joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009f260
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [0x1015f8f4]
mov esi, ecx
test eax, eax
je 0x1009f27d
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x1009f296
jmp 0x1009f2a5
push 0x1015f8f4
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1009f2a5
cmp dword [eax], 0
mov ebx, eax
je 0x1009f2a5
add ebx, 4
jmp 0x1009f36c
mov eax, dword [0x1015f8f4]
test eax, eax
je 0x1009f31f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1009f338
mov edi, eax
test eax, eax
jne 0x1009f301
push 4
push 0xc
call fcn.1001d510
add esp, 8
test eax, eax
je 0x1009f373
mov dword [eax], 0
mov dword [eax + 8], 0x1015f8f4
mov edi, eax
mov eax, dword [0x1015f8f4]
test eax, eax
jne 0x1009f2f9
push 0x1015f8f4
call fcn.1009c440
add esp, 4
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor ebp, ebp
test esi, esi
je 0x1009f34a
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esi], 0
test eax, eax
je 0x1009f34a
cmp eax, 1
jne 0x1009f33c
mov ebp, ecx
jmp 0x1009f34a
push 0x1015f8f4
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1009f2ba
xor ebx, ebx
jmp 0x1009f36c
test ecx, ecx
je 0x1009f34a
lock dec dword [ecx]
jne 0x1009f34a
call fcn.10093270
mov ecx, dword [edi + 4]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], ebp
je 0x1009f36c
test ecx, ecx
je 0x1009f36c
lock dec dword [ecx]
jne 0x1009f36c
call fcn.10093270
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
push 0xc
call fcn.100f97e0
add esp, 8
ud2

Function at 0x1009f830
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ecx, esp
push dword [esp + 0x20]
call fcn.100a0bc0
add esp, 4
cmp dword [esp], 0
je 0x1009f85d
movsd xmm0, qword [esp + 4]
movsd qword [esi], xmm0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
mov edi, dword [esp + 4]
mov ebx, dword [esp + 8]
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x1009f87b
mov byte [esi], 4
test ebx, ebx
jne 0x1009f88e
jmp 0x1009f856
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
test ebx, ebx
je 0x1009f856
add ebx, ebx
je 0x1009f856
push 2
push ebx
push edi
call fcn.1001d520
add esp, 0x1c
pop esi
pop edi
pop ebx
ret
Function at 0x1009f8b0
Capabilities:
Delete file

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, esp
push dword [esp + 0x28]
call fcn.100a0bc0
add esp, 4
cmp dword [esp], 0
je 0x1009f8e5
movsd xmm0, qword [esp + 4]
movsd qword [esi], xmm0
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
ret
mov edi, dword [esp + 4]
mov ebx, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x1009f901
mov byte [esi], 4
test ebx, ebx
jne 0x1009f914
jmp 0x1009f8dc
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
test ebx, ebx
je 0x1009f8dc
add ebx, ebx
je 0x1009f8dc
push 2
push ebx
push edi
call fcn.1001d520
add esp, 0xc
jmp 0x1009f8dc

Function at 0x1009fc20
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, 0x17
cmp dword [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1009fc62
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x1009fcd6
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x1009fc76
cmp eax, 0x2739
jne 0x1009fca7
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1009fca1
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x1009fcb9
mov dword [esi + 4], edi
jmp 0x1009fc5a
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 1
jmp 0x1009fcd6
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 1
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x100a1150
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100a3cc0
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
push 4
push 8
call fcn.1001d510
add esp, 8
mov ebx, eax
test eax, eax
je 0x100a123b
mov eax, dword [ebp + 0xc]
mov dword [ebx], edi
mov dword [ebx + 4], esi
push 0
push 0x10000
push ebx
push 0x100a12a0
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x100a11cb
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
xor eax, eax
jmp 0x100a1226
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x28], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 4]
test eax, eax
je 0x100a11ff
push dword [ecx + 8]
push eax
push dword [ebp - 0x24]
call fcn.1001d520
add esp, 0xc
push 4
push 8
push dword [ebp - 0x20]
call fcn.1001d520
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov eax, 1
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0
push 4
push 8
call fcn.100f97e0
add esp, 8
ud2
Function at 0x100a1530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
je 0x100a1545
test eax, eax
jne 0x100a165d
mov ebp, dword [0x1015fc40]
test ebp, ebp
je 0x100a165d
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
xor ebx, ebx
jmp 0x100a1567
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x100a1588
push dword [ebp + 4]
call edi
test eax, eax
je 0x100a1560
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x100a1560
test bl, 1
je 0x100a165d
mov ebp, dword [0x1015fc40]
test ebp, ebp
je 0x100a165d
xor ebx, ebx
jmp 0x100a15b7
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x100a15d8
push dword [ebp + 4]
call edi
test eax, eax
je 0x100a15b0
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x100a15b0
test bl, 1
je 0x100a165d
mov ebp, dword [0x1015fc40]
test ebp, ebp
je 0x100a165d
xor ebx, ebx
jmp 0x100a15f7
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x100a1618
push dword [ebp + 4]
call edi
test eax, eax
je 0x100a15f0
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x100a15f0
test bl, 1
je 0x100a165d
mov ebp, dword [0x1015fc40]
test ebp, ebp
je 0x100a165d
xor ebx, ebx
jmp 0x100a1637
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x100a1658
push dword [ebp + 4]
call edi
test eax, eax
je 0x100a1630
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x100a1630
test bl, 1
jne 0x100a1669
mov al, byte [0x1013fa80]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebp, dword [0x1015fc40]
jmp 0x100a1674
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x100a165d
push dword [ebp + 4]
call edi
test eax, eax
je 0x100a1671
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
jmp 0x100a1671
Function at 0x100a2a00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x1015f900]
mov esi, ecx
test eax, eax
je 0x100a2a1b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x100a2a34
jmp 0x100a2a40
push 0x1015f900
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100a2a40
cmp byte [eax + 4], 0
mov edi, eax
jne 0x100a2ad5
mov eax, dword [0x1015f900]
test eax, eax
je 0x100a2aac
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x100a2ac5
mov edi, eax
test eax, eax
jne 0x100a2a95
push 4
push 8
call fcn.1001d510
add esp, 8
test eax, eax
je 0x100a2add
mov byte [eax + 4], 0
mov dword [eax], 0x1015f900
mov edi, eax
mov eax, dword [0x1015f900]
test eax, eax
jne 0x100a2a8d
push 0x1015f900
call fcn.1009c440
add esp, 4
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x100a2acc
movzx eax, word [esi]
mov byte [esi], 0
mov ecx, eax
shr ecx, 8
and eax, 1
cmovne eax, ecx
jmp 0x100a2ace
push 0x1015f900
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x100a2a55
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
xor eax, eax
mov byte [edi + 4], 1
mov byte [edi + 5], al
add edi, 5
mov eax, edi
pop esi
pop edi
ret
push 4
push 8
call fcn.100f97e0
add esp, 8
ud2
Function at 0x100a2af0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [0x1015f908]
mov esi, ecx
test eax, eax
je 0x100a2b0c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x100a2b25
jmp 0x100a2b34
push 0x1015f908
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100a2b34
cmp dword [eax], 0
mov ebx, eax
je 0x100a2b34
add ebx, 4
jmp 0x100a2c1c
mov eax, dword [0x1015f908]
test eax, eax
je 0x100a2bb5
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x100a2bd2
mov edi, eax
test eax, eax
jne 0x100a2b94
push 4
push 0x10
call fcn.1001d510
add esp, 8
test eax, eax
je 0x100a2c22
mov dword [eax], 0
mov dword [eax + 0xc], 0x1015f908
mov edi, eax
mov eax, dword [0x1015f908]
test eax, eax
jne 0x100a2b8c
push 0x1015f908
call fcn.1009c440
add esp, 4
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor edx, edx
test esi, esi
je 0x100a2bd6
mov ebx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi], 0
test ebx, ebx
je 0x100a2bda
cmp ebx, 1
jne 0x100a2bde
mov edx, ecx
jmp 0x100a2bf7
push 0x1015f908
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x100a2b4d
xor ebx, ebx
jmp 0x100a2c1c
xor eax, eax
jmp 0x100a2bf7
mov eax, ebx
jmp 0x100a2bf7
test ecx, ecx
je 0x100a2bf3
xor eax, eax
lock dec dword [ecx]
mov edx, 0
jne 0x100a2bf7
call fcn.10093230
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 8]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], eax
mov dword [edi + 8], edx
je 0x100a2c1c
test ecx, ecx
je 0x100a2c1c
lock dec dword [ecx]
jne 0x100a2c1c
call fcn.10093230
mov eax, ebx
pop esi
pop edi
pop ebx
ret
push 4
push 0x10
call fcn.100f97e0
add esp, 8
ud2
Function at 0x100a2c30
Capabilities:
Enumerate pe sections
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov esi, dword [eax + 4]
movzx eax, word [eax + 8]
mov word [esp + 6], ax
mov eax, dword [0x1015fc30]
cmp eax, 3
jne 0x100a2d35
lea ebx, [esp + 0x10]
push esi
push edi
push ebx
call fcn.100aacb0
add esp, 0xc
cmp dword [esp + 0x10], 0
je 0x100a2ca4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100a2c88
push 1
push eax
push dword [esp + 0x20]
call fcn.1001d520
add esp, 0xc
mov esi, dword [ebp + 8]
mov dword [esi + 8], 0x101345e4
mov dword [esi + 4], 2
mov dword [esi], 1
jmp 0x100a2d2b
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xorps xmm0, xmm0
mov dword [esp + 0xc], 0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x18], 1
mov dword [esp + 8], eax
lea eax, [esp + 0xc]
push eax
push ebx
push 0
push edi
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x100a2cfa
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x100a2d12
mov eax, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
movzx eax, word [esp + 6]
mov word [esi + 0xc], ax
xor eax, eax
mov ecx, dword [esp + 8]
mov dword [esi], eax
mov byte [edi], 0
test ecx, ecx
je 0x100a2d2b
push 1
push ecx
push edi
call fcn.1001d520
add esp, 0xc
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.100f9600
jmp 0x100a2c5b

Function at 0x100a2e20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x1015f910]
mov esi, ecx
test eax, eax
je 0x100a2e3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x100a2e54
jmp 0x100a2e5f
push 0x1015f910
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100a2e5f
cmp dword [eax], 0
mov edi, eax
jne 0x100a2efa
mov eax, dword [0x1015f910]
test eax, eax
je 0x100a2ecf
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x100a2ee8
mov edi, eax
test eax, eax
jne 0x100a2eb7
push 4
push 0xc
call fcn.1001d510
add esp, 8
test eax, eax
je 0x100a2f02
mov dword [eax], 0
mov dword [eax + 8], 0x1015f910
mov edi, eax
mov eax, dword [0x1015f910]
test eax, eax
jne 0x100a2eaf
push 0x1015f910
call fcn.1009c440
add esp, 4
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x100a2eef
mov ecx, dword [esi]
xor eax, eax
mov dword [esi], 0
cmp ecx, 1
jne 0x100a2ef1
mov eax, dword [esi + 4]
jmp 0x100a2ef1
push 0x1015f910
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x100a2e74
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
xor eax, eax
mov dword [edi], 1
mov dword [edi + 4], eax
add edi, 4
mov eax, edi
pop esi
pop edi
ret
push 4
push 0xc
call fcn.100f97e0
add esp, 8
ud2
Function at 0x100b5770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100b57c8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x100b57c0
cmp ebp, ebx
jb 0x100b5842
cmp ebp, dword [esp + 0x1c]
ja 0x100b5851
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x100b57c2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x100b57b0
jmp 0x100b581f
ja 0x100b57c8
cmp edx, edi
mov ebx, ebp
jne 0x100b5785
mov edx, dword [esp + 0x24]
test edx, edx
je 0x100b5823
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x100b5800
mov esi, edi
sub ecx, ebx
jns 0x100b5817
jmp 0x100b5825
cmp edi, edx
je 0x100b582c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x100b5825
xor al, 1
cmp esi, edx
jne 0x100b57e0
jmp 0x100b5825
xor eax, eax
jmp 0x100b5825
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101386e0
push 0x2b
push str.called__Option::unwrap____on_a__None__value:
call fcn.100f9870
add esp, 0xc
ud2
sub esp, 4
push ebp
push ebx
call fcn.100f9b00
add esp, 0xc
ud2
sub esp, 4
push dword [esp + 0x20]
push ebp
call fcn.100f9af0
add esp, 0xc
ud2
Function at 0x100c9df0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc4], 0
jg 0x100c9e15
push 0x6ba
push str.C:UsersFrank.cargo_registry_srcgithub.com_1ecc6299db9ec823imgui_sys_0.8.2_third_partyimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0xc4]
mov edi, 4
mov eax, dword [esi + 0xcc]
lea esi, [esp + 0xc]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10124410]
sub edi, 1
jne 0x100c9e30
mov ecx, dword [0x1015fb6c]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1bc8], eax
jne 0x100c9e62
mov dword [ecx + 0x1bcc], eax
cmp dword [ecx + 0x1c04], eax
jne 0x100c9e71
mov byte [ecx + 0x1c08], 1
ret 4

Function at 0x100c9fc0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp edi, 8
ja 0x100ca0e9
test byte [esi], 2
jne 0x100ca0e9
cmp dword [esi + 0x460], 0xffffffff
jne 0x100c9ffb
push 0x8bf
push str.C:UsersFrank.cargo_registry_srcgithub.com_1ecc6299db9ec823imgui_sys_0.8.2._third_party_imgui_imgui_draw.cpp
push str.PackIdMouseCursors____1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
push dword [esi + 0x460]
mov ecx, esi
call fcn.100c9d40
lea edx, [edi + edi*2]
movss xmm2, dword [edx*8 + 0x1015f7d0]
movss xmm4, dword [edx*8 + 0x1015f7d4]
movzx ecx, word [eax + 4]
movzx eax, word [eax + 6]
pop edi
movd xmm5, ecx
movd xmm3, eax
mov eax, dword [esp + 0x10]
cvtdq2ps xmm5, xmm5
cvtdq2ps xmm3, xmm3
addss xmm5, dword [edx*8 + 0x1015f7c8]
addss xmm3, dword [edx*8 + 0x1015f7cc]
movss dword [eax + 4], xmm4
movss dword [eax], xmm2
mov ecx, dword [edx*8 + 0x1015f7d8]
mov edx, dword [edx*8 + 0x1015f7dc]
movaps xmm1, xmm5
mov eax, dword [esp + 0xc]
addss xmm4, xmm3
movaps xmm0, xmm3
mov dword [eax], ecx
mov dword [eax + 4], edx
mulss xmm1, dword [esi + 0x24]
mov eax, dword [esp + 0x14]
mulss xmm0, dword [esi + 0x28]
movss dword [eax], xmm1
movaps xmm1, xmm2
movss dword [eax + 4], xmm0
addss xmm1, xmm5
addss xmm5, dword [0x1012e870]
movaps xmm0, xmm4
mulss xmm0, dword [esi + 0x28]
mulss xmm1, dword [esi + 0x24]
movss dword [eax + 0xc], xmm0
movaps xmm0, xmm5
addss xmm5, xmm2
movss dword [eax + 8], xmm1
mulss xmm0, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
mulss xmm3, dword [esi + 0x28]
movss dword [eax], xmm0
movss dword [eax + 4], xmm3
mulss xmm5, dword [esi + 0x24]
mulss xmm4, dword [esi + 0x28]
pop esi
movss dword [eax + 8], xmm5
movss dword [eax + 0xc], xmm4
mov al, 1
ret 0x14
pop edi
xor al, al
pop esi
ret 0x14
Function at 0x100ca920
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x100ca933
test esi, esi
jne 0x100ca94b
push 0x640
push str.C:UsersFrank.cargo_registry_srcgithub.com_1ecc6299db9ec823imgui_sys_0.8.2._third_party_imgui_imgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x100ca95a
mov dword [ebp], 0
push esi
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x100ca96f
pop edi
pop esi
pop ebp
ret
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push ebx
push esi
call edi
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x100caa5f
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100caa5f
push esi
call edi
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x100caa5f
push 0
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100caa5f
mov eax, dword [0x1015fb6c]
test eax, eax
je 0x100ca9d2
inc dword [eax + 0x36c]
push dword [0x1015fb74]
mov eax, dword [esp + 0x24]
add eax, edi
push eax
call dword [0x1015f6f0]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x100caa5f
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, edi
je 0x100caa30
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1015fb6c]
add esp, 4
test eax, eax
je 0x100caa19
dec dword [eax + 0x36c]
push dword [0x1015fb74]
push ebx
call dword [0x1015f6f4]
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x100caa47
push eax
lea eax, [edi + ebx]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebp, ebp
je 0x100caa58
mov dword [ebp], edi
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100cceb0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
test edi, edi
je 0x100ccf12
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100ccef6
cmp edi, 2
jb 0x100ccef6
cmp byte [esi], cl
jne 0x100ccef6
cmp byte [esi + 1], cl
jne 0x100ccef6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10124410]
jmp 0x100ccec7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10124410]
test edi, edi
jne 0x100ccec7
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100ccf48
nop dword [eax]
cmp cl, 0x23
jne 0x100ccf2f
cmp byte [esi], cl
jne 0x100ccf2f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10124410]
test cl, cl
jne 0x100ccf20
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x100cd140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
xor edx, edx
push ebx
push ebp
push esi
push edi
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], edx
test ebp, ebp
je 0x100cd161
cmp eax, ebp
jae 0x100cd2dc
mov cl, byte [eax]
mov byte [esp + 0x12], cl
test cl, cl
je 0x100cd2dc
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, ebp
movsx ecx, byte [ecx + 0x10128788]
test ecx, ecx
mov dword [esp + 0x14], ecx
sete bl
add ebx, ecx
test ebp, ebp
jne 0x100cd192
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [esp + 0x12]
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x100cd1ad
mov ch, byte [esi]
mov byte [esp + 0x11], ch
jmp 0x100cd1b2
mov byte [esp + 0x11], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x100cd1c1
mov ch, byte [esi]
mov byte [esp + 0x10], ch
jmp 0x100cd1c6
mov byte [esp + 0x10], 0
lea esi, [eax + 3]
cmp esi, edx
jae 0x100cd1d1
mov ch, byte [esi]
jmp 0x100cd1d3
xor ch, ch
mov ebp, dword [esp + 0x14]
movzx esi, byte [esp + 0x11]
movzx edx, byte [esp + 0x10]
movzx edi, ch
mov ebp, dword [ebp*4 + 0x101287a8]
mov byte [esp + 0x12], ch
movzx ecx, cl
and ebp, ecx
mov ecx, esi
and ecx, 0x3f
shl ebp, 6
or ebp, ecx
and esi, 0xc0
shl ebp, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or ebp, ecx
mov ecx, edi
and ecx, 0x3f
shr edi, 2
or edi, edx
shl ebp, 6
or ebp, ecx
shr edi, 2
mov ecx, dword [esp + 0x14]
or edi, esi
mov esi, dword [esp + 0x14]
shr edi, 2
mov ecx, dword [ecx*4 + 0x101287d0]
shr ebp, cl
cmp ebp, dword [esi*4 + 0x101287bc]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, ebp
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0x10ffff
or edi, edx
cmp ecx, ebp
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [esi*4 + 0x101287e4]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x100cd2c0
xor edx, edx
cmp byte [esp + 0x13], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x10], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
mov edx, dword [esp + 0x18]
inc edx
jmp 0x100cd14d
add eax, ebx
test ebp, ebp
je 0x100cd2d0
mov edx, dword [esp + 0x18]
inc edx
jmp 0x100cd14d
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0xc
ret