joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b1130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.00534790
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.005b37a0
test al, al
je 0x5b11ef
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x5b1263
mov ecx, edi
call fcn.00534790
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0xf8
push esi
push edi
call fcn.005b37a0
test al, al
je 0x5b1295
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x5b12ca
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x5b1249
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x5b1249
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5b1247
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.004d4870
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x5b1235
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, edi
call fcn.00455270
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5b1247
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5b121f
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5b1247
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5b121f
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5b1247
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x5b121f
Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x575c2e00
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x1de369bf
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x406844
Capabilities:
Connect socket

Disassembly:
test byte [ebp + 2], dl
add byte [eax], al
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 4]
cmp eax, 0xffffff82
je 0x4069ef
mov ecx, dword [ebx + 0x10]
test dword [edi + ecx - 0x2fe767c], ebp
push ecx
mov ebp, dword [eax + 0x144e8b05]
lea edx, [esi - 0x80]
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
clc
dec dword [edi]
test dword [eax + 1], edx
add byte [eax], al
mov esi, dword [0x6c40c1d8]
call esi
test eax, eax
scasb al, byte es:[edi]
wait
stc
add byte [eax], al

Function at 0x407ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1e]
mov esp, ebp
sbb byte [ebx - 0x74afebab], cl
inc ebp
adc byte [ebp + 1], dh
push ecx
mov ecx, dword [ebp + 0xc]
pop edi
mov edx, dword [ebp + 8]
adc byte [ecx + 0x73], 0x85
imul eax, dword [eax], 0
add byte [ebx - 0x3ca2e33c], al
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x40add0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ecx]
adc byte [ebx - 0x77cf3b3], cl
adc byte [ebx + 0x10], dh
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x5b27541c
xor eax, eax
pop ebp
mov al, byte [0x5c8b5621]
or byte [edi - 0x41], dl
sub al, 0
add byte [eax], al
mov cl, byte [ebp + 0x46]
cmp al, 0x63
mov byte [ebp + 0x10], al
jbe 0x40ae1d
mov eax, dword [ebp + 0x10]
mov ebx, 0x7764
and eax, 0xff
cdq
idiv ebx
add al, 0x30
mov byte [ebp + 0x10], dl
mov byte [ecx], al
inc ecx
inc ebx
add al, 0x3c
outsd dx, dword [esi]
cmp al, 0x6f
inc eax
pop ss
mov ecx, esp
stosb byte es:[edi], al
mov ebx, 0x590a
enter 0x48, 0x49
add byte [ecx + 0x3004680e], bl
mov byte [0x43b8a41], cl
xor byte [eax - 0x5039befc], cl
inc ecx
dec edi
jne 0x40adf9
xor al, 0x45
or al, 0x5f
pop esi
mov byte [ecx - 1], 0
pop ebx
pop ebp
ret
Function at 0x10001140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b4b0
push 0x10075669
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x100011a6
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x1000122f
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x100011cd
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x1000122f
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x10001208
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x10001208
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x1000122f
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x1000122f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001b30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001c00
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10001bec
cmp dword [ebp - 4], 0x50000000
jb 0x10001b6c
cmp dword [ebp - 4], 0x80000000
ja 0x10001b6c
mov dword [ebp - 4], 0x80010000
jmp 0x10001b45
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001b92
jmp 0x10001bec
cmp dword [ebp - 0x10], 0x10000
jne 0x10001bd5
cmp dword [ebp - 0x14], 0x10000
jb 0x10001bd5
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10001bc8
mov eax, dword [ebp - 0x24]
jmp 0x10001bee
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001be7
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10001c00
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001b45
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001d10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001d04
cmp dword [ebp - 4], 0x50000000
jb 0x10001c81
cmp dword [ebp - 4], 0x80000000
ja 0x10001c81
mov dword [ebp - 4], 0x4fff0000
jmp 0x10001c5a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001ca7
jmp 0x10001d04
cmp dword [ebp - 0x10], 0x10000
jne 0x10001cea
cmp dword [ebp - 0x14], 0x10000
jb 0x10001cea
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10001cdd
mov eax, dword [ebp - 0x24]
jmp 0x10001d06
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001cff
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10001d10
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001c5a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001d40
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10098c50], 0
je 0x10001d56
xor eax, eax
jmp 0x10001f71
cmp dword [0x10098c4c], 0
je 0x10001d69
mov eax, dword [0x10098c4c]
jmp 0x10001f71
push 0x24
push 0
push 0x10098c28
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10098c28], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x10098c2c], eax
cmp dword [0x10098c2c], 0
jne 0x10001e0e
mov dword [0x10098c50], 1
cmp dword [0x10098c2c], 0
je 0x10001dc1
mov eax, dword [0x10098c2c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10098c30], 0
mov dword [0x10098c34], 0
mov dword [0x10098c38], 0
mov dword [0x10098c3c], 0
mov dword [0x10098c40], 0
mov dword [0x10098c44], 0
mov dword [0x10098c48], 0
xor eax, eax
jmp 0x10001f71
push str.ImagehlpApiVersionEx
mov ecx, dword [0x10098c2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10098c30], eax
push str.SymInitialize
mov edx, dword [0x10098c2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10098c34], eax
push str.SymSetOptions
mov eax, dword [0x10098c2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10098c38], eax
push str.SymGetOptions
mov ecx, dword [0x10098c2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10098c3c], eax
push str.SymLoadModule64
mov edx, dword [0x10098c2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10098c40], eax
push str.SymGetModuleInfo64
mov eax, dword [0x10098c2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10098c44], eax
push str.SymFromName
mov ecx, dword [0x10098c2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10098c48], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov word [ebp - 8], 7
cmp dword [0x10098c30], 0
je 0x10001ef0
cmp dword [0x10098c34], 0
je 0x10001ef0
cmp dword [0x10098c40], 0
je 0x10001ef0
cmp dword [0x10098c44], 0
je 0x10001ef0
cmp dword [0x10098c48], 0
jne 0x10001ef5
jmp 0x10001da2
lea eax, [ebp - 8]
push eax
call dword [0x10098c30]
mov ecx, dword [ebp - 8]
and ecx, 0xffff
cmp ecx, 7
jge 0x10001f12
jmp 0x10001da2
push 0
push 0
mov edx, dword [0x10098c28]
push edx
call dword [0x10098c34]
test eax, eax
jne 0x10001f2c
jmp 0x10001da2
cmp dword [0x10098c3c], 0
je 0x10001f62
cmp dword [0x10098c38], 0
je 0x10001f62
call dword [0x10098c3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and al, 0xf8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
or ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x10098c38]
mov dword [0x10098c4c], 0x10098c28
mov eax, dword [0x10098c4c]
mov esp, ebp
pop ebp
ret
Function at 0x1000c140
Capabilities:
Hash data with crc32

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x10093708]
push edi
mov edi, dword [esp + 0x28]
mov ebp, dword [esi + 0x3e60]
mov ecx, ebp
mov eax, dword [ebp + 0xc]
and eax, 4
or eax, 0x1000103
or edi, eax
cmp dword [ebp + 0x190], 0
mov dword [esp + 0x28], edi
jne 0x1000c17f
cmp dword [esi + 0x4a74], 0
mov eax, 0x228
je 0x1000c184
mov eax, 0x1f8
movss xmm4, dword [eax + ebp]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebp + 4]
mov edx, 1
subss xmm4, dword [ecx + 0xf0]
subss xmm5, dword [ecx + 0xf4]
mov ecx, dword [esp + 0x20]
mov ebx, 2
movss xmm2, dword [0x100792a0]
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
cmovnp ecx, edx
ucomiss xmm0, xmm3
lahf
xor edx, edx
test ah, 0x44
cmovnp edx, ebx
or edx, ecx
comiss xmm3, xmm1
mov dword [esp + 0x10], edx
jb 0x1000c1fe
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x1000c1fe
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x1000c20f
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x1000c20f
movaps xmm0, xmm2
or dword [esi + 0x471c], ebx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movss dword [esi + 0x473c], xmm1
movss dword [esi + 0x4740], xmm0
mov dword [esi + 0x4724], 1
mov eax, dword [ebp + 4]
push ebx
test ecx, ecx
je 0x1000c257
push ecx
push eax
push str._s__s__08X
lea eax, [esp + 0x30]
push 0
push eax
call fcn.10014260
add esp, 0x18
jmp 0x1000c26c
push eax
push str._s__08X
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.10014260
add esp, 0x14
cmp byte [esp + 0x24], 0
movss xmm0, dword [esi + 0x37b8]
movss dword [esp + 0x18], xmm0
jne 0x1000c28b
mov dword [esi + 0x37b8], 0
push edi
push 0
push dword [esp + 0x28]
call fcn.100098e0
mov edi, dword [esi + 0x3e60]
add esp, 0xc
movss xmm0, dword [esp + 0x18]
movss dword [esi + 0x37b8], xmm0
mov byte [esp + 0x24], al
cmp word [edi + 0xb6], 1
mov eax, dword [esp + 0x10]
mov dword [edi + 0x74], ebx
mov byte [edi + 0xc6], al
jne 0x1000c2db
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebp + 0xf0], ecx
mov dword [ebp + 0xf4], eax
mov ebp, ebx
mov al, 0x23
not ebp
mov edx, 0x1007b701
mov ebx, ebp
cmp al, 0x23
jne 0x1000c2f6
cmp byte [edx], al
jne 0x1000c2f6
cmp byte [edx + 1], al
cmove ebx, ebp
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10079318]
test al, al
jne 0x1000c2e8
not ebx
cmp dword [esi + 0x3eac], ebx
jne 0x1000c325
push 0
push 0
call fcn.10021970
add esp, 8
mov eax, dword [esp + 0x1c]
cmp dword [esi + 0x4804], eax
jne 0x1000c374
test dword [esp + 0x28], 0x800000
jne 0x1000c374
cmp word [edi + 0x14c], 0
jne 0x1000c34e
cmp byte [edi + 0x152], 0
je 0x1000c374
push 0
push edi
call fcn.10012610
push 0
push edi
call fcn.10018760
push edi
push ebx
call fcn.10021970
mov eax, dword [esi + 0x4828]
add esp, 0x18
mov dword [esi + 0x3ecc], eax
mov al, byte [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10012e10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
jg 0x10012e36
push 0x737
push str.D:Projectm2extLibrariesimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [esp + 0x10]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10079318]
sub esi, 1
jne 0x10012e51
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10012e87
push esi
push dword [esp + 0x14]
push 4
push ebx
call fcn.1000f180
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x10012f10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
jg 0x10012f36
push 0x737
push str.D:Projectm2extLibrariesimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [esp + 0x10]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10079318]
sub esi, 1
jne 0x10012f51
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10012f87
push esi
push dword [esp + 0x14]
push 0xc
push ebx
call fcn.1000f180
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x10012f90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xe4], 0
jg 0x10012fb8
push 0x737
push str.D:Projectm2extLibrariesimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov edi, 0x10
movss xmm1, dword [esi + 0x100]
movss xmm2, dword [esi + 0x104]
mov ecx, dword [esi + 0xe4]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [esp + 8], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [esp + 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [esp + 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xec]
subss xmm0, xmm2
lea esi, [esp + 8]
mov edx, dword [eax + ecx*4 - 4]
movss dword [esp + 0x14], xmm0
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10079318]
sub edi, 1
jne 0x10013022
not edx
pop edi
mov eax, edx
pop esi
add esp, 0x10
ret 4
Function at 0x100150e0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
test edi, edi
je 0x10015142
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10015126
cmp edi, 2
jb 0x10015126
cmp byte [esi], cl
jne 0x10015126
cmp byte [esi + 1], cl
jne 0x10015126
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10079318]
jmp 0x100150f7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10079318]
test edi, edi
jne 0x100150f7
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10015178
nop dword [eax]
cmp cl, 0x23
jne 0x1001515f
cmp byte [esi], cl
jne 0x1001515f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10079318]
test cl, cl
jne 0x10015150
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x10015550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
xor ecx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x10015571
cmp eax, ebp
jae 0x100156d6
mov bl, byte [eax]
test bl, bl
je 0x100156d6
movzx ecx, bl
mov edx, ebp
shr ecx, 3
movsx edi, byte [ecx + 0x1007a290]
xor ecx, ecx
test edi, edi
mov dword [esp + 0x14], edi
sete cl
add ecx, edi
mov dword [esp + 0x18], ecx
test ebp, ebp
jne 0x100155a2
lea edx, [ecx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, bl
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x100155b7
mov bh, byte [esi]
jmp 0x100155b9
xor bh, bh
lea esi, [eax + 2]
mov byte [esp + 0x12], bh
cmp esi, edx
jae 0x100155c8
mov ch, byte [esi]
jmp 0x100155ca
xor ch, ch
lea esi, [eax + 3]
mov byte [esp + 0x11], ch
cmp esi, edx
jae 0x100155d9
mov bl, byte [esi]
jmp 0x100155db
xor bl, bl
mov edi, dword [edi*4 + 0x1007a2b0]
movzx edx, ch
movzx ecx, cl
and edi, ecx
movzx esi, bh
shl edi, 6
mov ecx, esi
and ecx, 0x3f
mov byte [esp + 0x28], bl
or edi, ecx
movzx ebx, bl
shl edi, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or edi, ecx
and esi, 0xc0
mov ecx, ebx
shl edi, 6
and ecx, 0x3f
shr ebx, 2
or edi, ecx
or ebx, edx
mov ecx, dword [esp + 0x14]
shr ebx, 2
or ebx, esi
mov esi, dword [esp + 0x14]
shr ebx, 2
mov ecx, dword [ecx*4 + 0x1007a2d8]
shr edi, cl
cmp edi, dword [esi*4 + 0x1007a2c4]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or ebx, ecx
mov ecx, edi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or ebx, edx
cmp ecx, edi
sbb ecx, ecx
and ecx, 0x100
or ebx, ecx
mov ecx, dword [esi*4 + 0x1007a2ec]
xor ebx, 0x2a
sar ebx, cl
test ebx, ebx
je 0x100156c6
xor edx, edx
cmp byte [esp + 0x28], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x13], cl
setne cl
add edx, ecx
cmp dword [esp + 0x18], edx
cmovl edx, dword [esp + 0x18]
mov ecx, edx
add eax, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
jmp 0x10015561
mov ecx, dword [esp + 0x18]
add eax, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
jmp 0x10015561
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret