joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47db70
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x4a1014]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x47dbf0
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042e650
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.004427c0
push esi
call dword [0x4a1024]
add esp, 0x20
lea eax, [ebx + 0x4d]
jmp 0x47dd50
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x47dc4a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042e650
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.004427c0
push 0
mov esi, 0x4d
call dword [0x4a1024]
add esp, 0x20
jmp 0x47dd41
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x47dc8a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042e650
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.004427c0
add esp, 0x1c
mov esi, 0x4d
jmp 0x47dd2d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x47dcb8
jg 0x47dc9e
cmp edi, 0x100000
jbe 0x47dcb8
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.004427c0
add esp, 0xc
mov esi, 0x4d
jmp 0x47dd2d
lea eax, [edi + 1]
push eax
call dword [0x4a1020]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x47dcd0
lea esi, [eax + 0x1b]
jmp 0x47dd2d
test edi, edi
je 0x47dd14
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47dd6d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47dd69
add esi, eax
cmp esi, edi
jb 0x47dce0
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.0047d970
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x4a1024]
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042996d
add esp, 0x120
ret
mov edi, esi
jmp 0x47dd14
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042e650
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.004427c0
add esp, 0x1c
mov esi, 0x4d
jmp 0x47dd2d
Function at 0x484020
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.00445cf0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x4a1020]
mov esi, eax
add esp, 8
test esi, esi
je 0x4841a2
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x4840a2
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x484113
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4840d0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x484145
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x49880d
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x49880e
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x484120
push dword [esp + 0x30]
call fcn.00445cf0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x484170
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x4a1024]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x484270
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x484296
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4842ce
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.00445cf0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x484325
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x484334
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x484345
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret

Function at 0x484f80
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x484fcc
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x484f91
pop ebx
pop edi
pop esi
ret
Function at 0x10005760
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100057a9
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000578d
cmp edi, 2
jb 0x1000578d
cmp byte [esi], cl
jne 0x1000578d
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100eab38]
test edi, edi
jne 0x10005773
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100057d8
cmp cl, 0x23
jne 0x100057bf
cmp byte [esi], cl
jne 0x100057bf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100eab38]
test cl, cl
jne 0x100057b0
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x10005a10
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10005a2f
push 0x348
push str.C:UserskarolDesktophpp_cs16hppincludesImGuiimgui.cpp
push str.filename__file_open_mode
call fcn.100b4bce
add esp, 0xc
mov edi, dword [esp + 0xc]
test edi, edi
je 0x10005a3d
mov dword [edi], 0
mov edx, 0x100ea890
mov ecx, esi
call fcn.100057e0
mov esi, eax
test esi, esi
jne 0x10005a52
pop edi
pop esi
ret
push ebx
push ebp
push 2
push 0
push esi
call fcn.100b4fb9
add esp, 0xc
test eax, eax
jne 0x10005b06
push esi
call fcn.100b5618
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10005b06
push 0
push 0
push esi
call fcn.100b4fb9
add esp, 0xc
test eax, eax
jne 0x10005b06
mov eax, dword [0x1010e4a0]
test eax, eax
je 0x10005a9d
inc dword [eax + 0x374]
push dword [0x1010e49c]
push ebx
call fcn.100026c0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x10005b06
push esi
push ebx
push 1
push ebp
call fcn.100b5976
add esp, 0x10
push esi
cmp eax, ebx
je 0x10005af1
call fcn.100b576d
mov eax, dword [0x1010e4a0]
add esp, 4
test eax, eax
je 0x10005adb
dec dword [eax + 0x374]
push dword [0x1010e49c]
push ebp
call fcn.100026d0
add esp, 8
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret
call fcn.100b576d
add esp, 4
test edi, edi
je 0x10005aff
mov dword [edi], ebx
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
ret
push esi
call fcn.100b576d
add esp, 4
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x10007d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x1c4]
test ecx, ecx
jg 0x10007dbb
push 0x4e9
push str.C:UserskarolDesktophpp_cs16hppincludesImGuiimgui.h
push str.Size___0
call fcn.100b4bce
mov ecx, dword [esi + 0x1c4]
add esp, 0xc
mov eax, dword [esi + 0x1cc]
mov edi, 4
lea esi, [esp + 0xc]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100eab38]
sub edi, 1
jne 0x10007dd0
mov ecx, dword [0x1010e4a0]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19e8], eax
jne 0x10007e02
mov dword [ecx + 0x19ec], eax
cmp dword [ecx + 0x1a14], eax
jne 0x10007e11
mov byte [ecx + 0x1a18], 1
ret 4

Function at 0x10007e20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x14
mov eax, dword [0x10106024]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x1c4]
test edx, edx
jg 0x10007e59
push 0x4e9
push str.C:UserskarolDesktophpp_cs16hppincludesImGuiimgui.h
push str.Size___0
call fcn.100b4bce
mov edx, dword [esi + 0x1c4]
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 8], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [esp + 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 0x10], eax
cvttss2si eax, xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x1cc]
lea esi, [esp + 8]
mov edx, dword [eax + edx*4 - 4]
not edx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100eab38]
sub edi, 1
jne 0x10007ec0
mov eax, dword [0x1010e4a0]
not edx
pop edi
pop esi
cmp dword [eax + 0x19e8], edx
jne 0x10007ef1
mov dword [eax + 0x19ec], edx
cmp dword [eax + 0x1a14], edx
jne 0x10007f00
mov byte [eax + 0x1a18], 1
mov ecx, dword [esp + 0x10]
mov eax, edx
xor ecx, esp
call fcn.100aa00f
add esp, 0x14
ret 4
Function at 0x1000a280
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x1000a296
cmp byte [edi + 0x2d0c], 0
je 0x1000a2ad
push 0xc6b
push str.C:UserskarolDesktophpp_cs16hppincludesImGuiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call fcn.100b4bce
add esp, 0xc
or edx, 0xffffffff
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], str.Window
mov esi, 0x100e8d99
mov al, 0x57
or ebx, 0xffffffff
nop word [eax + eax]
cmp al, 0x23
jne 0x1000a2de
cmp byte [esi], al
jne 0x1000a2de
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100eab38]
test al, al
jne 0x1000a2d0
mov esi, dword [edi + 0x2d20]
not edx
mov ecx, dword [edi + 0x2d24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0x10017450
mov dword [esp + 0x18], 0x100174b0
mov dword [esp + 0x1c], 0x100175a0
cmp esi, ecx
jne 0x1000a3c2
inc esi
test ecx, ecx
je 0x1000a339
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1000a33e
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1000a3c2
mov eax, dword [0x1010e4a0]
test eax, eax
je 0x1000a356
inc dword [eax + 0x374]
push dword [0x1010e49c]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call fcn.100026c0
mov ebx, eax
add esp, 8
mov eax, dword [edi + 0x2d28]
test eax, eax
je 0x1000a3b6
mov ecx, dword [edi + 0x2d20]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call fcn.100abd30
mov ecx, dword [edi + 0x2d28]
add esp, 0xc
