joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d080
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sym._strlen
mov ebx, eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x40]
lea ecx, [ebx + 0x30]
shr eax, 4
mov dword [ebp - 0x20], ecx
shl eax, 4
call fcn.0041a2f0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], ebx
lea edi, [esp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
add eax, edi
mov dword [eax], 0x61616161
mov dword [eax + 4], 0x61616161
mov dword [eax + 8], 0x61616161
mov dword [eax + 0xc], 0x61616161
mov dword [eax + 0x10], 0x61616161
mov dword [eax + 0x14], 0x61616161
mov dword [eax + 0x18], 0x61616161
mov dword [eax + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [edi + ebx + 0xf], 0x2d
sub esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42d174
int3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
je 0x42d1c0
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call sym._get_ptr_from_atom_1
mov ebx, eax
mov edi, dword [ebp - 0x24]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
add ebx, edi
mov dword [esp], eax
call sym._malloc
mov edx, 0x20
mov esi, eax
lea esi, [esi]
bt esi, edx
jae 0x42d1e6
mov eax, edx
neg eax
mov byte [ebx + eax + 0x30], 0x41
sub edx, 1
jne 0x42d1d8
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
jne 0x42d1fd
int3
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call sym._get_ptr_from_atom_1
mov ebx, eax
cmp esi, eax
je 0x42d223
mov dword [esp], esi
call sym._free
jmp 0x42d19a
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42d19a
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x42d19a
Function at 0x161125
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov edx, dword fs:[0x18]
xor eax, eax
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0xc]
cmp edx, 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
je 0x161260
xor eax, eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x14
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x14]
cmp esi, 0
sete bl
cmp esi, ecx
sete bh
or bl, bh
test bl, 1
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
jne 0x161260
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x14]
cmp edx, 0
sete ch
mov esi, dword [ebp - 0x20]
mov byte [ebp - 0x25], cl
mov byte [ebp - 0x26], ch
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov cx, word [eax + 0x24]
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x25]
and bh, bl
test bh, 1
mov dword [ebp - 0x30], eax
mov word [ebp - 0x32], cx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], esi
jne 0x1611d1
jmp 0x1611df
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff8
mov dword [ebp - 0x1c], eax
jmp 0x161260
mov al, byte [ebp - 0x26]
test al, 1
jne 0x161248
jmp 0x1611e8
mov ax, word [ebp - 0x32]
shr ax, 1
movzx ecx, ax
cmp ax, 0
mov dword [ebp - 0x40], ecx
je 0x161248
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x161216
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
cmp eax, ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], edx
jae 0x161260
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
cmovb dx, di
mov ebx, dword [ebp - 0x14]
mov si, word [ebx + eax*2]
add eax, 1
cmp si, dx
mov dword [ebp - 0x48], eax
je 0x161203
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x24]
cmp edx, esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], eax
jne 0x1611a3
mov eax, dword [ebp - 0x1c]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x161306
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
lea ecx, [0x1640e0]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
call fcn.00161125
xor ecx, ecx
mov edx, dword [eax + 0x3c]
mov esi, eax
add esi, edx
cmp dword [eax + edx], 0x4550
mov edx, ecx
cmove edx, esi
mov edx, dword [edx + 0x78]
mov esi, eax
add esi, edx
mov edi, eax
add edi, dword [edi + edx + 0x20]
mov edx, dword [eax + edx + 0x18]
cmp edx, 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ecx
je 0x161426
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
add ecx, dword [edx + 0x24]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x20]
add esi, dword [edi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dl, byte [ecx + eax]
mov esi, dword [ebp - 0x10]
mov dh, byte [esi + eax]
cmp dl, dh
sete bl
cmp dl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bl
mov byte [ebp - 0x46], dh
je 0x1613e1
mov al, byte [ebp - 0x46]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x44]
add edx, 1
mov ah, byte [ebp - 0x45]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x40], edx
jne 0x16139c
mov al, byte [ebp - 0x45]
test al, 1
jne 0x16140e
jmp 0x1613ea
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x1c]
cmp edx, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jb 0x16137f
jmp 0x161426
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
add edx, dword [esi + 0x1c]
mov edi, dword [ebp - 0x18]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x161b34
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [eax + 0x3c]
mov edi, eax
add edi, esi
add esi, 0xffffffc0
cmp esi, 0xfc0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edx
ja 0x161b77
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0x4550
cmove eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
add ecx, 6
mov dx, word [eax + 6]
cmp dx, 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov word [ebp - 0x26], dx
je 0x161bb4
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x18
mov edx, dword [ebp - 0x20]
movzx esi, word [edx + 0x14]
add ecx, esi
mov di, word [ebp - 0x26]
mov word [ebp - 0x28], di
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
jmp 0x161bed
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x54]
cmp ecx, 0
mov dword [ebp - 0x34], ecx
je 0x161be5
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x161bc9
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + eax]
mov esi, dword [ebp - 0x14]
mov byte [esi + eax], dl
add eax, 1
mov edi, dword [ebp - 0x34]
cmp eax, edi
mov dword [ebp - 0x38], eax
jne 0x161bc9
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dx, word [ebp - 0x28]
mov esi, dword [ebp - 0x14]
add esi, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
mov ebx, dword [ebp - 0x10]
add ebx, dword [eax + 0x14]
cmp edi, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x4e], dx
je 0x161c4b
xor eax, eax
mov dword [ebp - 0x54], eax
jmp 0x161c25
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x44]
mov dl, byte [ecx + eax]
mov esi, dword [ebp - 0x48]
mov byte [esi + eax], dl
add eax, 1
mov edi, dword [ebp - 0x4c]
cmp eax, edi
mov dword [ebp - 0x54], eax
jne 0x161c25
mov eax, dword [ebp - 0x24]
mov cx, word [eax]
mov word [ebp - 0x4e], cx
mov ax, word [ebp - 0x4e]
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x3c]
add edx, 0x28
movzx esi, ax
cmp ecx, esi
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], edx
jb 0x161bed
jmp 0x161bb4
Function at 0x10037d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10037d2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10037d54
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10037d5a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10037dc2
jg 0x10037d71
test esi, esi
je 0x10037dc2
test ecx, ecx
jl 0x10037dbd
jg 0x10037d7b
test eax, eax
je 0x10037dbd
cmp edi, ecx
jg 0x10037d8f
jl 0x10037d85
cmp esi, eax
jae 0x10037d8f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10037dc5
mov ecx, dword [ebp + 8]
jmp 0x10037dcf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10037de9
jg 0x10037dcf
test esi, esi
je 0x10037de9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10037de9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10037e00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x10037e2c
jl 0x10037e20
test ecx, ecx
jne 0x10037e2c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10037e45
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10037e93
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10037e99
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10037e99
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10037f06
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10037ec2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10037ef4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10037f06
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10037ed0
test edi, edi
je 0x10037f06
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10038290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10122040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100382c0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3306
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100382fc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100382fc
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3306
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100383d3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10038324
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10038330
movsx eax, bl
jmp 0x10038368
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10038392
sub eax, 1
je 0x10038392
sub eax, 2
jne 0x100383d3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3306
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100383b0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100383d3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3306
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f3306
mov esp, ebp
pop ebp
ret 4
Function at 0x100386d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10122040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003878c
cmp byte [esi + 0x3d], 0
je 0x1003878c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003877a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10038741
sub eax, 1
je 0x10038745
sub eax, 2
jne 0x1003877a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3306
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10038763
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003877a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3306
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3306
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100f3306
mov esp, ebp
pop ebp
ret
Function at 0x1003b000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101d523c], 0
push ebx
push esi
push edi
je 0x1003b1b8
mov ecx, dword [0x101de8cc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003b1b8
mov esi, dword [0x101de950]
xor ebx, ebx
mov dword [ebp - 4], esi
mov eax, dword [esi + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003b1b8
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [esi + 0x28]
jl 0x1003b067
push 0x410
push str.D:csgo_rax_sourcelegacyutlvector.h
push str.i___m_Size
call eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
cmp dword [esi + 0x24], 0xfffffffe
jne 0x1003b081
push 0x272
push str.D:csgo_rax_sourcelegacyutlvector.h
push str._IsReadOnly__
call eax
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x1003b097
xor edx, edx
test ecx, ecx
je 0x1003b0bd
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1003b0a4
cmp edi, 0x5ff56dc5
je 0x1003b0cf
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003b1b8
mov esi, dword [ebp - 4]
jmp 0x1003b044
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [edi + 0x28]
jl 0x1003b0f1
push 0x410
push str.D:csgo_rax_sourcelegacyutlvector.h
push str.i___m_Size
call esi
add esp, 0xc
cmp dword [edi + 0x24], 0xfffffffe
jne 0x1003b10b
push 0x272
push str.D:csgo_rax_sourcelegacyutlvector.h
push str._IsReadOnly__
call esi
add esp, 0xc
mov eax, dword [edi + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003b1b8
mov eax, dword [edi + 0x88]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003b1b8
xor esi, esi
test eax, eax
jle 0x1003b1b8
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp esi, dword [edi + 0x88]
jl 0x1003b165
push 0x410
push str.D:csgo_rax_sourcelegacyutlvector.h
push str.i___m_Size
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
cmp dword [edi + 0x84], 0xfffffffe
jne 0x1003b185
push 0x272
push str.D:csgo_rax_sourcelegacyutlvector.h
push str._IsReadOnly__
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [edi + 0x7c]
movss xmm0, dword [ecx + edx + 0x418]
ucomiss xmm0, dword [0x10114dc8]
lahf
test ah, 0x44
jp 0x1003b1a9
mov dword [ecx + edx + 0x418], 0x7f7fffff
inc esi
add edx, 0x420
mov dword [ebp - 4], edx
cmp esi, dword [ebp - 8]
jl 0x1003b140
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x101dca40
push ebx
push esi
push edi
call fcn.1003a450
mov ecx, 0x101e4ae0
call fcn.1003dcb0
mov ecx, dword [0x101de8c4]
test ecx, ecx
je 0x1003b28a
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov ebx, eax
test ebx, ebx
je 0x1003b28a
mov eax, dword [ebx + 0x14]
mov esi, 0x811c9dc5
mov edi, dword [ebx + 8]
mov dword [ebp - 8], eax
xor eax, eax
inc eax
cmp byte [edi + eax], 0
jne 0x1003b254
xor edx, edx
test eax, eax
je 0x1003b272
movsx ecx, byte [edi + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x1003b261
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
call fcn.1003db60
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x1003b244
mov ecx, dword [0x101de8cc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x101de8d0]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov dword [0x101dc6dc], eax
call fcn.100e8290
mov ecx, 0x101df5d0
call fcn.100d7b60
mov ecx, 0x101dceec
call fcn.1003ddd0
mov ecx, 0x101dc668
call fcn.1003dd40
mov ecx, dword [0x101de8cc]
mov dword [0x101dc664], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x138]
call eax
pop edi
pop esi
mov dword [0x101de934], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003db60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f5f25
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10122040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1003ed80
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1003dc8b
cmp dword [0x101e4ae8], 0xfffffff
jne 0x1003dbea
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101e4ae4
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100f3322
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101e4ae8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101150e0]
mov eax, dword [0x101e4afc]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101150e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x101e4ae0]
jbe 0x1003dc80
call fcn.1003eb20
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003ed80
mov ecx, dword [eax]
jmp 0x1003dc83
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.1003eba0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4