joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482a50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x487190
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4bf1d0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bf1d0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [0x4c06bc]
cmp eax, 0xffffffff
jne 0x482a90
xor esi, esi
jmp 0x482a99
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x18], esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x58], 0
test esi, esi
je 0x482aed
nop
cmp dword [esi + 0x14], 0
jne 0x482b3a
cmp dword [esi + 0x10], 0
jne 0x482b40
push 0x4820c0
push 0x4c77f4
call fcn.00482340
mov eax, dword [0x4c06bc]
add esp, 8
cmp eax, 0xffffffff
je 0x482bf1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x58], 0xffffffff
test esi, esi
je 0x482b1b
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x482b1b
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004682fb
add esp, 0x48
ret
cmp dword [esi + 0x10], 0
je 0x482b82
mov ebp, dword [esi + 0x10]
mov eax, dword [ebp + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp]
test ecx, ecx
je 0x482b70
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
cmp dword [esi + 0x10], 0
jne 0x482b40
cmp dword [esi + 0x14], 0
je 0x482aba
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x482ba7
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebp, dword [edi + 8]
test ebp, ebp
je 0x482bda
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x482bda
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
lea ecx, [ebp + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x482bda
mov eax, dword [ebp]
mov edx, dword [eax + 8]
mov ecx, ebp
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
cmp dword [esi + 0x14], 0
jne 0x482b8c
jmp 0x482ab0
call fcn.004839f0
mov esi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov edi, 0xb
mov dword [esp + 0x18], str.boost::thread_resource_error
call fcn.004688dd
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
mov dword [esp + 0x1c], vtable.boost::thread_resource_error.0
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x5c], 1
call fcn.00405b00
int3
Function at 0x482d40
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4871f8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4bf1d0]
xor eax, esp
mov dword [esp + 0x34], eax
push ebp
push esi
push edi
mov eax, dword [0x4bf1d0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x482c50
push 0
push 0
call fcn.00468fb2
mov ebp, eax
add esp, 0x18
test ebp, ebp
jne 0x482de2
call fcn.004839f0
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
mov esi, eax
lea edi, [ebp + 0xb]
mov dword [esp + 0x14], str.boost::thread_resource_error
call fcn.004688dd
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebp
mov byte [esp + 0x28], 0
mov dword [esp + 0x14], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x54], ebp
call fcn.00405b00
mov ecx, dword [esi]
add ecx, 4
mov edx, 1
lock xadd dword [ecx], edx
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x482e05
cmp eax, 0xffffffff
je 0x482e05
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebp
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004682fb
add esp, 0x44
ret
Function at 0x100022ca
Capabilities:
Create thread

Disassembly:
mov eax, 0x56a
mov word [0x10006014], ax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ws2_32
mov dword [0x10006374], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0x10002305
mov dword [0x10006370], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
xor eax, eax
add esp, 0xc
inc eax
ret

Function at 0x1000246b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
pop ebx
push ebx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov esi, eax
mov dword [ebp - 0x18], 0x5dc
lea eax, [ebp - 0x18]
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push str.pastebin.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x1bb
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
mov word [ebp - 0x14], bx
call dword [sym.imp.WS2_32.dll_connect]
push ecx
push ecx
push dword [sym.imp.WS2_32.dll_recv]
push dword [sym.imp.WS2_32.dll_send]
push esi
call section..text
add esp, 0x14
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str._r_n_r_n
push dword [0x100063dc]
call dword [sym.imp.MSVCR120.dll_strstr]
push 0xa
lea ecx, [ebp - 0x1c]
add eax, 4
push ecx
push eax
call dword [sym.imp.MSVCR120.dll_strtoul]
mov ecx, dword [ebp - 4]
add esp, 0x14
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100028b7
mov esp, ebp
pop ebp
ret
Function at 0x101c9f5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
push 0x1004b28
call fcn.0101cc70
and dword [ebp - 4], 0
dec dword [ebp + 0x10]
js 0x101c9f1
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
call dword [ebp + 0x14]
jmp 0x101c9de
or dword [ebp - 4], 0xffffffff
call fcn.0101ccab
ret 0x10

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40560d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40561c
pop dword [ebp - 0x3c]
mov eax, 0x1cf5f8aa
sub eax, 0x1cb5a28e
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x2d8bd175
sub dword [ebp - 0x4c], 0xdf398c2a
mov dword [ebp - 0x48], 0x1ad419da
add dword [ebp - 0x48], 0x175f326b
mov dword [ebp - 0x44], 0x617291ad
sub dword [ebp - 0x44], 0x15264d7f
mov dword [ebp - 0x40], 0xcffdfebf
sub dword [ebp - 0x40], 0xcffdfebf
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x28eeda77
add dword [ebp - 0x4c], 0x4b838edf
mov dword [ebp - 0x48], 0xe495143
add dword [ebp - 0x48], 0x33231032
mov dword [ebp - 0x44], 0x3bbd0874
sub dword [ebp - 0x44], 0xd84d9c08
mov dword [ebp - 0x40], 0xeccc8e9e
sub dword [ebp - 0x40], 0xeccc8e9e
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xb5d2fb8f
sub eax, 0xb5922b43
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3985b
push 0
call eax
mov ecx, 0x5a074dd4
sub ecx, 0x5a0705d1
xor ebx, ebx
add ebx, eax
mov esi, 0xeb5c0d15
sub esi, 0xeb1a5d15
add esi, dword [ebp - 0x3c]
mov edx, 0x10002143
add dword [ebp - 0x18], ebx
mov edi, dword [esi]
xor dword [ebp - 0x10], 0xc29e36df
xor edi, edx
sub dword [ebp - 0x10], ecx
mov dword [ebx], edi
sub dword [ebp - 0x20], ebx
add ebx, 0x56b3d58d
add ebx, 0xa94c2a77
add esi, 4
loop 0x405735
add eax, 0x9cee6feb
add eax, 0x6312a2f4
xor ebx, ebx
add ebx, eax
add eax, 0x71e865b9
sub eax, 0x71e865b4
mov ecx, 0x993bf1d
add ecx, 0xf6ac40e3
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401d10
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406238
push 0x405f0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, ecx
mov byte [ebp - 0x19], 0
xor eax, eax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x2e], eax
mov word [ebp - 0x2a], ax
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x1f39abd
Capabilities:
Encode data using xor

Disassembly:
pushfd
dec al
push esp
cmp al, al
cmc
neg al
stc
pushfd
cmc
bt bp, sp
rol al, 5
jmp 0x1f3b3c7
shr eax, 1
call fcn.013effd1
add byte [eax], al
xlatb
adc eax, 0x1b3
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid
Function at 0x1000bcd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
sub eax, 0
je 0x1000bd26
sub eax, 1
jne 0x1000be8a
mov eax, dword [ebp + 8]
push eax
mov dword [0x100aaa34], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000bb50
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1000b8c0
push 0
push 0
call esi
mov eax, 1
pop esi
pop ebp
ret 0xc
push 0x1000a230
push 0xfffffffffffffffc
push dword [0x100aaa0c]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x100aad8c]
test eax, eax
je 0x1000bd4b
mov esi, dword [eax + 0x6c]
test esi, esi
jne 0x1000bd69
jmp 0x1000bd4d
xor esi, esi
push 0xa3
push str.E:Projects1MTA_DLL___Visualsimguiimgui_impl_win32.cpp
push str.bd___0___No_platform_backend_to_shutdown__or_already_shutdown__
call fcn.100660da
mov eax, dword [0x100aad8c]
add esp, 0xc
test eax, eax
jne 0x1000bd89
push 0xebd
push str.E:Projects1MTA_DLL___Visualsimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.100660da
mov eax, dword [0x100aad8c]
add esp, 0xc
mov ecx, dword [esi + 0x28]
push edi
lea edi, [eax + 8]
test ecx, ecx
je 0x1000bda0
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x100aad8c]
mov dword [edi + 0x5c], 0
mov dword [edi + 0x64], 0
test eax, eax
je 0x1000bdb8
dec dword [eax + 0xa8]
push esi
call fcn.1005f497
mov esi, dword [0x100aad8c]
add esp, 4
test esi, esi
je 0x1000bdd4
mov edi, dword [esi + 0x70]
test edi, edi
jne 0x1000bdf3
jmp 0x1000bdd6
xor edi, edi
push 0x12b
push str.E:Projects1MTA_DLL___Visualsimguiimgui_impl_dx9.cpp
push str.bd___0___No_renderer_backend_to_shutdown__or_already_shutdown__
call fcn.100660da
mov esi, dword [0x100aad8c]
add esp, 0xc
test esi, esi
jne 0x1000be14
push 0xebd
push str.E:Projects1MTA_DLL___Visualsimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.100660da
mov esi, dword [0x100aad8c]
add esp, 0xc
call fcn.10039b30
mov ecx, dword [edi]
test ecx, ecx
je 0x1000be25
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [0x100aad8c]
mov dword [esi + 0x68], 0
mov dword [esi + 0x70], 0
test eax, eax
je 0x1000be42
dec dword [eax + 0xa8]
push edi
call fcn.1005f497
mov esi, dword [0x100aad8c]
add esp, 4
mov dword [0x100aad8c], esi
call fcn.10016ae0
mov dword [0x100aad8c], 0
pop edi
test esi, esi
je 0x1000be8a
mov ecx, esi
call fcn.10028cf0
mov eax, dword [0x100aad8c]
test eax, eax
je 0x1000be81
dec dword [eax + 0xa8]
push esi
call fcn.1005f497
add esp, 4
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x10010ff0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10011051
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10011034
cmp edi, 2
jb 0x10011034
cmp byte [esi], cl
jne 0x10011034
cmp byte [esi + 1], cl
jne 0x10011034
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10088cc8]
jmp 0x10011005
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10088cc8]
test edi, edi
jne 0x10011005
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10011080
cmp cl, 0x23
jne 0x10011067
cmp byte [esi], cl
jne 0x10011067
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10088cc8]
test cl, cl
jne 0x10011058
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10011210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10011233
push 0x72c
push str.E:Projects1MTA_DLL___Visualsimguiimgui.cpp
push str.filename__mode
call fcn.100660da
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10011240
mov dword [edi], 0
mov edx, 0x10091280
mov ecx, esi
call fcn.10011090
mov esi, eax
test esi, esi
je 0x1001131f
push esi
call fcn.10060698
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x10011316
push 2
push 0
push esi
call fcn.1005fcee
add esp, 0xc
test eax, eax
jne 0x10011316
push esi
call fcn.10060698
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10011316
push 0
push dword [ebp + 8]
push esi
call fcn.1005fcee
add esp, 0xc
test eax, eax
jne 0x10011316
mov eax, dword [0x100aad8c]
test eax, eax
je 0x100112b5
inc dword [eax + 0xa8]
push ebx
call fcn.1006615b
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x10011316
push esi
push ebx
push 1
push eax
call fcn.1005f890
add esp, 0x10
push esi
cmp eax, ebx
je 0x10011300
call fcn.10059877
mov eax, dword [0x100aad8c]
add esp, 4
test eax, eax
je 0x100112ee
dec dword [eax + 0xa8]
push dword [ebp + 8]
call fcn.1005f497
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10059877
add esp, 4
test edi, edi
je 0x1001130e
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10059877
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10013430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0xc8], 0
jg 0x10013458
push 0x6fa
push str.E:Projects1MTA_DLL___Visualsimguiimgui.h
push str.Size___0
call fcn.100660da
add esp, 0xc
mov eax, dword [ebx + 0xc8]
lea edx, [ebp + 8]
mov ebx, dword [ebx + 0xd0]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10088cc8]
sub esi, 1
jne 0x10013472
mov eax, dword [0x100aad8c]
not ebx
cmp dword [eax + 0x3e30], ebx
jne 0x100134ac
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10027920
add esp, 8
pop esi
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x100134c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc8], 0
jg 0x100134ea
push 0x6fa
push str.E:Projects1MTA_DLL___Visualsimguiimgui.h
push str.Size___0
call fcn.100660da
add esp, 0xc
mov eax, dword [ebp + 8]
mov edi, 0x10
movss xmm1, dword [esi + 0xe4]
movss xmm2, dword [esi + 0xe8]
mov ecx, dword [esi + 0xc8]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xd0]
subss xmm0, xmm2
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10088cc8]
sub edi, 1
jne 0x10013550
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10018ea0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x10018edd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x10018ec3
cmp byte [esi], bl
jne 0x10018ec3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x10088cc8]
test bl, bl
jne 0x10018eb4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.10018e40
Function at 0x10026b00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100aad8c]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x10026b47
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x10026b2e
cmp byte [edx], al
jne 0x10026b2e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10088cc8]
test al, al
jne 0x10026b20
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x5204]
test eax, eax
jle 0x10026b9c
xor edi, edi
nop word [eax + eax]
test esi, esi
js 0x10026b68
cmp esi, eax
jl 0x10026b82
push 0x6f1
push str.E:Projects1MTA_DLL___Visualsimguiimgui.h
push str.i___0__i___Size
call fcn.100660da
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ecx + 0x520c]
cmp dword [eax + edi + 4], ebx
je 0x10026ba5
mov eax, dword [ecx + 0x5204]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x10026b60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x10026bb1
cmp esi, dword [ecx + 0x5204]
jl 0x10026bc8
push 0x6f1
push str.E:Projects1MTA_DLL___Visualsimguiimgui.h
push str.i___0__i___Size
call fcn.100660da
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x520c]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret
Function at 0x100304b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100304e6
mov eax, dword [0x100aad8c]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100304d6
dec dword [eax + 0xa8]
push ecx
call fcn.1005f497
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1003051a
mov eax, dword [0x100aad8c]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1003050a
dec dword [eax + 0xa8]
push ecx
call fcn.1005f497
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1003054e
mov eax, dword [0x100aad8c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1003053e
dec dword [eax + 0xa8]
push ecx
call fcn.1005f497
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1003059e
mov eax, dword [0x100aad8c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1003058e
dec dword [eax + 0xa8]
push ecx
call fcn.1005f497
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100305d2
mov eax, dword [0x100aad8c]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100305c2
dec dword [eax + 0xa8]
push ecx
call fcn.1005f497
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10030606
mov eax, dword [0x100aad8c]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100305f6
dec dword [eax + 0xa8]
push ecx
call fcn.1005f497
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100333f0
Function at 0x10039dc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [0x100aad8c]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax + 0x2ed0], 0
je 0x10039e3a
push 0xa0
call edi
shr eax, 0xf
test al, 1
jne 0x10039e3a
cmp dword [0x100aad8c], 0
jne 0x10039e05
push 0xebd
push str.E:Projects1MTA_DLL___Visualsimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.100660da
add esp, 0xc
mov esi, dword [0x100aad8c]
cmp byte [esi + 0x3761], 0
je 0x10039e26
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.10010970
mov dword [esi + 0x334], 0x210
mov dword [esi + 0x8f4], 0xa0
mov eax, dword [0x100aad8c]
cmp byte [eax + 0x2f10], 0
je 0x10039eab
push 0xa1
call edi
shr eax, 0xf
test al, 1
jne 0x10039eab
cmp dword [0x100aad8c], 0
jne 0x10039e76
push 0xebd
push str.E:Projects1MTA_DLL___Visualsimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.100660da
add esp, 0xc
mov esi, dword [0x100aad8c]
cmp byte [esi + 0x3761], 0
je 0x10039e97
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.10010970
mov dword [esi + 0x338], 0x214
mov dword [esi + 0x904], 0xa1
mov eax, dword [0x100aad8c]
cmp byte [eax + 0x2ef0], 0
je 0x10039f19
push 0x5b
call edi
shr eax, 0xf
test al, 1
jne 0x10039f19
cmp dword [0x100aad8c], 0
jne 0x10039ee4
push 0xebd
push str.E:Projects1MTA_DLL___Visualsimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.100660da
add esp, 0xc
mov esi, dword [0x100aad8c]
cmp byte [esi + 0x3761], 0
je 0x10039f05
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.10010970
mov dword [esi + 0x220], 0x212
mov dword [esi + 0x8fc], 0x5b
mov eax, dword [0x100aad8c]
cmp byte [eax + 0x2f30], 0
je 0x10039f88
push 0x5c
call edi
shr eax, 0xf
test al, 1
jne 0x10039f88
mov esi, dword [0x100aad8c]
test esi, esi
jne 0x10039f59
push 0xebd
push str.E:Projects1MTA_DLL___Visualsimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.100660da
mov esi, dword [0x100aad8c]
add esp, 0xc
cmp byte [esi + 0x3761], 0
je 0x10039f74
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.10010970
mov dword [esi + 0x224], 0x216
mov dword [esi + 0x90c], 0x5c
pop edi
pop esi
pop ecx
ret