joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100115b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006964d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10468f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [0x10531940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x10531944]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov edx, eax
test edx, edx
je 0x10011722
mov ecx, dword [0x10531a98]
cmp dword [ecx + edx], 0
jle 0x10011722
mov ecx, dword [0x10531ab0]
mov ebx, dword [ebp + 8]
mov eax, dword [ecx + ebx]
cmp eax, dword [ecx + edx]
je 0x10011722
cmp byte [0x1052f489], 0
je 0x10011722
push ebx
lea eax, [ebp - 0x1c]
mov ecx, 0x1051ad38
push eax
call fcn.1000c530
mov edi, dword [ebp - 0x18]
mov eax, 0x5dd2eba9
mov esi, dword [ebp - 0x1c]
mov ecx, edi
sub ecx, esi
mov dword [ebp - 4], 0
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x100116de
push 0
mov eax, 0x2ba8
lea esi, [edi - 0x2ba8]
call fcn.100421f0
mov edi, esp
mov ecx, 0xaea
rep movsd dword es:[edi], dword [esi]
push ebx
mov ecx, 0x1051ad38
call fcn.1000c640
mov eax, dword [ebp - 0x18]
push ecx
mov ecx, 0x1051ad38
movss xmm0, dword [eax - 0x2b40]
movss dword [esp], xmm0
push ebx
call fcn.1000b5c0
mov ecx, dword [0x10531960]
mov edx, dword [ebp - 0x10]
push 0
push 0
mov eax, dword [ecx]
push dword [edx + 0x24]
mov eax, dword [eax + 4]
call eax
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push 0xff
push 1
mov eax, dword [eax + 0x24]
call eax
push ebx
mov ecx, 0x1051ad38
call fcn.1000cbd0
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x10011722
mov ecx, dword [ebp - 0x14]
mov eax, 0x5dd2eba9
sub ecx, esi
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ecx, eax, 0x2ba8
mov eax, esi
cmp ecx, 0x1000
jb 0x10011718
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10011736
push ecx
push esi
call fcn.10041fcb
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1004748f
int3
Function at 0x100127b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100696cd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10468f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10041f9b
mov edi, eax
add esp, 4
test edi, edi
je 0x1001284d
push 1
mov dword [ebp - 4], 0
call fcn.1004121a
add esp, 4
mov dword [edi + 4], eax
jmp 0x1001284f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10010010
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x100128aa
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x100128aa
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x100128c6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100128e9
cmp byte [ebp + 0xc], 0
je 0x100128d5
push esi
call fcn.100416af
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x100128f5
mov esi, str.ios_base::badbit_set
jmp 0x10012905
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10012930
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10010780
push 0x100806f8
lea eax, [ebp - 0x28]
push eax
call fcn.1004347b
int3
Function at 0x10013ca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x1052f2b0]
sub esp, 0x38
push esi
push edi
mov edi, ecx
cmp eax, 0xffffffff
je 0x10013e92
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10013e92
mov ecx, dword [0x10531940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x10531944]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov esi, eax
test esi, esi
je 0x10013e92
mov ecx, dword [0x10531a98]
cmp dword [ecx + esi], 0
jle 0x10013e92
mov ecx, dword [0x10531a9c]
test byte [ecx + esi], 1
jne 0x10013e92
mov eax, dword [0x10531aa0]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
movq xmm0, qword [eax + esi]
mov eax, dword [eax + esi + 8]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
movq qword [esp + 0x2c], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.10002990
add esp, 0xc
cmp byte [0x1051b111], 0
movss xmm0, dword [eax + 4]
movss dword [esp + 0x14], xmm0
je 0x10013d75
movss xmm0, dword [0x1006c454]
jmp 0x10013d7d
movss xmm0, dword [0x1006c388]
mov eax, dword [0x10531aa0]
movss dword [esp + 8], xmm0
mov dword [esp + 0x10], 0x42340000
mov dword [esp + 0xc], 0
movq xmm0, qword [eax + esi]
movq qword [esp + 0x18], xmm0
movss xmm1, dword [esp + 0x18]
movss xmm0, dword [esp + 0x1c]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x10013dcd
sqrtsd xmm0, xmm0
jmp 0x10013dd2
call fcn.10047870
fld qword [0x1006c480]
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
call fcn.10047da0
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
xorps xmm1, xmm1
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x1006c494]
comiss xmm0, xmm1
jb 0x10013e1a
movss xmm2, dword [0x1006c490]
comiss xmm2, xmm0
jae 0x10013e2c
comiss xmm1, xmm0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
cmovbe eax, ecx
movss xmm0, dword [eax]
mov eax, dword [0x10531948]
push ecx
mov ecx, edi
mulss xmm0, dword [eax + 0x20]
mulss xmm0, dword [esp + 0xc]
movss dword [esp], xmm0
call fcn.10013ea0
mov eax, dword [ebp + 8]
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
comiss xmm0, dword [0x1006c370]
mov dword [eax + 0x24], 0
jbe 0x10013e70
movss xmm1, dword [0x1006c4ac]
jmp 0x10013e78
movss xmm1, dword [0x1006c49c]
addss xmm0, dword [esp + 0x14]
push ecx
movss dword [eax + 0x28], xmm1
movss dword [esp], xmm0
push eax
call fcn.1003fd80
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10016330
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x1052f3c0]
mov dword [esp + 4], ecx
mov byte [0x10531ba2], 0
push ebx
push esi
push edi
cmp eax, 0xffffffff
je 0x1001635d
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x10016377
cmp byte [0x1052f3c8], 0
je 0x1001650a
cmp byte [0x10531bac], 0
je 0x1001650a
mov ecx, dword [0x10531940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x10531944]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov ebx, eax
test ebx, ebx
je 0x1001650a
mov ecx, dword [0x10531a98]
cmp dword [ecx + ebx], 0
jle 0x1001650a
mov ecx, dword [0x10531940]
mov edx, dword [ecx]
mov eax, dword [edx + 0x138]
call eax
mov dword [esp + 0x20], eax
test eax, eax
je 0x1001650a
mov ecx, dword [0x10531abc]
cmp dword [ecx + ebx], 0
je 0x1001650a
mov edi, dword [ebp + 8]
mov byte [0x10531ba2], 1
and dword [edi + 0x30], 0xfffdffff
call fcn.1003fa20
movss xmm0, dword [edi + 0x24]
fstp st(0)
movss dword [esp + 0x14], xmm0
xor esi, esi
movss xmm0, dword [edi + 0x28]
movss dword [esp + 0x18], xmm0
movss xmm0, dword [edi + 0x2c]
movss dword [esp + 0x1c], xmm0
nop dword [eax]
nop word [eax + eax]
mov eax, dword [0x10531aa0]
movq xmm0, qword [eax + ebx]
movq qword [esp + 0x24], xmm0
movss xmm1, dword [esp + 0x24]
movss xmm0, dword [esp + 0x28]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x1001645a
sqrtsd xmm0, xmm0
jmp 0x1001645f
call fcn.10047870
movss xmm1, dword [0x1006c380]
cvtsd2ss xmm0, xmm0
comiss xmm1, xmm0
ja 0x10016480
mov ecx, dword [esp + 0x10]
push edi
call fcn.10016520
inc esi
cmp esi, 0xf
jl 0x10016420
movss xmm0, dword [0x1052f3c4]
mov ecx, 0xe
movss xmm1, dword [0x1006c488]
mulss xmm0, xmm1
mov edx, dword [esp + 0x20]
mulss xmm0, dword [esp + 0x14]
movss dword [edi + 0x24], xmm0
movss xmm0, dword [0x1052f3c4]
mulss xmm0, xmm1
mulss xmm0, dword [esp + 0x18]
movss dword [edi + 0x28], xmm0
movss xmm0, dword [0x1052f3c4]
mulss xmm0, xmm1
mulss xmm0, dword [esp + 0x1c]
movss dword [edi + 0x2c], xmm0
mov eax, dword [edx + 0x2c]
sub ecx, eax
cmp eax, 0xe
jl 0x100164eb
test esi, esi
jne 0x100164eb
mov al, byte [0x10531ba4]
jmp 0x100164f2
xor al, al
mov byte [0x10531ba4], al
cmp esi, ecx
jg 0x10016500
cmp dword [edx + 0x2c], 0
je 0x10016500
test al, al
je 0x1001650a
mov ecx, dword [esp + 0x10]
push edi
call fcn.10016520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10016dc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006995d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10468f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
test esi, esi
js 0x10016efa
cmp esi, dword [ebx + 0x10]
jge 0x10016efa
cmp dword [ebp + 0xc], 0
je 0x10016efa
mov eax, dword [ebx + 0xc]
lea ecx, [esi*4]
mov dword [ebp - 0x20], ecx
xor edi, edi
mov eax, dword [ecx + eax]
mov ecx, dword [ebx]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
cmp byte [eax + 0xd], 0
jne 0x10016e4e
nop
mov dword [ebp - 0x10], eax
cmp dword [eax + 0x10], esi
jge 0x10016e3f
mov eax, dword [eax + 8]
xor edi, edi
jmp 0x10016e48
mov ecx, eax
mov edi, 1
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10016e30
cmp byte [ecx + 0xd], 0
jne 0x10016e59
cmp esi, dword [ecx + 0x10]
jge 0x10016eaa
cmp dword [ebx + 4], 0xaaaaaaa
je 0x10016f10
mov dword [ebp - 0x2c], ebx
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
call fcn.10041f9b
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 0
mov dword [eax], ecx
push eax
mov dword [eax + 4], ecx
push edi
push dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov ecx, ebx
mov word [eax + 0xc], 0
call fcn.1001b770
mov ecx, eax
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0xc]
push 0x40
push 4
add eax, edi
push eax
call esi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [edi + eax], ecx
lea eax, [ebp - 0x24]
mov ecx, dword [ebx + 0xc]
push eax
push dword [ebp - 0x18]
add ecx, edi
push 4
push ecx
call esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1001bba0
int3
Function at 0x10021e00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x10468f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x248]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push eax
push 0x1006d4f8
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x250], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x254], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x10021f79
lea eax, [ebp - 0x108]
sub edi, eax
test byte [ebp - 0x248], 0x10
jne 0x10021f5e
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x21c]
lea eax, [eax + 1]
mov byte [ebp + eax - 0x109], cl
test cl, cl
jne 0x10021e70
lea edx, [ebp - 0x108]
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x10021e90
sub edx, ecx
mov ecx, esi
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10021ea0
sub ecx, esi
cmp edx, ecx
jb 0x10021f58
mov ebx, dword [ebp - 0x24c]
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10021ec0
sub esi, ecx
mov eax, edx
sub eax, esi
mov ecx, ebx
lea eax, [ebp + eax - 0x108]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10021ef6
test bl, bl
je 0x10021ef2
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10021ef6
add eax, 2
add ecx, 2
test bl, bl
jne 0x10021ed6
xor eax, eax
jmp 0x10021efb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10021f52
mov ecx, dword [ebp - 0x24c]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10021f08
sub ecx, esi
sub edx, ecx
cmp edx, 0x104
jae 0x10021f8c
mov byte [ebp + edx - 0x108], al
lea ecx, [ebp - 0x108]
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x10021f30
mov ebx, dword [ebp - 0x250]
inc ebx
add edi, 0x100
mov dword [ebp - 0x250], ebx
jmp 0x10021f58
mov ebx, dword [ebp - 0x250]
mov esi, dword [ebp - 0x24c]
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10021e60
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100421e2
mov esp, ebp
pop ebp
ret
call fcn.10042808
int3
Function at 0x1002b0f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a415
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10468f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.1002b080
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1002b183
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xea0ea0
je 0x1002b2d4
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x118
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.10041f9b
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1006c460]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1006c460]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1002b276
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.1004c800
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100428f0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1002b258
cmp ebx, 0x200
jae 0x1002b256
shl ebx, 3
cmp ebx, ecx
jae 0x1002b258
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1002d5b0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002b080
mov edx, dword [eax]
jmp 0x1002b279
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1002b2a4
mov dword [ecx + eax*8], esi
jmp 0x1002b2b3
cmp edi, edx
jne 0x1002b2ad
mov dword [ecx + eax*8], esi
jmp 0x1002b2b7
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1002b2b7
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10040f5e
int3
Function at 0x1002c4d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a537
mov eax, dword fs:[0]
push eax
sub esp, 0x144
push esi
push edi
mov eax, dword [0x10468f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cvttss2si esi, dword [0x10530dcc]
lea eax, [ebp + 0xc]
mov ecx, 0x10468608
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov dword [ebp - 0x20], 0
cvttss2si edi, dword [0x10530dc8]
push esi
mov dword [ebp - 0x10], esi
push edi
call fcn.1002bd50
test al, al
jne 0x1002c544
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x35c
call fcn.10041f9b
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1002c578
push dword [ebp + 0xc]
mov ecx, eax
push esi
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 8]
call fcn.1002da60
mov esi, eax
jmp 0x1002c57a
xor esi, esi
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x324], edi
mov dword [esi + 0x328], eax
mov ecx, dword [0x10468628]
mov edi, dword [0x10468624]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], esi
cmp ecx, dword [0x1046862c]
je 0x1002c5da
cmp edi, ecx
jne 0x1002c5b6
mov dword [ecx], esi
add dword [0x10468628], 4
jmp 0x1002c5e9
mov eax, dword [ecx - 4]
mov dword [ecx], eax
mov eax, ecx
add dword [0x10468628], 4
sub eax, edi
sub eax, 4
push eax
sub ecx, eax
push edi
push ecx
call fcn.100438a0
add esp, 0xc
mov dword [edi], esi
jmp 0x1002c5e9
lea eax, [ebp - 0x10]
mov ecx, 0x10468624
push eax
push edi
call fcn.10005b30
mov ecx, esi
mov dword [0x10468620], esi
mov dword [ebp - 0x1c], 2
call fcn.10033020
movzx ecx, al
xor ecx, 0x811c9dc5
mov dword [ebp - 0x10], eax
imul edx, ecx, 0x1000193
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov dword [ebp - 0x14], eax
shr eax, 0x10
xor edx, ecx
movzx eax, al
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x10]
shr ecx, 0x18
xor eax, ecx
mov ecx, 0x10530f70
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1002b080
mov edx, dword [0x10530f74]
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [0x10530f74]
jne 0x1002c6c3
lea eax, [ebp - 0x14]
mov ecx, 0x10530f70
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1002b0f0
mov ecx, 0x43
lea esi, [ebp - 0x150]
mov edi, dword [eax]
lea eax, [ebp - 0x14]
push eax
add edi, 0xc
lea eax, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, 0x10530f70
call fcn.1002b0f0
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x15]
mov eax, dword [eax]
add eax, 0xc
push eax
call fcn.1002b900
lea eax, [ebp - 0x14]
mov ecx, 0x10530f70
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.1002b0f0
mov edx, dword [eax]
mov al, byte [edx + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002d920
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.1002b080
mov eax, dword [eax + 4]
test eax, eax
je 0x1002d994
cmp eax, dword [edi + 4]
je 0x1002d994
push dword [ebp + 0xc]
add eax, 0xc
mov ecx, edi
push eax
call fcn.1002da00
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.1002b0f0
mov ecx, 0x43
lea esi, [ebp - 0x118]
mov edi, dword [eax]
lea eax, [ebp - 0xc]
add edi, 0xc
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push edi
push eax
call fcn.1002b0f0
mov esi, dword [ebp + 0xc]
lea ecx, [ebp + 0xb]
push esi
mov eax, dword [eax]
add eax, 0xc
push eax
call fcn.1002b900
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.1002b0f0
mov ecx, dword [ebp - 4]
push esi
mov eax, dword [eax]
add eax, 0xc
push eax
call fcn.1002da00
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10033c60
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10468f40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x10033cbf
mov al, byte [ebp - 0x108]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0xf4], 0
setne dl
add esi, 0xffffff46
cmp esi, 0x24
ja case.0x10033cdf.193
movzx ecx, byte [esi + 0x10033e3c]
jmp dword [ecx*4 + 0x10033e0c]
xor dl, 1
pop esi
lea eax, [edx + 0x3a]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
test dl, dl
mov eax, 0x3d
mov ecx, 0x2b
cmovne eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
test dl, dl
mov eax, 0x2c
mov ecx, 0x22
cmovne eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
test dl, dl
mov eax, 0x2d
mov ecx, 0x5f
cmovne eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
shl dl, 4
pop esi
lea eax, [edx + 0x2e]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
shl dl, 4
pop esi
lea eax, [edx + 0x2f]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
test dl, dl
mov eax, 0x60
mov ecx, 0x7e
cmovne eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
shl dl, 5
pop esi
lea eax, [edx + 0x5b]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
shl dl, 5
pop esi
lea eax, [edx + 0x5c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
shl dl, 5
pop esi
lea eax, [edx + 0x5d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
test dl, dl
mov eax, 0x27
mov ecx, 0x22
cmovne eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100421e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.100421e2
mov esp, ebp
pop ebp
ret
Function at 0x100391e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
lea eax, [ebp - 8]
mov ebx, ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
push dword [0x10531c30]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [ebp - 8]
movd xmm1, dword [ebp - 4]
cvtdq2ps xmm0, xmm0
push 2
cvtdq2ps xmm1, xmm1
movss dword [ebx], xmm0
movss dword [ebx + 4], xmm1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
movsx edi, ax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
mov ecx, edi
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], edi
movups xmm0, xmmword [ebx]
pop edi
mov dword [ebx + 8], 0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4