joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58fd1f
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [esp + 4], str.thisimage
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0058e9ab
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0058f75a
test eax, eax
js 0x58fd9d
mov dword [esp + 4], str.thisimage
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0058e9ab
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00577370
test eax, eax
je 0x58fda9
mov dword [ebp - 0xc], 1
jmp 0x58feef
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0058fc3c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x58feeb
mov dword [esp + 4], str.postimage
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0058e9ab
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.cygwin1.dll_utime
test eax, eax
jns 0x58fe31
mov dword [esp + 4], str.postimage
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0058e9ab
mov ebx, eax
mov dword [esp], str.failed_utime___on__s
call fcn.0058e701
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004ae2f1
mov dword [esp + 4], 0x5d7458
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.004c85b0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x58fe72
mov dword [esp], str.could_not_open__s
call fcn.0058e701
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ae275
call fcn.0058e43c
jmp 0x58ff08
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
cmp eax, 1
je 0x58feba
mov dword [esp], str.could_not_write__s
call fcn.0058e701
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ae275
call fcn.0058e43c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_fclose
test eax, eax
je 0x58feee
mov dword [esp], str.writing__s_failed
call fcn.0058e701
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ae275
call fcn.0058e43c
jmp 0x58ff08
nop
jmp 0x58feef
nop
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x58ff0d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [ebp - 0x14], 0
mov dword [esp + 8], 1
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0047216a
mov dword [ebp - 0xc], 0
jmp 0x58ffcb
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
shl eax, 3
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x84]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004537a1
test eax, eax
je 0x58ff9c
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x2ba
mov dword [esp], str.rerere.c
call fcn.00499d7f
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
mov dword [esp], str.Staged__s_using_previous_resolution.
call fcn.0058e701
mov ebx, eax
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0048c914
add dword [ebp - 0xc], 1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
cmp edx, eax
ja 0x58ff42
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x84]
mov dword [esp + 8], 3
lea edx, [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004588be
test eax, eax
je 0x590014
mov dword [esp], str.unable_to_write_new_index_file
call fcn.0058e701
mov dword [esp], eax
call fcn.004ae00f
nop
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x598c4d
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0x1505
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0x1e
cmp eax, 0x10
sete al
movzx eax, al
mov dword [ebp - 0x10], eax
jmp 0x598db5
cmp dword [ebp - 0x10], 0
je 0x598cb2
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 0xd
jne 0x598d99
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp + 0xc], eax
jbe 0x598d99
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
cmp al, 0xa
jne 0x598d99
jmp 0x598db1
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str._________AA__A__________________]
movzx eax, al
and eax, 1
test eax, eax
je 0x598d99
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x598cdc
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp + 0xc], eax
jbe 0x598d11
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str._________AA__A__________________]
movzx eax, al
and eax, 1
test eax, eax
je 0x598d11
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
cmp al, 0xa
jne 0x598cd8
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp + 0xc], eax
jbe 0x598d29
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
cmp al, 0xa
jne 0x598d30
mov eax, 1
jmp 0x598d35
mov eax, 0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
and eax, 2
test eax, eax
jne 0x598db0
mov eax, dword [ebp + 0x10]
and eax, 4
test eax, eax
je 0x598d61
cmp dword [ebp - 0x14], 0
jne 0x598d61
mov eax, dword [ebp - 4]
shl eax, 5
add dword [ebp - 4], eax
xor dword [ebp - 4], 0x20
jmp 0x598db0
mov eax, dword [ebp + 0x10]
and eax, 8
test eax, eax
je 0x598db0
cmp dword [ebp - 0x14], 0
jne 0x598db0
jmp 0x598d8c
mov eax, dword [ebp - 4]
shl eax, 5
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
xor dword [ebp - 4], eax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 0xc], eax
jne 0x598d73
jmp 0x598db0
mov eax, dword [ebp - 4]
shl eax, 5
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movsx eax, al
xor dword [ebp - 4], eax
jmp 0x598db1
nop
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x598dcb
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 0xa
jne 0x598c79
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x598ddb
mov eax, dword [ebp - 8]
add eax, 1
jmp 0x598dde
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x598de8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0x1505
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0x1e
test eax, eax
je 0x598e3b
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00598c4d
jmp 0x598e68
mov eax, dword [ebp - 4]
shl eax, 5
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movsx eax, al
xor dword [ebp - 4], eax
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x598e4d
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 0xa
jne 0x598e22
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x598e5d
mov eax, dword [ebp - 8]
add eax, 1
jmp 0x598e60
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x48767a16
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4d947400
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10004300
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10004361
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10004344
cmp edi, 2
jb 0x10004344
cmp byte [esi], cl
jne 0x10004344
cmp byte [esi + 1], cl
jne 0x10004344
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1004f5a8]
jmp 0x10004315
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1004f5a8]
test edi, edi
jne 0x10004315
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10004390
cmp cl, 0x23
jne 0x10004377
cmp byte [esi], cl
jne 0x10004377
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1004f5a8]
test cl, cl
jne 0x10004368
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x100044a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100044b4
mov dword [ebx], 0
mov edx, 0x1004f1f8
call fcn.100043a0
mov esi, eax
test esi, esi
je 0x100045a2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10004598
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004598
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x10004598
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004598
mov eax, dword [0x1005eab0]
test eax, eax
je 0x1000452c
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x10004598
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000457d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1005eab0]
add esp, 4
test eax, eax
je 0x1000456a
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1000458f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009010
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000904f
cmp bl, 0x23
jne 0x10009031
cmp byte [esi], bl
jne 0x10009031
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x1004f5a8]
test bl, bl
jne 0x10009022
mov ecx, dword [0x1005eab0]
not eax
mov esi, dword [ecx + 0x3e10]
mov edi, dword [ecx + 0x3e18]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000908e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10009088
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000908a
mov esi, edx
test esi, esi
jne 0x10009070
cmp edi, ebx
je 0x1000909d
cmp dword [edi], eax
jne 0x1000909d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10016060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5a60], 0
lea esi, [edi + 0x5a64]
je 0x100160e2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001609c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100183d0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.100048b0
mov edx, dword [esi]
mov ecx, 0x1005eab8
push dword [edi + 0x5a60]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5a6c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100048b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100165a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x1005eab0]
test bl, bl
je 0x100165e6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x100165c7
cmp byte [esi], bl
jne 0x100165c7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x1004f5a8]
test bl, bl
jne 0x100165b8
mov edi, dword [0x1005eab0]
mov esi, dword [edi + 0x5a08]
xor ecx, ecx
not eax
test esi, esi
jle 0x1001660c
mov edi, dword [edi + 0x5a10]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x10016612
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x10016600
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x1001ffc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1001fffa
mov eax, dword [0x1005eab0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1001ffed
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1002002b
mov eax, dword [0x1005eab0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002001e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1002005c
mov eax, dword [0x1005eab0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1002004f
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100200a9
mov eax, dword [0x1005eab0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002009c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100200da
mov eax, dword [0x1005eab0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100200cd
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002010b
mov eax, dword [0x1005eab0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100200fe
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100226b0
Function at 0x10027d60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1005d040]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x1005eab0]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push dword [0x1005eb30]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
movd xmm1, eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x30]
mov ecx, edi
sub ecx, dword [0x1005eb38]
mov esi, dword [esp + 0x34]
mov edx, esi
sbb edx, dword [0x1005eb3c]
call fcn.1004b120
mov edx, dword [0x1005eb44]
mov ecx, dword [0x1005eb40]
movss dword [esp + 0x28], xmm0
call fcn.1004b120
movss xmm1, dword [esp + 0x28]
divss xmm1, xmm0
push 0x11
movss dword [ebx + 0x18], xmm1
mov dword [0x1005eb3c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1005eb38], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xdd0], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xdd1], al
call esi
mov ecx, dword [0x1005eab0]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xdd3], 0
mov byte [ebx + 0xdd2], al
cmp byte [ecx + 0x97], 0
lea esi, [ecx + 0xdb8]
je 0x10027e92
cvttss2si eax, dword [esi]
mov dword [esp + 0x28], eax
cvttss2si eax, dword [ecx + 0xdbc]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push dword [0x1005eb30]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10027efe
mov ecx, dword [0x1005eb30]
cmp eax, ecx
je 0x10027ebf
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10027efe
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10027efe
lea eax, [esp + 0x10]
push eax
push dword [0x1005eb30]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10027efe
movd xmm0, dword [esp + 0x10]
movd xmm1, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0x60], 0
je 0x10027f09
or eax, 0xffffffff
jmp 0x10027f14
mov eax, dword [0x1005eab0]
mov eax, dword [eax + 0x492c]
cmp dword [0x1005d2c8], eax
je 0x10027f26
mov dword [0x1005d2c8], eax
call fcn.100279b0
call fcn.10027ae0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret

Function at 0x10030a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10030aa1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10030a90
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10031220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, 0x1fffffff
mov esi, 1
push edi
mov edi, ecx
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0x10], edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10031251
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov ebx, dword [edi + 4]
or eax, 1
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10031120
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov edi, dword [edi + 4]
mov edi, dword [edi]
cmp edi, ebx
je 0x10031371
mov esi, edi
nop word [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea ebx, [esi + 8]
mov edi, dword [edi]
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
jbe 0x100312a7
mov ebx, dword [esi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x18], ecx
jbe 0x100312ca
mov edi, dword [ebp - 4]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100312b6
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
lea eax, [eax + ecx*8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [eax], ecx
jne 0x100312e9
mov dword [eax], esi
mov dword [eax + 4], esi
jmp 0x10031366
mov ebx, dword [eax + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.10031930
test al, al
je 0x10031321
mov ebx, dword [ebx]
cmp ebx, esi
je 0x10031319
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x10031366
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x10031349
nop dword [eax + eax]
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.10031930
test al, al
jne 0x1003137a
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10031330
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov esi, edi
cmp edi, dword [ebp - 8]
jne 0x10031290
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x10031366