joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009f4b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1f7d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x10159fd8]
mov edi, dword [esi + 0x174]
test edi, edi
jle 0x1009f521
mov edx, dword [esi + 0x4cb0]
mov ecx, dword [0x10159f7c]
add edx, dword [esi + 0x4cac]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push 1
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x1015eff4], 0
jne 0x1009f5f4
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push str.B8_________3B_F0_0F_4F_F0_89_5D_FC
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x34], xmm0
call fcn.1002bd10
mov dword [ebp - 4], 0
mov eax, dword [0x10159f34]
test eax, eax
je 0x1009f567
mov edx, dword [eax + 0x50]
jmp 0x1009f569
xor edx, edx
mov eax, dword [0x10159f2c]
test eax, eax
je 0x1009f577
mov eax, dword [eax + 0x18]
jmp 0x1009f579
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.10023f00
mov edi, dword [ebp - 0x1c]
add esp, 8
mov ecx, dword [ebp - 0x20]
inc edi
cmp ecx, 0xf
jbe 0x1009f5c3
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1009f5b9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1009f5b9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100b7eba
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x18], 0
call esi
lea eax, [ebp - 0x18]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x18]
push 4
push edi
call esi
mov byte [0x1015eff4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b798c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x1009f960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dl, byte [esi]
xor dl, byte [edi]
and dl, 1
xor dl, byte [edi]
mov byte [edi], dl
mov cl, byte [esi]
xor cl, dl
and cl, 2
xor cl, dl
mov byte [edi], cl
movzx eax, byte [esi]
xor al, cl
and al, 4
xor al, cl
mov byte [edi], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
movq xmm0, qword [esi + 0x18]
movq qword [edi + 0x18], xmm0
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
movq xmm0, qword [esi + 0x40]
movq qword [edi + 0x40], xmm0
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
movq xmm0, qword [esi + 0x4c]
movq qword [edi + 0x4c], xmm0
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
movq xmm0, qword [esi + 0x5c]
movq qword [edi + 0x5c], xmm0
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
movq xmm0, qword [esi + 0x68]
movq qword [edi + 0x68], xmm0
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
movq xmm0, qword [esi + 0x78]
movq qword [edi + 0x78], xmm0
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
movq xmm0, qword [esi + 0x84]
movq qword [edi + 0x84], xmm0
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
movq xmm0, qword [esi + 0x90]
movq qword [edi + 0x90], xmm0
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
movzx eax, byte [esi + 0xa8]
mov byte [edi + 0xa8], al
movq xmm0, qword [esi + 0xac]
movq qword [edi + 0xac], xmm0
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x100a8ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov ebx, edx
mov esi, ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], esi
lea eax, [ecx - 1]
mov dword [ebp - 0x1c], eax
sar eax, 1
mov dword [ebp - 0x14], eax
cmp ebx, eax
jge 0x100a8b53
lea esi, [edx + edx]
lea ecx, [edi + 0x10]
lea ecx, [ecx + esi*8]
lea eax, [ecx - 8]
push eax
push ecx
lea ecx, [ebp + 0x10]
call fcn.100a34d0
movzx edx, al
xor edx, 1
inc edx
add edx, esi
mov eax, dword [edi + edx*8]
mov ecx, dword [edi + edx*8 + 4]
mov dword [edi + ebx*8], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + ebx*8 + 4], ecx
mov ebx, edx
cmp edx, eax
jl 0x100a8b17
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov ebx, edx
cmp edx, eax
jne 0x100a8b70
test cl, 1
jne 0x100a8b70
mov eax, dword [edi + ecx*8 - 8]
mov ecx, dword [edi + ecx*8 - 4]
mov ebx, dword [ebp - 0x1c]
mov dword [edi + edx*8], eax
mov dword [edi + edx*8 + 4], ecx
mov al, byte [ebp + 0x10]
mov byte [ebp - 8], al
cmp esi, ebx
jge 0x100a8bad
nop word [eax + eax]
push dword [ebp - 0x10]
lea esi, [ebx - 1]
sar esi, 1
lea ecx, [ebp - 8]
lea eax, [edi + esi*8]
push eax
call fcn.100a34d0
test al, al
je 0x100a8bad
mov eax, dword [edi + esi*8]
mov ecx, dword [edi + esi*8 + 4]
mov dword [edi + ebx*8], eax
mov dword [edi + ebx*8 + 4], ecx
mov ebx, esi
cmp dword [ebp - 0xc], esi
jl 0x100a8b80
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + ebx*8 + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [edi + ebx*8], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100b798c
mov esp, ebp
pop ebp
ret
Function at 0x100af6c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov edx, dword [ebp + 0xc]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x1015ee98
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100b50e0
mov edx, dword [0x1015ee9c]
xorps xmm0, xmm0
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [0x1015ee9c]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
je 0x100af75f
lea ecx, [edx + 0xc]
push 1
push ecx
mov ecx, esi
call fcn.1002bd10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0x100c5876
mov ecx, esi
call fcn.1002bd10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100b4660
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.100b50e0
mov esi, dword [eax + 4]
test esi, esi
je 0x100b4715
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100b46dc
cmp eax, esi
jne 0x100b46d4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100b46e4
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100b46e4
cmp eax, esi
jne 0x100b46e4
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.1002b460
push 0x5c
push esi
call fcn.100b7eba
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b4800
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100b496f
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002b460
push 0x5c
push edi
call fcn.100b7eba
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100b48cd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100b4880
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100b4965
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100b48e1
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100b48e4
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100b4965
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002b460
push 0x5c
push edi
call fcn.100b7eba
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100b4976
cmp esi, eax
jne 0x100b4935
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100b48f0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b5150
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c2b55
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100d7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100b50e0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100b51da
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100b5320
cmp dword [ebx + 8], 0xfffffff
jne 0x100b51ee
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100b79a8
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100cc030]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100cc030]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100b52d3
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100b8d50
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100b52b5
cmp eax, 0x200
jae 0x100b52b3
shl eax, 3
cmp eax, ecx
jae 0x100b52b5
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10080490
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100b50e0
mov edx, dword [eax]
jmp 0x100b52d6
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100b5301
mov dword [ecx + eax*8], esi
jmp 0x100b5313
cmp ebx, edx
jne 0x100b530a
mov dword [ecx + eax*8], esi
jmp 0x100b5317
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100b5317
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b58e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c2b55
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100d7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100b50e0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100b596a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100b5ab2
cmp dword [ebx + 8], 0xfffffff
jne 0x100b597e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100b79a8
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100cc030]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100cc030]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100b5a65
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100b8d50
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100b5a47
cmp eax, 0x200
jae 0x100b5a45
shl eax, 3
cmp eax, ecx
jae 0x100b5a47
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10080490
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100b50e0
mov edx, dword [eax]
jmp 0x100b5a68
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100b5a93
mov dword [ecx + eax*8], esi
jmp 0x100b5aa5
cmp ebx, edx
jne 0x100b5a9c
mov dword [ecx + eax*8], esi
jmp 0x100b5aa9
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100b5aa9
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x57a2468a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x1e41b4d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x500c604
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
sub esp, 0x228
lea ebp, [esp - 4]
mov eax, dword [0x509ddfc]
xor eax, ebp
mov dword [ebp + 0x228], eax
push 0x4c
mov eax, 0x5071b23
call fcn.050702c4
mov eax, dword [ebp + 0x240]
mov ebx, dword [ebp + 0x234]
mov dword [ebp - 0x10], eax
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x16], ax
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], ax
lea eax, [ebp + 0x1a8]
push eax
mov word [ebp - 0x1c], 0x7d2
mov word [ebp - 0x1a], 7
mov word [ebp - 0x18], 9
call sub.MSVCR80.dll_memset
fld qword [0x5079750]
mov eax, dword [ebp + 0x238]
mov dword [ebp + 0x1b8], eax
mov eax, dword [ebp + 0x23c]
mov dword [ebp + 0x1bc], eax
mov dword [ebp + 0x1ac], 0x41444245
mov dword [ebp + 0x1b0], 0x4000000
mov dword [ebp + 0x1b4], 0x6c696e6b
lea esi, [ebp - 0x1c]
lea edi, [ebp + 0x1c0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebp + 0x1e8], 0
add esp, 4
mov dword [ebp + 0x1cc], 0x61637370
mov dword [ebp + 0x1d0], 0x4150504c
fstp qword [esp]
call fcn.05005171
mov dword [ebp + 0x1ec], eax
fld qword [0x5079748]
fstp qword [esp]
call fcn.05005171
fld qword [0x5079740]
mov dword [ebp + 0x1f0], eax
fstp qword [esp]
call fcn.05005171
pop ecx
pop ecx
mov dword [ebp + 0x1f4], eax
lea eax, [ebp + 0x1a8]
push eax
push ebx
lea ecx, [ebp + 0xa0]
mov dword [ebp + 0x1f8], 0x41444245
call fcn.050094e9
push str.ACE_Device_Link
push ebx
lea ecx, [ebp - 0x58]
call fcn.0500763a
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0xa0]
call fcn.0500952b
push 0x7d2
lea ecx, [ebp]
call fcn.0500739b
lea eax, [ebp]
push eax
lea ecx, [ebp + 0xa0]
mov byte [ebp - 4], 1
call fcn.0500952b
lea ecx, [ebp - 0x30]
call fcn.050076ef
mov eax, ecx
push eax
lea ecx, [ebp + 0xa0]
mov byte [ebp - 4], 2
call fcn.0500952b
push dword [ebp - 0x10]
lea ecx, [ebp + 0xa0]
call fcn.0500952b
lea ecx, [ebp + 0xa0]
call fcn.050096b5
mov esi, eax
mov edi, dword [esi + 0x28]
push edi
mov ecx, ebx
call fcn.05014451
mov edx, dword [esi]
push eax
push edi
push 0
mov ecx, esi
mov dword [ebp - 0x10], eax
call dword [edx + 0x18]
mov ecx, esi
call fcn.0503f8a6
push edi
push dword [ebp - 0x10]
call fcn.050417fa
push edi
push dword [ebp - 0x10]
push ebx
call fcn.05041edb
add esp, 0x14
push dword [ebp - 0x10]
mov ecx, ebx
mov esi, eax
call fcn.05014474
or dword [ebp - 4], 0xffffffff
mov eax, vtable.CProfileTag.0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x30], eax
mov dword [ebp], eax
call fcn.050076bd
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x228]
xor ecx, ebp
call fcn.05070186
add ebp, 0x22c
leave
ret
Function at 0x500fafe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x509ddfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
mov ebx, ecx
call sub.MSVCR80.dll_memset
fld qword [0x509c948]
mov eax, dword [ebp + 0xc]
fmul qword [0x5079748]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x18]
add esp, 4
mov esi, 0x41444245
fstp qword [esp]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], 0x2100000
mov dword [ebp - 0x60], 0x61637370
mov dword [ebp - 0x5c], 0x4150504c
mov dword [ebp - 0x54], 0x6e6f6e65
mov dword [ebp - 0x44], eax
call fcn.05005171
fld qword [0x509c950]
fmul qword [0x5079748]
mov dword [ebp - 0x40], eax
fstp qword [esp]
call fcn.05005171
fld qword [0x509c958]
mov dword [ebp - 0x3c], eax
fmul qword [0x5079748]
fstp qword [esp]
call fcn.05005171
mov dword [ebp - 0x34], esi
mov esi, dword [ebp + 0x1c]
test esi, esi
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
je 0x500fbc1
lea edi, [ebp - 0x6c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x500fc2a
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.MSVCR80.dll__time64]
pop ecx
mov esi, 0x509e378
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.MSVCR80.dll__gmtime64]
test eax, eax
pop ecx
je 0x500fc23
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x6c], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x6a], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x68], cx
mov cx, word [eax + 8]
mov word [ebp - 0x66], cx
mov cx, word [eax + 4]
mov word [ebp - 0x64], cx
mov ax, word [eax]
mov word [ebp - 0x62], ax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
and dword [ebx + 0x84], 0
mov dword [ebx], eax
lea eax, [ebx + 4]
push 0x20
pop ecx
mov edi, eax
lea esi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax], 0x84
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.05070186
leave
ret 0x18

Function at 0x50149a8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [esi], ecx
call fcn.05014966
lea eax, [ebp - 0x20]
push eax
mov dword [esi + 4], edi
mov dword [ebp - 0x20], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
and dword [esi + 0xc], 0
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop esi
leave
ret 8