joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038af0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10103275
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x10167080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1021e384], 0
jne 0x10038cc6
lea eax, [ebp - 0x50]
mov byte [0x1021e384], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x54], eax
test eax, eax
je 0x10038cc6
xor esi, esi
mov dword [ebp - 0x4c], esi
cmp dword [ebp - 0x50], esi
jle 0x10038cbf
nop dword [eax]
mov edx, dword [eax + esi*4]
xorps xmm0, xmm0
mov eax, edx
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
lea edi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10038b90
sub eax, edi
lea ecx, [ebp - 0x2c]
sar eax, 1
push eax
push edx
call fcn.1002b9d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
cmp edx, 7
mov ecx, dword [ebp - 0x2c]
cmova eax, ecx
seta byte [ebp - 0x45]
cmp word [eax], 0x2d
jne 0x10038c78
mov edi, dword [ebp - 0x1c]
xor edx, edx
lea esi, [edx + 1]
cmp byte [ebp - 0x45], dl
je 0x10038be5
mov eax, edi
sub eax, edx
cmp eax, esi
cmovb esi, eax
jmp 0x10038bee
cmp edi, 1
lea ecx, [ebp - 0x2c]
cmovb esi, edi
sub edi, esi
lea edx, [ecx + edx*2]
lea ecx, [edx + esi*2]
lea eax, [edi*2 + 2]
push eax
push ecx
push edx
call fcn.100dab50
add esp, 0xc
mov dword [ebp - 0x1c], edi
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.10069180
push eax
mov ecx, 0x1021e2f8
mov byte [ebp - 4], 1
call fcn.1002af20
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xf
jbe 0x10038c5d
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10038c53
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10038ce4
push ecx
push edx
call fcn.100d91c2
add esp, 8
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
cmp edx, 7
jbe 0x10038caf
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038ca5
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10038ce4
push edx
push ecx
call fcn.100d91c2
add esp, 8
mov eax, dword [ebp - 0x54]
inc esi
mov dword [ebp - 0x4c], esi
cmp esi, dword [ebp - 0x50]
jl 0x10038b70
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100d8e9a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100de11f
int3

Function at 0x100397d0
Capabilities:
Create process on windows

Disassembly:
add ecx, 8
cmp dword [ecx + 0x14], 0xf
jbe 0x100397db
mov ecx, dword [ecx]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x1003a510
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10167080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1021ac14], 0
push ebx
push esi
push edi
jne 0x1003a531
call fcn.1009d320
mov ebx, dword [0x1021abec]
lea eax, [ebp - 0x14]
push eax
push dword [0x1021e340]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x30]
mov ecx, edi
sub ecx, dword [0x1021e348]
mov esi, dword [ebp - 0x2c]
mov edx, esi
sbb edx, dword [0x1021e34c]
call fcn.100fb8a0
mov edx, dword [0x1021e354]
mov ecx, dword [0x1021e350]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.100fb8a0
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x1021e34c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1021e348], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov ecx, dword [0x1021abec]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
cmp byte [ecx + 0x37b], 0
lea esi, [ecx + 0xe4]
je 0x1003a645
cvttss2si eax, dword [esi]
mov dword [ebp - 0x1c], eax
cvttss2si eax, dword [ecx + 0xe8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x1021e340]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1003a6ad
mov ecx, dword [0x1021e340]
cmp eax, ecx
je 0x1003a672
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1003a6ad
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1003a6ad
lea eax, [ebp - 0x24]
push eax
push dword [0x1021e340]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1003a6ad
movd xmm0, dword [ebp - 0x24]
movd xmm1, dword [ebp - 0x20]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0xbc], 0
je 0x1003a6bb
or eax, 0xffffffff
jmp 0x1003a6c6
mov eax, dword [0x1021abec]
mov eax, dword [eax + 0x1c58]
cmp dword [0x1016800c], eax
je 0x1003a6d8
mov dword [0x1016800c], eax
call fcn.100af7a0
call fcn.1006ff30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d8e9a
mov esp, ebp
pop ebp
ret
Function at 0x1004a070
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101047f5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10167080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov edx, ebx
mov dword [ebp - 4], 0
call fcn.1001bb80
movzx eax, bl
xor eax, 0x811c9dc5
mov byte [ebp - 4], 1
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp - 0x2c], ebx
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.1004c410
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004a10e
mov eax, dword [esi + 4]
mov dword [edi + 0xf8], eax
cmp eax, dword [esi + 4]
je 0x1004a138
add eax, 0xc
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x1004a138
cmp dword [eax + 0x14], 0xf
mov ecx, dword [eax + 0x10]
jbe 0x1004a12e
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10008ad0
cmp dword [edi + 0x3c], 0xf
lea edx, [edi + 0x28]
mov eax, dword [edx + 0x10]
jbe 0x1004a146
mov edx, dword [edx]
push eax
lea ecx, [edi + 0x48]
call fcn.100355b0
add esp, 4
lea edx, [ebp + 0x10]
cmp dword [ebp + 0x24], 0xf
mov ecx, eax
cmova edx, dword [ebp + 0x10]
push dword [ebp + 0x20]
call fcn.100355b0
mov esi, eax
add esp, 4
mov ecx, dword [esi]
push 0
mov edx, dword [ecx + 4]
mov ecx, dword [edx + esi + 0x14]
and ecx, 0xfffffe7f
or ecx, 0x40
mov dword [edx + esi + 0x14], ecx
mov eax, dword [edi + 0x40]
sub eax, dword [ebp + 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.100d87f5
add esp, 0xc
mov edx, eax
mov ecx, esi
call fcn.1004b950
mov ecx, dword [0x1016f368]
mov ecx, dword [ecx + 4]
mov dl, byte [ecx + 0x1016f3a8]
mov byte [ecx + 0x1016f3a8], 0x20
mov ecx, eax
call fcn.1004b980
cmp dword [ebp - 0x14], 0xf
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmova edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.100355b0
add esp, 4
mov edx, 0x1013e1ac
mov ecx, eax
call fcn.1001b890
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x1004a211
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1004a207
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004a271
push ecx
push edx
call fcn.100d91c2
add esp, 8
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x1004a253
mov edx, dword [ebp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1004a249
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004a271
push ecx
push edx
call fcn.100d91c2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d8e9a
mov esp, ebp
pop ebp
ret 0x20
call fcn.100de11f
int3
Function at 0x1004a280
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp + 8], ebx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
mov esi, ecx
xor edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
shr ebx, 0x18
push edi
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x5c8]
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1004c410
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004a2eb
mov eax, dword [esi + 0x5cc]
mov dword [esi + 0xf8], eax
cmp eax, dword [esi + 0x5cc]
je 0x1004a33e
cmp dword [esi + 0x3c], 0xf
lea edx, [esi + 0x28]
mov eax, dword [edx + 0x10]
jbe 0x1004a307
mov edx, dword [edx]
push eax
lea ecx, [esi + 0x48]
call fcn.100355b0
mov edx, dword [esi + 0xf8]
add esp, 4
add edx, 0xc
cmp dword [edx + 0x14], 0xf
mov ecx, dword [edx + 0x10]
jbe 0x1004a327
mov edx, dword [edx]
push ecx
mov ecx, eax
call fcn.100355b0
add esp, 4
mov edx, 0x1013e1ac
mov ecx, eax
call fcn.1001b890
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c2a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1004c3fa
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10037f70
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1004c3cd
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x1004c353
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1004c3c3
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1004c38d
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x1004c385
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x1004c3c0
cmp edi, edx
je 0x1004c39d
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1004c3d6
cmp edi, edx
jne 0x1004c391
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x1004c302
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1004c3c0
push str.invalid_hash_bucket_count
call fcn.100d6fe6
int3
Function at 0x100558b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
imul ebx, ecx, 0xd50
push esi
push edi
xor esi, esi
mov edi, dword [ebx + 0x1020d484]
test edi, edi
jle 0x100558fd
lea edx, [ebx + 0x1020d4a4]
nop dword [eax + eax]
cvttss2si eax, dword [edx + 4]
lea edx, [edx + 0xd4]
cvttss2si ecx, dword [edx - 0xd8]
add ecx, eax
cvttss2si eax, dword [edx - 0xd4]
add ecx, eax
mov eax, esi
shl eax, 5
add esi, eax
xor esi, ecx
sub edi, 1
jne 0x100558d0
pop edi
mov dword [ebx + 0x1020d480], esi
pop esi
pop ebx
ret
Function at 0x100577c0
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x10167080]
xor eax, esp
mov dword [esp + 0x1a8], eax
cmp dword [0x10167dd4], 0xffffffff
push esi
jne 0x10057917
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, 0x4fd330
test eax, eax
je 0x1005780d
push str.1_LiveLink_:_7Socket_startup_failed__n
push 0
call esi
add esp, 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x10167dd4], eax
cmp eax, 0xffffffff
jne 0x1005782f
push str.1_LiveLink_:_7Socket_creation_failed__n
push 0
call esi
add esp, 8
mov eax, 2
xorps xmm0, xmm0
mov word [esp + 8], ax
mov eax, dword [0x1020d380]
movlpd qword [esp + 0x10], xmm0
movzx eax, word [eax + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push str.127.0.0.1
mov word [esp + 0xe], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0
mov dword [esp + 0x10], eax
push dword [esp + 0xe]
call dword [sym.imp.WS2_32.dll_ntohs]
push ecx
movzx eax, ax
push eax
push str.2_LiveLink_:_7Attempting_to_bind_on_port__d_...__n
call fcn.10069130
add esp, 0xc
mov esi, 0x4fca50
push eax
push 0
call esi
add esp, 0xc
lea eax, [esp + 8]
push 0x10
push eax
push dword [0x10167dd4]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x100578cf
push 0
push str.1_LiveLink_:_7Failed_to_bind_socket._Port_in_use____radiant_livePort_n
push 0
call esi
add esp, 0xc
call fcn.10057750
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.100d8e9a
mov esp, ebp
pop ebp
ret
push accept
push dword [0x10167dd4]
call dword [sym.imp.WS2_32.dll_listen]
push 0
cmp eax, 0xffffffff
jne 0x1005790b
push str.1_LiveLink_:_7Failed_to_listen_for_incoming_connections__n
push 0
call esi
add esp, 0xc
call fcn.10057750
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.100d8e9a
mov esp, ebp
pop ebp
ret
push str.2_LiveLink_:_7Succeeded__n
push 0
call esi
add esp, 0xc
mov ecx, dword [esp + 0x1ac]
pop esi
xor ecx, esp
call fcn.100d8e9a
mov esp, ebp
pop ebp
ret
Function at 0x10065410
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], edx
movss dword [ebp - 0xc], xmm3
movss dword [ebp - 0x10], xmm2
movss dword [ebp - 0x14], xmm1
mov dword [ebp - 8], ecx
pushal
push dword [ebp - 4]
mov eax, dword [ebp - 8]
sub esp, 0x20
fld dword [ebp + 0x18]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fld dword [ebp + 0x10]
fstp dword [esp + 0x14]
fld dword [ebp + 0xc]
fstp dword [esp + 0x10]
fld dword [ebp + 8]
fstp dword [esp + 0xc]
fld dword [ebp - 0xc]
fstp dword [esp + 8]
fld dword [ebp - 0x10]
fstp dword [esp + 4]
fld dword [ebp - 0x14]
fstp dword [esp]
call dword [0x101493b4]
add esp, 0x24
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10065480
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
pushal
push dword [0x101493b0]
push dword [0x101493a8]
mov eax, dword [ebp - 4]
call dword [0x101493ac]
add esp, 8
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100654f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
movss dword [ebp - 8], xmm3
movss dword [ebp - 0xc], xmm2
movss dword [ebp - 0x10], xmm1
mov dword [ebp - 4], ecx
pushal
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
sub esp, 0x20
fld dword [ebp + 0x18]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fld dword [ebp + 0x10]
fstp dword [esp + 0x14]
fld dword [ebp + 0xc]
fstp dword [esp + 0x10]
fld dword [ebp + 8]
fstp dword [esp + 0xc]
fld dword [ebp - 8]
fstp dword [esp + 8]
fld dword [ebp - 0xc]
fstp dword [esp + 4]
fld dword [ebp - 0x10]
fstp dword [esp]
call dword [0x1014939c]
add esp, 0x24
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10065660
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
pushal
push dword [ebp - 4]
mov esi, dword [ebp - 8]
call dword [0x10149370]
add esp, 4
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10065690
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
pushal
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
mov eax, dword [ebp - 8]
call dword [0x10149354]
add esp, 0x28
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10065910
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
pushal
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
call dword [0x10149348]
add esp, 0x24
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10065960
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
movss dword [ebp - 8], xmm3
movss dword [ebp - 0xc], xmm2
movss dword [ebp - 0x10], xmm1
mov dword [ebp - 4], ecx
pushal
mov esi, dword [ebp - 4]
sub esp, 0x10
fld dword [ebp + 8]
fstp dword [esp + 0xc]
fld dword [ebp - 8]
fstp dword [esp + 8]
fld dword [ebp - 0xc]
fstp dword [esp + 4]
fld dword [ebp - 0x10]
fstp dword [esp]
call dword [0x1014933c]
add esp, 0x10
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100659b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
pushal
mov eax, dword [ebp - 4]
push dword [ebp - 8]
call dword [0x10149338]
add esp, 4
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10065ee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101055ad
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10167080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10066019
lea eax, [ebp - 0x6c]
push eax
push 0x40
push 0xd536000
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x1021b090], 0
jne 0x10065f6a
mov byte [0x1021b090], 1
mov byte [0x1021b0a5], 1
mov dword [0x1021b094], 0x67493c
mov dword [0x1021b098], 0x10065ed0
mov eax, dword [0x67493d]
add eax, 0x674941
mov dword [0x1021b09c], eax
sub esp, 8
mov ecx, 0x1021b090
call fcn.10068a70
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push str.iw3xo_bin_reshade.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10065f9d
push 0x16
push str.iw3xo_bin_reshade.dll_n
mov ecx, 0x10167f38
call fcn.10003330
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], vtable.std::_Func_impl_no_alloc_class__void___cdecl_load_addon_libaries_void_::_2::_lambda_1___void___.0
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x1c], 0
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.10066120
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x1021b020
call fcn.100643c0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10065fff
mov edx, dword [ecx]
lea eax, [ebp - 0x40]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x10066074
mov edx, dword [ecx]
lea eax, [ebp - 0x68]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x10066074
test eax, eax
jne 0x10066074
push dword [0x1021b160]
push dword [0x1021b15c]
call fcn.100d73a0
mov edi, dword [0x1021b160]
add esp, 8
mov esi, dword [0x1021b15c]
cmp esi, edi
je 0x1006606a
mov ecx, dword [esi]
test ecx, ecx
je 0x1006604d
mov eax, dword [ecx]
push 1
call dword [eax]
add esi, 4
cmp esi, edi
jne 0x10066041
mov edi, dword [0x1021b160]
mov esi, dword [0x1021b15c]
cmp esi, edi
je 0x1006606a
mov dword [0x1021b160], esi
mov ecx, 0x1021ac18
call fcn.10003690
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d8e9a
mov esp, ebp
pop ebp
ret 0xc