joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10088130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
jle 0x10088242
movsd xmm1, qword [0x102de5f8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
add edi, 2
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
mov eax, ecx
movzx esi, byte [edi - 1]
mov ebp, edx
and edx, 0x7f
shr eax, 7
and ecx, 0x7f
add edx, edx
shl ecx, 8
or edx, eax
movzx eax, byte [edi - 2]
or esi, ecx
shl esi, 8
and ebp, 0x80
or esi, eax
test edx, edx
jne 0x10088192
test esi, esi
jne 0x10088192
xorps xmm0, xmm0
jmp 0x1008822e
lea eax, [edx - 0x7f]
neg edx
sbb edx, edx
or esi, 0x800000
and edx, eax
movd xmm0, esi
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x102093e0]
cvtps2pd xmm0, xmm0
cvtpd2ps xmm0, xmm0
movss dword [esp + 0x20], xmm0
test ebp, ebp
je 0x100881cf
mulss xmm0, dword [0x102093f8]
movss dword [esp + 0x20], xmm0
test edx, edx
jle 0x100881f6
movaps xmm0, xmm1
movd xmm1, edx
cvtdq2pd xmm1, xmm1
call fcn.1012bd40
movss xmm1, dword [esp + 0x20]
cvtps2pd xmm1, xmm1
mulsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
jmp 0x10088226
jns 0x1008822e
mov eax, edx
cvtps2pd xmm0, xmm0
cdq
xor eax, edx
sub eax, edx
movsd qword [esp + 0x10], xmm0
movaps xmm0, xmm1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
call fcn.1012bd40
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movsd xmm1, qword [0x102de5f8]
movss dword [edi - 2], xmm0
add edi, 4
sub ebx, 1
jne 0x10088152
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1008b600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
jle 0x1008b72c
movsd xmm2, qword [0x102de5f8]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
add esi, 6
movzx ecx, byte [esi]
movzx ebp, byte [esi + 1]
mov eax, ecx
movzx edi, byte [esi - 1]
and ecx, 0xf
shl ecx, 8
mov edx, ebp
or edi, ecx
shr eax, 4
movzx ecx, byte [esi - 4]
and edx, 0x7f
shl edx, 4
or edx, eax
shl edi, 8
movzx eax, byte [esi - 2]
or edi, eax
shl ecx, 8
movzx eax, byte [esi - 3]
shl edi, 8
or edi, eax
movzx eax, byte [esi - 5]
or ecx, eax
movzx eax, byte [esi - 6]
shl ecx, 8
or ecx, eax
test edx, edx
jne 0x1008b680
test edi, edi
jne 0x1008b680
test ecx, ecx
jne 0x1008b680
xorps xmm1, xmm1
jmp 0x1008b718
movd xmm1, ecx
sub edx, 0x3ff
movd xmm0, edi
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
mulsd xmm1, qword [0x10209488]
addsd xmm1, xmm0
addsd xmm1, qword [0x102094a0]
mulsd xmm1, qword [0x10209480]
movsd qword [esp + 0x10], xmm1
cmp ebp, 0x80
jb 0x1008b6ce
mulsd xmm1, qword [0x101fccc0]
movsd qword [esp + 0x10], xmm1
test edx, edx
jle 0x1008b6ed
movd xmm1, edx
movaps xmm0, xmm2
cvtdq2pd xmm1, xmm1
call fcn.1012bd40
mulsd xmm0, qword [esp + 0x10]
movaps xmm1, xmm0
jmp 0x1008b710
jns 0x1008b718
mov eax, edx
movaps xmm0, xmm2
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
call fcn.1012bd40
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movsd xmm2, qword [0x102de5f8]
movsd qword [esi - 6], xmm1
add esi, 8
sub ebx, 1
jne 0x1008b622
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1009d490
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
xor edi, edi
movzx ecx, word [esi + edi*2]
movsx eax, cx
imul eax, eax
push ecx
push ebp
sar eax, 2
add ebx, eax
call fcn.1009d6f0
movzx eax, al
add esp, 8
mov word [esi + edi*2], ax
inc edi
cmp edi, 0xa0
jl 0x1009d4a3
mov ecx, dword [ebp + 0x6c]
mov eax, ecx
shl ebx, 0xc
mov dword [esp + 0x20], ebx
sub eax, 0
je 0x1009d67c
sub eax, 1
je 0x1009d554
sub eax, 1
je 0x1009d507
push ecx
push str._Error_:_Unhandled_NMS_ADPCM_type__d._n
push dword [esp + 0x30]
call fcn.1006ac00
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, dword [esp + 0x34]
xor edx, edx
nop dword [eax]
lea eax, [edx + edx]
add edx, 4
mov cx, word [eax + esi]
lea edi, [edi + 2]
shl cx, 4
or cx, word [eax + esi + 2]
shl cx, 4
or cx, word [eax + esi + 4]
shl cx, 4
or cx, word [eax + esi + 6]
mov word [edi - 2], cx
cmp edx, 0xa0
jl 0x1009d510
mov word [edi], bx
mov eax, 0xa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov dword [esp + 0x10], eax
nop
lea eax, [esi + ecx*2]
mov dword [esp + 0x14], eax
lea ebx, [esi + ecx*2]
lea edx, [esi + ecx*2]
lea edi, [esi + ecx*2]
lea ebp, [esi + ecx*2]
lea eax, [esi + 4]
lea eax, [eax + ecx*2]
mov dword [esp + 0x18], eax
lea eax, [ecx*2 + 0x18]
add ecx, 0x10
mov dword [esp + 0x1c], ecx
movzx ecx, word [eax + esi]
and cx, 0xf
shl cx, 4
or cx, word [eax + esi + 2]
shl cx, 4
or cx, word [eax + esi + 4]
movzx eax, word [eax + esi + 6]
shr ax, 1
shl cx, 3
or cx, ax
movzx eax, word [edx + 0x10]
shl ax, 4
or ax, word [edx + 0x12]
shl ax, 4
or ax, word [edi + 0x14]
movzx ecx, cx
shl ax, 4
or ax, word [edi + 0x16]
mov dword [esp + 0x2c], ecx
and ecx, 0x1111
shr word [esp + 0x2c], 1
or ax, cx
movzx ecx, word [ebx + 8]
mov edx, dword [esp + 0x2c]
shl cx, 4
or cx, word [ebx + 0xa]
mov ebx, dword [esp + 0x14]
movzx edi, ax
mov eax, edx
shl cx, 4
and eax, 0x1111
or cx, word [ebp + 0xc]
shl cx, 4
or cx, word [ebp + 0xe]
or cx, ax
shr edx, 1
movzx eax, word [ebx]
and edx, 0x1111
shl ax, 4
or ax, word [ebx + 2]
mov ebx, dword [esp + 0x18]
shl ax, 4
movzx ecx, cx
or ax, word [ebx]
shl ax, 4
or ax, dx
mov edx, dword [esp + 0x10]
or ax, word [ebx + 2]
mov word [edx], ax
mov word [edx + 2], cx
mov ecx, dword [esp + 0x1c]
mov word [edx + 4], di
add edx, 6
mov dword [esp + 0x10], edx
cmp ecx, 0xa0
jl 0x1009d560
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov word [edx], ax
mov eax, 0xa0
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x34]
xor edi, edi
lea eax, [edi + edi]
add edi, 8
mov cx, word [eax + esi]
lea edx, [eax + esi]
shl cx, 2
lea ebp, [ebp + 2]
or cx, word [eax + esi + 8]
shl cx, 2
or cx, word [eax + esi + 2]
shl cx, 2
or cx, word [eax + esi + 0xa]
shl cx, 2
or cx, word [edx + 4]
shl cx, 2
or cx, word [eax + esi + 0xc]
mov ax, word [eax + esi + 0xe]
shl cx, 2
sar ax, 2
or cx, ax
or cx, word [edx + 6]
mov word [ebp - 2], cx
cmp edi, 0xa0
jl 0x1009d682
pop edi
pop esi
mov word [ebp], bx
mov eax, 0xa0
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100b0d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
movsx eax, word [esi + 0x20]
push eax
movsx eax, word [esi + 0x10]
sar eax, 2
push eax
call fcn.100b08b0
add esp, 8
mov dword [esp + 0x1c], eax
lea ebp, [esi + 0x12]
mov dword [esp + 0x10], 5
nop
movsx edi, word [ebp]
movsx ebx, word [ebp + 0x10]
sar edi, 2
movzx ecx, di
mov eax, ecx
test edi, edi
jle 0x100b0d66
jmp 0x100b0d6d
neg eax
and eax, 0x1fff
mov esi, 0x102efd90
xor edx, edx
mov cx, word [esi]
lea esi, [esi + 2]
cmp ax, cx
jl 0x100b0d85
inc edx
cmp edx, 0xf
jl 0x100b0d74
lea ecx, [edx - 6]
movzx edx, cx
test ax, ax
jne 0x100b0d97
mov ecx, 0x20
jmp 0x100b0dae
test dx, dx
js 0x100b0da4
mov cx, dx
sar ax, cl
jmp 0x100b0dab
mov ecx, edx
neg ecx
shl ax, cl
movzx ecx, ax
movsx esi, word [ebp + 0x10]
add edx, 0xfffffff3
mov eax, ebx
sar eax, 6
and eax, 0xf
add eax, edx
movzx edx, ax
mov dword [esp + 0x14], edx
mov edx, esi
movzx ebx, ax
and edx, 0x3f
movsx eax, cx
imul edx, eax
sar edx, 4
movzx eax, dx
test bx, bx
js 0x100b0dee
mov cl, bl
shl ax, cl
mov ecx, 0x7fff
and ax, cx
jmp 0x100b0df7
mov cl, byte [esp + 0x14]
neg cl
sar ax, cl
mov edx, dword [esp + 0x1c]
movzx eax, ax
movsx ecx, ax
mov eax, ecx
neg eax
xor edi, esi
cmovns eax, ecx
add ebp, 2
add edx, eax
sub dword [esp + 0x10], 1
mov dword [esp + 0x1c], edx
jne 0x100b0d50
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
add esp, 8
ret
Function at 0x100b4b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1b4
mov eax, dword [0x102f0d80]
xor eax, esp
mov dword [esp + 0x1b0], eax
mov ecx, dword [esp + 0x1bc]
mov eax, dword [esp + 0x1b8]
mov edx, dword [esp + 0x1c0]
push ebx
push ebp
mov dword [esp + 0x24], ecx
lea ebp, [eax + 0xf0]
mov ecx, dword [esp + 0x1cc]
lea ebx, [esp + 0x78]
push esi
mov esi, dword [esp + 0x1e0]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x1d8]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1dc]
push edi
mov edi, dword [esp + 0x1d8]
sub dword [esp + 0x10], edi
sub dword [esp + 0x14], edi
sub edx, edi
mov dword [esp + 0x28], esi
mov esi, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 4
nop word [eax + eax]
lea eax, [esp + 0x30]
push eax
movzx eax, word [edi]
push ecx
push eax
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + edi]
push eax
call fcn.100bee60
push ebp
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + edi]
push eax
mov eax, dword [esp + 0x40]
movzx eax, word [eax + edi]
push eax
push esi
call fcn.100bbe10
movups xmm0, xmmword [ebp]
mov ecx, dword [esp + 0x3c]
lea ebx, [ebx + 0x50]
add ecx, 0x1a
lea edi, [edi + 2]
movups xmmword [ebx - 0x50], xmm0
add esp, 0x24
sub dword [esp + 0x1c], 1
movups xmm0, xmmword [ebp + 0x10]
mov dword [esp + 0x18], ecx
movups xmmword [ebx - 0x40], xmm0
movups xmm0, xmmword [ebp + 0x20]
movups xmmword [ebx - 0x30], xmm0
movups xmm0, xmmword [ebp + 0x30]
movups xmmword [ebx - 0x20], xmm0
movups xmm0, xmmword [ebp + 0x40]
movups xmmword [ebx - 0x10], xmm0
jne 0x100b4c20
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x80]
mov ebx, dword [esp + 0x20]
push esi
push eax
push dword [esp + 0x34]
push ebx
call fcn.100be410
movzx eax, word [ebx + 0x284]
add esp, 0x10
mov edx, 0xa0
movsx ecx, ax
mov ebp, 0xffff8000
nop dword [eax + eax]
imul eax, ecx, 0x6e14
dec edx
movsx ecx, word [esi]
add eax, 0x4000
sar eax, 0xf
cwde
add eax, ecx
cmp eax, 0x7fff
jl 0x100b4cf3
mov eax, 0x7fff
jmp 0x100b4cfb
cmp eax, 0xffff8000
cmovle eax, ebp
movzx edi, ax
movsx ecx, di
lea eax, [ecx + ecx]
cmp eax, 0x7fff
jl 0x100b4d12
mov eax, 0x7fff
jmp 0x100b4d1a
cmp eax, 0xffff8000
cmovle eax, ebp
and eax, 0xfffffff8
mov word [esi], ax
add esi, 2
test edx, edx
jne 0x100b4cd0
mov ecx, dword [esp + 0x1c0]
mov word [ebx + 0x284], di
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011bad5
add esp, 0x1b4
ret
Function at 0x100beed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x102f0d80]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x84]
push ebx
mov ebx, dword [esp + 0x8c]
push ebp
mov ebp, dword [esp + 0x94]
push edi
mov edi, dword [esp + 0x8c]
mov dword [esp + 0xc], eax
mov eax, 0x14
mov dword [esp + 0x10], ebp
mov ebp, 0x7fff
push esi
movsx ecx, word [eax + edi - 0x10]
movsx edx, word [eax + edi - 0x18]
add edx, ecx
movsx ecx, word [eax + edi - 0x1e]
imul esi, edx, 0x806
movsx edx, word [eax + edi - 0xa]
add edx, ecx
imul ecx, edx, 0x86
movsx edx, word [eax + edi - 0xc]
sub esi, ecx
movsx ecx, word [eax + edi - 0x1c]
add edx, ecx
imul ecx, edx, 0x176
movsx edx, word [eax + edi - 0x16]
sub esi, ecx
movsx ecx, word [eax + edi - 0x12]
add edx, ecx
imul ecx, edx, 0x166d
add esi, ecx
movsx ecx, word [eax + edi - 0x14]
shl ecx, 0xd
add ecx, 0x1000
add ecx, esi
sar ecx, 0xd
cmp ecx, 0xffff8000
jge 0x100bef80
mov ecx, 0xffff8000
jmp 0x100bef85
cmp ecx, ebp
cmovg ecx, ebp
mov word [esp + eax + 0x24], cx
add eax, 2
cmp eax, 0x62
jle 0x100bef10
pop esi
push ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.100bf0a0
push dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push ebp
push eax
call fcn.100be990
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x30]
push dword [esp + 0x3c]
push ebp
call fcn.100be8d0
push edi
lea eax, [esp + 0x4c]
push eax
movzx eax, word [ebx]
push eax
call fcn.100bf000
mov ecx, dword [esp + 0xc0]
add esp, 0x3c
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011bad5
add esp, 0x7c
ret
Function at 0x100d86c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x20]
mov ecx, 2
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
cmp edi, 8
jle 0x100d8726
push dword [esp + 0x28]
push esi
push edi
call fcn.100d81e0
add esp, 0xc
mov ecx, 8
mov dword [esp + 0x18], ecx
cmp edi, 0x20
jle 0x100d8726
mov dword [esp + 0x20], 0x20
nop
push dword [esp + 0x28]
push esi
push ecx
push edi
call fcn.100d8a40
mov ecx, dword [esp + 0x30]
add esp, 0x10
lea eax, [ecx*4]
mov dword [esp + 0x20], eax
cmp eax, edi
jl 0x100d8700
mov dword [esp + 0x18], ecx
lea eax, [ecx*4]
cmp eax, edi
jne 0x100d882d
xor edx, edx
test ecx, ecx
jle 0x100d8889
lea eax, [ecx + ecx*2]
lea edi, [esi + eax*8]
lea eax, [esi + ecx*8]
mov dword [esp + 0x20], eax
mov eax, ecx
shl eax, 4
add eax, esi
mov ecx, dword [esp + 0x20]
movsd xmm3, qword [esi + edx*8]
movsd xmm6, qword [eax]
movsd xmm5, qword [esi + edx*8 + 8]
movsd xmm7, qword [ecx]
movsd xmm2, qword [ecx + 8]
addsd xmm7, xmm3
subsd xmm3, qword [ecx]
xorps xmm5, xmmword [0x10200570]
movsd xmm4, qword [eax + 8]
subsd xmm5, xmm2
subsd xmm2, qword [esi + edx*8 + 8]
movsd qword [esp + 0x10], xmm3
movaps xmm3, xmm6
addsd xmm3, qword [edi]
subsd xmm6, qword [edi]
movsd qword [esp + 8], xmm2
movaps xmm2, xmm4
addsd xmm2, qword [edi + 8]
subsd xmm4, qword [edi + 8]
movaps xmm0, xmm3
addsd xmm0, xmm7
subsd xmm7, xmm3
movsd qword [esi + edx*8], xmm0
movaps xmm0, xmm5
subsd xmm0, xmm2
addsd xmm2, xmm5
movsd qword [esi + edx*8 + 8], xmm0
add edx, 2
movsd xmm0, qword [esp + 0x10]
subsd xmm0, xmm4
movsd qword [eax], xmm7
addsd xmm4, qword [esp + 0x10]
movsd qword [eax + 8], xmm2
add eax, 0x10
movsd qword [ecx], xmm0
movsd xmm0, qword [esp + 8]
subsd xmm0, xmm6
addsd xmm6, qword [esp + 8]
movsd qword [ecx + 8], xmm0
add ecx, 0x10
movsd qword [edi], xmm4
movsd qword [edi + 8], xmm6
add edi, 0x10
mov dword [esp + 0x20], ecx
cmp edx, dword [esp + 0x18]
jl 0x100d8753
pop edi
pop esi
add esp, 0x14
ret
xor eax, eax
test ecx, ecx
jle 0x100d8889
movsd xmm5, qword [0x10200570]
lea edx, [esi + 8]
lea edx, [edx + ecx*8]
movsd xmm3, qword [edx - 8]
movsd xmm4, qword [esi + eax*8]
movaps xmm0, xmm3
movsd xmm1, qword [esi + eax*8 + 8]
addsd xmm0, xmm4
movsd xmm2, qword [edx]
subsd xmm4, xmm3
subsd xmm2, xmm1
xorps xmm1, xmm5
movsd qword [esi + eax*8], xmm0
subsd xmm1, qword [edx]
movsd qword [esi + eax*8 + 8], xmm1
add eax, 2
movsd qword [edx - 8], xmm4
movsd qword [edx], xmm2
add edx, 0x10
cmp eax, ecx
jl 0x100d8841
pop edi
pop esi
add esp, 0x14
ret
Function at 0x100da020
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
mov ecx, 2
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
cmp edi, 8
jle 0x100da086
push dword [esp + 0x20]
push esi
push edi
call fcn.100d9b30
add esp, 0xc
mov ecx, 8
mov dword [esp + 0x10], ecx
cmp edi, 0x20
jle 0x100da086
mov dword [esp + 0x18], 0x20
nop
push dword [esp + 0x20]
push esi
push ecx
push edi
call fcn.100da3a0
mov ecx, dword [esp + 0x28]
add esp, 0x10
lea eax, [ecx*4]
mov dword [esp + 0x18], eax
cmp eax, edi
jl 0x100da060
mov dword [esp + 0x10], ecx
lea eax, [ecx*4]
cmp eax, edi
jne 0x100da19a
xor edx, edx
test ecx, ecx
jle 0x100da1f8
lea eax, [ecx + ecx*2]
lea eax, [esi + eax*4]
mov dword [esp + 0xc], eax
lea edi, [esi + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
nop word [eax + eax]
movss xmm3, dword [esi + edx*4]
movss xmm7, dword [edi]
mov ecx, dword [esp + 0x18]
addss xmm7, xmm3
subss xmm3, dword [edi]
movss xmm5, dword [esi + edx*4 + 4]
movss xmm2, dword [edi + 4]
movss xmm6, dword [ecx]
xorps xmm5, xmmword [0x1020f260]
movss xmm4, dword [ecx + 4]
subss xmm5, xmm2
subss xmm2, dword [esi + edx*4 + 4]
movss dword [esp + 0xc], xmm3
movaps xmm3, xmm6
addss xmm3, dword [eax]
subss xmm6, dword [eax]
movss dword [esp + 8], xmm2
movaps xmm2, xmm4
addss xmm2, dword [eax + 4]
subss xmm4, dword [eax + 4]
movaps xmm0, xmm3
addss xmm0, xmm7
subss xmm7, xmm3
movss dword [esi + edx*4], xmm0
movaps xmm0, xmm5
subss xmm0, xmm2
addss xmm2, xmm5
movss dword [esi + edx*4 + 4], xmm0
add edx, 2
movss xmm0, dword [esp + 0xc]
subss xmm0, xmm4
movss dword [ecx], xmm7
addss xmm4, dword [esp + 0xc]
movss dword [ecx + 4], xmm2
add ecx, 8
mov dword [esp + 0x18], ecx
movss dword [edi], xmm0
movss xmm0, dword [esp + 8]
subss xmm0, xmm6
addss xmm6, dword [esp + 8]
movss dword [edi + 4], xmm0
add edi, 8
movss dword [eax], xmm4
movss dword [eax + 4], xmm6
add eax, 8
cmp edx, dword [esp + 0x10]
jl 0x100da0c0
pop edi
pop esi
add esp, 0xc
ret
xor eax, eax
test ecx, ecx
jle 0x100da1f8
movss xmm5, dword [0x1020f260]
lea edx, [esi + 4]
lea edx, [edx + ecx*4]
nop
movss xmm3, dword [edx - 4]
movss xmm4, dword [esi + eax*4]
movaps xmm0, xmm3
movss xmm1, dword [esi + eax*4 + 4]
addss xmm0, xmm4
movss xmm2, dword [edx]
subss xmm4, xmm3
subss xmm2, xmm1
xorps xmm1, xmm5
movss dword [esi + eax*4], xmm0
subss xmm1, dword [edx]
movss dword [esi + eax*4 + 4], xmm1
add eax, 2
movss dword [edx - 4], xmm4
movss dword [edx], xmm2
add edx, 8
cmp eax, ecx
jl 0x100da1b0
pop edi
pop esi
add esp, 0xc
ret
Function at 0x100e5110
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101fadf0
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x102f0d80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
call fcn.1011bae3
mov esi, eax
add esp, 4
test esi, esi
je 0x100e51f9
mov ecx, esi
call fcn.100e8310
push 0x34
mov dword [esi], vtable.tvg::Shape.0
call fcn.1011bae3
add esp, 4
test eax, eax
je 0x100e51d8
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], esi
mov byte [eax + 0x30], 0
mov byte [eax + 0x32], 0
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
mov byte [eax + 0x13], 1
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
mov byte [eax + 0x13], 1
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e9820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101faf10
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x102f0d80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea eax, [edi + 0xc]
mov dword [ebp - 4], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esi, dword [ebp + 8]
mov dword [edi + 0x18], 0
mov byte [ebp - 4], 1
lea ecx, [esi*4]
cmp esi, dword [edi + 8]
jbe 0x100e98b2
push ecx
push dword [edi]
mov dword [edi + 8], esi
call fcn.10132664
mov dword [edi], eax
lea ecx, [esi*4]
add esp, 8
lea eax, [edi + 0xc]
cmp esi, dword [eax + 8]
jbe 0x100e98c8
push ecx
push dword [eax]
mov dword [eax + 8], esi
call fcn.10132664
add esp, 8
mov dword [edi + 0xc], eax
test esi, esi
je 0x100e99ea
mov dword [ebp - 0x10], esi
push 0x64
call fcn.1011bae3
mov esi, eax
add esp, 4
test esi, esi
je 0x100e9942
lea ecx, [esi + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
xorps xmm0, xmm0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
movups xmmword [ecx + 0xc], xmm0
push 2
movq qword [ecx + 0x1c], xmm0
mov dword [ecx + 0x24], 0
push ecx
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
call fcn.1011b283
lea eax, [esi + 0x38]
push eax
call fcn.1011b585
add esp, 0xc
mov byte [esi + 0x60], 0
jmp 0x100e9944
xor esi, esi
push esi
lea ecx, [edi + 0xc]
call fcn.100e7650
push 8
call fcn.1011bae3
add esp, 4
test eax, eax
je 0x100e9964
xorps xmm0, xmm0
movq qword [eax], xmm0
jmp 0x100e9966
xor eax, eax
push eax
mov ecx, edi
call fcn.100e7650
sub dword [ebp - 0x10], 1
jne 0x100e98d3
xor esi, esi
nop word [eax + eax]
push 8
call fcn.1011bae3
add esp, 4
test eax, eax
je 0x100e9995
mov dword [eax], esi
mov dword [eax + 4], edi
jmp 0x100e9997
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x100e97c0
push 0
push 0
call fcn.10138294
mov edx, eax
add esp, 0x18
mov dword [ebp - 0x1c], edx
test edx, edx
je 0x100e99ff
mov ecx, dword [edi]
mov byte [ebp - 4], 1
mov ecx, dword [ecx + esi*4]
cmp dword [ecx + 4], 0
jne 0x100e9a0d
mov eax, dword [ebp - 0x18]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ecx], edx
mov dword [ecx + 4], eax
cmp dword [ebp - 0x18], 0
jne 0x100e9a0d
inc esi
cmp esi, dword [ebp + 8]
jb 0x100e9980
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [ebp - 0x18], 0
call fcn.1011b485
call fcn.101380fc
int3
Function at 0x100ec8f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 8]
test eax, eax
je 0x100eca59
push ebx
push ebp
shl eax, 3
push esi
push eax
call fcn.101288bb
mov esi, dword [esp + 0x38]
mov ecx, eax
mov eax, dword [edi + 8]
mov ebx, ecx
mov edi, dword [edi]
add esp, 4
mov dword [esp + 0x10], eax
movzx edx, word [esi + 4]
mov dword [esp + 0x28], ecx
movzx ecx, word [esi]
lea eax, [edi + eax*8]
mov dword [esp + 0x20], eax
mov eax, ecx
mov dword [esp + 0x24], eax
movsx ebp, ax
movzx eax, word [esi + 8]
sub ax, cx
mov ecx, dword [esp + 0x10]
cwde
dec eax
add eax, ebp
mov dword [esp + 0x1c], eax
movsx eax, dx
mov dword [esp + 0x14], eax
movzx eax, word [esi + 0xc]
sub ax, dx
mov edx, dword [esp + 0x14]
cwde
lea esi, [edx - 1]
add esi, eax
mov dword [esp + 0x18], esi
test ecx, ecx
je 0x100eca37
cmp edi, dword [esp + 0x20]
jae 0x100eca37
movzx eax, word [edi + 2]
cmp eax, esi
jg 0x100eca37
cmp eax, edx
jl 0x100eca2c
movzx esi, word [edi]
mov eax, esi
cmp eax, dword [esp + 0x1c]
jg 0x100eca28
movzx edx, word [edi + 4]
lea ecx, [edx + eax]
cmp ecx, ebp
jle 0x100eca20
cmp eax, ebp
jge 0x100ec9da
mov esi, dword [esp + 0x1c]
mov ecx, edx
sub esi, ebp
sub ecx, ebp
inc esi
add ecx, eax
cmp ecx, esi
jge 0x100ec9cf
mov ecx, dword [esp + 0x24]
sub eax, ebp
add eax, edx
mov word [ebx], cx
jmp 0x100ec9f0
mov ecx, dword [esp + 0x24]
mov eax, esi
mov word [ebx], cx
jmp 0x100ec9f0
mov ecx, dword [esp + 0x1c]
mov word [ebx], si
movzx eax, word [edi]
sub ecx, eax
movzx eax, word [edi + 4]
inc ecx
cmp eax, ecx
cmovge eax, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
movzx eax, ax
mov word [ebx + 4], ax
test ax, ax
je 0x100eca2c
mov ax, word [edi + 2]
mov word [ebx + 2], ax
mov al, byte [edi + 6]
mov byte [ebx + 6], al
add ebx, 8
dec ecx
mov dword [esp + 0x10], ecx
jmp 0x100eca2c
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add edi, 8
test ecx, ecx
jne 0x100ec975
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
sub ebx, edi
sar ebx, 3
push dword [esi]
call fcn.10128533
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi], edi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x1c
ret