joyce8/EMBER2024-capa huggingface dataset:
Function at 0x890058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008901a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x89007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x89006a
add dl, dl
jne 0x890089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8900dc
xor eax, eax
add dl, dl
jne 0x890096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x89017d
add dl, dl
jne 0x8900a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8900b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8900bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8900c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8900d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x890075
mov eax, 1
add dl, dl
jne 0x8900ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8900f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8900e1
sub eax, ebx
mov ebx, 1
jne 0x890128
mov ecx, 1
add dl, dl
jne 0x89010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x890119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x890105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x890075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x89013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x89014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x890136
cmp eax, 0x7d00
jae 0x89016d
cmp eax, 0x500
jb 0x890168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x890075
cmp eax, 0x7f
ja 0x890170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x890075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x89019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x890075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xcc0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00cc01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcc007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcc006a
add dl, dl
jne 0xcc0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcc00dc
xor eax, eax
add dl, dl
jne 0xcc0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcc017d
add dl, dl
jne 0xcc00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcc00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcc00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcc00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcc00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcc0075
mov eax, 1
add dl, dl
jne 0xcc00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcc00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcc00e1
sub eax, ebx
mov ebx, 1
jne 0xcc0128
mov ecx, 1
add dl, dl
jne 0xcc010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcc0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcc0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcc0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcc013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcc014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcc0136
cmp eax, 0x7d00
jae 0xcc016d
cmp eax, 0x500
jb 0xcc0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcc0075
cmp eax, 0x7f
ja 0xcc0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcc0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcc019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcc0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x59feb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test esi, esi
mov ecx, edi
jbe 0x59fed0
mov dl, byte [esp + 0x14]
mov al, byte [ecx]
add al, dl
xor al, dl
mov byte [ecx], al
inc ecx
dec esi
jne 0x59fec4
mov eax, edi
pop edi
pop esi
ret

Function at 0x5ace22
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, eax
rdtsc
lea esp, [esp + 0xc]
js 0x5aece3
setg cl
cwde
mov ecx, 0x11
jbe 0x5c07c7
lea edi, [0x7dac498d]
push edx
lea edi, [ebp - 0x54]
pop eax
cdq
mov al, bl
pushfd
rep movsd dword es:[edi], dword [esi]
xor dx, bx
rcr ch, 2
mov ecx, dword [ebp + 8]
rdtsc
dec eax
mov edx, dword [ebp - 0x44]
xor ax, bx
rol al, 2
not al
rol eax, cl
mov dword [ecx + 0x10], edx
push ecx
adc dl, dl
rcr dword [ecx - 0x3f01932b], 0x8b
inc ebp
or byte [esi - 0x2d], ah
shl dword [esi + 0xf], 1
mov esi, 0xe1d366cb
btc cx, si
mov ecx, dword [ebp - 0x40]
sal dx, cl
sbb dh, 0x27
cmp ax, 0xf29f
mov dword [eax + 0x14], ecx
jmp fcn.005c5a00
movsx edi, cl
push 0x717e9193
mov ecx, 0x11
push ecx
push 0xcea21c08
jmp 0x5a24ad
lahf
rdtsc
cwde
lea edi, [ebp - 0x54]
not dx
pushfd
pushal
call fcn.005c2c34
mov byte [esp + 8], ah
mov dword [ebp - 0x24], edx
pushfd
mov dword [ebp - 0x3c], 0
pushfd
mov dword [esp], 0x37eb653d
lea esp, [esp + 0x38]
jmp 0x5d5c45
shrd dx, bp, 8
sar dh, 1
rcl dx, cl
rol dx, cl
mov edx, dword [ebp - 0x34]
clc
bt bp, 0xf
test al, dh
push 0x5a070d5a
sub eax, eax
movzx ax, al
btc ax, 9
call fcn.005d25c9

Function at 0x5ada70
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
cmp dword [edx + 0x10], 0
mov byte [esp], 0x25
pushal
pushfd
push dword [esp]
lea esp, [esp + 0x30]
je 0x5d0b98
rdtsc
rdtsc
mov eax, dword [ebp - 0x74]
setge ch
mov ecx, dword [eax + 0xc]
shr al, cl
pushfd
cmc
sar dh, cl
add ecx, dword [ebp + 0x10]
movzx eax, bl
aas
rcr dx, 3
xchg dx, ax
mov edx, dword [ebp - 0x74]
call fcn.005c1b19
push 0x5a4718
pushal
mov byte [esp + 8], bh
pushfd
lea esp, [esp + 0x24]
call fcn.005b8d4a
push 0x1366adef
mov dword [esp], eax
pushfd
push ebx
lea esp, [esp + 8]
call fcn.005cb1f1
cmp bp, bp
stc
cmp cl, bl
test sp, 0x270a
mov dword [ebp - 0x18], eax
push ebx
push dword [esp]
test dl, dh
cmp dword [ebp - 0x18], 0
pushal
call fcn.005ca31a
sete al
pushfd
push dword [esp]
mov edx, dword [ebp - 0x34]
call fcn.005c017a
pushfd
mov dword [esp], str.VirtualQuery
jmp 0x5c68ef

Function at 0x5b04d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
lea esp, [esp + 0x2c]
je 0x5bce4d
setb ah
push 0xc1165ce
mov eax, 0xc0000001
pushal
mov byte [esp], 0x5f
push ebp
push 0x544d7e42
lea esp, [esp + 0x2c]
jmp fcn.005d1844
Function at 0x5b307a
Capabilities:
Encode data using xor

Disassembly:
jle 0x5b30a4
jl 0x5b30fd
invalid
dec esi
sub eax, dword [edx]
push ebx
inc edx
sub edi, dword [ecx + 0x65]
or eax, esi
scasb al, byte es:[edi]
pop edi
mov bh, 0x4c
jne 0x5b30a1
mov byte [0xe181ee63], al
xor eax, ebp
retf
pop esp
inc esi
wait
invalid
mov ebx, 0x938fcd8b
test al, 0xda
dec ebp
adc dword [eax + 6], edi
xor al, 0x7e
xor cl, al
mov ebx, 0x1615bbe6
jno 0x5b30f8
pop edx
popal
pop edi
mov byte [0x9abc8e88], al
stosd dword es:[edi], eax
lcall 0x48ae, 0x436af91d
xchg ecx, eax
rep lodsd eax, dword es:[esi]
outsd dx, dword [esi]
hlt

Function at 0x5b525b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dh, dh
push dword [esp]
cmp dword [ebp + 0x18], 4
pushfd
lea esp, [esp + 0xc]
jne 0x5db5a1
pushfd
cmp dword [ebp + 0x14], 8
jmp 0x5c328a
mov eax, 0xc0000001
pushfd
pushal
lea esp, [esp + 0x24]
jmp fcn.005d1844
lea esp, [esp + 4]
je 0x5bce4d
not ax
setp ah
jmp 0x5b7824

Function at 0x5b64c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5c7d35
add esp, 0xc
cmc
clc
cmc
test eax, eax
push 0x30b740ec
lea esp, [esp + 4]
jne 0x5c6b82
rdtsc
lahf
mov eax, dword [ebp + 0x14]
movzx dx, cl
push eax
jmp 0x5bb27b

Function at 0x5b6ded
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5c1f50
mov word [esp], 0xd480
mov byte [esp + 4], 0xd8
lea esp, [esp + 0xc]
je 0x5c2038
xor dh, al
lea ecx, [ebp*2 + 0x3bb1ffe0]
clc
mov edx, dword [ebp + 0xc]
sbb ah, 0x42
neg cl
push 0xf48786c6
mov dword [edx], 0
xadd ah, cl
mov dword [edx + 4], 0
xor cx, 0x83a2
btc dx, cx
shr eax, 8
rcr dh, 4
mov eax, dword [ebp + 0xc]
movsx dx, dl
shld dx, dx, 0xf
mov dword [eax + 8], 0
movzx dx, bl
or dl, 0x8b
and cl, cl
pushfd
mov dword [eax + 0xc], 0
pushal
cdq
seta cl
mov ecx, dword [ebp + 0xc]
sub ah, 0x46
inc esi

Function at 0x5b7415
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0x5bce4d
bswap ax
mov eax, 0xc0000001
pushfd
lea esp, [esp + 4]
jmp fcn.005d1844

Function at 0x5b7af7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0x5c9860
call fcn.005ce14d
Function at 0x5ba991
Capabilities:
Enumerate pe sections
Execute anti-debugging instructions

Disassembly:
mov dword [eax + 4], ecx
clc
cmc
call fcn.005d0fff
mov dword [esp + 0x20], eax
pushal
lea esp, [esp + 0x40]
jle 0x5dc76a
push 0xa5f50899
lea esp, [esp + 4]
call 0x5a1deb
rcl cx, 6
bt edi, 7
add esp, 4
shld ecx, edi, 0x1a
mov ecx, dword [ebp + 8]
shrd dx, bx, 8
mov edx, dword [ebp + 8]
sbb ah, al
pushal
adc ax, 0x1f73
sal al, cl
sub edx, dword [ecx + 8]
and cl, 0xf2
sar al, 3
pop eax
mov dword [ebp - 0x1c], edx
aaa
mov eax, dword [ebp + 0xc]
xadd ecx, edx
bswap ecx
mov dword [ebp - 0x14], eax
cdq
rcl dh, 6
shrd cx, sp, 3
shl cl, 5
mov ecx, dword [ebp - 0x14]
btr dx, bx
stc
and edx, 0x9fc9683c
shl dl, 2
mov dword [ebp - 0xc], ecx
pushfd
lea ecx, [edx - 0x557f776a]
sar cx, cl
mov edx, dword [ebp - 0xc]
btc cx, 8
cmc
mov eax, dword [ebp - 0xc]
ror cx, 0xe
add eax, dword [edx + 0x3c]
test bp, 0x53cb
sar cl, 2
rcl ecx, cl
bts cx, bp
mov dword [ebp - 8], eax
bsr cx, ax
aas
dec ah
and cl, al
mov ecx, dword [ebp - 8]
das
mov ah, byte [esp + 0xc]
btc ax, 1
xor edx, edx
call fcn.005bd245
pushfd
pushal
jmp 0x5c2a43

Function at 0x5c2885
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ch
mov dword [eax], 0
cmc
cmp dl, 0xe
btr cx, 4
clc
mov ecx, dword [ebp + 0x14]
cmp cl, bl
mov dword [ecx + 4], 1
clc
call fcn.005c5e6d
mov dword [ecx + 4], 0
rdtsc
add ax, 0x1935
mov edx, dword [ebp - 0xc]
pushal
mov dword [edx], 1
adc ax, 0x3b52
rdtsc
mov eax, dword [ebp - 0xc]
cmp bl, al
xor cl, ah
pop ecx
shl ch, cl
mov ecx, dword [ebp - 4]
sal dx, 0xd
mov dword [eax + 8], ecx
bsf dx, di
mov edx, dword [ebp - 0xc]
das
cwde
mov eax, dword [ebp - 8]
sal cx, 1
pop ecx
mov dword [edx + 0xc], eax
cmc
btc dx, 1
bts cx, cx
mov ecx, dword [ebp - 0xc]
sal dh, 6
or ecx, 0x80000000
ror dl, cl
push edx
mov edx, dword [ebp + 8]
mov byte [esp + 8], 0xbe
mov dword [edx], ecx
bt ax, 0xb
bt cx, bp
clc
pushfd
cmp dword [ebp + 0x14], 0
mov byte [esp + 8], cl
pushal
push esi
lea esp, [esp + 0x44]
je 0x5ad88a
invalid
shrd ax, dx, cl
aam 0x17
sal cx, 0xf
mov eax, dword [ebp + 0x14]
bswap cx
jmp 0x5b74d6
mov byte [esp + 4], 0x21
lea esp, [esp + 8]
je 0x5c9a43
bsr dx, ax
sub dl, al
aam 4
mov ecx, dword [ebp - 0xc]
jmp 0x5bfa3b
Function at 0x5c2a02
Capabilities:
Enumerate pe sections
Execute anti-debugging instructions

Disassembly:
dec dh
mov dword [ebp - 0x20], ecx
bsf dx, sp
sbb dx, 0xa33b
lea edx, [0xe49ec282]
inc dx
mov edx, dword [ebp - 0x20]
pushal
push 0xb68cda9e
test bl, 0x36
cmp edx, dword [ebp - 0x1c]
push dword [esp + 0xc]
mov byte [esp + 0x10], dl
call fcn.005d35cf
jmp 0x5bdb90
btr ax, 9
das
jmp 0x5d035b
cmc
cmc
sub ecx, ecx
bswap cx
mov cx, word [eax + 6]
cmp cl, bh
cmp dword [ebp - 0x10], ecx
jmp 0x5d2b7c
sub ecx, 0xd1b458f2
pushfd
call fcn.005d1571
lea esp, [esp + 0x10]
je 0x5c2a2f
or ah, ah
lahf
mov edx, dword [ebp + 0x14]
adc eax, 0x70cfaa13
setbe ch
mov eax, dword [edx]
sal dl, cl
test dl, dl
mov dword [ebp - 0x10], eax
cmp ax, 0x174f
and dh, 0xe8
mov ecx, dword [ebp - 4]
shl dl, cl
mov edx, dword [ecx + 0xc]
call fcn.005ca2d8
lea esp, [esp + 0x24]
call 0x5a1deb
pushfd
add esp, 8
push esp
aas
mov ecx, dword [ebp + 8]
ror ax, cl
sbb ah, bh
setae dl
sub ah, ah
mov edx, dword [ebp + 8]
rcr al, 6
shr al, cl
bsr eax, esp
sar al, cl
sub edx, dword [ecx + 8]
inc ch
sub ch, 0x87
cwde
mov dword [ebp - 0x1c], edx
aaa
rcr eax, 0x1f
movsx dx, al
mov eax, dword [ebp + 0xc]
mov dx, 0x4994
shld cx, si, cl
jmp 0x5cf9d8
mov dword [ebp - 0x14], eax
cdq
or cl, 0x91
mov ecx, dword [ebp - 0x14]
bts dx, 9
das
rdtsc
xadd dx, ax
mov dword [ebp - 0xc], ecx
btr ax, bp
sal ax, cl
cwde
mov edx, dword [ebp - 0xc]
cmc
clc
mov eax, dword [ebp - 0xc]
shl cl, 4
add eax, dword [edx + 0x3c]
adc ecx, esi
rcl cx, 1
movsx cx, cl
mov dword [ebp - 8], eax
aad 0x3f
rcl cx, cl
dec al
cwde
mov ecx, dword [ebp - 8]
daa
daa
bswap eax
dec ah
xor edx, edx
movzx dx, cl
mov dx, word [ecx + 0x14]
lea ecx, [ecx*4 + 0x70378fd3]
mov eax, dword [ebp - 8]
bswap ecx
movzx cx, dl
push esi
pop ecx
lea ecx, [eax + edx + 0x18]
mov byte [esp], bl
pushal
pushfd
pushfd
mov dword [ebp - 4], ecx
mov byte [esp + 8], al
mov dword [ebp - 0x10], 0
pushfd
lea esp, [esp + 0x30]
jmp 0x5b62da
mov eax, dword [ebp - 8]
jo 0x5b40d8
test dh, 0xa7
xor ecx, ecx
rol ch, 2
shld cx, di, cl
mov cx, word [eax + 6]
push 0x24ff290f
cmp dword [ebp - 0x10], ecx
mov dword [esp], eax
lea esp, [esp + 4]
jge 0x5ccdd8
movzx ax, cl
mov edx, dword [ebp - 0x10]
rcr ah, 4
bswap ax
bswap cx
imul edx, edx, 0x28
rol cl, cl
bswap eax
sal al, 1
mov eax, dword [ebp - 4]
shl ch, cl
mov ecx, dword [ebp - 0xc]
cmp sp, 0xfa01
add ecx, dword [eax + edx + 0xc]
jmp 0x5afba8
Function at 0x5c43cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi + 0x6105bb05]
lea esp, [esp + 0x28]
jb 0x5ccd11
pushal
mov byte [esp], 0xfd
xchg dword [esp + 0x20], edi
pushfd
push dword [esp + 0x24]
ret 0x28
lea esp, [esp + 8]
je 0x5bce4d
lea eax, [esp - 0x6a3cf96a]
movzx ax, cl
push ecx
mov eax, 0xc0000001
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
jmp fcn.005d1844
cmp dword [ebp - 8], 0
push edx
lea esp, [esp + 4]
jne 0x5b9504
bswap cx
rdtsc
pushal
mov eax, dword [ebp + 0x1c]
pushfd
xchg dword [esp + 0x20], eax
pop ecx
not cl
mov ecx, dword [ebp + 0x18]
pushal
bswap edx
mov dword [esp + 0x38], ecx
rdtsc
mov edx, dword [ebp + 0x14]
pop eax
push 0xa76995db
push 0x379e5bfd
movsx cx, bl
xchg dword [esp + 0x38], edx
lahf
pushfd
mov eax, dword [ebp + 0x10]
xchg cx, dx
call fcn.005d76a8
jmp 0x5aec4a
jmp 0x5d5776
lea esp, [esp + 0x30]
je 0x5d1958
pushal
stc
push dword [esp + 4]
stc
cmp dword [ebp + 0x18], 4
mov byte [esp], bl
lea esp, [esp + 0x24]
jne 0x5db5a1
pushfd
clc
push eax
cmp dword [ebp + 0x14], 8
jmp 0x5b1a21
pushfd
xchg dword [esp + 4], edi
mov byte [esp], dh
push dword [esp + 4]
ret 8
aam 0x24
daa
mov edx, dword [ebp + 0x10]
aas
btr ecx, ecx
ror ah, cl
mov dword [ebp - 8], edx
bts ax, di
xor ecx, 0xfe518e5c
sub eax, 0x6a56bb09
mov eax, dword [ebp - 8]
xor cl, bh
and cl, 0x75
sal ch, cl
pushal
mov dword [eax], 7
adc ch, 0xaa
shrd ecx, edi, 9
shrd cx, dx, 3
sal ch, cl
mov ecx, dword [ebp - 8]
call fcn.005d897d
stc
mov dword [ebp - 8], 1
cmc
cmp ecx, 0x14e9c889
jmp 0x5bc9bc

Function at 0x5c4a41
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi - 0x4122520c]
push 6
adc byte [ebp + 0x3e08fe94], cl
xor byte [esi + 0x45], ah
add byte [edi + 0x2a6705f0], ah
jae 0x5c4a57
inc eax
dec ebx
cmpsb byte [esi], byte es:[edi]
inc ebp
sub al, 0x9e
test eax, 0xf8b5f3ba
lahf
loop 0x5c4a18
stosd dword es:[edi], eax
cmp al, byte [esi + 0x48913ebd]
xchg byte [ebp + 0x50], bl
xor byte [edi - 0x47902302], dl
dec eax
xchg ebp, eax
das
adc ch, byte [esp + edi*2]
push esi
jne 0x5c4a1e
jb fcn.005c49e2
sub al, 0x81
enter 0xfffffffffffff49d, 0xffffffffffffffad
cld
jmp 0x7d80bffb
Function at 0x10002940
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100029a1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10002984
cmp edi, 2
jb 0x10002984
cmp byte [esi], cl
jne 0x10002984
cmp byte [esi + 1], cl
jne 0x10002984
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1002bca0]
jmp 0x10002955
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1002bca0]
test edi, edi
jne 0x10002955
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100029d0
cmp cl, 0x23
jne 0x100029b7
cmp byte [esi], cl
jne 0x100029b7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1002bca0]
test cl, cl
jne 0x100029a8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002b20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10002b45
push 0x599
push str.C:UsersUserDesktopImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002b52
mov dword [edi], 0
mov edx, 0x1002b99c
mov ecx, esi
call fcn.100029e0
mov esi, eax
test esi, esi
je 0x10002c42
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10002c38
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002c38
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10002c38
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002c38
mov eax, dword [0x10034780]
test eax, eax
je 0x10002bcc
inc dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10002c38
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x10002c1d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10034780]
add esp, 4
test eax, eax
je 0x10002c0a
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10002c2f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100049c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x100049e8
push 0x502
push str.C:UsersUserDesktopImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1002bca0]
sub edi, 1
jne 0x10004a02
mov ecx, dword [0x10034780]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19e4], eax
jne 0x10004a34
mov dword [ecx + 0x19e8], eax
cmp dword [ecx + 0x1a18], eax
jne 0x10004a43
mov byte [ecx + 0x1a1c], 1
pop ebp
ret 4

Function at 0x10007240
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10007259
cmp byte [edi + 0x2d2c], 0
je 0x10007271
push 0xed0
push str.C:UsersUserDesktopImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov al, 0x57
mov esi, 0x1002a329
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x1000729e
cmp byte [esi], al
jne 0x1000729e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x1002bca0]
test al, al
jne 0x10007290
mov esi, dword [edi + 0x2d40]
not edx
mov ecx, dword [edi + 0x2d44]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x10012ab0
mov dword [ebp - 0xc], 0x10012b10
mov dword [ebp - 8], 0x10012be0
cmp esi, ecx
jne 0x10007374
inc esi
test ecx, ecx
je 0x100072f5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x100072fa
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10007374
mov eax, dword [0x10034780]
test eax, eax
je 0x10007312
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2d48]
test eax, eax
je 0x10007368
mov ecx, dword [edi + 0x2d40]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2d48]
add esp, 0xc
test ecx, ecx
je 0x1000735e
mov eax, dword [0x10034780]
test eax, eax
je 0x1000735e
dec dword [eax + 0x374]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi + 0x2d48], ebx
mov dword [edi + 0x2d44], esi
mov eax, dword [edi + 0x2d40]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d48]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2d40]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100082a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x100082df
cmp bl, 0x23
jne 0x100082c1
cmp byte [esi], bl
jne 0x100082c1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x1002bca0]
test bl, bl
jne 0x100082b2
mov ecx, dword [0x10034780]
not eax
mov esi, dword [ecx + 0x19a0]
mov edi, dword [ecx + 0x19a8]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000831e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10008318
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000831a
mov esi, edx
test esi, esi
jne 0x10008300
cmp edi, ebx
je 0x1000832d
cmp dword [edi], eax
jne 0x1000832d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10012210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x10034780]
push edi
cmp byte [esi + 0x2d58], 0
je 0x100122af
cmp dword [esi + 0x2d60], 0
lea edi, [esi + 0x2d64]
je 0x100122a1
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10012259
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100137b0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.10003100
mov edx, dword [edi]
mov ecx, 0x1003477c
push dword [esi + 0x2d60]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d6c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.10003100
pop edi
pop esi
mov esp, ebp
pop ebp
ret