joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4902d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x38]
push eax
call edi
test eax, eax
je 0x403ef4
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x34], 0x12
jne 0x403ed2
mov esi, dword [0x495f8c]
test esi, esi
je 0x403ee2
push esi
call fcn.00401ad0
mov esi, dword [esi]
add esp, 4
test esi, esi
jne 0x403ec1
jmp 0x403ee2
lea ecx, [ebp - 0x38]
push ecx
call ebx
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x38]
push eax
call edi
test eax, eax
jne 0x403eb1
mov edi, dword [0x495f90]
test edi, edi
je 0x403fce
call fcn.004025f0
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov dword [ebp - 0x18], eax
call ebx
movzx esi, ax
push 0xa1
shr esi, 0xf
call ebx
movzx ebx, ax
shr ebx, 0xf
test esi, esi
jne 0x403f4b
cmp byte [edi + 0x1d0], 1
jne 0x403f4b
mov ecx, dword [ebp - 0x18]
push ecx
push esi
push esi
push 0x154
push edi
call fcn.004010e0
add esp, 0x14
test ebx, ebx
jne 0x403f6c
cmp byte [edi + 0x1d4], 1
jne 0x403f6c
mov edx, dword [ebp - 0x18]
push edx
push ebx
push ebx
push 0x158
push edi
call fcn.004010e0
add esp, 0x14
cmp dword [edi + 0x70], 0x34003
jne 0x403fce
mov ecx, dword [edi + 0x258]
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [edi + 0x26c], eax
jne 0x403fab
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp dword [edi + 0x270], eax
je 0x403fce
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x18], eax
sub esp, 0x10
fild dword [ebp - 0x18]
fstp qword [esp + 8]
fild dword [ebp - 0x1c]
fstp qword [esp]
push edi
call fcn.00402e70
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004725e9
mov esp, ebp
pop ebp
ret

Function at 0x404100
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x494900], 0
jne 0x404164
push 0xc38
push 0
push 0x495ee0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.004081f0
test eax, eax
jne 0x40412e
call fcn.00408280
xor eax, eax
ret
call fcn.004084b0
push 0x495f98
call fcn.004071c0
add esp, 4
mov dword [0x495f94], eax
mov dword [0x494900], 1
call fcn.00405da0
mov dword [0x495fa0], eax
mov dword [0x495fa4], edx
call fcn.00401b00
mov eax, 1
ret
Function at 0x406260
Capabilities:
Link many functions at runtime

Disassembly:
push 0x474e20
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x496728], eax
test eax, eax
jne 0x406289
push str.WGL:_Failed_to_load_opengl32.dll
push 0x10008
call fcn.00404080
add esp, 8
xor eax, eax
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.wglCreateContext
push eax
call esi
mov dword [0x49672c], eax
mov eax, dword [0x496728]
push str.wglDeleteContext
push eax
call esi
mov ecx, dword [0x496728]
push 0x474dc0
push ecx
mov dword [0x496730], eax
call esi
mov edx, dword [0x496728]
push str.wglMakeCurrent
push edx
mov dword [0x496734], eax
call esi
mov dword [0x496738], eax
mov eax, dword [0x496728]
push str.wglShareLists
push eax
call esi
mov dword [0x49673c], eax
mov eax, 1
pop esi
ret

Function at 0x406a80
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x496b14], eax
cmp eax, 0xffffffff
jne 0x406aa5
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.00404080
add esp, 8
xor eax, eax
ret
mov eax, 1
mov dword [0x496b10], eax
ret
Function at 0x407a80
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.winmm.dll
call esi
xor edi, edi
mov dword [0x4966e8], eax
cmp eax, edi
jne 0x407aba
push str.Win32:_Failed_to_load_winmm.dll
push 0x10008
call fcn.00404080
add esp, 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push eax
call ebx
push str.user32.dll
mov dword [0x4966ec], eax
call esi
mov dword [0x496708], eax
cmp eax, edi
jne 0x407af9
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.00404080
add esp, 8
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push str.SetProcessDPIAware
push eax
call ebx
mov dword [0x49670c], eax
mov eax, dword [0x496708]
push str.ChangeWindowMessageFilterEx
push eax
call ebx
push str.dinput8.dll
mov dword [0x496710], eax
call esi
mov dword [0x4966f0], eax
cmp eax, edi
je 0x407b35
push str.DirectInput8Create
push eax
call ebx
mov dword [0x4966f4], eax
mov eax, str.xinput1_4.dll
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], str.xinput1_3.dll
mov dword [ebp - 0x10], str.xinput9_1_0.dll
mov dword [ebp - 0xc], str.xinput1_2.dll
mov dword [ebp - 8], str.xinput1_1.dll
mov dword [ebp - 4], edi
lea esp, [esp]
push eax
call esi
mov dword [0x4966fc], eax
test eax, eax
jne 0x407b77
mov eax, dword [ebp + edi*4 - 0x14]
inc edi
test eax, eax
jne 0x407b60
jmp 0x407b97
push str.XInputGetCapabilities
push eax
call ebx
mov ecx, dword [0x4966fc]
push str.XInputGetState
push ecx
mov dword [0x496700], eax
call ebx
mov dword [0x496704], eax
push str.dwmapi.dll
call esi
mov dword [0x496714], eax
test eax, eax
je 0x407bc7
push str.DwmIsCompositionEnabled
push eax
call ebx
mov edx, dword [0x496714]
push str.DwmFlush
push edx
mov dword [0x496718], eax
call ebx
mov dword [0x49671c], eax
push str.shcore.dll
call esi
mov dword [0x496720], eax
test eax, eax
je 0x407be4
push 0x4752c4
push eax
call ebx
mov dword [0x496724], eax
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4081f0
Capabilities:
Allocate thread local storage

Disassembly:
call fcn.00406a80
test eax, eax
jne 0x4081fc
xor eax, eax
ret
push esi
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x495fe4
push 0
push 0x2000
call esi
push 2
push 0
push 0
push 0x2001
call esi
call fcn.00407a80
pop esi
test eax, eax
je 0x4081f9
call fcn.00407bf0
mov eax, dword [0x496724]
test eax, eax
je 0x40823e
push 2
call eax
jmp 0x408249
mov eax, dword [0x49670c]
test eax, eax
je 0x408249
call eax
call fcn.00403ce0
test eax, eax
je 0x4081f9
call fcn.00408030
mov dword [0x495fe0], eax
test eax, eax
je 0x4081f9
call fcn.00403e80
call fcn.00406260
test eax, eax
je 0x4081f9
call fcn.00405d50
call fcn.00405d00
mov eax, 1
ret
Function at 0x40a4e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x40a52c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40a50f
cmp edi, 2
jb 0x40a50f
cmp byte [esi], cl
jne 0x40a50f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4799e8]
test edi, edi
jne 0x40a4f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40a55b
cmp cl, 0x23
jne 0x40a542
cmp byte [esi], cl
jne 0x40a542
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4799e8]
test cl, cl
jne 0x40a533
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x40a770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x40a795
push 0x5e6
push str.C:Users_vinnyDesktopimgui_1.75imgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x40a7a2
mov dword [edi], 0
mov edx, 0x478c80
mov ecx, esi
call fcn.0040a570
mov esi, eax
test esi, esi
je 0x40a892
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40a888
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x40a888
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x40a888
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x40a888
mov eax, dword [0x494ca0]
test eax, eax
je 0x40a81c
inc dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40a888
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40a86d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x494ca0]
add esp, 4
test eax, eax
je 0x40a85a
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x40a87f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jg 0x40d39f
push 0x50f
push str.C:Users_vinnyDesktopimgui_1.75imgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [esi + 0xbc]
add esp, 0xc
mov eax, dword [esi + 0xc4]
mov edi, 4
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4799e8]
sub edi, 1
jne 0x40d3b3
mov ecx, dword [0x494ca0]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a2c], eax
jne 0x40d3e5
mov dword [ecx + 0x1a30], eax
cmp dword [ecx + 0x1a64], eax
jne 0x40d3f4
mov byte [ecx + 0x1a68], 1
pop ebp
ret 4

Function at 0x40d400
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0xbc]
test edx, edx
jg 0x40d432
push 0x50f
push str.C:Users_vinnyDesktopimgui_1.75imgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov edx, dword [esi + 0xbc]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc4]
lea esi, [ebp - 0x10]
mov edx, dword [eax + edx*4 - 4]
not edx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4799e8]
sub edi, 1
jne 0x40d490
mov eax, dword [0x494ca0]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a2c], edx
jne 0x40d4c1
mov dword [eax + 0x1a30], edx
cmp dword [eax + 0x1a64], edx
jne 0x40d4d0
mov byte [eax + 0x1a68], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x40fcc0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x40fcd9
cmp byte [edi + 0x2d7c], 0
je 0x40fcf1
push 0xef6
push str.C:Users_vinnyDesktopimgui_1.75imgui.cpp
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], str.Window
mov al, 0x57
mov esi, 0x476d19
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x40fd1e
cmp byte [esi], al
jne 0x40fd1e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x4799e8]
test al, al
jne 0x40fd10
mov esi, dword [edi + 0x2d90]
not edx
mov ecx, dword [edi + 0x2d94]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x41ddc0
mov dword [ebp - 0x10], 0x41de20
mov dword [ebp - 0xc], 0x41ded0
cmp esi, ecx
jne 0x40fdee
inc esi
test ecx, ecx
je 0x40fd75
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x40fd7a
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x40fdee
mov eax, dword [0x494ca0]
test eax, eax
je 0x40fd92
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, dword [edi + 0x2d98]
add esp, 4
mov dword [ebp - 4], eax
test ebx, ebx
je 0x40fde2
mov ecx, dword [edi + 0x2d90]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x494ca0]
add esp, 0xc
test eax, eax
je 0x40fdd5
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
mov dword [edi + 0x2d98], eax
mov dword [edi + 0x2d94], esi
mov eax, dword [edi + 0x2d90]
movups xmm0, xmmword [ebp - 0x1c]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d98]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2d90]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411b90
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x411bcf
cmp bl, 0x23
jne 0x411bb1
cmp byte [esi], bl
jne 0x411bb1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x4799e8]
test bl, bl
jne 0x411ba2
mov ebx, dword [0x494ca0]
not eax
mov esi, dword [ebx + 0x19e8]
mov edi, dword [ebx + 0x19f0]
mov ecx, edi
test esi, esi
je 0x411c14
nop dword [eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x411c08
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x411c0a
mov esi, edx
test esi, esi
jne 0x411bf0
mov ecx, dword [ebx + 0x19f0]
mov edx, dword [ebx + 0x19e8]
lea ecx, [ecx + edx*8]
cmp edi, ecx
je 0x411c2c
cmp dword [edi], eax
jne 0x411c2c
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4178c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x494ca0]
push ebx
push esi
push edi
mov esi, dword [eax + 0x19f8]
mov eax, dword [esi + 0xbc]
add esi, 0xbc
mov dword [ebp - 4], ecx
test eax, eax
jg 0x4178ff
push 0x50f
push str.C:Users_vinnyDesktopimgui_1.75imgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [esi]
add esp, 0xc
mov ebx, dword [esi + 8]
lea edx, [ebp - 4]
mov edi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4799e8]
sub edi, 1
jne 0x417910
mov edi, dword [esi + 4]
not ebx
mov ecx, dword [esi]
cmp ecx, edi
jne 0x417959
inc ecx
test edi, edi
je 0x417945
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x41794a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00421110
mov ecx, dword [esi]
mov eax, dword [esi + 8]
pop edi
mov dword [eax + ecx*4], ebx
inc dword [esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x494ca0]
push edi
cmp byte [esi + 0x2da8], 0
je 0x41d29f
cmp dword [esi + 0x2db0], 0
lea edi, [esi + 0x2db4]
je 0x41d291
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x41d249
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.004214b0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0040b330
mov edx, dword [edi]
mov ecx, 0x494c9c
push dword [esi + 0x2db0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2dbc]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.0040b330
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41dca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [0x494ca0]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [edi + 0x2d80], 0
test eax, eax
je 0x41ddb9
lea esi, [edi + 0x2d84]
mov dword [edi + 0x2d80], 0
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41dcf8
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.004214b0
mov ecx, dword [esi + 4]
xor edx, edx
mov dword [esi], 0
test ecx, ecx
jne 0x41dd0f
push 8
mov ecx, esi
call fcn.004214b0
mov edx, dword [esi]
mov eax, dword [esi + 8]
xor ebx, ebx
mov byte [edx + eax], 0
inc dword [esi]
mov eax, dword [edi + 0x2d90]
mov ecx, dword [esi]
test eax, eax
jle 0x41dd73
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x41dd4a
push 0x505
push str.C:Users_vinnyDesktopimgui_1.75imgui.h
push str.i___Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [edi + 0x2d98]
add eax, ecx
push esi
push eax
push edi
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
inc ebx
mov eax, dword [edi + 0x2d90]
add ecx, 0x18
add esp, 0xc
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x41dd4a
mov ecx, dword [esi]
lea eax, [ecx - 1]
mov edx, 0x478ce8
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x2d8c]
test eax, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 8]
mov edi, 0x494c9c
cmovne edi, eax
call fcn.0040a570
mov esi, eax
test esi, esi
je 0x41ddb9
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100062fa
pop dword [ebp - 0x44]
mov eax, 0xc3502a2
add eax, 0x3cb6058
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x39e70
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xab4b6e87
sub ecx, 0xab4b2302
mov edi, eax
mov edx, 0x907fee9f
sub edx, 0x807e689f
add edx, dword [ebp - 0x44]
mov esi, 0x8551819
sub esi, 0xfc5cb68a
sub dword [ebp - 8], edi
mov ebx, dword [edx]
mov dword [ebp - 0x3c], 0x4add12f7
sub ebx, esi
xor dword [ebp - 0x14], 0x4b8b26a4
mov dword [edi], ebx
mov dword [ebp - 0x34], 0x2f405ec0
add edi, 0x42e557c5
add edi, 0xbd1aa83f
add edx, 0x838a8d87
add edx, 0x7c75727d
loop 0x10006354
add eax, 0xe2767810
sub eax, 0xe2755729
xor ebx, ebx
add ebx, eax
add eax, 0x8bcda9f7
sub eax, 0x8bcda9f2
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x402160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x41f008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push ecx
mov dword [ebp - 8], 0
call fcn.00408303
push 0x44
mov esi, eax
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.004072f0
add esp, 0x10
mov dword [ebp - 0x4c], 0x44
xor eax, eax
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
movups xmmword [ebp - 0x5c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
test eax, eax
jne 0x4021e6
call fcn.00408364
add esp, 4
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004050c9
mov esp, ebp
pop ebp
ret
call fcn.00408364
add esp, 4
push 1
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop esi
call fcn.004050c9
mov esp, ebp
pop ebp
ret

Function at 0x402260
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x41c65c
mov esi, eax
push 0x6e
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4022bb
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004050c9
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0xc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4022a8
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp edi, dword [ebp - 8]
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.004050c9
mov esp, ebp
pop ebp
ret