joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d540
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
test eax, eax
mov ebp, 1
cmovne ebp, eax
test esi, esi
je 0x1005d777
mov edi, dword [0x10258f60]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0x21
jae 0x1005d777
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1005d587
test ebx, ebx
jne 0x1005d597
test ecx, ecx
jne 0x1005d777
test ebx, ebx
jne 0x1005d777
lea eax, [ebp - 1]
cmp eax, 2
jae 0x1005d777
cmp dword [edi + 0x1cd8], 0
je 0x1005d777
cmp ebp, 1
je 0x1005d5c2
cmp dword [edi + 0x1ce0], 0xffffffff
jne 0x1005d744
mov ebp, ecx
lea eax, [edi + 0x1ce4]
push 0x20
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [edi + 0x1d04], 0
mov eax, dword [edi + 0x1d34]
test eax, eax
jns 0x1005d657
inc dword [edi + 0x36c]
push dword [0x10258f68]
push 0
call dword [0x101fc77c]
add esp, 8
mov esi, eax
mov eax, dword [edi + 0x1d38]
test eax, eax
je 0x1005d645
push dword [edi + 0x1d30]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 0x1d38]
test eax, eax
je 0x1005d635
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005d635
dec dword [ecx + 0x36c]
push dword [0x10258f68]
push eax
call dword [0x101fc780]
add esp, 8
mov dword [edi + 0x1d38], esi
mov dword [edi + 0x1d34], 0
xor eax, eax
mov dword [edi + 0x1d30], 0
cmp ebx, 9
jb 0x1005d70f
cmp eax, ebx
jge 0x1005d701
mov ecx, eax
shr ecx, 1
add ecx, eax
test eax, eax
mov esi, 8
cmovne esi, ecx
cmp esi, ebx
cmovle esi, ebx
cmp eax, esi
jae 0x1005d701
mov eax, dword [0x10258f60]
test eax, eax
je 0x1005d69a
inc dword [eax + 0x36c]
push dword [0x10258f68]
push esi
call dword [0x101fc77c]
add esp, 8
mov ecx, dword [edi + 0x1d38]
test ecx, ecx
je 0x1005d6f5
push dword [edi + 0x1d30]
push ecx
mov dword [esp + 8], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 0x1d38]
test eax, eax
je 0x1005d6e2
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005d6e2
dec dword [ecx + 0x36c]
push dword [0x10258f68]
push eax
call dword [0x101fc780]
add esp, 8
mov eax, dword [esp]
mov dword [edi + 0x1d38], eax
mov dword [edi + 0x1d34], esi
mov dword [edi + 0x1d30], ebx
mov eax, dword [edi + 0x1d38]
jmp 0x1005d72d
test ebx, ebx
je 0x1005d76b
lea eax, [edi + 0x1d3c]
mov dword [edi + 0x1d40], 0
mov dword [edi + 0x1d3c], 0
mov dword [edi + 0x1cd0], eax
push ebx
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + 0x1cd4], ebx
mov eax, dword [edi + 0x1998]
mov dword [edi + 0x1ce0], eax
mov ecx, dword [edi + 0x1d2c]
cmp ecx, eax
sete dl
dec eax
cmp ecx, eax
sete al
or al, dl
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [edi + 0x1cd0], 0
jmp 0x1005d73e
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005d780
Capabilities:
Terminate process

Disassembly:
push edi
push esi
mov esi, dword [0x10258f60]
cmp byte [esi + 0x1cc0], 0
je 0x1005d7dd
mov ecx, dword [esi + 0x19e4]
mov eax, dword [ecx + 0x110]
test al, 1
je 0x1005d7dd
mov edx, dword [esi + 0x19e8]
test edx, edx
je 0x1005d7dd
mov edi, dword [ecx + 0x2f0]
cmp edi, dword [edx + 0x2f0]
jne 0x1005d7dd
and eax, 2
lea edi, [ecx + eax*8]
add edi, 0x114
mov eax, dword [ecx + 0x10c]
test eax, eax
jne 0x1005d7d5
push edi
call fcn.1004b890
cmp dword [esi + 0x1cd8], eax
jne 0x1005d7e2
xor eax, eax
pop esi
pop edi
ret
cmp byte [esi + 0x1cc1], 0
jne 0x1005d806
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x1d08], xmm0
mov dword [esi + 0x1d18], eax
mov byte [esi + 0x1cc1], 1
mov al, 1
jmp 0x1005d7df
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005dbb0
Capabilities:
Hash data with crc32
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [0x10258f60]
mov eax, dword [edi + 0x2cb0]
cmp eax, dword [edi + 0x2cb4]
jne 0x1005dc70
lea ebx, [eax + 1]
test eax, eax
je 0x1005dbe3
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x1005dbe8
mov ecx, 8
cmp ecx, ebx
cmovg ebx, ecx
cmp eax, ebx
jge 0x1005dc70
lea eax, [ebx + ebx*8]
lea eax, [eax + eax*2]
add eax, ebx
inc dword [edi + 0x36c]
push dword [0x10258f68]
push eax
call dword [0x101fc77c]
add esp, 8
mov esi, eax
mov eax, dword [edi + 0x2cb8]
test eax, eax
je 0x1005dc5e
mov ecx, dword [edi + 0x2cb0]
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
push edx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 0x2cb8]
test eax, eax
je 0x1005dc4e
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005dc4e
dec dword [ecx + 0x36c]
push dword [0x10258f68]
push eax
call dword [0x101fc780]
add esp, 8
mov dword [edi + 0x2cb8], esi
mov dword [edi + 0x2cb4], ebx
mov eax, dword [edi + 0x2cb0]
mov ecx, dword [edi + 0x2cb8]
lea edx, [eax + eax*8]
lea edx, [edx + edx*2]
add edx, eax
xorps xmm0, xmm0
movups xmmword [ecx + edx + 9], xmm0
movups xmmword [ecx + edx], xmm0
mov ebp, dword [edi + 0x2cb0]
lea eax, [ebp + 1]
mov dword [edi + 0x2cb0], eax
test ebp, ebp
js 0x1005dd6f
mov esi, dword [esp + 0x20]
mov ecx, dword [edi + 0x2cb8]
lea eax, [ebp*8]
add eax, ebp
lea edx, [eax + eax*2]
mov dword [esp + 8], ecx
lea eax, [ecx + ebp]
mov dword [esp + 4], edx
add eax, edx
mov dword [esp], eax
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
mov eax, dword [0x10258f60]
test eax, eax
je 0x1005dce1
inc dword [eax + 0x36c]
inc edi
push dword [0x10258f68]
push edi
call dword [0x101fc77c]
add esp, 8
mov ebx, eax
push edi
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp]
mov dword [eax], ebx
movzx edx, byte [esi]
test dl, dl
je 0x1005dd54
add esi, 2
mov ecx, 0xffffffff
mov eax, 0xffffffff
jmp 0x1005dd39
movzx edi, dl
movzx ebx, al
shr eax, 8
xor ebx, edi
xor eax, dword [ebx*4 + 0x101a7104]
inc esi
mov dl, dh
test dh, dh
je 0x1005dd50
mov dh, byte [esi - 1]
cmp dl, 0x23
jne 0x1005dd20
cmp dh, 0x23
jne 0x1005dd20
cmp byte [esi], 0x23
cmove eax, ecx
mov dh, 0x23
jmp 0x1005dd20
not eax
jmp 0x1005dd56
xor eax, eax
mov edx, dword [esp + 4]
add edx, ebp
mov ecx, dword [esp + 8]
mov dword [ecx + edx + 4], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005e500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1005f0c0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
cmp dword [esi + 0xc], 0
jle 0x1005e5f6
xor ecx, ecx
mov dword [ebp - 0x20], esi
jmp 0x1005e568
mov ecx, dword [0x10258f68]
mov dword [ebp - 0x10], 1
push ecx
push eax
call dword [0x101fc780]
add esp, 8
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
inc ecx
cmp ecx, dword [esi + 0xc]
jge 0x1005e5f6
mov eax, dword [esi + 0x14]
mov eax, dword [eax + ecx*8 + 4]
cmp eax, 0xffffffff
je 0x1005e55e
cmp dword [esi], eax
jle 0x1005e6a3
mov edx, dword [esi + 8]
imul edi, eax, 0x6c
mov eax, dword [edx + edi + 0x68]
test eax, eax
mov dword [ebp - 0x24], ecx
je 0x1005e5ce
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edx
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005e5aa
dec dword [ecx + 0x36c]
mov dword [ebp - 0x10], 0
mov ecx, dword [0x10258f68]
mov dword [ebp - 0x10], 0
push ecx
push eax
call dword [0x101fc780]
add esp, 8
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov eax, dword [edx + edi + 8]
test eax, eax
je 0x1005e55e
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005e540
dec dword [ecx + 0x36c]
mov dword [ebp - 0x10], 1
jmp 0x1005e540
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1005e641
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005e622
dec dword [ecx + 0x36c]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, dword [0x10258f68]
mov dword [ebp - 0x10], 0xffffffff
push ecx
push eax
call dword [0x101fc780]
add esp, 8
mov dword [esi + 0x14], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e68b
mov dword [esi + 4], 0
mov dword [esi], 0
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005e66c
dec dword [ecx + 0x36c]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, dword [0x10258f68]
mov dword [ebp - 0x10], 0xffffffff
push ecx
push eax
call dword [0x101fc780]
add esp, 8
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop dword [eax + eax]
push ebp
sub esp, 8
add ebp, 0xc
call sub.VCRUNTIME140.dll___std_terminate
nop dword [eax]
push ebp
sub esp, 8
add ebp, 0xc
call sub.VCRUNTIME140.dll___std_terminate
int3
Function at 0x1005e780
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x1005e840
js 0x1005e8cf
mov edi, dword [esi + 8]
cmp eax, dword [esi + 4]
jne 0x1005e82a
lea ecx, [eax + 1]
mov ebx, eax
shr ebx, 1
add ebx, eax
cmp ebx, ecx
cmovle ebx, ecx
cmp eax, ebx
jae 0x1005e82a
lea eax, [ebx*4]
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005e7ca
inc dword [ecx + 0x36c]
push dword [0x10258f68]
push eax
call dword [0x101fc77c]
add esp, 8
mov edi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e81a
mov ecx, dword [esi]
shl ecx, 2
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e80a
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005e80a
dec dword [ecx + 0x36c]
push dword [0x10258f68]
push eax
call dword [0x101fc780]
add esp, 8
mov dword [esi + 8], edi
mov dword [esi + 4], ebx
mov eax, dword [esi]
test eax, eax
jle 0x1005e8bf
shl eax, 2
push eax
push edi
add edi, 4
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov edi, dword [esi + 8]
jmp 0x1005e8bf
cmp dword [esi + 4], 0
je 0x1005e850
mov eax, dword [esi + 8]
xor ecx, ecx
lea edi, [eax + ecx*4]
jmp 0x1005e8bf
mov eax, dword [0x10258f60]
test eax, eax
je 0x1005e85f
inc dword [eax + 0x36c]
push dword [0x10258f68]
push 0x20
call dword [0x101fc77c]
add esp, 8
mov edi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e8b0
mov ecx, dword [esi]
shl ecx, 2
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e8a0
mov ecx, dword [0x10258f60]
test ecx, ecx
je 0x1005e8a0
dec dword [ecx + 0x36c]
push dword [0x10258f68]
push eax
call dword [0x101fc780]
add esp, 8
mov dword [esi + 8], edi
mov dword [esi + 4], 8
mov eax, dword [esi]
lea edi, [edi + eax*4]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [edi], eax
inc dword [esi]
pop esi
pop edi
pop ebx
ret 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005ee30
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [0x10258f60]
mov edi, dword [eax + 0x1b34]
test edi, edi
je 0x1005ef01
test byte [edi + 0xb], 8
jne 0x1005eefc
mov edx, dword [eax + 0x19b0]
mov ebx, edx
nop dword [eax]
test ebx, ebx
jle 0x1005ee77
lea esi, [ebx - 1]
mov ebp, dword [eax + 0x19b8]
cmp dword [ebp + ebx*4 - 4], edi
mov ebx, esi
jne 0x1005ee60
jmp 0x1005ee7c
mov esi, 0xffffffff
mov edi, esi
nop
add edi, ecx
js 0x1005eea7
cmp edi, edx
jge 0x1005eea7
mov ebx, dword [eax + 0x19b8]
mov ebx, dword [ebx + edi*4]
cmp byte [ebx + 0x7a], 0
je 0x1005ee80
cmp dword [ebx + 0x2f0], ebx
jne 0x1005ee80
test byte [ebx + 0xa], 8
jne 0x1005ee80
jmp 0x1005eee9
xor edi, edi
test ecx, ecx
jns 0x1005eec4
test edx, edx
jle 0x1005eef5
lea edi, [edx - 1]
jmp 0x1005eec4
add edi, ecx
js 0x1005eef5
cmp esi, edi
je 0x1005eef5
cmp edi, edx
jge 0x1005eef5
mov ebx, dword [eax + 0x19b8]
mov ebx, dword [ebx + edi*4]
cmp byte [ebx + 0x7a], 0
je 0x1005eec0
cmp dword [ebx + 0x2f0], ebx
jne 0x1005eec0
test byte [ebx + 0xa], 8
jne 0x1005eec0
mov dword [eax + 0x1b38], ebx
mov dword [eax + 0x1b34], ebx
mov byte [eax + 0x1b48], 0
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005fb40
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov eax, dword [0x10258d1c]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x3c]
lea edx, [ecx - 1]
shl edx, 4
add edx, dword [esi + 0x44]
add eax, 0x14
cmp ecx, 1
cmovae eax, edx
movdqu xmm0, xmmword [eax]
movdqu xmmword [esp + 8], xmm0
mov ebx, dword [esi]
test ebx, ebx
jle 0x1005fbbc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1005fbbc
lea edi, [ebx - 1]
mov dword [esp + 4], edi
shl edi, 5
lea edx, [ecx + edi]
mov ebp, dword [edx]
mov dword [esp], ebp
test ebp, ebp
je 0x1005fbb5
movdqu xmm0, xmmword [ecx + edi + 4]
movdqu xmm1, xmmword [esp + 8]
pcmpeqb xmm1, xmm0
pmovmskb ebp, xmm1
cmp ebp, 0xffff
jne 0x1005fbbc
cmp dword [ecx + edi + 0x18], 0
je 0x1005fbd5
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10155ad1
mov ecx, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1005fa40
add edx, 0xffffffe0
xor ebp, ebp
cmp ebx, 2
cmovae ebp, edx
cmp dword [esp], 0
jne 0x1005fc2b
cmp ebx, 2
jb 0x1005fc2b
movdqu xmm0, xmmword [ebp + 4]
movdqu xmm1, xmmword [esp + 8]
pcmpeqb xmm1, xmm0
pmovmskb edx, xmm1
cmp edx, 0xffff
jne 0x1005fc2b
mov edx, dword [ebp + 0x14]
mov ebx, dword [esi + 0x48]
test ebx, ebx
je 0x1005fc1f
mov dword [esp], ebp
mov ebp, dword [esi + 0x50]
mov ebx, dword [ebp + ebx*4 - 4]
mov ebp, dword [esp]
jmp 0x1005fc21
xor ebx, ebx
cmp edx, ebx
jne 0x1005fc2b
cmp dword [ebp + 0x18], 0
je 0x1005fc48
movdqu xmm0, xmmword [eax]
movdqu xmmword [ecx + edi + 4], xmm0
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10155ad1
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
mov dword [esi], eax
jmp 0x1005fc35
Function at 0x10062400
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x10258d1c]
xor eax, esp
mov dword [esp + 0x38], eax
cmp dword [esp + 0x5c], 0x1000000
jb 0x10062536
mov esi, ecx
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x60]
test eax, eax
je 0x10062437
cmp eax, edi
jne 0x10062449
jmp 0x10062536
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, edi
cmp eax, edi
je 0x10062536
movss xmm0, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
test ecx, ecx
jne 0x1006245d
mov ecx, dword [esi + 0x28]
mov ecx, dword [ecx + 8]
xorps xmm1, xmm1
ucomiss xmm0, xmm1
jne 0x1006246f
jp 0x1006246f
mov edx, dword [esi + 0x28]
movss xmm0, dword [edx + 0xc]
mov edx, dword [esi + 0x48]
test edx, edx
jle 0x1006254b
mov ebx, dword [ecx + 0x38]
mov ebx, dword [ebx + 8]
mov ebp, dword [esi + 0x50]
cmp ebx, dword [ebp + edx*4 - 4]
jne 0x1006254b
mov ebx, dword [esi + 0x3c]
test ebx, ebx
jle 0x1006254b
mov ebp, dword [esp + 0x6c]
movss xmm1, dword [esp + 0x68]
mov edx, dword [esp + 0x58]
mov edi, dword [esi + 0x44]
shl ebx, 4
movups xmm2, xmmword [ebx + edi - 0x10]
movups xmmword [esp + 0x28], xmm2
test ebp, ebp
je 0x100624e3
movups xmm2, xmmword [ebp]
movups xmm3, xmmword [esp + 0x28]
movaps xmm4, xmm2
cmpleps xmm4, xmm3
movaps xmm5, xmm3
cmpltps xmm5, xmm2
movsd xmm5, xmm4
andps xmm3, xmm5
andnps xmm5, xmm2
orps xmm5, xmm3
movups xmmword [esp + 0x28], xmm5
xor ebx, ebx
test ebp, ebp
setne bl
movss xmm2, dword [edx]
movss xmm3, dword [edx + 4]
mov dword [esp + 0x24], ebx
movss dword [esp + 0x20], xmm1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
movss dword [esp + 0xc], xmm3
movss dword [esp + 8], xmm2
movss dword [esp + 4], xmm0
mov dword [esp], esi
call fcn.10062560
sub esp, 0x28
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10155ad1
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
mov dword [esp], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10063a60
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x78
mov eax, dword [0x10258d1c]
xor eax, esp
mov dword [esp + 0x74], eax
cmp byte [ecx], 0
jne 0x10063ac9
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x10063ad1
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esp], xmm0
mov edx, dword [eax + 0x70]
mov dword [esp + 0x70], edx
movups xmm0, xmmword [eax + 0x60]
movups xmmword [esp + 0x60], xmm0
movups xmm0, xmmword [eax + 0x50]
movups xmmword [esp + 0x50], xmm0
movups xmm0, xmmword [eax + 0x40]
movups xmmword [esp + 0x40], xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [esp + 0x30], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm1
cmp dword [esp], 0
je 0x10063b37
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov byte [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 1
mov byte [esp + 0x1c], 0
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x7f7fffff
mov byte [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x3f800000
movups xmmword [esp + 0x48], xmm0
movups xmmword [esp + 0x58], xmm0
movups xmmword [esp + 0x64], xmm0
mov eax, dword [esp + 0x90]
movss xmm0, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
mov dword [esp], esi
mov dword [esp + 4], edx
movss dword [esp + 0x10], xmm0
test eax, eax
je 0x10063b6a
mov dword [esp + 0x30], eax
mov eax, esp
push eax
call fcn.10063650
mov esi, eax
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10155ad1
mov eax, esi
add esp, 0x78
pop esi
ret 0x14
Function at 0x10064700
Capabilities:
Terminate process

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
cmp eax, 7
ja 0x100647e3
test byte [ecx + 4], 2
jne 0x100647e3
mov edi, dword [ecx + 0x58]
cmp edi, 0xffffffff
je 0x100647ea
cmp dword [ecx + 0x40], edi
jle 0x100647ea
mov edx, dword [ecx + 0x48]
lea esi, [edi + edi*8]
lea esi, [esi + esi*2]
add esi, edi
cmp dword [edx + esi], 0x80000000
jne 0x100647ea
movd xmm2, dword [edx + esi + 8]
shl eax, 3
movsd xmm0, qword [eax + eax*2 + 0x101a8018]
movq xmm3, qword [eax + eax*2 + 0x101a8020]
movsd xmm1, qword [eax + eax*2 + 0x101a8010]
mov eax, dword [esp + 0x14]
movsd qword [eax], xmm0
mov eax, dword [esp + 0x10]
movq qword [eax], xmm3
mov eax, dword [esp + 0x18]
pxor xmm3, xmm3
punpcklwd xmm2, xmm3
cvtdq2ps xmm2, xmm2
addps xmm1, xmm2
movsd xmm2, qword [ecx + 0x24]
mulps xmm2, xmm1
movlps qword [eax], xmm2
movaps xmm2, xmm0
addps xmm2, xmm1
movsd xmm3, qword [ecx + 0x24]
mulps xmm3, xmm2
movlps qword [eax + 8], xmm3
mov eax, dword [esp + 0x1c]
movss xmm3, dword [0x101ae230]
movaps xmm4, xmm1
movsd xmm5, qword [ecx + 0x24]
addss xmm1, xmm3
mulps xmm1, xmm5
movlps qword [eax], xmm1
movsd xmm1, qword [ecx + 0x24]
addss xmm4, xmm3
addss xmm4, xmm0
movss xmm2, xmm4
mulps xmm2, xmm1
movlps qword [eax + 8], xmm2
mov al, 1
jmp 0x100647e5
xor eax, eax
pop esi
pop edi
ret 0x14
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10068da0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x50
mov eax, dword [esp + 0x54]
movss xmm0, dword [esp + 0x58]
shufps xmm0, xmm0, 0
movups xmmword [esp + 0x40], xmm0
movdqa xmm0, xmmword [0x101ae270]
movdqa xmm7, xmmword [str._b_t_n_v]
movdqa xmm1, xmmword [0x101ae290]
movaps xmm5, xmmword [0x101ae2a0]
xor ecx, ecx
nop word [eax + eax]
movups xmmword [esp + 0x30], xmm5
movdqu xmmword [esp], xmm1
movdqu xmmword [esp + 0x10], xmm7
movdqu xmmword [esp + 0x20], xmm0
movups xmm1, xmmword [esp]
movaps xmm0, xmmword [0x101ae2b0]
andps xmm1, xmm0
movaps xmm3, xmmword [0x101ae2c0]
orps xmm1, xmm3
movdqu xmm6, xmmword [esp]
psrld xmm6, 0x10
movdqa xmm4, xmmword [0x101ae2d0]
por xmm6, xmm4
movaps xmm2, xmmword [0x101ae2e0]
subps xmm6, xmm2
movaps xmm7, xmm2
addps xmm6, xmm1
movaps xmm1, xmm5
andps xmm1, xmm0
orps xmm1, xmm3
movdqu xmm5, xmmword [esp + 0x30]
psrld xmm5, 0x10
por xmm5, xmm4
subps xmm5, xmm2
addps xmm5, xmm1
movups xmm2, xmmword [esp + 0x20]
andps xmm2, xmm0
orps xmm2, xmm3
movdqu xmm1, xmmword [esp + 0x20]
psrld xmm1, 0x10
por xmm1, xmm4
subps xmm1, xmm7
addps xmm1, xmm2
movups xmm7, xmmword [esp + 0x10]
andps xmm7, xmm0
orps xmm7, xmm3
movdqu xmm2, xmmword [esp + 0x10]
psrld xmm2, 0x10
por xmm2, xmm4
subps xmm2, xmmword [0x101ae2e0]
addps xmm2, xmm7
movups xmm0, xmmword [esp + 0x40]
mulps xmm2, xmm0
mulps xmm1, xmm0
mulps xmm5, xmm0
mulps xmm6, xmm0
cvttps2dq xmm0, xmm6
movdqa xmm7, xmm0
psrad xmm7, 0x1f
movaps xmm4, xmmword [0x101ae2f0]
subps xmm6, xmm4
cvttps2dq xmm6, xmm6
pand xmm6, xmm7
por xmm6, xmm0
cvttps2dq xmm0, xmm5
movdqa xmm7, xmm0
psrad xmm7, 0x1f
subps xmm5, xmm4
cvttps2dq xmm5, xmm5
pand xmm5, xmm7
por xmm5, xmm0
cvttps2dq xmm3, xmm1
movdqa xmm0, xmm3
psrad xmm0, 0x1f
subps xmm1, xmm4
cvttps2dq xmm7, xmm1
pand xmm7, xmm0
por xmm7, xmm3
cvttps2dq xmm0, xmm2
movdqa xmm1, xmm0
psrad xmm1, 0x1f
subps xmm2, xmm4
cvttps2dq xmm2, xmm2
pand xmm2, xmm1
por xmm2, xmm0
movdqa xmm0, xmm2
movdqa xmm3, xmmword [0x101a77e0]
pxor xmm0, xmm3
movdqa xmm4, xmmword [0x101ae300]
movdqa xmm1, xmm4
pcmpgtd xmm1, xmm0
pand xmm2, xmm1
movdqa xmm0, xmmword [0x101ae310]
pandn xmm1, xmm0
por xmm1, xmm2
movdqa xmm0, xmm7
pxor xmm0, xmm3
movdqa xmm2, xmm4
pcmpgtd xmm2, xmm0
pand xmm7, xmm2
pandn xmm2, xmmword [0x101ae310]
por xmm2, xmm7
movdqu xmm7, xmmword [esp + 0x10]
packuswb xmm1, xmm2
movdqa xmm0, xmm5
pxor xmm0, xmm3
movdqa xmm2, xmm4
pcmpgtd xmm2, xmm0
pand xmm5, xmm2
movdqa xmm0, xmmword [0x101ae310]
pandn xmm2, xmm0
por xmm2, xmm5
movdqu xmm5, xmmword [esp + 0x30]
movdqa xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm4
pcmpgtd xmm3, xmm0
pand xmm6, xmm3
pandn xmm3, xmmword [0x101ae310]
por xmm3, xmm6
packuswb xmm2, xmm3
packuswb xmm2, xmm1
movdqu xmm1, xmmword [esp]
movdqu xmmword [eax + ecx], xmm2
movdqu xmm0, xmmword [esp + 0x20]
add ecx, 0x10
movdqa xmm2, xmmword [0x101ae320]
paddd xmm5, xmm2
paddd xmm1, xmm2
paddd xmm7, xmm2
paddd xmm0, xmm2
cmp ecx, 0x100
jne 0x10068de0
add esp, 0x50
ret