joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074ac0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
mov dword [ebp - 4], eax
push esi
mov esi, ecx
movd xmm0, ebx
pshufd xmm1, xmm0, 0
push edi
cmp eax, 0xffff
jg 0x10074c52
cmp dword [ebp + 8], 0xffff
jg 0x10074c52
mov edx, dword [ebp + 0x10]
xor edi, edi
dec edx
test edx, edx
jle 0x10074bf0
cmp edx, 8
jb 0x10074bd0
movaps xmm2, xmmword [0x10162ae0]
mov eax, edx
and eax, 0x80000007
jns 0x10074b20
dec eax
or eax, 0xfffffff8
inc eax
movaps xmm4, xmmword [str._b_b_b_b]
mov ecx, edx
sub ecx, eax
mov eax, 3
mov dword [ebp - 8], ecx
lea ecx, [ebx + 0xc]
mov ebx, dword [ebp - 8]
movd xmm3, eax
nop dword [eax]
movd xmm0, edi
lea eax, [edi + 4]
pshufd xmm0, xmm0, 0
lea ecx, [ecx + 0x40]
paddd xmm0, xmm2
add edi, 8
pslld xmm0, xmm3
paddd xmm0, xmm1
paddd xmm0, xmm4
movd dword [ecx - 0x48], xmm0
psrldq xmm0, 4
movd dword [ecx - 0x40], xmm0
psrldq xmm0, 4
movd dword [ecx - 0x38], xmm0
psrldq xmm0, 4
movd dword [ecx - 0x30], xmm0
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
pslld xmm0, xmm3
paddd xmm0, xmm1
paddd xmm0, xmm4
movd dword [ecx - 0x28], xmm0
psrldq xmm0, 4
movd dword [ecx - 0x20], xmm0
psrldq xmm0, 4
movd dword [ecx - 0x18], xmm0
psrldq xmm0, 4
movd dword [ecx - 0x10], xmm0
cmp edi, ebx
jl 0x10074b40
mov ebx, dword [ebp + 0xc]
cmp edi, edx
jge 0x10074bed
lea eax, [edi*8 + 4]
sub edx, edi
add eax, ebx
add edi, edx
nop dword [eax]
lea ecx, [eax + 4]
mov dword [eax], ecx
lea eax, [eax + 8]
sub edx, 1
jne 0x10074be0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x20]
mov dword [ebx + edi*8 + 4], 0
mov dword [esi], eax
dec eax
mov dword [esi + 0x1c], ebx
mov ebx, dword [ebp + 0x10]
add eax, ebx
mov dword [esi + 4], edx
cdq
idiv ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov word [ecx], ax
mov ecx, dword [ebp - 4]
mov word [esi + 0x22], ax
lea eax, [esi + 0x28]
mov dword [esi + 0x24], eax
mov word [eax], cx
mov eax, 0xffff
pop edi
mov word [esi + 0x2a], ax
mov dword [esi + 0x2c], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10074c60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx edi, word [edx]
add eax, ecx
mov dword [ebp - 0x10], eax
cmp edi, ecx
jg 0x10074d4e
mov eax, dword [edx + 4]
movzx eax, word [eax]
cmp eax, ecx
jle 0x10074d4e
xor ebx, ebx
xor eax, eax
xor esi, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
cmp edi, dword [ebp - 0x10]
jge 0x10074d40
movzx eax, word [edx + 2]
lea edi, [edx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
cmp eax, ebx
jle 0x10074cf4
mov edi, eax
sub edi, ebx
mov ebx, eax
movzx eax, word [edx]
mov edx, dword [ebp - 0x14]
imul edi, esi
cmp eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edx, dword [edx]
movzx ecx, word [edx]
mov eax, ecx
jge 0x10074ce5
sub eax, dword [ebp + 8]
add esi, eax
mov eax, ecx
mov dword [ebp - 4], esi
movzx ecx, ax
jmp 0x10074d29
sub eax, dword [ebp - 4]
add esi, eax
mov eax, ecx
mov dword [ebp - 4], esi
movzx ecx, ax
jmp 0x10074d29
mov edi, dword [edi]
movzx eax, word [edx]
mov edx, dword [ebp - 4]
movzx ebx, word [edi]
mov ecx, ebx
sub ecx, eax
lea eax, [ecx + esi]
mov esi, dword [ebp + 0xc]
sub esi, edx
cmp eax, dword [ebp + 0xc]
cmovle esi, ecx
mov ecx, ebx
mov ebx, dword [ebp - 8]
add edx, esi
mov dword [ebp - 4], edx
mov edx, edi
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 0x18]
imul edi, esi
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
movzx ecx, cx
add eax, edi
cmp ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jl 0x10074ca5
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100751f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov ebx, dword [esi + 4]
mov edi, dword [esi + 8]
cmp ebx, edi
jl 0x1007520d
xor edx, edx
mov ecx, ebx
xor al, al
jmp 0x1007522c
mov eax, dword [esi]
lea ecx, [ebx + 1]
mov al, byte [ebx + eax]
mov dword [esi + 4], ecx
movzx edx, al
cmp ecx, edi
jl 0x10075223
xor al, al
jmp 0x1007522c
mov eax, dword [esi]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 4], ecx
shl edx, 8
movzx eax, al
or edx, eax
je 0x10075283
cmp ecx, edi
jl 0x1007523e
xor al, al
jmp 0x10075247
mov eax, dword [esi]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 4], ecx
movzx eax, al
mov dword [ebp - 4], eax
dec eax
cmp eax, 3
ja 0x100752cc
mov eax, dword [ebp - 4]
imul edx, eax
add edx, ecx
cmp edx, edi
jg 0x100752cc
test edx, edx
js 0x100752cc
mov dword [esi + 4], edx
mov ecx, esi
mov edx, eax
call fcn.100751a0
mov ecx, dword [esi + 4]
dec eax
mov edi, dword [esi + 8]
add ecx, eax
cmp ecx, edi
jg 0x100752cc
test ecx, ecx
js 0x100752cc
mov dword [esi + 4], ecx
xor edx, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], edx
sub ecx, ebx
movq xmm0, qword [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
test ebx, ebx
js 0x100752bb
test ecx, ecx
js 0x100752bb
cmp ebx, edi
jg 0x100752bb
sub edi, ebx
cmp ecx, edi
jg 0x100752bb
mov eax, dword [esi]
mov edx, ecx
add eax, ebx
mov dword [ebp - 0x10], eax
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100752e0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
mov edx, dword [esi + 4]
cmp edx, edi
jl 0x100752f2
xor al, al
jmp 0x100752fb
mov eax, dword [esi]
mov al, byte [edx + eax]
inc edx
mov dword [esi + 4], edx
movzx ecx, al
lea eax, [ecx - 0x20]
cmp eax, 0xd6
ja 0x10075311
pop edi
lea eax, [ecx - 0x8b]
pop esi
ret
lea eax, [ecx - 0xf7]
push ebx
cmp eax, 3
ja 0x10075350
cmp edx, edi
jl 0x10075334
xor bl, bl
shl ecx, 8
movzx eax, bl
pop ebx
add eax, 0xffff096c
pop edi
add eax, ecx
pop esi
ret
mov eax, dword [esi]
shl ecx, 8
mov bl, byte [edx + eax]
lea eax, [edx + 1]
mov dword [esi + 4], eax
movzx eax, bl
pop ebx
add eax, 0xffff096c
pop edi
add eax, ecx
pop esi
ret
lea eax, [ecx - 0xfb]
cmp eax, 3
ja 0x10075392
cmp edx, edi
jl 0x10075374
shl ecx, 8
xor bl, bl
mov eax, 0xfa94
sub eax, ecx
movzx ecx, bl
pop ebx
pop edi
sub eax, ecx
pop esi
ret
mov eax, dword [esi]
shl ecx, 8
mov bl, byte [edx + eax]
lea eax, [edx + 1]
mov dword [esi + 4], eax
mov eax, 0xfa94
sub eax, ecx
movzx ecx, bl
pop ebx
pop edi
sub eax, ecx
pop esi
ret
cmp ecx, 0x1c
jne 0x100753cf
cmp edx, edi
jl 0x100753ab
xor edx, edx
xor al, al
pop ebx
shl edx, 8
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
lea ecx, [edx + 1]
mov al, byte [edx + eax]
mov dword [esi + 4], ecx
movzx edx, al
cmp ecx, edi
jl 0x10075465
xor al, al
shl edx, 8
pop ebx
movzx eax, al
pop edi
or eax, edx
pop esi
ret
cmp ecx, 0x1d
jne 0x1007547a
cmp edx, edi
jl 0x100753f2
xor edx, edx
xor al, al
shl edx, 8
shl edx, 8
pop ebx
shl edx, 8
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
lea ecx, [edx + 1]
mov al, byte [edx + eax]
mov dword [esi + 4], ecx
movzx edx, al
cmp ecx, edi
jl 0x10075418
shl edx, 8
xor al, al
shl edx, 8
pop ebx
shl edx, 8
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
shl edx, 8
mov al, byte [ecx + eax]
inc ecx
movzx eax, al
or edx, eax
mov dword [esi + 4], ecx
mov ebx, edx
cmp ecx, edi
jl 0x10075440
shl edx, 8
xor al, al
pop ebx
shl edx, 8
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
mov edx, ebx
shl edx, 8
mov al, byte [ecx + eax]
inc ecx
movzx eax, al
or edx, eax
mov dword [esi + 4], ecx
cmp ecx, edi
jl 0x10075465
xor al, al
shl edx, 8
pop ebx
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
pop ebx
shl edx, 8
pop edi
mov al, byte [ecx + eax]
inc ecx
movzx eax, al
mov dword [esi + 4], ecx
or eax, edx
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10075490
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [esi + 8]
test edi, edi
js 0x10075608
mov dword [esi + 4], 0
jle 0x10075584
xor ebx, ebx
mov ecx, esi
call fcn.10075180
cmp al, 0x1c
jb 0x10075539
mov ecx, dword [esi + 4]
mov edi, dword [esi + 8]
cmp ecx, edi
jge 0x10075608
mov eax, dword [esi]
mov al, byte [ecx + eax]
cmp al, 0x1c
jb 0x10075608
cmp al, 0x1e
jne 0x10075527
lea eax, [ecx + 1]
cmp eax, edi
jg 0x10075608
test eax, eax
js 0x10075608
mov dword [esi + 4], eax
cmp eax, edi
jge 0x1007552e
nop dword [eax]
mov ecx, dword [esi]
mov cl, byte [eax + ecx]
inc eax
movzx edx, cl
mov ecx, edx
mov dword [esi + 4], eax
and ecx, 0xf
cmp cl, 0xf
je 0x1007552e
and edx, 0xfffffff0
cmp edx, 0xf0
je 0x1007552e
cmp eax, edi
jl 0x10075500
jmp 0x1007552e
mov ecx, esi
call fcn.100752e0
mov ecx, esi
call fcn.10075180
cmp al, 0x1c
jae 0x100754c3
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
cmp edx, edi
jl 0x10075549
xor al, al
mov ecx, edx
jmp 0x10075554
mov eax, dword [esi]
lea ecx, [edx + 1]
mov al, byte [edx + eax]
mov dword [esi + 4], ecx
movzx eax, al
cmp eax, 0xc
jne 0x10075575
cmp ecx, edi
jl 0x10075564
xor al, al
jmp 0x1007556d
mov eax, dword [esi]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 4], ecx
movzx eax, al
or eax, 0x100
cmp eax, dword [ebp - 4]
je 0x100755bf
mov ebx, ecx
cmp ecx, edi
jl 0x100754b8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
movq xmm0, qword [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
test edi, edi
js 0x100755aa
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ecx
sub edx, ebx
movq xmm0, qword [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
test ebx, ebx
js 0x100755f7
test edx, edx
js 0x100755f7
cmp ebx, edi
jg 0x100755f7
sub edi, ebx
cmp edx, edi
jg 0x100755f7
mov eax, dword [esi]
mov ecx, edx
add eax, ebx
mov dword [ebp - 0x10], eax
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], ecx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10075620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x10075734
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push edi
test esi, esi
jg 0x10075645
mov byte [ebp - 1], dl
lea eax, [edx + 1]
jmp 0x10075652
mov al, byte [ebx]
mov edx, 1
mov byte [ebp - 1], al
lea eax, [edx + 1]
movzx edi, byte [ebp - 1]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], edx
cmp edx, esi
jl 0x1007566a
xor al, al
jmp 0x1007567b
mov dl, byte [ebx + edx]
mov byte [ebp - 1], dl
mov edx, eax
mov al, byte [ebp - 1]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
shl edi, 8
movzx eax, al
or edi, eax
cmp dword [ebp - 8], esi
jl 0x1007568c
xor al, al
jmp 0x10075693
mov al, byte [ebx + edx]
mov edx, dword [ebp - 0xc]
inc edx
movzx ebx, al
test ecx, ecx
js 0x10075734
cmp ecx, edi
jge 0x10075734
lea eax, [ebx - 1]
cmp eax, 3
ja 0x10075734
mov eax, ebx
imul eax, ecx
add eax, edx
cmp eax, esi
jg 0x10075734
test eax, eax
js 0x10075734
mov edx, ebx
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0xc]
call fcn.100751a0
mov edx, ebx
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.100751a0
lea ecx, [edi + 1]
mov dword [ebp - 0x1c], 0
imul ecx, ebx
mov edx, eax
sub edx, esi
add esi, 2
pop edi
pop ebx
add ecx, esi
xor esi, esi
mov dword [ebp - 0x18], esi
movq xmm0, qword [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
test ecx, ecx
js 0x10075725
test edx, edx
js 0x10075725
mov eax, dword [ebp + 0x14]
cmp ecx, eax
jg 0x10075725
sub eax, ecx
cmp edx, eax
jg 0x10075725
mov eax, dword [ebp + 0xc]
mov esi, edx
add eax, ecx
mov dword [ebp - 0x1c], eax
movq xmm0, qword [ebp - 0x1c]
mov eax, dword [ebp + 8]
movq qword [eax], xmm0
mov dword [eax + 8], esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100757e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push edi
push eax
mov edx, 0x12
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 0x18]
mov dword [ebp - 8], 0
call fcn.10075490
add esp, 4
xor esi, esi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
jge 0x1007583e
lea ecx, [ebp - 0x18]
call fcn.100752e0
mov dword [ebp + esi*4 - 0xc], eax
inc esi
cmp esi, 2
jge 0x1007583e
mov eax, dword [ebp - 0x10]
jmp 0x10075822
mov edi, dword [ebp - 8]
test edi, edi
je 0x10075941
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x10075941
xor edx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edx
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x18], xmm0
push ebx
mov ebx, dword [ebp + 0x14]
test edi, edi
js 0x10075891
test ecx, ecx
js 0x10075891
cmp edi, ebx
jg 0x10075891
mov eax, ebx
sub eax, edi
cmp ecx, eax
jg 0x10075891
mov eax, dword [ebp + 0xc]
mov edx, ecx
add eax, edi
mov dword [ebp - 0x18], eax
movq xmm0, qword [ebp - 0x18]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], edx
push eax
mov edx, 0x13
movq qword [ebp - 0x18], xmm0
lea ecx, [ebp - 0x18]
call fcn.10075490
add esp, 4
xor esi, esi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
nop
cmp dword [ebp - 0x14], eax
jge 0x100758dc
lea ecx, [ebp - 0x18]
call fcn.100752e0
mov dword [ebp + esi*4 - 4], eax
inc esi
cmp esi, 1
jge 0x100758dc
mov eax, dword [ebp - 0x10]
jmp 0x100758c0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10075903
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
movq xmm0, qword [ebp - 0x18]
pop ebx
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
add eax, edi
cmp eax, ebx
jg 0x10075939
test eax, eax
js 0x10075939
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.100751f0
mov edx, dword [ebp + 8]
add esp, 4
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop ebx
pop edi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movq xmm0, qword [ebp - 0x18]
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10076210
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, edx
mov edx, ecx
cmp dword [edx + 0x3c], 0
je 0x10076224
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp edi, dword [edx + 0xc]
jge 0x100762cf
mov esi, dword [edx + 0x30]
cmp esi, 2
jge 0x100762cf
push ebx
mov ebx, dword [edx + 0x10]
add ebx, dword [edx + 4]
mov edx, dword [edx + 0x18]
test esi, esi
jne 0x10076278
movzx ecx, byte [ebx + edi*2]
movzx eax, byte [ebx + edi*2 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + edi*2 + 3]
lea esi, [edx + ecx*2]
movzx ecx, byte [ebx + edi*2 + 2]
shl ecx, 8
add ecx, eax
pop ebx
pop edi
lea eax, [edx + ecx*2]
or ecx, 0xffffffff
cmp esi, eax
cmove esi, ecx
mov eax, esi
pop esi
ret
movzx ecx, byte [ebx + edi*4]
movzx eax, byte [ebx + edi*4 + 1]
movzx esi, byte [ebx + edi*4 + 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + edi*4 + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + edi*4 + 5]
shl ecx, 8
add ecx, edx
add esi, ecx
movzx ecx, byte [ebx + edi*4 + 4]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + edi*4 + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + edi*4 + 7]
shl ecx, 8
add ecx, edx
add eax, ecx
or ecx, 0xffffffff
cmp esi, eax
pop ebx
cmove esi, ecx
pop edi
mov eax, esi
pop esi
ret
pop edi
or eax, 0xffffffff
pop esi
ret
Function at 0x10076e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0xffffffff
push esi
mov eax, edx
mov dword [ebp - 4], ebx
push edi
movq xmm0, qword [ebx + 0x70]
mov esi, dword [ebx + 0x78]
mov dword [ebp - 0x14], eax
movq qword [ebp - 0x24], xmm0
test esi, esi
js 0x10076fab
mov edi, dword [ebp - 0x24]
xor edx, edx
test esi, esi
jle 0x10076f82
mov cl, byte [edi]
mov edx, 1
test cl, cl
je 0x10076f82
cmp cl, 3
jne 0x10076f0d
cmp edx, esi
jl 0x10076e6c
xor al, al
jmp 0x10076e74
mov al, byte [edi + edx]
mov edx, 2
movzx ecx, al
cmp edx, esi
jl 0x10076e7f
xor al, al
jmp 0x10076e83
mov al, byte [edi + edx]
inc edx
shl ecx, 8
movzx eax, al
or ecx, eax
mov dword [ebp - 0x10], ecx
cmp edx, esi
jl 0x10076e96
xor al, al
jmp 0x10076e9a
mov al, byte [edi + edx]
inc edx
movzx ecx, al
cmp edx, esi
jl 0x10076ea5
xor al, al
jmp 0x10076ea9
mov al, byte [edi + edx]
inc edx
shl ecx, 8
xor ebx, ebx
movzx eax, al
or ecx, eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x10], ebx
jbe 0x10076f0a
nop dword [eax + eax]
cmp edx, esi
jl 0x10076ec8
xor al, al
jmp 0x10076ecc
mov al, byte [edi + edx]
inc edx
movzx eax, al
mov dword [ebp - 0x18], eax
cmp edx, esi
jl 0x10076eda
xor al, al
jmp 0x10076ede
mov al, byte [edi + edx]
inc edx
movzx eax, al
cmp edx, esi
jl 0x10076ee9
xor cl, cl
jmp 0x10076eed
mov cl, byte [edi + edx]
inc edx
shl eax, 8
movzx ecx, cl
or eax, ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0xc]
jl 0x10076f01
cmp ecx, eax
jl 0x10076f7a
inc ebx
mov dword [ebp - 0xc], eax
cmp ebx, dword [ebp - 0x10]
jl 0x10076ec0
mov ebx, dword [ebp - 4]
movq xmm0, qword [ebx + 0x64]
sub esp, 0xc
mov eax, dword [ebx + 0x6c]
mov edx, esp
mov ecx, dword [ebp - 8]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [ebp - 0x24]
push eax
call fcn.10075620
add esp, 4
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [ebx + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [ebx + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x30]
push eax
call fcn.100757e0
mov edx, dword [ebp + 8]
add esp, 0x1c
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
jmp 0x10076f0a
add eax, edx
cmp eax, esi
jg 0x10076fab
test eax, eax
js 0x10076fab
cmp eax, esi
jl 0x10076f9d
xor al, al
movzx eax, al
mov dword [ebp - 8], eax
jmp 0x10076f0d
mov al, byte [edi + eax]
movzx eax, al
mov dword [ebp - 8], eax
jmp 0x10076f0d
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10078460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x3c], 0
jne 0x10078488
push dword [ebp + 8]
call fcn.100763b0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [esp + 0x10], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x3c], 0
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
movups xmmword [esp + 0x4c], xmm0
mov dword [esp + 0x70], 0
movups xmmword [esp + 0x5c], xmm0
call fcn.10076fc0
mov ebx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x10078542
mov eax, dword [esp + 0x3c]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [0x101e0c0c]
add ecx, ecx
test eax, eax
je 0x10078509
inc dword [eax + 0x36c]
push dword [0x101e0c08]
push ecx
call fcn.10062c40
mov dword [ebx], eax
mov edx, edi
mov dword [esp + 0x70], eax
mov ecx, esi
lea eax, [esp + 0x48]
push eax
call fcn.10076fc0
add esp, 0xc
test eax, eax
je 0x10078542
mov eax, dword [esp + 0x6c]
cmp eax, dword [esp + 0x3c]
je 0x1007854a
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007b950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
mov dword [ebp - 0x20], 0
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x1007b983
mov eax, dword [esi + 0x44]
shl ecx, 4
add eax, 0xfffffff0
add eax, ecx
jmp 0x1007b989
mov eax, dword [esi + 0x28]
add eax, 0x14
movups xmm0, xmmword [eax]
mov ecx, dword [esi + 0x48]
movups xmmword [ebp - 0x1c], xmm0
test ecx, ecx
je 0x1007b9a3
mov eax, dword [esi + 0x50]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 0xc], eax
jmp 0x1007b9aa
mov dword [ebp - 0xc], 0
movss xmm0, dword [ebp - 0x14]
comiss xmm0, dword [ebp - 0x1c]
jb 0x1007ba0c
movss xmm0, dword [ebp - 0x10]
comiss xmm0, dword [ebp - 0x18]
jb 0x1007ba0c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x1007b9ef
lea edi, [eax + 1]
test ecx, ecx
je 0x1007b9db
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1007b9e0
mov eax, 8
cmp eax, edi
mov ecx, esi
cmovg edi, eax
push edi
call fcn.10082380
mov eax, dword [esi]
movups xmm0, xmmword [ebp - 0x20]
shl eax, 5
add eax, dword [esi + 8]
pop edi
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x10]
movups xmmword [eax + 0x10], xmm0
inc dword [esi]
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1007bb10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, ecx
push ebx
push esi
push edi
mov edi, dword [edx + 0x48]
test edi, edi
je 0x1007bb2b
mov eax, dword [edx + 0x50]
mov edi, dword [eax + edi*4 - 4]
jmp 0x1007bb2d
xor edi, edi
mov esi, dword [edx]
mov dword [ebp - 4], edi
test esi, esi
je 0x1007bbdc
jle 0x1007bbd4
mov ebx, dword [edx + 8]
mov ecx, esi
shl ecx, 5
add ebx, 0xffffffe0
add ebx, ecx
je 0x1007bbdc
mov eax, dword [ebx]
test eax, eax
je 0x1007bb5e
cmp dword [ebx + 0x14], edi
jne 0x1007bbdc
cmp dword [ebx + 0x18], 0
jne 0x1007bbdc
xor ecx, ecx
lea edi, [ebx - 0x20]
cmp esi, 1
cmovle edi, ecx
mov dword [ebp - 8], edi
test eax, eax
jne 0x1007bbc7
test edi, edi
je 0x1007bbc7
mov eax, dword [ebp - 4]
cmp dword [edi + 0x14], eax
jne 0x1007bbc7
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x1007bb96
mov eax, dword [edx + 0x44]
shl ecx, 4
add eax, 0xfffffff0
add ecx, eax
jmp 0x1007bb9c
mov ecx, dword [edx + 0x28]
add ecx, 0x14
lea esi, [edi + 4]
mov edi, 0xc
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x1007bbc7
add esi, 4
add ecx, 4
sub edi, 4
jae 0x1007bba4
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x1007bbc7
dec dword [edx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov dword [ebx + 0x14], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, edx
call fcn.1007b950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007bf80
Capabilities:
Terminate process

Disassembly:
mov edx, ecx
cmp dword [edx + 0x64], 0
jg 0x1007bf90
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [edx + 0x60]
test eax, eax
je 0x1007bffd
movq xmm0, qword [edx]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x70]
movq qword [eax + ecx*8], xmm0
lea ecx, [eax + ecx*8]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0x60]
movq xmm0, qword [edx + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x70]
movq qword [eax + ecx*8 + 0xc], xmm0
lea ecx, [eax + ecx*8]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
mov ecx, dword [edx + 0x70]
mov dword [edx + 0x60], 0
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
movq xmm0, qword [ecx + 0xc]
movq qword [edx + 0xc], xmm0
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x14], eax
mov ecx, dword [edx + 0xc]
lea eax, [eax + ecx*2]
mov dword [edx + 0x38], eax
ret 4