joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040720
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1b0]
mov edi, eax
test edi, edi
js 0x1004088d
test ebx, ebx
je 0x1004088d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10040772
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0xa8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x100407ce
mov eax, dword [esi + 0xac]
cmp eax, dword [esi + 0xac]
je 0x100407f2
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013deb8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040876
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10040800
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10040760
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DPixelShader9.0
mov dword [esi + 4], vtable.m_IDirect3DPixelShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040886
lea eax, [ebp + 8]
add ecx, 0xa8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013deb8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10040a00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x194]
mov edi, eax
test edi, edi
js 0x10040b74
test ebx, ebx
je 0x10040b74
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp + 0x18], ebx
test ebx, ebx
jne 0x10040a5b
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x168]
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x10040ab7
mov eax, dword [esi + 0x16c]
cmp eax, dword [esi + 0x16c]
je 0x10040adb
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, 0x1013deb8
mov esi, 0xc
mov edx, ecx
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040b5d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10040ae7
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10040a49
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexBuffer9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexBuffer9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040b6d
lea eax, [ebp + 8]
add ecx, 0x168
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
push 0x1013deb8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10040ba0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov edi, eax
test edi, edi
js 0x10040d14
test ebx, ebx
je 0x10040d14
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], ebx
test ebx, ebx
jne 0x10040bf2
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x128]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x10040c4e
mov eax, dword [esi + 0x12c]
cmp eax, dword [esi + 0x12c]
je 0x10040c72
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x1013deb8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040cfd
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10040c80
push 0x14
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10040be0
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.0
mov dword [esi + 4], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x1012a970
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040d0d
lea eax, [ebp + 8]
add ecx, 0x128
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
push 0x1013deb8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100411a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x160]
mov edi, eax
test edi, edi
js 0x1004130d
test ebx, ebx
je 0x1004130d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x100411f2
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x188]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004124e
mov eax, dword [esi + 0x18c]
cmp eax, dword [esi + 0x18c]
je 0x10041272
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013deb8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100412f6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10041280
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x100411e0
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexDeclaration9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexDeclaration9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10041306
lea eax, [ebp + 8]
add ecx, 0x188
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013deb8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10041320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x174]
mov edi, eax
test edi, edi
js 0x1004148d
test ebx, ebx
je 0x1004148d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10041372
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1a8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x100413ce
mov eax, dword [esi + 0x1ac]
cmp eax, dword [esi + 0x1ac]
je 0x100413f2
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013deb8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10041476
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10041400
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10041360
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexShader9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10041486
lea eax, [ebp + 8]
add ecx, 0x1a8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013deb8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10043490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011b919
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1015bc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x100434da
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1c8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x10043539
mov eax, dword [esi + 0x1cc]
cmp eax, dword [esi + 0x1cc]
je 0x10043561
mov eax, dword [eax + 0xc]
lea ecx, [eax - 4]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, 0x1013deb8
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100435e7
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10043570
push 0x10
call fcn.100d04bc
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1004364f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DVolume9.0
lea eax, [ebp - 0x1c]
mov dword [esi], vtable.m_IDirect3DVolume9.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x1c8
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
call fcn.1003dfb0
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x10043651
push 0x14
call fcn.100d04bc
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x1004364f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DSwapChain9Ex.0
lea eax, [ebp - 0x14]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x128
mov byte [ebp - 4], 3
mov dword [ebp + 8], ebx
call fcn.1003dfb0
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x10043651
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100437c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.1003df40
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x10043819
mov ecx, dword [edi + 4]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10057050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10057081
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10057070
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10063400
Capabilities:
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
mov ecx, dword [eax + 0x10]
jbe 0x1006342a
mov eax, dword [eax]
push esi
push 0
push ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x10063447
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
push 0x6801
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10063467
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10065fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e26d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1015bc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100d04bc
mov edi, eax
add esp, 4
test edi, edi
je 0x1006604d
push 1
mov dword [ebp - 4], 0
call fcn.100d2b57
add esp, 4
mov dword [edi + 4], eax
jmp 0x1006604f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10044f30
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x100660aa
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x100660aa
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x100660c6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100660e9
cmp byte [ebp + 0xc], 0
je 0x100660d5
push esi
call fcn.100d301d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x100660f5
mov esi, str.ios_base::badbit_set
jmp 0x10066105
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100468d0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.100456e0
push 0x10152860
lea eax, [ebp - 0x28]
push eax
call fcn.100ed62d
int3
Function at 0x10070580
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x10195478
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [0x10195478]
mov ebx, esi
sub ebx, dword [0x10195470]
mov eax, dword [0x1019547c]
mov edi, eax
sbb edi, dword [0x10195474]
mov edx, dword [0x1019548c]
mov ecx, dword [0x10195488]
mov dword [0x10195480], ebx
mov dword [0x10195484], edi
mov dword [0x10195470], esi
mov dword [0x10195474], eax
call fcn.100d0990
mov edx, edi
movss dword [ebp - 4], xmm0
mov ecx, ebx
call fcn.100d0990
cmp byte [0x10194e01], 0
movss xmm2, dword [ebp - 4]
divss xmm2, xmm0
movss dword [0x1019546c], xmm2
je 0x1007064e
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 8]
push eax
call edi
movsd xmm0, qword [0x101954b8]
call fcn.100d07c0
mov edx, dword [ebp - 4]
mov esi, eax
mov ecx, dword [ebp - 8]
call fcn.100d08c0
divsd xmm0, qword [0x101954b0]
movsd qword [0x101954b8], xmm0
call fcn.100d07c0
mov ecx, eax
sub ecx, esi
cmp esi, eax
sbb eax, eax
test ecx, eax
je 0x10070605
movss xmm2, dword [0x1019546c]
cmp dword [0x10194ed4], 5
pop edi
pop esi
pop ebx
jl 0x100706c0
movss xmm1, dword [0x101954ac]
movsd xmm0, qword [0x1012e260]
cvtps2pd xmm1, xmm1
comisd xmm0, xmm1
movss xmm0, dword [0x101262f0]
divss xmm0, xmm2
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x1012e258]
cvtpd2ps xmm0, xmm0
jbe 0x10070698
mulss xmm0, dword [0x10126514]
jmp 0x100706a0
mulss xmm0, dword [0x1012a650]
movss dword [str.B_e_], xmm0
movss dword [0x10195490], xmm0
movss dword [0x10195494], xmm0
movss dword [0x10195498], xmm0
mov esp, ebp
pop ebp
ret

Function at 0x10071010
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1015bc40]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str._themes.re
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.100fedf0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push str.Theme
push str.Themes
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push 0x1012afcc
push dword [0x10195540]
mov dword [0x1015b668], eax
call fcn.10075910
push 6
push 0x10070f70
push dword [0x10195534]
call fcn.100755d0
push 7
push 0x10070fc0
push dword [0x10195554]
call fcn.100755d0
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
call fcn.100d04ae
mov esp, ebp
pop ebp
ret
Function at 0x100755d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp esi, 5
jl 0x100756a3
push 0x40
push 0x3000
lea eax, [esi + 5]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x10075608
push str.Failed_to_allocate_memory_for_trampoline.
jmp 0x100756a8
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10075631
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push str.Failed_to_change_memory_protection.
jmp 0x100756a8
push esi
push ebx
push edi
call fcn.100eca80
mov eax, ebx
mov byte [edi + esi], 0xe9
sub eax, edi
add esp, 0xc
sub eax, 5
mov dword [edi + esi + 1], eax
mov eax, dword [ebp + 0xc]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
cmp esi, 5
jle 0x10075673
lea eax, [esi - 5]
push eax
lea eax, [ebx + 5]
push 0x90
push eax
call fcn.100ed000
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1007569a
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push str.Failed_to_restore_memory_protection.
jmp 0x100756a8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Length_must_be_at_least_5_bytes_to_apply_a_hook.
lea ecx, [ebp - 0xc]
call fcn.1004b930
push 0x101530fc
lea eax, [ebp - 0xc]
push eax
call fcn.100ed62d
int3

Function at 0x10075910
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call fcn.100eca80
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret