joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbed0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bed200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbed0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed0c2
add dl, dl
jne 0xbed0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed134
xor eax, eax
add dl, dl
jne 0xbed0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed1d5
add dl, dl
jne 0xbed0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbed12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbed0cd
mov eax, 1
add dl, dl
jne 0xbed142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed139
sub eax, ebx
mov ebx, 1
jne 0xbed180
mov ecx, 1
add dl, dl
jne 0xbed166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbed171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbed197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbed1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed18e
cmp eax, 0x7d00
jae 0xbed1c5
cmp eax, 0x500
jb 0xbed1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed0cd
cmp eax, 0x7f
ja 0xbed1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbed1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbed0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100022c1
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x10045040]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
push 0x20
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ebx, eax
test ebx, ebx
jne 0x100022ed
xor al, al
jmp 0x100023a5
xor eax, eax
push 0x38
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 1
xor esi, esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0x100037d8
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x20]
mov dword [esp + 0x3c], eax
mov ecx, dword [ebx]
push edx
push 0x20
push eax
push 1
push esi
push ebx
mov dword [0x10045d30], eax
call dword [ecx + 0x40]
test eax, eax
je 0x10002380
lea ecx, [esp + 0x10]
xor eax, eax
cmp dword [esp + 0x3c], eax
push ecx
lea ecx, [esp + 0x20]
sete al
push ecx
push 0x20
push dword [esp + 0x44]
mov dword [esp + 0x4c], eax
mov eax, dword [ebx]
push 1
push esi
push ebx
call dword [eax + 0x40]
test eax, eax
jne 0x1000239b
mov edx, dword [esp + 0x10]
mov edi, 0x10045d38
push 0x77
pop ecx
push edx
mov esi, dword [edx]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx]
call dword [eax + 8]
mov byte [esp + 0xc], 1
mov ecx, dword [ebx]
push ebx
call dword [ecx + 8]
mov al, byte [esp + 0xc]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10034bf9
mov esp, ebp
pop ebp
ret

Function at 0x100023b7
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10045040]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [0x10045d2c], 0
and dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x100037d8
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0xc], 0
je 0x100023f9
call fcn.100022c1
test al, al
jne 0x1000240c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x10045d2c], 0
je 0x100023ce
jmp 0x10002449
mov eax, dword [0x10045de0]
push ecx
mov dword [0x10045f14], eax
call fcn.100324dc
mov ecx, dword [0x10045f14]
xor edx, edx
inc edx
call fcn.100326ae
push 0x10002455
push 0xfffffffffffffffc
push dword [0x10045d30]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [0x10045d34], eax
mov byte [0x10045d2c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034bf9
leave
ret
Function at 0x10002924
Capabilities:
Get disk information

Disassembly:
push 0x24c
mov eax, 0x100360a2
call fcn.10035cb4
mov edi, ecx
mov dword [ebp - 0x214], edi
mov ecx, 0xff
mov dword [ebp - 0x214], edi
push ecx
lea eax, [ebp - 0x110]
xor esi, esi
push eax
push esi
push esi
lea eax, [ebp - 0x214]
push eax
push ecx
lea eax, [ebp - 0x210]
push eax
push 0x1003b5b0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [ebp - 0x214]
lea eax, [ebp - 0x258]
push str._.10X
push eax
call fcn.100025d1
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], esi
inc eax
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, [ebp - 0x228]
mov dword [ebx], eax
lea eax, [ebp - 0x240]
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
push dword [ebp - 0x220]
push str._.8X_.8X_.8X
push eax
call fcn.100025d1
mov byte [ebp - 4], 1
lea eax, [ebp - 0x258]
cmp dword [ebp - 0x244], 0xf
lea ecx, [ebp - 0x240]
cmova eax, dword [ebp - 0x258]
cmp dword [ebp - 0x22c], 0xf
push eax
cmova ecx, dword [ebp - 0x240]
push ecx
push 0x1003b5bc
push edi
call fcn.100025d1
add esp, 0x24
lea ecx, [ebp - 0x240]
call fcn.10001abf
lea ecx, [ebp - 0x258]
call fcn.10001abf
mov eax, edi
call fcn.10035c72
ret

Function at 0x10002b1b
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x24
mov eax, 0x10036126
call fcn.10035cb4
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
xor edx, edx
mov dword [ebp - 4], edx
lea edi, [ebp - 0x2c]
xor eax, eax
stosd dword es:[edi], eax
push 0xf
pop ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x2c], dl
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
cmp dword [ebp + 0x1c], ebx
lea eax, [ebp + 8]
mov edi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
cmova eax, dword [ebp + 8]
push ecx
push edx
push 1
push dword [ebp + 0x18]
mov dword [ebp - 0x14], edx
push eax
call edi
test eax, eax
jne 0x10002b7f
mov ecx, esi
push 0x10037454
call fcn.10001b67
jmp 0x10002bd7
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x1c]
ja 0x10002b9a
cmp dword [ebp - 0x18], ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
cmova eax, dword [ebp - 0x2c]
mov byte [eax + ecx], 0
jmp 0x10002ba7
push ecx
sub ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.100049a1
cmp dword [ebp - 0x18], ebx
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x2c]
cmova ecx, dword [ebp - 0x2c]
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], ebx
push ecx
cmova eax, dword [ebp + 8]
push 1
push dword [ebp + 0x18]
push eax
call edi
mov ecx, esi
test eax, eax
je 0x10002b73
lea eax, [ebp - 0x2c]
push eax
call fcn.10001b2e
mov edx, dword [ebp - 0x18]
cmp edx, ebx
jbe 0x10002be7
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.10001cce
and dword [ebp - 0x1c], 0
lea ecx, [ebp + 8]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x2c], 0
call fcn.10001abf
mov eax, esi
call fcn.10035c72
ret
Function at 0x10002c02
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x24
mov eax, 0x10036126
call fcn.10035cb4
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
xor edx, edx
mov dword [ebp - 4], edx
lea edi, [ebp - 0x2c]
xor eax, eax
stosd dword es:[edi], eax
push 0xf
pop ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x2c], dl
push edx
push edx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
cmp dword [ebp + 0x1c], ebx
lea eax, [ebp + 8]
mov edi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
cmova eax, dword [ebp + 8]
push ecx
push edx
push 1
push dword [ebp + 0x18]
mov dword [ebp - 0x14], edx
push eax
call edi
test eax, eax
jne 0x10002c68
mov ecx, esi
push 0x10037454
call fcn.10001b67
jmp 0x10002cc4
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x1c]
ja 0x10002c83
cmp dword [ebp - 0x18], ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
cmova eax, dword [ebp - 0x2c]
mov byte [eax + ecx], 0
jmp 0x10002c90
push ecx
sub ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.100049a1
cmp dword [ebp - 0x18], ebx
lea edx, [ebp - 0x14]
push 0
push 0
push edx
lea ecx, [ebp - 0x2c]
cmova ecx, dword [ebp - 0x2c]
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], ebx
push ecx
cmova eax, dword [ebp + 8]
push 1
push dword [ebp + 0x18]
push eax
call edi
mov ecx, esi
test eax, eax
je 0x10002c5c
lea eax, [ebp - 0x2c]
push eax
call fcn.10001b2e
mov edx, dword [ebp - 0x18]
cmp edx, ebx
jbe 0x10002cd4
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.10001cce
and dword [ebp - 0x1c], 0
lea ecx, [ebp + 8]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x2c], 0
call fcn.10001abf
mov eax, esi
call fcn.10035c72
ret
Function at 0x100030c7
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x20
mov eax, 0x100361b2
call fcn.10035cb4
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], esi
xor eax, eax
push 0xf0000000
xor ecx, ecx
mov dword [ebp - 4], eax
inc ecx
mov dword [ebp - 0x24], eax
push ecx
push eax
push eax
mov bl, al
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10003164
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10003164
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
push 0
push dword [ebp + 0x18]
cmova eax, dword [ebp + 8]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10003164
push 4
call fcn.10034c07
pop ecx
push 0
push eax
mov dword [eax], 0x10
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
cmp dword [ebp - 0x28], 0
je 0x10003173
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x24], 0
je 0x10003184
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, esi
test bl, bl
jne 0x10003196
push 0x10037454
call fcn.10001b67
jmp 0x100031a6
xor eax, eax
lea edx, [ebp - 0x20]
inc eax
push eax
push 0x10
call fcn.10002a22
pop ecx
pop ecx
lea ecx, [ebp + 8]
call fcn.10001abf
mov eax, esi
call fcn.10035c72
ret

Function at 0x100031b6
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036208
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.10035d50
mov eax, dword [0x10045040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2014], esi
xor ebx, ebx
mov dword [ebp - 0x201c], esi
mov dword [ebp - 0x2018], ebx
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_4.0__compatible_
mov dword [ebp - 4], 1
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp dword [ebp + 0x1c], 0xf
mov ecx, eax
push ebx
push ebx
push ebx
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
push ebx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0x2000
mov edi, eax
lea eax, [ebp - 0x2010]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x10003294
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [ebp - 0x2010]
mov ecx, esi
push eax
call fcn.10001b67
push ecx
push dword [ebp - 0x2014]
mov ecx, esi
mov dword [ebp - 0x2018], 1
call fcn.1000452b
lea ecx, [ebp + 8]
call fcn.10001abf
mov eax, esi
jmp 0x1000329c
lea ecx, [ebp + 8]
call fcn.10001abf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10034bf9
leave
ret
Function at 0x100035c4
Capabilities:
Read .ini file

Disassembly:
push 0x44
mov eax, 0x10036297
call fcn.10035cb4
mov esi, edx
mov dword [ebp - 0x50], ecx
mov edi, dword [esi]
mov ebx, dword [esi + 4]
cmp edi, ebx
je 0x100035f1
mov ecx, edi
call fcn.10001abf
add edi, 0x20
cmp edi, ebx
jne 0x100035de
mov eax, dword [esi]
mov dword [esi + 4], eax
mov edi, 0x2000
push edi
call fcn.10034c68
pop ecx
push dword [ebp - 0x50]
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
jmp 0x100036b4
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10001b67
xor edx, edx
lea edi, [ebp - 0x4c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, dword [ebp - 0x1c]
inc ebx
stosd dword es:[edi], eax
add ebx, ecx
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edi
mov byte [ebp - 0x4c], dl
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
push ecx
cmova eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push eax
call fcn.1000490e
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x50]
cmova eax, dword [ebp - 0x2c]
push edi
push 0
push 0x10037548
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [ebp - 0x18], 0xf
push edi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push 0
push 0x1003b608
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x30], eax
mov ecx, esi
lea eax, [ebp - 0x4c]
push eax
call fcn.10001a82
mov edx, dword [ebp - 0x38]
cmp edx, 0xf
jbe 0x100036a8
mov ecx, dword [ebp - 0x4c]
inc edx
call fcn.10001cce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10001abf
cmp byte [ebx], 0
jne 0x1000360f
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 5
test eax, eax
setne al
call fcn.10035c72
ret

Function at 0x1000373e
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x10045f4c]
push 0xa
movzx eax, dx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
xor eax, eax
push eax
push 0x80
push 1
push eax
push eax
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x100037b1
cmp esi, 0xffffffff
je 0x100037b1
push 4
call fcn.10034c07
pop ecx
push 0
push eax
and dword [eax], 0
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003913
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
ret
Function at 0x1000757e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
sub esp, 0x18
lea esi, [ebp - 0x20]
mov ecx, esp
call fcn.10002924
mov dl, 1
mov ecx, esi
call fcn.10002cef
mov esi, dword [ebp - 0x10]
add esp, 0x18
inc esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp dword [ebp - 0xc], 0xf
lea ecx, [ebp - 0x20]
push esi
cmova ecx, dword [ebp - 0x20]
mov edi, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x20]
call fcn.10001abf
pop edi
pop esi
leave
ret

Function at 0x10007e3b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x10045f68], esi
jne 0x10007e65
push esi
push esi
push 0x10045f54
push 0x1000600a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10045f68], eax
call fcn.10007676
movss xmm1, dword [0x10041734]
xorps xmm0, xmm0
call fcn.100131de
call fcn.100077ff
call fcn.1000798c
movss xmm1, dword [0x10041734]
xorps xmm0, xmm0
call fcn.100131de
call fcn.10007b19
call fcn.10007caa
movss xmm1, dword [0x10041734]
xorps xmm0, xmm0
call fcn.100131de
push ecx
push esi
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x43230000
mov ecx, str.habilidades_extra
mov dword [ebp - 4], 0x42aa0000
call fcn.1000e25e
pop ecx
pop ecx
test al, al
je 0x10007f42
movss xmm0, dword [0x1004161c]
call fcn.10012d19
mov esi, 0x10037454
push esi
call fcn.100255e4
movss xmm0, dword [0x1004165c]
pop ecx
call fcn.10012d19
mov edx, 0x10045d2e
mov ecx, str.Detect_Player
call fcn.10026abf
push esi
call fcn.100255e4
pop ecx
mov edx, 0x10065d80
mov ecx, str.Ver_Invisvel
call fcn.10026abf
test al, al
je 0x10007f30
xor ecx, ecx
cmp byte [0x10065d80], cl
sete cl
call fcn.10005ba1
movss xmm0, dword [0x1004164c]
call fcn.10012d19
call fcn.1000e2d3
pop esi
leave
ret

Function at 0x10008fe2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push esi
push edi
push 4
mov esi, ecx
not edx
pop edi
movzx eax, byte [esi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10037698]
inc esi
sub edi, 1
jne 0x10008ff2
pop edi
not edx
pop esi
mov eax, edx
leave
ret
Function at 0x10009012
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov edx, ebx
test edi, edi
je 0x10009076
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x1000903e
cmp edi, 2
jb 0x1000903e
cmp byte [esi], al
jne 0x1000903e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10037698]
test edi, edi
jne 0x10009027
jmp 0x1000907d
cmp al, 0x23
jne 0x10009064
cmp byte [esi], al
jne 0x10009064
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10037698]
mov al, byte [esi]
inc esi
test al, al
jne 0x10009056
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x100091aa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x100091ce
push 0x599
push str.E:Sources_C__ImGui__Git__TrainerTrainerimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x100091d8
and dword [edi], 0
mov edx, 0x1003e4b4
mov ecx, esi
call fcn.10009086
mov esi, eax
test esi, esi
je 0x10009240
mov ecx, esi
call fcn.1000914e
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10009239
mov ecx, ebx
call fcn.1000b704
mov dword [ebp + 8], eax
test eax, eax
je 0x10009239
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov ecx, esi
cmp eax, ebx
je 0x10009229
call fcn.1000913f
mov ecx, dword [ebp + 8]
call fcn.1000b71c
jmp 0x10009240
call fcn.1000913f
test edi, edi
je 0x10009234
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x10009242
mov ecx, esi
call fcn.1000913f
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10016ccf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x10045f74]
push edi
cmp byte [esi + 0x2d58], 0
je 0x10016d45
cmp dword [esi + 0x2d60], 0
lea edi, [esi + 0x2d64]
mov ecx, edi
je 0x10016d39
push 0
call fcn.1001807d
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.1000979c
mov edx, dword [edi]
mov ecx, 0x10045f6d
push dword [esi + 0x2d60]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d6c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x10016d45
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.1000979c
pop edi
pop esi
pop ebp
ret

Function at 0x1001722f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10045f74]
push esi
mov esi, ecx
push edi
and dword [eax + 0x2d30], 0
test esi, esi
je 0x1001727e
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
call fcn.10017282
mov edx, 0x1003e518
mov ecx, esi
mov edi, eax
call fcn.10009086
mov esi, eax
test esi, esi
je 0x1001727e
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, esi
call fcn.1000913f
pop edi
pop esi
leave
ret