joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003ee0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0x30]
mov ecx, 0xb
mov esi, str._pipediscord_ipc_0
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 3
push 0
mov eax, 0x30
movsw word es:[edi], word [esi]
push 0
mov word [ebp - 6], ax
lea eax, [ebp - 0x30]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x10003f82
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call esi
cmp eax, 2
jne 0x10003f4b
mov ax, word [ebp - 6]
cmp ax, 0x39
jae 0x10003f8e
inc ax
mov word [ebp - 6], ax
jmp 0x10003f61
cmp eax, 0xe7
jne 0x10003f8e
push 0x2710
lea eax, [ebp - 0x30]
push eax
call edi
test eax, eax
je 0x10003f8e
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x10003f32
pop edi
pop esi
mov byte [ebx], 1
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005ab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f6a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, 3
mov word [esi + 0xe], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0x800
mov byte [ebp - 4], 1
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
cmp dword [esi + 0x10], 0
jne 0x10005b6f
push 0x14
call fcn.100220b1
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [eax], 0
mov dword [eax + 4], 0x10000
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10005c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
mov ebx, 1
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
add eax, 0x10
mov dword [ebp + 0xc], eax
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.1005d950
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, dword [ebp + 0xc]
adc esi, edx
inc ebx
mov dword [eax], edi
mov dword [eax + 4], esi
add eax, 8
mov dword [ebp + 0xc], eax
cmp ebx, 0x138
jl 0x10005cb3
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0x138
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10007770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x10081584]
push esi
push dword [ebp + 8]
mov dword [edi + 0x154], 1
lea eax, [edi + 0x15c]
lea ebx, [edi + 0x154]
push eax
call fcn.100291f0
add esp, 0xc
mov dword [edi + 0x158], esi
add esi, 8
je 0x10007827
mov eax, dword [edi]
test eax, eax
je 0x100077e0
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x100077e0
test ebx, ebx
je 0x100077e0
push 0
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x100077e0
cmp dword [ebp + 0xc], esi
je 0x10007827
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10007800
mov eax, dword [edi + 4]
cmp eax, 3
je 0x100077f4
cmp eax, 1
jne 0x10007800
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x50]
call ecx
add esp, 8
mov esi, dword [edi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
xor al, al
mov byte [esi], 0
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000af70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f8aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100241e0
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x1000b01d
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
mov dword [ebp - 0x18], str.bad_locale_name
mov byte [ebp - 0x14], 1
call fcn.10027c0b
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x1007ac58
push eax
call fcn.10028fb4
push eax
push esi
call fcn.10024540
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d6f0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100872dc]
sub esp, 0x404
test eax, eax
jne 0x1000d717
push eax
push eax
push eax
push 1
push str.ServerTime
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x100872dc], eax
mov ecx, dword [0x1008573c]
test ecx, ecx
jne 0x1000d73d
push ecx
push ecx
push 3
push ecx
push ecx
push 0x50
push str.www.audition.nexus
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ecx, eax
mov dword [0x1008573c], ecx
mov eax, dword [0x10087a84]
test eax, eax
jne 0x1000d761
push eax
push eax
push eax
push eax
push eax
push str._time
push 0x10071ef0
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [0x10087a84], eax
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x1000d7b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HttpSendRequest_FAILED___d
call fcn.1000d370
push eax
call fcn.10006550
add esp, 0xc
mov dword [0x100872dc], 0
mov dword [0x1008573c], 0
mov eax, 0x1007e320
mov dword [0x10087a84], 0
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.10029030
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x3ff
lea eax, [ebp - 0x404]
push eax
push dword [0x10087a84]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1000d800
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetReadFile_FAILED___d
jmp 0x1000d780
mov edx, dword [ebp - 4]
xor eax, eax
test edx, edx
je 0x1000d82e
lea esp, [esp]
mov cl, byte [ebp + eax - 0x404]
cmp cl, 0xa
je 0x1000d821
cmp cl, 0xd
jne 0x1000d829
mov byte [ebp + eax - 0x404], 0x20
inc eax
cmp eax, edx
jb 0x1000d810
lea eax, [ebp - 0x404]
mov byte [ebp + edx - 0x404], 0
push eax
push str.Server_Time_:_s
push 0x100
push 0x1007e320
call fcn.1000c150
add esp, 0x10
mov dword [0x10087a84], 0
mov eax, 0x1007e320
mov esp, ebp
pop ebp
ret

Function at 0x1000d9d0
Capabilities:
Hide thread from debugger

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [0x100856a0]
push str.NtSetInformationThread
push 0x10071f94
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x1000da01
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x11
test edi, edi
jne 0x1000da1f
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
test eax, eax
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
push edi
call esi
test eax, eax
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000dce0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x238
push esi
push edi
sub esp, 8
fldz
lea eax, [esp + 0x48]
mov esi, ecx
fstp qword [esp]
push 0x10071c88
push eax
call fcn.1000aeb0
add esp, 0x10
lea eax, [esp + 0x140]
push esi
push 0xff
push eax
lea eax, [esp + 0x4c]
push eax
push str.SOUNDOFFSET
push str.CONFIG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x140]
push eax
call fcn.100369d0
push ecx
fst qword [esp + 0x40]
fstp qword [esp]
push str.SOUNDOFFSET
push str._CIniReader::ReadFloat____s____f__n
call fcn.1000d370
mov edi, eax
add esp, 0x10
mov esi, edi
lea eax, [esi + 1]
jmp 0x1000dd60
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x1000dd60
push 6
push dword [0x10081574]
sub esi, eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0
lea eax, [esp + 0x38]
push eax
push esi
push edi
push dword [0x10081574]
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
fld qword [esp + 0x38]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000f8e0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
mov eax, ecx
mov esi, edx
push edi
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], eax
push ecx
push 0x100723bc
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000f9d3
jmp 0x1000f930
cmp byte [ebp - 0x224], 0x2e
je 0x1000f9b6
push dword [ebp - 4]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x100723c0
lea eax, [ebp - 0x110]
push eax
call ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x110]
push eax
call ebx
test byte [ebp - 0x250], 0x10
je 0x1000f97f
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.1000f8e0
jmp 0x1000f9b6
push esi
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1000f9b6
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xc0000005
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1000f9da
int 0x29
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000f930
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call fcn.1002f686
int3
Function at 0x100107f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005fb49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x814
push esi
mov esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10010848
mov eax, dword [esi]
jmp 0x1001084a
mov eax, esi
xor ecx, ecx
push 0x1d
mov word [eax], cx
mov ecx, esi
push str.Unknown_Windows_Product_Name.
call fcn.1001bf30
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100108f7
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 1
push eax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x18], 0x800
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.ProductName
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100108ee
cmp word [ebp - 0x820], ax
jne 0x100108c5
xor ecx, ecx
jmp 0x100108df
lea ecx, [ebp - 0x820]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100108d0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x820]
mov ecx, esi
push eax
call fcn.1001bf30
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100117a0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10085710]
sub esp, 0x404
test eax, eax
jne 0x100117c7
push eax
push eax
push eax
push 1
push str.CCUValue
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x10085710], eax
mov ecx, dword [0x1008574c]
test ecx, ecx
jne 0x100117ed
push ecx
push ecx
push 3
push ecx
push ecx
push 0x50
push str.www.audition.nexus
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ecx, eax
mov dword [0x1008574c], ecx
mov eax, dword [0x100872a8]
test eax, eax
jne 0x10011811
push eax
push eax
push eax
push eax
push eax
push str._connected_players
push 0x10071ef0
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [0x100872a8], eax
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x10011865
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HttpSendRequest_FAILED___d
call fcn.1000d370
push eax
call fcn.10006550
mov eax, dword [0x10085758]
add esp, 0xc
mov dword [0x10085710], 0
mov dword [0x1008574c], 0
mov dword [0x100872a8], 0
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.10029030
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x3ff
lea eax, [ebp - 0x404]
push eax
push dword [0x100872a8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x100118b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetReadFile_FAILED___d
jmp 0x10011830
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x404], 0
lea eax, [ebp - 0x404]
push eax
call fcn.100355cd
add esp, 4
test eax, eax
je 0x100118e4
lea eax, [ebp - 0x404]
push eax
call fcn.100355cd
add esp, 4
mov dword [0x10085758], eax
jmp 0x100118e9
mov eax, dword [0x10085758]
cmp eax, 0x7fffffff
jne 0x10011901
xor eax, eax
mov dword [0x10085758], eax
mov dword [0x10085710], eax
mov dword [0x1008574c], eax
mov dword [0x100872a8], 0
mov esp, ebp
pop ebp
ret
Function at 0x10018240
Capabilities:
Get common file path
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1005fc13
push eax
mov dword fs:[0], esp
sub esp, 0x7f4
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp eax, 1
jne 0x100186b8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x100
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [ebp - 0x400]
mov ecx, 6
mov esi, str._t2embed.dll
lea edi, [edi + eax*2]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x400]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1008567c], eax
test eax, eax
jne 0x100182fc
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push str.Failed_to_load_DLL__path_was:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x800]
push 0
push str.DLL_Failed_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
push dword [esi + 0x10074440]
push eax
call edi
mov dword [esi + 0x100856a8], eax
add esi, 4
cmp esi, 0x64
jge 0x10018322
mov eax, dword [0x1008567c]
jmp 0x10018304
jmp 0x10018339
jmp fcn.102bf26c
test eax, eax
jne 0x100186c8
push dword [0x1008567c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001aa20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [0x100ba184]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100ba190]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100ba17c]
lea ebx, [ebx]
cmp edi, edx
jne 0x1001aa88
mov ecx, edx
jmp 0x1001aa8d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1001aaa5
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1001aa9c
mov eax, dword [eax]
jmp 0x1001aa80
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
jne 0x1001aaa5
mov edx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8

Function at 0x1001c6b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1005f928
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1001c7ee
cmp byte [edi + 0x3d], 0
je 0x1001c7ee
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x1001c708
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.1001c300
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp ecx, 0x10
jae 0x1001c76a
lea ebx, [ebp - 0x28]
mov esi, ebx
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push esi
lea eax, [edi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1001c76f
sub eax, 1
je 0x1001c773
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x1001c7c7
xor bl, bl
jmp 0x1001c7c9
mov esi, dword [ebp - 0x28]
jmp 0x1001c73d
mov byte [edi + 0x3d], 0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jae 0x1001c781
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x1001c7a9
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jae 0x1001c793
lea eax, [ebp - 0x28]
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.10034781
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x1001c766
cmp byte [edi + 0x3d], 0
je 0x1001c7c7
test esi, esi
jne 0x1001c730
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1001c3d0
jmp 0x1001c72d
mov bl, 1
cmp ecx, 0x10
jb 0x1001c7db
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10006e40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ca60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f646
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 8
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100220b1
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1002443d
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push 0
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.1001c810
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001cca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005fe4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100220b1
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1002443d
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10021a10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [0x100ba224]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100ba230]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100ba21c]
lea ebx, [ebx]
cmp edi, edx
jne 0x10021a78
mov ecx, edx
jmp 0x10021a7d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10021a95
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x10021a8c
mov eax, dword [eax]
jmp 0x10021a70
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
jne 0x10021a95
mov edx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8