joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032fb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x10030a2e
mov byte [esp], cl
lea esp, [esp + 0x2c]
jne 0x10033889
not cl
mov ecx, edi
rcl si, 1
sub si, ax
push edx
btc si, di
sub ecx, ebx
sub esi, 0xe46bde97
btc si, 1
xor esi, edi
cmp cx, ax
lea esi, [esp + 4]
cmp bh, ch
jmp 0x1003169e
sub edi, 4
pushfd
clc
stc
cmc
push dword [edi]
pop dword [esp + 4]
push dword [esp]
pushal
clc
stc
cmp edi, ebx
pushfd
lea esp, [esp + 0x2c]
ja 0x10033607
sub al, bh
sub ebx, edi
cmp bl, al
xor al, cl
dec di
add al, cl
add ebx, esp
shl di, cl
mov edi, ebx
and al, 0x80
not al
mov al, 0x2e
push 0x8acaace2
call fcn.10032457
add byte [eax], al
push esp
insb byte es:[edi], dx
jae 0x10031729
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
daa
pop eax
inc edx
clc
repne scasb al, byte es:[edi]
pushfd
jmp 0x10023d05

Function at 0x10033431
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx di, cl
mov edi, edx
stc
jmp 0x1003142c
bt bp, si
test eax, edi
mov dword [ebp - 0x10], ecx
cmc
bt bp, 0xf
seta ch
sar cx, 3
mov ecx, dword [ebp + 0xc]
push 0xff81364
cmc
cmp ecx, 0xffff
pushal
pushfd
lea esp, [esp + 0x28]
jbe 0x100317b4
stc
sal ch, cl
mov edi, dword [edx + 0x24]
bsr bx, ax
rcr ch, cl
adc ch, bl
add edi, eax
adc bx, bx
mov ebx, dword [edx + 0x20]
dec cl
and cx, cx
mov ch, ah
stc
add ebx, eax
bsf ecx, edx
ror ch, cl
push 0xf1097986
test edx, edx
mov dword [ebp - 8], 0
dec cl
xor ecx, 0xbc462ab1
mov ecx, dword [edx + 0x18]
sub esp, 0xfffffffc
cmp dh, dl
call fcn.10032180
rcl al, 5
mov al, byte [edi]
stc
test al, al
pushal
lea esp, [esp + 0x20]
je 0x10020369
test cl, al
cmp eax, 0x7977c0d4
pushfd
sub al, 0x30
cmp dl, 0xf8
mov byte [esp], ah
call fcn.10032c3d
pushal
movzx ecx, word [edi + ecx*2]
or edi, 0xe37fcfaa
sub edi, 0xcd9479c2
btr edi, 0x1c
stc
mov edi, dword [edx + 0x1c]
test ax, 0x16cc
jmp 0x10030b17
adc al, al
mov dword [esp], ebp
pushfd
call fcn.10031a77
pop edi
popal
or al, 0xb7
into
call 0x8e8dab1b
in al, dx
cmc
jl 0x1002fd62
rol byte [ecx + 8], cl
jnp 0x1002fd66
mov ebp, 0x855adf38
movsb byte es:[edi], byte [esi]
lds edi, [ebp - 0x33]
push edi
pop ecx
in eax, 0x82
cmp eax, 0x55bbbd34
ror ecx, cl
leave
push 0x8e3d82c7
sbb byte [ecx], 0x54
mov es, word [edx + 0x228b5419]
mov esp, dword [edx]
ljmp 0xf082:0x13dcab6c
test edi, ecx
stc
add edi, eax
cmp di, 0x19d6
cmc
cmp cl, ch
mov edi, dword [edi + ecx*4]
jmp 0x10030c9f
call fcn.10033300
jmp 0x1002fd2a
mov ecx, edi
lea esp, [esp + 0x20]
je 0x10033889
bsf ecx, esi
adc cx, 0x9a92
sub cl, dh
add edx, eax
xor ch, ah
bsf cx, di
mov ecx, dword [esi + 0x7c]
cmc
test di, 0x5b18
add ecx, edx
jmp 0x1002fa0e
mov edx, dword [esi + 0x78]
bt dx, 3
stc
test edx, edx
mov byte [esp], 0xab
lea esp, [esp + 4]
jbe 0x100342e2
pushal
jmp 0x100326fa
Function at 0x401460
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::size___const
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x10057420
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
push ebx
push eax
call fcn.10058d00
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10057489
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x12f684b
je 0x1005763c
push 0xd8
call fcn.1009af98
mov ecx, dword ds:[ebx]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
push 0xcc
mov dword [esi + 8], ecx
lea ecx, [esi + 0xc]
push 0
push ecx
call fcn.100b0160
mov dword [esi + 0xa4], 0
add esp, 0xc
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc ecx
mov eax, ecx
movss xmm2, dword [edi]
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x102fe2b0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x102fe2b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm2
seta al
test al, al
je 0x100575cf
movd xmm0, ecx
sub esp, 8
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x102fe2b0]
cvtpd2ps xmm0, xmm0
divss xmm0, xmm2
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.100e9ff0
add esp, 8
fstp dword [ebp - 4]
movss xmm0, dword [ebp - 4]
call fcn.10113d90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100575b1
nop dword [eax + eax]
cmp ebx, 0x200
jae 0x100575af
shl ebx, 3
cmp ebx, ecx
jae 0x100575b1
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100580e0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.10058d00
mov edx, dword [eax]
jmp 0x100575d2
mov edx, dword [ebp - 8]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi + 4]
mov esi, dword [ebp - 0xc]
jne 0x100575fb
mov dword [ecx + eax*8], esi
jmp 0x10057626
nop dword [eax + eax]
cmp dword [ecx + eax*8], edx
jne 0x1005761a
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
nop word [eax + eax]
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1005762a
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10076d2b
int3
Function at 0x100580e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x10058255
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10056c00
lea eax, ds:[edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10058228
nop dword [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x100581a2
mov dword ds:[edx], eax
mov dword [edx + 4], eax
jmp 0x10058216
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x100581dc
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x100581d4
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x10058213
nop dword [eax]
cmp edi, edx
je 0x100581f0
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10058231
cmp edi, edx
jne 0x100581e4
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10058150
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10058213
push str.invalid_hash_bucket_count
call fcn.10076d2b
int3

Function at 0x10059900
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x1005992b
mov edx, dword [ebp + 8]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10059914
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret
Function at 0x1009da50
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acef6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x103060c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x2c]
mov dword [ebp + 8], edi
mov eax, dword [ebx]
mov dword [esi], eax
movzx eax, byte [ebx + 4]
mov byte [esi + 4], al
movzx eax, byte [ebx + 5]
mov byte [esi + 5], al
movzx eax, byte [ebx + 6]
mov byte [esi + 6], al
movzx eax, byte [ebx + 7]
mov byte [esi + 7], al
movzx eax, byte [ebx + 8]
mov byte [esi + 8], al
movzx eax, byte [ebx + 9]
mov byte [esi + 9], al
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
movzx eax, byte [ebx + 0x28]
mov byte [esi + 0x28], al
movzx eax, byte [ebx + 0x29]
mov byte [esi + 0x29], al
movzx eax, byte [ebx + 0x2a]
mov byte [esi + 0x2a], al
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebx + 0x30]
sub eax, dword [ebx + 0x2c]
je 0x1009db3b
cmp eax, 0x7fffffff
ja 0x1009dbde
push eax
mov ecx, edi
call fcn.1009eae0
mov esi, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
sub esi, eax
mov edi, dword [edi]
push esi
push eax
push edi
call fcn.100b0590
mov ecx, dword [ebp + 8]
lea eax, [esi + edi]
mov esi, dword [ebp - 0x10]
add esp, 0xc
mov dword [ecx + 4], eax
lea edi, [esi + 0x38]
mov dword [ebp - 4], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x38]
sar eax, 2
mov dword [ebp + 8], edi
test eax, eax
je 0x1009db9c
cmp eax, 0x3fffffff
ja 0x1009dbe3
push eax
mov ecx, edi
call fcn.1009ebf0
mov esi, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
sub esi, eax
mov edi, dword [edi]
push esi
push eax
push edi
call fcn.100b0590
mov ecx, dword [ebp + 8]
add esp, 0xc
sar esi, 2
lea eax, [edi + esi*4]
mov esi, dword [ebp - 0x10]
mov dword [ecx + 4], eax
lea eax, [ebx + 0x44]
mov byte [ebp - 4], 1
lea ecx, [esi + 0x44]
push eax
call fcn.100092e0
lea eax, [ebx + 0x5c]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x5c]
call fcn.100092e0
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [ebx + 0x78]
mov dword [esi + 0x78], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1009ee20
call fcn.1009ee40
int3
Function at 0x1009e1f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
movzx eax, byte [edi + 6]
mov byte [esi + 6], al
movzx eax, byte [edi + 7]
mov byte [esi + 7], al
movzx eax, byte [edi + 8]
mov byte [esi + 8], al
movzx eax, byte [edi + 9]
mov byte [esi + 9], al
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x2c]
movzx eax, byte [edi + 0x28]
mov byte [esi + 0x28], al
movzx eax, byte [edi + 0x29]
mov byte [esi + 0x29], al
movzx eax, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
lea eax, [edi + 0x2c]
push eax
call fcn.1009e090
lea eax, [edi + 0x38]
lea ecx, [esi + 0x38]
cmp ecx, eax
je 0x1009e288
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sar eax, 2
push eax
push edx
call fcn.1009c850
lea eax, [edi + 0x44]
lea ecx, [esi + 0x44]
cmp ecx, eax
je 0x1009e2a4
cmp dword [eax + 0x14], 0xf
mov edx, dword [eax + 0x10]
jbe 0x1009e29d
mov eax, dword [eax]
push edx
push eax
call fcn.10035aa0
lea eax, [edi + 0x5c]
lea ecx, [esi + 0x5c]
cmp ecx, eax
je 0x1009e2c0
cmp dword [eax + 0x14], 0xf
mov edx, dword [eax + 0x10]
jbe 0x1009e2b9
mov eax, dword [eax]
push edx
push eax
call fcn.10035aa0
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x78]
mov dword [esi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebp
ret 4

Function at 0x100a0520
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x100a3410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov edi, ecx
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
movzx eax, byte [esi + 7]
mov byte [edi + 7], al
movzx eax, byte [esi + 8]
mov byte [edi + 8], al
movzx eax, byte [esi + 9]
mov byte [edi + 9], al
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
movzx eax, byte [esi + 0x28]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x29]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x2a]
mov byte [edi + 0x2a], al
mov edx, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], edx
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x40], edx
movups xmmword [edi + 0x44], xmm0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
movups xmm0, xmmword [esi + 0x44]
movups xmmword [edi + 0x44], xmm0
movq xmm0, qword [esi + 0x54]
movq qword [edi + 0x54], xmm0
xorps xmm0, xmm0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0xf
mov byte [esi + 0x44], 0
movups xmmword [edi + 0x5c], xmm0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
movups xmm0, xmmword [esi + 0x5c]
movups xmmword [edi + 0x5c], xmm0
movq xmm0, qword [esi + 0x6c]
movq qword [edi + 0x6c], xmm0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xf
mov byte [esi + 0x5c], 0
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x100a8750
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov al, byte [ebx + 0xc]
lea edx, [esi + 0x20]
test al, 0x60
je 0x100a8785
movzx eax, al
shr eax, 5
and eax, 3
mov ecx, dword [eax*8 + 0x101d5448]
or dword [edx], ecx
mov eax, dword [eax*8 + 0x101d544c]
or dword [edx + 4], eax
mov al, byte [ebx + 0xd]
lea edi, [ebx + 0xd]
test al, 3
je 0x100a87b6
movzx ecx, al
and ecx, 3
mov eax, dword [ecx*8 + 0x101d5468]
or dword [edx], eax
mov eax, dword [ecx*8 + 0x101d546c]
lea ecx, [esi + 0x20]
or dword [edx + 4], eax
add ebx, 0xd
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], ebx
jmp 0x100a87be
mov dword [ebp + 0xc], edx
mov ebx, edi
mov dword [ebp - 4], edi
mov al, byte [edi]
test al, 0xc
je 0x100a87e3
movzx ecx, al
shr ecx, 2
and ecx, 3
mov eax, dword [ecx*8 + 0x101d5488]
or dword [edx], eax
mov eax, dword [ecx*8 + 0x101d548c]
or dword [edx + 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [esi + 0xc]
jmp dword [eax*4 + 0x100a8c60]

Function at 0x101142c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101142ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101142ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x101300c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [0x1034c744]
sub esp, 0x34
mov eax, dword [eax + 8]
push ebx
push esi
push edi
cmp byte [eax + 6], 0
mov ebx, ecx
je 0x10130216
mov eax, dword [0x1034c74c]
mov edi, dword [eax + 0x10]
mov ecx, dword [eax + 0x1c]
mov edx, dword [edi]
mov eax, dword [ecx]
mov esi, dword [edx + 0xc]
call dword [eax + 0x30]
push eax
mov ecx, edi
call esi
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [0x1034dcac]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x1035b434]
cmp ecx, dword [edx + 4]
jg 0x1013021d
mov esi, dword [0x1035b438]
mov ecx, edi
call fcn.10022440
sub esp, 8
movss xmm1, dword [eax + 4]
movss xmm2, dword [eax]
movss xmm0, dword [eax + 8]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.100d7410
fstp dword ds:[esp + 0x44]
movss xmm0, dword [esp + 0x44]
add esp, 8
comiss xmm0, dword [0x102fdec8]
ja 0x10130216
movss xmm1, dword [esi + 0x1c]
sub esp, 8
movss xmm2, dword [esi + 0x18]
movss xmm0, dword [esi + 0x20]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.100d7410
fstp dword [esp + 0x44]
movss xmm0, dword [esp + 0x44]
add esp, 8
comiss xmm0, dword [0x102fdec8]
ja 0x10130216
movd xmm0, dword [ebx + 8]
mov ecx, edi
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x102fdf10]
movss dword [esi + 0x1c], xmm0
call fcn.1003aee0
cmp byte [eax], 0
jne 0x101301fc
mov ecx, edi
call fcn.1003ad80
cmp byte [eax], 0
je 0x1013020e
movss xmm0, dword [esi + 0x1c]
mulss xmm0, dword [0x102fde5c]
movss dword [esi + 0x1c], xmm0
mov eax, dword [ebx + 8]
neg eax
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1035b434
call fcn.1009af0b
add esp, 4
cmp dword [0x1035b434], 0xffffffff
jne 0x1013012c
push 0x1035b434
mov dword [0x1035b438], 0
call fcn.1009aeba
add esp, 4
jmp 0x1013012c
Function at 0x1013aa80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10350170]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1cdc]
mov esi, 4
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x102eead0]
sub esi, 1
jne 0x1013aab2
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x1013aaf9
inc ecx
test esi, esi
je 0x1013aae7
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1013aaec
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10040820
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10141c20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc4]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xcc]
lea esi, [ebp - 0x10]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop word [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x102eead0]
sub edi, 1
jne 0x10141c90
mov eax, dword [0x10350170]
not edx
pop edi
pop esi
cmp dword [eax + 0x1d14], edx
jne 0x10141cc1
mov dword [eax + 0x1d18], edx
cmp dword [eax + 0x1d4c], edx
jne 0x10141cd0
mov byte [eax + 0x1d50], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4

Function at 0x10141e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xc4]
mov eax, dword [ecx + 0xcc]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102eead0]
sub edi, 1
jne 0x10141e80
mov ecx, dword [0x10350170]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1d14], eax
jne 0x10141eb2
mov dword [ecx + 0x1d18], eax
cmp dword [ecx + 0x1d4c], eax
jne 0x10141ec1
mov byte [ecx + 0x1d50], 1
pop ebp
ret 4