joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011f190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014964d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov eax, edx
mov dword [ebp - 0x10], eax
push esi
mov esi, ecx
push edi
test eax, eax
je 0x1011f30f
mov eax, dword [esi + 0x40]
cmp eax, 1
jl 0x1011f30f
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.1003ce60
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
mov edi, dword [ebp - 0x14]
shl eax, 4
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x40]
add esp, 0xc
xor ecx, ecx
test eax, eax
jle 0x1011f257
mov edx, dword [ebp - 0x14]
xor edi, edi
add edx, 6
cmp ecx, eax
jge 0x1011f30f
mov eax, dword [esi + 0x48]
movzx eax, word [edi + eax + 4]
cmp ecx, ebx
jge 0x1011f30f
mov word [edx - 2], ax
cmp ecx, dword [esi + 0x40]
jge 0x1011f30f
mov eax, dword [esi + 0x48]
inc ecx
mov ax, word [edi + eax + 6]
add edi, 0x1c
mov word [edx], ax
add edx, 0x10
mov eax, dword [esi + 0x40]
cmp ecx, eax
jl 0x1011f21e
mov edi, dword [ebp - 0x14]
test ebx, ebx
jle 0x1011f30f
mov ecx, dword [ebp - 0x10]
mov edx, edi
push ebx
call fcn.10128dc0
mov edx, dword [ebp - 0x14]
add esp, 4
xor edi, edi
xor ebx, ebx
add edx, 8
cmp dword [edx + 4], 0
je 0x1011f2d2
movzx ecx, word [edx]
cmp edi, dword [esi + 0x40]
jge 0x1011f30f
mov eax, dword [esi + 0x48]
mov word [ebx + eax + 8], cx
movzx ecx, word [edx + 2]
cmp edi, dword [esi + 0x40]
jge 0x1011f30f
mov eax, dword [esi + 0x48]
mov word [ebx + eax + 0xa], cx
cmp edi, dword [esi + 0x40]
jge 0x1011f30f
mov ecx, dword [esi + 0x48]
mov ax, word [edx - 4]
cmp ax, word [ecx + ebx + 4]
jne 0x1011f30f
movzx eax, word [edx - 2]
cmp ax, word [ecx + ebx + 6]
jne 0x1011f30f
mov ecx, eax
movzx eax, word [edx + 2]
add ecx, eax
cmp dword [esi + 0x20], ecx
cmovge ecx, dword [esi + 0x20]
mov dword [esi + 0x20], ecx
inc edi
add ebx, 0x1c
add edx, 0x10
cmp edi, dword [ebp - 0x1c]
jl 0x1011f277
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1011f301
mov eax, dword [0x101e6b78]
test eax, eax
je 0x1011f2f7
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10120d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi - 1]
cmp eax, 0xfffe
ja 0x10120dbb
mov edx, dword [ebp + 0x10]
lea eax, [edx - 1]
cmp eax, 0xfffe
ja 0x10120dbb
mov word [ebp - 0x18], si
lea eax, [ebp - 0x1c]
lea esi, [ecx + 0x40]
mov dword [ebp - 0x14], 0xffffffff
push eax
mov ecx, esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], bind
mov word [ebp - 0x16], dx
call fcn.1003cfc0
mov eax, dword [esi]
dec eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10120f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movss dword [ebp - 8], xmm3
mov dword [ebp - 4], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x101e6b78]
test eax, eax
je 0x10120f65
inc dword [eax + 0x36c]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx edx, byte [esi]
add esp, 4
movzx ecx, byte [esi + 1]
shl edx, 8
add edx, ecx
mov dword [ebp + 8], eax
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x10121048
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x10121048
movzx edi, byte [esi + 8]
movzx eax, byte [esi + 9]
shl edi, 8
add edi, eax
mov dword [0x101e6d7c], esi
movzx eax, byte [esi + 0xa]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0xb]
shl edi, 8
add esi, 0x10
add edi, eax
mov ecx, esi
mov eax, dword [ebp + 8]
add edi, eax
mov dword [0x101e8b6c], edi
mov dword [0x101e9d38], eax
mov dword [0x101e9d3c], eax
call fcn.1011dee0
cmp eax, esi
je 0x10121029
nop dword [eax]
cmp dword [0x101e9d3c], edi
ja 0x101210d2
mov ecx, eax
mov esi, eax
call fcn.1011dee0
cmp eax, esi
jne 0x10121010
cmp byte [eax], 5
jne 0x101210d2
cmp byte [eax + 1], 0xfa
jne 0x101210d2
cmp dword [0x101e9d3c], edi
jne 0x101210d2
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1012105e
mov ecx, 0x1d
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x80]
jmp 0x10121066
lea ecx, [ebp - 0x80]
call fcn.10121890
mov ecx, 0x1d
lea edi, [ebp - 0xf8]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xf8], 0
jne 0x101210d2
mov edx, dword [ebp - 4]
mov byte [ebp - 0xf0], 1
cmp byte [edx], 0
jne 0x101210d2
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xf8]
movss xmm0, dword [ebp - 8]
lea edi, [ebp - 0x80]
mov ecx, 0x1d
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [ebp - 0x7c], ebx
cmovne ecx, eax
movss dword [ebp - 0x70], xmm0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x50], ecx
push eax
mov ecx, edx
call fcn.101212f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x101212f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx], 0
jne 0x10121473
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x10121473
cmp dword [esi + 4], 0
jle 0x10121473
movss xmm0, dword [esi + 0x10]
comiss xmm0, dword [0x1017efe0]
jbe 0x10121473
cmp byte [esi + 0x3c], 0
jne 0x1012136e
mov ecx, 0x58
call fcn.101193e0
mov dword [ebp - 8], eax
test eax, eax
je 0x1012135b
mov ecx, eax
call fcn.1012a1f0
mov dword [ebp - 8], eax
lea ecx, [ebx + 0x34]
lea eax, [ebp - 8]
push eax
call fcn.1003c970
jmp 0x10121378
xor eax, eax
lea ecx, [ebx + 0x34]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.1003c970
jmp 0x10121378
cmp dword [ebx + 0x34], 0
je 0x10121473
mov edi, dword [ebx + 0x4c]
mov ecx, dword [ebx + 0x50]
cmp edi, ecx
jne 0x101213fe
inc edi
test ecx, ecx
je 0x10121392
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10121397
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x101213fe
mov eax, dword [0x101e6b78]
test eax, eax
je 0x101213af
inc dword [eax + 0x36c]
imul eax, edi, 0x74
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, dword [ebx + 0x54]
add esp, 4
mov dword [ebp - 8], eax
test edx, edx
je 0x101213f8
imul ecx, dword [ebx + 0x4c], 0x74
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebx + 0x54]
add esp, 0xc
test ecx, ecx
je 0x101213eb
mov eax, dword [0x101e6b78]
test eax, eax
je 0x101213eb
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 8]
add esp, 4
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x50], edi
imul eax, dword [ebx + 0x4c], 0x74
mov ecx, 0x1d
mov edi, dword [ebx + 0x54]
add edi, eax
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x4c]
inc eax
mov dword [ebx + 0x4c], eax
test eax, eax
jle 0x10121473
mov edi, dword [ebx + 0x54]
imul esi, eax, 0x74
cmp dword [esi + edi - 4], 0
jne 0x10121434
lea ecx, [ebx + 0x34]
call fcn.1003c910
mov eax, dword [eax]
mov dword [esi + edi - 4], eax
cmp byte [esi + edi - 0x6c], 0
jne 0x1012145f
mov ecx, dword [esi + edi - 0x70]
call fcn.101193e0
mov ecx, dword [ebp + 8]
push dword [esi + edi - 0x70]
mov dword [esi + edi - 0x74], eax
mov byte [esi + edi - 0x6c], 1
push dword [ecx]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, ebx
call fcn.101216c0
mov eax, dword [esi + edi - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x101216c0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x10121718
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x101216e8
mov eax, dword [0x101e6b78]
test eax, eax
je 0x101216de
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10121708
mov eax, dword [0x101e6b78]
test eax, eax
je 0x101216fe
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10121730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
jne 0x1012187e
mov ecx, dword [esi + 0x4c]
lea eax, [esi + 0x54]
xor edi, edi
mov dword [ebp - 4], eax
test ecx, ecx
jle 0x101217a7
xor ebx, ebx
mov eax, dword [eax]
mov edx, dword [ebx + eax]
test edx, edx
je 0x10121797
cmp edi, ecx
jge 0x1012187e
cmp byte [ebx + eax + 8], 0
je 0x10121797
mov eax, dword [0x101e6b78]
test eax, eax
je 0x1012177a
dec dword [eax + 0x36c]
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp edi, dword [esi + 0x4c]
jge 0x1012187e
mov eax, dword [esi + 0x54]
mov dword [ebx + eax], 0
mov ecx, dword [esi + 0x4c]
lea eax, [esi + 0x54]
inc edi
add ebx, 0x74
cmp edi, ecx
jl 0x10121753
jmp 0x101217aa
mov dword [ebp - 4], eax
mov edx, dword [esi + 0x34]
xor ecx, ecx
test edx, edx
jle 0x101217fc
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + ecx*4]
mov eax, dword [ebp - 4]
mov ebx, dword [edi + 0x3c]
cmp ebx, dword [eax]
jb 0x101217f4
cmp ecx, edx
jge 0x1012187e
imul eax, dword [esi + 0x4c], 0x74
mov edx, dword [ebp - 4]
add eax, dword [edx]
cmp ebx, eax
jae 0x101217f4
mov dword [edi + 0x3c], 0
cmp ecx, dword [esi + 0x34]
jge 0x1012187e
mov eax, dword [esi + 0x3c]
xor edx, edx
mov eax, dword [eax + ecx*4]
mov word [eax + 0x40], dx
mov edx, dword [esi + 0x34]
inc ecx
cmp ecx, edx
jl 0x101217b3
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x10121835
mov eax, dword [0x101e6b78]
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
test eax, eax
je 0x10121820
dec dword [eax + 0x36c]
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ecx
call ebx
add esp, 4
mov dword [esi + 0x54], 0
jmp 0x1012183b
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10121870
mov eax, dword [0x101e6b78]
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
test eax, eax
je 0x1012185f
dec dword [eax + 0x36c]
push ecx
call ebx
add esp, 4
mov dword [esi + 0x48], 0
nop dword [eax]
pop edi
mov dword [esi + 0x58], 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10121f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, ecx
push ebx
push esi
push edi
mov edi, dword [edx + 0x48]
test edi, edi
je 0x10121f9b
mov eax, dword [edx + 0x50]
mov edi, dword [eax + edi*4 - 4]
jmp 0x10121f9d
xor edi, edi
mov esi, dword [edx]
mov dword [ebp - 4], edi
test esi, esi
je 0x1012204d
jg 0x10121fb4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ebx, dword [edx + 8]
mov ecx, esi
shl ecx, 5
add ebx, 0xffffffe0
add ebx, ecx
je 0x1012204d
mov eax, dword [ebx]
test eax, eax
je 0x10121fd2
cmp dword [ebx + 0x14], edi
jne 0x1012204d
cmp dword [ebx + 0x18], 0
jne 0x1012204d
xor ecx, ecx
lea edi, [ebx - 0x20]
cmp esi, 1
cmovle edi, ecx
mov dword [ebp - 8], edi
test eax, eax
jne 0x10122040
test edi, edi
je 0x10122040
mov eax, dword [ebp - 4]
cmp dword [edi + 0x14], eax
jne 0x10122040
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x1012200a
mov eax, dword [edx + 0x44]
shl ecx, 4
add eax, 0xfffffff0
add ecx, eax
jmp 0x10122010
mov ecx, dword [edx + 0x28]
add ecx, 0x14
lea esi, [edi + 4]
mov edi, 0xc
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x10122040
add esi, 4
add ecx, 4
sub edi, 4
jae 0x10122018
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x10122040
mov ecx, edx
call fcn.1003ca60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov dword [ebx + 0x14], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.10122150
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10122150
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
test edx, edx
je 0x1012217f
mov eax, dword [ecx + 0x44]
shl edx, 4
add eax, 0xfffffff0
add eax, edx
jmp 0x10122185
mov eax, dword [ecx + 0x28]
add eax, 0x14
movups xmm0, xmmword [eax]
mov edx, dword [ecx + 0x48]
movups xmmword [ebp - 0x1c], xmm0
test edx, edx
je 0x1012219f
mov eax, dword [ecx + 0x50]
mov eax, dword [eax + edx*4 - 4]
mov dword [ebp - 0xc], eax
jmp 0x101221a6
mov dword [ebp - 0xc], 0
movss xmm0, dword [ebp - 0x14]
comiss xmm0, dword [ebp - 0x1c]
jb 0x101221c9
movss xmm0, dword [ebp - 0x10]
comiss xmm0, dword [ebp - 0x18]
jb 0x101221c9
lea eax, [ebp - 0x20]
push eax
call fcn.1003d180
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x101252a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x3c], 0
jne 0x101252c8
push dword [ebp + 8]
call fcn.10126c70
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [esp + 0x10], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x3c], 0
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
movups xmmword [esp + 0x4c], xmm0
mov dword [esp + 0x70], 0
movups xmmword [esp + 0x5c], xmm0
call fcn.101254e0
mov ebx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x10125380
mov eax, dword [esp + 0x3c]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [0x101e6b78]
add ecx, ecx
test eax, eax
je 0x10125349
inc dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebx], eax
mov dword [esp + 0x68], eax
mov edx, edi
lea eax, [esp + 0x40]
mov ecx, esi
push eax
call fcn.101254e0
add esp, 4
test eax, eax
je 0x10125380
mov eax, dword [esp + 0x6c]
cmp eax, dword [esp + 0x3c]
je 0x10125388
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10125420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x34], 1
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0
push eax
mov edi, edx
mov dword [ebp - 0xc], 0
mov ebx, ecx
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x4c], xmm0
call fcn.101254e0
mov esi, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x101254d1
mov eax, dword [ebp - 8]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [0x101e6b78]
add ecx, ecx
test eax, eax
je 0x101254a1
inc dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [esi], eax
mov edx, edi
mov dword [ebp - 0x3c], eax
mov ecx, ebx
lea eax, [ebp - 0x64]
push eax
call fcn.101254e0
add esp, 8
test eax, eax
je 0x101254d1
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 8]
je 0x101254d9
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10126710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 0x78]
movq xmm0, qword [edi + 0x70]
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], eax
test eax, eax
js 0x10126892
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
jg 0x10126750
xor ecx, ecx
jmp 0x10126762
mov bl, byte [esi]
mov ecx, 1
mov dword [ebp - 0x20], 1
test bl, bl
jne 0x10126793
add ecx, edx
cmp ecx, eax
jg 0x10126892
test ecx, ecx
js 0x10126892
cmp ecx, eax
jl 0x10126785
xor al, al
movzx eax, al
mov dword [ebp - 4], eax
jmp 0x10126825
mov al, byte [esi + ecx]
movzx eax, al
mov dword [ebp - 4], eax
jmp 0x10126825
cmp bl, 3
jne 0x10126825
mov edx, 2
lea ecx, [ebp - 0x24]
call fcn.10128cf0
mov esi, eax
lea ecx, [ebp - 0x24]
mov edx, 2
mov dword [ebp - 0x14], esi
call fcn.10128cf0
xor ebx, ebx
mov dword [ebp - 8], eax
test esi, esi
jle 0x10126825
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
nop dword [eax]
cmp edx, edi
jl 0x101267d8
xor al, al
jmp 0x101267dc
mov al, byte [esi + edx]
inc edx
movzx eax, al
mov dword [ebp - 0x18], eax
cmp edx, edi
jl 0x101267ea
xor al, al
jmp 0x101267ee
mov al, byte [esi + edx]
inc edx
movzx eax, al
cmp edx, edi
jl 0x101267f9
xor cl, cl
jmp 0x101267fd
mov cl, byte [esi + edx]
inc edx
shl eax, 8
movzx ecx, cl
or eax, ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jl 0x10126811
cmp ecx, eax
jl 0x1012681c
inc ebx
mov dword [ebp - 8], eax
cmp ebx, dword [ebp - 0x14]
jl 0x101267d0
jmp 0x10126822
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0xc]
movq xmm0, qword [edi + 0x64]
sub esp, 0xc
mov eax, dword [edi + 0x6c]
mov edx, esp
mov ecx, dword [ebp - 4]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [ebp - 0x24]
push eax
call fcn.101286d0
add esp, 4
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [edi + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [edi + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x30]
push eax
call fcn.10128270
mov edx, dword [ebp + 8]
add esp, 0x1c
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x101278f0
Capabilities:
Terminate process

Disassembly:
cmp dword [ecx + 0x3c], 0
push ebx
mov ebx, edx
je 0x10127901
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp ebx, dword [ecx + 0xc]
jge 0x101279ad
mov eax, dword [ecx + 0x30]
cmp eax, 2
jge 0x101279ad
mov edx, dword [ecx + 0x18]
push esi
push edi
mov edi, dword [ecx + 0x10]
add edi, dword [ecx + 4]
test eax, eax
jne 0x10127956
movzx ecx, byte [edi + ebx*2]
movzx eax, byte [edi + ebx*2 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*2 + 3]
lea esi, [edx + ecx*2]
movzx ecx, byte [edi + ebx*2 + 2]
shl ecx, 8
add ecx, eax
pop edi
lea eax, [edx + ecx*2]
or ecx, 0xffffffff
cmp esi, eax
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
ret
movzx ecx, byte [edi + ebx*4]
movzx eax, byte [edi + ebx*4 + 1]
movzx esi, byte [edi + ebx*4 + 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 5]
shl ecx, 8
add ecx, edx
add esi, ecx
movzx ecx, byte [edi + ebx*4 + 4]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 7]
shl ecx, 8
add ecx, edx
add eax, ecx
or ecx, 0xffffffff
cmp esi, eax
pop edi
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop ebx
ret
Function at 0x10128270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push edi
push eax
mov edx, 0x12
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 0x18]
mov dword [ebp - 8], 0
call fcn.101288c0
add esp, 4
xor esi, esi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
jge 0x101282ce
lea ecx, [ebp - 0x18]
call fcn.10128aa0
mov dword [ebp + esi*4 - 0xc], eax
inc esi
cmp esi, 2
jge 0x101282ce
mov eax, dword [ebp - 0x10]
jmp 0x101282b2
mov edi, dword [ebp - 8]
test edi, edi
je 0x101283d1
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x101283d1
xor edx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edx
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x18], xmm0
push ebx
mov ebx, dword [ebp + 0x14]
test edi, edi
js 0x10128321
test ecx, ecx
js 0x10128321
cmp edi, ebx
jg 0x10128321
mov eax, ebx
sub eax, edi
cmp ecx, eax
jg 0x10128321
mov eax, dword [ebp + 0xc]
mov edx, ecx
add eax, edi
mov dword [ebp - 0x18], eax
movq xmm0, qword [ebp - 0x18]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], edx
push eax
mov edx, 0x13
movq qword [ebp - 0x18], xmm0
lea ecx, [ebp - 0x18]
call fcn.101288c0
add esp, 4
xor esi, esi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
nop
cmp dword [ebp - 0x14], eax
jge 0x1012836c
lea ecx, [ebp - 0x18]
call fcn.10128aa0
mov dword [ebp + esi*4 - 4], eax
inc esi
cmp esi, 1
jge 0x1012836c
mov eax, dword [ebp - 0x10]
jmp 0x10128350
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10128393
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
movq xmm0, qword [ebp - 0x18]
pop ebx
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
add eax, edi
cmp eax, ebx
jg 0x101283c9
test eax, eax
js 0x101283c9
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.10128b80
mov edx, dword [ebp + 8]
add esp, 4
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop ebx
pop edi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movq xmm0, qword [ebp - 0x18]
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101286d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x101287ec
push ebx
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jg 0x101286fa
xor bl, bl
mov dword [ebp - 0x14], 1
xor eax, eax
jmp 0x1012870a
mov bl, byte [edi]
mov edx, 1
mov eax, edx
mov dword [ebp - 0x14], 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
movzx ebx, bl
cmp edx, esi
jl 0x10128721
xor al, al
jmp 0x10128730
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edi]
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
shl ebx, 8
movzx eax, al
or ebx, eax
cmp dword [ebp - 4], esi
jl 0x10128741
xor al, al
jmp 0x1012874b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
inc edx
mov al, byte [eax + edi]
movzx edi, al
test ecx, ecx
js 0x101287ec
cmp ecx, ebx
jge 0x101287ec
lea eax, [edi - 1]
cmp eax, 3
ja 0x101287ec
mov eax, edi
imul eax, ecx
add eax, edx
cmp eax, esi
jg 0x101287ec
test eax, eax
js 0x101287ec
mov edx, edi
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0xc]
call fcn.10128cf0
mov edx, edi
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.10128cf0
lea ecx, [ebx + 1]
mov dword [ebp - 0x20], 0
imul ecx, edi
mov edx, eax
sub edx, esi
add esi, 2
pop edi
pop ebx
add ecx, esi
xor esi, esi
mov dword [ebp - 0x1c], esi
movq xmm0, qword [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
test ecx, ecx
js 0x101287dd
test edx, edx
js 0x101287dd
mov eax, dword [ebp + 0x14]
cmp ecx, eax
jg 0x101287dd
sub eax, ecx
cmp edx, eax
jg 0x101287dd
mov eax, dword [ebp + 0xc]
mov esi, edx
add eax, ecx
mov dword [ebp - 0x20], eax
movq xmm0, qword [ebp - 0x20]
mov eax, dword [ebp + 8]
movq qword [eax], xmm0
mov dword [eax + 8], esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3