joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419dac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x419ed1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00419bb4
mov esi, eax
mov eax, dword [0x4537ec]
cmp byte [eax], 0
je 0x419e79
mov eax, dword [0x453660]
call fcn.00404764
call fcn.004043c0
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x419d7c]
call fcn.004083f4
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x419eec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x419eb5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x45361c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x456c54]
call fcn.004084b8
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419ed8
lea eax, [ebp - 4]
mov edx, dword [0x419d7c]
call fcn.00408400
ret

Function at 0x41b4ec
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41b518
cmp bl, 0
je 0x41b514
cmp bl, 0x41
jl 0x41b50f
cmp bl, 0x5a
jg 0x41b50f
or bl, 0x20
xor al, bl
inc esi
jmp 0x41b4f3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp fcn.0041b448

Function at 0x4261ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4261fe
test eax, edx
je 0x426201
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4261c1
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4261e7
add ecx, 4
js 0x4261d7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4261e4
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x42620d
test edx, edx
jne 0x4261b4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x4397fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x458fb8
cmp dword [edi], 0
jne 0x439878
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x458fb4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x453478
mov ecx, 2
call fcn.00404410
mov edx, 0x4397d4
lea eax, [esi + 5]
call fcn.004397f4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004397f4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43984d
mov dword [0x458fb4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x444fd8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x445074
push 0
mov eax, ebx
call fcn.004071a0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x44504f
mov ebx, esi
test ebx, ebx
je 0x445021
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004071a0
push eax
push 1
push 0
mov eax, edi
call fcn.004071a0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x44506a
mov ecx, dword [0x453678]
mov dl, 1
mov eax, dword [0x443370]
call fcn.00419fbc
call fcn.00405db0
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x446b98
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffde8
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00406618
test ebx, ebx
jg 0x446bd5
push 0x105
lea eax, [esp + 0x10]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov dword [esp + 8], eax
lea edx, [esp + 0xc]
mov eax, esi
mov ecx, dword [esp + 8]
call fcn.00406790
jmp 0x446c35
call sub.kernel32.dll_GetCommandLineW_1
mov dword [esp], eax
mov eax, esp
xor ecx, ecx
xor edx, edx
call fcn.00446b00
dec ebx
test ebx, ebx
je 0x446bfe
mov eax, esp
xor ecx, ecx
xor edx, edx
call fcn.00446b00
test al, al
je 0x446c35
jmp 0x446be8
mov eax, dword [esp]
mov dword [esp + 4], eax
lea ecx, [esp + 8]
lea eax, [esp + 4]
xor edx, edx
call fcn.00446b00
test al, al
je 0x446c35
mov eax, esi
mov edx, dword [esp + 8]
call fcn.0040731c
mov eax, dword [esi]
call fcn.004071a0
mov edx, eax
mov eax, esp
xor ecx, ecx
call fcn.00446b00
add esp, 0x218
pop esi
pop ebx
ret
Function at 0x44a8ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x44a934
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageW
test eax, eax
je 0x44a926
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageW
push 1
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, esi
cmp edi, ebx
jg 0x44a904
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x44bb3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00409990
xor eax, eax
push ebp
push 0x44bc76
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.00444f40
xor eax, eax
push ebp
push 0x44bc46
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
movzx ebx, word [eax + 0x30]
dec ebx
test ebx, ebx
jl 0x44bc2b
inc ebx
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.00444f40
mov eax, dword [ebp - 0x1c]
and eax, 2
cmp eax, 2
jne 0x44bc23
mov eax, dword [ebp - 0x1c]
and eax, 1
dec eax
jne 0x44bc23
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.00444f40
lea eax, [ebp - 8]
call fcn.0040991c
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.00444f40
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00444f40
lea eax, [edi + 4]
mov edx, dword [ebp - 8]
call fcn.00409934
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0044baa4
inc esi
dec ebx
jne 0x44bb9e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bc4d
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x4c]
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x20195dd1
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0xf837372
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1001f4c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x101da21c], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x1001f57a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x101da218], eax
inc ebx
cmp ebx, 0x100
jb 0x1001f4e0
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x1001f5a6
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101da218]
sub edi, 1
jne 0x1001f585
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1001f5d8
nop dword [eax]
cmp cl, 0x23
jne 0x1001f5bf
cmp byte [esi], cl
jne 0x1001f5bf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x101da218]
test cl, cl
jne 0x1001f5b0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10035df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x158
mov eax, dword [0x101383dc]
xor eax, esp
mov dword [esp + 0x154], eax
push esi
push edi
mov edi, dword [0x10138e58]
mov dword [esp + 0x2c], edx
mov edx, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x38], edx
mov eax, dword [edi + 0x1804]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], edi
mov byte [eax + 0x8e], 1
mov eax, dword [edi + 0x1804]
mov dword [esp + 0x24], eax
cmp byte [eax + 0x90], 0
je 0x10035e5d
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.100c2ed5
mov esp, ebp
pop ebp
ret
movss xmm0, dword [edi + 0x1424]
addss xmm0, xmm0
addss xmm0, dword [edi + 0x1734]
movss dword [esp + 0x5c], xmm0
test cl, 0x10
je 0x10035e81
xorps xmm3, xmm3
jmp fcn.10035e8c
movaps xmm3, xmm0
addss xmm3, dword [edi + 0x1438]
pop eax
lahf
cmp byte [eax + eax], dl
invalid

Function at 0x10035f91
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax + edx - 0x7f], dh
loope 0x10035f96
invalid
aas
invalid
Function at 0x100370b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x148
mov eax, dword [0x101383dc]
xor eax, esp
mov dword [esp + 0x144], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edx
mov edx, ecx
mov ecx, dword [0x10138e58]
mov dword [esp + 0x4c], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 0x1804]
push edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x84], edx
mov byte [eax + 0x8e], 1
mov eax, dword [ecx + 0x1804]
mov ecx, edx
mov dword [esp + 0x98], eax

Function at 0x10037183
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x10], ecx
mov eax, ecx
mov edx, ecx
and eax, 0x202
and edx, 2
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x60], edx
movss xmm0, dword [eax + 0xdc]
movss xmm4, dword [eax + 0xd8]
mov eax, dword [0x10138e58]
movss dword [esp + 0x14], xmm0
movss dword [esp + 0x44], xmm0
xorps xmm0, xmm0
movss dword [esp + 0x24], xmm4
movss xmm5, dword [eax + 0x1424]
addss xmm5, xmm5
movss dword [esp + 0x40], xmm4
addss xmm5, dword [eax + 0x1734]
xor al, 0x17
add byte [eax], al
mov eax, dword [eax + 0x1804]
mov dword [esp + 0x88], eax
movss xmm2, dword [eax + 0x144]
comiss xmm0, xmm2
movss dword [esp + 0x38], xmm5
jbe 0x10037285
mov ecx, dword [eax + 0x1a0]
movss xmm3, dword [eax + 0xd8]
movss xmm1, dword [eax + 0x4c]
mov dword [esp + 0x98], ecx
subss xmm3, dword [eax + 0x14]
test ecx, ecx
je 0x10037271
mov edx, dword [ecx + 0xc]
movss xmm0, dword [ecx + 0x14]
lea eax, [edx + 1]
test eax, eax
cmovns edx, eax
lea ecx, [edx*8]
sub ecx, edx
mov edx, dword [esp + 0x98]
movss xmm1, dword [edx + 0x18]
sbb byte [ebx + 0xff33442], cl
pop esp
enter 0x548b, 0x24
pushal
mulss xmm1, dword [eax + ecx*4]
mov eax, dword [esp + 0x88]
addss xmm1, xmm0
subss xmm1, dword [eax + 0x54]
subss xmm1, xmm3
addss xmm1, xmm2
movss xmm2, dword [0x1012a3c4]
maxss xmm2, xmm1
movss xmm3, dword [esi + 0x1438]
cvttss2si eax, xmm2
movaps xmm0, xmm3
addss xmm0, xmm5
movd xmm2, eax
xor eax, eax
cmp dword [esp + 0xc4], 0x200
cvtdq2ps xmm2, xmm2
sete al
inc eax
movd xmm1, eax
xor eax, eax
cvtdq2ps xmm1, xmm1
test edx, edx
sete al
mulss xmm1, xmm0
Function at 0x1004d3c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp ecx, edi
jb 0x1004d3ba
xor dl, dl
jmp fcn.1004d3bf
mov dl, byte [ecx]
inc ecx
mov dword [esi], ecx
inc eax
cmp eax, 4
jl 0x1004d3b2
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
jne 0x1004d42d
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
ja 0x1004d42d
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x1004d40f
mov edx, edi
mov ecx, esi
call 0x10099497
test eax, eax
je 0x1004d437
push edi
push dword [esi]
push dword [esi + 0x10]
call 0x10112106
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x1018d91c], str.Corrupt_PNG
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008bfee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp eax, 0x1f
ja 0x1008f66e
push ecx
push edx
call 0x1014e630
add esp, 8
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0x8b409
push str.glow.amout
lea ecx, [ebp - 0x28]
call 0x1015aa64
int3

Function at 0x1008c015
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
call fcn.100977a1
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x28]
movss xmm2, dword [0x1012a620]
mov edx, 0x1013946c
call 0x10111a5a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10096f46
push str.local_visuals.active
lea ecx, [ebp - 0x28]
mov dword [0x1018db18], 0x10123b28
call fcn.1009769d
push 0
mov edx, 0x10139510
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x28]
call 0x10111680
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10096f7f
push str.local_visuals.player.glow.enable
lea ecx, [ebp - 0x28]
call fcn.100976cc
push 0
mov edx, 0x10139511
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x28]
call 0x101116af
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10096fae
push str.local_visuals.player.glow.behind_wall
lea ecx, [ebp - 0x28]
call fcn.100976fb
push 0
mov edx, 0x10139512
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x28]
call 0x101116de
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10096fdd
push str.local_visuals.player.glow.color_tt
lea ecx, [ebp - 0x28]
Function at 0x10093898
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1009e74e
push str.fps_boost.type
lea ecx, [ebp - 0x28]
call fcn.1009ee9b
push 0
mov edx, 0x10183264
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x28]
call 0x1011906e
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1009e77d
push str.fps_boost.skipframes
adc dl, byte [eax]
lea ecx, [ebp - 0x28]
call fcn.1009eeca
xorps xmm2, xmm2
mov byte [ebp - 4], 0x51
mov edx, 0x10183268
sbb byte [eax], dl
lea ecx, [ebp - 0x28]
call 0x101192be
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.1009e7aa
add byte [eax + 0x70], ch
push 0x12
adc byte [ebp + 0x3ce8d84d], cl
mov dh, 0
add byte [edx], ch
mov edx, 0x1018326c
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x28]
call 0x10118eda
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1009e7d9
push str.fps_boost.visual_value
lea ecx, [ebp - 0x28]
call fcn.1009ef26
xorps xmm2, xmm2
mov byte [ebp - 4], 0x53
mov edx, 0x10183270
lea ecx, [ebp - 0x28]
call 0x1011931a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.1009e806

Function at 0x1009a46b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ecx + 0x18], eax
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x20], eax
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x24], eax
mov eax, dword [edx + 0x28]
invalid

Function at 0x100bb650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc edi
jo 0x100bb646
movups xmm3, xmmword [esi + 0xb48]

Function at 0x100bb7ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [edi + 0xb58], 0xc1800000
movss dword [edi + 0xb5c], xmm0

Function at 0x100bbafc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mulss xmm0, xmm2
movss xmm2, dword [0x1012a3c4]
divss xmm2, dword [edi + 0x2c]
addss xmm0, xmm3
movss xmm3, dword [ebp - 0x128]
mulss xmm3, xmm7
movss xmm7, dword [edi + 0x50]
movaps xmm4, xmm7
mulss xmm7, dword [ebp - 0x10c]
movss dword [ebp - 0x110], xmm0
movaps xmm0, xmm6
mulss xmm0, dword [ebp - 0x110]
mulss xmm6, dword [ebp - 0x124]
mulss xmm4, xmm1
movss xmm1, dword [0x1012a8c8]
addss xmm7, xmm6
addss xmm4, xmm0
movaps xmm0, xmm5
mulss xmm5, dword [ebp - 0x114]
mulss xmm0, xmm3
addss xmm7, xmm5
addss xmm4, xmm0
loopne 0x100bbb67
mulps xmm7, xmm2
mulss xmm4, dword [0x1012a88c]
comiss xmm1, xmm7
mulss xmm4, xmm2
movss xmm2, dword [0x1012a74c]
jbe 0x100bbb95
movaps xmm0, xmm1
jmp 0x100bbb9c
movaps xmm0, xmm2
minss xmm0, xmm7
comiss xmm1, xmm4
movss dword [edi + 0x34], xmm0
jbe 0x100bbbab
movaps xmm0, xmm1
jmp 0x100bbbb2
movaps xmm0, xmm2
minss xmm0, xmm4
movss dword [edi + 0x38], xmm0
Function at 0x100bbb72
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mulss xmm0, xmm2
movss xmm2, dword [0x1012a3c4]
divss xmm2, dword [edi + 0x2c]
addss xmm0, xmm3
movss xmm3, dword [ebp - 0x128]
mulss xmm3, xmm7
movss xmm7, dword [edi + 0x50]
movaps xmm4, xmm7
mulss xmm7, dword [ebp - 0x10c]
movss dword [ebp - 0x110], xmm0
movaps xmm0, xmm6
mulss xmm0, dword [ebp - 0x110]
mulss xmm6, dword [ebp - 0x124]
mulss xmm4, xmm1
movss xmm1, dword [0x1012a8c8]
addss xmm7, xmm6
addss xmm4, xmm0
movaps xmm0, xmm5
mulss xmm5, dword [ebp - 0x114]
mulss xmm0, xmm3
addss xmm7, xmm5
addss xmm4, xmm0
loopne 0x100bbb67
mulps xmm7, xmm2
mulss xmm4, dword [0x1012a88c]
comiss xmm1, xmm7
mulss xmm4, xmm2
movss xmm2, dword [0x1012a74c]
jbe 0x100bbb95
movaps xmm0, xmm1
jmp 0x100bbb9c
movaps xmm0, xmm2
minss xmm0, xmm7
comiss xmm1, xmm4
movss dword [edi + 0x34], xmm0
jbe 0x100bbbab
movaps xmm0, xmm1
jmp 0x100bbbb2
movaps xmm0, xmm2
minss xmm0, xmm4
movss dword [edi + 0x38], xmm0
Function at 0x100c0be1
Capabilities:
Check for software breakpoints

Disassembly:
or ecx, dword [eax + edx]
mov al, byte [0x1cffffff]
add byte [eax], al
add al, dh
or ecx, dword [eax + edx]
push 0x636a0073
arpl word [eax], ax
push 0x6d
jo 0x100c0bfb
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100c0c49
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100c0c49
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100c0c49
xor eax, eax
jmp 0x100c0c8a
mov dword [ebp - 4], 1
jmp 0x100c0c5b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100c0c85
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
ret 0x474
xor eax, eax
jmp 0x100c0c8a
jmp 0x100c0c52
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100c0c00
Capabilities:
Check for software breakpoints

Disassembly:
or ecx, dword [eax + edx]
mov al, byte [0x1cffffff]
add byte [eax], al
add al, dh
or ecx, dword [eax + edx]
push 0x636a0073
arpl word [eax], ax
push 0x6d
jo 0x100c0bfb
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100c0c49
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100c0c49
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100c0c49
xor eax, eax
jmp 0x100c0c8a
mov dword [ebp - 4], 1
jmp 0x100c0c5b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100c0c85
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
ret 0x474
xor eax, eax
jmp 0x100c0c8a
jmp 0x100c0c52
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100dfe4f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [eax - 0x3ca30000], al
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101383dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
xor eax, eax
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x20
jae 0x100dff4e
mov byte [ebp + eax - 0x24], 0
inc eax
cmp eax, 0x20
jl 0x100dfe75
mov bl, byte [esi]
movzx edx, bl
mov ecx, edx
and edx, 7
shr ecx, 3
movzx eax, byte [ebp + ecx - 0x24]
bts eax, edx
inc esi
mov byte [ebp + ecx - 0x24], al
test bl, bl
jne 0x100dfe86
test edi, edi
jne 0x100dfead
mov edi, dword [ebp - 0x2c]
mov edi, dword [edi]
mov al, byte [edi]
mov ebx, edi
movzx edx, al
loopne 0x100dfe49
inc esp
adc eax, 0x8a3574dc
dec ebp
fisttp dword [ebx - 0x75217409]
rol dword [ecx + ecx*8 + 0x7e8d2b74], 1
call 0x101a2a6f
int3