test ecx, ecx
je 0x1000a3a7
mov eax, dword [0x1010e4a0]
test eax, eax
je 0x1000a3a7
dec dword [eax + 0x374]
push dword [0x1010e49c]
push ecx
call fcn.100026d0
add esp, 8
mov dword [edi + 0x2d28], ebx
mov dword [edi + 0x2d24], esi
mov eax, dword [edi + 0x2d20]
movups xmm0, xmmword [esp + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d28]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [esp + 0x1c]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2d20]
mov byte [edi], 1
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x1000c1f0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push ebp
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000c230
cmp bl, 0x23
jne 0x1000c212
cmp byte [esi], bl
jne 0x1000c212
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x100eab38]
test bl, bl
jne 0x1000c203
mov ebx, dword [0x1010e4a0]
not eax
mov ebp, dword [ebx + 0x19a4]
mov esi, ebp
mov edi, dword [ebx + 0x19ac]
mov ecx, edi
test esi, esi
je 0x1000c274
nop dword [eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000c268
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000c26a
mov esi, edx
test esi, esi
jne 0x1000c250
mov ecx, dword [ebx + 0x19ac]
lea ecx, [ecx + ebp*8]
cmp edi, ecx
je 0x1000c287
cmp dword [edi], eax
jne 0x1000c287
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x10011c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x1010e4a0]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0x19b4]
mov eax, dword [ebp + 0x1c4]
mov dword [esp + 0xc], ecx
push edi
lea edi, [ebp + 0x1c4]
test eax, eax
jg 0x10011c3d
push 0x4e9
push str.C:UserskarolDesktophpp_cs16hppincludesImGuiimgui.h
push str.Size___0
call fcn.100b4bce
mov eax, dword [edi]
add esp, 0xc
mov ebx, dword [edi + 8]
lea edx, [esp + 0x10]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100eab38]
sub esi, 1
jne 0x10011c50
mov ecx, dword [edi]
not ebx
mov esi, dword [ebp + 0x1c8]
cmp ecx, esi
jne 0x10011c9c
inc ecx
test esi, esi
je 0x10011c88
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10011c8d
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10017e90
mov ecx, dword [edi]
mov eax, dword [ebp + 0x1cc]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10016e00
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [0x1010e4a0]
mov ebp, ecx
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esi + 0x2d2c]
mov ebx, dword [esi + 0x2d30]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x28], 0
cmp ecx, ebx
jne 0x10016f00
lea edi, [ecx + 1]
test ebx, ebx
je 0x10016e6a
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
jmp 0x10016e6f
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ebx
jle 0x10016f00
push dword [0x1010e49c]
inc dword [esi + 0x374]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call fcn.100026c0
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2d34]
test eax, eax
je 0x10016eee
mov ecx, dword [esi + 0x2d2c]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call fcn.100abd30
mov ecx, dword [esi + 0x2d34]
add esp, 0xc
test ecx, ecx
je 0x10016edf
mov eax, dword [0x1010e4a0]
test eax, eax
je 0x10016edf
dec dword [eax + 0x374]
push dword [0x1010e49c]
push ecx
call fcn.100026d0
add esp, 8
mov ecx, dword [esi + 0x2d2c]
mov dword [esi + 0x2d34], ebx
mov dword [esi + 0x2d30], edi
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x28]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [esi + 0x2d34]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [esp + 0x20]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2d2c]
mov eax, dword [esi + 0x2d2c]
test eax, eax
jg 0x10016f59
push 0x4e9
push str.C:UserskarolDesktophpp_cs16hppincludesImGuiimgui.h
push str.Size___0
call fcn.100b4bce
mov eax, dword [esi + 0x2d2c]
add esp, 0xc
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2d34]
push 0x100ea88c
push ebp
lea edi, [eax + ecx*4]
call fcn.100ab9b0
add esp, 8
test eax, eax
cmovne ebp, eax
mov esi, ebp
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10016f83
mov eax, dword [0x1010e4a0]
sub esi, ecx
test eax, eax
je 0x10016f9b
inc dword [eax + 0x374]
push dword [0x1010e49c]
inc esi
push esi
call fcn.100026c0
push esi
push ebp
push eax
call fcn.100abd30
mov dword [edi - 0x1c], eax
lea esi, [ebp + 1]
mov al, byte [ebp]
add esp, 0x14
or edx, 0xffffffff
test al, al
je 0x10016fed
or ebx, 0xffffffff
cmp al, 0x23
jne 0x10016fd4
cmp byte [esi], al
jne 0x10016fd4
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100eab38]
test al, al
jne 0x10016fc6
not edx
lea eax, [edi - 0x1c]
mov dword [edi - 0x18], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10058af0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov eax, dword [0x10106024]
xor eax, esp
mov dword [esp + 4], eax
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
cmp byte [esi + 0xc], 0
je 0x10058b3a
mov eax, dword [esi + 4]
cmp ebx, eax
jne 0x10058b22
cmp dword [esi + 8], edi
je 0x10058b22
mov dword [esi + 8], edi
jmp 0x10058b84
test eax, eax
je 0x10058b3a
push eax
call dword [sym.imp.MinHook.x86.dll_MH_DisableHook]
push dword [esi + 4]
call dword [sym.imp.MinHook.x86.dll_MH_RemoveHook]
mov byte [esi + 0xc], 0
lea eax, [esp + 0xc]
mov dword [esi + 4], ebx
push eax
push 0x40
push 0xe
push ebx
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10058b6a
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100aa00f
add esp, 8
ret 8
mov ecx, dword [esi + 4]
movq xmm0, qword [ecx]
movq qword [esi + 0xd], xmm0
mov eax, dword [ecx + 8]
mov dword [esi + 0x15], eax
mov ax, word [ecx + 0xc]
mov word [esi + 0x19], ax
mov ecx, dword [esp + 0x10]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100aa00f
add esp, 8
ret 8
Function at 0x100603c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7da5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10106024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 8]
mov eax, 0x7fffffff
mov edx, dword [ebp + 0xc]
lea esi, [edi + 0x28]
mov ebx, dword [esi + 0x10]
mov dword [ebp - 0x38], edi
mov ecx, dword [edx + 0x10]
sub eax, ecx
cmp eax, ebx
jb 0x100605af
cmp dword [edx + 0x14], 0x10
jb 0x10060417
mov edx, dword [edx]
cmp dword [esi + 0x14], 0x10
jb 0x1006041f
mov esi, dword [esi]
push ebx
push esi
push ecx
push edx
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x30]
call fcn.10029d20
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
mov esi, dword [ebp - 0x14]
add esi, 0xc
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x1c], 0x10
push 0x100ea890
cmovae eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x3c], esi
push eax
call fcn.100b444a
mov ebx, dword [ebp - 0x34]
add esp, 0xc
test ebx, ebx
je 0x100604e9
push 2
push 0
push ebx
call fcn.100b4fb9
add esp, 0xc
test eax, eax
jne 0x100604de
push ebx
call fcn.100b5618
mov edi, eax
add esp, 4
test edi, edi
js 0x100604db
je 0x100604db
lea ecx, [edi + 1]
push 0x100dc474
push ecx
call fcn.100aa9a6
mov esi, eax
add esp, 8
test esi, esi
je 0x100604d8
push 0
push 0
push ebx
mov byte [esi + edi], 0
call fcn.100b4fb9
add esp, 0xc
push ebx
push edi
push 1
push esi
call fcn.100b5976
add esp, 0x10
cmp eax, edi
jne 0x100604cf
mov ecx, dword [ebp - 0x3c]
push eax
push esi
call fcn.10063400
push esi
call fcn.100aa9a1
add esp, 4
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
push dword [ebp - 0x34]
call fcn.100b576d
add esp, 4
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x100605b4
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x30], 1
jne 0x1006055a
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
push 0x100f2094
cmovae eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
call fcn.100b444a
mov eax, dword [ebp - 0x34]
add esp, 0xc
test eax, eax
je 0x1006055a
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], 0x100f53ec
mov dword [ebp - 0x14], eax
push ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.10063590
push dword [ebp - 0x34]
call fcn.100b576d
add esp, 4
mov ecx, esi
call fcn.10058290
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x10060591
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10060587
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100605b9
push edx
push ecx
call fcn.100aa01d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100aa00f
mov esp, ebp
pop ebp
ret 8
call fcn.10029f50
call fcn.100a8fc6
call fcn.100bb40e
int3