joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006ea8b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10106834
push 0x1010682c
push str.FlsAlloc
push 0x1f
call fcn.1006e836
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006eabf
push dword [ebp + 8]
mov ecx, esi
call dword [0x101002e4]
call esi
jmp 0x1006eac5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1006eb09
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10106844
push 0x1010683c
push str.FlsGetValue
push 0x21
call fcn.1006e836
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006eb40
push dword [ebp + 8]
mov ecx, esi
call dword [0x101002e4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1006eb48
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1010684c
push 0x10106844
push str.FlsSetValue
push 0x22
call fcn.1006e836
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006eb82
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x101002e4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1007032f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1015b350]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1007036f
cmp byte [ebx], 0xa
jne 0x1007036f
or byte [edi + eax + 0x28], 4
jmp 0x10070374
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10070473
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10070456
inc eax
cmp dl, 0xd
je 0x100703a0
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100703c6
cmp eax, ecx
jae 0x100703d4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10070388
jmp 0x10070473
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10070451
cmp dword [ebp - 0x10], 0
je 0x10070451
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1015b350]
test byte [eax + edi + 0x28], 0x48
je 0x1007042b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10070416
mov byte [esi], dl
jmp 0x10070427
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1015b350]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10070473
cmp byte [ebp - 1], 0xa
jne 0x1007043a
cmp esi, ebx
jne 0x1007043a
mov byte [esi], 0xa
jmp 0x10070472
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10070eb5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10070473
mov byte [esi], 0xd
jmp 0x10070472
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1015b350]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10070470
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10070473
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1007047c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1015b350]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100704c2
cmp word [ebx], dx
jne 0x100704c2
or byte [eax + edi + 0x28], 4
jmp 0x100704c7
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1007062a
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1007060a
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10070508
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1007053e
cmp eax, edx
jae 0x1007054c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100704e3
jmp 0x1007062a
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10070605
cmp dword [ebp - 0x18], 0
je 0x10070605
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1015b350]
test byte [eax + edi + 0x28], 0x48
je 0x100705db
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1007059f
mov word [esi], cx
jmp 0x100705d6
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1015b350]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1015b350]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1015b350]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1007062a
pop eax
cmp word [ebp - 4], ax
jne 0x100705eb
cmp esi, ebx
jne 0x100705eb
mov word [esi], ax
jmp 0x10070627
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10070eb5
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1007062a
push 0xd
pop eax
jmp 0x100705e6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1015b350]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10070624
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1007062a
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10071284
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10071206
Function at 0x100766e9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10076786
push ebx
push esi
call fcn.100766b2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10073fae
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10076733
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10076785
push edi
push eax
call fcn.1006f2d6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10076753
call fcn.1006df82
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10076784
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10073fae
add esp, 0x20
test eax, eax
jne 0x10076772
push edi
call fcn.1006df82
jmp 0x1007677a
push ebx
call fcn.1006df82
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10076789
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1007679a
pop esi
ret
push ebx
push edi
push esi
call fcn.100766b2
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1006f2d6
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100767c2
push ebx
push esi
push edi
call fcn.100563e0
add esp, 0xc
push 0
call fcn.1006df82
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10076b92
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100767d7

Function at 0x100790ec
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1006b5be
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1007915b
cmp esi, dword [ebp - 4]
je 0x10079156
cmp dword [ebp + 0xc], 0
je 0x10079156
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10079133
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10078c3e
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1007915d
xor eax, eax
inc eax
jmp 0x1007915d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100791c2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1014d094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1006b5be
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1006b5be
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10079239
cmp word [ecx], dx
je 0x10079239
mov eax, dword [0x1010710c]
push edi
dec eax
push eax
push 0x10106ff8
call fcn.10079161
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100792ac
cmp word [eax], dx
je 0x100792ac
mov eax, dword [edi]
test eax, eax
je 0x1007925d
cmp word [eax], dx
je 0x1007925d
lea eax, [ebp - 0x10]
push eax
call fcn.10078b44
jmp 0x10079266
lea eax, [ebp - 0x10]
push eax
call fcn.10078bdf
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100792d6
mov eax, dword [0x10106ff4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10106ce8
call fcn.10079161
add esp, 0xc
test al, al
je 0x100792d6
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100792a1
cmp word [eax], di
je 0x100792a1
lea eax, [ebp - 0x10]
push eax
call fcn.10078b44
pop ecx
jmp 0x100792d8
lea eax, [ebp - 0x10]
push eax
call fcn.10078bdf
jmp 0x1007929e
mov eax, dword [edi]
test eax, eax
je 0x100792c3
cmp word [eax], dx
je 0x100792c3
lea eax, [ebp - 0x10]
push eax
call fcn.10078af9
pop ecx
jmp 0x100792d6
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100793a1
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10078fe6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100793a1
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100793a1
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100793a1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1007932e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1006ed24
test ebx, ebx
je 0x1007939c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1006ed24
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100793a1
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100793a1
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1006731a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100793a3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10054437
leave
ret
Function at 0x1007d381
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1007d2fd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1007d4f0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1007d4f0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1007d4a5
jg 0x1007d3dd
test eax, eax
je 0x1007d49b
push 1
push 0x1000
call fcn.1006e500
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1007d400
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1007d492
push 0x8000
push ebx
call fcn.1007d22e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1007d429
jg 0x1007d424
cmp ecx, 0x1000
jb 0x1007d429
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1006dd66
add esp, 0x10
cmp eax, 0xffffffff
je 0x1007d46e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1007d424
jl 0x1007d455
test ecx, ecx
jne 0x1007d416
push dword [ebp - 0xc]
push ebx
call fcn.1007d22e
push esi
call fcn.1006df82
add esp, 0xc
xor ebx, ebx
jmp 0x1007d4fe
cmp byte [edi + 0x24], 0
je 0x1007d485
cmp dword [edi + 0x20], 5
jne 0x1007d485
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1007d490
mov ebx, dword [edi + 0x18]
jmp 0x1007d492
xor ebx, ebx
push esi
call fcn.1006df82
pop ecx
jmp 0x1007d4fe
test ecx, ecx
jg 0x1007d467
jl 0x1007d4a5
test eax, eax
jae 0x1007d467
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10070eb5
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1007d4c5
cmp byte [edi + 0x1c], 0
je 0x1007d467
jmp 0x1007d4f6
push ebx
call fcn.100770ed
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1007d467
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1007d4fe
cmp byte [edi + 0x1c], 0
je 0x1007d4fb
mov ebx, dword [edi + 0x18]
jmp 0x1007d4fe
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10070eb5
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1008da70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1015b7c0]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1a28]
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 4], ecx
test eax, eax
jg 0x1008daae
push 0x591
push str.C:Usersw9263DesktopFormDX_PrivateFormDXImGuiimgui.h
push str.Size___0
call fcn.10063b16
mov eax, dword [edi]
add esp, 0xc
mov ebx, dword [edi + 8]
lea edx, [ebp - 4]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10111920]
sub esi, 1
jne 0x1008dac0
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x1008db09
inc ecx
test esi, esi
je 0x1008daf5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1008dafa
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1002f590
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100932a0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x100932dd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x100932c3
cmp byte [esi], bl
jne 0x100932c3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x10111920]
test bl, bl
jne 0x100932b4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.100932f0

Function at 0x100955e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x100955f9
cmp byte [edi + 0x2e2d], 0
je 0x10095610
push 0xf65
push str.C:Usersw9263DesktopFormDX_PrivateFormDXImGuiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call fcn.10063b16
add esp, 0xc
or eax, 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], str.Window
mov esi, 0x10117da1
mov cl, 0x57
or ebx, 0xffffffff
nop dword [eax + eax]
cmp cl, 0x23
jne 0x1009563f
cmp byte [esi], cl
jne 0x1009563f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10111920]
test cl, cl
jne 0x10095630
mov ecx, dword [edi + 0x2e40]
not eax
mov ebx, dword [edi + 0x2e44]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x100862c0
mov dword [ebp - 0x14], 0x10086230
mov dword [ebp - 0x10], 0x10086180
mov dword [ebp - 0xc], 0x10086060
mov dword [ebp - 8], 0x10085df0
cmp ecx, ebx
jne 0x10095729
lea esi, [ecx + 1]
test ebx, ebx
je 0x100956a6
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
jmp 0x100956ab
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ebx
jle 0x10095729
mov eax, dword [0x1015b7c0]
test eax, eax
je 0x100956c3
inc dword [eax + 0x374]
lea eax, [esi + esi*8]
shl eax, 2
push eax
call fcn.10066bc0
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2e48]
test eax, eax
je 0x10095717
mov ecx, dword [edi + 0x2e40]
lea ecx, [ecx + ecx*8]
shl ecx, 2
push ecx
push eax
push ebx
call fcn.100563e0
mov ecx, dword [edi + 0x2e48]
add esp, 0xc
test ecx, ecx
je 0x1009570e
mov eax, dword [0x1015b7c0]
test eax, eax
je 0x1009570e
dec dword [eax + 0x374]
push ecx
call fcn.10062c3b
add esp, 4
mov ecx, dword [edi + 0x2e40]
mov dword [edi + 0x2e48], ebx
mov dword [edi + 0x2e44], esi
mov eax, dword [edi + 0x2e48]
lea ecx, [ecx + ecx*8]
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [eax + ecx*4], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [eax + ecx*4 + 0x10], xmm0
mov dword [eax + ecx*4 + 0x20], 0
inc dword [edi + 0x2e40]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10098290
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1014d094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0xc4]
test edx, edx
jg 0x100982cb
push 0x591
push str.C:Usersw9263DesktopFormDX_PrivateFormDXImGuiimgui.h
push str.Size___0
call fcn.10063b16
mov edx, dword [esi + 0xc4]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xcc]
lea esi, [ebp - 0x14]
mov edx, dword [eax + edx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10111920]
sub edi, 1
jne 0x10098325
mov eax, dword [0x1015b7c0]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a60], edx
jne 0x10098356
mov dword [eax + 0x1a64], edx
cmp dword [eax + 0x1a9c], edx
jne 0x10098365
mov byte [eax + 0x1aa0], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.10054437
mov esp, ebp
pop ebp
ret 4

Function at 0x100984b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xc4]
test ecx, ecx
jg 0x100984de
push 0x591
push str.C:Usersw9263DesktopFormDX_PrivateFormDXImGuiimgui.h
push str.Size___0
call fcn.10063b16
mov ecx, dword [esi + 0xc4]
add esp, 0xc
mov eax, dword [esi + 0xcc]
mov edi, 4
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10111920]
sub edi, 1
jne 0x100984f2
mov ecx, dword [0x1015b7c0]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a60], eax
jne 0x10098524
mov dword [ecx + 0x1a64], eax
cmp dword [ecx + 0x1a9c], eax
jne 0x10098533
mov byte [ecx + 0x1aa0], 1
pop ebp
ret 4
Function at 0x1009b440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x1009b463
push 0x5e2
push str.C:Usersw9263DesktopFormDX_PrivateFormDXImGuiimgui.cpp
push str.filename__mode
call fcn.10063b16
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x1009b470
mov dword [edi], 0
mov edx, 0x1011a748
mov ecx, esi
call fcn.1009b610
mov esi, eax
test esi, esi
je 0x1009b54f
push esi
call fcn.10064507
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1009b546
push 2
push 0
push esi
call fcn.100633ae
add esp, 0xc
test eax, eax
jne 0x1009b546
push esi
call fcn.10064507
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1009b546
push 0
push dword [ebp + 8]
push esi
call fcn.100633ae
add esp, 0xc
test eax, eax
jne 0x1009b546
mov eax, dword [0x1015b7c0]
test eax, eax
je 0x1009b4e5
inc dword [eax + 0x374]
push ebx
call fcn.10066bc0
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1009b546
push esi
push ebx
push 1
push eax
call fcn.10062fd1
add esp, 0x10
push esi
cmp eax, ebx
je 0x1009b530
call fcn.1005ce9d
mov eax, dword [0x1015b7c0]
add esp, 4
test eax, eax
je 0x1009b51e
dec dword [eax + 0x374]
push dword [ebp + 8]
call fcn.10062c3b
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.1005ce9d
add esp, 4
test edi, edi
je 0x1009b53e
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.1005ce9d
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x1009b790
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1009b7dc
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1009b7bf
cmp edi, 2
jb 0x1009b7bf
cmp byte [esi], cl
jne 0x1009b7bf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10111920]
test edi, edi
jne 0x1009b7a5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1009b80b
cmp cl, 0x23
jne 0x1009b7f2
cmp byte [esi], cl
jne 0x1009b7f2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10111920]
test cl, cl
jne 0x1009b7e3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x1009c850
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1015b7c0]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1a28]
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 4], ecx
test eax, eax
jg 0x1009c88e
push 0x591
push str.C:Usersw9263DesktopFormDX_PrivateFormDXImGuiimgui.h
push str.Size___0
call fcn.10063b16
mov eax, dword [edi]
add esp, 0xc
mov ebx, dword [edi + 8]
lea edx, [ebp - 4]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10111920]
sub esi, 1
jne 0x1009c8a0
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x1009c8e9
inc ecx
test esi, esi
je 0x1009c8d5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1009c8da
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1002f590
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret