joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10264450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, ecx
mov dword [edi], 0x10388848
lea eax, [edi + 0x28]
mov dword [edi + 4], 0x1b
mov dword [edi + 8], 0
mov dword [edi + 0xc], 1
mov dword [edi + 0x10], 0
movzx ecx, byte [edi + 0x24]
mov dword [edi + 0x1c], 0
and cl, 0xfd
mov dword [edi + 0x18], 0
and cl, 0xfe
mov byte [edi + 0x24], cl
mov dword [edi + 0x20], 4
mov dword [edi + 0x18], eax
lea eax, [edi + 0x48]
movzx ecx, byte [edi + 0x44]
mov dword [edi + 0x3c], 0
and cl, 0xfd
mov dword [edi + 0x38], 0
and cl, 0xfe
cmp byte [esp + 0x1c], 1
mov byte [edi + 0x44], cl
mov dword [edi + 0x40], 1
mov dword [edi + 0x38], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0xf
mov byte [edi + 0x58], 0
mov dword [edi + 0x70], eax
sete al
cmp byte [esp + 0x20], 1
mov byte [edi + 0x74], al
sete al
mov dword [edi], 0x103ac1bc
mov byte [edi + 0x75], al
xor edx, edx
push ecx
mov eax, esp
sub esp, 0xc
mov ecx, eax
mov word [eax], dx
mov byte [eax + 2], dl
mov word [ecx], dx
mov byte [ecx + 2], dl
mov edx, esp
mov eax, dword [esp + 0x1c]
lea ecx, [edi + 0x78]
mov dword [esp + 0x1c], 0
mov dword [edx], eax
mov eax, dword [esp + 0x20]
mov dword [edx + 4], eax
mov ax, word [esp + 0x24]
mov word [edx + 8], ax
call fcn.100b0020
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x10], 1
test ecx, ecx
je 0x10264576
lea edx, [ecx + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
cmp eax, 1
jne 0x10264576
xor eax, eax
test edx, edx
cmove ecx, eax
test ecx, ecx
je 0x10264576
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, edi
pop edi
pop esi
ret 0x18
Function at 0x102717c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov edx, dword [esp + 0x34]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
mov eax, dword [edx + 0x1c]
and eax, 3
mov dword [esp + 0x10], 0
shl eax, 0xe
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 1
push edi
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x1038b7ac]
movss dword [esi + 0x9c], xmm0
mov eax, dword [edx + 0x1c]
shr eax, 0x12
and eax, 3
shl eax, 0xe
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x1038b7ac]
movss dword [esi + 0xa0], xmm0
mov eax, dword [edx + 0x1c]
movss xmm0, dword [esi + 0xa4]
shr eax, 2
movzx eax, ax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x38]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
movss dword [esp + 0x20], xmm0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x40], 0
call fcn.10271a60
mov ebx, eax
mov ecx, ebx
call fcn.102a3540
mov eax, dword [esi + 0x38]
mov edi, dword [eax + 0x2c]
test edi, edi
je 0x102718ee
mov edx, dword [esi + 0xc0]
cmp edx, 1
je 0x102718b0
cmp dword [esi + 0xbc], 1
jne 0x102718ee
mov eax, dword [edi]
mov ecx, dword [eax + 0x78]
lea eax, [esp + 0x40]
push eax
sub esp, 8
lea eax, [esi + 0x8c]
mov dword [esp + 4], 0
mov dword [esp], 0
push dword [esi + 0xbc]
push edx
push dword [esi + 0xb8]
push dword [esp + 0x5c]
push eax
lea eax, [esp + 0x3c]
push eax
push edi
call ecx
jmp 0x1027192e
mov edx, dword [eax + 0x28]
mov eax, dword [edx]
mov ecx, dword [eax + 0x5c]
lea eax, [esp + 0x40]
push eax
sub esp, 8
lea eax, [esi + 0x8c]
mov dword [esp + 4], 0
mov dword [esp], 0
push dword [esi + 0xb8]
push dword [esp + 0x54]
push eax
push ecx
mov dword [esp], 0x3f800000
lea eax, [esp + 0x38]
push eax
push edx
call ecx
mov ecx, ebx
mov edi, eax
call fcn.102a35e0
test edi, edi
js 0x1027196b
call fcn.10271a60
mov edi, eax
mov ecx, edi
call fcn.102a3570
mov ecx, dword [esp + 0x40]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
mov edx, dword [ecx]
push ecx
call dword [edx + 0xc]
mov ecx, edi
mov esi, eax
call fcn.102a3690
xor edi, edi
test esi, esi
cmovs edi, esi
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x10271979
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x30
ret 0x10
Function at 0x102750d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
mov eax, dword [0x10444724]
xor eax, esp
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x58]
lea eax, [ecx + 1]
imul eax, edx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov edi, dword [esp + 0x74]
shl eax, 4
add ebx, eax
lea eax, [ecx + 1]
mov ecx, dword [esp + 0x78]
imul eax, edx
mov dword [esp + 0xc], ebx
add ebp, eax
xor eax, eax
mov dword [esp + 0x10], eax
test ecx, ecx
jle 0x102752a1
movss xmm1, dword [0x10386834]
movss xmm2, dword [0x103ac5c0]
push esi
mov esi, edx
shl esi, 5
add edx, edx
mov dword [esp + 0x34], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x38], edx
xor edx, edx
mov dword [esp + 0x18], edx
test edi, edi
jle 0x10275287
lea eax, [edi - 1]
mov dword [esp + 0x1c], eax
lea eax, [ecx - 1]
mov dword [esp + 0x20], eax
mov eax, edi
not eax
mov dword [esp + 0x24], eax
mov eax, edi
neg eax
mov dword [esp + 0x28], eax
mov eax, 1
sub eax, edi
mov dword [esp + 0x2c], eax
lea eax, [edi + 1]
mov dword [esp + 0x30], eax
mov al, byte [esi]
cmp al, 0xff
jne 0x1027518b
movaps xmm0, xmm1
jmp 0x10275199
movzx eax, al
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
movss dword [ebx], xmm0
test edx, edx
mov ebx, dword [esp + 0x1c]
mov ecx, 0xff
mov eax, 0xda
mov dword [esp + 0x50], ebx
cmovne eax, ecx
mov dword [esp + 0x3c], 0xffffffff
mov ecx, eax
mov dword [esp + 0x40], 1
and ecx, 0xffffff6d
cmp edx, ebx
mov edx, dword [esp + 0x14]
cmovne ecx, eax
mov bl, byte [esi]
mov eax, ecx
mov bh, bl
and eax, 0xffffffe3
test edx, edx
cmovne eax, ecx
mov edi, eax
and edi, 0xffffff1f
cmp edx, dword [esp + 0x20]
cmovne edi, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x30]
shr bh, 7
xor edx, edx
mov dword [esp + 0x58], eax
nop
mov eax, 1
mov ecx, edx
shl eax, cl
test edi, eax
je 0x10275236
mov eax, dword [esp + edx*4 + 0x3c]
mov cl, byte [esi + eax]
jmp 0x10275238
xor cl, cl
mov al, cl
shr al, 7
cmp bh, al
jne 0x10275259
test bl, bl
js 0x10275251
test cl, cl
js 0x10275251
test bl, bl
je 0x10275251
test cl, cl
jne 0x10275259
inc edx
cmp edx, 8
jl 0x10275220
jmp 0x1027525d
mov byte [ebp], 0xff
mov edx, dword [esp + 0x18]
inc esi
mov ebx, dword [esp + 0x10]
inc edx
mov edi, dword [esp + 0x78]
add ebx, 0x10
inc ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edx
cmp edx, edi
jl 0x10275180
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x7c]
add ebx, dword [esp + 0x34]
inc eax
add ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
cmp eax, ecx
jl 0x10275142
pop esi
mov ecx, dword [esp + 0x58]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1037e005
add esp, 0x50
ret
Function at 0x10289b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x10444724]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x80]
push ebx
mov ebx, dword [esp + 0x8c]
push esi
mov esi, ecx
push edi
add eax, 0xffffffff
je 0x10289b6e
bsr eax, eax
xor eax, 0x1f
jmp 0x10289b73
mov eax, 0x20
mov edi, 0x20
mov edx, 1
mov ecx, edi
sub ecx, eax
mov eax, dword [esi + 0xc]
shl edx, cl
cmp eax, edx
cmovge eax, edx
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x90]
add eax, 0xffffffff
je 0x10289ba2
bsr eax, eax
xor eax, 0x1f
jmp 0x10289ba4
mov eax, edi
sub edi, eax
mov edx, 1
mov eax, dword [esi + 0xc]
mov ecx, edi
shl edx, cl
cmp eax, edx
cmovge eax, edx
mov dword [esi + 0x14], eax
mov edi, dword [esi + 0x18]
mov dword [esi + 0x18], 0
test edi, edi
je 0x10289be5
push dword [edi + 0x14]
call sym.skottie.dll_void___cdecl_sk_free_void__
add esp, 4
mov ecx, edi
call fcn.102892f0
push 0x24
push edi
call fcn.1037dfe9
add esp, 8
mov dword [esi + 0x20], 0
mov ecx, ebx
mov dword [esi + 0x1c], 0
mov al, byte [esi + 8]
mov byte [esp + 0xf], al
lea eax, [esp + 0x5c]
push 1
push dword [esi + 4]
mov dword [esp + 0x88], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x68], 0x103af744
mov dword [esp + 0x6c], esi
call fcn.100ddb40
test byte [ebx + 0xd], 8
mov ecx, 1
jne 0x10289c47
cmp byte [esp + 0xf], cl
jne 0x10289c47
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call dword [eax + 0x18]
mov ecx, dword [ebx + 0x3c]
cmp eax, ecx
cmovl ecx, eax
push 0
push ebx
push 0
push ecx
push 1
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.100e16b0
mov ecx, dword [esi + 0x24]
add esp, 0x20
mov eax, dword [esp + 0x10]
or ebx, 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esi + 0x24], eax
test ecx, ecx
je 0x10289cd3
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, ebx
lea edx, [ecx + 8]
lock xadd dword [edx], eax
cmp eax, 1
jne 0x10289ca5
xor eax, eax
test edx, edx
cmove ecx, eax
test ecx, ecx
je 0x10289ca5
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10289cd3
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, ebx
lea edx, [ecx + 8]
lock xadd dword [edx], eax
cmp eax, 1
jne 0x10289cd3
xor eax, eax
test edx, edx
cmove ecx, eax
test ecx, ecx
je 0x10289cd3
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x80]
test ecx, ecx
je 0x10289cf0
mov edx, dword [ecx]
lea eax, [esp + 0x5c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x28], 0
test ecx, ecx
je 0x10289d3a
mov eax, dword [ecx + 4]
lea edi, [ecx + 0xc]
mov eax, dword [eax + 4]
add edi, eax
mov eax, ebx
lock xadd dword [edi], eax
cmp eax, 1
jne 0x10289d3a
lock xadd dword [edi], eax
mov esi, edi
lea eax, [edi - 8]
neg esi
sbb esi, esi
and esi, eax
mov ecx, esi
call fcn.100c67e0
lock xadd dword [edi], ebx
cmp ebx, 1
jne 0x10289d3a
mov ecx, esi
call fcn.100e5600
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1037e005
add esp, 0x7c
ret 0xc
Function at 0x102b19d0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov ebp, dword [ebx + 0x18]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
mov esi, dword [ebx + 4]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0xc]
and ebp, eax
mov eax, dword [ecx + ebp*8]
cmp esi, eax
je 0x102b1a3c
mov esi, dword [ecx + ebp*8 + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x102b1a3c
mov ecx, dword [edi]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x102b1a82
cmp esi, eax
jne 0x102b1a30
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], edi
mov eax, dword [edi]
cmp esi, eax
je 0x102b1a6b
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + ebp*8]
cmp eax, dword [ebx + 4]
jne 0x102b1ab7
mov dword [ecx + ebp*8], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + ebp*8 + 4], edi
jmp 0x102b1adc
mov edx, dword [esp + 0x28]
push 0x10
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1037dfe9
mov eax, dword [esp + 0x28]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 0
pop ebx
add esp, 0xc
ret 0xc
cmp eax, esi
jne 0x102b1ac0
mov dword [ecx + ebp*8], edi
jmp 0x102b1adc
mov eax, dword [ecx + ebp*8 + 4]
mov eax, dword [eax]
mov dword [ecx + ebp*8 + 4], eax
cmp eax, edi
je 0x102b1adc
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + ebp*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebp*8 + 4], eax
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10386860]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x10386860]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x102b1b66
cmp ecx, 0x200
jae 0x102b1b2a
shl ecx, 3
jmp 0x102b1b34
cmp ecx, 0x1fffffff
jae 0x102b1b34
add ecx, ecx
push ecx
mov ecx, ebx
call fcn.102b28c0
mov eax, dword [ebx + 4]
cmp dword [eax], eax
je 0x102b1b66
mov eax, dword [eax + 4]
mov edi, eax
mov esi, dword [ebx + 4]
mov ecx, ebx
mov esi, dword [esi]
push esi
lea eax, [esi + 8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.102b19d0
cmp esi, edi
jne 0x102b1b48
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 0xc
Function at 0x102b2870
Capabilities:
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
ret 4
Function at 0x102cf6e0
Capabilities:
Hash data using murmur3

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov dword [esp + 8], 0
push ebp
push esi
push edi
cmp byte [ebx + 0x30c], 0
jne 0x102cf7b5
mov eax, dword [esp + 0x20]
mov ebp, 1
shr eax, 0x10
xor eax, dword [esp + 0x20]
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul edx, eax, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
mov eax, ecx
xor eax, edx
cmp ecx, edx
cmovne ebp, eax
mov eax, dword [ebx + 0x318]
xor esi, esi
mov dword [esp + 0x10], eax
lea ecx, [eax - 1]
mov dword [esp + 0x24], ecx
and ecx, ebp
test eax, eax
jle 0x102cf78b
mov edx, dword [ebx + 0x31c]
or edi, 0xffffffff
mov dword [esp + 0x14], edx
lea eax, [ecx + ecx*2]
mov ebx, ecx
lea edx, [edx + eax*4]
mov eax, dword [edx + 8]
test eax, eax
je 0x102cf78b
cmp ebp, eax
jne 0x102cf770
mov eax, dword [esp + 0x20]
cmp eax, dword [edx]
je 0x102cf78d
lea eax, [ecx - 1]
mov ecx, dword [esp + 0x24]
test eax, eax
cmovns ecx, edi
inc esi
add ecx, ebx
cmp esi, dword [esp + 0x10]
jge 0x102cf78b
mov edx, dword [esp + 0x14]
jmp 0x102cf755
xor edx, edx
lea eax, [edx + 4]
neg edx
sbb edx, edx
and edx, eax
mov ecx, dword [edx]
test ecx, ecx
je 0x102cf7a5
mov eax, 1
lock xadd dword [ecx], eax
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 8
ret 0xc
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [ebx]
mov ebp, eax
push dword [esp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
call edx
test al, al
jne 0x102cf7e3
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
pop ebx
add esp, 8
ret 0xc
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x10]
push edi
push eax
call fcn.100553a0
mov ecx, dword [ebx]
add esp, 8
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push dword [eax + 0xc]
call dword [edx + 4]
mov ecx, dword [ebx]
mov esi, eax
push ebp
mov edx, dword [ecx]
call dword [edx + 0x1c]
cmp esi, edi
jne 0x102cf82e
mov esi, dword [esp + 0x10]
test esi, esi
je 0x102cf823
mov eax, 1
lock xadd dword [esi], eax
lea eax, [esp + 0x24]
mov ebx, 1
jmp 0x102cf839
lea eax, [esp + 0x20]
mov ebx, 2
xor esi, esi
mov ebp, dword [esp + 0x1c]
or edi, 0xffffffff
mov dword [eax], 0
mov dword [ebp], esi
test bl, 2
je 0x102cf874
mov esi, dword [esp + 0x20]
and ebx, 0xfffffffd
test esi, esi
je 0x102cf874
mov eax, edi
lock xadd dword [esi], eax
cmp eax, 1
jne 0x102cf874
mov ecx, esi
call fcn.100550a0
push esi
call fcn.100550c0
add esp, 4
test bl, 1
je 0x102cf89c
mov esi, dword [esp + 0x24]
test esi, esi
je 0x102cf89c
mov eax, edi
lock xadd dword [esi], eax
cmp eax, 1
jne 0x102cf89c
mov ecx, esi
call fcn.100550a0
push esi
call fcn.100550c0
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
je 0x102cf8bd
lock xadd dword [esi], edi
cmp edi, 1
jne 0x102cf8bd
mov ecx, esi
call fcn.100550a0
push esi
call fcn.100550c0
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x102d6fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.102d6b21
out 0xef, eax
or al, 0x8d
lea eax, [ebp - 0x84]
push eax
call fcn.102d6b31
push eax
push esi
push dword [ebp + 8]
call fcn.102d6ae6
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x102d731a
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.102d6a92
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x102d7091
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.102d6a92
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x102d705e
call fcn.102d6b21
bound ecx, qword [ebx + 0x7e8b2847]
cmp al, 3
dec byte [ecx - 0x8743]
dec dword [ebx + 0x8087]
add byte [ebx], bh
ret
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x102d8490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esp, 0xffe68be8
call [ebx]
out 0x41, al
inc edi
lea eax, [ebp - 0x6f4]
push eax
call fcn.102d6b31
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.102d6ae6
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x102d8bc7
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x102d869c
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
invalid
invalid
cmpsd dword [esi], dword es:[edi]
clc
Function at 0x102e0b90
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
mov bl, 2
mov dword [esp + 8], 0
push str.HB_OPTIONS
mov byte [esp + 0xc], bl
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x102e0c4e
cmp byte [esi], 0
je 0x102e0c4e
push ebp
push edi
push 0x3a
push esi
call sub.VCRUNTIME140.dll_strchr
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x102e0bec
mov eax, esi
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x102e0be0
sub eax, edx
lea ebp, [eax + esi]
mov edi, ebp
sub edi, esi
push edi
push str.uniscribe_bug_compatible
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x102e0c10
cmp edi, 0x18
jne 0x102e0c10
or bl, 4
mov byte [esp + 0x10], bl
push edi
push 0x103b9a28
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x102e0c30
cmp edi, 3
jne 0x102e0c30
or bl, 8
mov byte [esp + 0x10], bl
cmp byte [ebp], 0
je 0x102e0c3f
cmp byte [ebp + 1], 0
lea esi, [ebp + 1]
jne 0x102e0bc4
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop esi
mov dword [0x1044a300], eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 8]
pop esi
mov dword [0x1044a300], eax
pop ebx
pop ecx
ret
Function at 0x10304a10
Capabilities:
Query environment variable

Disassembly:
mov ecx, 0x1044a4ac
jmp 0x10304a20
sub esp, 0x28
push ebx
mov ebx, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x18], ebx
lea ecx, [esp + 8]
mov eax, 1
mov edx, dword [ebx]
xchg dword [ecx], eax
test edx, edx
jne 0x10304bed
push ebp
push esi
push edi
nop word [eax + eax]
push str.HB_SHAPER_LIST
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
test esi, esi
je 0x10304b8f
cmp byte [esi], 0
je 0x10304b8f
push 0x28
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 8
mov dword [esp + 0x20], edi
test edi, edi
je 0x10304b95
movups xmm0, xmmword [0x103ddcf8]
xor ecx, ecx
mov dword [esp + 0x10], ecx
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x103ddd08]
movups xmmword [edi + 0x10], xmm0
movq xmm0, qword [0x103ddd18]
movq qword [edi + 0x20], xmm0
push 0x2c
push esi
call sub.VCRUNTIME140.dll_strchr
mov ecx, eax
mov dword [esp + 0x20], eax
add esp, 8
test ecx, ecx
jne 0x10304ae1
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10304ad2
sub ecx, edx
add ecx, esi
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x10]
mov ebx, eax
cmp eax, 2
jae 0x10304b76
lea eax, [eax + eax*4]
mov ebp, ecx
lea edi, [edi + eax*4]
sub ebp, esi
mov dword [esp + 0x14], edi
nop
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10304b05
sub eax, edx
cmp ebp, eax
jne 0x10304b69
push ebp
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x10304b69
movups xmm0, xmmword [edi]
mov esi, dword [edi + 0x10]
mov eax, ebx
sub eax, dword [esp + 0x10]
movups xmmword [esp + 0x28], xmm0
lea eax, [eax + eax*4]
shl eax, 2
push eax
mov eax, dword [esp + 0x18]
push eax
add eax, 0x14
push eax
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [esp + 0x20]
add esp, 0xc
movups xmm0, xmmword [esp + 0x28]
inc dword [esp + 0x10]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], esi
add ecx, 0x14
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
inc ebx
add edi, 0x14
cmp ebx, 2
jb 0x10304b00
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
cmp byte [esi], 0
je 0x10304b89
inc esi
mov dword [esp + 0x1c], esi
jmp 0x10304ab8
mov ebx, dword [esp + 0x24]
jmp 0x10304b91
xor edi, edi
test edi, edi
jne 0x10304b9a
mov edi, 0x103ddcf8
mov ecx, edi
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
je 0x10304be3
test edi, edi
je 0x10304bbc
cmp edi, 0x103ddcf8
je 0x10304bbc
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [ebx]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0
mov eax, 1
xchg dword [edx], eax
test ecx, ecx
je 0x10304a50
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov eax, edx
pop ebx
add esp, 0x28
ret