joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425180
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x47d550]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x40
mov eax, 0x462af6
call fcn.00446960
mov eax, dword [ebp + 0x24c]
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x425354
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x425354
call fcn.00423889
cmp byte [eax + 0x2a], bl
jne 0x4251dc
cmp byte [eax + 0x29], bl
jne 0x4251dc
mov ecx, eax
call fcn.00424f94
mov esi, 0x103
push esi
lea eax, [ebp + 0x13d]
push ebx
push eax
mov byte [ebp + 0x13c], bl
call fcn.00446500
add esp, 0xc
lea edi, [esi + 1]
push edi
lea eax, [ebp + 0x13c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp + 0x13c]
push eax
push dword [ebp + 0x250]
lea eax, [ebp - 0x30]
push eax
call fcn.00425115
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x425230
mov eax, dword [eax + 4]
jmp 0x425233
add eax, 4
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004014e8
push esi
lea eax, [ebp + 0x39]
push ebx
push eax
mov byte [ebp + 0x38], bl
call fcn.00446500
add esp, 0xc
mov esi, 0x465c28
push esi
lea ecx, [ebp]
call fcn.00403c42
push esi
lea ecx, [ebp + 0x1c]
mov dword [ebp - 4], ebx
call fcn.00403c42
push 5
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
jmp 0x42532e
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x42532b
push edi
lea eax, [ebp + 0x38]
push ebx
push eax
call fcn.00446500
add esp, 0xc
push edi
lea eax, [ebp + 0x38]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
push dword [eax + 0x47b524]
lea eax, [ebp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4252d3
add dword [ebp - 0x10], 4
cmp dword [ebp - 0x10], 8
jb 0x4252b0
jmp 0x42532b
push edi
lea eax, [ebp + 0x13c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp + 0x13c]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x4c]
push eax
call fcn.00425115
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.00403a43
push ebx
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.004014e8
cmp dword [ebp + 0x34], 0x10
mov eax, dword [ebp + 0x20]
jae 0x425323
lea eax, [ebp + 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
cmp esi, ebx
jne 0x425281
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.004014e8
push ebx
push 1
lea ecx, [ebp]
call fcn.004014e8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.004464e5
add ebp, 0x244
leave
ret
Function at 0x425d0f
Capabilities:
Get system information on windows

Disassembly:
push 0x28
mov eax, 0x462bf1
call fcn.00446960
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xb4]
mov dword [esi], vtable.OSVersion.0
call fcn.00403865
xor ebx, ebx
lea ecx, [esi + 0xd0]
mov dword [ebp - 4], ebx
call fcn.00403865
push 0x9c
lea edi, [esi + 4]
push ebx
push edi
mov byte [ebp - 4], 1
mov byte [esi + 0xa1], bl
mov byte [esi + 0xa0], bl
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xa8], bl
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov byte [esi + 0xa2], bl
call fcn.00446500
add esp, 0xc
push edi
mov dword [edi], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
dec eax
neg eax
sbb al, al
inc al
mov byte [esi + 0xa0], al
jne 0x425dbd
push 0x9c
push ebx
push edi
call fcn.00446500
add esp, 0xc
push edi
mov dword [edi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x425dc4
mov byte [esi + 0xa1], 1
cmp byte [esi + 0xa1], bl
je 0x425e24
mov ecx, esi
call fcn.00425923
push 0x24
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.00446500
add esp, 0xc
push str.GetNativeSystemInfo
push 0x468470
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x425e05
lea ecx, [ebp - 0x34]
push ecx
call eax
jmp 0x425e0f
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], 9
jne 0x425e1d
mov byte [esi + 0xa8], 1
mov ecx, esi
call fcn.004257a6
mov eax, esi
call fcn.00446a38
ret

Function at 0x426298
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi + 0x18], ecx
lea ecx, [ebp + 0xc]
push ecx
push ebx
mov dword [esi + 0x10], eax
lea eax, [esi + 0x14]
push eax
push dword [ebp + 8]
mov byte [esi + 0x1d], bl
push ebx
push ebx
mov dword [ebp + 0xc], ebx
mov dword [eax], esi
call fcn.0044aa8e
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x4262da
xor eax, eax
mov byte [esi + 0x1d], bl
inc eax
jmp 0x4262e2
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x42630a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
jne 0x426317
mov al, 1
jmp 0x426351
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, eax
jmp 0x42633d
cmp dword [esp + 0x14], 0xffffffff
je 0x42633d
call ebp
sub eax, ebx
cmp eax, dword [esp + 0x14]
ja 0x426347
push 0x32
call edi
cmp byte [esi + 0x1d], 0
jne 0x42632c
cmp byte [esi + 0x1d], 0
pop edi
pop ebp
sete al
pop ebx
pop esi
ret 4
Function at 0x42636b
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x1d], bl
je 0x4263aa
cmp dword [esi + 8], ebx
je 0x4263aa
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4263aa
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 4]
call fcn.00426359
pop ecx
mov dword [esi + 8], ebx
mov byte [esi + 0x1d], bl
pop esi
pop ebx
ret

Function at 0x42647d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
test ebx, ebx
jle 0x4264d5
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
sub eax, edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
inc esi
mov ebx, 0xff
and esi, ebx
movzx eax, byte [ecx + esi + 8]
add edi, eax
and edi, ebx
movzx ebx, byte [ecx + edi + 8]
mov byte [ecx + esi + 8], bl
mov byte [ecx + edi + 8], al
add al, bl
mov ebx, dword [ebp + 0xc]
movzx eax, al
mov al, byte [eax + ecx + 8]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
dec dword [ebp + 8]
jne 0x4264a0
mov dword [ecx + 4], edi
pop edi
mov dword [ecx], esi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x427f3d
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x429b96
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4615b1
call fcn.00446960
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x429bbb
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x429c01
lea ecx, [ebp - 0x10]
call fcn.004014a0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042937b
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004010f6
mov eax, esi
call fcn.00446a38
ret 8
Function at 0x42f583
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42f5ca
call fcn.00435924
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42f5ca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42f5e6
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042f0fd
mov esi, eax
test edi, edi
je 0x42f5e4
test ebx, ebx
je 0x42f5e4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x431d0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x431d30
cmp dword [edi + 0x54], 0
jne 0x431d30
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00435924
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00431ccd
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x433f91
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x433fd9
call fcn.00435924
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x433fd9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x43401c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x434005
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x434005
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x434019
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4464e5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47d550]
jne 0x4464ef
repz ret
jmp fcn.0044eb17
Function at 0x45b4c1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044fb00
and dword [ebp - 4], 0
cmp dword [0x482290], 0
mov ebx, eax
jne 0x45b572
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45b623
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46eab0
push edi
call esi
test eax, eax
je 0x45b623
push eax
call fcn.0044fa8e
mov dword [esp], 0x46eaa0
push edi
mov dword [0x482290], eax
call esi
push eax
call fcn.0044fa8e
mov dword [esp], 0x46ea8c
push edi
mov dword [0x482294], eax
call esi
push eax
call fcn.0044fa8e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x482298], eax
call esi
push eax
call fcn.0044fa8e
pop ecx
mov dword [0x4822a0], eax
test eax, eax
je 0x45b572
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044fa8e
pop ecx
mov dword [0x48229c], eax
mov eax, dword [0x48229c]
cmp eax, ebx
je 0x45b5ca
cmp dword [0x4822a0], ebx
je 0x45b5ca
push eax
call fcn.0044fb09
push dword [0x4822a0]
mov esi, eax
call fcn.0044fb09
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45b5ca
test edi, edi
je 0x45b5ca
call esi
test eax, eax
je 0x45b5c1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45b5c1
test byte [ebp - 0xc], 1
jne 0x45b5ca
or dword [ebp + 0x10], 0x200000
jmp 0x45b603
mov eax, dword [0x482294]
cmp eax, ebx
je 0x45b603
push eax
call fcn.0044fb09
pop ecx
test eax, eax
je 0x45b603
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45b603
mov eax, dword [0x482298]
cmp eax, ebx
je 0x45b603
push eax
call fcn.0044fb09
pop ecx
test eax, eax
je 0x45b603
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x482290]
call fcn.0044fb09
pop ecx
test eax, eax
je 0x45b623
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45b625
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10022690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b038b
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
mov eax, dword [0x100d99c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100d9b84]
mov esi, dword [ebp + 8]
test al, 1
jne 0x100227c4
or eax, 1
mov dword [0x100d9b84], eax
movaps xmm0, xmmword [0x100bb620]
mov eax, 0x10
pxor xmm0, xmmword [0x100bb610]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x8c938c93
mov dword [ebp - 0x18], 0xea8cee94
mov word [ebp - 0x14], 0xac9d
movups xmmword [ebp - 0x2c], xmm0
xor byte [ebp + eax - 0x2c], 0xac
inc eax
cmp eax, 0x1a
jb 0x10022701
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022727
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.1001d5b0
mov ecx, dword [0x100f6954]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10022750
mov ecx, dword [ecx + 0x50]
jmp 0x10022752
xor ecx, ecx
mov eax, dword [0x100f694c]
test eax, eax
je 0x10022760
mov eax, dword [eax + 0x18]
jmp 0x10022762
xor eax, eax
lea edx, [ebp - 0x44]
push edx
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10025d70
mov ecx, dword [ebp - 0x30]
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [0x100d9b80], eax
mov byte [ebp - 4], 0
cmp ecx, 0x10
jb 0x100227bb
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100227ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100227ac
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100ae001
mov eax, dword [0x100d9b80]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x100227c9
mov eax, dword [0x100d9b80]
test eax, eax
je 0x100227d1
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002da00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d99c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
movss xmm3, dword [0x100bb9f0]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
movzx eax, cl
push esi
push edi
mov edi, dword [ebp + 8]
movd xmm0, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shr ecx, 0x10
cvtdq2ps xmm0, xmm0
movd xmm1, eax
movzx eax, cl
mulss xmm0, xmm3
cvtdq2ps xmm1, xmm1
movd xmm2, eax
mulss xmm1, xmm3
cvtdq2ps xmm2, xmm2
mulss xmm2, xmm3
test edi, edi
je 0x1002db0e
mov eax, dword [edi]
sub esp, 0xc
mov ecx, edi
mov eax, dword [eax + 0x70]
movss dword [esp + 8], xmm2
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call eax
mov dword [ebp - 0x10], 0xdac2c988
xor eax, eax
mov dword [ebp - 0xc], 0xd8dccdc1
mov dword [ebp - 8], 0xacd8c2c5
xor byte [ebp + eax - 0x10], 0xac
inc eax
cmp eax, 0xc
jb 0x1002da97
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push 1
push 0
push ecx
mov eax, dword [eax + 0x2c]
mov ecx, edi
call eax
mov esi, eax
test esi, esi
je 0x1002db35
movzx ecx, byte [ebp - 0x16]
sub esp, 0xc
movss xmm1, dword [0x100bb9f0]
mov eax, dword [ebp - 0x1c]
mov edx, dword [esi]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movzx ecx, ah
movzx eax, al
mulss xmm0, xmm1
movss dword [esp + 8], xmm0
movd xmm0, ecx
mov ecx, esi
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp + 4], xmm0
movd xmm0, eax
mov eax, dword [edx + 0x2c]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp], xmm0
call eax
jmp 0x1002db35
mov ecx, dword [0x100f69c0]
lea edx, [ebp - 0x14]
movss dword [ebp - 0x14], xmm0
movss dword [ebp - 0x10], xmm1
movss dword [ebp - 0xc], xmm2
mov dword [ebp - 8], 0x3f800000
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x18]
call eax
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [ebp + 0x14]
push esi
push 0x400
mov eax, dword [eax + 0x74]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0x4000
mov eax, dword [eax + 0x74]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0x8000
mov eax, dword [eax + 0x74]
call eax
mov ecx, dword [0x100f69d0]
push 0
push 0
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x84]
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100ae337
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002db90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100d99c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002dc4c
cmp byte [esi + 0x3d], 0
je 0x1002dc4c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002dc3a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002dc01
sub eax, 1
je 0x1002dc05
sub eax, 2
jne 0x1002dc3a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae337
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002dc23
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002dc3a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae337
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae337
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100ae337
mov esp, ebp
pop ebp
ret
Function at 0x1002eef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b09d3
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100d99c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100eff9c]
mov dword [ebp - 4], 0
test al, 1
jne 0x1002f01d
or eax, 1
mov dword [0x100eff9c], eax
movaps xmm0, xmmword [0x100bb620]
mov eax, 0x10
pxor xmm0, xmmword [0x100bbc60]
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0x95ea8cee
mov dword [ebp - 0x34], 0x8ceaea8c
mov word [ebp - 0x30], 0x999d
mov byte [ebp - 0x2e], 0xac
movups xmmword [ebp - 0x48], xmm0
xor byte [ebp + eax - 0x48], 0xac
inc eax
cmp eax, 0x1b
jb 0x1002ef65
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002ef90
sub ecx, edx
lea eax, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.1001d5b0
mov ecx, dword [0x100f696c]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x1002efb9
mov ecx, dword [ecx + 0x50]
jmp 0x1002efbb
xor ecx, ecx
mov eax, dword [0x100f6964]
test eax, eax
je 0x1002efc9
mov eax, dword [eax + 0x18]
jmp 0x1002efcb
xor eax, eax
lea edx, [ebp - 0x2c]
push edx
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10025d70
mov ecx, dword [ebp - 0x18]
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov dword [0x100eff98], eax
mov byte [ebp - 4], 1
cmp ecx, 0x10
jb 0x1002f019
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002f00f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002f068
push ecx
push edx
call fcn.100ae001
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x65656863
cmovae ecx, dword [ebp + 8]
mov word [ebp - 0x10], 0x6573
mov byte [ebp - 0xe], 0
call dword [0x100eff98]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x1002f078
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002f06e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002f06e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100ae001
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18