joyce8/EMBER2024-capa huggingface dataset:
Function at 0x127424b
Capabilities:
Encode data using base64

Disassembly:
dec eax
ja 0x128e398
mov dword [esp + eax*2], 0xeb93d605
xor dl, bl
ror ax, 0x63
not dl
jae 0xf3c00c
pop ebp
pushal
inc esi
cmp al, 0x6e
aas
invalid
lea edi, [ecx + edi - 0x862e]
or byte [esp + ecx - 0x8631], cl
movzx edx, word [esp + ecx - 0x8632]
shr dword [esp + ecx*2 - 0x10c64], cl
xor eax, ebx
inc eax
rol eax, 1
push ecx
btr edx, ecx
lea eax, [edx + eax - 0x35b6afcf]
setae dl
or byte [esp + ecx - 0x862d], dh
not eax
sbb cx, cx
ja 0x1211e20
xor ebx, eax
add esi, eax
movzx eax, cx
rol word [esp + ecx + 3], 0xec
xchg dword [esp + edx*4 - 0x2d803], eax
pop ecx
pop eax
jae fcn.00f4c6ca
mov cx, word [edi]
mov edx, 0xd153005
movsx eax, dx
sar eax, 0x12
lea edi, [edi + edx*2 - 0x1a2a6008]
lea ebp, [edx + ebp - 0xd153006]
push edx
movzx edx, byte [ebp + edx*2 - 0x1a2a600a]
adc al, ah
jbe 0x1007a2f
mov ecx, 0xb880228c
movzx eax, cl
mov edx, 0xfbaad523
lea ebp, [ebp + eax*2 - 0x11c]
ror edx, cl
cmovae edx, ecx
rol dl, 5
mov ecx, dword [ebp + eax*4 - 0x230]
rol edx, 4
xor ecx, ebx
lea edx, [edx - 0x29756800]
lea ecx, [ecx + edx + 0x3287019a]
cbw
neg edx
imul eax
bswap ecx
call fcn.0110edff
sub edi, 4
mov eax, 0x9396271d
mov eax, dword [edi]
mov edx, 0x7e8d4899
shl dx, 0x44
xor eax, ebx
lea ecx, [edx*2 + 0x35a769b7]
inc dx
inc eax
ror eax, 3
xchg dl, cl
rol cl, 0x63
not eax
not cx
setb cl
shl ecx, 0x66
ror eax, 3
bt ecx, ecx
neg eax
shr cx, 0x61
btc ecx, edx
xor ebx, eax
shr edx, 0x5b
add ebp, eax
rdtsc
not cx
add ecx, ecx
bts cx, 2
lea esi, [esi + ecx - 0x60414006]
mov dword [esi + ecx - 0x60413ffa], eax
inc ecx
ror cx, 0xca
mov dword [esi + ecx - 0x6041ffcf], edx
btc ecx, ecx
mov eax, ecx
jb fcn.00fb1362
cwde
or cl, dl
shl al, 0x86
sbb byte [esp + eax + 1], al
lea edx, [eax*8 + 0x47a08dac]
mov word [eax + esi], cx
mov byte [esp + eax], 0x21
mov dword [esp + eax], edi
ret
lea ecx, [esp + ecx + 4]
mov edx, dword [ecx + eax*2 - 0x119e38e8]
mov dword [esp + eax - 0x8cf1c74], 0xe6398fb3
div byte [esp + eax - 0x8cf1c73]
movzx ecx, ax
lea ebp, [eax + ebp - 0x8cf8636]
mov dword [esp + eax - 0x8cf8632], ecx
btc eax, 0x23
mov dword [ebp + eax - 0x8cf863a], edx
mov eax, dword [edi + eax*4 - 0x233e18e8]
jae 0x117e8e3
jmp dword [esi - 0x61]
neg dl
rol dl, 1
shl eax, 0xdf
neg eax
shr dword [esp + eax - 0x80000000], 0x2e
sbb dl, 0x22
shl al, 0x66
xchg dword [esp + eax - 0x80000000], eax
ror dl, 1
neg dword [esp + eax*2 - 0x75c9e]
xor bl, dl
bts eax, eax
lea edx, [esp + edx + 4]
call fcn.011cbe2b
xor ebx, edx
ror cl, 0x82
and eax, 0x788fce8f
adc edi, edx
mov eax, dword [eax + esi - 0x780ec480]
add esi, 4
and cl, ch
push ecx
sal ecx, 0xd9
mov dword [esp + ecx], eax
movzx eax, cx
call fcn.00f7a521
mov edx, esi
sub esi, 2
mov eax, 0x4813da2b
movsx ecx, al
mov word [esi + eax - 0x4813da2b], dx
mov ecx, dword [ebp + ecx*4 - 0xac]
and al, ah
push eax
lea ebp, [ebp + eax - 0x4813da06]
movzx edx, ax
xor al, 0x81
dec dx
xor ecx, ebx
xor dword [esp + eax - 0x4813da8b], 0xb38e9d22
shl al, 0x64
bswap ecx
call fcn.01151001
Function at 0x127f3b0
Capabilities:
Authenticate hmac

Disassembly:
add edi, ecx
mov ecx, dword [esp + 4]
sar dx, 8
mov dword [esp], eax
mov eax, dword [esi]
mov edx, dword [esi + 4]
cmovae ecx, dword [esp + 4]
sal cl, 0x85
rol word [esp + 4], 0x45
mov cl, byte [esi + 8]
inc dword [esp + 4]
adc esi, 5
ror dword [esp + 4], 0xca
push 0xb5076c3f
shld eax, edx, cl
shr dword [esp + 5], 0xc7
call fcn.01220c26
rol cl, 0x85
lea edi, [edi + ecx - 0xe2c1c04]
sub edx, 0xa23ca083
sal dl, 0x45
mov eax, dword [edi + ecx - 0xe2c1c00]
mov dword [esp + ecx*8 - 0x7160e000], edx
xchg dword [esp + ecx*2 - 0x1c583800], ecx
call fcn.0126e787

Function at 0x128c002
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x8e232593
lea esp, [esp + 0x10]
je 0x106dfb2
push edi
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
push 0x8a37d59c
shr byte [esp], 0xe6
not byte [esp + 2]
mov edi, dword [edi*4 + 0x115c0c0]
not word [esp]
shl dword [esp], 0x21
rol byte [esp], 0x21
shr eax, 8
ror byte [esp + 2], 0x62
xor eax, edi
inc edx
xor eax, 0xa5198d0f
push 0xf5b994a1
or dword [esp + 1], 0x609f2301
dec ecx
push 0x4c2d8533
push 0x7b075e86
lea esp, [esp + 0x10]
jne 0x106df49
mov edi, 0x4a210a1d
mov edx, edi
pop edi
mov edx, 0xcbb18eb5
not eax
movsx ecx, dx
xadd cx, dx
mov dword [edi], eax
lea eax, [ecx*8 + 0x5611f287]
mul edx
lea ebp, [ebp + edx - 0x44764b67]
bt edx, ecx
btc eax, eax
mov ecx, dword [ebp + edx - 0x44764b63]
cdq
cwd
neg edx
xor ecx, ebx
bswap ecx
and dx, ax
xchg dx, ax
not ecx
lea ecx, [ecx + edx*2 - 0xb824bba]
lea eax, [edx + eax*4 - 0x1ce809f6]
adc dl, ah
not dl
neg ecx
sal edx, 0xd2
lea eax, [edx + edx*8 + 0x3d141e19]
btc ax, dx
xor ebx, ecx
bt ax, ax
bts eax, eax
btr eax, 0xa0
adc esi, ecx
not eax
movzx ecx, al
jmp esi
jmp 0x106df36
Function at 0x1291ea2
Capabilities:
Execute syscall

Disassembly:
lea ecx, [ecx + edx - 0x390f8f4d]
ror ecx, 3
lea ecx, [ecx + edx*8 + 0x2d2c36de]
shr dword [esp + edx - 0x37], 0x43
push eax
xor ebx, ecx
add esi, ecx
push 0xc6228929
mul ecx
mov ecx, 0xd913ed2d
xor cx, cx
mov dword [edi], edx
call fcn.00f67560
call fcn.00f10948
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov eax, dword [esp]
mov dword [edi + 4], ecx
mov dword [esp + 4], 0x25316908
xor dword [esp + 1], 0x2e9b043d
neg dword [esp + 4]
mov dword [edi], edx
xadd byte [esp], ah
movzx edx, word [esp + 4]
mov ebx, dword [esp + edx*2 - 0x12dac]
lea ebp, [ebp + edx*4 - 0x25b6c]
sal ax, 0xd
mov ecx, eax
push ecx
mov ecx, dword [ebp + edx*4 - 0x25b68]
sar ax, 0x47
xor ecx, ebx
bswap ecx
shr word [esp + edx - 0x96da], 0x2a
mul word [esp + edx*8 - 0x4b6cd]
jb 0x10f0f1f
mov eax, 0x39081a83
mov edx, eax
mov ecx, dword [eax + ebp - 0x39081a83]
or ax, ax
lea ebp, [eax + ebp - 0x39081a7f]
xor ecx, ebx
xor edx, 0xfe90dfb7
sbb eax, 0x4fad859c
adc al, 0x9b
ror ecx, 3
add dl, 0xaa
jb 0x11c891f
neg ecx
dec ecx
call fcn.0128819d
rol edx, 3
call fcn.011472fc
push 0xa68b8e19
mov eax, dword [ebp]
add ebp, 4
mov ecx, 0x87afaf07
xor eax, ebx
movsx edx, cl
shl dx, 0xe9
not eax
shr ecx, 0xb3
xor eax, 0x4b0857b8
sub word [esp + ecx*4 - 0x43d3], cx
bswap eax
xadd edx, ecx
adc eax, 0x9fa36233
not ecx
xor ecx, edx
xor ebx, eax
not word [esp + edx - 0x1ef5]
neg cl
add edi, eax
mov eax, dword [esi + edx*4 - 0x7bd4]
sub byte [esp + edx*8 - 0xf7a6], ch
mov cl, byte [esi + edx - 0x1ef1]
rol byte [esp + edx*4 - 0x7bd3], 6
ror dword [esp + edx - 0x1ef5], 0x74
lea esi, [esi + edx*2 - 0x3de8]
not edx
shr eax, cl
mov ecx, edx
mov dword [esi], eax
pop edx
jmp edi
jmp 0x11e18cd
push 0xc737bd21
sbb edi, 8
jmp 0x126ca93
Function at 0x10001220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10082450]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
xor edx, edx
push ebx
movzx eax, al
mov dword [ebp - 0x14], edx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x10001248
xor al, al
jmp 0x10001264
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov bl, byte [esi]
test al, al
je 0x10001282
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1003cad0
mov esp, ebp
pop ebp
ret

Function at 0x100012a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10082450]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
xor edx, edx
movzx eax, al
shl eax, 2
mov dword [ebp - 0x14], edx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x100012ca
xor al, al
jmp 0x100012e6
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov esi, dword [esi]
test al, al
je 0x10001304
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003cad0
mov esp, ebp
pop ebp
ret

Function at 0x10001d70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064cf0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082450]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1003c58e
mov esi, eax
add esp, 4
test esi, esi
je 0x10001dd0
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1003bc5d
add esp, 4
mov dword [esi + 4], eax
jmp 0x10001dd2
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064ff0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10082450]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100834a4], 0
jne 0x10003eeb
sub esp, 8
mov dword [ebp - 4], 0
mov eax, esp
lea ecx, [ebp - 0x34]
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [eax], str.ModMenu.ini
mov dword [eax + 4], 0xb
call fcn.10001f10
lea ecx, [ebp - 0x34]
call fcn.10002a60
mov eax, dword [0x10083490]
lea ecx, [ebp - 0x14]
add eax, 0x35c61c
push eax
call fcn.10002450
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], esi
call edi
test eax, eax
setne byte [ebp - 0x18]
mov esi, dword [esi]
test eax, eax
je 0x10003e6b
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x24]
call edi
test esi, esi
je 0x10003ee4
push 1
push ecx
mov ecx, esp
push esi
call fcn.10002450
call fcn.100012a0
add esp, 8
add eax, 0x1c
je 0x10003ee4
push 1
push ecx
mov ecx, esp
push eax
call fcn.10002450
call fcn.100012a0
add esp, 8
add eax, 0x5667
je 0x10003ee4
push eax
lea ecx, [ebp - 0x14]
call fcn.10002450
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], esi
call edi
test eax, eax
setne byte [ebp - 0x18]
mov byte [esi], 0
cmp byte [ebp - 0x18], 0
je 0x10003ee4
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x24]
call edi
mov byte [0x100834a4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003cad0
mov esp, ebp
pop ebp
ret
Function at 0x10005510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006512d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10082450]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1003c58e
mov edi, eax
add esp, 4
test edi, edi
je 0x100055b4
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1003bc5d
add esp, 4
mov dword [edi + 4], eax
jmp 0x100055b6
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10001960
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov ecx, dword [ebp - 0x10]
mov bl, al
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x10005610
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x10005610
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x1000562c
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1000564f
cmp byte [ebp + 0xc], 0
je 0x1000563b
push esi
call fcn.1003c0f2
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1000565b
mov esi, str.ios_base::badbit_set
jmp 0x1000566b
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100056a0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10002370
push 0x1007f9f8
lea eax, [ebp - 0x28]
push eax
call fcn.1003dcae
int3
Function at 0x10006f30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x10006f5c
jl 0x10006f50
test ecx, ecx
jne 0x10006f5c
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x1000700e
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.10004410
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x10006fc3
jg 0x10006f88
test esi, esi
je 0x10006fc3
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x10006f9d
mov eax, dword [ebp - 8]
jl 0x10006f98
cmp eax, esi
jae 0x10006f9d
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1003e180
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10006fe2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x10006ff8
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x10006f70
jl 0x10006ff8
test ecx, ecx
jne 0x10006f70
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1000704a
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x1000704a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [ebp - 4]
call fcn.1003e180
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x100070b7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10007070
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x100070a2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10042b26
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100070b7
cmp edi, eax
ja 0x10007080
test edi, edi
je 0x100070b7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10042b26
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10007520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10007552
sub eax, 1
jne 0x10007549
push eax
push eax
push eax
push 0x100074a0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1002d980
call fcn.1002dd20
push 0
call fcn.1000ed00
add esp, 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]

Function at 0x10007580
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10082450]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0x10]
mov dword [ebp - 0x14], 0
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x100075bc
mov byte [ebp - 8], al
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003cad0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
mov byte [ebp - 8], al
mov byte [esi], bl
test al, al
je 0x100075f5
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003cad0
mov esp, ebp
pop ebp
ret

Function at 0x10007610
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10082450]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0x10]
shl eax, 2
mov dword [ebp - 0x14], 0
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x10007651
movss xmm0, dword [ebp + 0xc]
mov byte [ebp - 8], al
movss dword [esi], xmm0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003cad0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [ebp + 0xc]
test eax, eax
setne al
mov byte [ebp - 8], al
movss dword [esi], xmm0
test al, al
je 0x10007691
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1003cad0
mov esp, ebp
pop ebp
ret
Function at 0x10011280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x100112a7
push 0x52d
push str.D:MGRDW_6_SDK_srcimguiimgui.h
push str.Size___0
call fcn.10043d91
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10066848]
sub edi, 1
jne 0x100112c1
mov ecx, dword [0x100834f0]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a34], eax
jne 0x100112f3
mov dword [ecx + 0x1a38], eax
cmp dword [ecx + 0x1a6c], eax
jne 0x10011302
mov byte [ecx + 0x1a70], 1
pop ebp
ret 4

Function at 0x10011d50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x10011db3
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10011d96
cmp edi, 2
jb 0x10011d96
cmp byte [esi], cl
jne 0x10011d96
cmp byte [esi + 1], cl
jne 0x10011d96
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10066848]
jmp 0x10011d67
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10066848]
test edi, edi
jne 0x10011d67
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10011de8
nop word [eax + eax]
cmp cl, 0x23
jne 0x10011dcf
cmp byte [esi], cl
jne 0x10011dcf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10066848]
test cl, cl
jne 0x10011dc0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10012690
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi], 0
jne 0x100126aa
cmp byte [edi + 0x2d94], 0
je 0x100126c1
push 0xc21
push str.D:MGRDW_6_SDK_srcimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call fcn.10043d91
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x10067471
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x100126ee
cmp byte [esi], al
jne 0x100126ee
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10066848]
test al, al
jne 0x100126e0
mov esi, dword [edi + 0x2da8]
not edx
mov ecx, dword [edi + 0x2dac]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x1001d460
mov dword [ebp - 0xc], 0x1001d390
mov dword [ebp - 8], 0x1001d490
cmp esi, ecx
jne 0x100127d0
inc esi
test ecx, ecx
je 0x10012745
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1001274a
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x100127d0
mov eax, dword [0x100834f0]
test eax, eax
je 0x10012762
inc dword [eax + 0x374]
push dword [0x100834f8]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [0x10082018]
mov ebx, eax
add esp, 8
mov eax, dword [edi + 0x2db0]
test eax, eax
je 0x100127c4
mov ecx, dword [edi + 0x2da8]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call fcn.1003e180
mov ecx, dword [edi + 0x2db0]
add esp, 0xc
test ecx, ecx
je 0x100127b4
mov eax, dword [0x100834f0]
test eax, eax
je 0x100127b4
dec dword [eax + 0x374]
push dword [0x100834f8]
push ecx
call dword [0x1008201c]
add esp, 8
mov dword [edi + 0x2db0], ebx
mov dword [edi + 0x2dac], esi
mov eax, dword [edi + 0x2da8]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2db0]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2da8]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret