joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100127a1
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [0x10249c14]
mov dword [esp + 8], edx
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x100128e3
mov eax, dword [0x10249c10]
test eax, eax
jne 0x10012741
mov edx, 0xe80c2f78
mov ecx, 0x101e7481
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov dword [0x10249c10], eax
cmp dword [eax + ebx], 0
jle 0x100128e3
call fcn.1000ae70
cmp eax, 9
je 0x100128e3
cmp eax, 8
je 0x100128e3
cmp eax, 0xa
je 0x100128e3
cmp byte [0x1024a286], 0
je 0x100128e3
mov ecx, dword [0x10210290]
mov eax, dword [0x1024a2a8]
cmp ecx, 3
ja case.0x10012788.0
jmp dword [ecx*4 + 0x100128ec]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x100127c0
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100127c0
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100128e3
test byte [esp + 0x10], 1
je 0x100128dc
mov eax, dword [0x10249c64]
mov ebx, dword [0x10249c14]
test eax, eax
jne 0x10012810
mov edx, 0xe80c2f78
mov ecx, 0x101e75b1
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov dword [0x10249c64], eax
test byte [eax + ebx], 1
jne 0x100128dc
cmp byte [0x1024a2c9], 0
je 0x100128ca
cmp byte [0x1024a2b0], 0
je 0x100128ca
mov eax, dword [0x1024a28c]
test al, al
je 0x1001285d
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x1024a28c]
test ah, ah
je 0x1001287c
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28e], 0
je 0x100128a3
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28f], 0
je 0x100128ca
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
or dword [edi + 0x30], 2
mov byte [0x1024ae56], 1
pop edi
pop esi
pop ebx
add esp, 8
ret
mov byte [0x1024ae56], 0
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x100127b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [0x10249c14]
mov dword [esp + 8], edx
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x100128e3
mov eax, dword [0x10249c10]
test eax, eax
jne 0x10012741
mov edx, 0xe80c2f78
mov ecx, 0x101e7481
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov dword [0x10249c10], eax
cmp dword [eax + ebx], 0
jle 0x100128e3
call fcn.1000ae70
cmp eax, 9
je 0x100128e3
cmp eax, 8
je 0x100128e3
cmp eax, 0xa
je 0x100128e3
cmp byte [0x1024a286], 0
je 0x100128e3
mov ecx, dword [0x10210290]
mov eax, dword [0x1024a2a8]
cmp ecx, 3
ja case.0x10012788.0
jmp dword [ecx*4 + 0x100128ec]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x100127c0
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x100127c0
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100128e3
test byte [esp + 0x10], 1
je 0x100128dc
mov eax, dword [0x10249c64]
mov ebx, dword [0x10249c14]
test eax, eax
jne 0x10012810
mov edx, 0xe80c2f78
mov ecx, 0x101e75b1
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov dword [0x10249c64], eax
test byte [eax + ebx], 1
jne 0x100128dc
cmp byte [0x1024a2c9], 0
je 0x100128ca
cmp byte [0x1024a2b0], 0
je 0x100128ca
mov eax, dword [0x1024a28c]
test al, al
je 0x1001285d
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x1024a28c]
test ah, ah
je 0x1001287c
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28e], 0
je 0x100128a3
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28f], 0
je 0x100128ca
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
or dword [edi + 0x30], 2
mov byte [0x1024ae56], 1
pop edi
pop esi
pop ebx
add esp, 8
ret
mov byte [0x1024ae56], 0
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x10012900
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [0x10249c14]
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x10012b5d
mov eax, dword [0x10249c10]
test eax, eax
jne 0x1001294a
mov edx, 0xe80c2f78
mov ecx, 0x101e7481
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov dword [0x10249c10], eax
cmp dword [eax + ebx], 0
jle 0x10012b5d
cmp byte [0x1024a294], 0
je 0x10012b5d
call fcn.1000ae70
cmp eax, 9
je 0x10012b5d
cmp eax, 8
je 0x10012b5d
cmp eax, 0xa
je 0x10012b5d
mov ecx, dword [0x10249c64]
mov ebx, dword [0x10249c14]
test ecx, ecx
jne 0x100129c2
mov edx, 0xe80c2f78
mov ecx, 0x101e75b1
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov ecx, eax
mov dword [0x10249c64], ecx
test byte [ecx + ebx], 1
mov eax, dword [0x10249ba0]
je 0x100129d8
mov edx, dword [eax + 0x1c]
mov dword [0x1024547c], edx
jmp 0x100129de
mov edx, dword [0x1024547c]
mov eax, dword [eax + 0x1c]
mov esi, dword [0x102102ac]
sub eax, edx
mov edx, dword [0x1024a260]
cmp eax, 2
setle al
mov byte [0x1024a30c], al
cmp esi, 3
ja case.0x100129ff.0
jmp dword [esi*4 + 0x10012b64]
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10012a37
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10012a37
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x10012b5d
mov al, byte [0x1024a30c]
mov ecx, dword [0x10249c64]
test al, al
je 0x10012b56
mov ebx, dword [0x10249c14]
test ecx, ecx
jne 0x10012a8d
mov edx, 0xe80c2f78
mov ecx, 0x101e75b1
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov ecx, eax
mov dword [0x10249c64], ecx
test byte [ecx + ebx], 1
jne 0x10012b56
cmp byte [0x1024a2c9], 0
je 0x10012b47
cmp byte [0x1024a2b3], 0
je 0x10012b47
mov eax, dword [0x1024a28c]
test al, al
je 0x10012ada
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
mov eax, dword [0x1024a28c]
test ah, ah
je 0x10012af9
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28e], 0
je 0x10012b20
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28f], 0
je 0x10012b47
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
or dword [edi + 0x30], 4
mov byte [0x1024ae55], 1
pop edi
pop esi
pop ebx
ret
mov byte [0x1024ae55], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10012b80
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [0x10249c14]
mov dword [esp + 8], edx
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x10012d86
mov eax, dword [0x10249c10]
test eax, eax
jne 0x10012bd1
mov edx, 0xe80c2f78
mov ecx, 0x101e7481
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov dword [0x10249c10], eax
cmp dword [eax + ebx], 0
jle 0x10012d86
call fcn.1000ae70
cmp eax, 9
je 0x10012d86
cmp eax, 8
je 0x10012d86
cmp eax, 0xa
je 0x10012d86
cmp byte [0x1024a269], 0
je 0x10012d86
mov ecx, dword [0x1021029c]
mov eax, dword [0x1024a2d8]
cmp ecx, 3
ja case.0x10012c18.0
jmp dword [ecx*4 + 0x10012d90]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10012c50
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10012c50
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x10012d86
test byte [esp + 0x10], 1
je 0x10012d7f
mov eax, dword [0x10249c64]
mov ebx, dword [0x10249c14]
test eax, eax
jne 0x10012ca0
mov edx, 0xe80c2f78
mov ecx, 0x101e75b1
call fcn.10004820
mov edx, 0xc10bf213
mov ecx, 0x101e73a9
mov esi, eax
call fcn.10004820
mov edx, esi
mov ecx, eax
call fcn.10113840
mov dword [0x10249c64], eax
test byte [eax + ebx], 1
jne 0x10012d7f
cmp byte [0x1024a2c9], 0
je 0x10012cd7
cmp byte [0x1024a2b1], 0
je 0x10012cd7
mov ecx, dword [0x10213bfc]
and dword [edi + 0x30], 0xfffffff7
push 0
push str._forward
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28d], 0
lea esi, [edi + 0x30]
je 0x10012cfd
mov ecx, dword [0x10213bfc]
and dword [esi], 0xffffffef
push 0
push str._back
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28e], 0
je 0x10012d23
mov ecx, dword [0x10213bfc]
and dword [esi], 0xfffffdff
push 0
push str._moveleft
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
cmp byte [0x1024a28f], 0
mov ecx, esi
je 0x10012d4e
mov ecx, dword [0x10213bfc]
and dword [esi], 0xfffffbff
push 0
push str._moveright
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c8]
call eax
lea ecx, [edi + 0x30]
cmp byte [0x1024a2b8], 0
mov byte [0x1024ae54], 1
je 0x10012d6f
or dword [esi], 2
mov eax, dword [esi]
or eax, 4
mov dword [ecx], eax
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esi]
mov ecx, esi
or eax, 4
mov dword [ecx], eax
pop edi
pop esi
pop ebx
add esp, 8
ret
mov byte [0x1024ae54], 0
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x1001faf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1001fb1c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1001fb44
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1001fb4a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1001fbb2
jg 0x1001fb61
test esi, esi
je 0x1001fbb2
test ecx, ecx
jl 0x1001fbad
jg 0x1001fb6b
test eax, eax
je 0x1001fbad
cmp edi, ecx
jg 0x1001fb7f
jl 0x1001fb75
cmp esi, eax
jae 0x1001fb7f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1001fbb5
mov ecx, dword [ebp + 8]
jmp 0x1001fbbf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1001fbd9
jg 0x1001fbbf
test esi, esi
je 0x1001fbd9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1001fbd9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001fbf0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x14]
test eax, eax
jg 0x1001fc11
jl 0x1001fc07
test esi, esi
jne 0x1001fc11
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ecx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1001fc29
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
pop ecx
ret 0xc
mov eax, dword [ebx + 0x1c]
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edx, dword [eax]
mov edi, esi
test edx, edx
je 0x1001fc70
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
test eax, eax
je 0x1001fc77
cmp eax, dword [esp + 0x1c]
cmovb esi, eax
push esi
push edx
push ebp
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add ebp, esi
sub edi, esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x1001fc77
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x4c], 0
je 0x1001fce6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1001fca1
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x1001fcd4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call eax
add esp, 0x10
add ebp, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1001fce6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1001fcb0
test edi, edi
je 0x1001fce6
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call eax
add esp, 0x10
sub edi, eax
mov edx, dword [esp + 0x20]
sub esi, edi
pop edi
pop ebp
mov eax, esi
sbb edx, 0
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x10020060
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1002007a
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100200a2
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx]
add ecx, eax
cmp eax, ecx
jae 0x100200a2
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
add esp, 0x28
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10020172
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100200cb
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100200d7
movsx eax, bl
jmp 0x10020117
lea eax, [esp + 0x38]
mov byte [esp + 0xf], bl
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10020137
sub eax, 1
je 0x10020137
sub eax, 2
jne 0x10020172
movsx eax, byte [esp + 0xf]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x28
ret 4
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x14]
sub edi, eax
je 0x10020157
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10020172
lea ecx, [esp + 0xf]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [esp + 0x10], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
add esp, 0x28
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret 4
Function at 0x100206d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10020762
cmp byte [esi + 0x3d], 0
je 0x10020762
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002075a
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10020729
sub eax, 1
je 0x1002072d
sub eax, 2
jne 0x1002075a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
add esp, 0x24
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x1002074d
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002075a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
add esp, 0x24
ret
pop edi
xor al, al
pop esi
add esp, 0x24
ret
mov al, 1
pop esi
add esp, 0x24
ret
Function at 0x1002ad20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], ebx
push esi
push edi
cmp ecx, eax
je 0x1002ae81
mov eax, dword [ebx + 4]
mov esi, ecx
mov edi, dword [ecx + 0xc]
mov edx, 0x811c9dc5
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 8]
xor ecx, ecx
test edi, edi
je 0x1002ad85
mov ebx, eax
nop word [eax + eax]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1002ad70
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.10177006
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [esp + 0x24]
je 0x1002ade9
cmp esi, dword [ebp + 0xc]
jne 0x1002ada2
mov eax, dword [esp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x1002ae75
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp eax, dword [ebp + 8]
jne 0x1002adfe
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1002ae02
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [ebp + 0xc]
je 0x1002ae75
nop word [eax + eax]
mov edi, dword [esi + 0xc]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1002ae36
mov ebx, dword [esi + 8]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1002ae21
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edx
lea eax, [ecx + eax*8]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
nop dword [eax]
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.10177006
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [esp + 0x24]
je 0x1002ae8a
cmp esi, dword [ebp + 0xc]
jne 0x1002ae50
mov eax, dword [esp + 0x10]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov dword [eax + 4], ecx
cmp esi, dword [ebp + 0xc]
jne 0x1002ae10
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002f300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [ebp + 0xc]
sub esp, 0x34
mov edx, dword [eax + 4]
push ebx
push esi
mov ebx, ecx
mov esi, 0x811c9dc5
xor ecx, ecx
push edi
mov edi, dword [eax]
test edx, edx
je 0x1002f335
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1002f321
mov eax, dword [ebp + 0xc]
push esi
push eax
lea eax, [esp + 0x40]
mov ecx, ebx
push eax
call fcn.10030b70
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x1002f36f
mov eax, dword [ebp + 0x10]
movq xmm0, qword [eax]
movq qword [ecx + 0x10], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 8], 0x9249249
jne 0x1002f383
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
push 0x1c
call fcn.10176cb7
mov edi, eax
add esp, 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
movq xmm0, qword [eax]
movq qword [edi + 0x10], xmm0
mov eax, dword [eax + 8]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10209820]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10209820]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1002f461
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x40], xmm2
fld dword [esp + 0x40]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [esp + 0x38]
movss xmm0, dword [esp + 0x38]
call fcn.101780b0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1002f444
cmp eax, 0x200
jae 0x1002f442
shl eax, 3
cmp eax, ecx
jae 0x1002f444
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100309b0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [esp + 0x40]
push eax
call fcn.10030b70
mov edx, dword [eax]
jmp 0x1002f465
mov edx, dword [esp + 0x38]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1002f48e
mov dword [ecx + eax*8], edi
jmp 0x1002f4b1
cmp esi, edx
jne 0x1002f4a7
mov dword [ecx + eax*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esp + 0x38]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1002f4b5
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc