joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038c40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x194]
mov edi, eax
test edi, edi
js 0x10038dae
test ebx, ebx
je 0x10038dae
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp + 0x18], ebx
test ebx, ebx
jne 0x10038c98
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x168]
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x10038cf4
mov eax, dword [esi + 0x16c]
cmp eax, dword [esi + 0x16c]
je 0x10038d18
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, 0x10124898
mov esi, 0xc
mov edx, ecx
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10038d97
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10038d24
push 0x10
call fcn.100beb62
mov esi, eax
add esp, 4
test esi, esi
je 0x10038c86
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexBuffer9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexBuffer9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10038da7
lea eax, [ebp + 8]
add ecx, 0x168
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
push 0x10124898
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10038de0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov edi, eax
test edi, edi
js 0x10038f51
test ebx, ebx
je 0x10038f51
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], ebx
test ebx, ebx
jne 0x10038e2f
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x128]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x10038e8b
mov eax, dword [esi + 0x12c]
cmp eax, dword [esi + 0x12c]
je 0x10038eaf
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x10124898
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10038f3a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10038ec0
push 0x14
call fcn.100beb62
mov esi, eax
add esp, 4
test esi, esi
je 0x10038e1d
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.0
mov dword [esi + 4], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x101144c0
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10038f4a
lea eax, [ebp + 8]
add ecx, 0x128
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
push 0x10124898
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100393c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x160]
mov edi, eax
test edi, edi
js 0x1003952a
test ebx, ebx
je 0x1003952a
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1003940f
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x188]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1003946b
mov eax, dword [esi + 0x18c]
cmp eax, dword [esi + 0x18c]
je 0x1003948f
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x10124898
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10039513
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100394a0
push 0x10
call fcn.100beb62
mov esi, eax
add esp, 4
test esi, esi
je 0x100393fd
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexDeclaration9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexDeclaration9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10039523
lea eax, [ebp + 8]
add ecx, 0x188
push eax
lea eax, [ebp - 8]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x10124898
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10039540
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x174]
mov edi, eax
test edi, edi
js 0x100396aa
test ebx, ebx
je 0x100396aa
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1003958f
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1a8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x100395eb
mov eax, dword [esi + 0x1ac]
cmp eax, dword [esi + 0x1ac]
je 0x1003960f
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x10124898
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10039693
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10039620
push 0x10
call fcn.100beb62
mov esi, eax
add esp, 4
test esi, esi
je 0x1003957d
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexShader9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x100396a3
lea eax, [ebp + 8]
add ecx, 0x1a8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x10124898
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003a990
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10108ff9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101425c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x1003a9da
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1c8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1003aa39
mov eax, dword [esi + 0x1cc]
cmp eax, dword [esi + 0x1cc]
je 0x1003aa61
mov eax, dword [eax + 0xc]
lea ecx, [eax - 4]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, 0x10124898
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1003aae4
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1003aa70
push 0x10
call fcn.100beb62
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1003ab49
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DVolume9.0
lea eax, [ebp - 0x1c]
mov dword [esi], vtable.m_IDirect3DVolume9.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x10]
push eax
add ecx, 0x1c8
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
call fcn.10036850
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x1003ab4b
push 0x14
call fcn.100beb62
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x1003ab49
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DSwapChain9Ex.0
lea eax, [ebp - 0x14]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x10]
push eax
add ecx, 0x128
mov byte [ebp - 4], 3
mov dword [ebp + 8], ebx
call fcn.10036850
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x1003ab4b
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003e940
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
int3
push ecx
cmp byte [esi], dl
push 0x99907006
jns 0x1003e995
adc al, 0x47
xchg ecx, eax
and eax, 0x90428579
push esp
push ebx
adc eax, 0x5f756741
pop esi
pop ebx
ret
push ebx
push esi
push edi
cmp byte [ebp - 0x6f], dh
xchg ebp, eax
xchg edx, eax
adc byte [edi + 0x24727770], 0x31
xchg esp, eax
inc edi
add byte [eax + 0x48], ch
pushal
je 0x1003e8ec
adc ch, byte [eax + 0x49]
or dword [eax - 0x337e9d88], eax
adc al, 0x41
add eax, 0x97670553
push ebp
push edx
arpl word [eax - 0x6c7e8cca], bx
xchg esi, eax
xchg dword [edx - 0x7f], esi
xchg esp, eax
add eax, 0x10601015
je 0x1003e914
inc ebx
push ss
inc esi
pop edi
pop esi
pop ebx
ret
adc eax, dword [eax]
add al, ch
mov bl, 0xa
or byte [eax], al
Function at 0x1003eac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x10144e30]
cmp ecx, dword [0x10144e34]
je 0x1003eaea
mov eax, dword [0x10144ca8]
mov dword [ecx], eax
mov ecx, dword [0x10144e30]
add ecx, 4
mov dword [0x10144e30], ecx
jmp 0x1003eb00
push 0x10144ca8
push ecx
mov ecx, 0x10144e2c
call fcn.1003e160
mov ecx, dword [0x10144e30]

Function at 0x1003ed70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx]
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1003edcd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x1003ed90
mov eax, dword [esi]
jmp 0x1003eea7
cmp eax, 0x4e0
jb 0x1003eea7
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x1003ede6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x1003ee30
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10045f80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101093a0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101425c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.100beb62
mov edi, eax
add esp, 4
test edi, edi
je 0x1004602d
push 1
mov dword [ebp - 4], 0
call fcn.100c099b
add esp, 4
mov dword [edi + 4], eax
jmp 0x1004602f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.1004a820
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x10144e50]
mov ecx, dword [0x10144e54]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004dee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a88d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x101425c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100beb62
mov edi, eax
add esp, 4
test edi, edi
je 0x1004df7d
push 1
mov dword [ebp - 4], 0
call fcn.100c099b
add esp, 4
mov dword [edi + 4], eax
jmp 0x1004df7f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10045df0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1004dfda
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1004dfda
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x1004dff6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1004e019
cmp byte [ebp + 0xc], 0
je 0x1004e005
push esi
call fcn.100c0e61
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1004e025
mov esi, str.ios_base::badbit_set
jmp 0x1004e035
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.1004e1e0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10046f90
push 0x1013cf94
lea eax, [ebp - 0x28]
push eax
call fcn.100db8ad
int3
Function at 0x1005eae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xorps xmm0, xmm0
lea eax, [ebp - 8]
push eax
movsd qword [0x10145268], xmm0
movsd qword [0x10145260], xmm0
movsd qword [0x10145270], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.100beb20
divsd xmm0, qword [0x10142038]
lea eax, [ebp - 0x10]
push eax
movsd qword [0x10145260], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.100beb20
divsd xmm0, qword [0x10145260]
mov eax, dword [0x10144c8c]
push 5
push 0x10116bb8
movsd qword [0x10145268], xmm0
mov dword [eax], 0x3e4ccccd
push dword [0x10144c90]
call fcn.10063d20
push 5
push 0x10116bb8
push dword [0x10144c94]
call fcn.10063d20
push 5
push 0x10116bb8
push dword [0x10144c98]
call fcn.10063d20
add esp, 0x24
push 0
push 0
push 0
push 0x1005ebd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x10144bdc]
push 0x1005e9a0
add eax, 0x472730
push eax
call fcn.100010f0
mov dword [0x1014525c], eax
mov esp, ebp
pop ebp
ret

Function at 0x1005f290
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1005f240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x100603f0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101425c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str._themes.re
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.100ecad0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push str.Theme
push str.Themes
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push 0x1011550c
push dword [0x10144bec]
mov dword [0x101420a8], eax
call fcn.10063d20
push 7
push 0x100603c0
push dword [0x10144bf8]
call fcn.10063bc0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
call fcn.100be994
mov esp, ebp
pop ebp
ret
Function at 0x100635f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010b4ed
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101425c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.100beb62
mov edi, eax
add esp, 4
test edi, edi
je 0x1006369d
push 1
mov dword [ebp - 4], 0
call fcn.100c099b
add esp, 4
mov dword [edi + 4], eax
jmp 0x1006369f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.1004a820
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
not ecx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and ecx, 1
mov dword [ebp - 4], 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
test bl, 4
cmove eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
cmp dword [ecx + 0x14], 0xf
mov ebx, dword [ecx + 0x10]
jbe 0x100636f8
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
cmp ebx, 0x7fffffff
ja 0x100637be
test ebx, ebx
je 0x1006379e
and eax, 6
cmp al, 6
je 0x1006379b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [esi + 0x40]
push eax
call fcn.10060530
push ebx
push dword [ebp + 8]
mov edi, eax
push edi
call fcn.100db020
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + edi]
mov dword [esi + 0x38], ecx
add esp, 0x14
mov ecx, eax
and ecx, 4
mov dword [ebp + 8], ecx
jne 0x1006375b
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
test al, 2
jne 0x10063796
mov edx, dword [esi + 0x38]
test al, 0x18
mov eax, dword [esi + 0x10]
mov ecx, edi
cmovne ecx, edx
sub edx, ecx
cmp dword [ebp + 8], 0
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
je 0x10063793
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
or eax, 1
jmp 0x100637a5
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.100bfc9f
int3