joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a340
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push edi
push esi
call sym.slink.exe__sys_error_none_4
call sym.slink.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x41a376
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.slink.exe__file_inet_sockaddr_init_4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
lea eax, [esp + 0xc]
push 4
push eax
call sym.slink.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.slink.exe__sys_order_flip_8
push dword [0x42e498]
lea eax, [esp + 0xc]
push eax
push edi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x41a366
mov esi, dword [esp + 0x24]
push esi
call fcn.0041a190
mov dword [esi + 0x920], edi
pop edi
pop esi
add esp, 0x10
ret 0x10

Function at 0x41a770
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
mov eax, 0x20
mov ebx, 0x400
mov word [esp + 0xc], ax
lea eax, [esp + 0x30]
push 0x42e718
push eax
mov dword [esp + 0x38], ebx
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0x34]
push eax
call sym.slink.exe__string_append1_8
mov edi, dword [esp + 0x438]
mov eax, dword [edi]
push dword [eax + 0x970]
lea eax, [esp + 0x10]
push eax
call sym.slink.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
call sym.slink.exe__string_append_8
push 0x42e768
lea eax, [esp + 0x34]
push eax
call sym.slink.exe__string_appends_8
mov ax, word [esp + 0x32]
cmp ax, bx
jle 0x41a803
cwde
push 0x431573
sub eax, ebx
push eax
push 0x42e714
call fcn.004044b0
mov ax, word [esp + 0x3e]
add esp, 0xc
test ax, ax
jle 0x41a816
cmp ax, bx
jge 0x41a812
movsx esi, ax
jmp 0x41a818
mov esi, ebx
jmp 0x41a818
xor esi, esi
push 1
call fcn.0040a50c
push eax
push esi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.0040a7a1
push 0x42e7b8
call fcn.004044b0
mov eax, dword [edi]
add esp, 0x18
movzx ecx, word [eax + 0x56a]
cmp cx, bx
jle 0x41a865
movsx eax, cx
push 0x431574
sub eax, 0x400
push eax
push 0x42e7bc
call fcn.004044b0
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 0x56a]
test ax, ax
jle 0x41a87f
cmp ax, bx
jge 0x41a87b
movsx esi, ax
jmp 0x41a881
mov esi, ebx
jmp 0x41a881
xor esi, esi
push 1
call fcn.0040a50c
push eax
mov eax, dword [edi]
push esi
add eax, 0x56c
push 1
push eax
call fcn.0040a7a1
push 0x42e7c0
call fcn.004044b0
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x428
ret 4
Function at 0x41a8c0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0041a770
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 2]
cmp cx, 0x50
jle 0x41a8f6
movsx eax, cx
push 0x43156f
sub eax, 0x50
push eax
push 0x42e700
call fcn.004044b0
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 2]
test ax, ax
jle 0x41a911
cmp ax, 0x50
jge 0x41a90a
movsx esi, ax
jmp 0x41a913
mov esi, 0x50
jmp 0x41a913
xor esi, esi
push 1
call fcn.0040a50c
push eax
mov eax, dword [edi]
push esi
add eax, 4
push 1
push eax
call fcn.0040a7a1
push 0x42e704
call fcn.004044b0
mov eax, dword [esp + 0x2c]
add esp, 0x18
movsx eax, word [eax]
pop edi
pop esi
cmp eax, 2
jle 0x41a95a
push 0x431572
add eax, 0xfffffffe
push eax
push 0x42e708
call fcn.004044b0
add esp, 0xc
push 0x20
push 0x42e70c
call fcn.004044b0
push 0x5e
push 0x42e710
call fcn.004044b0
add esp, 0x10
ret 0xc

Function at 0x41aa20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0x20
mov ax, word [edi]
mov word [ebx], ax
movzx eax, word [edi]
cmp ax, word [esi + 2]
jg 0x41aa7b
nop dword [eax]
cwde
mov cl, byte [eax + esi + 3]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x41aa7b
push ecx
lea eax, [esp + 0x10]
push eax
call sym.slink.exe__string_append1_8
mov ax, word [edi]
inc ax
movzx ecx, ax
mov word [edi], ax
mov eax, ecx
cmp cx, word [esi + 2]
jle 0x41aa50
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push esi
push dword [esp + 0x44]
push eax
call sym.slink.exe__string_t_int_12
push esi
call sym.slink.exe__sys_error_4
test al, al
je 0x41ab55
cmp byte [esp + 0x34], 0
je 0x41ab4f
push 1
call fcn.0040a50c
push eax
push 0xd
push 1
push str.Bad_integer__
call fcn.0040a7a1
mov ax, word [esp + 0x22]
add esp, 0x14
cmp ax, 0x20
jle 0x41aae7
cwde
push 0x43156e
sub eax, 0x20
push eax
push 0x42e6f4
call fcn.004044b0
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x41aafe
cmp ax, 0x20
jge 0x41aaf7
movsx esi, ax
jmp 0x41ab00
mov esi, 0x20
jmp 0x41ab00
xor esi, esi
push 1
call fcn.0040a50c
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040a7a1
push 1
call fcn.0040a50c
push eax
push 2
push 1
push 0x42e6f8
call fcn.0040a7a1
push 0x42e6fc
call fcn.004044b0
add esp, 0x2c
push ebx
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0041a8c0
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
mov ax, word [ebx]
mov word [edi], ax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
Function at 0x41b750
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x208c
call fcn.00407110
push esi
push edi
mov eax, 0x2000
mov edi, 0x84
mov word [esp + 0x90], ax
lea eax, [esp + 8]
push str.Syntax_error_occurred_on_line
push eax
mov dword [esp + 0x10], edi
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_append1_8
mov esi, dword [esp + 0x2098]
mov eax, dword [esi]
push dword [eax + 0x970]
lea eax, [esp + 0x94]
push eax
call sym.slink.exe__string_f_int_8
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_append_8
push 0x42e9d8
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_append1_8
mov eax, dword [esi]
add eax, 0x568
push eax
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_append_8
mov ax, word [esp + 0xa]
cmp ax, di
jle 0x41b80d
cwde
push 0x4315ce
sub eax, edi
push eax
push 0x42e984
call fcn.004044b0
mov ax, word [esp + 0x16]
add esp, 0xc
test ax, ax
jle 0x41b820
cmp ax, di
jge 0x41b81c
movsx esi, ax
jmp 0x41b822
mov esi, edi
jmp 0x41b822
xor esi, esi
push 1
call fcn.0040a50c
push eax
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040a7a1
push 0x42ea28
call fcn.004044b0
add esp, 0x18
call sym.slink.exe__sys_bomb_0
pop edi
pop esi
add esp, 0x208c
ret 4
Function at 0x41c6a0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x918]
cmp byte [eax], 0
jne 0x41c6bb
add eax, 8
mov dword [esp + 4], eax
jmp sym.slink.exe__file_close_4
ret 4

Function at 0x41c700
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.slink.exe__sys_error_none_4
mov edi, dword [esp + 0x10]
test edi, edi
je 0x41c799
push ebx
push dword [0x431674]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x24]
push dword [eax + 0x920]
call sub.KERNEL32.dll_ReadFile
mov ebx, dword [esp + 0x1c]
test al, al
jne 0x41c75b
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
je 0x41c765
mov dword [esi + 0xc], eax
mov eax, ebx
pop ebx
pop edi
pop esi
mov dword [eax], 0
ret 0x14
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
test eax, eax
jne 0x41c77b
push esi
push 1
push 0xfffffffffffffffd
mov dword [ebx], 0
call sym.slink.exe__sys_stat_set_12
pop ebx
pop edi
pop esi
ret 0x14
cmp eax, edi
jae 0x41c798
push esi
push 0xa
push 0xfffffffffffffffd
call sym.slink.exe__sys_stat_set_12
push esi
push edi
call sym.slink.exe__sys_stat_parm_int_8
push esi
push dword [ebx]
call sym.slink.exe__sys_stat_parm_int_8
pop ebx
pop edi
pop esi
ret 0x14
Function at 0x41df60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
cmp byte [0x430a68], 0
mov eax, 0x20
mov word [esp + 4], ax
jne 0x41df7b
call sym.slink.exe__sys_read_env_global_0
push esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x34]
call sym.slink.exe__string_copy_8
lea eax, [esp + 8]
push eax
call sym.slink.exe__string_upcase_4
mov eax, dword [0x433e0c]
mov esi, 0x433e0c
mov dword [esp + 4], eax
test eax, eax
je 0x41dfc6
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_equal_8
test al, al
jne 0x41e027
mov esi, dword [esp + 4]
mov eax, dword [esi]
mov dword [esp + 4], eax
test eax, eax
jne 0x41dfa6
lea eax, [esp + 4]
push eax
push pe_nt_image_headers32
call sym.slink.exe__sys_mem_alloc_8
mov eax, dword [esp + 4]
test eax, eax
jne 0x41e009
push 1
call fcn.0040a50c
push eax
push 0x3a
push 1
push str.Unable_to_allocate_more_virtual_memory.__The_disk_is_full.
call fcn.0040a7a1
push 0x42ee04
call fcn.004044b0
add esp, 0x18
call sym.slink.exe__sys_bomb_0
mov eax, dword [esp + 4]
add eax, 4
push eax
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__sys_read_env_lang_8
mov eax, dword [esp + 4]
mov dword [eax], 0
mov eax, dword [esp + 4]
mov dword [esi], eax
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x34]
add ecx, 4
pop esi
mov dword [eax], ecx
add esp, 0x28
ret 8

Function at 0x41e1e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040a50c
push eax
push 0x2e
push 1
push str.Error_reading_global.env_environment_file_set.
call fcn.0040a7a1
push 0x42f140
call fcn.004044b0
add esp, 0x18
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x42f070
push eax
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_append1_8
mov edi, dword [esp + 0x428]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.slink.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_append_8
push 0x42f0c0
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41e29c
cwde
push 0x43182a
sub eax, ebx
push eax
push 0x42f144
call fcn.004044b0
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41e2af
cmp ax, bx
jge 0x41e2ab
movsx esi, ax
jmp 0x41e2b1
mov esi, ebx
jmp 0x41e2b1
xor esi, esi
push 1
call fcn.0040a50c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a7a1
push 0x42f148
call fcn.004044b0
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41e303
movsx eax, cx
push 0x43182b
sub eax, 0x400
push eax
push 0x42f14c
call fcn.004044b0
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41e316
cmp ax, bx
jge 0x41e312
movsx esi, ax
jmp 0x41e318
mov esi, ebx
jmp 0x41e318
xor esi, esi
push 1
call fcn.0040a50c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a7a1
push 0x42f150
call fcn.004044b0
add esp, 0x18
call sym.slink.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 4
Function at 0x41eca0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040a50c
push eax
push 0xe
push 1
push str.Error_reading
call fcn.0040a7a1
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x41ed06
movsx eax, cx
push 0x43188a
sub eax, 0x20
push eax
push 0x42f388
call fcn.004044b0
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x41ed1d
cmp ax, 0x20
jge 0x41ed16
movsx esi, ax
jmp 0x41ed1f
mov esi, 0x20
jmp 0x41ed1f
xor esi, esi
push 1
call fcn.0040a50c
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0040a7a1
push 1
call fcn.0040a50c
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.0040a7a1
push 0x42f3b0
call fcn.004044b0
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push str.Error_on_line
push eax
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.slink.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_append_8
push str._of_file
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41edd5
cwde
push 0x43188b
sub eax, 0x400
push eax
push 0x42f3b4
call fcn.004044b0
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41ede8
cmp ax, bx
jge 0x41ede4
movsx esi, ax
jmp 0x41edea
mov esi, ebx
jmp 0x41edea
xor esi, esi
push 1
call fcn.0040a50c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a7a1
push 0x42f3b8
call fcn.004044b0
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41ee3c
movsx eax, cx
push 0x43188c
sub eax, 0x400
push eax
push 0x42f3bc
call fcn.004044b0
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41ee4f
cmp ax, bx
jge 0x41ee4b
movsx esi, ax
jmp 0x41ee51
mov esi, ebx
jmp 0x41ee51
xor esi, esi
push 1
call fcn.0040a50c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a7a1
push 0x42f3c0
call fcn.004044b0
add esp, 0x18
call sym.slink.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10004540
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100045a1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10004584
cmp edi, 2
jb 0x10004584
cmp byte [esi], cl
jne 0x10004584
cmp byte [esi + 1], cl
jne 0x10004584
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10058740]
jmp 0x10004555
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10058740]
test edi, edi
jne 0x10004555
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100045d0
cmp cl, 0x23
jne 0x100045b7
cmp byte [esi], cl
jne 0x100045b7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10058740]
test cl, cl
jne 0x100045a8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10004770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10004795
push 0x736
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x100047a2
mov dword [edi], 0
mov edx, 0x10061b80
mov ecx, esi
call fcn.100045e0
mov esi, eax
test esi, esi
je 0x10004892
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10004888
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004888
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10004888
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004888
mov eax, dword [0x10071684]
test eax, eax
je 0x1000481c
inc dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10004888
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000486d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10071684]
add esp, 4
test eax, eax
je 0x1000485a
dec dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x1000487f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006d40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 0xfc], 0
mov dword [ebp - 8], edi
jg 0x10006d7c
push 0x756
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [ebx + 0xfc]
lea edx, [ebp - 8]
mov ebx, dword [ebx + 0x104]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10058740]
sub esi, 1
jne 0x10006d96
mov eax, dword [0x10071684]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x10006dce
push ecx
push edi
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10029670
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10055654
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b6d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x1001b752
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001b70c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1002a990
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10004de0
mov edx, dword [esi]
mov ecx, 0x10071676
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10004de0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001bc20
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x1001bc5c
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x1001bc42
cmp byte [esi], al
jne 0x1001bc42
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x10058740]
test al, al
jne 0x1001bc34
pop ebx
not ecx
call fcn.1001bb60
test eax, eax
jne 0x1001bc70
mov ecx, edi
pop edi
pop esi
jmp fcn.1001ba80
pop edi
pop esi
ret

Function at 0x1001bc80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10071684]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x1001bcc7
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x1001bcae
cmp byte [edx], al
jne 0x1001bcae
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10058740]
test al, al
jne 0x1001bca0
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x537c]
test eax, eax
jle 0x1001bd1f
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor edi, edi
test esi, esi
js 0x1001bce8
cmp esi, eax
jl 0x1001bd05
push 0x74d
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.h
push str.i___0__i___Size
call edx
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [ecx + 0x5384]
cmp dword [eax + edi + 4], ebx
je 0x1001bd28
mov eax, dword [ecx + 0x537c]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x1001bce0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x1001bd34
cmp esi, dword [ecx + 0x537c]
jl 0x1001bd48
push 0x74d
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.h
push str.i___0__i___Size
call edx
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x5384]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret
Function at 0x10027610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
push dword [ebx + 0x390]
lea ecx, [esi + 0x5340]
call fcn.10004b80
cmp dword [ebx + 0x388], 0
mov edi, eax
je 0x10027652
push 0x41bf
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.cpp
push str.window__DockNode__0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
test edi, edi
je 0x10027671
cmp dword [edi + 0x1c], 0
je 0x100276a2
push 1
mov edx, ebx
call fcn.10020690
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x390]
mov ecx, esi
call fcn.1001f770
mov edi, eax
mov eax, dword [edi + 0x9c]
and eax, 0xfffffe92
or eax, 0x92
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0x3ea0]
mov dword [edi + 0x84], eax
test byte [edi + 0xa0], 1
jne 0x10027766
mov esi, edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100276c3
mov esi, eax
test byte [esi + 0xa0], 1
je 0x100276b1
movss xmm0, dword [esi + 0x3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x100276da
movss xmm0, dword [esi + 0x40]
comiss xmm0, xmm1
ja 0x100276f2
push 0x41d9
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.cpp
push str.ancestor_node__Size.x___0.0f__ancestor_node__Size.y___0.0f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x18]
mov edx, esi
test eax, eax
je 0x10027709
nop dword [eax + eax]
mov edx, eax
mov eax, dword [edx + 0x18]
test eax, eax
jne 0x10027700
and byte [edx + 0xa0], 0xdf
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x1002771c
call fcn.100217f0
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x10027728
call fcn.100217f0
cmp dword [edx + 0x18], 0
jne 0x1002774e
mov eax, dword [edx + 0x78]
test eax, eax
je 0x1002774e
nop word [eax + eax]
or byte [eax + 0xa0], 0x20
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x10027740
push dword [esi + 0x40]
mov edx, edi
mov ecx, esi
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call fcn.10025b40
add esp, 0x10
mov esi, dword [ebp - 4]
mov ecx, edi
mov bl, byte [edi + 0xa0]
mov edx, esi
push 1
call fcn.10020cf0
mov al, byte [edi + 0xa0]
add esp, 4
xor al, bl
and al, 1
xor byte [edi + 0xa0], al
cmp edi, dword [esi + 0x388]
je 0x100277ad
push 0x41e2
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.cpp
push str.node__window__DockNode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret