joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x407467
pop dword [ebp - 0x44]
mov eax, 0x407467
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x71eccdaf
sub dword [ebp - 0x54], 0x239a8864
mov dword [ebp - 0x50], 0xc7381d75
add dword [ebp - 0x50], 0x6afb2ed0
mov dword [ebp - 0x4c], 0xee02530a
add dword [ebp - 0x4c], 0x5e49f124
mov dword [ebp - 0x48], 0x54ed4dcc
sub dword [ebp - 0x48], 0x54ed4dcc
lea eax, [ebp - 0x54]
push eax
mov eax, 0xd2a4bf5e
sub eax, 0xd2643ee6
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x81beb637
add dword [ebp - 0x54], 0xf2b3b31f
mov dword [ebp - 0x50], 0x6595f8a7
add dword [ebp - 0x50], 0xdbd668ce
mov dword [ebp - 0x4c], 0x789195ff
add dword [ebp - 0x4c], 0xeaddd66d
mov dword [ebp - 0x48], 0xf74224c3
sub dword [ebp - 0x48], 0xf74224c3
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39de0
push 0
call eax
mov ecx, 0x41b0611b
sub ecx, 0x41b00e0b
xor edx, edx
add edx, eax
mov esi, 0x110bb19d
sub esi, 0x10c62f9d
add esi, dword [ebp - 0x44]
mov ebx, 0xc1c3b404
sub ebx, 0x237d58b5
add dword [ebp - 8], ecx
mov edi, dword [esi]
xor dword [ebp - 0x28], ecx
sub edi, ebx
mov dword [ebp - 0x40], 0x4d799bbb
mov dword [edx], edi
add dword [ebp - 0x3c], 0xaf65486b
add edx, 4
add esi, 0x3d37e819
sub esi, 0x3d37e815
loop 0x407581
add eax, 0x1596a436
add eax, 0xea6a9add
mov ebx, eax
add eax, 0x440cae9f
sub eax, 0x440cae9a
mov ecx, 0x63bf1823
add ecx, 0x9c80e7dd
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1000c080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x1000c0a4
jl 0x1000c099
test ecx, ecx
jne 0x1000c0a4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
push edi
mov edi, ecx
je 0x1000c17b
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
nop dword [eax + eax]
mov ecx, ebx
call fcn.10020f90
mov ecx, edx
mov esi, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jl 0x1000c113
jg 0x1000c0d8
test esi, esi
je 0x1000c113
mov eax, dword [ebp - 4]
cmp eax, ecx
jg 0x1000c0eb
nop
jl 0x1000c0e6
cmp edi, esi
jae 0x1000c0eb
mov esi, edi
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push dword [ebp + 8]
call fcn.100e8fa0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 4]
sub edi, esi
sbb ecx, dword [ebp - 8]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x1000c138
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x1000c165
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
mov byte [eax], cl
mov ecx, dword [ebp - 4]
adc ecx, 0xffffffff
add eax, esi
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
test ecx, ecx
jg 0x1000c0c0
jl 0x1000c168
test edi, edi
jne 0x1000c0c0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x1000c1bd
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [eax]
test eax, eax
je 0x1000c1c3
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.100e8fa0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp + 8], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000c1c3
lea eax, [ebx + 0x2c]
mov dword [ebp - 8], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x1000c239
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000c1ef
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [eax], edx
cmp edi, 0xfff
jbe 0x1000c224
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.101113a0
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1000c239
nop
cmp edi, eax
ja 0x1000c200
test edi, edi
je 0x1000c239
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.101113a0
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1005fc60
call fcn.100609c0
jmp fcn.1002f8c0
Function at 0x100354a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1023dad4]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1cdc]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xc4
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10159988]
sub esi, 1
jne 0x100354d0
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x10035517
inc ecx
test esi, esi
je 0x10035505
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1003550a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1004bbc0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10035540
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1023dad4]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1cdc]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xc4
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10159988]
sub esi, 1
jne 0x10035570
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x100355b7
inc ecx
test esi, esi
je 0x100355a5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x100355aa
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1004bbc0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1003a7a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x1003a806
mov cl, byte ds:[esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1003a7e9
cmp edi, 2
jb 0x1003a7e9
cmp byte [esi], cl
jne 0x1003a7e9
cmp byte [esi + 1], cl
jne 0x1003a7e9
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10159988]
jmp 0x1003a7b7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10159988]
test edi, edi
jne 0x1003a7b7
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1003a838
nop dword [eax]
cmp cl, 0x23
jne 0x1003a81f
cmp byte [esi], cl
jne 0x1003a81f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10159988]
test cl, cl
jne 0x1003a810
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x1003b080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x10], ecx
lea eax, [ebx + eax*4]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x1003b23f
push esi
mov esi, dword [ebp + 0x14]
push edi
nop dword [eax + eax]
test esi, esi
je 0x1003b0bc
cmp eax, esi
jae 0x1003b23a
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x1003b23a
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x10159ec8]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x1003b0ee
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x1003b103
mov bh, byte [esi]
jmp 0x1003b105
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 2], bh
cmp esi, edx
jae 0x1003b113
mov ch, byte [esi]
jmp 0x1003b115
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 1], ch
cmp esi, edx
jae 0x1003b123
mov bl, byte [esi]
jmp 0x1003b125
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp + 0xf], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x10159ee8]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10159f10]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x10159efc]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0x10ffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x10159f24]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1003b218
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp + 0xf], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x1003b21e
add eax, ebx
test esi, esi
je 0x1003b237
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
add ecx, 4
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x1003b0b0
jmp 0x1003b23a
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
pop edi
pop esi
mov edx, dword [ebp + 0x18]
mov dword [ecx], 0
test edx, edx
je 0x1003b24e
mov dword [edx], eax
sub ecx, ebx
sar ecx, 2
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
xor edx, edx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x1003b288
nop dword [eax + eax]
cmp eax, esi
jae 0x1003b401
mov cl, byte [eax]
mov byte [ebp - 3], cl
test cl, cl
je 0x1003b401
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x10159ec8]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x1003b2ba
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x1003b2d2
mov bl, byte [esi]
mov byte [ebp - 1], bl
jmp 0x1003b2d6
mov byte [ebp - 1], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x1003b2e2
mov ch, byte ds:[esi]
jmp 0x1003b2e4
xor ch, ch
lea ebx, [eax + 3]
mov byte [ebp - 3], ch
cmp ebx, edx
jae 0x1003b2f2
mov bl, byte [ebx]
jmp 0x1003b2f4
xor bl, bl
movzx esi, byte [ebp - 1]
movzx edx, ch
movzx ecx, cl
movzx edi, bl
mov byte [ebp - 2], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x10159ee8]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10159f10]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x10159efc]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0x10ffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x10159f24]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1003b3e8
xor edx, edx
cmp byte [ebp - 4], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x1003b26e
add eax, ebx
test esi, esi
je 0x1003b3f7
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x1003b26e
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1003b692
mov dword [edi], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003b4e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1003b6aa
pop edi
pop esi
pop ebp
ret
push ebx
push esi
call fcn.10115410
add esp, 4
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x1003b7a6
push 2
push 0
push esi
call fcn.101118a6
add esp, 0xc
test eax, eax
jne 0x1003b7a6
push esi
call fcn.10115410
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1003b7a6
push 0
push dword [ebp + 0x10]
push esi
call fcn.101118a6
add esp, 0xc
test eax, eax
jne 0x1003b7a6
mov eax, dword [0x1023dad4]
test eax, eax
je 0x1003b718
inc dword [eax + 0x370]
push dword [0x1023dadc]
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
call dword [0x1023b6b0]
add esp, 8
mov dword [ebp + 0x10], eax
test eax, eax
je 0x1003b7a6
push esi
push ebx
push 1
push eax
call fcn.101113a0
add esp, 0x10
cmp eax, ebx
je 0x1003b777
push esi
call fcn.101106eb
mov eax, dword [0x1023dad4]
add esp, 4
test eax, eax
je 0x1003b75d
dec dword [eax + 0x370]
push dword [0x1023dadc]
mov eax, dword [ebp + 0x10]
push eax
call dword [0x1023b6b4]
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x1003b78f
push eax
mov eax, dword [ebp + 0x10]
add eax, ebx
push 0
push eax
call fcn.100e8e40
add esp, 0xc
push esi
call fcn.101106eb
add esp, 4
test edi, edi
je 0x1003b79e
mov dword [edi], ebx
mov eax, dword [ebp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call fcn.101106eb
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1003c820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xc4]
mov eax, dword [ecx + 0xcc]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10159988]
sub edi, 1
jne 0x1003c840
mov ecx, dword [0x1023dad4]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1d14], eax
jne 0x1003c872
mov dword [ecx + 0x1d18], eax
cmp dword [ecx + 0x1d4c], eax
jne 0x1003c881
mov byte [ecx + 0x1d50], 1
pop ebp
ret 4
Function at 0x1003ca20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc4]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xcc]
lea esi, [ebp - 0x10]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop word [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10159988]
sub edi, 1
jne 0x1003ca90
mov eax, dword [0x1023dad4]
not edx
pop edi
pop esi
cmp dword [eax + 0x1d14], edx
jne 0x1003cac1
mov dword [eax + 0x1d18], edx
cmp dword [eax + 0x1d4c], edx
jne 0x1003cad0
mov byte [eax + 0x1d50], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004ace0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x1023dad4]
cmp byte [edi + 0x3745], 0
lea eax, [edi + 0x20]
jne 0x1004ae0a
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x1004ae02
push esi
push 0x1015a690
push ecx
call fcn.1003b4e0
mov esi, eax
add esp, 8
test esi, esi
je 0x1004adfe
push esi
call fcn.10115410
add esp, 4
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x1004adf5
push 2
push 0
push esi
call fcn.101118a6
add esp, 0xc
test eax, eax
jne 0x1004adf5
push esi
call fcn.10115410
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x1004adf5
push 0
push dword [ebp - 8]
push esi
call fcn.101118a6
add esp, 0xc
test eax, eax
jne 0x1004adf5
mov eax, dword [0x1023dad4]
test eax, eax
je 0x1004ad8e
inc dword [eax + 0x370]
push dword [0x1023dadc]
push ebx
call dword [0x1023b6b0]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1004adf5
push esi
push dword [ebp - 4]
push 1
push ebx
call fcn.101113a0
add esp, 0x10
push esi
cmp eax, dword [ebp - 4]
je 0x1004ade2
call fcn.101106eb
add esp, 4
mov eax, dword [0x1023dad4]
test eax, eax
je 0x1004add0
dec dword [eax + 0x370]
push dword [0x1023dadc]
push ebx
call dword [0x1023b6b4]
add esp, 8
jmp 0x1004adfe
call fcn.101106eb
push dword [ebp - 4]
push ebx
call fcn.10038800
add esp, 0xc
jmp 0x1004adc1
push esi
call fcn.101106eb
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x3745], 1
pop ebx
movss xmm0, dword [edi + 0x3748]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1004ae5b
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x3748], xmm0
jb 0x1004ae5b
mov eax, dword [eax]
test eax, eax
je 0x1004ae4a
push eax
call fcn.10038a80
add esp, 4
mov dword [edi + 0x3748], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x358], 1
mov dword [edi + 0x3748], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100513e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10051407
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10038dc0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1005142f
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10038dc0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10051454
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10038dc0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10051495
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10038dc0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x100514ba
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10038dc0
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword ds:[esi + 0x5c]
test eax, eax
je 0x100514e2
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10038dc0
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1004d000
Function at 0x10052e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x54]
mov dword [ebp - 4], ecx
cmp dword [esi + 0x4c], ebx
jle 0x10052eb6
xor edi, edi
nop word [eax + eax]
mov eax, dword [ecx]
mov ecx, dword [edi + eax]
test ecx, ecx
je 0x10052ea8
cmp byte [edi + eax + 8], 0
je 0x10052ea8
push ecx
call fcn.10038dc0
mov eax, dword [esi + 0x54]
lea ecx, [esi + 0x54]
add esp, 4
mov dword [edi + eax], 0
jmp 0x10052eab
lea ecx, [esi + 0x54]
inc ebx
add edi, 0x78
cmp ebx, dword [esi + 0x4c]
jl 0x10052e80
jmp 0x10052eb9
mov dword [ebp - 4], ecx
lea edi, [esi + 0x34]
xor edx, edx
mov dword [ebp - 8], edi
cmp dword [edi], edx
jle 0x10052f0a
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + edx*4]
mov eax, dword [ecx]
mov dword [ebp - 8], eax
cmp dword [ebx + 0x34], eax
jb 0x10052efc
mov ecx, dword [esi + 0x4c]
shl ecx, 4
sub ecx, dword [esi + 0x4c]
lea eax, [eax + ecx*8]
cmp dword [ebx + 0x34], eax
jae 0x10052ef9
mov dword [ebx + 0x34], 0
xor ecx, ecx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + edx*4]
mov word [eax + 0x38], cx
mov ecx, dword [ebp - 4]
inc edx
cmp edx, dword [edi]
jl 0x10052ec5
lea edi, [esi + 0x34]
mov dword [ebp - 8], edi
mov eax, dword [esi + 0x54]
test eax, eax
je 0x10052f2f
push eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
call fcn.10038dc0
add esp, 4
mov dword [esi + 0x54], 0
mov eax, dword [esi + 0x48]
mov ebx, edi
test eax, eax
je 0x10052f59
push eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
call fcn.10038dc0
add esp, 4
mov dword [esi + 0x48], 0
lea ebx, [esi + 0x34]
mov eax, dword [esi + 0x14]
mov dword [esi + 0x464], 0xffffffff
mov dword [esi + 0x460], 0xffffffff
test eax, eax
je 0x10052f82
push eax
call fcn.10038dc0
mov edi, ebx
add esp, 4
mov dword [ebp - 8], edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10052f92
push eax
call fcn.10038dc0
add esp, 4
xor ebx, ebx
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov byte [esi + 0x11], 0
cmp dword [edi], ebx
jle 0x1005300c
nop word [eax + eax]
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10053001
mov ecx, edi
call fcn.100545a0
mov eax, dword [edi + 0x28]
test eax, eax
je 0x10052fd5
push eax
call fcn.10038dc0
add esp, 4
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x10052fe8
push eax
call fcn.10038dc0
add esp, 4
mov eax, dword [edi + 8]
test eax, eax
je 0x10052ff8
push eax
call fcn.10038dc0
add esp, 4
push edi
call fcn.10038dc0
add esp, 4
mov eax, dword [ebp - 8]
inc ebx
cmp ebx, dword [eax]
jl 0x10052fb0
lea edi, [esi + 0x34]
mov eax, dword [edi + 8]
test eax, eax
je 0x10053030
push eax
mov dword [edi + 4], 0
mov dword [edi], 0
call fcn.10038dc0
add esp, 4
mov dword [edi + 8], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret