joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10115d70
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10115daf
cmp bl, 0x23
jne 0x10115d91
cmp byte [esi], bl
jne 0x10115d91
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10175150]
test bl, bl
jne 0x10115d82
mov ecx, dword [0x101e6b78]
not eax
mov esi, dword [ecx + 0x19d4]
mov edi, dword [ecx + 0x19dc]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10115dee
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10115de8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10115dea
mov esi, edx
test esi, esi
jne 0x10115dd0
cmp edi, ebx
je 0x10115dfd
cmp dword [edi], eax
jne 0x10115dfd
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10115ec0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [0x101e6b78]
push edi
mov edi, ecx
mov ebx, dword [edi + 0x1c0]
lea ecx, [edi + 0x1a4]
test dl, dl
je 0x10115f14
mov word [ecx], bx
mov eax, dword [edi + 0x198]
mov word [ecx + 2], ax
mov eax, dword [esi + 0x1a7c]
mov word [ecx + 4], ax
mov eax, dword [esi + 0x1a4c]
mov word [ecx + 6], ax
mov eax, dword [esi + 0x1a58]
mov word [ecx + 8], ax
add ecx, 0xa
mov eax, dword [esi + 0x1a64]
mov word [ecx], ax
jmp 0x10115f5a
movsx eax, word [ecx]
cmp eax, ebx
jne 0x10115f64
movsx eax, word [ecx + 2]
cmp eax, dword [edi + 0x198]
jne 0x10115f64
movsx eax, word [ecx + 4]
cmp eax, dword [esi + 0x1a7c]
jne 0x10115f64
movsx eax, word [ecx + 6]
cmp eax, dword [esi + 0x1a4c]
jl 0x10115f64
movsx eax, word [ecx + 8]
cmp eax, dword [esi + 0x1a58]
jl 0x10115f64
movsx eax, word [ecx + 0xa]
add ecx, 0xa
cmp eax, dword [esi + 0x1a64]
jl 0x10115f64
lea eax, [edi + 0x1ae]
cmp ecx, eax
je 0x10115f6c
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
pop esi
pop ebx
ret
Function at 0x10115f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [0x101e6b78]
lea eax, [ebp - 0x1c]
mov ebx, ecx
mov dword [ebp - 8], edx
push eax
mov dword [ebp - 0x1c], 5
movups xmm0, xmmword [edi + 0x15fc]
lea ecx, [edi + 0x1a4c]
movups xmmword [ebp - 0x18], xmm0
call fcn.1003c750
movaps xmm0, xmmword [0x1017f790]
lea eax, [ebp - 0x14]
mov esi, dword [0x101e6b78]
movups xmmword [edi + 0x15fc], xmm0
push eax
movss xmm0, dword [edi + 0x1540]
movss dword [ebp - 4], xmm0
lea ecx, [esi + 0x1a58]
movss xmm0, dword [esi + 0x1528]
mov dword [ebp - 0x14], 6
movss dword [ebp - 0x10], xmm0
call fcn.1003c690
movss xmm0, dword [ebp - 4]
lea eax, [ebp - 0x14]
movss dword [esi + 0x1528], xmm0
mov esi, dword [0x101e6b78]
movss xmm0, dword [edi + 0x1544]
movss dword [ebp - 4], xmm0
push eax
movss xmm0, dword [esi + 0x152c]
lea ecx, [esi + 0x1a58]
mov dword [ebp - 0x14], 7
movss dword [ebp - 0x10], xmm0
call fcn.1003c690
movss xmm0, dword [ebp - 4]
lea eax, [ebp - 0x14]
movss dword [esi + 0x152c], xmm0
mov esi, dword [0x101e6b78]
push eax
mov dword [ebp - 0x14], 1
movss xmm0, dword [esi + 0x1508]
lea ecx, [esi + 0x1a58]
movss xmm1, dword [esi + 0x150c]
movss dword [ebp - 0x10], xmm0
movss dword [ebp - 0xc], xmm1
call fcn.1003c690
mov eax, dword [edi + 0x1538]
mov ecx, dword [edi + 0x153c]
mov dword [esi + 0x1508], eax
mov dword [esi + 0x150c], ecx
test ebx, ebx
jne 0x101160a2
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
sub esp, 8
mov edx, ebx
push dword [ebp - 8]
call fcn.10116980
add esp, 0xc
mov ecx, 3
mov bl, al
call fcn.101118e0
mov ecx, 1
call fcn.1011d9f0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101167a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [0x101e6b78]
mov esi, dword [edi + 0x19e4]
test dword [esi + 8], 0x1000000
jne 0x101167c5
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xorps xmm1, xmm1
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], 0x41300000
call fcn.101198e0
cmp word [esi + 0x84], 1
jle 0x101167f3
call fcn.1011d370
pop edi
pop esi
mov esp, ebp
pop ebp
ret
movss xmm2, dword [esi + 0x14]
movss xmm0, dword [esi + 0x18]
mov eax, dword [esi + 0x9c]
movss xmm1, dword [0x1017f180]
movss dword [ebp - 8], xmm2
movss dword [ebp - 0x10], xmm2
movss dword [ebp - 4], xmm0
movss dword [ebp - 0xc], xmm0
test al, 1
je 0x1011683c
movaps xmm0, xmm1
maxss xmm0, xmm2
movaps xmm2, xmm0
movss xmm0, dword [ebp - 4]
movss dword [ebp - 8], xmm2
movss dword [ebp - 0x10], xmm2
test al, 2
je 0x10116851
maxss xmm1, xmm0
movaps xmm0, xmm1
movss dword [ebp - 4], xmm0
movss dword [ebp - 0xc], xmm0
call fcn.1011d370
mov eax, dword [edi + 0x19e4]
lea ecx, [ebp - 0x10]
xorps xmm1, xmm1
movss xmm3, dword [eax + 0xc8]
movss xmm0, dword [eax + 0xcc]
movaps xmm4, xmm3
addss xmm4, dword [ebp - 8]
movaps xmm2, xmm0
movss dword [ebp - 0x20], xmm3
addss xmm2, dword [ebp - 4]
movss dword [ebp - 0x1c], xmm0
movss dword [ebp - 0x18], xmm4
movss dword [ebp - 0x14], xmm2
call fcn.101198e0
cmp dword [esi + 0x13c], 0
jne 0x101168b1
cmp byte [esi + 0x145], 0
je 0x10116948
test dword [esi + 8], 0x800000
jne 0x10116948
mov edx, dword [esi + 0x54]
lea ecx, [ebp - 0x20]
push 0
call fcn.1011cfb0
mov edx, dword [esi + 0x54]
lea ecx, [ebp - 0x20]
add esp, 4
push 1
call fcn.1011a750
add esp, 4
cmp dword [esi + 0x13c], 0
jne 0x10116957
cmp esi, dword [edi + 0x1af8]
jne 0x10116957
movss xmm2, dword [0x1017f134]
lea ecx, [ebp - 0x20]
movss xmm4, dword [ebp - 0x18]
movss xmm3, dword [ebp - 0x14]
addss xmm4, xmm2
movss xmm1, dword [ebp - 0x20]
addss xmm3, xmm2
movss xmm0, dword [ebp - 0x1c]
subss xmm1, xmm2
mov edx, dword [edi + 0x1afc]
subss xmm0, xmm2
push 2
movss dword [ebp - 0x18], xmm4
movss dword [ebp - 0x14], xmm3
movss dword [ebp - 0x20], xmm1
movss dword [ebp - 0x1c], xmm0
call fcn.1011a750
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.1011cfb0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10116980
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
mov edi, dword [0x101e6b78]
mov dword [ebp - 0xc], edx
mov ebx, dword [edi + 0x19e4]
movss xmm4, dword [ebx + 0xc8]
movss xmm5, dword [ebx + 0xcc]
movss xmm3, dword [ebx + 0x218]
mov esi, dword [ebx + 0x1bc]
movss xmm2, dword [ebx + 0x214]
subss xmm4, dword [ebx + 0xc]
subss xmm5, dword [ebx + 0x10]
subss xmm3, dword [ebx + 0x10]
subss xmm2, dword [ebx + 0xc]
test esi, esi
je 0x10116a16
mov edx, dword [esi + 0xc]
lea eax, [edx + 1]
test eax, eax
cmovns edx, eax
cmp edx, dword [esi + 0x2c]
jl 0x101169f1
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movss xmm2, dword [esi + 0x18]
lea ecx, [edx*8]
subss xmm2, dword [esi + 0x14]
mov eax, dword [esi + 0x34]
sub ecx, edx
mulss xmm2, dword [eax + ecx*4]
addss xmm2, dword [esi + 0x14]
subss xmm2, dword [ebx + 0x3c]
mov ecx, dword [ebp + 8]
subss xmm3, xmm5
xorps xmm5, xmm5
subss xmm2, xmm4
movss xmm4, dword [0x1017f180]
mov edx, 1
mov esi, 2
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm5
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
cmovnp ecx, edx
ucomiss xmm0, xmm5
lahf
xor edx, edx
test ah, 0x44
cmovnp edx, esi
or edx, ecx
comiss xmm5, xmm1
mov dword [ebp - 0x14], edx
jb 0x10116a77
addss xmm1, xmm2
maxss xmm1, xmm4
comiss xmm5, xmm0
jb 0x10116a84
addss xmm0, xmm3
maxss xmm0, xmm4
push 0
push 0x1017dda0
lea eax, [ebp - 0x114]
movss dword [edi + 0x1ab8], xmm1
push 0x100
push eax
movss dword [edi + 0x1abc], xmm0
mov dword [edi + 0x1a90], 1
call fcn.1011c600
movss xmm0, dword [edi + 0x152c]
lea ecx, [ebp - 0x114]
push 0x21010107
xor edx, edx
movss dword [ebp - 0x10], xmm0
call fcn.10112270
mov esi, dword [edi + 0x19e4]
add esp, 0x14
movss xmm0, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
movss dword [edi + 0x152c], xmm0
cmp word [esi + 0x84], 1
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x54], edx
mov dword [esi + 0x9c], eax
jne 0x10116b19
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
mov dword [ebx + 0xc8], ecx
mov dword [ebx + 0xcc], eax
cmp dword [edi + 0x1b00], edx
jne 0x10116b5a
cmp dword [esi + 0x13c], 0
jne 0x10116b33
cmp byte [esi + 0x145], 0
je 0x10116b5a
mov ecx, esi
call fcn.10111f60
xor dl, dl
mov ecx, esi
call fcn.1010f1c0
mov ecx, dword [ebp - 0xc]
mov edx, esi
lea ecx, [ecx + 1]
call fcn.10119c40
mov dword [edi + 0x1a34], 2
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10116ff0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
xor ecx, ecx
push esi
push edi
mov edi, dword [0x101e6b78]
mov eax, dword [edi + 0x1a48]
test eax, eax
je 0x10117027
test dword [eax + 8], 0x200
cmove ecx, eax
cmp byte [edi + 0xaf], 0
movss xmm1, dword [edi + 0x155c]
movss xmm7, dword [edi + 0x1558]
movaps xmm6, xmm1
movss dword [ebp - 4], xmm1
movaps xmm5, xmm7
je 0x1011705b
maxss xmm5, dword [0x1017f180]
maxss xmm6, dword [0x1017f180]
mov eax, dword [edi + 0x19a4]
lea edx, [eax - 1]
test edx, edx
js 0x10117128
nop dword [eax]
cmp edx, eax
jge 0x10117147
mov eax, dword [edi + 0x19ac]
mov eax, dword [eax + edx*4]
cmp byte [eax + 0x7a], 0
je 0x10117119
cmp byte [eax + 0x81], 0
jne 0x10117119
mov esi, dword [eax + 8]
test esi, 0x200
jne 0x10117119
movups xmm0, xmmword [eax + 0x1dc]
movups xmmword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0x20]
movss xmm3, dword [ebp - 0x1c]
test esi, 0x1000002
jne 0x101170d0
subss xmm0, xmm5
movaps xmm2, xmm5
subss xmm3, xmm6
movaps xmm1, xmm6
jmp 0x101170db
subss xmm0, xmm7
movaps xmm2, xmm7
subss xmm3, xmm1
movss xmm4, dword [edi + 0xe0]
comiss xmm4, xmm0
addss xmm1, dword [ebp - 0x14]
addss xmm2, dword [ebp - 0x18]
jb 0x10117114
movss xmm0, dword [edi + 0xe4]
comiss xmm0, xmm3
jb 0x10117114
comiss xmm2, xmm4
jbe 0x10117114
comiss xmm1, xmm0
jbe 0x10117114
test ecx, ecx
cmovne eax, ecx
mov ecx, eax
test ecx, ecx
jne 0x10117128
movss xmm1, dword [ebp - 4]
sub edx, 1
mov eax, dword [edi + 0x19a4]
jns 0x10117070
mov dword [edi + 0x19e8], ecx
test ecx, ecx
je 0x1011714f
mov eax, dword [ecx + 0x2f0]
mov dword [edi + 0x19ec], eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor eax, eax
mov dword [edi + 0x19ec], eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x101178e0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x101e6b78]
push esi
mov eax, dword [ecx + 0x19e4]
mov byte [eax + 0x7c], 1
mov esi, dword [ecx + 0x19e4]
mov ecx, dword [esi + 0x274]
mov eax, dword [ecx + 0x3c]
test eax, eax
jle 0x10117955
dec eax
mov dword [ecx + 0x3c], eax
call fcn.10122060
mov eax, dword [esi + 0x274]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
jle 0x10117955
mov eax, dword [eax + 0x44]
add ecx, ecx
movss xmm0, dword [eax + ecx*8 - 0xc]
movss xmm1, dword [eax + ecx*8 - 8]
movss xmm2, dword [eax + ecx*8 - 4]
mov eax, dword [eax + ecx*8 - 0x10]
mov dword [esi + 0x1cc], eax
movss dword [esi + 0x1d0], xmm0
movss dword [esi + 0x1d4], xmm1
movss dword [esi + 0x1d8], xmm2
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10117960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x101e6b78]
mov eax, dword [esi + 0x19e4]
mov byte [eax + 0x7c], 1
push dword [edx + 4]
mov esi, dword [esi + 0x19e4]
push dword [edx]
push dword [ecx + 4]
push dword [ecx]
mov ecx, dword [esi + 0x274]
push dword [ebp + 8]
call fcn.1012be00
mov eax, dword [esi + 0x274]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
jg 0x101179a7
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [eax + 0x44]
add ecx, ecx
movss xmm0, dword [eax + ecx*8 - 0xc]
movss xmm1, dword [eax + ecx*8 - 8]
movss xmm2, dword [eax + ecx*8 - 4]
mov eax, dword [eax + ecx*8 - 0x10]
mov dword [esi + 0x1cc], eax
movss dword [esi + 0x1d0], xmm0
movss dword [esi + 0x1d4], xmm1
movss dword [esi + 0x1d8], xmm2
pop esi
pop ebp
ret

Function at 0x10117c10
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x10117cb1
jle 0x10117cb4
mov eax, dword [esi + 8]
mov edx, ecx
shl edx, 5
cmp dword [edx + eax - 0x20], 0
jne 0x10117c45
cmp dword [edx + eax - 8], 0
jne 0x10117c45
lea eax, [ecx - 1]
mov dword [esi], eax
test eax, eax
je 0x10117cb1
mov edx, dword [esi + 0x18]
test edx, edx
je 0x10117c5a
mov eax, dword [esi + 0x20]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4]
cmp dword [esi + 0x34], eax
jne 0x10117cb4
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10117c6c
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
cmp dword [esi + 0x38], eax
jne 0x10117cb4
mov eax, dword [esi + 0x30]
cmp eax, edx
jne 0x10117cb4
cmp eax, 0x10000
jae 0x10117cb4
mov ecx, dword [edi + 4]
push ebx
mov ebx, dword [edi]
cmp ebx, ecx
jne 0x10117ca6
inc ebx
test ecx, ecx
je 0x10117c94
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10117c99
mov eax, 8
cmp eax, ebx
mov ecx, edi
cmovg ebx, eax
push ebx
call fcn.1003c860
mov ecx, dword [edi]
mov eax, dword [edi + 8]
pop ebx
mov dword [eax + ecx*4], esi
inc dword [edi]
pop edi
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10117cc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
cmp ecx, esi
jne 0x10117cf6
inc ecx
test esi, esi
je 0x10117ce4
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10117ce9
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, ebx
call fcn.1003c860
mov ecx, dword [ebx]
mov eax, dword [ebx + 8]
mov dword [eax + ecx*4], edi
inc dword [ebx]
cmp byte [edi + 0x7a], 0
je 0x10117d59
mov eax, dword [edi + 0x150]
mov dword [ebp - 4], eax
cmp eax, 1
jle 0x10117d2f
push 0x10117d70
push 4
push eax
push dword [edi + 0x158]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
add esp, 0x10
xor esi, esi
jmp 0x10117d35
xor esi, esi
test eax, eax
jle 0x10117d59
cmp esi, dword [edi + 0x150]
jge 0x10117d60
mov eax, dword [edi + 0x158]
mov edx, dword [eax + esi*4]
cmp byte [edx + 0x7a], 0
je 0x10117d53
mov ecx, ebx
call fcn.10117cc0
inc esi
cmp esi, dword [ebp - 4]
jl 0x10117d35
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10117dd0
Capabilities:
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10117f26
cmp byte [edi + 0x2c94], 0
jne 0x10117f26
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x1017ddb5
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x10117e1e
cmp byte [esi], al
jne 0x10117e1e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10175150]
test al, al
jne 0x10117e10
mov esi, dword [edi + 0x2ca8]
not edx
mov ecx, dword [edi + 0x2cac]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x1010b4b0
mov dword [ebp - 0xc], 0x1010b3e0
mov dword [ebp - 8], 0x1010b1e0
cmp esi, ecx
jne 0x10117ef4
inc esi
test ecx, ecx
je 0x10117e75
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10117e7a
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10117ef4
mov eax, dword [0x101e6b78]
test eax, eax
je 0x10117e92
inc dword [eax + 0x36c]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2cb0]
test eax, eax
je 0x10117ee8
mov ecx, dword [edi + 0x2ca8]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2cb0]
add esp, 0xc
test ecx, ecx
je 0x10117ede
mov eax, dword [0x101e6b78]
test eax, eax
je 0x10117ede
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi + 0x2cb0], ebx
mov dword [edi + 0x2cac], esi
mov eax, dword [edi + 0x2ca8]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2cb0]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2ca8]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10119470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movss xmm4, dword [ebp + 0xc]
movaps xmm6, xmm1
movss xmm1, dword [ebp + 8]
xorps xmm5, xmm5
comiss xmm5, xmm1
push ebx
push esi
mov ebx, ecx
push edi
movaps xmm7, xmm2
xorps xmm3, xmm3
xorps xmm2, xmm2
ja 0x101194a6
comiss xmm5, xmm4
ja 0x101194a6
mov ecx, dword [0x101e6b78]
jmp 0x10119529
mov ecx, dword [0x101e6b78]
mov edi, dword [ecx + 0x19e4]
movss xmm3, dword [edi + 0x218]
mov esi, dword [edi + 0x1bc]
movss xmm2, dword [edi + 0x214]
subss xmm3, dword [edi + 0x10]
subss xmm2, dword [edi + 0xc]
test esi, esi
je 0x10119519
mov edx, dword [esi + 0xc]
lea eax, [edx + 1]
test eax, eax
cmovns edx, eax
cmp edx, dword [esi + 0x2c]
jl 0x101194ee
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movss xmm2, dword [esi + 0x18]
lea ecx, [edx*8]
subss xmm2, dword [esi + 0x14]
mov eax, dword [esi + 0x34]
sub ecx, edx
mulss xmm2, dword [eax + ecx*4]
mov ecx, dword [0x101e6b78]
addss xmm2, dword [esi + 0x14]
subss xmm2, dword [edi + 0x3c]
mov eax, dword [ecx + 0x19e4]
addss xmm2, dword [eax + 0xc]
addss xmm3, dword [eax + 0x10]
comiss xmm5, xmm1
movss xmm0, dword [0x1017f180]
jb 0x1011955f
ucomiss xmm1, xmm5
lahf
test ah, 0x44
jp 0x10119544
movaps xmm1, xmm6
jmp 0x1011955a
mov eax, dword [ecx + 0x19e4]
subss xmm2, dword [eax + 0xc8]
maxss xmm2, xmm0
addss xmm1, xmm2
movss dword [ebp + 8], xmm1
comiss xmm5, xmm4
jb 0x10119596
ucomiss xmm4, xmm5
lahf
test ah, 0x44
jp 0x10119580
movaps xmm4, xmm7
movss dword [ebx], xmm1
movss dword [ebx + 4], xmm4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ecx + 0x19e4]
subss xmm3, dword [eax + 0xcc]
maxss xmm3, xmm0
addss xmm4, xmm3
pop edi
pop esi
movss dword [ebx], xmm1
mov eax, ebx
movss dword [ebx + 4], xmm4
pop ebx
pop ebp
ret

Function at 0x10119b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101e6b78]
sub esp, 0x10
push esi
test ecx, ecx
jne 0x10119b87
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [edx + 0x134]
cmp dword [eax + 0x1af8], edx
je 0x10119b9c
mov byte [eax + 0x1b5d], 0
mov dword [eax + 0x1afc], ecx
mov dword [eax + 0x1af8], edx
mov dword [eax + 0x1b50], esi
mov dword [edx + esi*4 + 0x300], ecx
cmp dword [edx + 0x10c], ecx
jne 0x10119c13
movss xmm0, dword [edx + 0x118]
add esi, esi
movss xmm4, dword [edx + 0x11c]
movss xmm3, dword [edx + 0x120]
movss xmm1, dword [edx + 0x114]
subss xmm0, dword [edx + 0x10]
subss xmm4, dword [edx + 0xc]
subss xmm3, dword [edx + 0x10]
subss xmm1, dword [edx + 0xc]
movss dword [ebp - 0xc], xmm0
movss dword [ebp - 8], xmm4
movss dword [ebp - 4], xmm3
movss dword [ebp - 0x10], xmm1
movups xmm0, xmmword [ebp - 0x10]
movups xmmword [edx + esi*8 + 0x308], xmm0
cmp dword [eax + 0x1a34], 2
jne 0x10119c28
mov byte [eax + 0x1b5b], 1
pop esi
mov esp, ebp
pop ebp
ret
mov byte [eax + 0x1b5a], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10119cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x101e6b78]
mov eax, dword [esi + 0x1af8]
test eax, eax
je 0x10119d43
test edx, edx
je 0x10119d0d
cmp edx, 1
jne 0x10119d43
mov dword [esi + 0x1afc], ecx
mov dword [eax + edx*4 + 0x300], ecx
add edx, edx
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x1af8]
movups xmm0, xmmword [eax]
movups xmmword [ecx + edx*8 + 0x308], xmm0
mov word [esi + 0x1b59], 1
mov byte [esi + 0x1b5b], 1
pop esi
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10119dc0
Capabilities:
Encode data using xor
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, ecx
push esi
mov esi, dword [edx + 0x1c0]
test esi, esi
jg 0x10119ddb
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp + 8]
push edi
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [edx + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [edx + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [edx + 0x10]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [edx + 0x1c8]
mov edx, dword [eax + esi*4 - 4]
lea esi, [ebp - 0x10]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10175150]
sub edi, 1
jne 0x10119e36
mov eax, dword [0x101e6b78]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a04], edx
jne 0x10119e67
mov dword [eax + 0x1a0c], edx
cmp dword [eax + 0x1a08], edx
jne 0x10119e76
mov byte [eax + 0x1a19], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4

Function at 0x10119e80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x1c0]
test edx, edx
jg 0x10119e95
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ecx + 0x1c8]
mov ecx, dword [ebp + 8]
push dword [eax + edx*4 - 4]
xor edx, edx
call fcn.1011c510
add esp, 4
pop ebp
ret 8

Function at 0x10119eb0
Capabilities:
Encode data using xor
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x1c0]
test edx, edx
jg 0x10119ec5
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ecx + 0x1c8]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10175150]
sub edi, 1
jne 0x10119ee0
mov ecx, dword [0x101e6b78]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a04], eax
jne 0x10119f12
mov dword [ecx + 0x1a0c], eax
cmp dword [ecx + 0x1a08], eax
jne 0x10119f21
mov byte [ecx + 0x1a19], 1
pop ebp
ret 4