joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10122040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100384b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3c06
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100384ec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100384ec
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3c06
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100385c3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10038514
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10038520
movsx eax, bl
jmp 0x10038558
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10038582
sub eax, 1
je 0x10038582
sub eax, 2
jne 0x100385c3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3c06
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100385a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100385c3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3c06
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f3c06
mov esp, ebp
pop ebp
ret 4
Function at 0x100388c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10122040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003897c
cmp byte [esi + 0x3d], 0
je 0x1003897c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003896a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10038931
sub eax, 1
je 0x10038935
sub eax, 2
jne 0x1003896a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3c06
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10038953
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003896a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3c06
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3c06
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100f3c06
mov esp, ebp
pop ebp
ret
Function at 0x1003b270
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101d5360], 0
push ebx
push esi
push edi
je 0x1003b428
mov ecx, dword [0x101de9e4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003b428
mov esi, dword [0x101dea68]
xor ebx, ebx
mov dword [ebp - 4], esi
mov eax, dword [esi + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003b428
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [esi + 0x28]
jl 0x1003b2d7
push 0x410
push str.D:csgo_rax_sourcelegacyutlvector.h
push str.i___m_Size
call eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
cmp dword [esi + 0x24], 0xfffffffe
jne 0x1003b2f1
push 0x272
push str.D:csgo_rax_sourcelegacyutlvector.h
push str._IsReadOnly__
call eax
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x1003b307
xor edx, edx
test ecx, ecx
je 0x1003b32d
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1003b314
cmp edi, 0x5ff56dc5
je 0x1003b33f
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003b428
mov esi, dword [ebp - 4]
jmp 0x1003b2b4
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [edi + 0x28]
jl 0x1003b361
push 0x410
push str.D:csgo_rax_sourcelegacyutlvector.h
push str.i___m_Size
call esi
add esp, 0xc
cmp dword [edi + 0x24], 0xfffffffe
jne 0x1003b37b
push 0x272
push str.D:csgo_rax_sourcelegacyutlvector.h
push str._IsReadOnly__
call esi
add esp, 0xc
mov eax, dword [edi + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003b428
mov eax, dword [edi + 0x88]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003b428
xor esi, esi
test eax, eax
jle 0x1003b428
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp esi, dword [edi + 0x88]
jl 0x1003b3d5
push 0x410
push str.D:csgo_rax_sourcelegacyutlvector.h
push str.i___m_Size
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
cmp dword [edi + 0x84], 0xfffffffe
jne 0x1003b3f5
push 0x272
push str.D:csgo_rax_sourcelegacyutlvector.h
push str._IsReadOnly__
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [edi + 0x7c]
movss xmm0, dword [ecx + edx + 0x418]
ucomiss xmm0, dword [0x10114e10]
lahf
test ah, 0x44
jp 0x1003b419
mov dword [ecx + edx + 0x418], 0x7f7fffff
inc esi
add edx, 0x420
mov dword [ebp - 4], edx
cmp esi, dword [ebp - 8]
jl 0x1003b3b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x101dcb54
push ebx
push esi
push edi
call fcn.1003a660
mov ecx, 0x101e4bf8
call fcn.1003de40
mov ecx, dword [0x101de9dc]
test ecx, ecx
je 0x1003b4fa
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov ebx, eax
test ebx, ebx
je 0x1003b4fa
mov eax, dword [ebx + 0x14]
mov esi, 0x811c9dc5
mov edi, dword [ebx + 8]
mov dword [ebp - 8], eax
xor eax, eax
inc eax
cmp byte [edi + eax], 0
jne 0x1003b4c4
xor edx, edx
test eax, eax
je 0x1003b4e2
movsx ecx, byte [edi + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x1003b4d1
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
call fcn.1003dcf0
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x1003b4b4
mov ecx, dword [0x101de9e4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x101de9e8]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov dword [0x101dc7f4], eax
call fcn.100e88d0
mov ecx, 0x101df6e8
call fcn.100d80b0
mov ecx, 0x101dd008
call fcn.1003e0c0
mov ecx, 0x101dc780
call fcn.1003e030
mov ecx, dword [0x101de9e4]
mov dword [0x101dc77c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x138]
call eax
pop edi
pop esi
mov dword [0x101dea4c], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003dcf0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f6825
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10122040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1003f0d0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1003de1b
cmp dword [0x101e4c00], 0xfffffff
jne 0x1003dd7a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101e4bfc
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100f3c22
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101e4c00]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10115120]
mov eax, dword [0x101e4c14]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10115120]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x101e4bf8]
jbe 0x1003de10
call fcn.1003ee70
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003f0d0
mov ecx, dword [eax]
jmp 0x1003de13
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.1003eef0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e150
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x1003e2a6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100f4081
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x1003e209
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1003e1c7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1003e29c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1003e21d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x1003e220
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1003e29c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100f4081
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1003e2ad
cmp esi, eax
jne 0x1003e277
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1003e230
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003ef60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1003ef8c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x101e4bfc]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101e4c04
lea eax, [edi + edi]
push eax
call fcn.1002f470
mov eax, dword [0x101e4bfc]
lea ebx, [edi - 1]
mov dword [0x101e4c10], ebx
mov dword [0x101e4c14], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1003f0c6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101e4c04]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1003f024
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1003f091
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1003f05e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1003f056
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1003f091
cmp ebx, edx
je 0x1003f06e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1003f0a2
cmp ebx, edx
jne 0x1003f062
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1003f0c6
mov ebx, dword [0x101e4c10]
jmp 0x1003efd2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1003f091
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004a9e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10122040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x1004aa13
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3c06
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x1004aa80
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x1004aa7a
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1004aa7a
cmp word [eax], cx
jne 0x1004aa7a
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x1004aa75
cmp dword [ecx], 0x4550
jne 0x1004aa75
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 8]
je 0x1004aa69
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x1004aa75
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.10050e40
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x1004aa24
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100f3c06
mov esp, ebp
pop ebp
ret
Function at 0x1004ba70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 4], eax
mov ebx, ecx
cmp dword [esi + 0x14], 0xf
mov edi, dword [esi + 0x10]
jbe 0x1004ba8c
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1004baab
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1004ba97
mov eax, dword [ebp - 4]
push edx
mov edx, eax
mov ecx, ebx
call fcn.1004b340
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10053a20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10053a81
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10053a64
cmp edi, 2
jb 0x10053a64
cmp byte [esi], cl
jne 0x10053a64
cmp byte [esi + 1], cl
jne 0x10053a64
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101039f0]
jmp 0x10053a35
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101039f0]
test edi, edi
jne 0x10053a35
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10053ab0
cmp cl, 0x23
jne 0x10053a97
cmp byte [esi], cl
jne 0x10053a97
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x101039f0]
test cl, cl
jne 0x10053a88
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10053c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10053c75
push 0x7a3
push str.D:csgo_rax_sourcelegacyimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10053c82
mov dword [edi], 0
mov edx, 0x1010df18
mov ecx, esi
call fcn.10053ac0
mov esi, eax
test esi, esi
je 0x10053d72
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10053d68
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10053d68
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10053d68
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10053d68
mov eax, dword [0x101d77d4]
test eax, eax
je 0x10053cfc
inc dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10053d68
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x10053d4d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x101d77d4]
add esp, 4
test eax, eax
je 0x10053d3a
dec dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10053d5f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100561e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10122040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp dword [edi + 0xe4], 0
jg 0x1005621f
push 0x70d
push str.D:csgo_rax_sourcelegacyimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [ebp - 8]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101039f0]
sub esi, 1
jne 0x10056240
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e6c], ebx
jne 0x10056277
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1006a970
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f3c06
mov esp, ebp
pop ebp
ret 4
Function at 0x10059d20
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10059d5f
cmp bl, 0x23
jne 0x10059d41
cmp byte [esi], bl
jne 0x10059d41
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x101039f0]
test bl, bl
jne 0x10059d32
mov ecx, dword [0x101d77d4]
not eax
mov esi, dword [ecx + 0x3e20]
mov edi, dword [ecx + 0x3e28]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10059d9e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10059d98
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10059d9a
mov esi, edx
test esi, esi
jne 0x10059d80
cmp edi, ebx
je 0x10059dad
cmp dword [edi], eax
jne 0x10059dad
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret