joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053a50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ebx, dword [edi + 8]
cmp esi, ebx
jb 0x10053b49
mov ecx, dword [edi]
lea eax, [ebx + ecx*8]
cmp esi, eax
ja 0x10053b49
mov eax, dword [edi + 4]
sub esi, ebx
sar esi, 3
cmp ecx, eax
jne 0x10053b0a
inc ecx
test eax, eax
je 0x10053a94
cdq
sub eax, edx
mov edx, dword [edi + 4]
sar eax, 1
add eax, edx
jmp 0x10053a9c
mov edx, dword [edi + 4]
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jle 0x10053b0a
mov eax, dword [0x1017bfd8]
test eax, eax
je 0x10053ab7
inc dword [eax + 0x36c]
lea eax, [ecx*8]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [edi + 8]
test eax, eax
je 0x10053b01
mov ecx, dword [edi]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 8]
add esp, 0xc
test ecx, ecx
je 0x10053af7
mov eax, dword [0x1017bfd8]
test eax, eax
je 0x10053af7
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 8], ebx
mov dword [edi + 4], eax
mov ecx, dword [edi]
cmp esi, ecx
jge 0x10053b26
sub ecx, esi
lea eax, [ebx + esi*8]
shl ecx, 3
push ecx
push eax
add eax, 8
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, dword [ebp + 0xc]
shl esi, 3
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [edi + 8]
mov dword [esi + eax], ecx
mov dword [esi + eax + 4], edx
inc dword [edi]
mov eax, dword [edi + 8]
pop edi
add eax, esi
pop esi
pop ebx
pop ebp
ret 8
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10053d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
mov dword [ebp - 4], eax
push esi
mov esi, ecx
movd xmm0, ebx
pshufd xmm1, xmm0, 0
push edi
cmp eax, 0xffff
jg 0x10053eb7
cmp dword [ebp + 8], 0xffff
jg 0x10053eb7
mov ecx, dword [ebp + 0x10]
xor edi, edi
dec ecx
test ecx, ecx
jle 0x10053e55
cmp ecx, 8
jb 0x10053e36
movaps xmm2, xmmword [0x101453e0]
mov eax, ecx
and eax, 0x80000007
jns 0x10053d90
dec eax
or eax, 0xfffffff8
inc eax
movaps xmm3, xmmword [str._b_b_b_b]
mov edx, ecx
sub edx, eax
mov dword [ebp - 8], edx
lea edx, [ebx + 0xc]
mov ebx, dword [ebp - 8]
movd xmm0, edi
lea eax, [edi + 4]
pshufd xmm0, xmm0, 0
lea edx, [edx + 0x40]
paddd xmm0, xmm2
add edi, 8
pslld xmm0, 3
paddd xmm0, xmm1
paddd xmm0, xmm3
movd dword [edx - 0x48], xmm0
psrldq xmm0, 4
movd dword [edx - 0x40], xmm0
psrldq xmm0, 4
movd dword [edx - 0x38], xmm0
psrldq xmm0, 4
movd dword [edx - 0x30], xmm0
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
pslld xmm0, 3
paddd xmm0, xmm1
paddd xmm0, xmm3
movd dword [edx - 0x28], xmm0
psrldq xmm0, 4
movd dword [edx - 0x20], xmm0
psrldq xmm0, 4
movd dword [edx - 0x18], xmm0
psrldq xmm0, 4
movd dword [edx - 0x10], xmm0
cmp edi, ebx
jl 0x10053da4
mov ebx, dword [ebp + 0xc]
cmp edi, ecx
jge 0x10053e52
lea eax, [edi*8 + 4]
mov edx, ecx
add eax, ebx
sub edx, edi
mov edi, ecx
lea ecx, [eax + 4]
mov dword [eax], ecx
lea eax, [eax + 8]
sub edx, 1
jne 0x10053e45
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x20]
mov dword [ebx + edi*8 + 4], 0
mov dword [esi], eax
dec eax
mov dword [esi + 0x1c], ebx
mov ebx, dword [ebp + 0x10]
add eax, ebx
mov dword [esi + 4], edx
cdq
idiv ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov word [ecx], ax
mov ecx, dword [ebp - 4]
mov word [esi + 0x22], ax
lea eax, [esi + 0x28]
mov dword [esi + 0x24], eax
mov word [eax], cx
mov eax, 0xffff
pop edi
mov word [esi + 0x2a], ax
mov dword [esi + 0x2c], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10053ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
movzx esi, word [edx]
add eax, ecx
mov dword [ebp - 0x10], eax
push edi
cmp esi, ecx
jg 0x10053f97
mov eax, dword [edx + 4]
movzx eax, word [eax]
cmp eax, ecx
jle 0x10053f97
xor edi, edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 0x10]
jge 0x10053f89
movzx eax, word [edx + 2]
mov dword [ebp - 8], eax
cmp eax, edi
jle 0x10053f44
mov ecx, eax
mov dword [ebp - 4], eax
movzx eax, word [edx]
sub ecx, edi
mov edx, dword [edx + 4]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
imul ecx, ebx
movzx esi, word [edx]
mov eax, esi
cmp dword [ebp - 8], edi
jge 0x10053f38
sub eax, edi
add ebx, eax
mov eax, esi
movzx esi, ax
jmp 0x10053f72
sub eax, dword [ebp - 8]
add ebx, eax
mov eax, esi
movzx esi, ax
jmp 0x10053f72
mov esi, dword [edx + 4]
movzx eax, word [edx]
mov edx, dword [ebp + 0xc]
sub edx, ebx
mov dword [ebp - 0x14], esi
movzx edi, word [esi]
mov ecx, edi
mov esi, edi
sub ecx, eax
lea eax, [ecx + ebx]
cmp eax, dword [ebp + 0xc]
cmovle edx, ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
add ebx, edx
imul ecx, edx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add eax, ecx
movzx ecx, si
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp - 0x10]
jl 0x10053f02
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10054470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov ebx, dword [esi + 4]
mov edi, dword [esi + 8]
cmp ebx, edi
jl 0x1005448d
xor edx, edx
mov ecx, ebx
xor al, al
jmp 0x100544ac
mov eax, dword [esi]
lea ecx, [ebx + 1]
mov al, byte [ebx + eax]
mov dword [esi + 4], ecx
movzx edx, al
cmp ecx, edi
jl 0x100544a3
xor al, al
jmp 0x100544ac
mov eax, dword [esi]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 4], ecx
shl edx, 8
movzx eax, al
or edx, eax
je 0x10054503
cmp ecx, edi
jl 0x100544be
xor al, al
jmp 0x100544c7
mov eax, dword [esi]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 4], ecx
movzx eax, al
mov dword [ebp - 4], eax
dec eax
cmp eax, 3
ja 0x1005454c
mov eax, dword [ebp - 4]
imul edx, eax
add edx, ecx
cmp edx, edi
jg 0x1005454c
test edx, edx
js 0x1005454c
mov dword [esi + 4], edx
mov ecx, esi
mov edx, eax
call fcn.10054420
mov ecx, dword [esi + 4]
mov edi, dword [esi + 8]
dec ecx
add ecx, eax
cmp ecx, edi
jg 0x1005454c
test ecx, ecx
js 0x1005454c
mov dword [esi + 4], ecx
xor edx, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], edx
sub ecx, ebx
movq xmm0, qword [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
test ebx, ebx
js 0x1005453b
test ecx, ecx
js 0x1005453b
cmp ebx, edi
jg 0x1005453b
sub edi, ebx
cmp ecx, edi
jg 0x1005453b
mov eax, dword [esi]
mov edx, ecx
add eax, ebx
mov dword [ebp - 0x10], eax
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10054560
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
mov edx, dword [esi + 4]
cmp edx, edi
jl 0x10054572
xor al, al
jmp 0x1005457b
mov eax, dword [esi]
mov al, byte [edx + eax]
inc edx
mov dword [esi + 4], edx
movzx ecx, al
lea eax, [ecx - 0x20]
cmp eax, 0xd6
ja 0x10054591
pop edi
lea eax, [ecx - 0x8b]
pop esi
ret
lea eax, [ecx - 0xf7]
push ebx
cmp eax, 3
ja 0x100545d0
cmp edx, edi
jl 0x100545b4
xor bl, bl
shl ecx, 8
movzx eax, bl
pop ebx
add eax, 0xffff096c
pop edi
add eax, ecx
pop esi
ret
mov eax, dword [esi]
shl ecx, 8
mov bl, byte [edx + eax]
lea eax, [edx + 1]
mov dword [esi + 4], eax
movzx eax, bl
pop ebx
add eax, 0xffff096c
pop edi
add eax, ecx
pop esi
ret
lea eax, [ecx - 0xfb]
cmp eax, 3
ja 0x10054612
cmp edx, edi
jl 0x100545f4
shl ecx, 8
xor bl, bl
mov eax, 0xfa94
sub eax, ecx
movzx ecx, bl
pop ebx
pop edi
sub eax, ecx
pop esi
ret
mov eax, dword [esi]
shl ecx, 8
mov bl, byte [edx + eax]
lea eax, [edx + 1]
mov dword [esi + 4], eax
mov eax, 0xfa94
sub eax, ecx
movzx ecx, bl
pop ebx
pop edi
sub eax, ecx
pop esi
ret
cmp ecx, 0x1c
jne 0x1005464f
cmp edx, edi
jl 0x1005462b
xor edx, edx
xor al, al
pop ebx
shl edx, 8
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
lea ecx, [edx + 1]
mov al, byte [edx + eax]
mov dword [esi + 4], ecx
movzx edx, al
cmp ecx, edi
jl 0x100546e5
xor al, al
shl edx, 8
pop ebx
movzx eax, al
pop edi
or eax, edx
pop esi
ret
cmp ecx, 0x1d
jne 0x100546fa
cmp edx, edi
jl 0x10054672
xor edx, edx
xor al, al
shl edx, 8
shl edx, 8
pop ebx
shl edx, 8
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
lea ecx, [edx + 1]
mov al, byte [edx + eax]
mov dword [esi + 4], ecx
movzx edx, al
cmp ecx, edi
jl 0x10054698
shl edx, 8
xor al, al
shl edx, 8
pop ebx
shl edx, 8
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
shl edx, 8
mov al, byte [ecx + eax]
inc ecx
movzx eax, al
or edx, eax
mov dword [esi + 4], ecx
mov ebx, edx
cmp ecx, edi
jl 0x100546c0
shl edx, 8
xor al, al
pop ebx
shl edx, 8
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
mov edx, ebx
shl edx, 8
mov al, byte [ecx + eax]
inc ecx
movzx eax, al
or edx, eax
mov dword [esi + 4], ecx
cmp ecx, edi
jl 0x100546e5
xor al, al
shl edx, 8
pop ebx
movzx eax, al
pop edi
or eax, edx
pop esi
ret
mov eax, dword [esi]
pop ebx
shl edx, 8
pop edi
mov al, byte [ecx + eax]
inc ecx
movzx eax, al
mov dword [esi + 4], ecx
or eax, edx
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10054710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov eax, dword [edi + 8]
test eax, eax
js 0x1005486f
xor ecx, ecx
mov dword [edi + 4], ecx
cmp ecx, eax
jge 0x10054832
xor ebx, ebx
mov dword [ebp - 4], ebx
nop dword [eax + eax]
mov ecx, dword [edi + 4]
mov esi, dword [edi + 8]
cmp ecx, esi
jge 0x100547a3
mov ebx, dword [edi]
mov al, byte [ebx + ecx]
cmp al, 0x1c
jb 0x1005479f
cmp al, 0x1e
jne 0x10054796
lea eax, [ecx + 1]
cmp eax, esi
jg 0x1005486f
test eax, eax
js 0x1005486f
mov dword [edi + 4], eax
cmp eax, esi
jge 0x10054740
mov cl, byte [ebx + eax]
inc eax
movzx edx, cl
mov ecx, edx
mov dword [edi + 4], eax
and ecx, 0xf
cmp cl, 0xf
je 0x10054740
and edx, 0xfffffff0
cmp edx, 0xf0
je 0x10054740
cmp eax, esi
jl 0x10054771
jmp 0x10054740
mov ecx, edi
call fcn.10054560
jmp 0x10054740
cmp ecx, esi
jl 0x100547a9
xor al, al
mov edx, ecx
jmp 0x100547b4
mov eax, dword [edi]
lea edx, [ecx + 1]
mov al, byte [ecx + eax]
mov dword [edi + 4], edx
movzx eax, al
cmp eax, 0xc
jne 0x100547d5
cmp edx, esi
jl 0x100547c4
xor al, al
jmp 0x100547cd
mov eax, dword [edi]
mov al, byte [edx + eax]
inc edx
mov dword [edi + 4], edx
movzx eax, al
or eax, 0x100
cmp eax, dword [ebp - 8]
je 0x100547e6
cmp edx, esi
jge 0x10054832
mov dword [ebp - 4], edx
jmp 0x10054740
mov ebx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 0x14], 0
sub ecx, ebx
mov dword [ebp - 0x10], edx
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
test ebx, ebx
js 0x10054821
test ecx, ecx
js 0x10054821
cmp ebx, esi
jg 0x10054821
sub esi, ebx
cmp ecx, esi
jg 0x10054821
mov eax, dword [edi]
mov edx, ecx
add eax, ebx
mov dword [ebp - 0x14], eax
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
jl 0x1005485a
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10054880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x1005499c
push ebx
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jg 0x100548aa
xor bl, bl
mov dword [ebp - 0x14], 1
xor eax, eax
jmp 0x100548ba
mov bl, byte [edi]
mov edx, 1
mov eax, edx
mov dword [ebp - 0x14], 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
movzx ebx, bl
cmp edx, esi
jl 0x100548d1
xor al, al
jmp 0x100548e0
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edi]
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
shl ebx, 8
movzx eax, al
or ebx, eax
cmp dword [ebp - 4], esi
jl 0x100548f1
xor al, al
jmp 0x100548fb
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc edx
mov al, byte [eax + edi]
movzx edi, al
test ecx, ecx
js 0x1005499c
cmp ecx, ebx
jge 0x1005499c
lea eax, [edi - 1]
cmp eax, 3
ja 0x1005499c
mov eax, edi
imul eax, ecx
add eax, edx
cmp eax, esi
jg 0x1005499c
test eax, eax
js 0x1005499c
mov edx, edi
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0xc]
call fcn.10054420
mov edx, edi
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.10054420
lea ecx, [ebx + 1]
mov dword [ebp - 0x20], 0
imul ecx, edi
mov edx, eax
sub edx, esi
add esi, 2
pop edi
pop ebx
add ecx, esi
xor esi, esi
mov dword [ebp - 0x1c], esi
movq xmm0, qword [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
test ecx, ecx
js 0x1005498d
test edx, edx
js 0x1005498d
mov eax, dword [ebp + 0x14]
cmp ecx, eax
jg 0x1005498d
sub eax, ecx
cmp edx, eax
jg 0x1005498d
mov eax, dword [ebp + 0xc]
mov esi, edx
add eax, ecx
mov dword [ebp - 0x20], eax
movq xmm0, qword [ebp - 0x20]
mov eax, dword [ebp + 8]
movq qword [eax], xmm0
mov dword [eax + 8], esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10054bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push edi
push eax
mov edx, 0x12
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 0x18]
mov dword [ebp - 8], 0
call fcn.10054710
add esp, 4
xor esi, esi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
jge 0x10054c0e
lea ecx, [ebp - 0x18]
call fcn.10054560
mov dword [ebp + esi*4 - 0xc], eax
inc esi
cmp esi, 2
jge 0x10054c0e
mov eax, dword [ebp - 0x10]
jmp 0x10054bf2
mov edi, dword [ebp - 8]
test edi, edi
je 0x10054d11
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x10054d11
xor edx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edx
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x18], xmm0
push ebx
mov ebx, dword [ebp + 0x14]
test edi, edi
js 0x10054c61
test ecx, ecx
js 0x10054c61
cmp edi, ebx
jg 0x10054c61
mov eax, ebx
sub eax, edi
cmp ecx, eax
jg 0x10054c61
mov eax, dword [ebp + 0xc]
mov edx, ecx
add eax, edi
mov dword [ebp - 0x18], eax
movq xmm0, qword [ebp - 0x18]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], edx
push eax
mov edx, 0x13
movq qword [ebp - 0x18], xmm0
lea ecx, [ebp - 0x18]
call fcn.10054710
add esp, 4
xor esi, esi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
nop
cmp dword [ebp - 0x14], eax
jge 0x10054cac
lea ecx, [ebp - 0x18]
call fcn.10054560
mov dword [ebp + esi*4 - 4], eax
inc esi
cmp esi, 1
jge 0x10054cac
mov eax, dword [ebp - 0x10]
jmp 0x10054c90
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10054cd3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
movq xmm0, qword [ebp - 0x18]
pop ebx
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
add eax, edi
cmp eax, ebx
jg 0x10054d09
test eax, eax
js 0x10054d09
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.10054470
mov edx, dword [ebp + 8]
add esp, 4
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop ebx
pop edi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movq xmm0, qword [ebp - 0x18]
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100555d0
Capabilities:
Terminate process

Disassembly:
cmp dword [ecx + 0x3c], 0
push ebx
mov ebx, edx
je 0x100555e1
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp ebx, dword [ecx + 0xc]
jge 0x1005568d
mov eax, dword [ecx + 0x30]
cmp eax, 2
jge 0x1005568d
mov edx, dword [ecx + 0x18]
push esi
push edi
mov edi, dword [ecx + 0x10]
add edi, dword [ecx + 4]
test eax, eax
jne 0x10055636
movzx ecx, byte [edi + ebx*2]
movzx eax, byte [edi + ebx*2 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*2 + 3]
lea esi, [edx + ecx*2]
movzx ecx, byte [edi + ebx*2 + 2]
shl ecx, 8
add ecx, eax
pop edi
lea eax, [edx + ecx*2]
or ecx, 0xffffffff
cmp esi, eax
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
ret
movzx ecx, byte [edi + ebx*4]
movzx eax, byte [edi + ebx*4 + 1]
movzx esi, byte [edi + ebx*4 + 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 5]
shl ecx, 8
add ecx, edx
add esi, ecx
movzx ecx, byte [edi + ebx*4 + 4]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 7]
shl ecx, 8
add ecx, edx
add eax, ecx
or ecx, 0xffffffff
cmp esi, eax
pop edi
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop ebx
ret
Function at 0x10056230
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movq xmm0, qword [ecx + 0x70]
mov eax, edx
push ebx
push esi
mov esi, dword [ecx + 0x78]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 4], 0xffffffff
push edi
test esi, esi
js 0x100563c9
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
jg 0x1005626d
xor ecx, ecx
jmp 0x1005627a
mov bl, byte [edi]
mov edx, 1
mov ecx, edx
test bl, bl
jne 0x100562a5
add eax, ecx
cmp eax, esi
jg 0x100563c9
test eax, eax
js 0x100563c9
cmp eax, esi
jl 0x1005629a
xor al, al
movzx eax, al
jmp 0x10056356
mov al, byte [edi + eax]
movzx eax, al
jmp 0x10056356
cmp bl, 3
jne 0x10056359
mov eax, ecx
cmp eax, esi
jl 0x100562b8
xor al, al
jmp 0x100562c0
mov al, byte [eax + edi]
mov edx, 2
movzx ecx, al
cmp edx, esi
jl 0x100562cb
xor al, al
jmp 0x100562cf
mov al, byte [edi + edx]
inc edx
shl ecx, 8
movzx eax, al
or ecx, eax
mov dword [ebp - 0xc], ecx
cmp edx, esi
jl 0x100562e2
xor al, al
jmp 0x100562e6
mov al, byte [edi + edx]
inc edx
movzx ecx, al
cmp edx, esi
jl 0x100562f1
xor al, al
jmp 0x100562f5
mov al, byte [edi + edx]
inc edx
shl ecx, 8
xor ebx, ebx
movzx eax, al
or ecx, eax
mov dword [ebp - 8], ecx
cmp dword [ebp - 0xc], ebx
jbe 0x10056359
cmp edx, esi
jl 0x1005630f
xor al, al
jmp 0x10056313
mov al, byte [edi + edx]
inc edx
movzx eax, al
mov dword [ebp - 0x14], eax
cmp edx, esi
jl 0x10056321
xor al, al
jmp 0x10056325
mov al, byte [edi + edx]
inc edx
movzx eax, al
cmp edx, esi
jl 0x10056330
xor cl, cl
jmp 0x10056334
mov cl, byte [edi + edx]
inc edx
shl eax, 8
movzx ecx, cl
or eax, ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jl 0x10056348
cmp ecx, eax
jl 0x10056353
inc ebx
mov dword [ebp - 8], eax
cmp ebx, dword [ebp - 0xc]
jl 0x10056307
jmp 0x10056359
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 0x18]
sub esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, esp
movq xmm0, qword [esi + 0x64]
mov eax, dword [esi + 0x6c]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [ebp - 0x24]
push eax
call fcn.10054880
add esp, 4
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [esi + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [esi + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x30]
push eax
call fcn.10054bb0
mov edx, dword [ebp + 8]
add esp, 0x1c
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1005ad50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
push edi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x1005ad89
mov eax, dword [esi + 0x44]
shl ecx, 4
add eax, 0xfffffff0
add eax, ecx
jmp 0x1005ad8f
mov eax, dword [esi + 0x28]
add eax, 0x14
movups xmm0, xmmword [eax]
mov ecx, dword [esi + 0x48]
movups xmmword [esp + 0x14], xmm0
test ecx, ecx
je 0x1005adab
mov eax, dword [esi + 0x50]
mov eax, dword [eax + ecx*4 - 4]
mov dword [esp + 0x24], eax
jmp 0x1005adb3
mov dword [esp + 0x24], 0
movss xmm0, dword [esp + 0x1c]
comiss xmm0, dword [esp + 0x14]
jb 0x1005ae19
movss xmm0, dword [esp + 0x20]
comiss xmm0, dword [esp + 0x18]
jb 0x1005ae19
mov edi, dword [esi]
mov ecx, dword [esi + 4]
cmp edi, ecx
jne 0x1005adf8
inc edi
test ecx, ecx
je 0x1005ade6
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1005adeb
mov eax, 8
cmp eax, edi
mov ecx, esi
cmovg edi, eax
push edi
call fcn.10061060
mov eax, dword [esi]
movups xmm0, xmmword [esp + 0x10]
shl eax, 5
add eax, dword [esi + 8]
pop edi
movups xmmword [eax], xmm0
movups xmm0, xmmword [esp + 0x1c]
movups xmmword [eax + 0x10], xmm0
inc dword [esi]
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1005af20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, ecx
push ebx
push esi
mov esi, dword [edx + 0x48]
push edi
test esi, esi
je 0x1005af3b
mov eax, dword [edx + 0x50]
mov esi, dword [eax + esi*4 - 4]
jmp 0x1005af3d
xor esi, esi
mov edi, dword [edx]
mov dword [ebp - 4], esi
test edi, edi
je 0x1005afec
jle 0x1005afe4
mov ebx, dword [edx + 8]
mov ecx, edi
shl ecx, 5
add ebx, 0xffffffe0
add ebx, ecx
je 0x1005afec
mov eax, dword [ebx]
test eax, eax
je 0x1005af6e
cmp dword [ebx + 0x14], esi
jne 0x1005afec
cmp dword [ebx + 0x18], 0
jne 0x1005afec
xor ecx, ecx
lea esi, [ebx - 0x20]
cmp edi, 1
cmovle esi, ecx
mov dword [ebp - 8], esi
test eax, eax
jne 0x1005afd7
test esi, esi
je 0x1005afd7
mov eax, dword [ebp - 4]
cmp dword [esi + 0x14], eax
jne 0x1005afd7
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x1005afa6
mov eax, dword [edx + 0x44]
shl ecx, 4
add eax, 0xfffffff0
add ecx, eax
jmp 0x1005afac
mov ecx, dword [edx + 0x28]
add ecx, 0x14
add esi, 4
mov edi, 0xc
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x1005afd7
add esi, 4
add ecx, 4
sub edi, 4
jae 0x1005afb4
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x1005afd7
dec dword [edx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov dword [ebx + 0x14], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, edx
call fcn.1005ad50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005b2c0
Capabilities:
Terminate process

Disassembly:
mov edx, ecx
cmp dword [edx + 0x64], 0
jg 0x1005b2d0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [edx + 0x60]
test eax, eax
je 0x1005b33d
movq xmm0, qword [edx]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x70]
movq qword [eax + ecx*8], xmm0
lea ecx, [eax + ecx*8]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0x60]
movq xmm0, qword [edx + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x70]
movq qword [eax + ecx*8 + 0xc], xmm0
lea ecx, [eax + ecx*8]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
mov ecx, dword [edx + 0x70]
mov dword [edx + 0x60], 0
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
movq xmm0, qword [ecx + 0xc]
movq qword [edx + 0xc], xmm0
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x14], eax
mov ecx, dword [edx + 0xc]
lea eax, [eax + ecx*2]
mov dword [edx + 0x38], eax
ret 4