joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009cf50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10210050]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, edx
mov dword [ebp - 0x210], ecx
push 0xffffffffffffffff
mov edx, esi
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0x200
call fcn.1008d120
add esp, 4
push edi
push esi
push 1
push eax
call fcn.10176635
mov ecx, dword [ebp - 0x21c]
mov esi, eax
mov eax, dword [ebp - 0x214]
add esp, 0x10
mov ebx, dword [ebp - 0x210]
add eax, esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x224], ecx
jne 0x1009cff1
mov edx, 0x101d3cb3
mov ecx, ebx
call fcn.100ab5d0
jmp 0x1009d072
cmp eax, 0x28
ja 0x1009d005
mov edx, ecx
mov ecx, ebx
push eax
call fcn.100ab380
add esp, 4
jmp 0x1009d072
mov ecx, ebx
cmp eax, 0xffffffeb
jae 0x1009d0ef
mov edi, dword [ebx + 0x10]
lea edx, [eax + 0x11]
push 4
mov esi, dword [edi + 0x48]
call fcn.100a1970
mov cl, byte [edi + 0x4c]
add esp, 4
and cl, 0x18
mov dword [ebp - 0x228], eax
mov byte [eax + 5], cl
mov byte [eax + 4], 0x14
mov ecx, dword [edi + 0x58]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x220]
mov dword [edi + 0x58], eax
mov dword [eax + 8], esi
mov byte [eax + 6], 0
push ecx
push dword [ebp - 0x224]
mov byte [eax + ecx + 0x10], 0
mov dword [eax + 0xc], ecx
add eax, 0x10
push eax
call fcn.10171890
mov eax, dword [ebp - 0x228]
add esp, 0xc
mov esi, dword [ebp - 0x22c]
mov ecx, dword [ebx + 0xc]
mov dword [ecx], eax
mov al, byte [eax + 4]
or al, 0x40
mov byte [ecx + 8], al
mov eax, dword [ebx + 0x10]
add dword [ebx + 0xc], 0x10
cmp dword [eax + 0xc], 0
jle 0x1009d093
mov ecx, ebx
call fcn.1009b960
lea eax, [ebp - 0x20c]
cmp dword [ebp - 0x21c], eax
je 0x1009d0d6
mov edx, dword [ebx + 0xc]
mov eax, dword [edx - 0x10]
mov ecx, dword [edx - 0xc]
mov dword [edx - 0x30], eax
mov dword [edx - 0x2c], ecx
mov al, byte [edx - 8]
mov byte [edx - 0x28], al
mov eax, dword [ebx + 0x14]
cmp word [eax + 0x20], 0xffff
jge 0x1009d0d2
mov edx, dword [ebx + 0xc]
mov ecx, ebx
push 0
sub edx, 0x20
call fcn.10098480
add esp, 4
add dword [ebx + 0xc], 0xffffffe0
mov ecx, dword [ebp - 8]
xor eax, eax
cmp eax, esi
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret
call fcn.100a18e0
int3
Function at 0x100a3610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 0x10], edx
mov esi, ecx
call fcn.1017c976
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0xc], ecx
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
mov cl, byte [esi]
movzx eax, cl
test byte [eax + 0x101cef11], 8
je 0x100a3670
nop
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
test byte [eax + 0x101cef11], 8
jne 0x100a3660
lea edx, [esi + 1]
cmp cl, 0x2d
jne 0x100a3681
mov dword [ebp - 0x14], 1
jmp 0x100a368a
cmp cl, 0x2b
mov dword [ebp - 0x14], edi
cmovne edx, esi
cmp byte [edx], 0x30
jne 0x100a37ce
mov al, byte [edx + 1]
cmp al, 0x78
je 0x100a36a2
cmp al, 0x58
jne 0x100a37ce
add edx, 2
xor esi, esi
mov al, byte [edx]
movsx ecx, al
mov byte [ebp - 1], al
cmp ecx, dword [ebp - 0x1c]
jne 0x100a36c0
test esi, esi
jne 0x100a371a
mov esi, 1
inc edx
jmp 0x100a36a7
movzx eax, al
test byte [eax + 0x101cef11], 0x10
je 0x100a371a
mov eax, dword [ebp - 8]
test eax, eax
jne 0x100a36de
cmp byte [ebp - 1], 0x30
jne 0x100a36de
inc dword [ebp - 0xc]
jmp 0x100a3712
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x1e
jg 0x100a3711
test byte [ecx + 0x101cef11], 2
je 0x100a36f5
add ecx, 0xffffffd0
jmp 0x100a36fb
or ecx, 0x20
sub ecx, 0x57
mulsd xmm1, qword [0x101ed490]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
jmp 0x100a3712
inc edi
test esi, esi
je 0x100a3717
dec edi
inc edx
jmp 0x100a36a7
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
je 0x100a37ce
mov eax, dword [ebp - 0x10]
shl edi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x100a3738
cmp al, 0x50
jne 0x100a379f
mov al, byte [edx + 1]
xor ecx, ecx
mov byte [ebp - 1], al
cmp al, 0x2d
jne 0x100a374c
lea esi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x100a3758
xor eax, eax
xor esi, esi
cmp byte [ebp - 1], 0x2b
sete al
inc eax
add edx, eax
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x101cef11], 2
je 0x100a37ce
nop dword [eax + eax]
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x101cef11], 2
jne 0x100a3770
mov eax, ecx
neg eax
test esi, esi
cmove eax, ecx
add edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
cmp dword [ebp - 0x14], 0
je 0x100a37ac
xorps xmm1, xmmword [0x101ede60]
push edi
sub esp, 8
movsd qword [esp], xmm1
call fcn.10183170
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xorps xmm0, xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100a3a20
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
mov eax, dword [0x10210050]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
mov ebx, edx
lea edx, [esp + 8]
push esi
push edi
mov dword [esp + 0x1c], ebx
mov edi, ecx
call fcn.100a3870
mov esi, eax
test esi, esi
je 0x100a3a80
mov ecx, dword [esp + 0x10]
sub esi, edi
mov edx, dword [esp + 0x14]
mov al, 3
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov byte [ebx + 8], al
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret
push str..xXnN
push edi
call fcn.10183130
add esp, 8
test eax, eax
je 0x100a3ab4
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x100a3ab6
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push ebx
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.100a37e0
mov esi, eax
add esp, 4
test esi, esi
jne 0x100a3b49
push 0x2e
push edi
call fcn.10171660
mov edx, edi
mov esi, eax
add esp, 8
lea eax, [edx + 1]
nop dword [eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100a3ae0
sub edx, eax
cmp edx, 0xc8
ja 0x100a3a9d
test esi, esi
je 0x100a3a9d
lea edx, [esp + 0x20]
mov ecx, edi
sub edx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100a3b00
call fcn.1017c976
sub esi, edi
lea edx, [esp + 0x10]
push ebx
lea ecx, [esp + 0x24]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x24], al
call fcn.100a37e0
mov esi, eax
add esp, 4
test esi, esi
je 0x100a3a9d
mov eax, edi
lea ecx, [esp + 0x20]
sub eax, ecx
add esi, eax
test esi, esi
je 0x100a3a9d
mov ebx, dword [esp + 0x1c]
sub esi, edi
movsd xmm0, qword [esp + 0x10]
mov al, 0x13
mov ecx, dword [esp + 0xf4]
pop edi
movsd qword [ebx], xmm0
mov byte [ebx + 8], al
lea eax, [esi + 1]
pop esi
pop ebx
xor ecx, esp
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret
Function at 0x100ab380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x10]
mov edi, edx
mov edx, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], eax
mov ebx, dword [ecx + 0x48]
xor ebx, edx
mov dword [ebp - 4], ecx
cmp edx, 1
jb 0x100ab3cb
nop dword [eax + eax]
movzx ecx, byte [edi + esi - 1]
mov eax, ebx
shl eax, 5
dec esi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, 1
jae 0x100ab3b0
mov esi, dword [ebp - 4]
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x100ab450
movzx eax, byte [edi + 7]
cmp edx, eax
jne 0x100ab446
mov esi, dword [ebp + 8]
lea eax, [edi + 0x10]
mov edx, dword [ebp - 0xc]
sub esi, 4
jb 0x100ab411
nop word [eax + eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x100ab416
add edx, 4
add eax, 4
sub esi, 4
jae 0x100ab400
cmp esi, 0xfffffffc
je 0x100ab47d
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x100ab443
cmp esi, 0xfffffffd
je 0x100ab47d
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x100ab443
cmp esi, 0xfffffffe
je 0x100ab47d
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x100ab443
cmp esi, 0xffffffff
je 0x100ab47d
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x100ab47d
mov edx, dword [ebp + 8]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x100ab3e4
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov edi, dword [ebp - 8]
cmp eax, dword [esi + 0x20]
jl 0x100ab4c2
cmp eax, 0x7fffffff
jne 0x100ab49f
mov edx, 1
mov ecx, edi
call fcn.1009ba30
cmp dword [esi + 0x1c], 0x7fffffff
je 0x100ab529
jmp 0x100ab49f
mov ecx, dword [ebp - 4]
mov al, byte [edi + 5]
mov cl, byte [ecx + 0x4c]
xor cl, 0x18
test al, cl
je 0x100ab520
xor al, 0x18
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x20]
cmp edx, 0x1fffffff
jg 0x100ab4b3
add edx, edx
mov ecx, edi
call fcn.100ab300
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
dec ecx
and ecx, ebx
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 8]
mov ecx, edi
mov esi, dword [edi + 0x10]
push 4
lea edx, [edx + 0x11]
call fcn.100a1970
mov cl, byte [esi + 0x4c]
mov edi, eax
and cl, 0x18
add esp, 4
mov byte [edi + 5], cl
lea eax, [edi + 0x10]
mov byte [edi + 4], 4
mov ecx, dword [esi + 0x58]
mov dword [edi], ecx
mov dword [esi + 0x58], edi
mov dword [edi + 8], ebx
mov ebx, dword [ebp + 8]
push ebx
push dword [ebp - 0xc]
mov byte [edi + 6], 0
push eax
mov byte [edi + ebx + 0x10], 0
call fcn.10171890
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov byte [edi + 7], bl
mov eax, dword [ecx]
mov dword [edi + 0xc], eax
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
inc dword [ecx + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 4
mov ecx, edi
call fcn.10096620
int3
Function at 0x100b0599
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10210050]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
and edx, 0x3f
push esi
push edi
dec edx
mov edi, ecx
mov dword [ebp - 0x18], edi
cmp edx, 0x15
ja case.0x100b04ff.2
movzx eax, byte [edx + 0x100b067c]
jmp dword [eax*4 + 0x100b065c]
mov cl, byte [edi + 7]
mov eax, 1
shl eax, cl
dec eax
and eax, dword [ebx]
lea ecx, [eax + eax*2]
jmp 0x100b0642
movsd xmm0, qword [ebx]
lea eax, [ebp - 0xc]
push eax
sub esp, 8
movsd qword [esp], xmm0
call fcn.1017c99e
fmul qword [0x101ed540]
add esp, 0xc
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
comisd xmm0, xmmword [0x101ed738]
jb 0x100b056c
movsd xmm1, qword [0x101ed638]
comisd xmm1, xmm0
jbe 0x100b056c
call fcn.101a00c0
add eax, dword [ebp - 0xc]
cmp eax, 0x7fffffff
jbe 0x100b056e
not eax
jmp 0x100b056e
xor eax, eax
mov cl, byte [edi + 7]
mov esi, 1
shl esi, cl
dec esi
cdq
or esi, 1
idiv esi
jmp 0x100b063f
mov cl, byte [edi + 7]
mov edx, 1
mov eax, dword [ebx]
shl edx, cl
dec edx
and edx, dword [eax + 8]
jmp 0x100b063f
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
cmp byte [eax + 6], 0
lea ecx, [eax + 8]
mov dword [ebp - 0x10], ecx
jne 0x100b05ec
mov esi, dword [eax + 0xc]
mov ebx, esi
mov edx, dword [ecx]
shr ebx, 5
xor edx, esi
inc ebx
cmp esi, ebx
jb 0x100b05e4
mov edi, eax
nop dword [eax]
movzx ecx, byte [edi + esi + 0xf]
mov eax, edx
shl eax, 5
sub esi, ebx
add ecx, eax
mov eax, edx
shr eax, 2
add ecx, eax
xor edx, ecx
cmp esi, ebx
jae 0x100b05c0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], edx
mov byte [eax + 6], 1
jmp 0x100b05ef
mov dword [ebp - 0x10], ecx
mov cl, byte [edi + 7]
mov eax, 1
shl eax, cl
mov ecx, dword [ebp - 0x10]
dec eax
and eax, dword [ecx]
lea ecx, [eax + eax*2]
jmp 0x100b0642
mov eax, dword [edi + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret
mov cl, byte [edi + 7]
mov eax, 1
shl eax, cl
dec eax
and eax, 1
lea ecx, [eax + eax*2]
jmp 0x100b0642
mov cl, byte [edi + 7]
mov esi, 1
mov eax, dword [ebx]
xor edx, edx
shl esi, cl
dec esi
or esi, 1
div esi
lea ecx, [edx + edx*2]
mov eax, dword [edi + 0x10]
pop edi
pop esi
pop ebx
lea eax, [eax + ecx*8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret
Function at 0x100bcc20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100bcc81
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100bcc64
cmp edi, 2
jb 0x100bcc64
cmp byte [esi], cl
jne 0x100bcc64
cmp byte [esi + 1], cl
jne 0x100bcc64
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101cfae0]
jmp 0x100bcc35
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101cfae0]
test edi, edi
jne 0x100bcc35
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100bccb0
cmp cl, 0x23
jne 0x100bcc97
cmp byte [esi], cl
jne 0x100bcc97
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x101cfae0]
test cl, cl
jne 0x100bcc88
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x100bce60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x100bce83
push 0x645
push str.C:Users_skyleDesktop_sorcecodespoopv4poopv4pandora_finalMenuimguiimgui.cpp
push str.filename__mode
call fcn.101771fb
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x100bce90
mov dword [edi], 0
mov edx, 0x101d9534
mov ecx, esi
call fcn.100bccc0
mov esi, eax
test esi, esi
je 0x100bcf6f
push esi
call fcn.10182cdc
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x100bcf66
push 2
push 0
push esi
call fcn.10176a93
add esp, 0xc
test eax, eax
jne 0x100bcf66
push esi
call fcn.10182cdc
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x100bcf66
push 0
push dword [ebp + 8]
push esi
call fcn.10176a93
add esp, 0xc
test eax, eax
jne 0x100bcf66
mov eax, dword [0x102762e8]
test eax, eax
je 0x100bcf05
inc dword [eax + 0x374]
push ebx
call fcn.1017ca98
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x100bcf66
push esi
push ebx
push 1
push eax
call fcn.10176635
add esp, 0x10
push esi
cmp eax, ebx
je 0x100bcf50
call fcn.10175a0b
mov eax, dword [0x102762e8]
add esp, 4
test eax, eax
je 0x100bcf3e
dec dword [eax + 0x374]
push dword [ebp + 8]
call fcn.1017629f
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10175a0b
add esp, 4
test edi, edi
je 0x100bcf5e
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10175a0b
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x100bd0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [edx - 1]
mov dword [ebp - 0xc], ebx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x1c], eax
cmp ebx, eax
mov eax, dword [ebp + 8]
jae 0x100bd296
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x100bd114
cmp eax, esi
jae 0x100bd291
mov bl, byte [eax]
mov byte [ebp - 3], bl
test bl, bl
je 0x100bd291
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x101db950]
test ecx, ecx
mov dword [ebp - 0x10], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x18], ebx
test esi, esi
jne 0x100bd146
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x100bd15b
mov bh, byte [esi]
jmp 0x100bd15d
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x100bd16b
mov ch, byte [esi]
jmp 0x100bd16d
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x100bd17b
mov bl, byte [esi]
jmp 0x100bd17d
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp - 1], bl
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx*4 + 0x101db93c]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0x10]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x101db928]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x10]
cmp esi, dword [ebx*4 + 0x101db970]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x101db984]
mov ebx, dword [ebp - 0x18]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x100bd26e
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 4], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x100bd274
add eax, ebx
test esi, esi
je 0x100bd28e
mov ecx, dword [ebp - 0x14]
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x1c]
jb 0x100bd108
jmp 0x100bd291
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0xc]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100bd2a4
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100bd2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov eax, ecx
push edi
mov dword [ebp - 0x18], esi
xor edx, edx
mov dword [ebp - 0x10], edx
test esi, esi
je 0x100bd2d1
cmp eax, esi
jae 0x100bd44c
mov cl, byte [eax]
mov byte [ebp - 3], cl
test cl, cl
je 0x100bd44c
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x101db950]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x100bd303
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x100bd318
mov bh, byte [esi]
jmp 0x100bd31a
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x100bd328
mov ch, byte [esi]
jmp 0x100bd32a
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x100bd338
mov bl, byte [esi]
jmp 0x100bd33a
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp - 1], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x101db93c]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x101db928]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x101db970]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x101db984]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x100bd430
xor edx, edx
mov esi, dword [ebp - 0x18]
cmp byte [ebp - 4], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x100bd2c2
add eax, ebx
test esi, esi
je 0x100bd442
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
inc edx
jmp 0x100bd2c2
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100bf770
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xfc], 0
jg 0x100bf797
push 0x6d1
push str.C:Users_skyleDesktop_sorcecodespoopv4poopv4pandora_finalMenuimguiimgui.h
push str.Size___0
call fcn.101771fb
add esp, 0xc
mov ecx, dword [esi + 0xfc]
mov edi, 4
mov eax, dword [esi + 0x104]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101cfae0]
sub edi, 1
jne 0x100bf7b1
mov ecx, dword [0x102762e8]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1c84], eax
jne 0x100bf7e3
mov dword [ecx + 0x1c88], eax
cmp dword [ecx + 0x1cbc], eax
jne 0x100bf7f2
mov byte [ecx + 0x1cc0], 1
pop ebp
ret 4

Function at 0x100bf800
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10210050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xfc], 0
jg 0x100bf834
push 0x6d1
push str.C:Users_skyleDesktop_sorcecodespoopv4poopv4pandora_finalMenuimguiimgui.h
push str.Size___0
call fcn.101771fb
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0x44]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x48]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0x44]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x48]
mov ecx, dword [esi + 0xfc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x104]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x101cfae0]
sub edi, 1
jne 0x100bf894
mov eax, dword [0x102762e8]
not edx
pop edi
pop esi
cmp dword [eax + 0x1c84], edx
jne 0x100bf8c5
mov dword [eax + 0x1c88], edx
cmp dword [eax + 0x1cbc], edx
jne 0x100bf8d4
mov byte [eax + 0x1cc0], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret 4
Function at 0x100cb0b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10210050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102762e8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x1c48]
add esi, 0xfc
mov dword [ebp - 8], ecx
cmp dword [esi], 0
jg 0x100cb0f3
push 0x6d1
push str.C:Users_skyleDesktop_sorcecodespoopv4poopv4pandora_finalMenuimguiimgui.h
push str.Size___0
call fcn.101771fb
add esp, 0xc
mov ecx, dword [esi]
lea edx, [ebp - 8]
mov eax, dword [esi + 8]
mov edi, 4
mov ebx, dword [eax + ecx*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101cfae0]
sub edi, 1
jne 0x100cb106
mov edi, dword [esi + 4]
not ebx
mov ecx, dword [esi]
cmp ecx, edi
jne 0x100cb14d
inc ecx
test edi, edi
je 0x100cb13b
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x100cb140
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100deba0
mov ecx, dword [esi]
mov eax, dword [esi + 8]
pop edi
mov dword [eax + ecx*4], ebx
inc dword [esi]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret