joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cd5c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x180], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404698
xor eax, eax
push ebp
push 0x45cea7
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x45ce7f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 4]
call fcn.0040d054
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 4]
call fcn.00404280
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.00402e0c
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 4]
call fcn.0040423c
push 0x200
push 0x160
lea eax, [ebp - 0x17c]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004046a8
mov esi, eax
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45ce59
lea eax, [ebx + 0xc]
lea edx, [ebp - 0x170]
mov ecx, 0x104
call fcn.00404458
mov dword [ebx + 8], 8
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [0x48b6f4]
mov eax, dword [eax]
call eax
test eax, eax
je 0x45ce59
push 0
push 0xf4240
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.0040541c
mov dword [ebx + 4], eax
push 0
push 0xf4240
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0040541c
mov dword [ebx], eax
mov edx, esi
lea eax, [ebx + 0x44]
mov ecx, 0x104
call fcn.00408f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ce86
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x462c60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x160], edx
mov edi, eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x40706c]
call fcn.00404e88
xor eax, eax
push ebp
push 0x462d6e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x462caa
bt dword [ebp - 4], eax
jae 0x462d3a
lea eax, [ebp - 0x164]
mov edx, ebx
add dl, 0x41
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x164]
lea eax, [ebp - 0x168]
call fcn.00402d0c
mov edx, 0x462d7c
lea eax, [ebp - 0x168]
mov cl, 2
call fcn.00402cdc
lea edx, [ebp - 0x168]
lea eax, [ebp - 0x16c]
call fcn.00402d0c
mov edx, 0x462d80
lea eax, [ebp - 0x16c]
mov cl, 3
call fcn.00402cdc
lea edx, [ebp - 0x16c]
lea eax, [ebp - 0x160]
call fcn.0040444c
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
call fcn.0045cd5c
lea edx, [ebp - 0x15c]
mov eax, edi
mov si, 0xfffd
call fcn.004035f4
inc ebx
cmp ebx, 0x1a
jne 0x462c9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462d75
lea eax, [ebp - 0x160]
call fcn.004041e8
lea eax, [ebp - 0x15c]
mov edx, dword [0x40706c]
call fcn.00404f58
ret
Function at 0x4876c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4876d0
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4877fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004041e8
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402b54
mov eax, dword [ebp - 0x18]
call fcn.004046a8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4877e0
mov eax, ebx
call fcn.0040271c
mov esi, eax
push esi
push ebx
push 0
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402b54
mov eax, dword [ebp - 0x1c]
call fcn.004046a8
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x48780c
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 8]
shr edx, 0x10
mov word [ebp - 2], dx
mov dx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 4], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 6], dx
mov ax, word [eax + 0xc]
and ax, 0xffff
mov word [ebp - 8], ax
mov edx, ebx
mov eax, esi
call fcn.0040273c
lea edx, [ebp - 0x20]
movzx eax, word [ebp - 2]
call fcn.004083ec
push dword [ebp - 0x20]
push 0x487818
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 4]
call fcn.004083ec
push dword [ebp - 0x24]
push 0x487818
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 6]
call fcn.004083ec
push dword [ebp - 0x28]
push 0x487818
lea edx, [ebp - 0x2c]
movzx eax, word [ebp - 8]
call fcn.004083ec
push dword [ebp - 0x2c]
mov eax, edi
mov edx, 7
call fcn.00404568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487802
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.0040420c
ret
Function at 0x48781c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404698
mov eax, dword [ebp - 8]
call fcn.00404698
xor eax, eax
push ebp
push 0x487927
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x4c]
mov edx, 0x44
call fcn.00406c58
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
sub bl, 1
jb 0x487879
je 0x487881
dec bl
je 0x487889
jmp 0x48788f
mov word [ebp - 0x1c], 1
jmp 0x48788f
mov word [ebp - 0x1c], 2
jmp 0x48788f
mov word [ebp - 0x1c], 0
mov edx, dword [ebp - 4]
mov eax, 0x487940
call fcn.00404790
test eax, eax
je 0x4878ba
push 0x48794c
push dword [ebp - 4]
push 0x48794c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404568
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 4]
push 0x487940
push dword [ebp - 8]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.00404568
mov eax, dword [ebp - 0x60]
call fcn.004046a8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4878ff
mov esi, dword [ebp - 0x5c]
jmp 0x487904
call fcn.0040da14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48792e
lea eax, [ebp - 0x60]
call fcn.004041e8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040420c
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0xbe63048
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42f314
mov ecx, 0x1ddb054a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4014b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456b90
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x466040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
push 0x30
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push esi
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call sub.VCRUNTIME140.dll_memset
lea edi, [esi + 0x40]
add esp, 0xc
lea eax, [edi + 0x10]
mov dword [ebp - 0x10], edi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov ecx, dword [eax + 4]
test ecx, ecx
jns 0x4015a8
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.0041c040
lea eax, [edi + 0x10]
mov dword [eax], 0
xorps xmm0, xmm0
mov dword [edi + 0x2c], 0
mov eax, esi
mov dword [edi + 0x30], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x88], 0
movups xmmword [esi + 0x78], xmm0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4025e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x402641
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x402624
cmp edi, 2
jb 0x402624
cmp byte [esi], cl
jne 0x402624
cmp byte [esi + 1], cl
jne 0x402624
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x45aef0]
jmp 0x4025f5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x45aef0]
test edi, edi
jne 0x4025f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x402670
cmp cl, 0x23
jne 0x402657
cmp byte [esi], cl
jne 0x402657
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x45aef0]
test cl, cl
jne 0x402648
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x402810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x402823
mov dword [ebx], 0
mov edx, 0x45aa90
call fcn.00402680
mov esi, eax
test esi, esi
je 0x402943
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x402939
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x402939
push esi
call edi
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x402939
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x402939
mov ecx, edi
call fcn.00407210
mov dword [ebp + 8], eax
test eax, eax
je 0x402939
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x402922
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [0x466af0]
add esp, 4
test ecx, ecx
je 0x40290f
movsx edx, word [ecx + 0x2508]
lea eax, [ecx + 0x250c]
mov esi, dword [ecx + 0x1230]
lea eax, [eax + edx*8]
cmp dword [eax], esi
je 0x402905
lea eax, [edx + 1]
mov edi, 6
cdq
idiv edi
movzx eax, dx
mov word [ecx + 0x2508], ax
cwde
lea eax, [eax*8 + 0x250c]
add eax, ecx
xor edx, edx
mov dword [eax], esi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x2504]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x402931
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x410ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x466040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xf4]
mov ebx, dword [edi + 0xfc]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x45aef0]
sub esi, 1
jne 0x410b10
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x1304], ebx
jne 0x410b47
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0041b540
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004550f4
mov esp, ebp
pop ebp
ret 4
Function at 0x4139b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
or edx, 0xffffffff
mov al, 0x23
push ebx
push esi
push edi
mov edi, dword [0x466af0]
mov esi, 0x45a681
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x4139de
cmp byte [esi], al
jne 0x4139de
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x45aef0]
test al, al
jne 0x4139d0
not edx
mov ecx, edx
call fcn.0040a710
cmp byte [edi + 0xd4], 0
je 0x413a1a
test eax, eax
je 0x413a1a
cmp byte [eax + 0xbb], 0
je 0x413a1a
mov bl, 1
jmp 0x413a1c
xor bl, bl
movss xmm3, dword [0x460654]
lea eax, [ebp - 0x24]
movss xmm1, dword [edi + 0xcbc]
lea ecx, [edi + 0x1d20]
movss xmm2, dword [0x4605f4]
movaps xmm0, xmm3
subss xmm0, xmm1
mov dword [ebp - 0x24], 4
push eax
mulss xmm0, xmm2
addss xmm0, xmm1
movss xmm1, dword [edi + 0xcc0]
movss dword [ebp - 0x10], xmm0
xorps xmm0, xmm0
subss xmm0, xmm1
mulss xmm0, xmm2
addss xmm0, xmm1
movss xmm1, dword [edi + 0xcc4]
movss dword [ebp - 0xc], xmm0
xorps xmm0, xmm0
subss xmm0, xmm1
mulss xmm0, xmm2
addss xmm0, xmm1
movss dword [ebp - 8], xmm0
movss xmm0, dword [edi + 0xcc8]
subss xmm3, xmm0
mulss xmm3, xmm2
addss xmm3, xmm0
movups xmm0, xmmword [edi + 0xcbc]
movups xmmword [ebp - 0x20], xmm0
movss dword [ebp - 4], xmm3
call fcn.0041be30
cmp dword [edi + 0x1d1c], 4
je 0x413ace
movups xmm0, xmmword [ebp - 0x10]
movups xmmword [edi + 0xcbc], xmm0
test bl, bl
je 0x413b15
mov edx, dword [0x466af0]
or dword [edx + 0x1cb0], 1
mov eax, dword [edi + 0x2448]
mov ecx, dword [edi + 0x244c]
mov dword [edx + 0x1cc0], eax
mov dword [edx + 0x1cc4], ecx
mov dword [edx + 0x1cc8], 0
mov dword [edx + 0x1ccc], 0
mov dword [edx + 0x1cb4], 1
push 0x200016f
xor edx, edx
mov ecx, str.Tooltip_Error
call fcn.0040d4c0
add esp, 4
mov ecx, 1
mov bl, al
call fcn.00402e80
test bl, bl
je 0x413be9
mov ecx, dword [edi + 0x12c4]
cmp word [ecx + 0xc8], 1
jne 0x413bee
mov esi, dword [0x466af0]
mov eax, dword [esi + 0x12c4]
mov byte [eax + 0xbc], 1
mov eax, dword [esi + 0x12c4]
cmp byte [eax + 0xbf], 0
jne 0x413baa
mov ecx, str.MESSAGE_FROM_DEAR_IMGUI
mov esi, ecx
cmp esi, 0xffffffff
jae 0x413b96
nop
mov dl, byte [ecx]
test dl, dl
je 0x413b96
cmp dl, 0x23
jne 0x413b90
cmp byte [ecx + 1], dl
je 0x413b96
inc ecx
cmp ecx, 0xffffffff
jb 0x413b80
push ecx
xorps xmm3, xmm3
mov edx, esi
call fcn.004379d0
mov esi, dword [0x466af0]
add esp, 4
mov ecx, dword [edi + 0x12c4]
call fcn.00410040
mov ecx, dword [edi + 0x12c4]
call fcn.0040ffd0
mov eax, dword [esi + 0x12c4]
movss xmm0, dword [eax + 0x18]
movss xmm1, dword [eax + 0x1c]
mov al, bl
movss dword [edi + 0x2448], xmm0
movss dword [edi + 0x244c], xmm1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040fda0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2414], 0
lea esi, [edi + 0x2418]
je 0x419ef2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x419eac
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041c460
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00402ce0
mov edx, dword [esi]
mov ecx, 0x466aec
push dword [edi + 0x2414]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2420]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00402ce0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a370
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x466af0]
test bl, bl
je 0x41a3b6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x41a397
cmp byte [esi], bl
jne 0x41a397
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x45aef0]
test bl, bl
jne 0x41a388
mov edi, dword [0x466af0]
mov ecx, dword [edi + 0x23ac]
not eax
mov edx, dword [edi + 0x23b4]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x41a3dd
cmp dword [edx + 4], eax
je 0x41a3e0
add edx, 0x24
cmp edx, ecx
jne 0x41a3d1
xor eax, eax
ret
mov eax, edx
ret
Function at 0x42d190
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x466040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x466af0]
lea eax, [ebp - 0xc]
mov ebx, ecx
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42d34b
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x42d34b
push edi
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [0x466af0]
add esp, 4
mov edi, eax
test ecx, ecx
je 0x42d239
movsx edx, word [ecx + 0x2508]
lea eax, [ecx + 0x250c]
mov ebx, dword [ecx + 0x1230]
lea eax, [eax + edx*8]
cmp dword [eax], ebx
je 0x42d22c
lea eax, [edx + 1]
mov dword [ebp - 0x20], 6
cdq
idiv dword [ebp - 0x20]
movzx eax, dx
mov word [ecx + 0x2508], ax
cwde
lea eax, [eax*8 + 0x250c]
add eax, ecx
xor edx, edx
mov dword [eax], ebx
mov dword [eax + 4], edx
inc word [eax + 4]
inc dword [ecx + 0x2500]
mov ebx, dword [ebp - 0x18]
test edi, edi
je 0x42d24c
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x42d24e
xor edi, edi
or dword [esi + 0xc], 6
mov dword [esi + 0x84], edi
mov dword [esi + 0x7c], str.imgui_impl_win32
mov dword [edi], ebx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
mov esi, dword [esi + 0x84]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42d2a9
mov dword [esi], eax
mov eax, dword [0x466af0]
xor esi, esi
mov dword [ebp - 0x34], str.xinput1_4.dll
mov dword [ebp - 0x30], str.xinput1_3.dll
mov dword [ebp - 0x2c], str.xinput9_1_0.dll
mov eax, dword [eax + 0x1d94]
mov dword [ebp - 0x28], str.xinput1_2.dll
mov dword [ebp - 0x24], str.xinput1_1.dll
mov ecx, dword [eax]
mov eax, dword [edi]
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x28], eax
mov byte [edi + 0x29], 1
nop word [eax + eax]
push dword [ebp + esi*4 - 0x34]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x42d319
inc esi
cmp esi, 5
jl 0x42d2f0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004550f4
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004550f4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.004550f4
mov esp, ebp
pop ebp
ret
Function at 0x441c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov edi, dword [0x466af0]
mov ebx, dword [edi + 0x12c4]
cmp byte [ebx + 0xbf], 0
jne 0x441d92
mov esi, dword [edi + 0x209c]
test esi, esi
jne 0x441cc3
mov ecx, str.Mismatched_BeginTabBar___EndTabBar___
pop edi
pop esi
pop ebx
jmp fcn.004134a0
cmp byte [esi + 0x73], 0
je 0x441cd0
mov ecx, esi
call fcn.00441da0
cmp byte [esi + 0x74], 0
jne 0x441cf4
cmp dword [esi + 0x20], 0
je 0x441cf4
mov eax, dword [esi + 0x28]
inc eax
cmp eax, dword [edi + 0x1230]
jl 0x441cf4
movss xmm1, dword [esi + 0x40]
addss xmm1, dword [esi + 0x38]
jmp 0x441d13
movss xmm1, dword [esi + 0x38]
movss xmm0, dword [ebx + 0x104]
subss xmm0, xmm1
maxss xmm0, dword [esi + 0x3c]
movss dword [esi + 0x3c], xmm0
addss xmm1, xmm0
movss dword [ebx + 0x104], xmm1
cmp byte [esi + 0x72], 1
jle 0x441d39
mov eax, dword [esi + 0x88]
mov ecx, dword [esi + 0x8c]
mov dword [ebx + 0x100], eax
mov dword [ebx + 0x104], ecx
or eax, 0xffffffff
test dword [esi + 0x10], 0x100000
mov word [esi + 0x78], ax
jne 0x441d4e
call fcn.00410bf0
mov eax, dword [edi + 0x20c0]
add eax, 0xffffffff
mov dword [edi + 0x20c0], eax
jne 0x441d6b
xor ecx, ecx
mov dword [edi + 0x209c], ecx
pop edi
pop esi
pop ebx
ret
mov edx, dword [edi + 0x20c8]
mov ecx, dword [edx + eax*8 - 8]
test ecx, ecx
jne 0x441d8c
imul ecx, dword [edx + eax*8 - 4], 0x9c
mov eax, dword [0x466af0]
add ecx, dword [eax + 0x20a8]
mov dword [edi + 0x209c], ecx
pop edi
pop esi
pop ebx
ret
Function at 0x4472a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4576cd
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x466040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x40
lea eax, [ebp - 0x68]
mov dword [ebp - 0x6c], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x4472ec
mov eax, dword [esi]
push 0
push 0
push dword [esi + 0x10]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x80], eax
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.0044d610
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
mov ecx, dword [esi + 0x10]
cmova eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 0xf
jbe 0x447339
mov esi, dword [esi]
push dword [ebp - 0x80]
push eax
push ecx
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
push ecx
cmova eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x6c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x447391
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x78]
call esi
jmp 0x4473ae
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, 0x45facc
call fcn.0044cc00
push 0x44ce20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x4473ea
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4473e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4473e0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00455225
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004550f4
mov esp, ebp
pop ebp
ret