joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0c36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
dec edx
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
loopne 0x4d0ca0
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004d0815
stosb byte es:[edi], al
sti
invalid
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.004d07ca
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004d0805
sti
invalid
push eax

Function at 0x4efc4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4efc67
mov edi, dword [esi + 0xc]
jmp 0x4efca7
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4efc80
call fcn.0042387f
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4efc95
call fcn.0042387f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4efca7
call fcn.0042387f
call fcn.00420b06
cmp dword [eax + 0x3c], 0
je 0x4efcbc
push edi
mov ecx, ebx
call fcn.004eea81
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004efb69
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4efcda
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4efce6
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x50bbf7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5896f0]
jne 0x50bc01
repz ret
jmp fcn.00513ae3
Function at 0x10004d80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x101016e0]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 8], eax
mov esi, ecx
mov ax, word [0x101016e4]
push 3
movups xmmword [ebp - 0x30], xmm0
push 0
movups xmm0, xmmword [0x101016c8]
mov word [ebp - 4], ax
mov eax, 0x30
push 0
mov word [ebp - 6], ax
lea eax, [ebp - 0x30]
movups xmmword [ebp - 0x20], xmm0
push 0xc0000000
movq xmm0, qword [0x101016d8]
push eax
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10004e46
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x10004e0f
mov ax, word [ebp - 6]
cmp ax, 0x39
jae 0x10004e52
inc ax
mov word [ebp - 6], ax
jmp 0x10004e25
cmp eax, 0xe7
jne 0x10004e52
push 0x2710
lea eax, [ebp - 0x30]
push eax
call ebx
test eax, eax
je 0x10004e52
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10004df6
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100052b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa90
lea eax, [ebp - 0x88]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x20
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push 0xfde9
call esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10005314
push str.Error_opening_Steam_key_n
jmp 0x100053b9
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100053b4
mov ecx, dword [ebp - 8]
cmp ecx, 1
jb 0x100053b4
shr ecx, 1
mov eax, esi
je 0x10005378
lea edx, [esi + 0x5c]
nop dword [eax + eax]
cmp word [ebp + eax*2 - 0x290], 0x2f
jne 0x10005373
mov word [ebp + eax*2 - 0x290], dx
inc eax
cmp eax, ecx
jb 0x10005360
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x290]
push eax
push str.__s__steam:__rungameid__s
lea eax, [ebp - 0xa90]
push 0x800
push eax
call fcn.100051d0
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.10004f50
add esp, 0x1c
pop esi
mov esp, ebp
pop ebp
ret
push str.Error_reading_SteamExe_key_n
push 2
call fcn.100d40b8
add esp, 4
push eax
call fcn.100053f0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100069f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x1016fa8f
push 0x64
call fcn.100ce820
mov esi, eax
add esp, 8
test esi, esi
je 0x10006b60
push 0x63
lea ecx, [esi + 1]
push 0
push ecx
call fcn.100d07e0
lea eax, [esi + 4]
mov byte [esi], 1
push 2
push eax
call fcn.100ccedf
lea eax, [esi + 0x34]
push eax
call fcn.100cd0dc
xorps xmm0, xmm0
mov dword [0x101fc06c], esi
add esp, 0x18
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x10006a6e
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10006a63
cmp byte [eax], 0
je 0x10006a63
push eax
push esi
call fcn.100052b0
jmp 0x10006a6b
push 0
push esi
call fcn.10005240
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x101d6970
mov dword [0x101fc068], eax
call fcn.100ccefb
add esp, 4
test eax, eax
jne 0x10006b6f
cmp dword [0x101d699c], 0x7fffffff
je 0x10006b76
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10006ab5
movups xmm0, xmmword [eax]
movups xmmword [0x101f7a18], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x10006abf
xorps xmm0, xmm0
movups xmmword [0x101f7a18], xmm0
movq qword [0x101f7a28], xmm0
xorps xmm0, xmm0
push 0x101d6970
movups xmmword [0x101f7a30], xmm0
movq qword [0x101f7a40], xmm0
call fcn.100ccf41
add esp, 4
cmp dword [0x101f7a14], 0
jne 0x10006b6a
push esi
call fcn.10007db0
mov dword [0x101f7a14], eax
mov dword [eax + 8], 0x10005420
mov eax, dword [0x101f7a14]
mov dword [eax + 0xc], 0x10005430
mov al, 1
mov esi, dword [0x101fc06c]
xchg byte [esi], al
push 4
call fcn.100ce3c5
add esp, 8
test eax, eax
je 0x10006b29
mov dword [eax], esi
jmp 0x10006b2b
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10005480
push 0
push 0
call fcn.100d8e8d
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x10006b8c
cmp dword [esi + 0x60], 0
jne 0x10006b87
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x101fc06c], 0
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.100cd25b
push 6
mov dword [0x101d699c], 0x7ffffffe
call fcn.100cd25b
call fcn.100d8c8d
push 6
mov dword [ebp - 4], 0
call fcn.100cd25b
int3
Function at 0x1000f430
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push dword [0x101d6530]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1000f515
cmp byte [0x101d6462], al
je 0x1000f515
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f515
call fcn.10076c70
test al, al
je 0x1000f515
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10077420
cmp eax, 9
je 0x1000f515
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10077420
cmp eax, 8
je 0x1000f515
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10010cf0
test dword [eax], 0x400
jne 0x1000f515
cmp byte [0x1020c2a5], 0
jne 0x1000f4cc
cmp byte [0x1020c2a6], 0
je 0x1000f4cc
mov eax, dword [ebp + 8]
mov byte [0x1020c2a6], 0
or dword [eax + 0x30], 2
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
test byte [esi + 0x30], 2
je 0x1000f506
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10010cf0
test byte [eax], 1
je 0x1000f4f8
mov al, 1
mov byte [0x1020c2a6], 1
mov byte [0x1020c2a5], al
pop esi
pop ebp
ret
and dword [esi + 0x30], 0xfffffffd
xor al, al
mov byte [0x1020c2a5], al
pop esi
pop ebp
ret
mov byte [0x1020c2a5], 0
mov byte [0x1020c2a6], 0
pop esi
pop ebp
ret
Function at 0x1000f520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101d639c]
sub esp, 0x14
mov ecx, dword [eax]
call fcn.10077420
cmp eax, 9
je 0x1000f701
cmp eax, 8
je 0x1000f701
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10010cf0
mov eax, dword [eax]
mov dword [0x1020c294], eax
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10010e80
push dword [0x101d6520]
movss xmm0, dword [eax + 8]
movss dword [0x1020c298], xmm0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000f619
cmp byte [0x1020c28e], 0
je 0x1000f619
mov eax, dword [0x1020c2a0]
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x30], eax
cmp byte [0x1020c28d], 0
je 0x1000f618
movss xmm1, dword [0x1020c258]
lea eax, [edi + 0x10]
addss xmm1, dword [0x1020c264]
movss xmm2, dword [0x1020c25c]
lea ecx, [edi + 0xc]
movss xmm0, dword [0x1020c254]
addss xmm2, dword [0x1020c268]
addss xmm0, dword [0x1020c260]
movss dword [eax], xmm1
lea eax, [edi + 0x14]
push esi
movss dword [eax], xmm2
lea eax, [ebp - 0x14]
push eax
movss dword [edi + 0xc], xmm0
call fcn.1000f240
mov eax, dword [edi + 0xc]
mov dword [edi + 0xc], eax
movss xmm0, dword [0x101883d4]
movss dword [edi + 0x28], xmm0
movss xmm0, dword [0x101883d8]
movss dword [edi + 0x24], xmm0
pop esi
pop edi
mov ecx, dword [0x1020c1c4]
push str.sv_gravity
mov eax, dword [ecx]
mov eax, dword [eax + 0x44]
call eax
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x30]
call eax
fmul dword [0x101016a8]
mov eax, dword [0x101d6398]
mov ecx, dword [0x10216320]
fstp dword [ebp - 4]
movss xmm0, dword [ebp - 4]
mulss xmm0, dword [eax + 0x20]
mov eax, dword fs:[0x2c]
movss dword [0x1020c29c], xmm0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1020c2dc]
cmp eax, dword [ecx + 4]
jg 0x1000f705
movss xmm0, dword [0x1020c29c]
xorps xmm0, xmmword [0x101029a0]
comiss xmm0, dword [0x1020c2d8]
jbe 0x1000f6ea
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10010e80
push ecx
fld dword [eax + 8]
fstp dword [esp]
call fcn.100da808
fstp dword [ebp - 8]
fld dword [0x1020c29c]
fstp dword [esp]
call fcn.100da808
movss xmm0, dword [ebp - 8]
add esp, 4
fstp dword [ebp - 4]
movss xmm1, dword [ebp - 4]
xorps xmm1, xmmword [0x101029a0]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1000f6ea
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10077420
cmp eax, 9
je 0x1000f6ea
mov al, 1
jmp 0x1000f6ec
xor al, al
movss xmm0, dword [0x1020c298]
mov byte [0x1020c28e], al
movss dword [0x1020c2d8], xmm0
mov esp, ebp
pop ebp
ret
push 0x1020c2dc
call fcn.100ce799
add esp, 4
cmp dword [0x1020c2dc], 0xffffffff
jne 0x1000f674
movss xmm0, dword [0x1020c298]
push 0x1020c2dc
movss dword [0x1020c2d8], xmm0
call fcn.100ce748
add esp, 4
jmp 0x1000f674
Function at 0x1000f760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push dword [0x101d6820]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000f810
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f810
call fcn.10077420
cmp eax, 9
je 0x1000f810
cmp eax, 8
je 0x1000f810
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10010cf0
test byte [eax], 1
mov eax, dword [0x101d6398]
je 0x1000f7c7
cmp byte [0x1020c2e4], 0
jne 0x1000f7c7
mov ecx, dword [eax + 0x1c]
mov dword [0x1020c2e8], ecx
mov byte [0x1020c2e4], 1
jmp 0x1000f7cd
mov ecx, dword [0x1020c2e8]
mov eax, dword [eax + 0x1c]
sub eax, ecx
cmp eax, dword [0x101d68d4]
jle 0x1000f809
mov eax, dword [0x101d639c]
mov byte [0x1020c2e4], 0
mov byte [0x1020c28f], 1
mov ecx, dword [eax]
call fcn.10010cf0
test byte [eax], 1
je 0x1000f810
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
mov byte [0x1020c2e4], 0
pop ebp
ret
mov byte [0x1020c28f], 0
pop ebp
ret
Function at 0x10010c10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101d64d5], 0
push esi
mov esi, dword [ebp + 8]
je 0x10010ce1
push dword [0x101d6504]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10010ce1
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
test ecx, ecx
je 0x10010ce1
call fcn.10076c70
test al, al
je 0x10010ce1
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10077420
cmp eax, 9
je 0x10010ce1
cmp eax, 8
je 0x10010ce1
test byte [ebp + 0xc], 1
je 0x10010ca0
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10010cf0
test byte [eax], 1
jne 0x10010ca0
or dword [esi + 0x30], 2
mov eax, dword [0x101d6398]
mov byte [0x1020c291], 1
mov ecx, dword [eax + 0x1c]
add ecx, 2
mov dword [0x1020c2ec], ecx
jmp 0x10010cb4
cmp byte [0x1020c291], 0
je 0x10010ce1
mov ecx, dword [0x1020c2ec]
mov eax, dword [0x101d6398]
cmp dword [eax + 0x1c], ecx
jge 0x10010cd8
mov byte [0x1020c291], 1
or dword [esi + 0x30], 4
mov eax, dword [esi + 0x30]
and eax, 0xfffffff7
and eax, 0xffffffef
mov dword [esi + 0x30], eax
mov eax, dword [0x101d6398]
cmp dword [eax + 0x1c], ecx
jle 0x10010ce1
mov byte [0x1020c291], 0
pop esi
pop ebp
ret

Function at 0x10011020
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101d680d], 0
je 0x100110a1
push dword [0x101d6808]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100110a1
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
test ecx, ecx
je 0x100110a1
call fcn.10076c70
test al, al
je 0x100110a1
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10077420
cmp eax, 9
je 0x100110a1
cmp eax, 8
je 0x100110a1
test byte [0x1020c294], 1
mov byte [0x1020c290], 0
je 0x100110a1
mov eax, dword [0x101d639c]
mov ecx, dword [eax]
call fcn.10010cf0
test byte [eax], 1
jne 0x100110a1
mov ecx, dword [ebp + 8]
mov byte [0x1020c290], 1
or dword [ecx + 0x30], 2
mov byte [0x1020c290], 1
or dword [ecx + 0x30], 4
pop ebp
ret
Function at 0x10019380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x10103a24
push dword [ebp + 8]
lea eax, [ebp + 8]
mov edi, ecx
push eax
call fcn.100db7c5
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x1001947c
push 2
push 0
push eax
call fcn.100dbf98
push dword [ebp + 8]
call fcn.100dc6bc
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
je 0x1001947c
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, 2
je 0x100193d7
cmp esi, 1
jne 0x100193dc
mov ebx, 2
test esi, esi
jne 0x100193e5
lea ebx, [esi + 1]
jmp 0x100193f4
cmp esi, 4
je 0x100193ef
cmp esi, 3
jne 0x100193f4
mov ebx, 4
add eax, ebx
push eax
call fcn.100ced4a
push 0
push 0
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.100dbf98
push dword [ebp + 8]
push dword [ebp - 4]
push 1
push dword [ebp + 0xc]
call fcn.100dbb3a
mov ecx, dword [ebp - 4]
add esp, 0x20
cmp eax, ecx
jne 0x1001947c
test ebx, ebx
je 0x1001943d
push ebx
mov ebx, dword [ebp + 0xc]
push 0
lea eax, [ebx + ecx]
push eax
call fcn.100d07e0
add esp, 0xc
jmp 0x10019440
mov ebx, dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100db931
add esp, 4
mov ecx, edi
push esi
push ebx
call fcn.10017020
push ebx
call fcn.100ced53
mov eax, dword [edi + 0x28]
add esp, 4
mov ecx, dword [eax]
test ecx, ecx
je 0x10019475
cmp ecx, 0x20
jne 0x10019487
mov ecx, dword [eax + 4]
add eax, 4
test ecx, ecx
jne 0x10019466
mov dword [edi + 0x2c], 0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x2c], eax
test eax, eax
je 0x1001947c
push 0x20
call fcn.100ce3c5
mov ecx, eax
add esp, 4
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x100194e4
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov dword [ecx + 4], 1
mov dword [ecx + 8], 1
mov dword [ecx], vtable.std::_Ref_count_obj2_class_valve_parser::node_.0
mov dword [ecx + 0xc], vtable.valve_parser::node.0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x10], edi
jmp 0x100194e6
xor ecx, ecx
mov esi, dword [edi + 0x34]
lea eax, [ecx + 0xc]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
test esi, esi
je 0x10019517
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x10019517
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10019517
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [edi + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001f4b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fdfcf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100cd2c3
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x1001f53b
push eax
push esi
call fcn.100cd608
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.100ccd3f
int3
Function at 0x10026e10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100fe3bd
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100ce3c5
mov edi, eax
add esp, 4
test edi, edi
je 0x10026ea2
push 1
mov dword [ebp - 4], 0
call fcn.100cd50a
add esp, 4
mov dword [edi + 4], eax
jmp 0x10026ea4
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
push ebx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.1001f0b0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x10026f00
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10026f00
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
pop ebx
jne 0x10026f1d
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10026f3e
cmp byte [ebp + 0xc], 0
je 0x10026f2c
push esi
call fcn.100cd9a0
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10026f4a
mov esi, str.ios_base::badbit_set
jmp 0x10026f5a
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10027630
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.1001f770
push 0x10182968
lea eax, [ebp - 0x28]
push eax
call fcn.100cfc7c
int3
Function at 0x10035ed0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [0x10214570]
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [esi + 0x1994]
test cl, 0x10
jne 0x1003600c
mov ebx, dword [edi + 0x114]
lea eax, [esi + 0x19b4]
test ebx, ebx
je 0x10035f13
cmp dword [eax], ebx
jne 0x10036003
cmp byte [esi + 0xf0], 0
je 0x10036003
test ebx, ebx
jne 0x10035fbc
test cl, 8
je 0x10036003
mov cl, byte [edi + 0x118]
and cl, 1
mov byte [ebp - 1], cl
jne 0x10035f6b
cmp dword [eax], ebx
je 0x10036003
cmp dword [esi + 0x19dc], edi
jne 0x10036003
lea eax, [edi + 0x11c]
mov ecx, edi
push eax
call fcn.10039ad0
mov ebx, eax
mov dword [edi + 0x114], ebx
jmp 0x10035fa3
lea eax, [edi + 0x11c]
mov ecx, edi
push eax
call fcn.10039ad0
mov ebx, eax
push ebx
mov dword [edi + 0x114], ebx
call fcn.10041f70
add esp, 4
cmp byte [esi + 0x3d8], 0
je 0x10035fa3
push edi
push ebx
call fcn.100419e0
push edi
call fcn.100390e0
add esp, 0xc
cmp dword [esi + 0x19b4], ebx
lea eax, [esi + 0x19b4]
jne 0x10036003
mov cl, byte [ebp - 1]
mov byte [esi + 0x19c5], cl
jmp 0x10035fc3
mov byte [esi + 0x19c5], 0
cmp dword [eax], ebx
jne 0x10036003
mov ecx, dword [edi + 0x1c8]
mov eax, dword [edi + 0x1d0]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 8], eax
mov eax, dword [0x10214570]
cmp byte [eax + 0xf0], 0
je 0x10036003
movss xmm1, dword [eax + 0x38]
movss xmm0, dword [eax + 0x43c]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
test al, al
jne 0x1003604c
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
or ebx, 0xffffffff
mov edx, 0x10105381
mov al, 0x23
or esi, 0xffffffff
nop dword [eax + eax]
cmp al, 0x23
jne 0x1003602e
cmp byte [edx], al
jne 0x1003602e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10104d78]
test al, al
jne 0x10036020
mov esi, dword [ebp - 0xc]
not ebx
cmp byte [esi + 0x1c70], 0
jne 0x10036085
call fcn.10036fe0
mov eax, dword [ebp - 8]
mov dword [esi + 0x1c88], ebx
mov ebx, dword [ebp + 8]
mov dword [esi + 0x1c8c], eax
mov byte [esi + 0x1c70], 1
mov dword [esi + 0x1c74], ebx
mov dword [esi + 0x1c7c], 0
jmp 0x10036088
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 0x1948]
mov dword [esi + 0x1c78], eax
mov byte [esi + 0x1c71], 1
test bl, 1
jne 0x100360d1
call fcn.10036470
cmp dword [esi + 0x1cd8], 0
je 0x100360d1
test dword [esi + 0x1ccc], 0x1000
je 0x100360d1
mov eax, dword [esi + 0x1994]
mov byte [eax + 0x87], 1
mov dword [eax + 0xac], 1
test bl, 0x12
jne 0x100360dd
and dword [edi + 0x118], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret