joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e9300
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x1024f7f4]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov ebx, dword [esi + 0x3e58]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0xc]
and eax, 4
or eax, 0x1000103
or edi, eax
cmp dword [ebx + 0x190], 0
mov dword [ebp + 0x10], edi
jne 0x100e9345
cmp dword [esi + 0x4a14], 0
mov eax, 0x228
je 0x100e934a
mov eax, 0x1f8
movss xmm4, dword [eax + ebx]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebx + 4]
mov ecx, dword [ebp + 8]
subss xmm4, dword [ebx + 0xf0]
subss xmm5, dword [ebx + 0xf4]
movss xmm2, dword [0x10237970]
cvttss2si eax, dword [ecx]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 2
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
mov eax, 1
cmovnp ecx, eax
ucomiss xmm0, xmm3
lahf
test ah, 0x44
mov eax, dword [ebp + 8]
cmovnp eax, dword [ebp - 4]
or eax, ecx
comiss xmm3, xmm1
mov dword [ebp + 8], eax
jb 0x100e93cd
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x100e93cd
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x100e93de
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x100e93de
movaps xmm0, xmm2
or dword [esi + 0x470c], 2
mov ecx, dword [ebp - 0xc]
movss dword [esi + 0x472c], xmm1
movss dword [esi + 0x4730], xmm0
mov dword [esi + 0x4714], 1
mov eax, dword [ebx + 4]
push edx
test ecx, ecx
je 0x100e9421
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.100e2810
add esp, 0x18
jmp 0x100e9435
push eax
push str._s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.100e2810
add esp, 0x14
cmp byte [ebp + 0xc], 0
movss xmm0, dword [esi + 0x37b0]
movss dword [ebp - 0xc], xmm0
jne 0x100e9452
mov dword [esi + 0x37b0], 0
mov ecx, dword [ebp - 4]
xor edx, edx
push edi
call fcn.100ebff0
mov edi, dword [esi + 0x3e58]
add esp, 4
movss xmm0, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
movss dword [esi + 0x37b0], xmm0
cmp word [edi + 0xb6], 1
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [edi + 0x74], edx
mov byte [edi + 0xc6], al
jne 0x100e94a4
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebx + 0xf0], ecx
mov dword [ebx + 0xf4], eax
mov edi, edx
mov al, 0x23
not edi
mov edx, 0x1021da65
mov ebx, edi
cmp al, 0x23
jne 0x100e94bf
cmp byte [edx], al
jne 0x100e94bf
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x101d6b20]
test al, al
jne 0x100e94b1
mov edi, dword [ebp - 0xc]
not ebx
cmp dword [esi + 0x3ea4], ebx
jne 0x100e94ee
xor edx, edx
xor ecx, ecx
call fcn.100e58d0
mov eax, dword [ebp - 8]
cmp dword [esi + 0x47e8], eax
jne 0x100e953c
test dword [ebp + 0x10], 0x800000
jne 0x100e953c
cmp word [edi + 0x14c], 0
jne 0x100e9515
cmp byte [edi + 0x152], 0
je 0x100e953c
xor edx, edx
mov ecx, edi
call fcn.100eef30
xor dl, dl
mov ecx, edi
call fcn.100f6ac0
mov edx, edi
mov ecx, ebx
call fcn.100e58d0
mov eax, dword [esi + 0x480c]
mov dword [esi + 0x3ec4], eax
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100fa1d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5ad0], 0
lea esi, [edi + 0x5ad4]
je 0x100fa252
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x100fa20c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100fc310
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.100e3410
mov edx, dword [esi]
mov ecx, 0x1024f7c1
push dword [edi + 0x5ad0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5adc]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100e3410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101049b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x101049ea
mov eax, dword [0x1024f7f4]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x101049dd
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10104a1b
mov eax, dword [0x1024f7f4]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x10104a0e
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10104a4c
mov eax, dword [0x1024f7f4]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x10104a3f
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10104a99
mov eax, dword [0x1024f7f4]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10104a8c
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10104aca
mov eax, dword [0x1024f7f4]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10104abd
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10104afb
mov eax, dword [0x1024f7f4]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10104aee
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10107700
Function at 0x1010e240
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x1024f7f4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
cmp byte [eax + 0x2edc], 0
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
je 0x1010e2cd
xor edx, edx
mov ecx, 0x210
call fcn.100f2850
test al, al
je 0x1010e2cd
push 0xa0
call ebx
shr eax, 0xf
test al, 1
jne 0x1010e2cd
cmp dword [0x1024f7f4], 0
jne 0x1010e298
push 0x108f
push str.C:UsersPcDownloadsGTA_SAN_ANDREAS___FULL1_fware_iv_mainFedorawareFedoraware_TF2includeImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1024f7f4]
cmp byte [esi + 0x3769], 0
je 0x1010e2b9
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.100e1ea0
mov dword [esi + 0x338], 0x210
mov dword [esi + 0x8f8], 0xa0
mov eax, dword [0x1024f7f4]
cmp byte [eax + 0x2f1c], 0
je 0x1010e34b
xor edx, edx
mov ecx, 0x214
call fcn.100f2850
test al, al
je 0x1010e34b
push 0xa1
call ebx
shr eax, 0xf
test al, 1
jne 0x1010e34b
cmp dword [0x1024f7f4], 0
jne 0x1010e316
push 0x108f
push str.C:UsersPcDownloadsGTA_SAN_ANDREAS___FULL1_fware_iv_mainFedorawareFedoraware_TF2includeImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1024f7f4]
cmp byte [esi + 0x3769], 0
je 0x1010e337
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.100e1ea0
mov dword [esi + 0x33c], 0x214
mov dword [esi + 0x908], 0xa1
mov eax, dword [0x1024f7f4]
cmp byte [eax + 0x2efc], 0
je 0x1010e3c6
xor edx, edx
mov ecx, 0x212
call fcn.100f2850
test al, al
je 0x1010e3c6
push 0x5b
call ebx
shr eax, 0xf
test al, 1
jne 0x1010e3c6
cmp dword [0x1024f7f4], 0
jne 0x1010e391
push 0x108f
push str.C:UsersPcDownloadsGTA_SAN_ANDREAS___FULL1_fware_iv_mainFedorawareFedoraware_TF2includeImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1024f7f4]
cmp byte [esi + 0x3769], 0
je 0x1010e3b2
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.100e1ea0
mov dword [esi + 0x224], 0x212
mov dword [esi + 0x900], 0x5b
mov eax, dword [0x1024f7f4]
cmp byte [eax + 0x2f3c], 0
je 0x1010e442
xor edx, edx
mov ecx, 0x216
call fcn.100f2850
test al, al
je 0x1010e442
push 0x5c
call ebx
shr eax, 0xf
test al, 1
jne 0x1010e442
mov esi, dword [0x1024f7f4]
test esi, esi
jne 0x1010e413
push 0x108f
push str.C:UsersPcDownloadsGTA_SAN_ANDREAS___FULL1_fware_iv_mainFedorawareFedoraware_TF2includeImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x1024f7f4]
add esp, 0xc
cmp byte [esi + 0x3769], 0
je 0x1010e42e
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.100e1ea0
mov dword [esi + 0x228], 0x216
mov dword [esi + 0x910], 0x5c
pop edi
pop esi
pop ebx
ret
Function at 0x10117a70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1024f7f4]
sub esp, 8
push esi
mov esi, ecx
push edi
mov edi, dword [eax + 0x4a14]
cmp esi, 0xffffffff
jne 0x10117a91
cmp dword [edi + 0x48], ecx
cmovne esi, dword [edi + 0x48]
mov eax, dword [edi + 0x40]
cmp esi, eax
jne 0x10117a9d
or esi, 0xffffffff
jmp 0x10117aa2
cmp esi, 0xffffffff
jl 0x10117aa6
cmp esi, eax
jl 0x10117abe
push 0xc0c
push str.C:UsersPcDownloadsGTA_SAN_ANDREAS___FULL1_fware_iv_mainFedorawareFedoraware_TF2includeImGuiimgui_tables.cpp
push str.column_n____1__column_n___table__ColumnsCount
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
test byte [edi + 4], 7
je 0x10117b17
mov ax, word [edi + 0x4c]
mov word [edi + 0x1cc], si
mov esi, 0x10225635
mov word [edi + 0x4e], ax
mov al, 0x23
mov byte [edi + 0x1e3], 1
mov edi, dword [edi]
not edi
mov ecx, edi
cmp al, 0x23
jne 0x10117af5
cmp byte [esi], al
jne 0x10117af5
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x101d6b20]
test al, al
jne 0x10117ae7
not ecx
xor edx, edx
call fcn.100f4850
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1013dd00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
cmp edx, eax
jbe 0x1013dd31
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.1006d9f0
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x1013de37
mov eax, ecx
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp + 8], ebx
cmp esi, dword [ebp - 8]
jne 0x1013ddc2
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x1013de2c
mov edx, dword [ebx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1013ddf9
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x1013ddf4
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x1013de29
cmp esi, edx
je 0x1013de0c
nop dword [eax]
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1013de40
cmp esi, edx
jne 0x1013de00
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 8]
jne 0x1013dd70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x1013de29
Function at 0x1013de60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x1013dfb6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.1019280b
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x1013df19
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1013ded7
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1013dfac
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1013df2d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x1013df30
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1013dfac
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.1019280b
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x1013dfbd
cmp esi, eax
jne 0x1013df87
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1013df40
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1013e3c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1013e55a
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x1013e3fb
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x1013e424
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x1013e410
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.101407e0
push 0x40
push edi
call fcn.1019280b
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1013e489
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1013e440
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x1013e478
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1013e49b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x1013e49e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x1013e54d
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x1013e4be
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1013e4e4
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1013e4d0
mov eax, dword [ebp - 4]
and edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.101407e0
push 0x40
push edi
call fcn.1019280b
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1013e537
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1013e4f6
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x1013e4b0
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10142f50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x101430ec
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x10142f8b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x10142fb4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10142fa0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.100c1490
push 0x3c
push edi
call fcn.1019280b
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10143019
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10142fd0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10143008
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1014302b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x1014302e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x101430df
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x1014304e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10143074
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10143060
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.100c1490
push 0x3c
push edi
call fcn.1019280b
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x101430c9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10143088
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x10143040
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1015a2f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [0x10312eb4], 0
push esi
je 0x1015a588
mov esi, dword [0x1024f7f4]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 2
movups xmm0, xmmword [esi + 0x387c]
lea ecx, [esi + 0x476c]
movups xmmword [ebp - 0x14], xmm0
call fcn.100fbf70
mov dword [esi + 0x387c], 0
lea eax, [ebp - 0x18]
mov dword [esi + 0x3880], 0
mov dword [esi + 0x3884], 0
mov dword [esi + 0x3888], 0x3eb33333
mov esi, dword [0x1024f7f4]
push eax
mov dword [ebp - 0x18], 0xa
movups xmm0, xmmword [esi + 0x38fc]
lea ecx, [esi + 0x476c]
movups xmmword [ebp - 0x14], xmm0
call fcn.100fbf70
mov dword [esi + 0x38fc], 0
lea eax, [ebp - 0x18]
mov dword [esi + 0x3900], 0
mov dword [esi + 0x3904], 0
mov dword [esi + 0x3908], 0x3f000000
mov esi, dword [0x1024f7f4]
push eax
mov dword [ebp - 0x18], 0xb
movups xmm0, xmmword [esi + 0x390c]
lea ecx, [esi + 0x476c]
movups xmmword [ebp - 0x14], xmm0
call fcn.100fbf70
mov dword [esi + 0x390c], 0
lea eax, [ebp - 0x10]
mov dword [esi + 0x3910], 0
mov dword [esi + 0x3914], 0
mov dword [esi + 0x3918], 0x3f000000
mov esi, dword [0x1024f7f4]
push eax
mov dword [ebp - 0x10], 2
movss xmm1, dword [esi + 0x3788]
lea ecx, [esi + 0x4778]
movss xmm0, dword [esi + 0x378c]
movss dword [ebp - 0xc], xmm1
movss dword [ebp - 8], xmm0
call fcn.100fbeb0
mov dword [esi + 0x3788], 0x40800000
lea eax, [ebp - 0x10]
mov dword [esi + 0x378c], 0x40800000
mov esi, dword [0x1024f7f4]
push eax
mov dword [ebp - 0x10], 4
movss xmm0, dword [esi + 0x3794]
lea ecx, [esi + 0x4778]
movss dword [ebp - 0xc], xmm0
call fcn.100fbeb0
mov eax, dword [0x1024f7f4]
xor edx, edx
mov dword [esi + 0x3794], 0
mov ecx, str.Keybinds
push 0x22
or dword [eax + 0x470c], 2
mov dword [eax + 0x472c], 0x43480000
mov dword [eax + 0x4730], 0
mov dword [eax + 0x4714], 1
call fcn.100ebff0
add esp, 4
test al, al
je 0x1015a56f
cmp byte [0x10312a0c], 0
mov eax, dword [0x10312910]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
je 0x1015a4d7
test eax, eax
je 0x1015a4d1
push eax
call esi
test ax, ax
jns 0x1015a4d7
mov byte [ebp - 4], 1
jmp 0x1015a4db
mov byte [ebp - 4], 0
push dword [ebp - 4]
push str.Aimbot
call fcn.1015a590
movzx eax, byte [0x103128c8]
push eax
push str.Auto_Shoot
call fcn.1015a590
mov eax, dword [0x103174b4]
cmp eax, 3
je 0x1015a51b
test eax, eax
jne 0x1015a515
push dword [0x103173b8]
call esi
test ax, ax
jns 0x1015a51b
mov byte [ebp - 4], 1
jmp 0x1015a51f
mov byte [ebp - 4], 0
push dword [ebp - 4]
push str.Double_Tap
call fcn.1015a590
movzx eax, byte [0x10315c64]
push eax
push str.Anti_Aim
call fcn.1015a590
cmp byte [0x10315a48], 0
mov eax, dword [0x10315a6c]
je 0x1015a55e
test eax, eax
je 0x1015a558
push eax
call esi
test ax, ax
jns 0x1015a55e
mov byte [ebp - 4], 1
jmp 0x1015a562
mov byte [ebp - 4], 0
push dword [ebp - 4]
push str.Triggerbot
call fcn.1015a590
call fcn.100ee820
mov ecx, 2
call fcn.100e3980
mov ecx, 3
call fcn.100e38d0
pop esi
mov esp, ebp
pop ebp
ret