joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100407f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1b0]
mov edi, eax
test edi, edi
js 0x1004095d
test ebx, ebx
je 0x1004095d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10040842
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0xa8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003e010
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004089e
mov eax, dword [esi + 0xac]
cmp eax, dword [esi + 0xac]
je 0x100408c2
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013ded8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040946
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100408d0
push 0x10
call fcn.100d088c
mov esi, eax
add esp, 4
test esi, esi
je 0x10040830
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DPixelShader9.0
mov dword [esi + 4], vtable.m_IDirect3DPixelShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040956
lea eax, [ebp + 8]
add ecx, 0xa8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003e080
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013ded8
push ebx
call fcn.1003f4e0
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10040ad0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x194]
mov edi, eax
test edi, edi
js 0x10040c44
test ebx, ebx
je 0x10040c44
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp + 0x18], ebx
test ebx, ebx
jne 0x10040b2b
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x168]
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003e010
mov eax, dword [eax + 4]
test eax, eax
jne 0x10040b87
mov eax, dword [esi + 0x16c]
cmp eax, dword [esi + 0x16c]
je 0x10040bab
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, 0x1013ded8
mov esi, 0xc
mov edx, ecx
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040c2d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10040bb7
push 0x10
call fcn.100d088c
mov esi, eax
add esp, 4
test esi, esi
je 0x10040b19
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexBuffer9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexBuffer9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040c3d
lea eax, [ebp + 8]
add ecx, 0x168
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003e080
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
push 0x1013ded8
push ebx
call fcn.1003f4e0
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10040c70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov edi, eax
test edi, edi
js 0x10040de4
test ebx, ebx
je 0x10040de4
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], ebx
test ebx, ebx
jne 0x10040cc2
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x128]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003e010
mov eax, dword [eax + 4]
test eax, eax
jne 0x10040d1e
mov eax, dword [esi + 0x12c]
cmp eax, dword [esi + 0x12c]
je 0x10040d42
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x1013ded8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040dcd
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10040d50
push 0x14
call fcn.100d088c
mov esi, eax
add esp, 4
test esi, esi
je 0x10040cb0
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.0
mov dword [esi + 4], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x1012a970
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040ddd
lea eax, [ebp + 8]
add ecx, 0x128
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003e080
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
push 0x1013ded8
push ebx
call fcn.1003f4e0
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10041270
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x160]
mov edi, eax
test edi, edi
js 0x100413dd
test ebx, ebx
je 0x100413dd
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x100412c2
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x188]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003e010
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004131e
mov eax, dword [esi + 0x18c]
cmp eax, dword [esi + 0x18c]
je 0x10041342
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013ded8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100413c6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10041350
push 0x10
call fcn.100d088c
mov esi, eax
add esp, 4
test esi, esi
je 0x100412b0
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexDeclaration9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexDeclaration9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x100413d6
lea eax, [ebp + 8]
add ecx, 0x188
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003e080
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013ded8
push ebx
call fcn.1003f4e0
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100413f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x174]
mov edi, eax
test edi, edi
js 0x1004155d
test ebx, ebx
je 0x1004155d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10041442
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1a8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003e010
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004149e
mov eax, dword [esi + 0x1ac]
cmp eax, dword [esi + 0x1ac]
je 0x100414c2
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013ded8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10041546
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100414d0
push 0x10
call fcn.100d088c
mov esi, eax
add esp, 4
test esi, esi
je 0x10041430
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexShader9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10041556
lea eax, [ebp + 8]
add ecx, 0x1a8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003e080
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013ded8
push ebx
call fcn.1003f4e0
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10043560
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011bbd9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1015bc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x100435aa
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1c8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003e010
mov eax, dword [eax + 4]
test eax, eax
jne 0x10043609
mov eax, dword [esi + 0x1cc]
cmp eax, dword [esi + 0x1cc]
je 0x10043631
mov eax, dword [eax + 0xc]
lea ecx, [eax - 4]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, 0x1013ded8
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100436b7
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10043640
push 0x10
call fcn.100d088c
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1004371f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DVolume9.0
lea eax, [ebp - 0x1c]
mov dword [esi], vtable.m_IDirect3DVolume9.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x1c8
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
call fcn.1003e080
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x10043721
push 0x14
call fcn.100d088c
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x1004371f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DSwapChain9Ex.0
lea eax, [ebp - 0x14]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x128
mov byte [ebp - 4], 3
mov dword [ebp + 8], ebx
call fcn.1003e080
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x10043721
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10043890
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.1003e010
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x100438e9
mov ecx, dword [edi + 4]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10057320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10057351
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10057340
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x100636c0
Capabilities:
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
mov ecx, dword [eax + 0x10]
jbe 0x100636ea
mov eax, dword [eax]
push esi
push 0
push ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x10063707
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
push 0x6801
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10063727
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10066270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e56d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1015bc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100d088c
mov edi, eax
add esp, 4
test edi, edi
je 0x1006630d
push 1
mov dword [ebp - 4], 0
call fcn.100d2f27
add esp, 4
mov dword [edi + 4], eax
jmp 0x1006630f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10045000
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1006636a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1006636a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10066386
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100663a9
cmp byte [ebp + 0xc], 0
je 0x10066395
push esi
call fcn.100d33ed
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x100663b5
mov esi, str.ios_base::badbit_set
jmp 0x100663c5
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100469a0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.100457b0
push 0x10152870
lea eax, [ebp - 0x28]
push eax
call fcn.100ed8fd
int3
Function at 0x10071080
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1015bc40]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str._themes.re
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.100ff0c0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push str.Theme
push str.Themes
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push 0x1012afcc
push dword [0x1019554c]
mov dword [0x1015b66c], eax
call fcn.10075980
push 6
push 0x10070fe0
push dword [0x10195540]
call fcn.10075640
push 7
push 0x10071030
push dword [0x10195560]
call fcn.10075640
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
call fcn.100d087e
mov esp, ebp
pop ebp
ret
Function at 0x10075640
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp esi, 5
jl 0x10075713
push 0x40
push 0x3000
lea eax, [esi + 5]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x10075678
push str.Failed_to_allocate_memory_for_trampoline.
jmp 0x10075718
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100756a1
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push str.Failed_to_change_memory_protection.
jmp 0x10075718
push esi
push ebx
push edi
call fcn.100ecd50
mov eax, ebx
mov byte [edi + esi], 0xe9
sub eax, edi
add esp, 0xc
sub eax, 5
mov dword [edi + esi + 1], eax
mov eax, dword [ebp + 0xc]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
cmp esi, 5
jle 0x100756e3
lea eax, [esi - 5]
push eax
lea eax, [ebx + 5]
push 0x90
push eax
call fcn.100ed2d0
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1007570a
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push str.Failed_to_restore_memory_protection.
jmp 0x10075718
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Length_must_be_at_least_5_bytes_to_apply_a_hook.
lea ecx, [ebp - 0xc]
call fcn.10049b60
push 0x10153140
lea eax, [ebp - 0xc]
push eax
call fcn.100ed8fd
int3

Function at 0x10075980
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call fcn.100ecd50
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret