joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10078bf2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10078c06
push ebx
sub ecx, edx
lea ebx, [ecx + 1]
lea eax, [ebx + 4]
push 0x100014bc
push eax
call fcn.10018970
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x10078c30
mov esi, 0x8007000e
jmp 0x10078c70
push ebx
push dword [esi]
push edi
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push edi
lea edx, [ebx + 4]
push edx
push 0
push 0
mov dword [ebx + edi], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push 0x10001d28
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x10078c70
push 0x10006660
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop ebx
test ecx, ecx
je 0x10078c82
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebp - 4], 0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x10078c96
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebx]
call fcn.10078994
mov edi, eax
test edi, edi
jne 0x10078cc3
mov esi, 0x8007000e
jmp 0x10078d61
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10078cc8
lea eax, [ebp - 4]
push eax
push edi
sub esi, ecx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
lea eax, [esi + 1]
push eax
push 0
push 0
push 0x10001d38
push ecx
call dword [edx + 0x1c]
mov esi, eax
test esi, esi
jns 0x10078cff
push 0x10006660
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10078d61
xor edi, edi
cmp dword [ebx + 4], edi
jbe 0x10078d61
xor ecx, ecx
mov dword [ebp + 0xc], ecx
add ecx, dword [ebx + 8]
mov eax, dword [ecx + 4]
dec eax
je 0x10078d3a
dec eax
je 0x10078d2c
dec eax
je 0x10078d1e
xor esi, esi
jmp 0x10078d52
push dword [ebp - 4]
push ecx
push dword [ebp + 8]
call fcn.10078bf2
jmp 0x10078d4c
push dword [ebp - 4]
push ecx
push dword [ebp + 8]
call fcn.10078b37
jmp 0x10078d4c
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
push dword [ebp + 8]
call fcn.10078a5c
mov esi, eax
test esi, esi
js 0x10078d61
mov ecx, dword [ebp + 0xc]
inc edi
add ecx, 0x10
mov dword [ebp + 0xc], ecx
cmp edi, dword [ebx + 4]
jb 0x10078d0b
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10078d6e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10078d7c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push 0x100014bc
push 0x2c
call fcn.10018970
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x10078db6
push 0x10006688
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, 0x8007000e
jmp 0x10078e94
mov esi, dword [ebp + 0xc]
push edi
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
push 4
pop ecx
fld dword [edi + 0x40]
lea eax, [ebx + 0x10]
lea edx, [ebp - 4]
push edx
fstp dword [eax]
add eax, ecx
fld dword [edi + 0x20]
push ebx
push 0x2c
fstp dword [eax]
add eax, ecx
fld dword [edi + 0x24]
push 0
push 0
fstp dword [eax]
add eax, ecx
fld dword [edi + 0x28]
push 0x100065bc
fstp dword [eax]
add eax, ecx
fld dword [edi + 0x30]
fstp dword [eax]
fld dword [edi + 0x34]
fstp dword [eax + ecx]
fld dword [edi + 0x38]
fstp dword [eax + ecx + 4]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
js 0x10078e66
cmp dword [edi + 0x44], 0
je 0x10078e73
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [edi + 0x44]
call fcn.10078994
mov edi, eax
test edi, edi
jne 0x10078e37
mov esi, 0x8007000e
jmp 0x10078e93
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10078e3c
lea eax, [ebp - 8]
push eax
push edi
sub esi, ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
lea eax, [esi + 1]
push eax
push 0
push 0
push 0x1000661c
push ecx
call dword [edx + 0x1c]
mov esi, eax
test esi, esi
jns 0x10078e73
push 0x10006660
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10078e93
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10078e93
cmp dword [eax], 0
je 0x10078e93
push dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.10078c96
mov esi, eax
pop edi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10078ea5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10078eb6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebp - 4], 0
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x10078f85
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
and dword [ebp - 4], 0
push ebx
push esi
push edi
push eax
call dword [ecx + 0x10]
mov ebx, eax
mov esi, ebx
imul esi, esi, 0xc
lea eax, [esi + 4]
push 0x100014bc
push eax
call fcn.10018970
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x10078fbf
mov esi, 0x8007000e
jmp 0x10079000
imul ebx, ebx, 3
push esi
push dword [ebp + 0x10]
lea eax, [edi + 4]
push eax
mov dword [edi], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push edi
lea edx, [esi + 4]
push edx
push 0
push 0
push 0x10001c38
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x10079000
push 0x10006660
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10079011
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebp - 4], 0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10079ff4
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
and dword [ebp - 0xc], 0
imul eax, eax, 0xc
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x20]
mov ecx, esi
shl ecx, 2
add ecx, 4
imul ecx, ebx
push edi
lea eax, [ecx + eax + 8]
push 0x100014bc
push eax
mov dword [ebp - 0x10], eax
call fcn.10018970
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 8], edi
test edi, edi
jne 0x1007a041
mov esi, 0x8007000e
jmp 0x1007a11f
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
mov dword [edi], eax
lea edx, [edi + 4]
test eax, eax
je 0x1007a08d
mov ebx, eax
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 0x24]
mov ecx, dword [esi + 0xc0]
imul ecx, eax
mov eax, dword [esi + 0x94]
movzx esi, word [eax + 2]
add ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
add esi, ecx
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add edx, 0xc
inc eax
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
cmp eax, ebx
jb 0x1007a056
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp + 0x18]
mov dword [edx], ebx
add edx, 4
test ecx, ecx
je 0x1007a0c6
test ebx, ebx
je 0x1007a0f4
mov eax, esi
shl eax, 2
mov dword [edx], esi
add edx, 4
xor edi, edi
test esi, esi
je 0x1007a0bf
mov eax, dword [ecx + edi*4]
mov dword [edx], eax
add edx, 4
inc edi
cmp edi, esi
jb 0x1007a0ad
mov eax, esi
shl eax, 2
add ecx, eax
dec ebx
jne 0x1007a0a2
jmp 0x1007a0f1
test ebx, ebx
je 0x1007a0f4
mov edi, dword [ebp + 0x14]
lea eax, [esi + esi]
mov dword [edx], esi
add edx, 4
xor ecx, ecx
test esi, esi
je 0x1007a0ec
movzx eax, word [edi + ecx*2]
mov dword [edx], eax
add edx, 4
inc ecx
cmp ecx, esi
jb 0x1007a0db
lea eax, [esi + esi]
add edi, eax
dec ebx
jne 0x1007a0d0
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push edi
push dword [ebp - 0x10]
push 0
push 0
push 0x1000660c
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x1007a11f
push 0x10006660
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x1007a130
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebp - 0xc], 0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x24
Function at 0x1007a145
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea ebx, [edi*8 + 4]
push 0x100014bc
push ebx
mov dword [ebp - 0xc], ebx
call fcn.10018970
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 8], esi
test esi, esi
jne 0x1007a17e
mov edi, 0x8007000e
jmp 0x1007a1ea
and dword [ebp + 0x10], 0
mov dword [esi], edi
lea edx, [esi + 4]
test edi, edi
je 0x1007a1c1
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov ecx, dword [esi + 0xc0]
mov eax, dword [esi + 0xa0]
imul ecx, ebx
movzx eax, word [eax + 2]
add ecx, dword [ebp + 0xc]
fld dword [eax + ecx]
fstp dword [edx]
add edx, 8
fld dword [eax + ecx + 4]
inc ebx
fstp dword [edx - 4]
cmp ebx, edi
jb 0x1007a191
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push esi
push ebx
push 0
push 0
push 0x100065fc
push eax
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
jns 0x1007a1ea
push 0x10006660
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1007a1fb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebp - 4], 0
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x1007a210
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ebx
imul esi, esi, 0x14
push edi
add esi, 4
push 0x100014bc
push esi
mov dword [ebp - 8], esi
call fcn.10018970
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1007a24a
mov esi, 0x8007000e
jmp 0x1007a2cd
xor ecx, ecx
mov dword [edi], ebx
mov dword [ebp + 0x10], ecx
test ebx, ebx
je 0x1007a2a4
lea esi, [edi + 4]
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [edx + 0xc0]
imul eax, ecx
add eax, dword [ebp + 0xc]
mov ecx, edx
push eax
call fcn.10079eee
mov ecx, dword [ebp + 0x10]
fld dword [ebp - 0x18]
mov dword [esi], ecx
push 4
pop eax
add esi, eax
fstp dword [esi]
add esi, eax
fld dword [ebp - 0x14]
fstp dword [esi]
add esi, eax
fld dword [ebp - 0x10]
fstp dword [esi]
add esi, eax
fld dword [ebp - 0xc]
fstp dword [esi]
add esi, eax
inc ecx
mov dword [ebp + 0x10], ecx
cmp ecx, ebx
jb 0x1007a258
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push edi
push esi
push 0
push 0
push 0x1000662c
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x1007a2cd
push 0x10006660
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1007a2de
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebp - 4], 0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1007aef9
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3ac
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp + 0x14]
push esi
xor esi, esi
and dword [ebp - 0x39c], esi
push edi
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp + 0x1c]
xor edi, edi
mov dword [ebp - 0x3a8], eax
test ecx, ecx
je 0x1007b06e
mov eax, dword [ebx + 0xc0]
imul eax, dword [ebp + 0x10]
add eax, 3
shr eax, 2
lea eax, [eax + ecx*4]
lea eax, [eax*4 + 8]
push 0x100014bc
push eax
mov dword [ebp - 0x3a4], eax
call fcn.10018970
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1007af83
mov esi, 0x8007000e
xor ebx, ebx
jmp 0x1007b058
mov eax, dword [ebx + 4]
mov dword [edi], eax
mov ecx, dword [ebx]
xor edx, edx
lea esi, [edi + 4]
cmp dword [ebx + 4], edx
jbe 0x1007afbd
add ecx, 5
movzx eax, byte [ecx - 1]
mov dword [esi], eax
movzx eax, byte [ecx]
mov dword [esi + 4], eax
movzx eax, byte [ecx + 1]
mov dword [esi + 8], eax
movzx eax, byte [ecx + 2]
mov dword [esi + 0xc], eax
add esi, 0x10
add ecx, 8
inc edx
cmp edx, dword [ebx + 4]
jb 0x1007af97
mov eax, dword [ebx + 0xc0]
imul eax, dword [ebp + 0x10]
add eax, 3
shr eax, 2
mov dword [esi], eax
push dword [ebx]
mov eax, dword [ebp - 0x3ac]
push dword [eax]
lea ecx, [ebp - 0x398]
call fcn.10051f24
xor ebx, ebx
push ebx
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x398]
push ebx
call fcn.100bd30f
push ebx
lea eax, [esi + 4]
push eax
push ebx
lea ecx, [ebp - 0x2d4]
call fcn.100bd30f
mov esi, ebx
cmp dword [ebp + 0x10], ebx
jbe 0x1007b026
push 1
push esi
push esi
lea ecx, [ebp - 0x398]
call fcn.1004be8d
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x1007b011
mov ecx, dword [ebp - 0x3a8]
mov eax, dword [ecx]
lea edx, [ebp - 0x39c]
push edx
push edi
push dword [ebp - 0x3a4]
push ebx
push ebx
push 0x10001cc8
push ecx
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jns 0x1007b058
push 0x10006660
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x39c]
test ecx, ecx
je 0x1007b06e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x39c], ebx
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.101becf5
leave
ret 0x18
Function at 0x100c2ca3
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
xor esi, esi
push edi
test ebx, ebx
je 0x100c2ccf
cmp ebx, 1
je 0x100c2ccf
push 0x100068e0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x8876086c
jmp 0x100c2dda
push 1
push 0x1c0
call sub.msvcrt.dll_calloc
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 4], edi
test edi, edi
jne 0x100c2cf0
mov edi, 0x8007000e
jmp 0x100c2dda
fld dword [ebp + 0xc]
mov dword [edi + 0xc], ebx
mov ebx, dword [ebp + 8]
fstp dword [edi + 4]
call fcn.100c243a
test eax, eax
je 0x100c2d1e
push dword [ebp + 0x14]
fld dword [ebp + 0x10]
push ecx
fstp dword [esp]
call fcn.100c3f9b
mov dword [edi + 0x1bc], eax
test eax, eax
jne 0x100c2d28
mov edi, 0x80004005
jmp 0x100c2dcb
mov dword [edi + 0x1c], esi
call fcn.10164377
mov ebx, eax
test ebx, ebx
jne 0x100c2d40
mov edi, 0x8007000e
jmp 0x100c2dcb
push 0x100c4682
push 0x1870a
push ebx
call fcn.10164540
push fcn.101c0ed5
push 0x18706
push ebx
call fcn.10164540
push 0x100c46e2
push 0x1870b
push ebx
call fcn.10164540
push 0x100c2387
push 0x1870d
push ebx
call fcn.10164540
push 0x100c2326
push 0x1870f
push ebx
call fcn.10164540
fld1
sub esp, 0x18
fstp qword [esp + 0x10]
fldz
fst qword [esp + 8]
fstp qword [esp]
push ebx
call fcn.1016451d
fld qword [0x100068d8]
push ecx
push ecx
fstp qword [esp]
push 0x1872c
push ebx
call fcn.1016442c
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x1c], ebx
mov dword [eax], edi
mov dword [ebp - 4], esi
xor edi, edi
mov esi, dword [ebp - 4]
test esi, esi
je 0x100c2dda
push dword [ebp + 8]
call fcn.100c2516
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100c3e72
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x100c3f53
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xa8], eax
call fcn.101bf530
mov eax, dword [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0xac], ecx
test eax, eax
jne 0x100c3f12
push 0x1000693c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x8876086c
jmp 0x100c3f7f
xor edx, edx
push edx
push edx
push eax
push ecx
push 0xffffffffffffffff
push esi
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
fld dword [ebp + 0x18]
push dword [ebp - 0xa4]
push dword [ebp - 0xa0]
push dword [ebp - 0x9c]
push ecx
push ecx
fstp dword [esp + 4]
fld dword [ebp + 0x14]
fstp dword [esp]
push dword [ebp - 0xac]
push ebx
push edi
call sym.d3dx9_43.dll_D3DXCreateTextA
jmp 0x100c3f7f
fld dword [ebp + 0x18]
push 1
push dword [ebp - 0xa4]
mov edx, esi
push dword [ebp - 0xa0]
push ecx
push ecx
mov ecx, dword [ebp - 0x9c]
fstp dword [esp + 4]
fld dword [ebp + 0x14]
fstp dword [esp]
push ebx
push edi
call fcn.100c3941
lea esp, [ebp - 0xb8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101becf5
leave
ret 0x20

Function at 0x100c480c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ecx + 4], 0
fldz
fstp qword [ebp - 0x18]
jne 0x100c4826
mov eax, 0x900
leave
ret
push esi
call fcn.100c4062
mov esi, dword [eax + 0x10]
cmp esi, 3
jb 0x100c48c1
dec esi
push edi
mov edi, dword [eax + 0xc]
fld dword [edi]
fsub dword [edi + esi*8 - 8]
fstp dword [ebp - 0x10]
fld dword [edi + 4]
fsub dword [edi + esi*8 - 4]
fstp dword [ebp - 0xc]
jne 0x100c4878
fld qword [ebp - 0x18]
fld st(0)
pop edi
fabs
fcomp qword [0x10006b70]
fnstsw ax
test ah, 5
jp 0x100c48b1
push 0x10006b10
fstp st(0)
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x100c48c1
fstp st(0)
mov eax, edi
add edi, 8
fld dword [edi]
fsub dword [eax]
fstp dword [ebp - 8]
fld dword [edi + 4]
fsub dword [eax + 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
fstp dword [ebp - 4]
call fcn.100c448f
fadd qword [ebp - 0x18]
dec esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
fst qword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jne 0x100c4876
jmp 0x100c4855
fldz
fcompp
fnstsw ax
test ah, 5
mov eax, 0x901
jnp 0x100c48c6
mov eax, 0x900
pop esi
leave
ret
Function at 0x100d704a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
xor ecx, ecx
sub eax, ecx
mov dword [ebp - 4], ecx
je 0x100d71c8
dec eax
je 0x100d70dd
dec eax
jne 0x100d715d
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x10]
mov ecx, dword [edi + 0x20]
mov esi, dword [ebp + 0xc]
add ecx, esi
cmp ecx, eax
jbe 0x100d70b7
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx]
add esi, dword [edi + 0x20]
push ecx
call dword [eax + 0x10]
add eax, eax
cmp esi, eax
ja 0x100d70a3
mov eax, dword [edi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov esi, eax
add esi, esi
mov ecx, dword [edi + 0x14]
push esi
call fcn.10018f24
test eax, eax
js 0x100d71ca
mov esi, dword [ebp + 0xc]
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx]
push esi
push dword [ebp + 8]
push ecx
call dword [eax + 0xc]
add eax, dword [edi + 0x20]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [eax], esi
add dword [edi + 0x20], esi
jmp 0x100d71c8
mov edx, dword [edi + 0x1c]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, 0x10000
ja 0x100d7107
mov eax, dword [edi + 0x18]
push ebx
push dword [ebp + 8]
add eax, edx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
add dword [edi + 0x1c], ebx
jmp 0x100d71c3
mov eax, 0x10000
cmp edx, eax
je 0x100d713a
test edx, edx
je 0x100d713a
sub eax, edx
push eax
mov eax, dword [edi + 0x18]
push dword [ebp + 8]
add eax, edx
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [edi + 0x1c]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
sub eax, edx
add esp, 0xc
add eax, 0x10000
jmp 0x100d713d
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edx, edx
je 0x100d7176
push 0
push dword [ebp + 0x10]
push 0x10000
push dword [edi + 0x18]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100d7164
mov eax, 0x80004005
jmp 0x100d71ca
mov ecx, 0x10000
add dword [edi + 0x20], ecx
sub ecx, dword [edi + 0x1c]
and dword [edi + 0x1c], 0
mov dword [ebp - 4], ecx
mov esi, ebx
sub esi, ecx
shr esi, 0x10
test esi, esi
je 0x100d71a8
push 0
push dword [ebp + 0x10]
shl esi, 0x10
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100d715d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add dword [edi + 0x20], esi
add ecx, esi
add eax, esi
jmp 0x100d71ab
mov eax, dword [ebp + 8]
cmp ecx, ebx
jae 0x100d71c3
mov esi, ebx
sub esi, ecx
push esi
push eax
push dword [edi + 0x18]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x1c], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100d71d6
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
sub eax, 0
je 0x100d721e
dec eax
je 0x100d71ef
dec eax
je 0x100d721e
jmp 0x100d720d
cmp dword [esi + 0x1c], 0
je 0x100d721e
push 0
lea eax, [ebp - 4]
push eax
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100d7214
mov eax, 0x80004005
jmp 0x100d7220
mov eax, dword [esi + 0x1c]
add dword [esi + 0x20], eax
and dword [esi + 0x1c], 0
xor eax, eax
pop esi
leave
ret

Function at 0x100dcaff
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x18]
imul eax, esi
add eax, ecx
mov dword [ebp + 0x14], eax
cmp ecx, eax
jae 0x100dcc3a
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push edi
lea edx, [ecx + eax*4]
mov eax, dword [ebp + 0x14]
lea edi, [esi + esi]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ebx
cmp ecx, edx
jae 0x100dcc20
mov eax, edx
sub eax, ecx
dec eax
shr eax, 3
lea ebx, [ecx + 4]
inc eax
mov dword [ebp + 0x10], ebx
mov dword [ebp - 8], eax
mov edi, dword [ebx + esi]
mov esi, dword [esi + ebx - 4]
mov ebx, dword [ebx - 4]
mov ecx, ebx
shr ecx, 2
mov eax, esi
shr eax, 2
mov edx, 0xffc03fc0
and eax, edx
and ecx, edx
add ecx, eax
mov eax, edi
shr eax, 2
and eax, edx
add ecx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
shr eax, 2
and eax, edx
lea edx, [ecx + eax - 0x7fff80]
mov ecx, ebx
mov eax, esi
and eax, 0xff00ff
and ecx, 0xff00ff
add ecx, eax
mov eax, edi
and eax, 0xff00ff
add ecx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
and eax, 0xff00ff
lea eax, [ecx + eax + 0x20002]
mov ecx, dword [ebp + 0x10]
shr eax, 2
xor edx, eax
shr ebx, 2
mov eax, 0x3fc03fc0
and ebx, eax
shr esi, 2
and esi, eax
shr edi, 2
and edi, eax
mov eax, dword [ecx]
add ebx, esi
mov esi, dword [ebp + 0x18]
shr eax, 2
add ebx, edi
and eax, 0x3fc03fc0
lea eax, [ebx + eax + 0x800080]
and edx, 0xff00ff
xor edx, eax
mov eax, dword [ebp - 4]
mov ebx, ecx
mov dword [eax], edx
add eax, 4
add ebx, 8
dec dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], ebx
jne 0x100dcb55
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
add ebx, dword [ebp + 0x1c]
add ecx, edi
add edx, edi
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], edx
cmp ecx, eax
jb 0x100dcb38
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 0x18