joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100066e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081b40
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100beec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100c07cc]
push dword [0x100a4014]
mov ebx, dword [0x100c07b4]
mov edi, dword [eax + 0x60]
call fcn.100538b0
mov ecx, dword [0x100c07c8]
add esp, 4
test al, al
je 0x1000685f
cmp byte [0x100c0785], 0
je 0x1000685f
mov eax, dword [0x100c0788]
cmp byte [eax], 0
je 0x1000685f
cmp dword [ecx], 1
jne 0x1000685f
test edi, edi
je 0x100068f6
movss xmm0, dword [ebx + 0x3c]
ucomiss xmm0, dword [0x100837e4]
lahf
test ah, 0x44
jp 0x10006779
mov byte [0x100c0786], 1
jmp 0x1000681d
mov eax, dword [0x100c0760]
push ecx
mov dword [esp], 0x3f800000
add eax, 0xa03a70
push 0
mov ecx, ebx
mov byte [0x100c0786], 0
call eax
mov eax, dword [0x100c0760]
push ecx
mov dword [esp], 0x3f800000
add eax, 0xa03a70
push 1
mov ecx, ebx
call eax
mov eax, dword [0x100c0760]
push ecx
mov dword [esp], 0x3f800000
add eax, 0xa03a70
push 2
mov ecx, ebx
call eax
mov eax, dword [0x100c0760]
push ecx
mov dword [esp], 0x3f800000
add eax, 0xa03a70
push 3
mov ecx, ebx
call eax
mov eax, dword [0x100c0760]
lea ecx, [edi + 0x3fa0]
sub esp, 8
add eax, 0xaaa6e0
mov dword [esp + 4], 0
mov dword [esp], 0x42b40000
call eax
mov eax, dword [edi]
mov ecx, edi
push 0
push 0x66
mov eax, dword [eax + 0x3e0]
call eax
cmp byte [0x100c0786], 0
je 0x10006850
mov eax, dword [edi]
lea esi, [edi + 0x3fa0]
push esi
push 0
mov ecx, edi
mov eax, dword [eax + 0x3e0]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0
mov eax, dword [eax + 0x3e0]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0
mov eax, dword [eax + 0x3e0]
call eax
mov ecx, dword [0x100c07c8]
mov byte [0x100c07fd], 0
jmp 0x10006867
test edi, edi
je 0x100068f6
cmp dword [ecx], 1
jne 0x10006914
cmp byte [0x100c0786], 0
je 0x10006914
mov eax, dword [0x100c0760]
push ecx
mov dword [esp], 0x31653937
add eax, 0xa03a70
push 0
mov ecx, ebx
call eax
mov eax, dword [0x100c0760]
push ecx
mov dword [esp], 0x4d8ef3c3
add eax, 0xa03a70
push 1
mov ecx, ebx
call eax
mov eax, dword [0x100c0760]
push ecx
mov dword [esp], 0x31653937
add eax, 0xa03a70
push 2
mov ecx, ebx
call eax
mov eax, dword [0x100c0760]
push ecx
mov dword [esp], 0x31653937
add eax, 0xa03a70
push 3
mov ecx, ebx
call eax
mov byte [0x100c07fd], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x100c07fd], 0
jne 0x10006914
mov eax, dword [0x100c0760]
mov ecx, ebx
add eax, 0xa03b10
call eax
mov byte [0x100c07fd], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006e70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100beec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x14]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
test al, al
push esi
mov esi, dword [ebp + 0x10]
cmovne ecx, esi
mov dword [ebp - 0x14], 0
test ecx, ecx
jne 0x10006ea2
mov byte [ebp - 8], cl
jmp 0x10006ebf
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc]
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
push esi
push ebx
push dword [ebp + 8]
call fcn.10056a60
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10006ee9
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10054ef6
mov esp, ebp
pop ebp
ret
Function at 0x100082c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081cbd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100beec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10054dd3
mov edi, eax
add esp, 4
test edi, edi
je 0x10008364
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1005449e
add esp, 4
mov dword [edi + 4], eax
jmp 0x10008366
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10001c80
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov ecx, dword [ebp - 0x10]
mov bl, al
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x100083c0
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x100083c0
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x100083dc
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100083ff
cmp byte [ebp + 0xc], 0
je 0x100083eb
push esi
call fcn.10054934
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1000840b
mov esi, str.ios_base::badbit_set
jmp 0x1000841b
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10008450
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10002710
push 0x100a2208
lea eax, [ebp - 0x28]
push eax
call fcn.10056591
int3
Function at 0x1000a0b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x1000a0dc
jl 0x1000a0d0
test ecx, ecx
jne 0x1000a0dc
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x1000a18e
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.10007090
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x1000a143
jg 0x1000a108
test esi, esi
je 0x1000a143
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x1000a11d
mov eax, dword [ebp - 8]
jl 0x1000a118
cmp eax, esi
jae 0x1000a11d
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10056a60
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000a162
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x1000a178
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x1000a0f0
jl 0x1000a178
test ecx, ecx
jne 0x1000a0f0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1000a1ca
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x1000a1ca
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [ebp - 4]
call fcn.10056a60
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x1000a237
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000a1f0
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x1000a222
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1005f935
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1000a237
cmp edi, eax
ja 0x1000a200
test edi, edi
je 0x1000a237
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1005f935
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000abd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100beec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
push ebx
push ecx
mov ecx, esp
push edi
mov dword [ecx], eax
call fcn.100042c0
mov esi, dword [ebp + 0xc]
add esp, 0xc
movzx eax, bl
mov dword [ebp - 0x14], 0
test bl, bl
jne 0x1000ac14
mov byte [ebp - 8], bl
mov byte [esi], 0xe8
jmp 0x1000ac4c
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov byte [esi], 0xe8
test eax, eax
je 0x1000ac4c
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push 4
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, esp
push ecx
mov dword [edx], ecx
mov edx, esp
mov ecx, dword [ebp + 0xc]
inc ecx
mov dword [edx], ecx
call fcn.10005840
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10054ef6
mov esp, ebp
pop ebp
ret
Function at 0x1000ad00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100beec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
sub ecx, 1
je 0x1000ae03
sub ecx, 1
je 0x1000ada6
sub ecx, 2
je 0x1000ad45
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054ef6
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebp + 0x14]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
shl ecx, 2
mov dword [ebp - 0x14], edx
test ecx, ecx
jne 0x1000ad64
xor cl, cl
jmp 0x1000ad7f
lea edx, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x14], eax
call ebx
mov edx, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov esi, dword [esi]
test cl, cl
je 0x1000ad9c
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push edx
call ebx
mov eax, dword [ebp + 0xc]
add eax, 4
add eax, esi
jmp 0x1000ae63
movzx ecx, byte [ebp + 0x14]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x14], edx
add ecx, ecx
jne 0x1000adc2
xor cl, cl
jmp 0x1000addd
lea edx, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x14], eax
call ebx
mov edx, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
movzx esi, word [esi]
test cl, cl
je 0x1000adfb
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push edx
call ebx
mov eax, dword [ebp + 0xc]
movsx ecx, si
add ecx, 2
jmp 0x1000ae61
movzx ecx, byte [ebp + 0x14]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x14], edx
test ecx, ecx
jne 0x1000ae1f
xor cl, cl
jmp 0x1000ae3a
lea edx, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x14], eax
call ebx
mov edx, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov ch, byte [esi]
mov byte [ebp - 0x19], ch
test cl, cl
je 0x1000ae5d
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push edx
call ebx
mov eax, dword [ebp + 0xc]
mov ch, byte [ebp - 0x19]
movsx ecx, ch
inc eax
add eax, ecx
mov ecx, dword [ebp - 4]
mov dword [edi], eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.10054ef6
mov esp, ebp
pop ebp
ret
Function at 0x100197d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x100197f7
push 0x52d
push str.D:Dev_Arc2MGRModingcppRisingDevMenu_srcimguiimgui.h
push str.Size___0
call fcn.1006664e
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100870a0]
sub edi, 1
jne 0x10019811
mov ecx, dword [0x100c29e4]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a34], eax
jne 0x10019843
mov dword [ecx + 0x1a38], eax
cmp dword [ecx + 0x1a6c], eax
jne 0x10019852
mov byte [ecx + 0x1a70], 1
pop ebp
ret 4

Function at 0x100198e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100beec0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x10019914
push 0x52d
push str.D:Dev_Arc2MGRModingcppRisingDevMenu_srcimguiimgui.h
push str.Size___0
call fcn.1006664e
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov ecx, dword [esi + 0xbc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc4]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100870a0]
sub edi, 1
jne 0x10019974
mov eax, dword [0x100c29e4]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a34], edx
jne 0x100199a5
mov dword [eax + 0x1a38], edx
cmp dword [eax + 0x1a6c], edx
jne 0x100199b4
mov byte [eax + 0x1a70], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.10054ef6
mov esp, ebp
pop ebp
ret 4
Function at 0x1001a740
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x1001a7a3
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1001a786
cmp edi, 2
jb 0x1001a786
cmp byte [esi], cl
jne 0x1001a786
cmp byte [esi + 1], cl
jne 0x1001a786
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100870a0]
jmp 0x1001a757
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100870a0]
test edi, edi
jne 0x1001a757
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1001a7d8
nop word [eax + eax]
cmp cl, 0x23
jne 0x1001a7bf
cmp byte [esi], cl
jne 0x1001a7bf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100870a0]
test cl, cl
jne 0x1001a7b0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1001b610
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi], 0
jne 0x1001b62a
cmp byte [edi + 0x2d94], 0
je 0x1001b641
push 0xf38
push str.D:Dev_Arc2MGRModingcppRisingDevMenu_srcimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call fcn.1006664e
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x10088001
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x1001b66e
cmp byte [esi], al
jne 0x1001b66e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100870a0]
test al, al
jne 0x1001b660
mov esi, dword [edi + 0x2da8]
not edx
mov ecx, dword [edi + 0x2dac]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x100269e0
mov dword [ebp - 0xc], 0x10026910
mov dword [ebp - 8], 0x10026a10
cmp esi, ecx
jne 0x1001b750
inc esi
test ecx, ecx
je 0x1001b6c5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1001b6ca
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1001b750
mov eax, dword [0x100c29e4]
test eax, eax
je 0x1001b6e2
inc dword [eax + 0x374]
push dword [0x100c29ec]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [0x100bea10]
mov ebx, eax
add esp, 8
mov eax, dword [edi + 0x2db0]
test eax, eax
je 0x1001b744
mov ecx, dword [edi + 0x2da8]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call fcn.10056a60
mov ecx, dword [edi + 0x2db0]
add esp, 0xc
test ecx, ecx
je 0x1001b734
mov eax, dword [0x100c29e4]
test eax, eax
je 0x1001b734
dec dword [eax + 0x374]
push dword [0x100c29ec]
push ecx
call dword [0x100bea14]
add esp, 8
mov dword [edi + 0x2db0], ebx
mov dword [edi + 0x2dac], esi
mov eax, dword [edi + 0x2da8]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2db0]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2da8]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100beec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c29e4]
push ebx
push esi
push edi
mov eax, dword [eax + 0x1a00]
cmp dword [eax + 0xbc], 0
lea edi, [eax + 0xbc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jg 0x100213ad
push 0x52d
push str.D:Dev_Arc2MGRModingcppRisingDevMenu_srcimguiimgui.h
push str.Size___0
call fcn.1006664e
add esp, 0xc
mov eax, dword [edi]
lea edx, [ebp - 8]
mov ebx, dword [edi + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100870a0]
sub esi, 1
jne 0x100213c0
mov eax, dword [ebp - 0xc]
not ebx
mov esi, dword [edi]
mov ecx, dword [eax + 0xc0]
cmp esi, ecx
jne 0x10021410
inc esi
test ecx, ecx
je 0x100213fb
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10021400
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.100274a0
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
mov eax, dword [eax + 0xc4]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10054ef6
mov esp, ebp
pop ebp
ret
Function at 0x10025ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x100c29e4]
cmp byte [esi + 0x2d94], 0
jne 0x1002600a
cmp dword [esi + 0x2db4], 0
je 0x10025f0a
push 0x2533
push str.D:Dev_Arc2MGRModingcppRisingDevMenu_srcimguiimgui.cpp
push str.g.SettingsWindows.empty__
call fcn.1006664e
add esp, 0xc
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10026003
push edi
push 0x1008a9a4
push eax
call fcn.1001a4c0
mov edi, eax
add esp, 8
test edi, edi
je 0x10026002
push ebx
push edi
call fcn.10066dad
add esp, 4
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x10025ff8
push 2
push 0
push edi
call fcn.1005fd3f
add esp, 0xc
test eax, eax
jne 0x10025ff8
push edi
call fcn.10066dad
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x10025ff8
push 0
push dword [ebp - 8]
push edi
call fcn.1005fd3f
add esp, 0xc
test eax, eax
jne 0x10025ff8
mov eax, dword [0x100c29e4]
test eax, eax
je 0x10025f91
inc dword [eax + 0x374]
push dword [0x100c29ec]
push ebx
call dword [0x100bea10]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10025ff8
push edi
push dword [ebp - 4]
push 1
push ebx
call fcn.1005f935
add esp, 0x10
push edi
cmp eax, dword [ebp - 4]
je 0x10025fc6
call fcn.1005f076
add esp, 4
jmp 0x10025fd7
call fcn.1005f076
push dword [ebp - 4]
push ebx
call fcn.1001c3a0
add esp, 0xc
mov eax, dword [0x100c29e4]
test eax, eax
je 0x10025fe6
dec dword [eax + 0x374]
push dword [0x100c29ec]
push ebx
call dword [0x100bea14]
add esp, 8
jmp 0x10026001
push edi
call fcn.1005f076
add esp, 4
pop ebx
pop edi
mov byte [esi + 0x2d94], 1
movss xmm0, dword [esi + 0x2d98]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1002605c
subss xmm0, dword [esi + 0x18]
comiss xmm1, xmm0
movss dword [esi + 0x2d98], xmm0
jb 0x1002605c
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1002604b
push eax
call fcn.10023e70
add esp, 4
mov dword [esi + 0x2d98], 0
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x35c], 1
mov dword [esi + 0x2d98], 0
pop esi
mov esp, ebp
pop ebp
ret