joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d4dc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47d4e4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47d6d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x47d6ec
mov eax, esi
call fcn.00470cf4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004045bc
lea ecx, [ebp - 0x10]
mov edx, 0x47d700
mov eax, esi
call fcn.00470cf4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004045bc
lea ecx, [ebp - 0x14]
mov edx, 0x47d718
mov eax, esi
call fcn.00470cf4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004045bc
lea ecx, [ebp - 0x18]
mov edx, 0x47d734
mov eax, esi
call fcn.00470cf4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004045bc
lea ecx, [ebp - 0x1c]
mov edx, 0x47d750
mov eax, esi
call fcn.00470cf4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004045bc
lea ecx, [ebp - 0x24]
mov edx, 0x47d768
mov eax, esi
call fcn.00470cf4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004085f4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408b34
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x47d780
mov eax, esi
call fcn.00470cf4
mov eax, dword [ebp - 0x28]
call fcn.0045ffa4
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x47d790
mov eax, esi
call fcn.00470cf4
mov eax, dword [ebp - 0x2c]
call fcn.0045ffa4
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x47d7a8
mov eax, esi
call fcn.00470cf4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408b34
inc eax
je 0x47d679
lea ecx, [ebp - 0x34]
mov edx, 0x47d7a8
mov eax, esi
call fcn.00470cf4
mov eax, dword [ebp - 0x34]
call fcn.00408af8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a088
fstp qword [ebp - 0x3c]
wait
call fcn.0040a3f8
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x47d694
lea ecx, [ebp - 0x40]
mov edx, 0x47d7a8
mov eax, esi
call fcn.00470cf4
mov eax, dword [ebp - 0x40]
call fcn.0045ffa4
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x47d7b8
mov eax, esi
call fcn.00470cf4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004045bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d6dd
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040458c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040458c
ret
Function at 0x484468
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4844c2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00484458
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0045ea50
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0045e650
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4844c9
lea eax, [ebp - 4]
call fcn.00404568
ret

Function at 0x48804c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409298
add esp, 0x100
pop ebx
ret
Function at 0x488074
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4a
push 0
push 0
dec ecx
jne 0x48807c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4883dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0048804c
lea eax, [ebp - 0x124]
xor ecx, ecx
mov edx, 0x10c
call fcn.00403104
lea eax, [ebp - 0x230]
xor ecx, ecx
mov edx, 0x10c
call fcn.00403104
push 0x40
lea edx, [ebp - 0x234]
mov eax, dword [0x48dcd4]
mov eax, dword [eax]
call fcn.004563ec
mov ecx, dword [ebp - 0x234]
mov dl, 1
mov eax, dword [0x412f44]
call fcn.00417c80
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
sub edx, 0x218
xor ecx, ecx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x124]
mov ecx, 0x10c
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x124]
mov ecx, 0x105
call fcn.004047d8
mov eax, dword [ebp - 0x238]
mov edx, 0x4883f4
call fcn.00404974
je 0x488145
mov eax, ebx
call fcn.00403738
jmp 0x4883b2
mov eax, dword [0x48dcd4]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
lea edx, [ebp - 0x230]
mov ecx, 0x10c
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
call fcn.00402e80
mov eax, 0x186a0
call fcn.00403124
add eax, 0x2710
lea edx, [ebp - 4]
call fcn.004089bc
push 0xffff
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0x488404
lea eax, [ebp - 0x23c]
mov edx, 3
call fcn.004048e8
mov ecx, dword [ebp - 0x23c]
mov dl, 1
mov eax, dword [0x412f44]
call fcn.00417c80
mov esi, eax
mov eax, dword [ebp - 0x128]
cdq
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.00417a68
mov eax, esi
call fcn.00403738
push 1
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0x488404
lea eax, [ebp - 0x240]
mov edx, 3
call fcn.004048e8
mov eax, dword [ebp - 0x240]
call fcn.00404a28
push eax
push 0x488410
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.00403738
xor eax, eax
push ebp
push 0x4882cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x488420
call fcn.00404600
mov al, byte [0x48851c]
push eax
lea eax, [ebp - 0x244]
push eax
xor ecx, ecx
mov edx, 0x488528
mov eax, dword [ebp - 0xc]
call fcn.0040d684
mov edx, dword [ebp - 0x244]
lea eax, [ebp - 0xc]
call fcn.00404600
xor eax, eax
push ebp
push 0x488290
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0xc]
call fcn.004085f4
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 8]
call fcn.00457618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48829a
lea eax, [ebp - 0x24c]
push eax
mov ecx, 0x488534
mov edx, 0x488534
mov eax, dword [ebp - 8]
call fcn.00487a5c
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x14]
call fcn.004085f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4882d6
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4883e4
lea eax, [ebp - 0x250]
mov edx, 8
call fcn.0040458c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040458c
ret
Function at 0x41dae0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x418015
lea edi, [esi - 0x17015]
push edi
or ebp, 0xffffffff
jmp 0x41db02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41db09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41daf8
mov eax, 1
add ebx, ebx
jne 0x41db1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41db10
jne 0x41db2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41db10
xor ecx, ecx
sub eax, 3
jb 0x41db40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41dbb2
mov ebp, eax
add ebx, ebx
jne 0x41db4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41db58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41db7c
inc ecx
add ebx, ebx
jne 0x41db68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41db5d
jne 0x41db79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41db5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41db9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41db8d
jmp 0x41dafe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41db9c
add edi, ecx
jmp 0x41dafe
pop esi
mov edi, esi
mov ecx, 0x51
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41dbba
cmp byte [edi], 2
jne 0x41dbba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41dbbf
lea edi, [esi + 0x1b000]
mov eax, dword [edi]
or eax, eax
je 0x41dc37
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d924]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d960]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41dbec
mov ecx, edi
jns 0x41dc1b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d968]
or eax, eax
je 0x41dc31
mov dword [ebx], eax
add ebx, 4
jmp 0x41dc09
call dword [esi + 0x1d964]
mov ebp, dword [esi + 0x1d96c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41dc6b
sub esp, 0xffffff80
jmp 0x401b88

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x3913700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0391378f
jae 0x391370e
xor ecx, ecx
call fcn.0391378f
jae 0x391373d
xor eax, eax
call fcn.0391378f
jae 0x391374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0391378f
adc al, al
jae 0x391372f
jne 0x3913779
stosb byte es:[edi], al
jmp 0x3913711
call fcn.0391379b
sub ecx, ebx
jne 0x3913756
call fcn.03913799
jmp 0x3913775
lodsb al, byte [esi]
shr eax, 1
je 0x3913783
adc ecx, ecx
jmp 0x3913772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03913799
cmp eax, 0x7d00
jae 0x3913772
cmp ah, 5
jae 0x3913773
cmp eax, 0x7f
ja 0x3913774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3913711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x12713f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8e9000]
push edi
jmp 0x127140a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1271411
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1271400
mov eax, 1
add ebx, ebx
jne 0x1271423
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1271434
jne 0x1271453
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1271453
dec eax
add ebx, ebx
jne 0x1271440
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1271418
add ebx, ebx
jne 0x127144f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x12714a5
xor ecx, ecx
sub eax, 3
jb 0x127146b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x12714da
sar eax, 1
mov ebp, eax
jmp 0x1271476
add ebx, ebx
jne 0x1271476
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1271444
inc ecx
add ebx, ebx
jne 0x1271484
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1271444
add ebx, ebx
jne 0x1271491
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1271486
jne 0x12714a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1271486
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x12714c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x12714b6
jmp 0x1271406
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x12714c4
add edi, ecx
jmp 0x1271406
pop esi
mov edi, esi
mov ecx, 0x2e76ea
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x12714ff
cmp byte [edi], 7
jne 0x12714e4
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x12714e2
lea edi, [esi + 0xe6c000]
mov eax, dword [edi]
or eax, eax
je 0x1271550
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe7dca4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe7de70]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1271505
mov ecx, edi
jns 0x1271534
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe7de78]
or eax, eax
je 0x127154a
mov dword [ebx], eax
add ebx, 4
jmp 0x1271522
call dword [esi + 0xe7de74]
mov ebp, dword [esi + 0xe7de7c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1271584
sub esp, 0xffffff80
jmp 0x6e8488

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000a6af
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.10043d44
add esp, 0x10
xor edx, edx
ret

Function at 0x1000a8ba
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
not edx
push edi
mov edi, dword [esp + 0xc]
test esi, esi
je 0x1000a8e6
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100672a8]
inc edi
sub esi, 1
jne 0x1000a8ce
not edx
pop edi
mov eax, edx
pop esi
ret

Function at 0x1000a8ed
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov edx, ebx
test edi, edi
je 0x1000a953
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x1000a91b
cmp edi, 2
jb 0x1000a91b
cmp byte [esi], al
jne 0x1000a91b
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100672a8]
test edi, edi
jne 0x1000a904
jmp 0x1000a95a
cmp al, 0x23
jne 0x1000a941
cmp byte [esi], al
jne 0x1000a941
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100672a8]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000a933
pop edi
not edx
pop esi
mov eax, edx
pop ebx
ret
Function at 0x1001a568
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, str.D:____________600__SFPluginImGuiimgui_draw.cpp
push edi
cmp dword [esi + 0x24], 0
jle 0x1001a57e
cmp dword [esi + 0x28], 0
jg 0x1001a591
push 0x8e8
push ebx
push str.TexWidth___0__TexHeight___0
call fcn.100432b1
add esp, 0xc
mov edi, dword [esp + 0x10]
mov edx, 0xffff
movzx eax, word [edi + 4]
mov ecx, eax
cmp ax, dx
jne 0x1001a5bc
push 0x8e9
push ebx
push str.rect__IsPacked__
call fcn.100432b1
movzx ecx, word [edi + 4]
add esp, 0xc
movzx eax, cx
movd xmm1, eax
movzx eax, word [edi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mulss xmm1, dword [esi + 0x2c]
mov eax, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [esi + 0x30]
movss dword [eax], xmm1
movss dword [eax + 4], xmm0
movzx eax, word [edi + 4]
movzx ecx, word [edi]
add ecx, eax
movzx eax, word [edi + 6]
movd xmm1, ecx
movzx ecx, word [edi + 2]
add ecx, eax
mov eax, dword [esp + 0x18]
cvtdq2ps xmm1, xmm1
pop edi
movd xmm0, ecx
mulss xmm1, dword [esi + 0x2c]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [esi + 0x30]
pop esi
movss dword [eax], xmm1
pop ebx
movss dword [eax + 4], xmm0
ret 0xc
Function at 0x1003888c
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100388ec
mov ebp, 0x10000000
cmp eax, 0x7c
je 0x100388ec
cmp eax, 0x29
jne 0x100388f2
cmp dword [esi + 0x10], 0
jne 0x100388ec
test dword [esi + 0x50], ebp
je 0x100389ea
cmp eax, 0x5d
jne 0x100388c7
test dword [esi + 0x50], ebp
je 0x100389de
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.100381c7
mov ecx, esi
call fcn.1003a692
mov ecx, esi
call fcn.1003a6d0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x100388a0
pop esi
pop ebp
mov al, cl
pop ebx
ret
cmp eax, 0x2e
jne 0x10038903
push 5
lea ecx, [esi + 0x24]
call fcn.1003a654
jmp 0x100388d4
cmp eax, 0x5c
jne 0x1003894f
mov ecx, esi
call fcn.1003a692
test byte [esi + 0x50], 0x80
je 0x10038946
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x1003892f
push 4
lea ecx, [esi + 0x24]
call fcn.1003a654
mov ecx, esi
call fcn.1003a692
jmp 0x100388e2
cmp al, 0x42
jne 0x10038946
push 4
lea ecx, [esi + 0x24]
call fcn.1003a654
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x10038926
mov ecx, esi
call fcn.100389f4
jmp 0x100388db
cmp eax, 0x5b
jne 0x10038972
mov ecx, esi
call fcn.1003a692
mov ecx, esi
call fcn.10038f9a
push 4
push 0x5d
mov ecx, esi
call fcn.10039d92
jmp 0x100388db
cmp eax, 0x28
jne 0x1003899f
mov ecx, esi
call fcn.1003a692
mov ecx, esi
call fcn.1003ac90
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.10039d92
test bl, bl
je 0x100388e2
jmp 0x100388db
cmp eax, 0x5e
jne 0x100389ab
push 2
jmp 0x1003891e
cmp eax, 0x24
jne 0x100389b7
push 3
jmp 0x1003891e
cmp eax, 0x2a
je 0x100389e2
cmp eax, 0x2b
je 0x100389e2
cmp eax, 0x3f
je 0x100389e2
cmp eax, 0x7b
je 0x100389e2
cmp eax, 0x7d
jne 0x100388b9
test dword [esi + 0x50], ebp
je 0x100389e6
jmp 0x100388c7
push 4
jmp 0x100389ec
push 0xa
jmp 0x100389ec
push 6
jmp 0x100389ec
push 5
mov ecx, esi
call fcn.10039d61
int3
Function at 0x1004453f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1003ef70
mov eax, dword [0x100870a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10055fa5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10044581
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100446dd
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10065de0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100888d8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.10059814
mov ecx, dword [esi*4 + 0x100888d8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x100446d6
cmp eax, dword [ecx + edi + 0x24]
jne 0x100446d6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100446d6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10059814
add esp, 0x14
test edx, edx
jl 0x100446d6
jg 0x1004464c
test eax, eax
jb 0x100446d6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100446d6
jl 0x10044666
cmp dword [ebp - 0x1008], eax
ja 0x100446d6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10044684
test ebx, ebx
je 0x100446bd
cmp ecx, edi
jae 0x100446bd
mov al, byte [ecx]
cmp al, 0xd
jne 0x1004469e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100446aa
cmp byte [ecx + 1], 0xa
jne 0x100446aa
inc ecx
jmp 0x100446aa
movzx eax, al
movsx eax, byte [eax + 0x10087310]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10044684
cmp edx, ebx
jne 0x10044684
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100446db
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1003df5f
leave
ret

Function at 0x100536b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100536f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100536f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100536f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100536f7
cmp dword [ecx + 0x74], 0xe
jbe 0x100536f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10054864
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100547e6
Function at 0x1005529e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10079cd8
push 0x10079cd0
push str.FlsAlloc
push 0x1f
call fcn.100550e6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100552d2
push dword [ebp + 8]
mov ecx, esi
call dword [0x10067244]
call esi
jmp 0x100552d8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1005531c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10079ce8
push 0x10079ce0
push str.FlsGetValue
push 0x21
call fcn.100550e6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10055353
push dword [ebp + 8]
mov ecx, esi
call dword [0x10067244]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1005535b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10079cf0
push 0x10079ce8
push str.FlsSetValue
push 0x22
call fcn.100550e6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10055395
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10067244]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]