joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006c9f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1006ca17
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x1006ca5f
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x20], ebx
jmp 0x1006ca63
mov ebp, dword [esp + 0x1c]
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1006cac5
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x1006ca84
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x1006caf7
nop word [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x10154a16
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x10154a17
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x1006cad0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x1006e6c9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1006e6f0
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1006e6f3
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1006e6a5
pop esi
leave
ret 8
Function at 0x100c4ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 1
push eax
push 0xf003f
push 0
push str.Software_shark
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c4d1f
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x100c4d1f
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100c7f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10146a71
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov ecx, dword [0x101e66f0]
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x138]
call eax
mov edi, eax
test edi, edi
je 0x100c8095
mov ecx, dword fs:[0x2c]
mov edx, dword [0x101e66ac]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x101eef00]
cmp ecx, dword [edx + 4]
jg 0x100c80a8
mov eax, dword [0x101e671c]
mov dword [ebp - 0x10], eax
mov eax, dword [0x101e6748]
push esi
test eax, eax
jne 0x100c7f96
mov edx, 0xe80c2f78
mov ecx, 0x10170e3d
call fcn.100074c0
mov edx, 0xc10bf213
mov ecx, 0x101708a1
mov esi, eax
call fcn.100074c0
push esi
push eax
call fcn.100fc160
mov dword [0x101e6748], eax
mov esi, dword [ebp - 0x10]
mov ecx, dword [0x101ee7c4]
mov esi, dword [esi + eax]
mov eax, dword [ecx]
inc esi
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [edi]
mov ecx, dword [0x101ee7c4]
fstp dword [ebp - 0x1c]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [0x101e66e8]
movss xmm0, dword [eax + 0x20]
mov eax, dword [ecx]
movss dword [ebp - 0x18], xmm0
mov eax, dword [eax + 0x1c]
call eax
fstp dword [ebp - 0x14]
push 0
mov ecx, edi
call dword [ebp - 0x10]
fadd dword [ebp - 0x14]
sub esp, 8
fstp dword [ebp - 0x14]
movss xmm0, dword [ebp - 0x14]
mov dword [esp + 4], 0x3e4ccccd
movss dword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fminf]
movss xmm3, dword [ebp + 8]
add esp, 8
movaps xmm0, xmm3
movss xmm4, dword [0x1017f094]
divss xmm0, dword [ebp - 0x18]
movss xmm2, dword [0x1017f064]
addss xmm0, xmm4
cvttss2si eax, xmm0
sub esi, eax
movd xmm0, esi
cvtdq2ps xmm0, xmm0
pop esi
mulss xmm0, dword [ebp - 0x18]
movss dword [ebp + 8], xmm0
fsub dword [ebp + 8]
fstp dword [ebp + 8]
movss xmm0, dword [ebp + 8]
andps xmm0, xmmword [0x1017f970]
comiss xmm0, xmm2
ja 0x100c8095
mov eax, dword [0x101e66e8]
pop edi
movd xmm0, dword [eax + 0x1c]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [eax + 0x20]
subss xmm0, xmm2
cvttss2si ecx, xmm0
movss xmm0, dword [ebp - 0x1c]
addss xmm0, xmm3
divss xmm0, dword [eax + 0x20]
addss xmm0, xmm4
cvttss2si eax, xmm0
cmp eax, ecx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0x101eef00
call fcn.1006d07f
add esp, 4
cmp dword [0x101eef00], 0xffffffff
jne 0x100c7f58
mov dword [ebp - 4], 0
mov ecx, dword [0x101e674c]
mov dword [ebp - 0x28], 0xe9dbf2f7
mov dword [ebp - 0x24], 0xeaf1fce5
mov dword [ebp - 0x20], 0x84e3e5e8
mov eax, dword [ecx]
mov edx, dword [eax + 0x44]
xor eax, eax
jmp 0x100c80f0
xor byte [ebp + eax - 0x28], 0x84
inc eax
cmp eax, 0xc
jb 0x100c80f0
lea eax, [ebp - 0x28]
push eax
call edx
push 0x101eef00
mov dword [ebp - 4], 0xffffffff
call fcn.1006d02e
add esp, 4
jmp 0x100c7f58
Function at 0x100cba60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [0x101e6788]
mov ecx, 0x96
mov dword [ebp - 0xc], edx
push edi
mov eax, dword [esi + 4]
inc eax
cdq
idiv ecx
mov eax, dword [0x101edde8]
imul ebx, edx, 0x64
add ebx, dword [eax + 0xf0]
mov eax, dword [0x101e6760]
mov dword [ebp - 0x10], ebx
mov eax, dword [eax + 0x9c]
mov dword [ebp - 0x1c], eax
je 0x100cbb94
test eax, eax
je 0x100cbb94
mov ecx, 0x19
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
inc dword [ebx + 4]
mov ecx, ebx
and dword [ebx + 0x30], 0xfffff7fe
call fcn.100d0930
xor edx, edx
mov dword [ebp - 8], edx
cmp dword [ebp - 0xc], edx
jle 0x100cbb94
mov ecx, dword [0x101e66ac]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x18], eax
mov ebx, dword [ebx + 4]
mov eax, 0x1b4e81b5
add ebx, edx
mov esi, dword [ebp - 0x10]
imul ebx
mov ecx, ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x96
sub ecx, eax
mov eax, dword [0x101edde8]
imul edx, ecx, 0x64
imul ecx, ecx, 0x68
add edx, dword [eax + 0xf0]
add ecx, dword [eax + 0xf4]
mov edi, edx
mov dword [ebp - 0x14], ecx
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
cmp dword [edx + 8], 0x7fffffff
mov ecx, 0x19
mov dword [edx + 4], ebx
mov esi, edx
mov ebx, dword [ebp - 0x14]
sete al
mov byte [edx + 0x48], al
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x18]
mov eax, dword [0x101ede04]
mov dword [ebp - 4], edx
cmp eax, dword [ecx + 4]
jg 0x100cbb9b
jmp 0x100cbb61
mov edx, dword [ebp - 4]
mov eax, dword [0x101e678c]
mov ecx, edx
call eax
mov edx, dword [ebp - 8]
mov dword [ebx + 0x64], eax
inc edx
mov eax, dword [0x101e6760]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
inc dword [eax + 0x4d30]
mov eax, dword [ebp - 0x1c]
inc dword [eax + 0x2c]
inc dword [eax + 0x18]
cmp edx, dword [ebp - 0xc]
jl 0x100cbae5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x101ede04
call fcn.1006d07f
add esp, 4
cmp dword [0x101ede04], 0xffffffff
jne 0x100cbb5e
mov dword [ebp - 0x27], 0xe1ede8e7
xor eax, eax
mov dword [ebp - 0x23], 0xe0aaf0ea
mov word [ebp - 0x1f], 0xe8e8
mov byte [ebp - 0x1d], 0x84
jmp 0x100cbbd0
xor byte [ebp + eax - 0x27], 0x84
inc eax
cmp eax, 0xb
jb 0x100cbbd0
mov edx, str.53_8B_D9_83_C8
lea ecx, [ebp - 0x27]
call fcn.100c53f0
push 0x101ede04
mov dword [0x101e678c], eax
call fcn.1006d02e
add esp, 4
jmp 0x100cbb5e
Function at 0x100ce4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x34
mov ecx, dword [0x101e66ac]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101eef20]
cmp eax, dword [ecx + 4]
jg 0x100ce547
movq xmm0, qword [ebp + 0x14]
sub esp, 0xc
mov eax, dword [ebp + 0x1c]
mov ecx, esp
sub esp, 0xc
movq qword [ecx], xmm0
movq xmm0, qword [ebp + 8]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [ebp + 0x10]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
call dword [0x101eef0c]
add esp, 0x18
mov esp, ebp
pop ebp
ret
push 0x101eef20
call fcn.1006d07f
add esp, 4
cmp dword [0x101eef20], 0xffffffff
jne 0x100ce512
movaps xmm0, xmmword [0x1017fba0]
xor eax, eax
movaps xmm2, xmmword [0x1017f9b0]
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x14], 0xb1a4c2b4
movaps xmm0, xmmword [0x1017fa80]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x10], 0xb4c7a4b3
mov byte [ebp - 0xc], 0x84
jmp 0x100ce590
movups xmm0, xmmword [ebp + eax - 0x34]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x34], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100ce590
cmp eax, 0x29
jae 0x100ce5bd
jmp 0x100ce5b0
xor byte [ebp + eax - 0x34], 0x84
inc eax
cmp eax, 0x29
jb 0x100ce5b0
jmp 0x100ce5bd
mov dword [ebp - 0xb], 0xe1ede8e7
xor eax, eax
mov dword [ebp - 7], 0xe0aaf0ea
mov word [ebp - 3], 0xe8e8
mov byte [ebp - 1], 0x84
jmp 0x100ce5e0
xor byte [ebp + eax - 0xb], 0x84
inc eax
cmp eax, 0xb
jb 0x100ce5e0
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0xb]
call fcn.100c53f0
push 0x101eef20
mov dword [0x101eef0c], eax
call fcn.1006d02e
add esp, 4
jmp 0x100ce512
Function at 0x100d1820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x101edea4], 0
push esi
mov esi, dword [0x101e66ac]
push edi
mov edi, dword fs:[0x2c]
jne 0x100d1870
mov ecx, dword [edi + esi*4]
mov eax, dword [0x101eef74]
cmp eax, dword [ecx + 4]
jg 0x100d189b
mov eax, dword [0x101eef60]
test eax, eax
je 0x100d185f
mov eax, dword [eax + 1]
mov dword [0x101edea4], eax
cmp dword [0x101edea4], 0
jne 0x100d1870
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + esi*4]
mov eax, dword [0x101eef50]
cmp eax, dword [ecx + 4]
jg 0x100d195d
mov ecx, dword [0x101edea4]
push str.CCSGO_HudDeathNotice
call dword [0x101eef68]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x101eef74
call fcn.1006d07f
add esp, 4
cmp dword [0x101eef74], 0xffffffff
jne 0x100d184e
movaps xmm0, xmmword [0x1017fd60]
xor eax, eax
movaps xmm2, xmmword [0x1017f9b0]
movups xmmword [ebp - 0x32], xmm0
mov dword [ebp - 0x12], 0xa4c0b1a4
movaps xmm0, xmmword [0x1017fe10]
movups xmmword [ebp - 0x22], xmm0
mov word [ebp - 0xe], 0xbcb4
mov byte [ebp - 0xc], 0x84
jmp 0x100d18e3
movups xmm0, xmmword [ebp + eax - 0x32]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x32], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100d18e3
cmp eax, 0x27
jae 0x100d190f
jmp 0x100d1902
xor byte [ebp + eax - 0x32], 0x84
inc eax
cmp eax, 0x27
jb 0x100d1902
jmp 0x100d190f
mov dword [ebp - 0xb], 0xe1ede8e7
xor eax, eax
mov dword [ebp - 7], 0xe0aaf0ea
mov word [ebp - 3], 0xe8e8
mov byte [ebp - 1], 0x84
jmp 0x100d1930
xor byte [ebp + eax - 0xb], 0x84
inc eax
cmp eax, 0xb
jb 0x100d1930
lea edx, [ebp - 0x32]
lea ecx, [ebp - 0xb]
call fcn.100c53f0
push 0x101eef74
mov dword [0x101eef60], eax
call fcn.1006d02e
add esp, 4
jmp 0x100d184e
push 0x101eef50
call fcn.1006d07f
add esp, 4
cmp dword [0x101eef50], 0xffffffff
jne 0x100d1884
movaps xmm0, xmmword [0x1017fb30]
xor eax, eax
movaps xmm2, xmmword [0x1017f9b0]
movups xmmword [ebp - 0x3b], xmm0
movaps xmm0, xmmword [0x1017fd30]
movups xmmword [ebp - 0x2b], xmm0
movaps xmm0, xmmword [0x1017f9e0]
movups xmmword [ebp - 0x1b], xmm0
jmp 0x100d19a3
movups xmm0, xmmword [ebp + eax - 0x3b]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x3b], xmm1
add eax, 0x10
cmp eax, 0x30
jb 0x100d19a3
mov dword [ebp - 0xb], 0xe1ede8e7
xor eax, eax
mov dword [ebp - 7], 0xe0aaf0ea
mov word [ebp - 3], 0xe8e8
mov byte [ebp - 1], 0x84
jmp 0x100d19d7
xor byte [ebp + eax - 0xb], 0x84
inc eax
cmp eax, 0xb
jb 0x100d19d7
lea edx, [ebp - 0x3b]
lea ecx, [ebp - 0xb]
call fcn.100c53f0
push 0x101eef50
mov dword [0x101eef68], eax
call fcn.1006d02e
add esp, 4
jmp 0x100d1884
Function at 0x100d2460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x101e66f0]
sub esp, 0x30
mov eax, dword [ecx]
push esi
push edi
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100d2572
mov ecx, dword [0x101e66f0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100d2572
mov edi, dword [0x101e671c]
test edi, edi
je 0x100d2568
mov eax, dword [0x101e6718]
test eax, eax
jne 0x100d24d5
mov edx, 0xe80c2f78
mov ecx, 0x10170905
call fcn.100074c0
mov edx, 0xc10bf213
mov ecx, 0x101708a1
mov esi, eax
call fcn.100074c0
push esi
push eax
call fcn.100fc160
mov dword [0x101e6718], eax
cmp dword [eax + edi], 0
jle 0x100d2568
mov edx, dword [0x101ede94]
test edx, edx
jne 0x100d24ff
mov ecx, str.CCSGO_HudDeathNotice
call fcn.100d1820
mov edx, eax
mov dword [0x101ede94], edx
test edx, edx
je 0x100d2572
lea eax, [edx + 0x50]
test eax, eax
je 0x100d2525
cmp byte [0x101e9998], 0
je 0x100d2519
movss xmm0, dword [0x1017f334]
jmp 0x100d2521
movss xmm0, dword [0x1017f108]
movss dword [eax], xmm0
cmp byte [0x101edea0], 0
je 0x100d2572
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101e66ac]
mov byte [0x101edea0], 0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101eef58]
cmp eax, dword [ecx + 4]
jg 0x100d2578
jmp 0x100d2559
mov edx, dword [0x101ede94]
lea ecx, [edx - 0x14]
call dword [0x101eef64]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x101ede94], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x101eef58
call fcn.1006d07f
add esp, 4
cmp dword [0x101eef58], 0xffffffff
jne 0x100d2553
movaps xmm0, xmmword [0x1017fba0]
xor eax, eax
movaps xmm2, xmmword [0x1017f9b0]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0xc], 0x84
movaps xmm0, xmmword [0x1017fcd0]
movups xmmword [ebp - 0x1c], xmm0
jmp 0x100d25b3
movups xmm0, xmmword [ebp + eax - 0x2c]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x2c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100d25b3
cmp eax, 0x21
jae 0x100d25df
jmp 0x100d25d2
xor byte [ebp + eax - 0x2c], 0x84
inc eax
cmp eax, 0x21
jb 0x100d25d2
jmp 0x100d25df
mov dword [ebp - 0xb], 0xe1ede8e7
xor eax, eax
mov dword [ebp - 7], 0xe0aaf0ea
mov word [ebp - 3], 0xe8e8
mov byte [ebp - 1], 0x84
jmp 0x100d2600
xor byte [ebp + eax - 0xb], 0x84
inc eax
cmp eax, 0xb
jb 0x100d2600
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xb]
call fcn.100c53f0
push 0x101eef58
mov dword [0x101eef64], eax
call fcn.1006d02e
add esp, 4
jmp 0x100d2553
Function at 0x100d7680
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10146e32
push eax
mov dword fs:[0], esp
mov eax, dword [0x101ee810]
push ebx
sub esp, 0x18
mov ecx, dword [eax + 0xc]
push esi
push edi
mov edi, dword [0x101ee80c]
cmp ecx, dword [eax + 0x10]
je 0x100d76c7
mov dword [eax + 0x10], ecx
cmp dword [0x101e6780], 0
je 0x100d7762
mov ecx, edi
call fcn.100d2630
cmp byte [edi + 0xc], 0
je 0x100d775f
cmp byte [0x101e676c], 0
jne 0x100d775f
mov eax, dword [0x101e671c]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100d775f
mov eax, dword [0x101e6718]
test eax, eax
jne 0x100d772b
mov edx, 0xe80c2f78
mov ecx, 0x10170905
call fcn.100074c0
mov edx, 0xc10bf213
mov ecx, 0x101708a1
mov esi, eax
call fcn.100074c0
push esi
push eax
call fcn.100fc160
mov dword [0x101e6718], eax
mov ecx, dword [ebp - 0x14]
cmp dword [eax + ecx], 0
jle 0x100d775f
mov eax, dword [0x101e66e8]
movss xmm0, dword [eax + 0x10]
call fcn.100d78b0
test al, al
jne 0x100d7775
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
lea ecx, [edi + 0x18]
call fcn.1000b6f0
cmp byte [eax], 0
jne 0x100d7762
mov byte [edi], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100d6ac0
mov ecx, edi
call fcn.100d5fa0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101e66ac]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101eef84]
cmp eax, dword [ecx + 4]
jg 0x100d7829
mov ecx, dword [0x101eef8c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
fstp dword [ebp - 0x14]
movss xmm0, dword [ebp - 0x14]
comiss xmm0, dword [0x1017efe0]
jbe 0x100d7762
call fcn.1000ac60
mov ecx, dword [0x101eef8c]
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x14], edx
call dword [ebp - 0x14]
mov eax, dword [0x101e6788]
fstp dword [ebp - 0x14]
movss xmm1, dword [ebp - 0x14]
mulss xmm1, dword [esi]
mov ecx, dword [ebp - 0xc]
movss xmm0, dword [eax + 0xc]
pop edi
subss xmm0, xmm1
pop esi
movss dword [eax + 0xc], xmm0
movss xmm0, dword [eax + 0x10]
subss xmm0, xmm1
movss dword [eax + 0x10], xmm0
movss xmm0, dword [eax + 0x14]
subss xmm0, xmm1
movss dword [eax + 0x14], xmm0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x101eef84
call fcn.1006d07f
add esp, 4
cmp dword [0x101eef84], 0xffffffff
jne 0x100d77a1
mov dword [ebp - 4], 0
mov ecx, dword [0x101e674c]
movaps xmm0, xmmword [0x1017f9b0]
xorps xmm0, xmmword [0x1017ff60]
mov dword [ebp - 0x18], 0x84e1e8e5
mov eax, dword [ecx]
movups xmmword [ebp - 0x28], xmm0
mov edx, dword [eax + 0x44]
mov eax, 0x10
jmp 0x100d7875
xor byte [ebp + eax - 0x28], 0x84
inc eax
cmp eax, 0x14
jb 0x100d7875
lea eax, [ebp - 0x28]
push eax
call edx
push 0x101eef84
mov dword [0x101eef8c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1006d02e
add esp, 4
jmp 0x100d77a1
Function at 0x100db920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10146f59
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword fs:[0x2c]
push esi
mov esi, dword [0x101e66ac]
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + esi*4]
mov eax, dword [0x101eefc8]
cmp eax, dword [edi + 4]
jg 0x100db9cc
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push esi
call dword [0x101eefcc]
mov ecx, dword [0x101e66e4]
add esp, 8
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 0xc]
call eax
mov esi, eax
test esi, esi
jne 0x100db998
push 0x14
push str.C:UsersdavinOneDrivePulpitowned.me_csgo_cheat_mainowned.mehack_features_skinsglove.cpp
push str.glove
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [0x101eefc4]
cmp eax, dword [edi + 4]
jg 0x100dba40
push 0x101716c8
mov ecx, esi
call dword [0x101eefc0]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax]
jmp 0x100dba22
push 0x101eefc8
call fcn.1006d07f
add esp, 4
cmp dword [0x101eefc8], 0xffffffff
jne 0x100db95f
mov dword [ebp - 4], 0
mov ecx, dword [0x101edea8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov ecx, dword [0x101edea8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
test eax, eax
je 0x100dba1f
jmp 0x100dba10
cmp dword [eax + 0x14], 0x36
je 0x100db9c8
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x100dba10
jmp 0x100dba1f
mov eax, dword [ebp - 0x10]
push 0x101eefc8
mov dword [0x101eefcc], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1006d02e
add esp, 4
jmp 0x100db95f
push 0x101eefc4
call fcn.1006d07f
add esp, 4
cmp dword [0x101eefc4], 0xffffffff
jne 0x100db9a9
movaps xmm0, xmmword [0x1017fd80]
xor eax, eax
movaps xmm2, xmmword [0x1017f9b0]
movups xmmword [ebp - 0x46], xmm0
mov dword [ebp - 0x26], 0xa4b5c2a4
movaps xmm0, xmmword [0x1017fde0]
movups xmmword [ebp - 0x36], xmm0
mov word [ebp - 0x22], 0xbcc1
mov byte [ebp - 0x20], 0x84
jmp 0x100dba90
movups xmm0, xmmword [ebp + eax - 0x46]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x46], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100dba90
cmp eax, 0x27
jae 0x100dbabd
jmp 0x100dbab0
xor byte [ebp + eax - 0x46], 0x84
inc eax
cmp eax, 0x27
jb 0x100dbab0
jmp 0x100dbabd
mov dword [ebp - 0x1f], 0xe1ede8e7
xor eax, eax
mov dword [ebp - 0x1b], 0xe0aaf0ea
mov word [ebp - 0x17], 0xe8e8
mov byte [ebp - 0x15], 0x84
jmp 0x100dbae0
xor byte [ebp + eax - 0x1f], 0x84
inc eax
cmp eax, 0xb
jb 0x100dbae0
lea edx, [ebp - 0x46]
lea ecx, [ebp - 0x1f]
call fcn.100c53f0
push 0x101eefc4
mov dword [0x101eefc0], eax
call fcn.1006d02e
add esp, 4
jmp 0x100db9a9
Function at 0x100e4f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x101ef10c]
sub esp, 0x30
push esi
mov esi, ecx
test edx, edx
jne 0x100e501a
movaps xmm0, xmmword [0x1017fc10]
xor eax, eax
movaps xmm2, xmmword [0x1017f9b0]
movups xmmword [ebp - 0x2d], xmm0
mov word [ebp - 0xd], 0x84bd
movaps xmm0, xmmword [0x1017fdd0]
movups xmmword [ebp - 0x1d], xmm0
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x2d]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x2d], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100e4fb0
cmp eax, 0x22
jae 0x100e4fdb
nop dword [eax]
xor byte [ebp + eax - 0x2d], 0x84
inc eax
cmp eax, 0x22
jb 0x100e4fd0
mov dword [ebp - 0xb], 0xe1ede8e7
xor eax, eax
mov dword [ebp - 7], 0xe0aaf0ea
mov word [ebp - 3], 0xe8e8
mov byte [ebp - 1], 0x84
xor byte [ebp + eax - 0xb], 0x84
inc eax
cmp eax, 0xb
jb 0x100e4ff5
lea edx, [ebp - 0x2d]
lea ecx, [ebp - 0xb]
call fcn.100c53f0
mov edx, dword [eax + 3]
add edx, 0xb0
mov dword [0x101ef10c], edx
mov eax, dword [esi]
movss xmm1, dword [edx + 4]
mov ecx, dword [esi + 4]
pop esi
movss xmm0, dword [eax]
mulss xmm0, dword [edx]
mulss xmm1, dword [eax + 4]
addss xmm1, xmm0
movss xmm0, dword [edx + 8]
mulss xmm0, dword [eax + 8]
addss xmm1, xmm0
addss xmm1, dword [edx + 0xc]
movss dword [ecx], xmm1
movss xmm0, dword [edx + 0x14]
mulss xmm0, dword [eax + 4]
movss xmm2, dword [edx + 0x10]
mulss xmm2, dword [eax]
addss xmm2, xmm0
movss xmm0, dword [edx + 0x18]
mulss xmm0, dword [eax + 8]
addss xmm2, xmm0
addss xmm2, dword [edx + 0x1c]
movss dword [ecx + 4], xmm2
mov dword [ecx + 8], 0
movss xmm0, dword [edx + 0x34]
mulss xmm0, dword [eax + 4]
movss xmm3, dword [edx + 0x30]
mulss xmm3, dword [eax]
addss xmm3, xmm0
movss xmm0, dword [edx + 0x38]
mulss xmm0, dword [eax + 8]
addss xmm3, xmm0
movss xmm0, dword [0x1017f014]
addss xmm3, dword [edx + 0x3c]
comiss xmm0, xmm3
jbe 0x100e50d9
mulss xmm1, dword [0x1017f320]
mov al, 1
mulss xmm2, dword [0x1017f320]
movss dword [ecx], xmm1
movss dword [ecx + 4], xmm2
mov esp, ebp
pop ebp
ret
movss xmm0, dword [0x1017f0d8]
xor al, al
divss xmm0, xmm3
mulss xmm1, xmm0
mulss xmm2, xmm0
movss dword [ecx], xmm1
movss dword [ecx + 4], xmm2
mov esp, ebp
pop ebp
ret