joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b9feb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100ba035
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100b9fdc
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100b9feb
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x104bfc8e
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100ba03c
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.100a0eb2
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100ba0db
add edi, 4
add eax, 2
dec ecx
jne 0x100ba021
call 0x100ba088
loope 0x100ba07e
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100ba0d8
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100ba0e9
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100ba09c
cmp eax, ecx
ja 0x100ba09c
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100ba126
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100ba11c
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.100a1391
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1ae54b8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1dd83dc1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0xb97e6d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00b97e6d
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x1f875f33
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x6b84756
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10066f50
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10066f50
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101f3c30]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101f3c40], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x101f3c50]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100648cc
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x101f3c50], 0
call fcn.10001a30
mov ecx, dword [0x101f3c4c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100648cc
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x101f3c4c], 0
mov dword [0x101f3c40], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101f3c44], 0
je 0x10002679
mov eax, dword [0x101f3c44]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.100648d1
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100648cc
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x101f3c44], eax
mov dword [0x101f3c48], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x101f3c4c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x101f3c4c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10003bc0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x80
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
test cl, 1
cmovne eax, edx
shr ecx, 1
test cl, 1
je 0x10003be6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10003bf1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10003bfc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10003c07
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10003c12
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10003c1d
bts eax, 1
test cl, 2
je 0x10003c26
bts eax, 0
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov ebx, ecx
and ebx, 0x80000000
neg ebx
lea eax, [ecx + ecx]
sbb ebx, ebx
and ebx, 0x4c11db7
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [edi + eax*4], ebx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
nop
test bl, 1
je 0x10003cff
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10003cf0
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
mov edx, 0x80
cmp ecx, 0xff
jle 0x10003bd3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003d30
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x10085a90
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.100681df
add esp, 0xc
test eax, eax
je 0x10003d69
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.10068226
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10003d95
call fcn.100682a7
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100684f3
add esp, 0x10
test eax, eax
je 0x10003def
push esi
nop word [eax + eax]
mov esi, ebx
test eax, eax
je 0x10003dd7
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10003db6
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call fcn.100684f3
add esp, 0x10
test eax, eax
jne 0x10003db0
pop esi
push ebx
call fcn.100685a3
push dword [ebp + 0xc]
call fcn.100682a7
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004300
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x101ffba8]
push esi
mov esi, dword [0x101ffbac]
push edi
movsd xmm0, qword [eax]
lea eax, [esp + 0xc]
subsd xmm0, qword [0x1008e3d8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
andps xmm0, xmmword [0x1008e9c0]
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0xc]
mulsd xmm0, qword [0x1008e2d8]
push eax
push dword [esp + 0x10]
push 8
addsd xmm0, qword [0x1008e498]
push esi
movsd qword [esi], xmm0
call edi
mov eax, dword [0x101ffba8]
mov esi, dword [0x101ffbb0]
movsd xmm0, qword [eax]
lea eax, [esp + 0xc]
subsd xmm0, qword [0x1008e3d8]
push eax
push 0x40
push 8
push esi
andps xmm0, xmmword [0x1008e9c0]
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0xc]
mulsd xmm0, qword [0x1008e2d8]
push eax
push dword [esp + 0x10]
push 8
addsd xmm0, qword [0x1008e498]
push esi
movsd qword [esi], xmm0
call edi
mov eax, dword [0x101ffba8]
mov esi, dword [0x101ffbb4]
movsd xmm0, qword [eax]
lea eax, [esp + 0xc]
subsd xmm0, qword [0x1008e3d8]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x1008e9c0]
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0xc]
cvtpd2ps xmm0, xmm0
push eax
push dword [esp + 0x10]
mulss xmm0, dword [0x1008e340]
push 4
push esi
addss xmm0, dword [0x1008e758]
movss dword [esi], xmm0
call edi
mov eax, dword [0x101ffba8]
mov esi, dword [0x101ffbb8]
movsd xmm0, qword [eax]
lea eax, [esp + 0xc]
subsd xmm0, qword [0x1008e3d8]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x1008e9c0]
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0xc]
cvtpd2ps xmm0, xmm0
push eax
push dword [esp + 0x10]
mulss xmm0, dword [0x1008e340]
push 4
push esi
addss xmm0, dword [0x1008e758]
movss dword [esi], xmm0
call edi
mov eax, dword [0x101ffba8]
mov esi, dword [0x101ffbbc]
movsd xmm0, qword [eax]
lea eax, [esp + 0xc]
subsd xmm0, qword [0x1008e3d8]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x1008e9c0]
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0xc]
cvtpd2ps xmm0, xmm0
push eax
push dword [esp + 0x10]
mulss xmm0, dword [0x1008e340]
push 4
push esi
addss xmm0, dword [0x1008e748]
movss dword [esi], xmm0
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100044e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [0x101ffbc0], 0
push esi
push edi
je 0x100046f6
movss xmm0, dword [0x101ffbc4]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffb9c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [0x101ffbc8]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffba0]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [0x101ffbcc]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffba4]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
movss dword [esi], xmm0
push 4
push esi
call edi
movsd xmm0, qword [0x101ffbd0]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffba8]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
movsd qword [esi], xmm0
push 8
push esi
call edi
movsd xmm0, qword [0x101ffbd8]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffbac]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0xc]
movsd qword [esi], xmm0
push eax
push dword [esp + 0x10]
push 8
push esi
call edi
movsd xmm0, qword [0x101ffbe0]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffbb0]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
movsd qword [esi], xmm0
push 8
push esi
call edi
movss xmm0, dword [0x101ffbe8]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffbb4]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [0x101ffbec]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffbb8]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [0x101ffbf0]
lea eax, [esp + 0xc]
mov esi, dword [0x101ffbbc]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
movss dword [esi], xmm0
push 4
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1000c7a0
sub eax, 0x78b0c1
mov byte [0x101f46a8], 1
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x78b0bc
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 4], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000c68d
mov eax, dword [ebp - 0x10]
mov ecx, 0x78b0bc
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1000c68f
call esi
mov eax, 0x1000c5c0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x78976c
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x789767
call edi
test eax, eax
je 0x1000c6e1
mov eax, dword [ebp - 0x10]
mov ecx, 0x789767
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1000c6e3
call esi
mov eax, 0x1000c5e0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x789a68
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x789a63
call edi
test eax, eax
je 0x1000c735
mov eax, dword [ebp - 0x10]
mov ecx, 0x789a63
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1000c737
call esi
mov eax, 0x1000c600
mov byte [ebp - 0x10], 0xe9
sub eax, 0x789db1
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x789dac
call edi
test eax, eax
je 0x1000c789
mov eax, dword [ebp - 0x10]
mov ecx, 0x789dac
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1000c78b
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret