xb9
add byte [ebx], 0x41
xchg byte [ebx], al
push 0xffffffffffffff84
add ebp, dword [eax - 0x7b]
imul ebp, dword [ebx], 0xdd7f7f7f
inc edx
mov word [eax - 0x2993f42b], es
xlatb
aad 0xb
cmc
mov word [ebx], cs
std
mov byte [edx + esi], bh
or al, byte [esi - 0x7f7eb9ff]
add byte [eax + 0x47018708], 0x81
add byte [eax - 0x7f7dc480], 0x80
add byte [edx - 0x7afa70ae], 0x80
add byte [eax - 0x6d3969f6], 0x52
pop dword [ebx]
pop eax
jg 0xfce1e6
jg 0xfce0eb
push edx
pop dword [0x80808085]
or dl, byte [esi - 0x70ad6d3a]
add ebp, edx
add byte [eax - 0x7dbf4c80], 0x52
pop dword [0x80808085]
or dl, byte [esi - 0x70ad6d3a]
pop dword [ebx]
stosb byte es:[edi], al
add dword [eax - 0x70ad7d80], 0x80808505
or byte [edx], 0x96
add ebp, dword [edx - 0x7d7f7f7f]
push edx
pop dword [0x80808085]
or dl, byte [esi - 0x6cad6d3a]
inc eax
adc byte [edx - 0x71], 5
test dword [eax - 0x69f57f80], eax
invalid
xchg esi, eax
invalid
add dword [eax + 0x52828080], 0x8085058f
add byte [eax - 0x6d3969f6], 0x52
xchg ebx, eax
inc eax
adc byte [edx - 0x71], 5
test dword [eax - 0x69f57f80], eax
invalid
Function at 0x10004450
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x10004483
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [esp + 0xc]
push 0x10003fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10004483
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 0xc

Function at 0x100050d0
Capabilities:
Hash data using fnv

Disassembly:
mov al, byte [ecx]
test al, al
jne 0x100050d9
mov eax, edx
ret
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
jmp fcn.100050d0
Function at 0x10011b70
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, ecx
mov ecx, dword [0x1023d1cc]
push esi
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je case.default.0x10011c8b
mov ecx, dword [0x1023d1cc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je case.default.0x10011c8b
mov edi, dword [0x1023d288]
test edi, edi
je case.default.0x10011c8b
mov eax, dword [0x1023d284]
test eax, eax
jne 0x10011be4
mov edx, 0xe80c2f78
mov ecx, 0x1021170d
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d284], eax
cmp dword [eax + edi], 0
jle case.default.0x10011c8b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x10011c04
mov esi, 0x811c9dc5
jmp 0x10011c1a
movsx eax, al
inc ecx
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100050d0
mov esi, eax
mov ecx, dword [ebx]
push 0
push str.attacker
mov edx, dword [ecx + 0x18]
mov ecx, ebx
call edx
mov ecx, dword [0x1023d1cc]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
call edx
mov ecx, dword [0x1023d20c]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
test eax, eax
je case.default.0x10011c8b
test esi, esi
je case.default.0x10011c8b
cmp esi, 0x1b30ddf0
jne case.default.0x10011c8b
cmp eax, dword [0x1023d288]
jne case.default.0x10011c8b
cmp byte [0x10273300], 0
mov dword [0x102732e0], 0xff
je case.default.0x10011c8b
mov eax, dword [0x10273344]
cmp eax, 3
ja case.default.0x10011c8b
jmp dword [eax*4 + 0x10011cf8]
mov ecx, dword [0x102732d8]
push str.buttons_arena_switch_press_02.wav
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
call eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x102732d8]
push str.buttons_button22.wav
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
call eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x102732d8]
push str.survivalmoney_collect_01.wav
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
call eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x102732d8]
push str.Ui_beep07.wav
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
call eax
pop edi
pop esi
pop ebx
ret
Function at 0x10017720
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xd4
push ebx
push esi
push edi
mov edi, dword [0x1023d288]
mov ebx, ecx
test edi, edi
je 0x100179bb
mov eax, dword [0x1023d284]
test eax, eax
jne 0x10017776
mov edx, 0xe80c2f78
mov ecx, 0x1021170d
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d284], eax
cmp dword [eax + edi], 0
jle 0x100179bb
cmp byte [0x102733d5], 0
je 0x100179bb
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1023d190]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1027b710]
cmp eax, dword [ecx + 4]
jle 0x100177e1
push 0x1027b710
call fcn.1018369a
add esp, 4
cmp dword [0x1027b710], 0xffffffff
jne 0x100177e1
mov ecx, dword [0x1023d1c8]
push str.sv_autobunnyhopping
mov eax, dword [ecx]
call dword [eax + 0x44]
push 0x1027b710
mov dword [0x1027b6f8], eax
call fcn.10183649
add esp, 4
mov ecx, dword [0x1027b6f8]
push 1
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
call eax
push dword [0x102733f8]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x100179bb
call fcn.1000c050
cmp eax, 9
je 0x100179bb
mov eax, dword [0x1023d2c0]
mov ecx, dword [0x1023d288]
mov edi, ecx
test eax, eax
jne 0x10017858
mov edx, 0xe80c2f78
mov ecx, 0x10211851
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov ecx, dword [0x1023d288]
mov dword [0x1023d2c0], eax
test byte [eax + edi], 1
jne 0x100179bb
test byte [ebx + 0x30], 2
je 0x100179bb
mov eax, dword [ecx]
mov dword [esp + 0x90], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa0], 0
mov eax, dword [eax + 0x28]
call eax
lea ecx, [esp + 0x30]
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [esp + 0x18], xmm0
movss xmm0, dword [esp + 0x18]
movss dword [esp + 0x24], xmm0
movss xmm0, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
movss dword [esp + 0x28], xmm0
movss xmm0, dword [esp + 0x20]
subss xmm0, dword [0x1022fb1c]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x3c], 0
push eax
mov dword [esp + 0x3c], 0
movss dword [esp + 0x34], xmm0
mov dword [esp + 0x38], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
call fcn.10004fd0
mov ecx, dword [0x1023d210]
lea edx, [esp + 0x88]
push edx
push 0
push 0x201400b
mov eax, dword [ecx]
lea edx, [esp + 0x3c]
push edx
call dword [eax + 0x14]
movss xmm0, dword [esp + 0xb4]
comiss xmm0, dword [0x1022f9c8]
jb 0x100179bb
and dword [ebx + 0x30], 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018c80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [0x1023d288]
mov ebx, edx
mov dword [esp + 0x10], ecx
test edi, edi
je case.0x10018d02.0
mov eax, dword [0x1023d284]
test eax, eax
jne 0x10018cd7
mov edx, 0xe80c2f78
mov ecx, 0x1021170d
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d284], eax
cmp dword [eax + edi], 0
jle case.0x10018d02.0
cmp byte [0x10273438], 0
je case.0x10018d02.0
mov ecx, dword [0x10237334]
mov eax, dword [0x10273430]
cmp ecx, 3
ja case.0x10018d02.0
jmp dword [ecx*4 + 0x10018e18]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10018d3a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10018d3a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
jne case.0x10018d02.0
call fcn.1000c050
cmp eax, 9
je case.0x10018d02.0
cmp eax, 8
je case.0x10018d02.0
mov eax, dword [0x1023d2c0]
mov edi, dword [0x1023d288]
test eax, eax
jne 0x10018d96
mov edx, 0xe80c2f78
mov ecx, 0x10211851
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d2c0], eax
test byte [eax + edi], 1
je case.0x10018d02.0
movss xmm3, dword [0x102373ac]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
movaps xmm1, xmm3
movss dword [esp + 0xc], xmm3
xorps xmm1, xmmword [0x1022fee0]
movaps xmm2, xmm3
xorps xmm2, xmmword [0x1022fee0]
movss xmm0, dword [edx]
comiss xmm0, xmm1
movss dword [esp + 0x14], xmm1
cmovae ecx, edx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [edx], eax
cmp byte [0x102733ce], 0
je case.0x10018d02.0
movss xmm0, dword [ebx]
lea ecx, [esp + 0x14]
comiss xmm0, xmm2
lea eax, [esp + 0xc]
movss dword [esp + 0x14], xmm2
cmovae ecx, ebx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018d09
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [0x1023d288]
mov ebx, edx
mov dword [esp + 0x10], ecx
test edi, edi
je case.0x10018d02.0
mov eax, dword [0x1023d284]
test eax, eax
jne 0x10018cd7
mov edx, 0xe80c2f78
mov ecx, 0x1021170d
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d284], eax
cmp dword [eax + edi], 0
jle case.0x10018d02.0
cmp byte [0x10273438], 0
je case.0x10018d02.0
mov ecx, dword [0x10237334]
mov eax, dword [0x10273430]
cmp ecx, 3
ja case.0x10018d02.0
jmp dword [ecx*4 + 0x10018e18]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10018d3a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10018d3a
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
jne case.0x10018d02.0
call fcn.1000c050
cmp eax, 9
je case.0x10018d02.0
cmp eax, 8
je case.0x10018d02.0
mov eax, dword [0x1023d2c0]
mov edi, dword [0x1023d288]
test eax, eax
jne 0x10018d96
mov edx, 0xe80c2f78
mov ecx, 0x10211851
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d2c0], eax
test byte [eax + edi], 1
je case.0x10018d02.0
movss xmm3, dword [0x102373ac]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
movaps xmm1, xmm3
movss dword [esp + 0xc], xmm3
xorps xmm1, xmmword [0x1022fee0]
movaps xmm2, xmm3
xorps xmm2, xmmword [0x1022fee0]
movss xmm0, dword [edx]
comiss xmm0, xmm1
movss dword [esp + 0x14], xmm1
cmovae ecx, edx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [edx], eax
cmp byte [0x102733ce], 0
je case.0x10018d02.0
movss xmm0, dword [ebx]
lea ecx, [esp + 0x14]
comiss xmm0, xmm2
lea eax, [esp + 0xc]
movss dword [esp + 0x14], xmm2
cmovae ecx, ebx
comiss xmm3, xmm0
cmovae eax, ecx
mov eax, dword [eax]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret