joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
mov esi, ecx
movaps xmm3, xmm2
mov ecx, dword [0x1017bfd8]
push edi
mov edi, edx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + 0x19e4]
test edi, edi
jne 0x10042e82
mov edx, esi
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x10042e70
mov eax, dword [ecx + 0x19e4]
sub edx, edi
lea edi, [edx + esi]
cmp esi, edi
je 0x10042fc5
movss xmm0, dword [ebp + 0xc]
xorps xmm1, xmm1
addss xmm0, dword [0x101450e0]
movss dword [ebp + 0xc], xmm0
movss xmm0, dword [ecx + 0x1500]
comiss xmm1, xmm0
mov edx, dword [eax + 0x274]
ja 0x10042fae
minss xmm0, dword [0x10145040]
movss xmm2, dword [ecx + 0x1900]
mov dword [esp + 0x14], edi
mulss xmm0, dword [0x10145264]
addss xmm0, dword [0x10144fec]
cvttss2si eax, xmm0
shl eax, 0x18
mov esi, eax
or esi, 0xb4b4b4
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x18fc]
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x10]
test eax, eax
je 0x10042fae
test edi, edi
jne 0x10042f2a
mov ecx, esi
lea eax, [ecx + 1]
mov dword [esp + 0x14], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10042f10
sub ecx, dword [esp + 0x14]
lea eax, [ecx + esi]
mov dword [esp + 0x14], eax
cmp esi, eax
je 0x10042faa
cmp dword [esp + 0xc], 0
jne 0x10042f3b
mov eax, dword [edx + 0x28]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], eax
ucomiss xmm2, xmm1
lahf
test ah, 0x44
jp 0x10042f4c
mov eax, dword [edx + 0x28]
movss xmm2, dword [eax + 0xc]
mov eax, dword [edx + 0x48]
test eax, eax
jle 0x10042fcb
mov eax, dword [esp + 0xc]
mov esi, dword [edx + 0x48]
mov ecx, dword [edx + 0x50]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 8]
cmp eax, dword [ecx + esi*4 - 4]
mov esi, dword [esp + 0x10]
jne 0x10042fcb
mov ecx, dword [edx + 0x3c]
test ecx, ecx
jle 0x10042fcb
mov eax, dword [edx + 0x44]
push 0
shl ecx, 4
push ecx
movss dword [esp], xmm3
push dword [esp + 0x1c]
movups xmm0, xmmword [ecx + eax - 0x10]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x2c]
push esi
push eax
push dword [esp + 0x30]
movups xmmword [esp + 0x38], xmm0
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call fcn.10060040
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 0x2cbc], 0
je 0x10042fc5
push edi
mov edx, esi
lea ecx, [ebp + 8]
call fcn.10052690
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100448e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x1c0]
test edx, edx
jg 0x100448f5
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ecx + 0x1c8]
mov ecx, dword [ebp + 8]
push dword [eax + edx*4 - 4]
xor edx, edx
call fcn.100421e0
mov ecx, dword [0x1017bfd8]
add esp, 4
cmp dword [ecx + 0x1a04], eax
jne 0x10044920
mov dword [ecx + 0x1a0c], eax
cmp dword [ecx + 0x1a08], eax
jne 0x1004492f
mov byte [ecx + 0x1a18], 1
pop ebp
ret 8

Function at 0x10044940
Capabilities:
Encode data using xor
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x1c0]
test edx, edx
jg 0x10044955
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ecx + 0x1c8]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1013a068]
sub edi, 1
jne 0x10044970
mov ecx, dword [0x1017bfd8]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a04], eax
jne 0x100449a2
mov dword [ecx + 0x1a0c], eax
cmp dword [ecx + 0x1a08], eax
jne 0x100449b1
mov byte [ecx + 0x1a18], 1
pop ebp
ret 4

Function at 0x100449c0
Capabilities:
Encode data using xor
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10150380]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
push esi
mov esi, dword [edx + 0x1c0]
test esi, esi
jg 0x100449e5
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp + 8]
push edi
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [edx + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [edx + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x1c8]
mov edx, dword [eax + esi*4 - 4]
lea esi, [ebp - 0x14]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1013a068]
sub edi, 1
jne 0x10044a40
mov eax, dword [0x1017bfd8]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a04], edx
jne 0x10044a71
mov dword [eax + 0x1a0c], edx
cmp dword [eax + 0x1a08], edx
jne 0x10044a80
mov byte [eax + 0x1a18], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.1010fe2d
mov esp, ebp
pop ebp
ret 4
Function at 0x10044aa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x1017bfd8]
mov eax, dword [esi + 0x1af4]
test eax, eax
je 0x10044af3
test edx, edx
je 0x10044abd
cmp edx, 1
jne 0x10044af3
mov dword [esi + 0x1af8], ecx
mov dword [eax + edx*4 + 0x300], ecx
add edx, edx
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x1af4]
movups xmm0, xmmword [eax]
movups xmmword [ecx + edx*8 + 0x308], xmm0
mov word [esi + 0x1b55], 1
mov byte [esi + 0x1b57], 1
pop esi
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10044bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1017bfd8]
sub esp, 0x10
push esi
test ecx, ecx
jne 0x10044bc7
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [edx + 0x134]
cmp dword [eax + 0x1af4], edx
je 0x10044bdc
mov byte [eax + 0x1b59], 0
mov dword [eax + 0x1af8], ecx
mov dword [eax + 0x1af4], edx
mov dword [eax + 0x1b4c], esi
mov dword [edx + esi*4 + 0x300], ecx
cmp dword [edx + 0x10c], ecx
jne 0x10044c53
movss xmm0, dword [edx + 0x118]
add esi, esi
movss xmm4, dword [edx + 0x11c]
movss xmm3, dword [edx + 0x120]
movss xmm1, dword [edx + 0x114]
subss xmm0, dword [edx + 0x10]
subss xmm4, dword [edx + 0xc]
subss xmm3, dword [edx + 0x10]
subss xmm1, dword [edx + 0xc]
movss dword [ebp - 0xc], xmm0
movss dword [ebp - 8], xmm4
movss dword [ebp - 4], xmm3
movss dword [ebp - 0x10], xmm1
movups xmm0, xmmword [ebp - 0x10]
movups xmmword [edx + esi*8 + 0x308], xmm0
cmp dword [eax + 0x1a34], 2
jne 0x10044c68
mov byte [eax + 0x1b57], 1
pop esi
mov esp, ebp
pop ebp
ret
mov byte [eax + 0x1b56], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10045190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [0x1017bfd8]
mov edx, dword [esi + 0x168]
inc dword [esi + 0x328]
and edx, 5
jne 0x100451b7
inc dword [esi + 0x32c]
cmp byte [ebp + 8], 0
je 0x100452b5
cmp dword [edi + 0x1a04], ebx
jne 0x100452b5
cmp dword [esi + 0x338], 0x7fffffff
jne 0x100452b5
cmp dword [esi + 0x33c], 0x7fffffff
jne 0x100452b5
cmp byte [edi + 0xf8], 0
jne 0x100452b5
mov eax, dword [edi + 0x34]
test eax, eax
js 0x100452b5
cmp eax, 0x200
jge 0x100452e2
movss xmm2, dword [edi + eax*4 + 0x448]
xorps xmm0, xmm0
ucomiss xmm2, xmm0
lahf
test ah, 0x44
jp 0x10045229
mov al, 1
jmp 0x1004528a
movss xmm3, dword [edi + 0x88]
comiss xmm2, xmm3
jbe 0x10045288
movss xmm4, dword [edi + 0x8c]
comiss xmm0, xmm4
jae 0x1004527f
movss xmm1, dword [0x10145040]
movaps xmm0, xmm2
subss xmm0, dword [edi + 0x18]
divss xmm1, xmm4
subss xmm0, xmm3
subss xmm2, xmm3
mulss xmm0, xmm1
mulss xmm2, xmm1
cvttss2si eax, xmm0
cvttss2si ecx, xmm2
sub ecx, eax
xor eax, eax
test ecx, ecx
cmovg eax, ecx
test eax, eax
setg al
jmp 0x1004528a
xor eax, eax
test eax, eax
setg al
jmp 0x1004528a
xor al, al
test al, al
je 0x100452b5
cmp byte [edi + 0xf9], 0
je 0x100452a2
mov ecx, edx
neg ecx
sbb ecx, ecx
neg ecx
dec ecx
jmp 0x100452a7
mov ecx, 1
mov eax, dword [esi + 0x32c]
add eax, ecx
mov dword [esi + 0x33c], eax
mov eax, dword [esi + 0x328]
cmp eax, dword [esi + 0x330]
je 0x100452db
test edx, edx
jne 0x100452ea
mov eax, dword [esi + 0x32c]
cmp eax, dword [esi + 0x334]
jne 0x100452ea
mov dword [edi + 0x1b0c], ebx
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x10045300
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movss xmm4, dword [ebp + 0xc]
movaps xmm6, xmm1
movss xmm1, dword [ebp + 8]
xorps xmm5, xmm5
comiss xmm5, xmm1
push ebx
push esi
mov ebx, ecx
push edi
movaps xmm7, xmm2
xorps xmm3, xmm3
xorps xmm2, xmm2
ja 0x10045336
comiss xmm5, xmm4
ja 0x10045336
mov ecx, dword [0x1017bfd8]
jmp 0x100453b9
mov ecx, dword [0x1017bfd8]
mov edi, dword [ecx + 0x19e4]
movss xmm3, dword [edi + 0x218]
mov esi, dword [edi + 0x1bc]
movss xmm2, dword [edi + 0x214]
subss xmm3, dword [edi + 0x10]
subss xmm2, dword [edi + 0xc]
test esi, esi
je 0x100453a9
mov edx, dword [esi + 0xc]
lea eax, [edx + 1]
test eax, eax
cmovns edx, eax
cmp edx, dword [esi + 0x2c]
jl 0x1004537e
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movss xmm2, dword [esi + 0x18]
lea ecx, [edx*8]
subss xmm2, dword [esi + 0x14]
mov eax, dword [esi + 0x34]
sub ecx, edx
mulss xmm2, dword [eax + ecx*4]
mov ecx, dword [0x1017bfd8]
addss xmm2, dword [esi + 0x14]
subss xmm2, dword [edi + 0x3c]
mov eax, dword [ecx + 0x19e4]
addss xmm2, dword [eax + 0xc]
addss xmm3, dword [eax + 0x10]
comiss xmm5, xmm1
movss xmm0, dword [0x101450fc]
jb 0x100453ef
ucomiss xmm1, xmm5
lahf
test ah, 0x44
jp 0x100453d4
movaps xmm1, xmm6
jmp 0x100453ea
mov eax, dword [ecx + 0x19e4]
subss xmm2, dword [eax + 0xc8]
maxss xmm2, xmm0
addss xmm1, xmm2
movss dword [ebp + 8], xmm1
comiss xmm5, xmm4
jb 0x10045426
ucomiss xmm4, xmm5
lahf
test ah, 0x44
jp 0x10045410
movaps xmm4, xmm7
movss dword [ebx], xmm1
movss dword [ebx + 4], xmm4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ecx + 0x19e4]
subss xmm3, dword [eax + 0xcc]
maxss xmm3, xmm0
addss xmm4, xmm3
pop edi
pop esi
movss dword [ebx], xmm1
mov eax, ebx
movss dword [ebx + 4], xmm4
pop ebx
pop ebp
ret

Function at 0x10045440
Capabilities:
Terminate process

Disassembly:
push ebx
xorps xmm0, xmm0
mov ebx, ecx
comiss xmm0, xmm1
push esi
push edi
ja 0x100454f6
mov eax, dword [0x1017bfd8]
ucomiss xmm1, xmm0
mov edx, dword [eax + 0x19e4]
lahf
test ah, 0x44
jp 0x100454d4
movss xmm1, dword [edx + 0xc]
movss xmm2, dword [edx + 0x214]
mov esi, dword [edx + 0x1bc]
subss xmm2, xmm1
test esi, esi
je 0x100454bd
mov edi, dword [esi + 0xc]
lea eax, [edi + 1]
test eax, eax
cmovns edi, eax
cmp edi, dword [esi + 0x2c]
jl 0x10045498
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movss xmm2, dword [esi + 0x18]
lea ecx, [edi*8]
subss xmm2, dword [esi + 0x14]
mov eax, dword [esi + 0x34]
sub ecx, edi
mulss xmm2, dword [eax + ecx*4]
addss xmm2, dword [esi + 0x14]
subss xmm2, dword [edx + 0x3c]
addss xmm1, xmm2
subss xmm1, dword [ebx]
maxss xmm1, dword [0x10145040]
movaps xmm0, xmm1
pop edi
pop esi
pop ebx
ret
comiss xmm1, xmm0
jbe 0x100454e7
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [edx + 0x58]
addss xmm1, xmm0
subss xmm1, dword [ebx]
maxss xmm1, dword [0x10145040]
movaps xmm0, xmm1
pop edi
pop esi
pop ebx
ret

Function at 0x10045500
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1017bfd8]
test eax, eax
je 0x1004550d
add eax, 8
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10045520
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1017bfd8]
test eax, eax
je 0x1004552f
add eax, 0x1500
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10045540
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [0x1017bfd8]
mov ecx, dword [esi + 0x1a48]
test ecx, ecx
je 0x10045717
mov eax, dword [esi + 0x1a04]
mov dword [esi + 0x1a0c], eax
cmp dword [esi + 0x1a08], eax
jne 0x10045570
mov byte [esi + 0x1a18], 1
mov ecx, dword [ecx + 0x2f0]
test ecx, ecx
je 0x1004570f
cmp byte [esi + 0xe8], 0
je 0x100456fe
lea eax, [esi + 0xe0]
test esi, esi
je 0x1004570f
mov edx, eax
test eax, eax
jne 0x100455a5
lea edx, [esi + 0xe0]
movss xmm0, dword [edx]
movss xmm1, dword [0x10145370]
comiss xmm0, xmm1
movss xmm2, dword [edx + 4]
jb 0x100456fe
comiss xmm2, xmm1
jb 0x100456fe
movss xmm2, dword [eax]
subss xmm2, dword [esi + 0x1a24]
movss xmm0, dword [ecx + 0xc]
movss xmm1, dword [eax + 4]
subss xmm1, dword [esi + 0x1a28]
ucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10045601
movss xmm0, dword [ecx + 0x10]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x100456f2
test dword [ecx + 8], 0x100
xorps xmm0, xmm0
movss xmm4, dword [esi + 0x10]
maxss xmm2, xmm0
movss xmm5, dword [esi + 0x14]
maxss xmm1, xmm0
subss xmm4, dword [ecx + 0x14]
subss xmm5, dword [ecx + 0x18]
minss xmm4, xmm2
minss xmm5, xmm1
jne 0x10045643
comiss xmm0, dword [esi + 0x2c94]
jb 0x10045643
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x2c94], eax
mov eax, dword [ecx + 0xac]
test al, 1
je 0x100456f2
and eax, 0xfffffff1
movss xmm2, dword [ecx + 0xc]
mov dword [ecx + 0xac], eax
movss xmm3, dword [ecx + 0x10]
cvttss2si eax, xmm4
mov dword [ecx + 0xb8], 0x7f7fffff
mov dword [ecx + 0xbc], 0x7f7fffff
movd xmm0, eax
cvttss2si eax, xmm5
cvtdq2ps xmm0, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [ecx + 0xc], xmm0
subss xmm0, xmm2
movss dword [ecx + 0x10], xmm1
subss xmm1, xmm3
addss xmm0, dword [ecx + 0xc8]
addss xmm1, dword [ecx + 0xcc]
movss dword [ecx + 0xc8], xmm0
movss dword [ecx + 0xcc], xmm1
movss xmm1, dword [ecx + 0x10]
movss xmm0, dword [ecx + 0xc]
subss xmm1, xmm3
subss xmm0, xmm2
addss xmm1, dword [ecx + 0xe4]
addss xmm0, dword [ecx + 0xe0]
movss dword [ecx + 0xe4], xmm1
movss dword [ecx + 0xe0], xmm0
mov ecx, dword [esi + 0x1a48]
pop esi
jmp fcn.1004ced0
call fcn.10044c80
mov dword [esi + 0x1a48], 0
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [esi + 0x1a2c]
test ecx, ecx
je 0x1004570d
mov eax, dword [esi + 0x1a04]
cmp dword [ecx + 0x50], eax
jne 0x1004570d
mov dword [esi + 0x1a0c], eax
cmp dword [esi + 0x1a08], eax
jne 0x10045741
mov byte [esi + 0x1a18], 1
cmp byte [esi + 0xe8], 0
jne 0x1004570d
pop esi
jmp fcn.10044c80
Function at 0x10045750
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [0x1017bfd8]
push edi
cmp dword [esi + 0x1a04], 0
jne 0x10045926
cmp dword [esi + 0x19f0], 0
jne 0x10045926
mov eax, dword [esi + 0x1af4]
test eax, eax
je 0x1004578a
cmp byte [eax + 0x80], 0
jne 0x10045926
cmp byte [esi + 0x3d0], 0
je 0x100458b8
cmp dword [esi + 0x19ec], 0
je 0x1004588d
mov edi, dword [esi + 0x19e8]
mov ecx, edi
call fcn.1004ced0
mov ecx, dword [edi + 0x50]
mov edx, edi
call fcn.10044b00
mov byte [esi + 0x1b56], 1
mov eax, dword [edi + 0x2f0]
movss xmm1, dword [esi + 0xe0]
movss xmm0, dword [esi + 0xe4]
subss xmm1, dword [eax + 0xc]
subss xmm0, dword [eax + 0x10]
movss dword [esi + 0x1a24], xmm1
movss dword [esi + 0x1a28], xmm0
test byte [edi + 8], 4
jne 0x1004580a
mov eax, dword [edi + 0x2f0]
test byte [eax + 8], 4
jne 0x1004580a
mov dword [esi + 0x1a48], edi
cmp byte [esi + 0xb0], 0
je 0x100458b8
mov ecx, dword [esi + 0x19ec]
test byte [ecx + 8], 1
jne 0x100458b8
mov eax, dword [0x1017bfd8]
movss xmm4, dword [esi + 0x380]
comiss xmm4, dword [ecx + 0xc]
movss xmm2, dword [eax + 0x1904]
mulss xmm2, dword [ecx + 0x26c]
movss xmm0, dword [eax + 0x153c]
movss xmm3, dword [ecx + 0xc]
addss xmm0, xmm0
addss xmm2, dword [ecx + 0x10]
addss xmm3, dword [ecx + 0x1c]
addss xmm2, xmm0
jb 0x10045881
movss xmm0, dword [esi + 0x384]
comiss xmm0, dword [ecx + 0x10]
jb 0x10045881
comiss xmm3, xmm4
jbe 0x10045881
comiss xmm2, xmm0
ja 0x100458b8
mov dword [esi + 0x1a48], 0
jmp 0x100458b8
test eax, eax
je 0x100458b8
call fcn.1004dda0
test eax, eax
jne 0x100458b8
mov dword [esi + 0x1af4], eax
mov byte [esi + 0x1b59], al
mov dword [esi + 0x1af8], eax
mov byte [esi + 0x1b54], al
mov dword [esi + 0x1b4c], eax
cmp byte [esi + 0x3d1], 0
je 0x10045926
call fcn.1004dda0
mov ebx, dword [esi + 0x19a4]
mov edi, eax
test edi, edi
sete cl
lea edx, [ebx - 1]
test edx, edx
js 0x1004590a
nop word [eax + eax]
test cl, cl
jne 0x1004590e
cmp edx, ebx
jge 0x1004591e
mov eax, dword [esi + 0x19ac]
mov eax, dword [eax + edx*4]
cmp eax, edi
je 0x10045914
cmp eax, dword [esi + 0x19e8]
mov eax, 1
movzx ecx, cl
cmove ecx, eax
sub edx, eax
jns 0x100458e0
test cl, cl
je 0x10045914
mov edi, dword [esi + 0x19e8]
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.1004dfd0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
pop esi
pop ebx
ret
Function at 0x10046a00
Capabilities:
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10046b56
cmp byte [edi + 0x2c90], 0
jne 0x10046b56
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x10142141
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x10046a4e
cmp byte [esi], al
jne 0x10046a4e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x1013a068]
test al, al
jne 0x10046a40
mov esi, dword [edi + 0x2ca4]
not edx
mov ecx, dword [edi + 0x2ca8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x10052e00
mov dword [ebp - 0xc], 0x10052e60
mov dword [ebp - 8], 0x10052f30
cmp esi, ecx
jne 0x10046b24
inc esi
test ecx, ecx
je 0x10046aa5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10046aaa
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10046b24
mov eax, dword [0x1017bfd8]
test eax, eax
je 0x10046ac2
inc dword [eax + 0x36c]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2cac]
test eax, eax
je 0x10046b18
mov ecx, dword [edi + 0x2ca4]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2cac]
add esp, 0xc
test ecx, ecx
je 0x10046b0e
mov eax, dword [0x1017bfd8]
test eax, eax
je 0x10046b0e
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi + 0x2cac], ebx
mov dword [edi + 0x2ca8], esi
mov eax, dword [edi + 0x2ca4]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2cac]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2ca4]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10046bc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
cmp ecx, esi
jne 0x10046bf6
inc ecx
test esi, esi
je 0x10046be4
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10046be9
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, ebx
call fcn.10053900
mov ecx, dword [ebx]
mov eax, dword [ebx + 8]
mov dword [eax + ecx*4], edi
inc dword [ebx]
cmp byte [edi + 0x7a], 0
je 0x10046c59
mov eax, dword [edi + 0x150]
mov dword [ebp - 4], eax
cmp eax, 1
jle 0x10046c2f
push 0x10046b60
push 4
push eax
push dword [edi + 0x158]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
add esp, 0x10
xor esi, esi
jmp 0x10046c35
xor esi, esi
test eax, eax
jle 0x10046c59
cmp esi, dword [edi + 0x150]
jge 0x10046c60
mov eax, dword [edi + 0x158]
mov edx, dword [eax + esi*4]
cmp byte [edx + 0x7a], 0
je 0x10046c53
mov ecx, ebx
call fcn.10046bc0
inc esi
cmp esi, dword [ebp - 4]
jl 0x10046c35
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10046c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x10046d8c
jle 0x10046d92
mov eax, dword [esi + 8]
mov edx, ecx
shl edx, 5
cmp dword [edx + eax - 0x20], 0
jne 0x10046cad
cmp dword [edx + eax - 8], 0
jne 0x10046cad
lea eax, [ecx - 1]
mov dword [esi], eax
test eax, eax
je 0x10046d8c
mov edx, dword [esi + 0x18]
test edx, edx
je 0x10046cc6
mov eax, dword [esi + 0x20]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4]
cmp dword [esi + 0x34], eax
jne 0x10046d92
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10046cdc
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
cmp dword [esi + 0x38], eax
jne 0x10046d92
mov eax, dword [esi + 0x30]
cmp eax, edx
jne 0x10046d92
cmp eax, 0x10000
jae 0x10046d92
mov ecx, dword [edi + 4]
push ebx
mov ebx, dword [edi]
cmp ebx, ecx
jne 0x10046d81
inc ebx
test ecx, ecx
je 0x10046d10
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10046d15
mov eax, 8
cmp eax, ebx
cmovg ebx, eax
cmp ebx, ecx
jle 0x10046d81
mov eax, dword [0x1017bfd8]
test eax, eax
je 0x10046d2d
inc dword [eax + 0x36c]
lea eax, [ebx*4]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, dword [edi + 8]
add esp, 4
mov dword [ebp - 4], eax
test edx, edx
je 0x10046d7b
mov ecx, dword [edi]
shl ecx, 2
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 8]
add esp, 0xc
test ecx, ecx
je 0x10046d6e
mov eax, dword [0x1017bfd8]
test eax, eax
je 0x10046d6e
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
mov dword [edi + 8], eax
mov dword [edi + 4], ebx
mov ecx, dword [edi]
mov eax, dword [edi + 8]
pop ebx
mov dword [eax + ecx*4], esi
inc dword [edi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10046e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x1017bfd8]
mov eax, dword [esi + 0x19e4]
mov byte [eax + 0x7c], 1
push dword [edx + 4]
mov esi, dword [esi + 0x19e4]
push dword [edx]
push dword [ecx + 4]
push dword [ecx]
mov ecx, dword [esi + 0x274]
push dword [ebp + 8]
call fcn.1005b000
mov eax, dword [esi + 0x274]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
jg 0x10046e57
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [eax + 0x44]
add ecx, ecx
movss xmm0, dword [eax + ecx*8 - 0xc]
movss xmm1, dword [eax + ecx*8 - 8]
movss xmm2, dword [eax + ecx*8 - 4]
mov eax, dword [eax + ecx*8 - 0x10]
mov dword [esi + 0x1cc], eax
movss dword [esi + 0x1d0], xmm0
movss dword [esi + 0x1d4], xmm1
movss dword [esi + 0x1d8], xmm2
pop esi
pop ebp
ret

Function at 0x10046ea0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x1017bfd8]
push esi
mov eax, dword [ecx + 0x19e4]
mov byte [eax + 0x7c], 1
mov esi, dword [ecx + 0x19e4]
mov ecx, dword [esi + 0x274]
mov eax, dword [ecx + 0x3c]
test eax, eax
jle 0x10046f15
dec eax
mov dword [ecx + 0x3c], eax
call fcn.1005ae30
mov eax, dword [esi + 0x274]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
jle 0x10046f15
mov eax, dword [eax + 0x44]
add ecx, ecx
movss xmm0, dword [eax + ecx*8 - 0xc]
movss xmm1, dword [eax + ecx*8 - 8]
movss xmm2, dword [eax + ecx*8 - 4]
mov eax, dword [eax + ecx*8 - 0x10]
mov dword [esi + 0x1cc], eax
movss dword [esi + 0x1d0], xmm0
movss dword [esi + 0x1d4], xmm1
movss dword [esi + 0x1d8], xmm2
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3