joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x40452c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40450f
cmp edi, 2
jb 0x40450f
cmp byte [esi], cl
jne 0x40450f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4a8ca8]
test edi, edi
jne 0x4044f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40455b
cmp cl, 0x23
jne 0x404542
cmp byte [esi], cl
jne 0x404542
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4a8ca8]
test cl, cl
jne 0x404533
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x404650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x404674
push 0x824
push str.....imgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x404681
mov dword [ebx], 0
mov edx, 0x4a68f0
mov ecx, esi
call fcn.00404570
mov esi, eax
test esi, esi
je 0x404740
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x404736
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x404736
push esi
call edi
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x404736
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x404736
cmp edi, 0xffffffff
je 0x404736
mov ecx, edi
call fcn.00409a80
mov dword [ebp + 8], eax
push esi
test eax, eax
je 0x404737
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x40471f
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp + 8]
add esp, 4
call fcn.00409b10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x40472e
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x408f10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xec], 0
jg 0x408f39
push 0x78c
push 0x4a02f8
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xec]
lea edx, [ebp + 8]
mov ebx, dword [edi + 0xf4]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4a8ca8]
sub esi, 1
jne 0x408f53
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc0], ebx
jne 0x408f8a
push ecx
push dword [ebp + 8]
lea edx, [esi + 0xc]
mov ecx, ebx
call fcn.00428e90
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x408fa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xec], 0
jg 0x408fc9
push 0x78c
push 0x4a02f8
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xec]
lea edx, [ebp + 8]
mov ebx, dword [edi + 0xf4]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4a8ca8]
sub esi, 1
jne 0x408fe3
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc0], ebx
jne 0x40901a
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00428e90
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x409030
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xec], 0
jg 0x40905b
push 0x78c
push 0x4a02f8
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x108]
mov edi, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x10c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0xec]
movss xmm0, dword [eax]
subss xmm0, dword [ebp - 0xc]
movss dword [ebp - 0x1c], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, dword [ebp - 8]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, dword [ebp - 0xc]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xf4]
lea esi, [ebp - 0x1c]
subss xmm0, dword [ebp - 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
movss dword [ebp - 0x10], xmm0
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4a8ca8]
sub edi, 1
jne 0x4090c5
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4137d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
mov dword [ebp - 4], edi
lea edx, [ebp - 4]
not ebx
mov esi, 4
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4a8ca8]
sub esi, 1
jne 0x4137f0
mov eax, dword [0x4c9b64]
not ebx
cmp dword [eax + 0x3fc0], ebx
jne 0x413828
push ecx
push edi
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00428e90
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ef60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x5dc8], 0
lea ecx, [esi + 0x5dcc]
je 0x41efcc
push 0
call fcn.00429d00
push dword [ebp + 8]
lea ecx, [esi + 0x5dcc]
push edi
call fcn.00405460
mov edx, dword [esi + 0x5dcc]
test edx, edx
je 0x41efa0
dec edx
jmp 0x41efa2
xor edx, edx
push dword [esi + 0x5dc8]
mov eax, dword [esi + 0x5dd4]
mov ecx, 0x4c9b60
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push edi
call fcn.00405460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f6d0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4c9b64]
test bl, bl
je 0x41f716
or edi, 0xffffffff
cmp bl, 0x23
jne 0x41f6f7
cmp byte [esi], bl
jne 0x41f6f7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4a8ca8]
test bl, bl
jne 0x41f6e8
mov edi, dword [0x4c9b64]
mov ecx, dword [edi + 0x5d6c]
not eax
mov edx, dword [edi + 0x5d74]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x41f73d
cmp dword [edx + 4], eax
je 0x41f740
add edx, 0x24
cmp edx, ecx
jne 0x41f731
xor eax, eax
ret
mov eax, edx
ret

Function at 0x41f950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4c9b64]
push esi
mov esi, ecx
push edi
mov dword [eax + 0x5d5c], 0
test esi, esi
je 0x41f9a5
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.0041f9b0
mov edx, 0x4a68f4
mov ecx, esi
mov edi, eax
call fcn.00404570
mov esi, eax
test esi, esi
je 0x41f9a5
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4622a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4622c3
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.00409b10
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4622e4
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.00409b10
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x462305
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.00409b10
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x462342
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.00409b10
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x462363
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.00409b10
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x462384
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.00409b10
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00465900
Function at 0x46b770
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
mov esi, edx
mov ecx, 1
mul ebx
push edi
shr edx, 0xb
xor edi, edi
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0x10], edi
sub edx, eax
mov dword [ebp - 4], edx
test ebx, ebx
je 0x46b8aa
xor ebx, ebx
cmp edx, 7
jbe 0x46b809
mov eax, 7
sub eax, esi
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
add ebx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
add edi, ecx
cmp eax, edx
jb 0x46b7b8
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp ebx, eax
jae 0x46b86f
sub eax, ebx
cmp eax, 2
jb 0x46b85b
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea ebx, [ebx + edx*2]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 8]
mov edi, ebx
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x46b835
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
cmp ebx, dword [ebp - 4]
jae 0x46b868
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
mov eax, dword [ebp - 0xc]
add eax, edx
add edi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [ebp - 4]
add edi, eax
sub dword [ebp + 8], edx
mov edx, 0x15b0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edx
jne 0x46b7a7
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46bf50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, 2
dec esi
mov edx, ecx
mov dword [ebp - 8], edx
mov dword [ebp + 8], esi
cmp esi, eax
jl 0x46bfda
push ebx
push edi
mov edi, esi
and edi, 0x1f
mov dword [ebp - 4], edi
mov ecx, eax
sar ecx, 5
lea ebx, [edx + ecx*4]
mov ecx, eax
or ecx, 0x1f
mov edx, 0x1f
cmp esi, ecx
cmovle edx, edi
xor edi, edi
inc edx
xor ecx, ecx
bts edi, edx
cmp edx, 0x20
cmovae ecx, edi
xor edi, ecx
cmp edx, 0x40
mov edx, eax
cmovae ecx, edi
xor esi, esi
and edx, 0x1f
dec edi
bts esi, edx
xor ecx, ecx
cmp edx, 0x20
cmovae ecx, esi
xor esi, ecx
cmp edx, 0x40
mov edx, dword [ebp - 8]
cmovae ecx, esi
dec esi
not esi
add eax, 0x20
and edi, esi
and eax, 0xffffffe0
or dword [ebx], edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
cmp eax, esi
jle 0x46bf76
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x472bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test byte [esi + 0x6d], 0xc
ja 0x472be4
push 0xadc
push str.....imgui_tables.cpp
push str.column__SortDirectionsAvailCount___0
call edi
add esp, 0xc
cmp word [esi + 0x5a], 0xffff
jne 0x472c0f
test byte [esi + 0x6d], 0xc
ja 0x472c05
push 0xac9
push str.....imgui_tables.cpp
push str.n___column__SortDirectionsAvailCount
call edi
add esp, 0xc
movzx eax, byte [esi + 0x6e]
pop edi
and eax, 3
pop esi
ret
push ebx
xor ebx, ebx
movzx eax, byte [esi + 0x6d]
shr eax, 2
and eax, 3
cmp ebx, eax
jl 0x472c34
push 0xac9
push str.....imgui_tables.cpp
push str.n___column__SortDirectionsAvailCount
call edi
add esp, 0xc
mov al, byte [esi + 0x6e]
mov cl, bl
add cl, cl
shr al, cl
xor al, byte [esi + 0x6d]
test al, 3
je 0x472c64
inc ebx
cmp ebx, 3
jl 0x472c12
push 0xae2
push str.....imgui_tables.cpp
push 0x4a0438
call edi
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
ret
movzx ecx, byte [esi + 0x6d]
lea eax, [ebx + 1]
shr ecx, 2
and ecx, 3
cdq
idiv ecx
mov ebx, edx
cmp ebx, ecx
jl 0x472c8e
push 0xac9
push str.....imgui_tables.cpp
push str.n___column__SortDirectionsAvailCount
call edi
add esp, 0xc
movzx eax, byte [esi + 0x6e]
mov cl, bl
pop ebx
add cl, cl
shr eax, cl
pop edi
and eax, 3
pop esi
ret
Function at 0x474e30
Capabilities:
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x4c9b64]
push esi
mov esi, ecx
push edi
mov edi, dword [eax + 0x4c94]
cmp esi, 0xffffffff
jne 0x474e4c
cmp dword [edi + 0x48], ecx
cmovne esi, dword [edi + 0x48]
mov eax, dword [edi + 0x40]
cmp esi, eax
jne 0x474e58
or esi, 0xffffffff
jmp 0x474e5d
cmp esi, 0xffffffff
jl 0x474e61
cmp esi, eax
jl 0x474e79
push 0xcce
push str.....imgui_tables.cpp
push str.column_n____1__column_n___table__ColumnsCount
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
test byte [edi + 4], 7
je 0x474ed2
mov ax, word [edi + 0x4c]
mov word [edi + 0x1d8], si
mov esi, 0x4bf35d
mov word [edi + 0x4e], ax
mov al, 0x23
mov byte [edi + 0x1ef], 1
mov edi, dword [edi]
not edi
mov ecx, edi
cmp al, 0x23
jne 0x474eb0
cmp byte [esi], al
jne 0x474eb0
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x4a8ca8]
test al, al
jne 0x474ea2
not ecx
xor edx, edx
call fcn.00418c70
pop edi
pop esi
pop ecx
ret

Function at 0x476030
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
push edi
movaps xmmword [ebp - 0x30], xmm0
or eax, 0xffffffff
movaps xmmword [ebp - 0x20], xmm0
mov cl, 0x54
mov dword [ebp - 0x30], str.Table
mov esi, 0x4b7e8d
or edi, 0xffffffff
cmp cl, 0x23
jne 0x476080
cmp byte [esi], cl
jne 0x476080
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4a8ca8]
test cl, cl
jne 0x476071
mov esi, dword [0x4c9b64]
not eax
mov ecx, str.Table
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x4758d0
mov dword [ebp - 0x20], 0x475a30
mov dword [ebp - 0x1c], 0x475b00
mov dword [ebp - 0x18], 0x475990
mov dword [ebp - 0x14], 0x475d50
call fcn.0041f6d0
test eax, eax
je 0x4760ed
push 0x3396
push str.....imgui.cpp
push str.FindSettingsHandler_handler__TypeName___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0x5d6c]
call fcn.004298f0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x491510
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0xc], 0x100000
push esi
push edi
je 0x491580
mov cl, byte [edx]
lea esi, [edx + 1]
or eax, 0xffffffff
test cl, cl
je 0x491558
or edi, 0xffffffff
nop word [eax + eax]
cmp cl, 0x23
jne 0x49153f
cmp byte [esi], cl
jne 0x49153f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4a8ca8]
test cl, cl
jne 0x491530
mov ecx, dword [0x4c9b64]
not eax
cmp dword [ecx + 0x3fd8], eax
jne 0x49156e
mov dword [ecx + 0x3fdc], eax
cmp dword [ecx + 0x4000], eax
jne 0x491592
mov byte [ecx + 0x4004], 1
pop edi
pop esi
ret
mov eax, dword [0x4c9b64]
push ecx
push edx
mov ecx, dword [eax + 0x3f88]
call fcn.00408ea0
pop edi
pop esi
ret

Function at 0x49c2f0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov eax, dword [0x4c9b64]
push esi
test eax, eax
je 0x49c2ff
mov esi, dword [eax + 0x70]
jmp 0x49c301
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x49c324
mov dword [esi], eax
pop esi
ret
Function at 0x49c330
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
push esi
mov esi, dword [0x4c9b64]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x49c366
push 0x10b2
push str.....imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call ebx
mov esi, dword [0x4c9b64]
add esp, 0xc
cmp dword [esi + 0x70], 0
je 0x49c380
push 0x8b
push str....._backendsimgui_impl_win32.cpp
push str.io.BackendPlatformUserData__nullptr___Already_initialized_a_platform_backend__
call ebx
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x49c397
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x49c38e
mov ecx, 0x38
call fcn.00409a80
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x49c3c7
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x49c3c9
xor edi, edi
or dword [esi + 0xc], 6
mov eax, dword [ebp - 8]
mov dword [esi + 0x70], edi
mov dword [esi + 0x68], str.imgui_impl_win32
mov esi, dword [0x4c9b64]
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x14], eax
mov dword [edi + 0x20], 9
test esi, esi
je 0x49c40a
mov esi, dword [esi + 0x70]
jmp 0x49c40c
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x49c42f
mov dword [esi], eax
mov esi, dword [0x4c9b64]
cmp dword [esi + 0x49f8], 0
jg 0x49c452
push 0x783
push 0x4a02f8
push str.i___0__i___Size
call ebx
add esp, 0xc
mov eax, dword [esi + 0x4a00]
xor esi, esi
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x34], str.xinput1_4.dll
mov dword [ebp - 0x30], str.xinput1_3.dll
mov eax, dword [eax]
mov dword [ebp - 0x2c], str.xinput9_1_0.dll
mov dword [ebp - 0x28], str.xinput1_2.dll
mov dword [ebp - 0x24], str.xinput1_1.dll
mov dword [eax + 0x24], ecx
mov byte [edi + 0x29], 1
nop dword [eax]
push dword [ebp + esi*4 - 0x34]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x49c4af
inc esi
cmp esi, 5
jl 0x49c490
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ecx, 0x210
call fcn.00402cd0
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax], 0
je 0x49c7ef
xor edx, edx
mov ecx, 0x210
call fcn.00416550
test al, al
je 0x49c7ef
push 0xa0
call ebx
shr eax, 0xf
test al, 1
jne 0x49c7ef
mov esi, dword [0x4c9b64]
test esi, esi
jne 0x49c7c0
push 0x10b2
push str.....imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x4c9b64]
add esp, 0xc
cmp byte [esi + 0x3891], 0
je 0x49c7db
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403720
mov dword [esi + 0x334], 0x210
mov dword [esi + 0x8f4], 0xa0
mov ecx, 0x214
call fcn.00402cd0
cmp byte [eax], 0
je 0x49c86f
xor edx, edx
mov ecx, 0x214
call fcn.00416550
test al, al
je 0x49c86f
push 0xa1
call ebx
shr eax, 0xf
test al, 1
jne 0x49c86f
mov esi, dword [0x4c9b64]
test esi, esi
jne 0x49c840
push 0x10b2
push str.....imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x4c9b64]
add esp, 0xc
cmp byte [esi + 0x3891], 0
je 0x49c85b
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403720
mov dword [esi + 0x338], 0x214
mov dword [esi + 0x904], 0xa1
mov ecx, 0x212
call fcn.00402cd0
cmp byte [eax], 0
je 0x49c8ec
xor edx, edx
mov ecx, 0x212
call fcn.00416550
test al, al
je 0x49c8ec
push 0x5b
call ebx
shr eax, 0xf
test al, 1
jne 0x49c8ec
mov esi, dword [0x4c9b64]
test esi, esi
jne 0x49c8bd
push 0x10b2
push str.....imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x4c9b64]
add esp, 0xc
cmp byte [esi + 0x3891], 0
je 0x49c8d8
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403720
mov dword [esi + 0x220], 0x212
mov dword [esi + 0x8fc], 0x5b
mov ecx, 0x216
call fcn.00402cd0
cmp byte [eax], 0
je 0x49c969
xor edx, edx
mov ecx, 0x216
call fcn.00416550
test al, al
je 0x49c969
push 0x5c
call ebx
shr eax, 0xf
test al, 1
jne 0x49c969
mov esi, dword [0x4c9b64]
test esi, esi
jne 0x49c93a
push 0x10b2
push str.....imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x4c9b64]
add esp, 0xc
cmp byte [esi + 0x3891], 0
je 0x49c955
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403720
mov dword [esi + 0x224], 0x216
mov dword [esi + 0x90c], 0x5c
pop edi
pop esi
pop ebx
ret
Function at 0x49c970
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4c9b64]
test eax, eax
jne 0x49c99a
push 0x10b2
push str.....imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [0x4c9b64]
add esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
lea esi, [eax + 8]
push 0x11
call edi
shr eax, 0xf
and al, 1
cmp byte [esi + 0x3889], 0
mov byte [ebp - 4], al
je 0x49c9da
test al, al
je 0x49c9c8
movss xmm3, dword [0x4c2afc]
jmp 0x49c9cb
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x1000
call fcn.00403720
push 0x10
call edi
shr eax, 0xf
and al, 1
cmp byte [esi + 0x3889], 0
mov byte [ebp - 4], al
je 0x49ca0f
test al, al
je 0x49c9fd
movss xmm3, dword [0x4c2afc]
jmp 0x49ca00
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x2000
call fcn.00403720
push 0x12
call edi
shr eax, 0xf
and al, 1
cmp byte [esi + 0x3889], 0
mov byte [ebp - 4], al
je 0x49ca44
test al, al
je 0x49ca32
movss xmm3, dword [0x4c2afc]
jmp 0x49ca35
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x4000
call fcn.00403720
push 0x5d
call edi
shr eax, 0xf
and al, 1
cmp byte [esi + 0x3889], 0
mov byte [ebp - 4], al
je 0x49ca7c
test al, al
je 0x49ca67
movss xmm0, dword [0x4c2afc]
jmp 0x49ca6a
xorps xmm0, xmm0
push dword [ebp - 4]
movaps xmm3, xmm0
mov ecx, esi
push 0x8000
call fcn.00403720
pop edi
pop esi
mov esp, ebp
pop ebp
ret