joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ebc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1f], 0
je 0x1000ec99
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x100b0820]
movaps xmm1, xmmword [0x100b17b0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x100b17c0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x100b17d0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x100b17e0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x7d]
inc eax
xor byte [edx], cl
cmp eax, 0x1e
jb 0x1000ec87
mov byte [esi + 0x1f], 0
mov eax, esi
pop esi
ret

Function at 0x1000eca0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x1000ed79
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x100b0820]
movaps xmm1, xmmword [0x100b17b0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x100b17c0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x100b17d0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x100b17e0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x7d]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x1000ed67
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret
Function at 0x1000ed80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x1000ee59
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x100b0820]
movaps xmm1, xmmword [0x100b17b0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x100b17c0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x100b17d0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x100b17e0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x7d]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x1000ee47
mov byte [esi + 0x16], 0
pop esi
ret

Function at 0x1000ee60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1f], 0
je 0x1000ef39
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x100b0820]
movaps xmm1, xmmword [0x100b17b0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x100b17c0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x100b17d0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x100b17e0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x7d]
inc eax
xor byte [edx], cl
cmp eax, 0x1e
jb 0x1000ef27
mov byte [esi + 0x1f], 0
pop esi
ret
Function at 0x10010c60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10010cc1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10010ca4
cmp edi, 2
jb 0x10010ca4
cmp byte [esi], cl
jne 0x10010ca4
cmp byte [esi + 1], cl
jne 0x10010ca4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10095830]
jmp 0x10010c75
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10095830]
test edi, edi
jne 0x10010c75
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10010cf0
cmp cl, 0x23
jne 0x10010cd7
cmp byte [esi], cl
jne 0x10010cd7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10095830]
test cl, cl
jne 0x10010cc8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10012f30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c4], 0
jg 0x10012f57
push 0x4e3
push str.C:Users1_source_reposgamesnusSnusHack_RemasteredSnusHack_RemasteredImGuiimgui.h
push str.Size___0
call fcn.1006e577
add esp, 0xc
mov ecx, dword [esi + 0x1c4]
mov edi, 4
mov eax, dword [esi + 0x1cc]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10095830]
sub edi, 1
jne 0x10012f71
mov ecx, dword [0x100bb5a0]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19d0], eax
jne 0x10012fa3
mov dword [ecx + 0x19d4], eax
cmp dword [ecx + 0x19fc], eax
jne 0x10012fb2
mov byte [ecx + 0x1a00], 1
pop ebp
ret 4

Function at 0x100153a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x100153b9
cmp byte [edi + 0x2cf4], 0
je 0x100153d0
push 0xe95
push str.C:Users1_source_reposgamesnusSnusHack_RemasteredSnusHack_RemasteredImGuiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call fcn.1006e577
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x100abd01
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax + eax]
cmp al, 0x23
jne 0x100153fe
cmp byte [esi], al
jne 0x100153fe
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10095830]
test al, al
jne 0x100153f0
mov esi, dword [edi + 0x2d08]
not edx
mov ecx, dword [edi + 0x2d0c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x10021670
mov dword [ebp - 0xc], 0x100216d0
mov dword [ebp - 8], 0x100217a0
cmp esi, ecx
jne 0x100154d2
inc esi
test ecx, ecx
je 0x10015455
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1001545a
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x100154d2
mov eax, dword [0x100bb5a0]
test eax, eax
je 0x10015472
inc dword [eax + 0x370]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call fcn.1006e5f8
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2d10]
test eax, eax
je 0x100154c6
mov ecx, dword [edi + 0x2d08]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call fcn.1005e8e0
mov ecx, dword [edi + 0x2d10]
add esp, 0xc
test ecx, ecx
je 0x100154bd
mov eax, dword [0x100bb5a0]
test eax, eax
je 0x100154bd
dec dword [eax + 0x370]
push ecx
call fcn.10069065
add esp, 4
mov dword [edi + 0x2d10], ebx
mov dword [edi + 0x2d0c], esi
mov eax, dword [edi + 0x2d08]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d10]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2d08]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016bc0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10016bff
cmp bl, 0x23
jne 0x10016be1
cmp byte [esi], bl
jne 0x10016be1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10095830]
test bl, bl
jne 0x10016bd2
mov ecx, dword [0x100bb5a0]
not eax
mov esi, dword [ecx + 0x199c]
mov edi, dword [ecx + 0x19a4]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10016c3e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10016c38
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10016c3a
mov esi, edx
test esi, esi
jne 0x10016c20
cmp edi, ebx
je 0x10016c4d
cmp dword [edi], eax
jne 0x10016c4d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1001c350
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100bb5a0]
push ebx
push esi
push edi
mov esi, dword [eax + 0x19ac]
add esi, 0x1c4
mov dword [ebp - 4], ecx
cmp dword [esi], 0
jg 0x1001c387
push 0x4e3
push str.C:Users1_source_reposgamesnusSnusHack_RemasteredSnusHack_RemasteredImGuiimgui.h
push str.Size___0
call fcn.1006e577
add esp, 0xc
mov eax, dword [esi]
lea edx, [ebp - 4]
mov ebx, dword [esi + 8]
mov edi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop word [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10095830]
sub edi, 1
jne 0x1001c3a0
mov ecx, dword [esi + 4]
not ebx
mov edi, dword [esi]
cmp edi, ecx
jne 0x1001c3e7
inc edi
test ecx, ecx
je 0x1001c3d5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1001c3da
mov eax, 8
cmp eax, edi
mov ecx, esi
cmovg edi, eax
push edi
call fcn.100220f0
mov ecx, dword [esi]
mov eax, dword [esi + 8]
pop edi
mov dword [eax + ecx*4], ebx
inc dword [esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100213f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [0x100bb5a0]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 0
mov edi, dword [esi + 0x2d14]
mov ecx, dword [esi + 0x2d18]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 8], 0
cmp edi, ecx
jne 0x100214dd
inc edi
test ecx, ecx
je 0x10021456
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1002145b
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x100214dd
test esi, esi
je 0x1002146e
inc dword [esi + 0x370]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call fcn.1006e5f8
mov ebx, eax
add esp, 4
mov eax, dword [esi + 0x2d1c]
test eax, eax
je 0x100214ce
mov ecx, dword [esi + 0x2d14]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call fcn.1005e8e0
mov ecx, dword [esi + 0x2d1c]
add esp, 0xc
test ecx, ecx
je 0x100214c5
mov eax, dword [0x100bb5a0]
test eax, eax
je 0x100214c5
dec dword [eax + 0x370]
push ecx
call fcn.10069065
add esp, 4
mov dword [esi + 0x2d1c], ebx
mov ebx, dword [ebp - 4]
mov dword [esi + 0x2d18], edi
mov eax, dword [esi + 0x2d14]
mov ecx, dword [esi + 0x2d1c]
movups xmm0, xmmword [ebp - 0x20]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [ebp - 8]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [ebp - 0x10]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2d14]
cmp dword [esi + 0x2d14], 0
jg 0x10021532
push 0x4e3
push str.C:Users1_source_reposgamesnusSnusHack_RemasteredSnusHack_RemasteredImGuiimgui.h
push str.Size___0
call fcn.1006e577
add esp, 0xc
mov eax, dword [esi + 0x2d14]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2d1c]
mov esi, ebx
lea edi, [eax + ecx*4]
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10021550
mov eax, dword [0x100bb5a0]
sub esi, ecx
test eax, eax
je 0x10021568
inc dword [eax + 0x370]
inc esi
push esi
call fcn.1006e5f8
push esi
push ebx
push eax
call fcn.1005e8e0
mov dword [edi - 0x1c], eax
lea esi, [ebx + 1]
mov al, byte [ebx]
add esp, 0x10
or edx, 0xffffffff
test al, al
je 0x100215b7
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x1002159e
cmp byte [esi], al
jne 0x1002159e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10095830]
test al, al
jne 0x10021590
not edx
lea eax, [edi - 0x1c]
mov dword [edi - 0x18], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003eb90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
cmp byte [ebp + 0xc], 0
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmovne esi, edi
test esi, esi
jne 0x1003ebb9
mov byte [ebp - 8], 0
jmp 0x1003ebd9
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call fcn.1005e8e0
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x1003ec03
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003ec10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x1003ec5e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 1]
movzx eax, cl
sub eax, 0xe8
je 0x1003ece1
sub eax, 1
je 0x1003ece1
sub eax, 0x16
jne 0x1003ecd2
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.100407d0
add esp, 4
cmp al, 0x15
je 0x1003ec8b
cmp al, 0x25
jne 0x1003ecd2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov esi, dword [esi]
test eax, eax
je 0x1003ecc5
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov ecx, dword [esi]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x1003ed1f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 4]
add eax, ecx
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ed30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.1003ec10
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
test eax, eax
je 0x1003ed8a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
inc esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
lea eax, [esi + 4]
sub edi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x1003edca
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ff60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x1003ffda
movups xmm4, xmmword [0x100b0820]
push ebx
push esi
mov eax, 0xffffffa8
mov ebx, 2
nop dword [eax]
lea ecx, [eax - 1]
movd xmm2, eax
lea esi, [eax - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [eax - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + eax + 0x58]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + eax + 0x58], xmm3
add eax, 4
sub ebx, 1
jne 0x1003ff80
pop esi
pop ebx
mov byte [edi + 9], 0
mov eax, edi
pop edi
ret
Function at 0x100400c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008651b
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x100b8180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x38]
mov dword [esi], 0
mov byte [esi + 6], 0
mov dword [esi + 8], 0
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov dword [ebp - 0x34], 0x1000a020
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
call fcn.10040490
mov ecx, eax
lea eax, [ebp - 0x38]
push ecx
push eax
lea eax, [ecx + 0x1c]
push eax
call fcn.10040610
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10040146
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
push eax
call edx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov dword [ebp - 0x5c], 0x1000c850
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 1
call fcn.10040490
mov ecx, eax
lea eax, [ebp - 0x60]
push ecx
push eax
lea eax, [ecx + 0x1c]
push eax
call fcn.10040610
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x1004018d
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x60]
cmp ecx, eax
setne al
push eax
call edx
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov dword [ebp - 0x84], 0x1000e190
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 2
call fcn.10040490
mov ecx, eax
lea eax, [ebp - 0x88]
push ecx
push eax
lea eax, [ecx + 0x1c]
push eax
call fcn.10040610
mov ecx, dword [ebp - 0x64]
test ecx, ecx
je 0x100401e3
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x88]
cmp ecx, eax
setne al
push eax
call edx
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov dword [ebp - 0xac], 0x1000c080
mov dword [ebp - 0x8c], eax
mov dword [ebp - 4], 3
call fcn.10040490
mov ecx, eax
lea eax, [ebp - 0xb0]
push ecx
push eax
lea eax, [ecx + 0x1c]
push eax
call fcn.10040610
mov ecx, dword [ebp - 0x8c]
test ecx, ecx
je 0x10040240
mov edx, dword [ecx]
lea eax, [ebp - 0xb0]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push 0
push 0
push 0
push 0x10040050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005cac0
mov esp, ebp
pop ebp
ret

Function at 0x10040280
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x100402a2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x5b]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x10040290
mov byte [esi + 8], 0
pop esi
ret

Function at 0x100402b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x100402d2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x5b]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x100402c0
mov byte [esi + 7], 0
pop esi
ret
Function at 0x100402e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edi, 5
jbe 0x10040307
push 0x53
push str.C:Users1_source_reposDK22Pacplugin_sdkinjectorhooking.hpp
push str.size___bufsize
call fcn.1006e577
add esp, 0xc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov al, byte [ebp + 0x10]
lea ecx, [ebx + 4]
mov esi, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
xor ecx, ecx
test al, al
mov byte [ebx + 0x14], 1
mov dword [ebx + 0xc], esi
cmovne ecx, edi
mov dword [ebx + 0x10], edi
mov byte [ebx + 0x15], al
mov dword [ebp - 0x10], 0
test ecx, ecx
jne 0x1004033d
xor bl, bl
jmp 0x10040356
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
push 0x40
push ecx
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne bl
push edi
push esi
push dword [ebp + 0x10]
mov byte [ebp - 4], bl
call fcn.1005e8e0
add esp, 0xc
test bl, bl
je 0x10040381
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100407d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x10040817
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret