joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005e780
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x1005e840
js 0x1005e8cf
mov edi, dword [esi + 8]
cmp eax, dword [esi + 4]
jne 0x1005e82a
lea ecx, [eax + 1]
mov ebx, eax
shr ebx, 1
add ebx, eax
cmp ebx, ecx
cmovle ebx, ecx
cmp eax, ebx
jae 0x1005e82a
lea eax, [ebx*4]
mov ecx, dword [0x10259f60]
test ecx, ecx
je 0x1005e7ca
inc dword [ecx + 0x36c]
push dword [0x10259f68]
push eax
call dword [0x101fd77c]
add esp, 8
mov edi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e81a
mov ecx, dword [esi]
shl ecx, 2
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e80a
mov ecx, dword [0x10259f60]
test ecx, ecx
je 0x1005e80a
dec dword [ecx + 0x36c]
push dword [0x10259f68]
push eax
call dword [0x101fd780]
add esp, 8
mov dword [esi + 8], edi
mov dword [esi + 4], ebx
mov eax, dword [esi]
test eax, eax
jle 0x1005e8bf
shl eax, 2
push eax
push edi
add edi, 4
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov edi, dword [esi + 8]
jmp 0x1005e8bf
cmp dword [esi + 4], 0
je 0x1005e850
mov eax, dword [esi + 8]
xor ecx, ecx
lea edi, [eax + ecx*4]
jmp 0x1005e8bf
mov eax, dword [0x10259f60]
test eax, eax
je 0x1005e85f
inc dword [eax + 0x36c]
push dword [0x10259f68]
push 0x20
call dword [0x101fd77c]
add esp, 8
mov edi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e8b0
mov ecx, dword [esi]
shl ecx, 2
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e8a0
mov ecx, dword [0x10259f60]
test ecx, ecx
je 0x1005e8a0
dec dword [ecx + 0x36c]
push dword [0x10259f68]
push eax
call dword [0x101fd780]
add esp, 8
mov dword [esi + 8], edi
mov dword [esi + 4], 8
mov eax, dword [esi]
lea edi, [edi + eax*4]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [edi], eax
inc dword [esi]
pop esi
pop edi
pop ebx
ret 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005ee30
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [0x10259f60]
mov edi, dword [eax + 0x1b34]
test edi, edi
je 0x1005ef01
test byte [edi + 0xb], 8
jne 0x1005eefc
mov edx, dword [eax + 0x19b0]
mov ebx, edx
nop dword [eax]
test ebx, ebx
jle 0x1005ee77
lea esi, [ebx - 1]
mov ebp, dword [eax + 0x19b8]
cmp dword [ebp + ebx*4 - 4], edi
mov ebx, esi
jne 0x1005ee60
jmp 0x1005ee7c
mov esi, 0xffffffff
mov edi, esi
nop
add edi, ecx
js 0x1005eea7
cmp edi, edx
jge 0x1005eea7
mov ebx, dword [eax + 0x19b8]
mov ebx, dword [ebx + edi*4]
cmp byte [ebx + 0x7a], 0
je 0x1005ee80
cmp dword [ebx + 0x2f0], ebx
jne 0x1005ee80
test byte [ebx + 0xa], 8
jne 0x1005ee80
jmp 0x1005eee9
xor edi, edi
test ecx, ecx
jns 0x1005eec4
test edx, edx
jle 0x1005eef5
lea edi, [edx - 1]
jmp 0x1005eec4
add edi, ecx
js 0x1005eef5
cmp esi, edi
je 0x1005eef5
cmp edi, edx
jge 0x1005eef5
mov ebx, dword [eax + 0x19b8]
mov ebx, dword [ebx + edi*4]
cmp byte [ebx + 0x7a], 0
je 0x1005eec0
cmp dword [ebx + 0x2f0], ebx
jne 0x1005eec0
test byte [ebx + 0xa], 8
jne 0x1005eec0
mov dword [eax + 0x1b38], ebx
mov dword [eax + 0x1b34], ebx
mov byte [eax + 0x1b48], 0
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005f7f0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [ecx + 8]
test eax, eax
je 0x1005f81a
mov dword [esi + 4], 0
mov dword [esi], 0
push eax
call fcn.10048500
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1005f83f
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
push eax
call fcn.10048500
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1005f864
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
push eax
call fcn.10048500
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1005f89e
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
push eax
call fcn.10048500
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1005f8c3
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
push eax
call fcn.10048500
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1005f8e8
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
push eax
call fcn.10048500
add esp, 4
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 1
cmp dword [esi + 0x68], 0
jle 0x1005fa0c
mov eax, dword [esi + 0x70]
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0x68]
test eax, eax
jle 0x1005fa36
mov edi, dword [esi + 0x70]
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x1005f954
mov dword [edi + 4], 0
mov dword [edi], 0
push ecx
call fcn.10048500
add esp, 4
mov dword [edi + 8], 0
mov eax, dword [esi + 0x68]
test eax, eax
jle 0x1005fa36
mov edi, dword [esi + 0x70]
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x1005f97f
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
push ecx
call fcn.10048500
add esp, 4
mov dword [edi + 0x14], 0
mov eax, dword [esi + 0x68]
cmp eax, 2
jl 0x1005fa0c
mov edi, 1
xor ebx, ebx
jmp 0x1005f9a8
inc edi
add ebx, 0x18
cmp edi, eax
jge 0x1005fa0c
cmp eax, edi
jle 0x1005fa36
mov ebp, dword [esi + 0x70]
mov ecx, dword [ebp + ebx + 0x20]
test ecx, ecx
je 0x1005f9df
mov dword [ebp + ebx + 0x1c], 0
mov dword [ebp + ebx + 0x18], 0
push ecx
call fcn.10048500
add esp, 4
mov dword [ebp + ebx + 0x20], 0
mov eax, dword [esi + 0x68]
cmp eax, edi
jle 0x1005fa36
mov ebp, dword [esi + 0x70]
mov ecx, dword [ebp + ebx + 0x2c]
test ecx, ecx
je 0x1005f9a0
xorps xmm0, xmm0
movlps qword [ebp + ebx + 0x24], xmm0
push ecx
call fcn.10048500
add esp, 4
mov dword [ebp + ebx + 0x2c], 0
mov eax, dword [esi + 0x68]
jmp 0x1005f9a0
mov eax, dword [esi + 0x70]
test eax, eax
je 0x1005fa31
mov dword [esi + 0x6c], 0
mov dword [esi + 0x68], 0
push eax
call fcn.10048500
add esp, 4
mov dword [esi + 0x70], 0
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005fb40
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov eax, dword [0x10259d1c]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x3c]
lea edx, [ecx - 1]
shl edx, 4
add edx, dword [esi + 0x44]
add eax, 0x14
cmp ecx, 1
cmovae eax, edx
movdqu xmm0, xmmword [eax]
movdqu xmmword [esp + 8], xmm0
mov ebx, dword [esi]
test ebx, ebx
jle 0x1005fbbc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1005fbbc
lea edi, [ebx - 1]
mov dword [esp + 4], edi
shl edi, 5
lea edx, [ecx + edi]
mov ebp, dword [edx]
mov dword [esp], ebp
test ebp, ebp
je 0x1005fbb5
movdqu xmm0, xmmword [ecx + edi + 4]
movdqu xmm1, xmmword [esp + 8]
pcmpeqb xmm1, xmm0
pmovmskb ebp, xmm1
cmp ebp, 0xffff
jne 0x1005fbbc
cmp dword [ecx + edi + 0x18], 0
je 0x1005fbd5
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10155bf1
mov ecx, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1005fa40
add edx, 0xffffffe0
xor ebp, ebp
cmp ebx, 2
cmovae ebp, edx
cmp dword [esp], 0
jne 0x1005fc2b
cmp ebx, 2
jb 0x1005fc2b
movdqu xmm0, xmmword [ebp + 4]
movdqu xmm1, xmmword [esp + 8]
pcmpeqb xmm1, xmm0
pmovmskb edx, xmm1
cmp edx, 0xffff
jne 0x1005fc2b
mov edx, dword [ebp + 0x14]
mov ebx, dword [esi + 0x48]
test ebx, ebx
je 0x1005fc1f
mov dword [esp], ebp
mov ebp, dword [esi + 0x50]
mov ebx, dword [ebp + ebx*4 - 4]
mov ebp, dword [esp]
jmp 0x1005fc21
xor ebx, ebx
cmp edx, ebx
jne 0x1005fc2b
cmp dword [ebp + 0x18], 0
je 0x1005fc48
movdqu xmm0, xmmword [eax]
movdqu xmmword [ecx + edi + 4], xmm0
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10155bf1
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
mov dword [esi], eax
jmp 0x1005fc35
Function at 0x1005fc50
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x3c]
lea edx, [ecx - 1]
shl edx, 4
add edx, dword [esi + 0x44]
add eax, 0x14
cmp ecx, 1
cmovae eax, edx
movups xmm2, xmmword [eax]
mov eax, dword [esi + 0x48]
test eax, eax
je 0x1005fa74
mov ecx, dword [esi + 0x50]
mov ebx, dword [ecx + eax*4 - 4]
jmp 0x1005fa76
xor ebx, ebx
movaps xmm0, xmm2
unpckhpd xmm0, xmm2
ucomiss xmm0, xmm2
jb 0x1005fb38
movaps xmm0, xmm2
shufps xmm0, xmm2, 0x55
movaps xmm1, xmm2
shufps xmm1, xmm2, 0xff
ucomiss xmm1, xmm0
jb 0x1005fb38
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jne 0x1005fb08
lea ebp, [eax + 1]
test eax, eax
je 0x1005fab8
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x1005fabd
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x1005fb08
movups xmmword [esp], xmm2
mov eax, ebp
shl eax, 5
push eax
call fcn.100484d0
add esp, 4
mov edi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1005fafc
mov ecx, dword [esi]
shl ecx, 5
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esi + 8]
call fcn.10048500
add esp, 4
mov dword [esi + 8], edi
mov dword [esi + 4], ebp
mov eax, dword [esi]
movups xmm2, xmmword [esp]
mov ecx, dword [esi + 8]
shl eax, 5
mov dword [ecx + eax], 0
movups xmmword [ecx + eax + 4], xmm2
mov dword [ecx + eax + 0x14], ebx
mov dword [ecx + eax + 0x1c], 0
mov dword [ecx + eax + 0x18], 0
inc dword [esi]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ecx + 0x48]
test eax, eax
je 0x1005fc67
mov edx, dword [ecx + 0x50]
mov eax, dword [edx + eax*4 - 4]
jmp 0x1005fc69
xor eax, eax
mov ebx, dword [ecx]
test ebx, ebx
je 0x1005fc9c
jle 0x1005fd28
mov edx, dword [ecx + 8]
test edx, edx
je 0x1005fc9c
lea edi, [ebx - 1]
mov dword [esp + 8], edi
shl edi, 5
lea esi, [edx + edi]
mov ebp, dword [esi]
test ebp, ebp
je 0x1005fc95
cmp dword [edx + edi + 0x14], eax
jne 0x1005fc9c
cmp dword [edx + edi + 0x18], 0
je 0x1005fca8
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1005fa40
add esi, 0xffffffe0
mov dword [esp], 0
cmp ebx, 2
mov dword [esp + 4], eax
mov eax, dword [esp]
cmovae eax, esi
mov dword [esp], eax
mov eax, dword [esp + 4]
mov esi, dword [esp]
test ebp, ebp
jne 0x1005fd14
cmp ebx, 2
jb 0x1005fd14
cmp dword [esi + 0x14], eax
jne 0x1005fd14
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x3c]
lea ebp, [ebx - 1]
shl ebp, 4
add ebp, dword [ecx + 0x44]
add esi, 0x14
cmp ebx, 1
cmovae esi, ebp
mov ebx, dword [esp]
movdqu xmm0, xmmword [ebx + 4]
movdqu xmm1, xmmword [esi]
pcmpeqb xmm1, xmm0
pmovmskb esi, xmm1
cmp esi, 0xffff
mov esi, dword [esp]
jne 0x1005fd14
cmp dword [esi + 0x18], 0
je 0x1005fd20
mov dword [edx + edi + 0x14], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 8]
mov dword [ecx], eax
jmp 0x1005fd18
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
Function at 0x1005fe80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 0x3c]
test eax, eax
jle 0x1005fe90
dec eax
mov dword [ecx + 0x3c], eax
jmp fcn.1005fb40
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1005ff30
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 0x48]
test eax, eax
jle 0x1005ff40
dec eax
mov dword [ecx + 0x48], eax
jmp fcn.1005fc50
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10062400
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x10259d1c]
xor eax, esp
mov dword [esp + 0x38], eax
cmp dword [esp + 0x5c], 0x1000000
jb 0x10062536
mov esi, ecx
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x60]
test eax, eax
je 0x10062437
cmp eax, edi
jne 0x10062449
jmp 0x10062536
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, edi
cmp eax, edi
je 0x10062536
movss xmm0, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
test ecx, ecx
jne 0x1006245d
mov ecx, dword [esi + 0x28]
mov ecx, dword [ecx + 8]
xorps xmm1, xmm1
ucomiss xmm0, xmm1
jne 0x1006246f
jp 0x1006246f
mov edx, dword [esi + 0x28]
movss xmm0, dword [edx + 0xc]
mov edx, dword [esi + 0x48]
test edx, edx
jle 0x1006254b
mov ebx, dword [ecx + 0x38]
mov ebx, dword [ebx + 8]
mov ebp, dword [esi + 0x50]
cmp ebx, dword [ebp + edx*4 - 4]
jne 0x1006254b
mov ebx, dword [esi + 0x3c]
test ebx, ebx
jle 0x1006254b
mov ebp, dword [esp + 0x6c]
movss xmm1, dword [esp + 0x68]
mov edx, dword [esp + 0x58]
mov edi, dword [esi + 0x44]
shl ebx, 4
movups xmm2, xmmword [ebx + edi - 0x10]
movups xmmword [esp + 0x28], xmm2
test ebp, ebp
je 0x100624e3
movups xmm2, xmmword [ebp]
movups xmm3, xmmword [esp + 0x28]
movaps xmm4, xmm2
cmpleps xmm4, xmm3
movaps xmm5, xmm3
cmpltps xmm5, xmm2
movsd xmm5, xmm4
andps xmm3, xmm5
andnps xmm5, xmm2
orps xmm5, xmm3
movups xmmword [esp + 0x28], xmm5
xor ebx, ebx
test ebp, ebp
setne bl
movss xmm2, dword [edx]
movss xmm3, dword [edx + 4]
mov dword [esp + 0x24], ebx
movss dword [esp + 0x20], xmm1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
movss dword [esp + 0xc], xmm3
movss dword [esp + 8], xmm2
movss dword [esp + 4], xmm0
mov dword [esp], esi
call fcn.10062560
sub esp, 0x28
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10155bf1
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
mov dword [esp], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100631f0
Capabilities:
Terminate process

Disassembly:
push esi
cmp byte [ecx], 0
jne 0x10063228
mov esi, ecx
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x10063208
push eax
call fcn.10048500
add esp, 4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10063218
push eax
call fcn.10048500
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
Function at 0x10063a60
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x78
mov eax, dword [0x10259d1c]
xor eax, esp
mov dword [esp + 0x74], eax
cmp byte [ecx], 0
jne 0x10063ac9
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x10063ad1
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esp], xmm0
mov edx, dword [eax + 0x70]
mov dword [esp + 0x70], edx
movups xmm0, xmmword [eax + 0x60]
movups xmmword [esp + 0x60], xmm0
movups xmm0, xmmword [eax + 0x50]
movups xmmword [esp + 0x50], xmm0
movups xmm0, xmmword [eax + 0x40]
movups xmmword [esp + 0x40], xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [esp + 0x30], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm1
cmp dword [esp], 0
je 0x10063b37
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov byte [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 1
mov byte [esp + 0x1c], 0
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x7f7fffff
mov byte [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x3f800000
movups xmmword [esp + 0x48], xmm0
movups xmmword [esp + 0x58], xmm0
movups xmmword [esp + 0x64], xmm0
mov eax, dword [esp + 0x90]
movss xmm0, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
mov dword [esp], esi
mov dword [esp + 4], edx
movss dword [esp + 0x10], xmm0
test eax, eax
je 0x10063b6a
mov dword [esp + 0x30], eax
mov eax, esp
push eax
call fcn.10063650
mov esi, eax
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10155bf1
mov eax, esi
add esp, 0x78
pop esi
ret 0x14
Function at 0x10064700
Capabilities:
Terminate process

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
cmp eax, 7
ja 0x100647e3
test byte [ecx + 4], 2
jne 0x100647e3
mov edi, dword [ecx + 0x58]
cmp edi, 0xffffffff
je 0x100647ea
cmp dword [ecx + 0x40], edi
jle 0x100647ea
mov edx, dword [ecx + 0x48]
lea esi, [edi + edi*8]
lea esi, [esi + esi*2]
add esi, edi
cmp dword [edx + esi], 0x80000000
jne 0x100647ea
movd xmm2, dword [edx + esi + 8]
shl eax, 3
movsd xmm0, qword [eax + eax*2 + 0x101a9018]
movq xmm3, qword [eax + eax*2 + 0x101a9020]
movsd xmm1, qword [eax + eax*2 + 0x101a9010]
mov eax, dword [esp + 0x14]
movsd qword [eax], xmm0
mov eax, dword [esp + 0x10]
movq qword [eax], xmm3
mov eax, dword [esp + 0x18]
pxor xmm3, xmm3
punpcklwd xmm2, xmm3
cvtdq2ps xmm2, xmm2
addps xmm1, xmm2
movsd xmm2, qword [ecx + 0x24]
mulps xmm2, xmm1
movlps qword [eax], xmm2
movaps xmm2, xmm0
addps xmm2, xmm1
movsd xmm3, qword [ecx + 0x24]
mulps xmm3, xmm2
movlps qword [eax + 8], xmm3
mov eax, dword [esp + 0x1c]
movss xmm3, dword [0x101af230]
movaps xmm4, xmm1
movsd xmm5, qword [ecx + 0x24]
addss xmm1, xmm3
mulps xmm1, xmm5
movlps qword [eax], xmm1
movsd xmm1, qword [ecx + 0x24]
addss xmm4, xmm3
addss xmm4, xmm0
movss xmm2, xmm4
mulps xmm2, xmm1
movlps qword [eax + 8], xmm2
mov al, 1
jmp 0x100647e5
xor eax, eax
pop esi
pop edi
ret 0x14
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10068da0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x50
mov eax, dword [esp + 0x54]
movss xmm0, dword [esp + 0x58]
shufps xmm0, xmm0, 0
movups xmmword [esp + 0x40], xmm0
movdqa xmm0, xmmword [0x101af270]
movdqa xmm7, xmmword [str._b_t_n_v]
movdqa xmm1, xmmword [0x101af290]
movaps xmm5, xmmword [0x101af2a0]
xor ecx, ecx
nop word [eax + eax]
movups xmmword [esp + 0x30], xmm5
movdqu xmmword [esp], xmm1
movdqu xmmword [esp + 0x10], xmm7
movdqu xmmword [esp + 0x20], xmm0
movups xmm1, xmmword [esp]
movaps xmm0, xmmword [0x101af2b0]
andps xmm1, xmm0
movaps xmm3, xmmword [0x101af2c0]
orps xmm1, xmm3
movdqu xmm6, xmmword [esp]
psrld xmm6, 0x10
movdqa xmm4, xmmword [0x101af2d0]
por xmm6, xmm4
movaps xmm2, xmmword [0x101af2e0]
subps xmm6, xmm2
movaps xmm7, xmm2
addps xmm6, xmm1
movaps xmm1, xmm5
andps xmm1, xmm0
orps xmm1, xmm3
movdqu xmm5, xmmword [esp + 0x30]
psrld xmm5, 0x10
por xmm5, xmm4
subps xmm5, xmm2
addps xmm5, xmm1
movups xmm2, xmmword [esp + 0x20]
andps xmm2, xmm0
orps xmm2, xmm3
movdqu xmm1, xmmword [esp + 0x20]
psrld xmm1, 0x10
por xmm1, xmm4
subps xmm1, xmm7
addps xmm1, xmm2
movups xmm7, xmmword [esp + 0x10]
andps xmm7, xmm0
orps xmm7, xmm3
movdqu xmm2, xmmword [esp + 0x10]
psrld xmm2, 0x10
por xmm2, xmm4
subps xmm2, xmmword [0x101af2e0]
addps xmm2, xmm7
movups xmm0, xmmword [esp + 0x40]
mulps xmm2, xmm0
mulps xmm1, xmm0
mulps xmm5, xmm0
mulps xmm6, xmm0
cvttps2dq xmm0, xmm6
movdqa xmm7, xmm0
psrad xmm7, 0x1f
movaps xmm4, xmmword [0x101af2f0]
subps xmm6, xmm4
cvttps2dq xmm6, xmm6
pand xmm6, xmm7
por xmm6, xmm0
cvttps2dq xmm0, xmm5
movdqa xmm7, xmm0
psrad xmm7, 0x1f
subps xmm5, xmm4
cvttps2dq xmm5, xmm5
pand xmm5, xmm7
por xmm5, xmm0
cvttps2dq xmm3, xmm1
movdqa xmm0, xmm3
psrad xmm0, 0x1f
subps xmm1, xmm4
cvttps2dq xmm7, xmm1
pand xmm7, xmm0
por xmm7, xmm3
cvttps2dq xmm0, xmm2
movdqa xmm1, xmm0
psrad xmm1, 0x1f
subps xmm2, xmm4
cvttps2dq xmm2, xmm2
pand xmm2, xmm1
por xmm2, xmm0
movdqa xmm0, xmm2
movdqa xmm3, xmmword [0x101a87e0]
pxor xmm0, xmm3
movdqa xmm4, xmmword [0x101af300]
movdqa xmm1, xmm4
pcmpgtd xmm1, xmm0
pand xmm2, xmm1
movdqa xmm0, xmmword [0x101af310]
pandn xmm1, xmm0
por xmm1, xmm2
movdqa xmm0, xmm7
pxor xmm0, xmm3
movdqa xmm2, xmm4
pcmpgtd xmm2, xmm0
pand xmm7, xmm2
pandn xmm2, xmmword [0x101af310]
por xmm2, xmm7
movdqu xmm7, xmmword [esp + 0x10]
packuswb xmm1, xmm2
movdqa xmm0, xmm5
pxor xmm0, xmm3
movdqa xmm2, xmm4
pcmpgtd xmm2, xmm0
pand xmm5, xmm2
movdqa xmm0, xmmword [0x101af310]
pandn xmm2, xmm0
por xmm2, xmm5
movdqu xmm5, xmmword [esp + 0x30]
movdqa xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm4
pcmpgtd xmm3, xmm0
pand xmm6, xmm3
pandn xmm3, xmmword [0x101af310]
por xmm3, xmm6
packuswb xmm2, xmm3
packuswb xmm2, xmm1
movdqu xmm1, xmmword [esp]
movdqu xmmword [eax + ecx], xmm2
movdqu xmm0, xmmword [esp + 0x20]
add ecx, 0x10
movdqa xmm2, xmmword [0x101af320]
paddd xmm5, xmm2
paddd xmm1, xmm2
paddd xmm7, xmm2
paddd xmm0, xmm2
cmp ecx, 0x100
jne 0x10068de0
add esp, 0x50
ret
Function at 0x10069660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1006eb00
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x1006983e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
test ecx, ecx
jle 0x1006983e
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
cmp ecx, 9
mov eax, 8
cmovge eax, ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], eax
shl eax, 4
mov dword [ebp - 0x10], 1
push eax
mov dword [ebp - 0x2c], ecx
call fcn.100484d0
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edi
mov ecx, edi
shl ecx, 4
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x40], 0
jle 0x10069762
xor eax, eax
xor ecx, ecx
xor edx, edx
nop dword [eax]
cmp dword [ebp - 0x28], edx
jle 0x1006983e
mov esi, dword [ebx + 0x48]
movzx esi, word [esi + ecx + 4]
mov edi, dword [ebp - 0x20]
mov word [edi + eax + 4], si
cmp dword [ebx + 0x40], edx
jle 0x1006983e
cmp dword [ebp - 0x28], edx
jle 0x1006983e
mov esi, dword [ebx + 0x48]
movzx esi, word [esi + ecx + 6]
mov edi, dword [ebp - 0x20]
mov word [edi + eax + 6], si
inc edx
add ecx, 0x1c
add eax, 0x10
cmp edx, dword [ebx + 0x40]
jl 0x10069710
mov edi, dword [ebp - 0x28]
test edi, edi
jle 0x1006983e
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, esi
push edi
call fcn.10069880
add esp, 4
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x1006978f
inc edx
add ecx, 0x10
add eax, 0x1c
cmp edx, edi
jge 0x1006981d
cmp dword [esi + ecx + 0xc], 0
je 0x10069780
cmp dword [ebx + 0x40], edx
jle 0x1006983e
movzx esi, word [esi + ecx + 8]
mov edi, dword [ebx + 0x48]
mov word [edi + eax + 8], si
cmp dword [ebp - 0x28], edx
jle 0x1006983e
cmp dword [ebx + 0x40], edx
jle 0x1006983e
mov esi, dword [ebp - 0x20]
movzx esi, word [esi + ecx + 0xa]
mov edi, dword [ebx + 0x48]
mov word [edi + eax + 0xa], si
mov esi, dword [ebp - 0x28]
cmp esi, edx
jle 0x1006983e
mov dword [ebp - 0x2c], esi
cmp dword [ebx + 0x40], edx
jle 0x1006983e
mov esi, dword [ebp - 0x20]
movzx edi, word [esi + ecx + 4]
mov ebx, dword [ebx + 0x48]
cmp di, word [ebx + eax + 4]
jne 0x1006983e
movzx edi, word [esi + ecx + 6]
cmp di, word [ebx + eax + 6]
jne 0x1006983e
movzx ebx, word [esi + ecx + 0xa]
add ebx, edi
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x20]
cmp edi, ebx
cmovg ebx, edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x20], ebx
mov ebx, edi
mov edi, dword [ebp - 0x2c]
jmp 0x10069780
mov dword [ebp - 0x10], 0
push esi
call fcn.10048500
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop word cs:[eax + eax]
push ebp
sub esp, 0xc
add ebp, 0xc
lea ecx, [ebp - 0x28]
call fcn.1005f130
add esp, 0xc
pop ebp
ret