joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405da0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x454a92
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x45c300
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.00406d70
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.004079a0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x46da28]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.00406f80
test eax, eax
jne 0x405e98
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x405e91
or eax, 4
push ebx
push eax
call fcn.00403600
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x4079a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x45255b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0044fb01
push 4
mov dword [esp + 0x24], 0
call fcn.0042900e
mov edi, eax
add esp, 4
test edi, edi
je 0x407a22
call fcn.0044fd7c
mov dword [edi], eax
call fcn.0044fc51
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0044fac2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x407a17
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0044faea
jmp 0x407a24
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x40bc70
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
push eax
push 0x20
xor bl, bl
call dword [0x457288]
push eax
call dword [0x457030]
test eax, eax
je 0x40bd00
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x14], 1
call dword [0x457024]
test eax, eax
jne 0x40bcb9
push str.Cant___lookup___privilege___value._n
call fcn.00438f21
add esp, 4
mov eax, dword [esp + 4]
push 0
push 0
push 0x10
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x2c], 2
call dword [0x457020]
test eax, eax
jne 0x40bcea
push str.Cant___adjust___privilege___value._n
call fcn.00438f21
add esp, 4
call dword [0x45728c]
mov ecx, dword [esp + 4]
test eax, eax
push ecx
sete bl
call dword [0x4572bc]
mov al, bl
pop ebx
add esp, 0x18
ret
Function at 0x414120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x454cf3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov ecx, 7
xor eax, eax
xor edx, edx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov word [esi + 4], dx
mov dword [esp + 0x14], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov word [esi + 0x20], ax
lea ecx, [esi + 0x38]
push ecx
mov byte [esp + 0x18], 1
call fcn.00415230
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x4144f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4542ce
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov ecx, 7
xor eax, eax
xor edx, edx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov word [esi + 4], dx
mov dword [esp + 0x14], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov word [esi + 0x20], ax
lea ecx, [esi + 0x38]
push ecx
mov byte [esp + 0x18], 1
call fcn.00415230
lea edx, [esi + 0x50]
push edx
mov byte [esp + 0x18], 2
call fcn.00415230
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x418be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x454888
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 5
xor eax, eax
push 0x45d10c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
call fcn.00401f90
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
push 0
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.00418880
add esp, 8
cmp dword [esp + 0x1c], 8
jb 0x418c5d
mov edx, dword [esp + 8]
push edx
call fcn.00429048
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret
Function at 0x41e650
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x452ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404950
lea edi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x14], edi
mov dword [esp + 0x30], 0
mov esi, dword [edi - 0xc]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x41e6c0
push esi
lea ecx, [esp + 0x18]
call fcn.00404750
mov edi, dword [esp + 0x14]
lea ecx, [esi + 1]
push ecx
push edi
call fcn.0043780a
add esp, 8
test esi, esi
jl 0x41e77f
cmp esi, dword [edi - 8]
jg 0x41e77f
lea eax, [esp + 0x14]
mov dword [edi - 0xc], esi
xor edx, edx
push eax
lea ecx, [esp + 0x20]
mov word [edi + esi*2], dx
lea esi, [ebx + 0x1c]
push ecx
call fcn.00405d20
mov edx, dword [esi + 0x18]
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
test esi, esi
je 0x41e70e
cmp esi, eax
je 0x41e713
call fcn.00436eb7
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x18]
jne 0x41e75b
lea esi, [ebx + 0x3c]
lea eax, [edi - 0x10]
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e744
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test esi, esi
jne 0x41e77b
call fcn.00436eb7
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esi + 0x18]
jne 0x41e772
call fcn.00436eb7
mov edx, dword [esp + 0x20]
mov esi, dword [edx + 0x10]
jmp 0x41e720
mov esi, dword [esi]
jmp 0x41e764
push 0x80070057
call fcn.00404920
int3
Function at 0x427550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x452883
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
push esi
mov dword [esp + 0x18], 1
call fcn.0044fc81
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0x4275a1
mov eax, dword [esi + 0x1c]
push eax
call fcn.00429048
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x10002ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002b41
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002b02
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18

Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a
Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad75025
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x3ad75034
pop dword [ebp - 0x10]
mov eax, 0xf0dc5c4c
add eax, 0x49faf3e8
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x35068
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xb9129bfc
add ecx, 0x46eda16f
mov edx, eax
mov ebx, 0x5f65b24d
add ebx, 0xdb729bb3
add ebx, dword [ebp - 0x10]
mov edi, 0xc7713f45
sub edi, 0xe850570c
sub dword [ebp - 8], 0xdad11cb9
mov esi, dword [ebx]
add dword [ebp - 4], 0xcf0deb84
sub esi, edi
sub dword [ebp - 0xc], esi
mov dword [edx], esi
xor dword [ebp - 0xc], 0x951c7355
add edx, 4
add ebx, 0xc67dfca4
sub ebx, 0xc67dfca0
loop 0x3ad7508e
add eax, 0xe87f
mov ebx, eax
add eax, 5
mov ecx, 0x49056fd
add ecx, 0x3646a903
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10004400
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10004461
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10004444
cmp edi, 2
jb 0x10004444
cmp byte [esi], cl
jne 0x10004444
cmp byte [esi + 1], cl
jne 0x10004444
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10058730]
jmp 0x10004415
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10058730]
test edi, edi
jne 0x10004415
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10004490
cmp cl, 0x23
jne 0x10004477
cmp byte [esi], cl
jne 0x10004477
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10058730]
test cl, cl
jne 0x10004468
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10004630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10004655
push 0x736
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10004662
mov dword [edi], 0
mov edx, 0x10061b70
mov ecx, esi
call fcn.100044a0
mov esi, eax
test esi, esi
je 0x10004752
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10004748
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004748
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10004748
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004748
mov eax, dword [0x10071684]
test eax, eax
je 0x100046dc
inc dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10004748
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000472d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10071684]
add esp, 4
test eax, eax
je 0x1000471a
dec dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x1000473f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 0xfc], 0
mov dword [ebp - 8], edi
jg 0x10006c3c
push 0x756
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [ebx + 0xfc]
lea edx, [ebp - 8]
mov ebx, dword [ebx + 0x104]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10058730]
sub esi, 1
jne 0x10006c56
mov eax, dword [0x10071684]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x10006c8e
push ecx
push edi
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10029520
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10055554
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x1001b612
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001b5cc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1002a840
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10004ca0
mov edx, dword [esi]
mov ecx, 0x10071676
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10004ca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001bae0
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x1001bb1c
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x1001bb02
cmp byte [esi], al
jne 0x1001bb02
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x10058730]
test al, al
jne 0x1001baf4
pop ebx
not ecx
call fcn.1001ba20
test eax, eax
jne 0x1001bb30
mov ecx, edi
pop edi
pop esi
jmp fcn.1001b940
pop edi
pop esi
ret

Function at 0x1001bb40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10071684]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x1001bb87
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x1001bb6e
cmp byte [edx], al
jne 0x1001bb6e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10058730]
test al, al
jne 0x1001bb60
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x537c]
test eax, eax
jle 0x1001bbdf
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor edi, edi
test esi, esi
js 0x1001bba8
cmp esi, eax
jl 0x1001bbc5
push 0x74d
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.h
push str.i___0__i___Size
call edx
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [ecx + 0x5384]
cmp dword [eax + edi + 4], ebx
je 0x1001bbe8
mov eax, dword [ecx + 0x537c]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x1001bba0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x1001bbf4
cmp esi, dword [ecx + 0x537c]
jl 0x1001bc08
push 0x74d
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.h
push str.i___0__i___Size
call edx
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x5384]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret
Function at 0x100274d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
push dword [ebx + 0x390]
lea ecx, [esi + 0x5340]
call fcn.10004a40
cmp dword [ebx + 0x388], 0
mov edi, eax
je 0x10027512
push 0x41bf
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.cpp
push str.window__DockNode__0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
test edi, edi
je 0x10027531
cmp dword [edi + 0x1c], 0
je 0x10027562
push 1
mov edx, ebx
call fcn.10020550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x390]
mov ecx, esi
call fcn.1001f630
mov edi, eax
mov eax, dword [edi + 0x9c]
and eax, 0xfffffe92
or eax, 0x92
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0x3ea0]
mov dword [edi + 0x84], eax
test byte [edi + 0xa0], 1
jne 0x10027626
mov esi, edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10027583
mov esi, eax
test byte [esi + 0xa0], 1
je 0x10027571
movss xmm0, dword [esi + 0x3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1002759a
movss xmm0, dword [esi + 0x40]
comiss xmm0, xmm1
ja 0x100275b2
push 0x41d9
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.cpp
push str.ancestor_node__Size.x___0.0f__ancestor_node__Size.y___0.0f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x18]
mov edx, esi
test eax, eax
je 0x100275c9
nop dword [eax + eax]
mov edx, eax
mov eax, dword [edx + 0x18]
test eax, eax
jne 0x100275c0
and byte [edx + 0xa0], 0xdf
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x100275dc
call fcn.100216b0
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x100275e8
call fcn.100216b0
cmp dword [edx + 0x18], 0
jne 0x1002760e
mov eax, dword [edx + 0x78]
test eax, eax
je 0x1002760e
nop word [eax + eax]
or byte [eax + 0xa0], 0x20
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x10027600
push dword [esi + 0x40]
mov edx, edi
mov ecx, esi
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call fcn.10025a00
add esp, 0x10
mov esi, dword [ebp - 4]
mov ecx, edi
mov bl, byte [edi + 0xa0]
mov edx, esi
push 1
call fcn.10020bb0
mov al, byte [edi + 0xa0]
add esp, 4
xor al, bl
and al, 1
xor byte [edi + 0xa0], al
cmp edi, dword [esi + 0x388]
je 0x1002766d
push 0x41e2
push str.D:MyFilesDLLDLL_WITH_HWID_RANPINASImGui_StandaloneImGuiimgui.cpp
push str.node__window__DockNode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret