joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002856
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
lea eax, [ebp - 0x800]
push esi
mov esi, 0x800
push esi
push 0
push eax
call fcn.10006730
add esp, 0xc
lea eax, [ebp - 0x800]
push dword [ebp + 0x1c]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
lea eax, [ebp - 0x800]
push dword [ebp + 0x14]
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call fcn.1000476c
add esp, 0x18
pop esi
leave
ret
Function at 0x1000346f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push dword [esi]
call fcn.10009ba7
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
pop ecx
pop ecx
test eax, eax
je 0x100034da
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100034da
mov eax, dword [esi]
push 0x513
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x400
push dword [0x1001f014]
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
jne 0x100034da
mov ecx, dword [0x1001f9fc]
push ebx
push dword [esi]
push 1
push 0x3c
call fcn.100024d4
jmp 0x1000365d
push 0x40
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.10006730
push 0x208
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.10006730
add esp, 0x18
lea eax, [ebp - 0x260]
push ebx
push 0x104
push eax
call fcn.10002990
and dword [ebp - 4], 0
lea eax, [ebp - 0x260]
mov dword [ebp - 0x10], eax
mov ebx, 0x400
mov eax, dword [esi + 8]
push 0xbd4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [0x1001f014]
mov dword [ebp - 0xc], str.album
call edi
mov eax, dword [esi + 0xc]
push 0xbd4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [0x1001f014]
mov dword [ebp - 0xc], str.artist
call edi
mov eax, dword [esi + 0x18]
push 0xbd4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [0x1001f014]
mov dword [ebp - 0xc], str.albumartist
call edi
mov eax, dword [esi + 4]
push 0xbd4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [0x1001f014]
mov dword [ebp - 0xc], 0x1001755c
call edi
push dword [esi + 0x30]
lea eax, [ebp - 0x58]
mov dword [ebp - 0xc], str.track
push 0x10017460
push 0x20
push eax
call fcn.100029cf
add esp, 0x10
lea eax, [ebp - 0x58]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 0xbd4
push eax
push ebx
push dword [0x1001f014]
call edi
mov eax, dword [esi + 0x14]
push 0xbd4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [0x1001f014]
mov dword [ebp - 0xc], str.genre
call edi
mov eax, dword [esi + 0x10]
push 0xbd4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [0x1001f014]
mov dword [ebp - 0xc], str.comment
call edi
cmp dword [esi + 0x2c], 0
jle 0x1000364b
push dword [esi + 0x2c]
lea eax, [ebp - 0x58]
mov dword [ebp - 0xc], str.year
push 0x10017460
push 0x20
push eax
call fcn.100029cf
add esp, 0x10
lea eax, [ebp - 0x58]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 0xbd4
push eax
push ebx
push dword [0x1001f014]
call edi
push 0x127
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [0x1001f014]
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003afd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.10005750
push ebx
push esi
push edi
push 0x1001fa18
push 0
push str.usefilename
push 0x10017410
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x10003b92
push dword [esi]
call fcn.1000971e
push 2
lea ebx, [eax + 0xa]
push ebx
call fcn.10008d24
add esp, 0xc
mov dword [esi + 0x84], eax
push dword [esi]
push ebx
push eax
call fcn.10002990
push 0x2e
push dword [ebp + 0xc]
call fcn.10006b22
push 0x2e
push dword [esi + 0x84]
mov edi, eax
call fcn.10006b22
add esp, 0x10
mov esi, eax
test edi, edi
je 0x10003bfe
test esi, esi
je 0x10003bfe
push edi
call fcn.1000971e
pop ecx
cmp eax, 0xa
jae 0x10003bfe
push edi
push ebx
push esi
call fcn.10002990
jmp 0x10003bfe
push 0x1000
lea eax, [ebp - 0x1000]
push 0
push eax
call fcn.10006730
add esp, 0xc
lea eax, [ebp - 0x1000]
mov edi, 0x800
push dword [ebp + 0xc]
push edi
push eax
call fcn.10002990
push esi
lea eax, [ebp - 0x1000]
push edi
push eax
call fcn.10004a16
lea eax, [ebp - 0x1000]
push eax
call fcn.100049a4
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1000]
push eax
call fcn.100087f4
pop ecx
mov dword [esi + 0x84], eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10003de0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x10016e68
call fcn.1000572c
sub esp, 0x238
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x1001fa18
push 1
push str.showconf
push 0x10017410
call edi
test eax, eax
je 0x10003e1f
push dword [ebp + 0x14]
call fcn.10003db4
pop ecx
test eax, eax
je 0x10003fc7
push ebx
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x244]
push esi
push eax
call fcn.10006730
push 0x1001fc20
push 0x400
push dword [ebp + 8]
mov ebx, str.transcoder
push str._Artist_____Album_____Title_
push str.fileformat
push ebx
call fcn.10002856
lea eax, [ebp - 0x244]
push eax
call fcn.100027df
push esi
push 0xfde9
push eax
call fcn.10001129
push 0x1001fc20
push 0x104
push dword [ebp + 0xc]
mov esi, eax
push esi
push str.fileroot
push ebx
call fcn.10002856
add esp, 0x4c
push esi
call fcn.100087c3
mov dword [esp], 0x1001fa18
push 0x66434141
push str.format
push 0x10017410
call edi
push 0x2e
mov ebx, eax
mov dword [ebp - 0x24], str.extension
pop esi
lea eax, [ebp - 0x13]
mov word [ebp - 0x14], si
push 0x202
mov dword [ebp - 0x20], eax
xor edi, edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x12], edi
push eax
push 0x400
push dword [0x1001f014]
mov word [ebp - 0xe], di
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], 0x1001fc20
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x10003f71
push 8
call fcn.100053e2
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x10003f16
mov ecx, eax
call fcn.10001020
mov esi, eax
jmp 0x10003f18
mov esi, edi
or dword [ebp - 4], 0xffffffff
push 0x1001fa18
push dword [0x1001f014]
push esi
call fcn.10002770
add esp, 0xc
cmp dword [esi + 4], 0
jle 0x10003f48
push edi
mov ecx, esi
call fcn.1000110d
cmp dword [eax], ebx
je 0x10003f6c
inc edi
cmp edi, dword [esi + 4]
jl 0x10003f36
mov eax, 0x66434141
push 0x202
mov ebx, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 0x400
push dword [0x1001f014]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x2e
pop esi
xor edi, edi
cmp byte [ebp - 0x13], 0
je 0x10003f9a
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.10001188
pop ecx
pop ecx
mov esi, eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10002944
push esi
call fcn.100087c3
pop ecx
jmp 0x10003fc3
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
push 8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3a]
push eax
push ebx
call fcn.10003a16
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10002944
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x10004811
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp - 0x200]
push esi
push 0x200
xor esi, esi
push esi
push eax
call fcn.10006730
mov ecx, dword [0x1001fa00]
add esp, 0xc
push str.2.78
push esi
push esi
push 0xfffe
push dword [0x1001fa08]
push dword [0x1001fa04]
push esi
push 0xb
call fcn.100025a1
push eax
lea eax, [ebp - 0x200]
push 0x100
push eax
call fcn.100029cf
mov ecx, dword [0x1001fa00]
add esp, 0x10
push esi
push esi
push 0xa
push dword [0x1001fa08]
push dword [0x1001fa04]
push esi
push 0xb
call fcn.100025a1
push 0x104
lea ecx, [ebp - 0x200]
push ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
cmp eax, 6
jne 0x100048b2
push 0x1001fa18
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [0x1001fa10]
call dword [sym.imp.USER32.dll_IsWindow]
neg eax
sbb eax, eax
inc eax
leave
ret

Function at 0x10005021
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x2f
pop ecx
push 0x5c
movzx eax, word [edi]
mov esi, edi
pop edx
cmp ax, dx
je 0x10005041
cmp ax, cx
jne 0x1000504f
movzx eax, word [edi + 2]
cmp ax, dx
je 0x10005078
cmp ax, cx
je 0x10005078
movzx eax, word [esi]
test ax, ax
je 0x10005118
cmp ax, dx
je 0x10005118
cmp ax, cx
je 0x10005118
inc esi
add esi, 1
jne 0x1000504f
jmp 0x1000511c
lea esi, [edi + 4]
test esi, esi
je 0x1000511c
movzx eax, word [esi]
test ax, ax
je 0x1000509f
cmp ax, dx
je 0x1000509b
cmp ax, cx
je 0x1000509b
inc esi
add esi, 1
jne 0x10005083
test esi, esi
je 0x1000511c
cmp word [esi], bx
je 0x1000511c
inc esi
add esi, 1
je 0x1000511c
movzx eax, word [esi]
test ax, ax
je 0x100050c4
cmp ax, dx
je 0x10005118
cmp ax, cx
je 0x10005118
inc esi
add esi, 1
jne 0x100050aa
jmp 0x10005118
cmp word [esi], bx
je 0x1000511c
push 0x2f
pop edi
movzx eax, word [esi]
test ax, ax
je 0x100050ee
cmp ax, dx
je 0x100050ee
cmp ax, di
je 0x100050ee
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push 0x5c
pop edx
test esi, esi
jne 0x100050cc
mov edi, dword [ebp + 8]
test esi, esi
je 0x1000511c
movzx ecx, word [esi]
mov ebx, ecx
test cx, cx
je 0x10005112
xor eax, eax
push eax
push edi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esi], bx
add esi, 2
push 0x5c
pop edx
push 0
pop ebx
test esi, esi
jne 0x100050c4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10010571
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10010210
push eax
push esi
invalid
invalid

Function at 0x100121cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
Function at 0x41a4a08
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x41a4a9f
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x41a4ab8
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a4aa6
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41b1dc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41b1e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41b1e0a
push 3
push 0x41b1e2c
push 0x41b1e2c
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41b1e30
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b1e27
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x403a70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403ad1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403ab4
cmp edi, 2
jb 0x403ab4
cmp byte [esi], cl
jne 0x403ab4
cmp byte [esi + 1], cl
jne 0x403ab4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x442420]
jmp 0x403a85
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x442420]
test edi, edi
jne 0x403a85
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403b00
cmp cl, 0x23
jne 0x403ae7
cmp byte [esi], cl
jne 0x403ae7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x442420]
test cl, cl
jne 0x403ad8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403bb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x403bd5
push 0x80a
push str.C:Users_samesDesktopVerahook_Loaderproimgui_masterimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x403be2
mov dword [edi], 0
mov edx, 0x441d08
mov ecx, esi
call fcn.00403b10
mov esi, eax
test esi, esi
je 0x403cd2
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403cc8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403cc8
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x403cc8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403cc8
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [0x5573b0]
test eax, eax
je 0x403c68
inc dword [eax + 0xb0]
test ebx, ebx
je 0x403cc8
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x403cad
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x5573b0]
add esp, 4
test eax, eax
je 0x403c9a
dec dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x403cbf
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406d30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
jg 0x406d59
push 0x738
push 0x43d2a8
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [ebp + 8]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x442420]
sub esi, 1
jne 0x406d73
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x406daa
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0041aec0
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
Function at 0x40a820
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40a85d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x40a843
cmp byte [esi], bl
jne 0x40a843
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x442420]
test bl, bl
jne 0x40a834
pop edi
pop esi
not ecx
pop ebx
jmp fcn.0040a7c0
Function at 0x419980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5b94], 0
lea esi, [edi + 0x5b98]
je 0x419a02
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x4199bc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041bb40
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00404220
mov edx, dword [esi]
mov ecx, 0x5573ac
push dword [edi + 0x5b94]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5ba0]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00404220
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419e50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x5573b0]
test bl, bl
je 0x419e96
or edi, 0xffffffff
cmp bl, 0x23
jne 0x419e77
cmp byte [esi], bl
jne 0x419e77
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x442420]
test bl, bl
jne 0x419e68
mov edi, dword [0x5573b0]
mov ecx, dword [edi + 0x5b38]
not eax
mov edx, dword [edi + 0x5b40]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x419ebd
cmp dword [edx + 4], eax
je 0x419ec0
add edx, 0x24
cmp edx, ecx
jne 0x419eb1
xor eax, eax
ret
mov eax, edx
ret
Function at 0x423c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x423caa
mov eax, dword [0x5573b0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x423c9d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x423cdb
mov eax, dword [0x5573b0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x423cce
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x423d0c
mov eax, dword [0x5573b0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x423cff
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x423d59
mov eax, dword [0x5573b0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x423d4c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x423d8a
mov eax, dword [0x5573b0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x423d7d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x423dbb
mov eax, dword [0x5573b0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x423dae
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.004265e0
Function at 0x434f40
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x5573b0]
mov edx, 0x210
push ebx
push esi
push edi
call fcn.004109c0
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax], 0
je 0x434fda
mov ecx, dword [0x5573b0]
mov edx, 0x210
call fcn.00402b80
cmp byte [eax + 8], 0
jne 0x434fda
push 0xa0
call ebx
shr eax, 0xf
test al, 1
jne 0x434fda
cmp dword [0x5573b0], 0
jne 0x434fa5
push 0x10a9
push str.C:Users_samesDesktopVerahook_Loaderproimgui_masterimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x5573b0]
cmp byte [esi + 0x3771], 0
je 0x434fc6
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403270
mov dword [esi + 0x33c], 0x210
mov dword [esi + 0x8fc], 0xa0
mov ecx, dword [0x5573b0]
mov edx, 0x214
call fcn.004109c0
cmp byte [eax], 0
je 0x435065
mov ecx, dword [0x5573b0]
mov edx, 0x214
call fcn.00402b80
cmp byte [eax + 8], 0
jne 0x435065
push 0xa1
call ebx
shr eax, 0xf
test al, 1
jne 0x435065
cmp dword [0x5573b0], 0
jne 0x435030
push 0x10a9
push str.C:Users_samesDesktopVerahook_Loaderproimgui_masterimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x5573b0]
cmp byte [esi + 0x3771], 0
je 0x435051
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403270
mov dword [esi + 0x340], 0x214
mov dword [esi + 0x90c], 0xa1
mov ecx, dword [0x5573b0]
mov edx, 0x212
call fcn.004109c0
cmp byte [eax], 0
je 0x4350ed
mov ecx, dword [0x5573b0]
mov edx, 0x212
call fcn.00402b80
cmp byte [eax + 8], 0
jne 0x4350ed
push 0x5b
call ebx
shr eax, 0xf
test al, 1
jne 0x4350ed
cmp dword [0x5573b0], 0
jne 0x4350b8
push 0x10a9
push str.C:Users_samesDesktopVerahook_Loaderproimgui_masterimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x5573b0]
cmp byte [esi + 0x3771], 0
je 0x4350d9
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403270
mov dword [esi + 0x228], 0x212
mov dword [esi + 0x904], 0x5b
mov ecx, dword [0x5573b0]
mov edx, 0x216
call fcn.004109c0
cmp byte [eax], 0
je 0x435176
mov ecx, dword [0x5573b0]
mov edx, 0x216
call fcn.00402b80
cmp byte [eax + 8], 0
jne 0x435176
push 0x5c
call ebx
shr eax, 0xf
test al, 1
jne 0x435176
mov esi, dword [0x5573b0]
test esi, esi
jne 0x435147
push 0x10a9
push str.C:Users_samesDesktopVerahook_Loaderproimgui_masterimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x5573b0]
add esp, 0xc
cmp byte [esi + 0x3771], 0
je 0x435162
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403270
mov dword [esi + 0x22c], 0x216
mov dword [esi + 0x914], 0x5c
pop edi
pop esi
pop ebx
ret
Function at 0x43be11
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43be50
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43be50
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43be50
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43be50
cmp dword [ecx + 0x74], 0xe
jbe 0x43be50
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40df14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40df23
pop dword [ebp - 4]
mov eax, 0x40df23
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x3a970
push 0
mov eax, 0xe501c9d6
add eax, 0x1b408842
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0xd5205407
sub ecx, 0xd52018d9
xor esi, esi
add esi, eax
mov edi, 0xe2f88d36
sub edi, 0xe2b53936
add edi, dword [ebp - 4]
mov edx, 0x125f528d
sub edx, 0xa732e027
mov ebx, dword [edi]
xor ebx, edx
mov dword [esi], ebx
add esi, 4
add edi, 4
loop 0x40df7f
add eax, 0xdf8b
mov ebx, eax
add eax, 0xce7d7421
sub eax, 0xce7d741c
mov ecx, 0x498d2da6
add ecx, 0xb6b2d25a
add ecx, dword [ebp - 4]
call ebx
leave
ret