joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x406243
pop dword [ebp - 0x28]
mov eax, 0x406243
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xbcc627cc
sub dword [ebp - 0x38], 0x6e73e281
mov dword [ebp - 0x34], 0xb9c2ed75
add dword [ebp - 0x34], 0x78705ed0
mov dword [ebp - 0x30], 0xba06b744
sub dword [ebp - 0x30], 0x6dba7316
mov dword [ebp - 0x2c], 0x33647fb1
sub dword [ebp - 0x2c], 0x33647fb1
lea eax, [ebp - 0x38]
push eax
mov eax, 0xfe09f95b
add eax, 0x23687a9
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xbb8bf410
add dword [ebp - 0x38], 0xb8e67546
mov dword [ebp - 0x34], 0x93a1e1b
add dword [ebp - 0x34], 0x3832435a
mov dword [ebp - 0x30], 0x148641eb
add dword [ebp - 0x30], 0x4ee92a81
mov dword [ebp - 0x2c], 0xe5231aad
add dword [ebp - 0x2c], 0x1adce553
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xf70e110d
add eax, 0x9326ff3
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3780b
push 0
call eax
mov ecx, 0x49eb
mov esi, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x28]
mov edx, 0x99ae5dd7
sub edx, 0xe4a1abdc
xor dword [ebp - 0x14], edx
mov ebx, dword [edi]
xor dword [ebp - 0x24], eax
sub ebx, edx
xor dword [ebp - 0x20], 0xf5117395
mov dword [esi], ebx
xor dword [ebp - 0x24], 0x79894cd9
add esi, 0x24bcacbf
sub esi, 0x24bcacbb
add edi, 0x2ce9fc75
add edi, 0xd316038f
loop 0x406354
add eax, 0xd039bb93
sub eax, 0xd038a114
xor ebx, ebx
add ebx, eax
add eax, 0xc8fba31b
add eax, 0x37045cea
mov ecx, 0x7099bce5
add ecx, 0x8fa6431b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000983f
pop dword [ebp - 0x18]
mov eax, 0xae7724a
add eax, 0x51925f5
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x38f0f
push 0
mov eax, 0xe506c72e
add eax, 0x2afa7936
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x3873a480
add ecx, 0xc78ca342
xor edi, edi
add edi, eax
mov edx, 0xa73e384d
sub edx, 0x973cb24d
add edx, dword [ebp - 0x18]
mov esi, 0xd7ee2150
mov dword [ebp - 4], 0xc9ca4c80
mov ebx, dword [edx]
sub dword [ebp - 4], 0x6b85c604
xor ebx, esi
add dword [ebp - 8], edx
mov dword [edi], ebx
sub dword [ebp - 0x14], eax
add edi, 0xf89b1c72
add edi, 0x764e392
add edx, 0x7fae024c
sub edx, 0x7fae0248
loop 0x1000989a
add eax, 0xbc9aa340
add eax, 0x43666e9b
xor ebx, ebx
add ebx, eax
add eax, 0x6567697d
sub eax, 0x65676978
mov ecx, 0x1e825f8
sub ecx, 0xf1e825f8
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x417c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4c6b3c]
push ebx
push eax
call sub.WINSPOOL.DRV_StartPagePrinter
lea ecx, [esp + 8]
mov ebx, 1

Function at 0x417c58
Capabilities:
Query or enumerate registry value

Disassembly:
and al, 0x1c
add byte [eax], al
add byte [eax], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [0x4c6b3c]
dec esp
add byte [ebx + 0x4c7f6c], ah
push edx
call dword [sym.imp.GDI32.dll_GetBkMode]
mov dword [esp + 4], eax
and al, 4
mov eax, dword [0x4c7f6c]
test eax, eax
jne fcn.00417cd0
push 0x4c6c4c

Function at 0x417c80
Capabilities:
Query or enumerate registry value

Disassembly:
test eax, eax
je 0x417c8b
xor eax, eax
pop ebx
add esp, 0xc
les ecx, [ebx + eax*8]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
inc esp
and al, 0xc
push eax
lea ecx, [esp + 8]

Function at 0x417c90
Capabilities:
Query or enumerate registry value

Disassembly:
test eax, eax
je 0x417c8b
xor eax, eax
pop ebx
add esp, 0xc
les ecx, [ebx + eax*8]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
inc esp
and al, 0xc
push eax
lea ecx, [esp + 8]

Function at 0x421a30
Capabilities:
Encode data using xor

Disassembly:
int3
and al, 0x72
movsb byte es:[edi], byte [esi]
jge 0x421955
ret
add dl, dl
mov esi, dword [eax]
xchg ebx, eax
test eax, 0x6c406b2e
add ebx, dword [eax + 0x25]
xchg ebx, eax
test dword [ecx], esi
loopne 0x4219cb
sbb eax, dword [edx]
push edi
ror dword [edi + edi*4 - 0x50], 1
mov ebp, 0xb76e138d
nop
push ebx
cmp byte [edx], bh
pop ss
xor edi, ebx
inc ebx
inc ebp
xchg esi, eax
popal
and esi, dword [ecx]
xor eax, dword [ecx + 0x12]
jbe 0x421a73
dec eax
push ebx
sub dword [ebx - 0x11f1eeeb], esi
xor byte [eax + 0x10], al
inc esi
pop esi
shr dword [edx + 0x2d3ff58e], 0xa0
lodsd eax, dword [esi]
bnd jo 0x421a77
sub eax, 0x70f2ada0
dec byte [esi - 0x585ebde2]
jmp 0x421aea
jo 0x421a77
mov ds, word [esi]
inc edx
mov eax, dword [0x336aeba7]
mul byte [edx]
xor ebx, dword [edx + 0x2b]
lea eax, [ebx]
daa
fnsave dword [edx]
push edx
and eax, dword [0x2163fc86]
enter 0x35e7, 0xffffffffffffffde
pop edi
invalid
xlatb
jmp 0x193b51c7

Function at 0x4374cc
Capabilities:
Encode data using xor

Disassembly:
jg 0x43754a
xor eax, 0x448e897f
push cs
call 0x9df5af59
fsubrp st(1)
call 0x91bdb39f
pop eax
mov ecx, edx
sub dword [edi + 7], esi
invalid
xchg edx, eax
mov byte [0x8d2c4248], al
Function at 0x4bab05
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33f8
cmp edx, dword [eax]
je 0x4bab27
add eax, 8
inc ecx
cmp eax, 0x4c3488
jl 0x4bab18
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33f8]
jne 0x4bac55
mov eax, dword [0x4c7f80]
cmp eax, 1
je 0x4bac2f
test eax, eax
jne 0x4bab58
cmp dword [0x4c3324], 1
je 0x4bac2f
cmp edx, 0xfc
je 0x4bac55
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bab8f
lea eax, [ebp - 0x1a4]
push 0x4bfbe0
push eax
call fcn.004bb4f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb980
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4babd2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb980
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfbdc
push edi
call fcn.004bd850
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfbc0
push eax
call fcn.004bb4f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb500
lea eax, [ebp - 0xa0]
push 0x4bfbbc
push eax
call fcn.004bb500
push dword [esi + 0x4c33fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb500
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb94
push eax
call fcn.004bd7c4
add esp, 0x2c
pop edi
jmp 0x4bac55
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33fc]
push 0
push eax
push dword [esi]
call fcn.004bb980
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xa754d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0xa75532
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0xa754f8
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0xa94313
Capabilities:
Authenticate hmac
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 5]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], edx
mov edx, eax
mov eax, dword [esp]
xchg edx, eax
mov edx, ecx
push eax
xchg edx, eax
pop edx
xchg ecx, eax
xchg dword [esp], ecx
xchg ecx, eax
lea esp, [esp + 4]
add dword [esp], 0xffffc1a6
xchg dword [esp], ecx
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x2f]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
pushfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x2e]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add ebp, 0x28
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x52]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
popfd
push esi
mov esi, edx
pop esi
lea ebp, [ebp - 0x28]
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 2]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], ecx
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 2]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
mov esi, esi
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x3b]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], ecx
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x6b]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
xchg edx, eax
mov edx, dword [esp + 4]
push eax
xchg edx, eax
pop edx
lea eax, [eax + 0x10]
mov ecx, ecx
xchg dword [esp + 4], eax
lea ecx, [ecx]
mov dword [esp + 4], eax
mov ecx, ecx
xchg ecx, eax
mov ecx, dword [esp]
push eax
xchg ecx, eax
pop ecx
lea esp, [esp + 4]
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x57]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
popfd
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x36]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg edx, esi
lea esp, [esp - 4]
mov dword [esp], edx
mov edx, esi
mov esi, dword [esp]
xchg esi, edi
mov edi, dword [esp + 4]
push esi
xchg esi, edi
pop edi
lea esi, [esi + 0x4f]
push ebp
mov ebp, esp
leave
xchg dword [esp + 4], esi
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x64]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
mov dword [esp + 4], esi
pushfd
add ebp, 0x34
popfd
lea ebp, [ebp - 0x34]
xchg esi, eax
mov eax, dword [esp]
push esi
xchg esi, eax
pop eax
lea esp, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x58]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
jmp 0xaa7348
call fcn.00aa9e68
xchg dword [eax], edx
jg 0xaa7336
push esi
pop ebx
mov al, byte [0xbcde94d1]
invalid
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1e2c7045
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x21c2719e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402f40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x402fa1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x402f84
cmp edi, 2
jb 0x402f84
cmp byte [esi], cl
jne 0x402f84
cmp byte [esi + 1], cl
jne 0x402f84
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x47afa8]
jmp 0x402f55
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x47afa8]
test edi, edi
jne 0x402f55
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x402fd0
cmp cl, 0x23
jne 0x402fb7
cmp byte [esi], cl
jne 0x402fb7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x47afa8]
test cl, cl
jne 0x402fa8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x403185
push 0x627
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x403192
mov dword [edi], 0
mov edx, 0x47ac9c
mov ecx, esi
call fcn.00402ff0
mov esi, eax
test esi, esi
je 0x403282
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403278
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403278
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x403278
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403278
mov eax, dword [0x48c7f8]
test eax, eax
je 0x40320c
inc dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x403278
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40325d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x48c7f8]
add esp, 4
test eax, eax
je 0x40324a
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x40326f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x405658
push 0x51a
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x47afa8]
sub edi, 1
jne 0x405672
mov ecx, dword [0x48c7f8]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a2c], eax
jne 0x4056a4
mov dword [ecx + 0x1a30], eax
cmp dword [ecx + 0x1a64], eax
jne 0x4056b3
mov byte [ecx + 0x1a68], 1
pop ebp
ret 4

Function at 0x4056c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x4056eb
push 0x51a
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov ecx, dword [esi + 0xbc]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc4]
lea esi, [ebp - 0x10]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x47afa8]
sub edi, 1
jne 0x405750
mov eax, dword [0x48c7f8]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a2c], edx
jne 0x405781
mov dword [eax + 0x1a30], edx
cmp dword [eax + 0x1a64], edx
jne 0x405790
mov byte [eax + 0x1a68], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x407d40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x407d59
cmp byte [edi + 0x2d8c], 0
je 0x407d71
push 0xf7e
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x479099
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x407d9e
cmp byte [esi], al
jne 0x407d9e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x47afa8]
test al, al
jne 0x407d90
mov esi, dword [edi + 0x2da0]
not edx
mov ecx, dword [edi + 0x2da4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x415100
mov dword [ebp - 0xc], 0x415160
mov dword [ebp - 8], 0x415210
cmp esi, ecx
jne 0x407e74
inc esi
test ecx, ecx
je 0x407df5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x407dfa
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x407e74
mov eax, dword [0x48c7f8]
test eax, eax
je 0x407e12
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2da8]
test eax, eax
je 0x407e68
mov ecx, dword [edi + 0x2da0]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2da8]
add esp, 0xc
test ecx, ecx
je 0x407e5e
mov eax, dword [0x48c7f8]
test eax, eax
je 0x407e5e
dec dword [eax + 0x374]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi + 0x2da8], ebx
mov dword [edi + 0x2da4], esi
mov eax, dword [edi + 0x2da0]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2da8]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2da0]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409700
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x40973f
cmp bl, 0x23
jne 0x409721
cmp byte [esi], bl
jne 0x409721
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x47afa8]
test bl, bl
jne 0x409712
mov ecx, dword [0x48c7f8]
not eax
mov esi, dword [ecx + 0x19e8]
mov edi, dword [ecx + 0x19f0]
lea ebx, [edi + esi*8]
test esi, esi
je 0x40977e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x409778
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x40977a
mov esi, edx
test esi, esi
jne 0x409760
cmp edi, ebx
je 0x40978d
cmp dword [edi], eax
jne 0x40978d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x40edb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x48c7f8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x19f8]
add esi, 0xbc
mov dword [ebp - 4], ecx
cmp dword [esi], 0
jg 0x40ede8
push 0x51a
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esi]
lea edx, [ebp - 4]
mov ebx, dword [esi + 8]
mov edi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x47afa8]
sub edi, 1
jne 0x40ee00
mov ecx, dword [esi + 4]
not ebx
mov edi, dword [esi]
cmp edi, ecx
jne 0x40ee47
inc edi
test ecx, ecx
je 0x40ee35
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x40ee3a
mov eax, 8
cmp eax, edi
mov ecx, esi
cmovg edi, eax
push edi
call fcn.00415c80
mov ecx, dword [esi]
mov eax, dword [esi + 8]
pop edi
mov dword [eax + ecx*4], ebx
inc dword [esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret