joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bcd9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1009f068]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, esi
call fcn.1001e110
push 1
xor edx, edx
mov ecx, esi
call fcn.1003ec60
mov eax, dword [0x100a1264]
add esp, 4
mov edx, dword [eax + 0x3e58]
cmp byte [edx + 0xaf], 0
jne 0x1000bc96
movss xmm1, dword [eax + 0x37cc]
addss xmm1, dword [edx + 0xf8]
movss xmm0, dword [edx + 0xfc]
movss dword [edx + 0xf0], xmm1
movss dword [edx + 0xf4], xmm0
mov eax, dword [edx + 0x120]
mov ecx, dword [edx + 0x124]
mov dword [edx + 0x118], eax
mov eax, dword [edx + 0x12c]
mov dword [edx + 0x11c], ecx
mov dword [edx + 0x128], eax
mov byte [edx + 0x130], 1
cmp byte [edi + 5], 0
jne 0x1000bd2c
push 0
push dword [edi]
mov dword [ebp - 0x94], 0x42c80000
mov dword [ebp - 0x90], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [edi]
add ecx, 0xffffffdf
cmp ecx, 0x84
ja case.0x1000bcd2.41
movzx ecx, byte [ecx + 0x1000be48]
jmp dword [ecx*4 + 0x1000be40]
or eax, 0x100
push 0x80
lea ecx, [ebp - 0x8c]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
cmp dword [edi], 0
lea eax, [ebp - 0x8c]
mov ecx, str.None
lea edx, [ebp - 0x94]
cmovne ecx, eax
push 0
call fcn.1003fe90
add esp, 4
test al, al
je 0x1000bd22
mov byte [edi + 5], 1
jmp 0x1000bddb
cmp byte [edi + 5], 0
je 0x1000bddb
push 0
lea edx, [ebp - 0x94]
mov dword [ebp - 0x94], 0x42c80000
mov ecx, 0x1008fd6c
mov dword [ebp - 0x90], 0
call fcn.1003fe90
add esp, 4
test al, al
je 0x1000bd5d
mov byte [edi + 5], 0
cmp byte [edi + 5], 0
je 0x1000bddb
mov esi, 0x1008af70
xor edx, edx
push 1
lea ecx, [edx + 0x1b]
call fcn.1001e8b0
add esp, 4
test al, al
jne 0x1000bdd7
xor edx, edx
push 1
lea ecx, [edx + 0x12]
call fcn.1001e8b0
add esp, 4
test al, al
jne 0x1000bdd7
xor edx, edx
push 1
lea ecx, [edx + 2]
call fcn.1001e8b0
add esp, 4
test al, al
jne 0x1000bdd7
xor edx, edx
push 1
lea ecx, [edx + 1]
call fcn.1001e8b0
add esp, 4
test al, al
jne 0x1000bdd7
mov ecx, dword [esi]
xor edx, edx
push 1
call fcn.1001e8b0
add esp, 4
test al, al
jne 0x1000bdd3
add esi, 4
cmp esi, 0x1008b208
jne 0x1000bd68
jmp 0x1000bddb
mov eax, dword [esi]
mov dword [edi], eax
mov byte [edi + 5], 0
mov eax, dword [0x100a1264]
mov esi, dword [eax + 0x3e58]
cmp dword [esi + 0xe4], 1
jg 0x1000be06
push 0x1e80
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.cpp
push str.window__IDStack.Size___1
call fcn.10064e29
add esp, 0xc
cmp dword [esi + 0xe4], 0
jg 0x1000be26
push 0x743
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.h
push str.Size___0
call fcn.10064e29
add esp, 0xc
mov ecx, dword [ebp - 8]
dec dword [esi + 0xe4]
xor ecx, ebp
pop edi
pop esi
call fcn.10051658
mov esp, ebp
pop ebp
ret 4
Function at 0x1000eb00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1000eb61
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000eb44
cmp edi, 2
jb 0x1000eb44
cmp byte [esi], cl
jne 0x1000eb44
cmp byte [esi + 1], cl
jne 0x1000eb44
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1008b478]
jmp 0x1000eb15
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1008b478]
test edi, edi
jne 0x1000eb15
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000eb90
cmp cl, 0x23
jne 0x1000eb77
cmp byte [esi], cl
jne 0x1000eb77
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1008b478]
test cl, cl
jne 0x1000eb68
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1000ed20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x1000ed43
push 0x804
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.cpp
push str.filename__mode
call fcn.10064e29
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000ed50
mov dword [edi], 0
mov edx, 0x10094b28
mov ecx, esi
call fcn.1000eba0
mov esi, eax
test esi, esi
je 0x1000ee2f
push esi
call fcn.10062370
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1000ee26
push 2
push 0
push esi
call fcn.100616b4
add esp, 0xc
test eax, eax
jne 0x1000ee26
push esi
call fcn.10062370
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1000ee26
push 0
push dword [ebp + 8]
push esi
call fcn.100616b4
add esp, 0xc
test eax, eax
jne 0x1000ee26
mov eax, dword [0x100a1264]
test eax, eax
je 0x1000edc5
inc dword [eax + 0xac]
push ebx
call fcn.10064eaa
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1000ee26
push esi
push ebx
push 1
push eax
call fcn.100612e5
add esp, 0x10
push esi
cmp eax, ebx
je 0x1000ee10
call fcn.10056ca6
mov eax, dword [0x100a1264]
add esp, 4
test eax, eax
je 0x1000edfe
dec dword [eax + 0xac]
push dword [ebp + 8]
call fcn.1005d9ff
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10056ca6
add esp, 4
test edi, edi
je 0x1000ee1e
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10056ca6
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10012e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009f068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp dword [edi + 0xe4], 0
jg 0x10012eae
push 0x736
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.h
push str.Size___0
call fcn.10064e29
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [ebp - 8]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1008b478]
sub esi, 1
jne 0x10012ed0
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e8c], ebx
jne 0x10012f07
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.100298a0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10051658
mov esp, ebp
pop ebp
ret 4

Function at 0x10012f20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1009f068]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xe4], 0
jg 0x10012f54
push 0x736
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.h
push str.Size___0
call fcn.10064e29
add esp, 0xc
mov eax, dword [ebp + 8]
mov edi, 0x10
movss xmm1, dword [esi + 0x100]
movss xmm2, dword [esi + 0x104]
mov ecx, dword [esi + 0xe4]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xec]
subss xmm0, xmm2
lea esi, [ebp - 0x18]
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1008b478]
sub edi, 1
jne 0x10012fc0
mov ecx, dword [ebp - 8]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.10051658
mov esp, ebp
pop ebp
ret 4
Function at 0x10016c60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x100a1264]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [esi + 0x3e58]
mov ecx, edx
mov dword [ebp - 0xc], edx
cmp dword [edx + 0x190], 0
jne 0x10016c98
cmp dword [esi + 0x4a14], 0
mov eax, 0x228
je 0x10016c9d
mov eax, 0x1f8
movss xmm4, dword [eax + edx]
xorps xmm3, xmm3
movss xmm5, dword [eax + edx + 4]
subss xmm4, dword [ecx + 0xf0]
subss xmm5, dword [ecx + 0xf4]
mov ecx, dword [ebp + 8]
movss xmm2, dword [0x10097f5c]
mov dword [ebp - 4], 0
mov dword [ebp + 8], 2
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
mov eax, 1
cmovnp ecx, eax
ucomiss xmm0, xmm3
lahf
test ah, 0x44
mov eax, dword [ebp - 4]
cmovnp eax, dword [ebp + 8]
or eax, ecx
comiss xmm3, xmm1
mov dword [ebp - 4], eax
jb 0x10016d20
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x10016d20
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x10016d31
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x10016d31
movaps xmm0, xmm2
or dword [esi + 0x470c], 2
movss dword [esi + 0x472c], xmm1
movss dword [esi + 0x4730], xmm0
mov dword [esi + 0x4714], 1
mov eax, dword [edx + 4]
push ebx
test edi, edi
je 0x10016d71
push edi
push eax
push str._s__s__08X
lea eax, [ebp + 8]
push 0
push eax
call fcn.1000ea50
add esp, 0x18
jmp 0x10016d85
push eax
push str._s__08X
lea eax, [ebp + 8]
push 0
push eax
call fcn.1000ea50
add esp, 0x14
movss xmm0, dword [esi + 0x37b0]
xor edx, edx
mov ecx, dword [ebp + 8]
push 0x1000107
movss dword [ebp - 8], xmm0
call fcn.1001a240
mov edi, dword [esi + 0x3e58]
add esp, 4
movss xmm0, dword [ebp - 8]
movss dword [esi + 0x37b0], xmm0
mov byte [ebp + 0xb], al
cmp word [edi + 0xb6], 1
mov eax, dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [edi + 0x74], ebx
mov byte [edi + 0xc6], al
jne 0x10016de8
mov edx, dword [ebp - 0xc]
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [edx + 0xf0], ecx
mov dword [edx + 0xf4], eax
mov edi, ebx
mov edx, 0x10091169
not edi
mov al, 0x23
mov ebx, edi
cmp al, 0x23
jne 0x10016e03
cmp byte [edx], al
jne 0x10016e03
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x1008b478]
test al, al
jne 0x10016df5
mov edi, dword [ebp - 8]
not ebx
cmp dword [esi + 0x3ea4], ebx
jne 0x10016e32
xor edx, edx
xor ecx, ecx
call fcn.10012ff0
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0x47e8], eax
jne 0x10016e77
cmp word [edi + 0x14c], 0
jne 0x10016e50
cmp byte [edi + 0x152], 0
je 0x10016e77
xor edx, edx
mov ecx, edi
call fcn.1001d490
xor dl, dl
mov ecx, edi
call fcn.10024830
mov edx, edi
mov ecx, ebx
call fcn.10012ff0
mov eax, dword [esi + 0x480c]
mov dword [esi + 0x3ec4], eax
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100170c0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x100170ff
cmp bl, 0x23
jne 0x100170e1
cmp byte [esi], bl
jne 0x100170e1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x1008b478]
test bl, bl
jne 0x100170d2
mov ecx, dword [0x100a1264]
not eax
mov esi, dword [ecx + 0x3e40]
mov edi, dword [ecx + 0x3e48]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1001713e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10017138
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1001713a
mov esi, edx
test esi, esi
jne 0x10017120
cmp edi, ebx
je 0x1001714d
cmp dword [edi], eax
jne 0x1001714d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10028500
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100a1264]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x10028547
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x1002852e
cmp byte [edx], al
jne 0x1002852e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x1008b478]
test al, al
jne 0x10028520
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x5a74]
test eax, eax
jle 0x1002859c
xor edi, edi
nop word [eax + eax]
test esi, esi
js 0x10028568
cmp esi, eax
jl 0x10028582
push 0x72d
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.h
push str.i___0__i___Size
call fcn.10064e29
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ecx + 0x5a7c]
cmp dword [eax + edi + 4], ebx
je 0x100285a5
mov eax, dword [ecx + 0x5a74]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x10028560
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x100285b1
cmp esi, dword [ecx + 0x5a74]
jl 0x100285c8
push 0x72d
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.h
push str.i___0__i___Size
call fcn.10064e29
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x5a7c]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret
Function at 0x100323f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10032426
mov eax, dword [0x100a1264]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10032416
dec dword [eax + 0xac]
push ecx
call fcn.1005d9ff
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1003245a
mov eax, dword [0x100a1264]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1003244a
dec dword [eax + 0xac]
push ecx
call fcn.1005d9ff
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1003248e
mov eax, dword [0x100a1264]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1003247e
dec dword [eax + 0xac]
push ecx
call fcn.1005d9ff
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100324de
mov eax, dword [0x100a1264]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x100324ce
dec dword [eax + 0xac]
push ecx
call fcn.1005d9ff
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10032512
mov eax, dword [0x100a1264]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10032502
dec dword [eax + 0xac]
push ecx
call fcn.1005d9ff
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10032546
mov eax, dword [0x100a1264]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10032536
dec dword [eax + 0xac]
push ecx
call fcn.1005d9ff
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10034d30
Function at 0x1003b8c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x100a1264]
mov edx, 0x210
push esi
push edi
call fcn.1001e1a0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax], 0
je 0x1003b956
mov ecx, dword [0x100a1264]
mov edx, 0x210
call fcn.1000dc60
cmp byte [eax + 8], 0
jne 0x1003b956
push 0xa0
call edi
shr eax, 0xf
test al, 1
jne 0x1003b956
cmp dword [0x100a1264], 0
jne 0x1003b921
push 0x108f
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.10064e29
add esp, 0xc
mov esi, dword [0x100a1264]
cmp byte [esi + 0x3769], 0
je 0x1003b942
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1000e310
mov dword [esi + 0x338], 0x210
mov dword [esi + 0x8f8], 0xa0
mov ecx, dword [0x100a1264]
mov edx, 0x214
call fcn.1001e1a0
cmp byte [eax], 0
je 0x1003b9e4
mov ecx, dword [0x100a1264]
mov edx, 0x214
call fcn.1000dc60
cmp byte [eax + 8], 0
jne 0x1003b9e4
push 0xa1
call edi
shr eax, 0xf
test al, 1
jne 0x1003b9e4
cmp dword [0x100a1264], 0
jne 0x1003b9af
push 0x108f
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.10064e29
add esp, 0xc
mov esi, dword [0x100a1264]
cmp byte [esi + 0x3769], 0
je 0x1003b9d0
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1000e310
mov dword [esi + 0x33c], 0x214
mov dword [esi + 0x908], 0xa1
mov ecx, dword [0x100a1264]
mov edx, 0x212
call fcn.1001e1a0
cmp byte [eax], 0
je 0x1003ba6f
mov ecx, dword [0x100a1264]
mov edx, 0x212
call fcn.1000dc60
cmp byte [eax + 8], 0
jne 0x1003ba6f
push 0x5b
call edi
shr eax, 0xf
test al, 1
jne 0x1003ba6f
cmp dword [0x100a1264], 0
jne 0x1003ba3a
push 0x108f
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.10064e29
add esp, 0xc
mov esi, dword [0x100a1264]
cmp byte [esi + 0x3769], 0
je 0x1003ba5b
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1000e310
mov dword [esi + 0x224], 0x212
mov dword [esi + 0x900], 0x5b
mov ecx, dword [0x100a1264]
mov edx, 0x216
call fcn.1001e1a0
cmp byte [eax], 0
je 0x1003bafb
mov ecx, dword [0x100a1264]
mov edx, 0x216
call fcn.1000dc60
cmp byte [eax + 8], 0
jne 0x1003bafb
push 0x5c
call edi
shr eax, 0xf
test al, 1
jne 0x1003bafb
mov esi, dword [0x100a1264]
test esi, esi
jne 0x1003bacc
push 0x108f
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.10064e29
mov esi, dword [0x100a1264]
add esp, 0xc
cmp byte [esi + 0x3769], 0
je 0x1003bae7
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1000e310
mov dword [esi + 0x228], 0x216
mov dword [esi + 0x910], 0x5c
pop edi
pop esi
ret
Function at 0x1004e020
Capabilities:
Hash data with crc32

Disassembly:
push ecx
test dword [ecx + 0xc], 0x100000
push ebx
push esi
push edi
mov esi, edx
je 0x1004e092
mov cl, byte [esi]
or eax, 0xffffffff
inc esi
test cl, cl
je 0x1004e068
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x1004e04f
cmp byte [esi], cl
jne 0x1004e04f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1008b478]
test cl, cl
jne 0x1004e040
mov ecx, dword [0x100a1264]
not eax
cmp dword [ecx + 0x3ea4], eax
jne 0x1004e07e
mov dword [ecx + 0x3ea8], eax
cmp dword [ecx + 0x3ecc], eax
jne 0x1004e0f8
mov byte [ecx + 0x3ed0], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x100a1264]
mov ebx, dword [eax + 0x3e58]
cmp dword [ebx + 0xe4], 0
jg 0x1004e0bd
push 0x736
push str.E:Visual_Studio_ProjectsNFSMWModMenuNFSMWModMenuimguiimgui.h
push str.Size___0
call fcn.10064e29
add esp, 0xc
mov ecx, dword [ebx + 0xe4]
xor edx, edx
mov eax, dword [ebx + 0xec]
push dword [eax + ecx*4 - 4]
mov ecx, esi
call fcn.1000eb00
mov ecx, dword [ebx]
mov edi, eax
add esp, 4
cmp dword [ecx + 0x3e8c], edi
jne 0x1004e0f6
push ecx
push esi
mov edx, 0xb
mov ecx, edi
call fcn.100298a0
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10062133
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10052720
mov eax, dword [0x1009f068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100672a7
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10062175
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100622d1
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1007a3a0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100a0de8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1006da07
mov ecx, dword [esi*4 + 0x100a0de8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x100622ca
cmp eax, dword [edi + ecx + 0x24]
jne 0x100622ca
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100622ca
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1006da07
add esp, 0x14
test edx, edx
jl 0x100622ca
jg 0x10062240
test eax, eax
jb 0x100622ca
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100622ca
jl 0x1006225a
cmp dword [ebp - 0x1008], eax
ja 0x100622ca
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10062278
test ebx, ebx
je 0x100622b1
cmp ecx, edi
jae 0x100622b1
mov al, byte [ecx]
cmp al, 0xd
jne 0x10062292
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1006229e
cmp byte [ecx + 1], 0xa
jne 0x1006229e
inc ecx
jmp 0x1006229e
movzx eax, al
movsx eax, byte [eax + 0x1009f2d0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10062278
cmp edx, ebx
jne 0x10062278
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100622cf
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10051658
leave
ret
Function at 0x1006bb8f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006ba00

Function at 0x1006c0e2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10083688
push 0x10083680
push str.FlsAlloc
push 0x1e
call fcn.1006becc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006c116
push dword [ebp + 8]
mov ecx, esi
call dword [0x1007f204]
call esi
jmp 0x1006c11c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1006c160
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10083698
push 0x10083690
push str.FlsGetValue
push 0x20
call fcn.1006becc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006c197
push dword [ebp + 8]
mov ecx, esi
call dword [0x1007f204]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]