joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d40
Capabilities:
Read .ini file

Disassembly:
push 0x104
push 0x4359c8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x4359c8
call fcn.00411eb0
push 0x4359c8
push 0x104
push 0x435ad0
mov byte [eax], 0
call fcn.004114de
push str.quconfig.ini
push 0x104
push 0x435ad0
call fcn.00411546
add esp, 0x20
push 0x435ad0
push 0x104
push 0x435bd8
push 0x42ba13
push str.page
push str.webcmd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call fcn.00402140
test al, al
jne 0x403dd1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x927c0
call esi
call fcn.00402140
test al, al
je 0x403dc0
pop esi
call fcn.004038a0
xor eax, eax
ret

Function at 0x4055d0
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x4055fb
call fcn.004073a3
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
jne 0x40561e
push eax
push dword [esi + 4]
call fcn.00405556
push esi
push eax
mov ecx, 0x432fc4
call fcn.004051e0
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x41128e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431c44]
jne 0x411298
repz ret
jmp fcn.004168eb
Function at 0x422298
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00418cdf
and dword [ebp - 4], 0
cmp dword [0x435868], 0
mov ebx, eax
jne 0x422349
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4223fa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42b894
push edi
call esi
test eax, eax
je 0x4223fa
push eax
call fcn.00418c6d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435868], eax
call esi
push eax
call fcn.00418c6d
mov dword [esp], 0x42b870
push edi
mov dword [0x43586c], eax
call esi
push eax
call fcn.00418c6d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435870], eax
call esi
push eax
call fcn.00418c6d
pop ecx
mov dword [0x435878], eax
test eax, eax
je 0x422349
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00418c6d
pop ecx
mov dword [0x435874], eax
mov eax, dword [0x435874]
cmp eax, ebx
je 0x4223a1
cmp dword [0x435878], ebx
je 0x4223a1
push eax
call fcn.00418ce8
push dword [0x435878]
mov esi, eax
call fcn.00418ce8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4223a1
test edi, edi
je 0x4223a1
call esi
test eax, eax
je 0x422398
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422398
test byte [ebp - 0xc], 1
jne 0x4223a1
or dword [ebp + 0x10], 0x200000
jmp 0x4223da
mov eax, dword [0x43586c]
cmp eax, ebx
je 0x4223da
push eax
call fcn.00418ce8
pop ecx
test eax, eax
je 0x4223da
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4223da
mov eax, dword [0x435870]
cmp eax, ebx
je 0x4223da
push eax
call fcn.00418ce8
pop ecx
test eax, eax
je 0x4223da
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435868]
call fcn.00418ce8
pop ecx
test eax, eax
je 0x4223fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4223fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406fc8
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address

Disassembly:
push ebx
push esi
push edi
mov eax, 0x1a1
cmp eax, 0x24
ja 0x406fd7
call 0x8566ee8
jo 0x40701e
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edi, dword fs:[0x30]
add byte [ebx + ecx*4 + 0x3d], ah
xor byte [eax], al
add byte [eax], al
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x46260c], eax
sub eax, eax
je 0x406ffc
call 0xa97b58f9
invalid
call 0x40193b
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
push 8
call fcn.00409abb
push 4
mov esi, eax
call fcn.00409abb
lea edi, [esi + 4]
push edi
push ebx
push eax
push 0x407952
push ebx
push ebx
mov dword [eax], 0x406d8b
call fcn.0040e511
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x407072
cmp dword [edi], ebx
jne 0x407044
push 1
jmp 0x407076
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi], eax
jne 0x407051
push 5
jmp 0x407076
push ebx
push dword [esi + 4]
push dword [esi]
call fcn.004095b1
add esp, 0xc
test eax, eax
je 0x407067
push 2
jmp 0x407076
pop edi
mov dword [esi], ebx
xor eax, eax
mov dword [esi + 4], ebx
pop esi
pop ebx
ret
mov dword [edi], ebx
push 6
call fcn.00407abf
int3

Function at 0x408b4f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x408b70
jl 0x408b67
test edi, edi
jne 0x408b70
xor eax, eax
xor edx, edx
jmp 0x408c31
cmp dword [ebx + 0x38], 0
je 0x408b85
push eax
push edi
push dword [ebp + 8]
call fcn.00408c37
jmp 0x408c31
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x408bcc
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x408bcc
cmp eax, edi
jb 0x408ba6
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040a920
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x408bd2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x408c26
mov ecx, ebx
call fcn.004083b7
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x408c11
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0041119d
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x408c26
jmp 0x408be4
test edx, edx
je 0x408c26
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0041119d
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x100012f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1007d068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov cl, byte [esi]
mov byte [ebp - 0x19], cl
test eax, eax
je 0x10001348
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov cl, byte [ebp - 0x19]
movzx eax, cl
sub eax, 0xe8
je 0x1000141a
sub eax, 1
je 0x1000141a
sub eax, 0x16
jne 0x10001401
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
inc esi
mov dword [ebp - 0x14], 1
push 1
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov cl, byte [esi]
mov byte [ebp - 0x19], cl
test eax, eax
je 0x100013a6
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov cl, byte [ebp - 0x19]
cmp cl, 0x15
je 0x100013b0
cmp cl, 0x25
jne 0x10001401
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x14], 4
push 4
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100013ea
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov ecx, dword [esi]
mov eax, edi
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bb2a
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bb2a
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
inc esi
mov dword [ebp - 0x14], 4
push 4
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov ecx, dword [esi]
mov dword [ebp - 0x20], ecx
test eax, eax
je 0x10001458
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov ecx, dword [ebp - 0x20]
lea eax, [esi + 4]
add eax, ecx
mov ecx, dword [ebp - 4]
mov dword [edi], eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.1003bb2a
mov esp, ebp
pop ebp
ret
Function at 0x10001480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1007d068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
push esi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], edx
mov dword [ecx], eax
mov ecx, edx
call fcn.100012f0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
test eax, eax
je 0x100014e8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x10001528
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 0x18]
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1003bb2a
mov esp, ebp
pop ebp
ret
Function at 0x10007af0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10007b22
jl 0x10007b15
test ecx, ecx
jne 0x10007b22
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10007be2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10007080
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10007b8e
jg 0x10007b4d
test esi, esi
je 0x10007b8e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10007b65
mov eax, dword [esp + 0x10]
jl 0x10007b5f
cmp eax, esi
jae 0x10007b65
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1003d6f0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10007baf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x10007bcb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10007b34
jl 0x10007bcb
test ecx, ecx
jne 0x10007b34
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10007c20
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10007c20
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.1003d6f0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10007c89
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10007c46
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10007c74
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10047c65
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10007c89
cmp edi, eax
ja 0x10007c52
test edi, edi
je 0x10007c89
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10047c65
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006364d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1007d068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.10002f80
push 8
call fcn.1003bc18
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 1
call fcn.1003b223
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.100092c0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov byte [ebp + 0xb], al
test ecx, ecx
je 0x10008e1a
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x10008e1a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x10008e36
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.10002f80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000c470
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1000c4d1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000c4b4
cmp edi, 2
jb 0x1000c4b4
cmp byte [esi], cl
jne 0x1000c4b4
cmp byte [esi + 1], cl
jne 0x1000c4b4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100707e0]
jmp 0x1000c485
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100707e0]
test edi, edi
jne 0x1000c485
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000c500
cmp cl, 0x23
jne 0x1000c4e7
cmp byte [esi], cl
jne 0x1000c4e7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100707e0]
test cl, cl
jne 0x1000c4d8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x1000c680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x1000c6a3
push 0x628
push str.D:Dev_Arc2MGRModingcppRevengeanceMegaPatchMGRImGuiTemplateimguiimgui.cpp
push str.filename__mode
call fcn.1004de5a
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000c6b0
mov dword [edi], 0
mov edx, 0x100704dc
mov ecx, esi
call fcn.1000c510
mov esi, eax
test esi, esi
je 0x1000c78f
push esi
call fcn.100487cd
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1000c786
push 2
push 0
push esi
call fcn.100480b5
add esp, 0xc
test eax, eax
jne 0x1000c786
push esi
call fcn.100487cd
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1000c786
push 0
push dword [ebp + 8]
push esi
call fcn.100480b5
add esp, 0xc
test eax, eax
jne 0x1000c786
mov eax, dword [0x1007f15c]
test eax, eax
je 0x1000c725
inc dword [eax + 0x374]
push ebx
call fcn.1004dedb
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1000c786
push esi
push ebx
push 1
push eax
call fcn.10047c65
add esp, 0x10
push esi
cmp eax, ebx
je 0x1000c770
call fcn.1004148c
mov eax, dword [0x1007f15c]
add esp, 4
test eax, eax
je 0x1000c75e
dec dword [eax + 0x374]
push dword [ebp + 8]
call fcn.10047718
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.1004148c
add esp, 4
test edi, edi
je 0x1000c77e
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.1004148c
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1000e990
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x1000e9b7
push 0x52d
push 0x1006d9b0
push str.Size___0
call fcn.1004de5a
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100707e0]
sub edi, 1
jne 0x1000e9d1
mov ecx, dword [0x1007f15c]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a34], eax
jne 0x1000ea03
mov dword [ecx + 0x1a38], eax
cmp dword [ecx + 0x1a6c], eax
jne 0x1000ea12
mov byte [ecx + 0x1a70], 1
pop ebp
ret 4

Function at 0x10010d50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10010d69
cmp byte [edi + 0x2d94], 0
je 0x10010d80
push 0xf38
push str.D:Dev_Arc2MGRModingcppRevengeanceMegaPatchMGRImGuiTemplateimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call fcn.1004de5a
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x1006dff9
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax + eax]
cmp al, 0x23
jne 0x10010dae
cmp byte [esi], al
jne 0x10010dae
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100707e0]
test al, al
jne 0x10010da0
mov esi, dword [edi + 0x2da8]
not edx
mov ecx, dword [edi + 0x2dac]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x1001d520
mov dword [ebp - 0xc], 0x1001d580
mov dword [ebp - 8], 0x1001d650
cmp esi, ecx
jne 0x10010e82
inc esi
test ecx, ecx
je 0x10010e05
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10010e0a
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10010e82
mov eax, dword [0x1007f15c]
test eax, eax
je 0x10010e22
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call fcn.1004dedb
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2db0]
test eax, eax
je 0x10010e76
mov ecx, dword [edi + 0x2da8]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call fcn.1003d6f0
mov ecx, dword [edi + 0x2db0]
add esp, 0xc
test ecx, ecx
je 0x10010e6d
mov eax, dword [0x1007f15c]
test eax, eax
je 0x10010e6d
dec dword [eax + 0x374]
push ecx
call fcn.10047718
add esp, 4
mov dword [edi + 0x2db0], ebx
mov dword [edi + 0x2dac], esi
mov eax, dword [edi + 0x2da8]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2db0]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2da8]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012110
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1001214f
cmp bl, 0x23
jne 0x10012131
cmp byte [esi], bl
jne 0x10012131
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x100707e0]
test bl, bl
jne 0x10012122
mov ecx, dword [0x1007f15c]
not eax
mov esi, dword [ecx + 0x19f0]
mov edi, dword [ecx + 0x19f8]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1001218e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10012188
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1001218a
mov esi, edx
test esi, esi
jne 0x10012170
cmp edi, ebx
je 0x1001219d
cmp dword [edi], eax
jne 0x1001219d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100177d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007d068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1007f15c]
push ebx
push esi
push edi
mov eax, dword [eax + 0x1a00]
cmp dword [eax + 0xbc], 0
lea edi, [eax + 0xbc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
jg 0x1001781a
push 0x52d
push 0x1006d9b0
push str.Size___0
call fcn.1004de5a
add esp, 0xc
mov eax, dword [edi]
lea edx, [ebp - 8]
mov ebx, dword [edi + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100707e0]
sub esi, 1
jne 0x10017830
mov eax, dword [ebp - 0xc]
not ebx
mov esi, dword [edi]
mov ecx, dword [eax + 0xc0]
cmp esi, ecx
jne 0x10017880
inc esi
test ecx, ecx
je 0x1001786b
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10017870
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.1001e0c0
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
mov eax, dword [eax + 0xc4]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bb2a
mov esp, ebp
pop ebp
ret