joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011ed30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.1011ee90
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [edi + 0x40], eax
jle 0x1011ee5a
xor ecx, ecx
mov esi, 0xffff
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 0x48]
add ebx, ecx
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x1011ee47
cmp dword [ebx], 0x10000
ja 0x1011ee47
cmp dword [edx + 0x38], edi
jne 0x1011ee87
cmp dword [edi + 0x1c], 0
jle 0x1011ee87
cmp dword [edi + 0x20], 0
jle 0x1011ee87
movzx eax, word [ebx + 8]
cmp ax, si
je 0x1011ee87
movzx esi, word [ebx + 4]
sub esp, 0x1c
movzx ecx, word [ebx + 0xa]
movzx edx, word [ebx + 6]
movss xmm0, dword [ebx + 0xc]
movd xmm6, eax
add eax, esi
movss dword [esp + 0x18], xmm0
movd xmm3, ecx
cvtdq2ps xmm3, xmm3
movd xmm2, eax
lea eax, [edx + ecx]
mulss xmm3, dword [edi + 0x28]
mov ecx, dword [ebx + 0x18]
movd xmm1, eax
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
mulss xmm2, dword [edi + 0x24]
mulss xmm1, dword [edi + 0x28]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm6, xmm6
addss xmm0, dword [ebx + 0x14]
mulss xmm6, dword [edi + 0x24]
movss dword [esp + 0x14], xmm1
movss dword [esp + 0x10], xmm2
movss xmm2, dword [ebx + 0x10]
movss dword [esp + 0xc], xmm3
movss xmm3, dword [ebx + 0x14]
movss dword [esp + 8], xmm6
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebx + 0x10]
movss dword [esp], xmm0
push dword [ebx]
call fcn.1011e7b0
mov eax, dword [ebp - 4]
mov esi, 0xffff
mov ecx, dword [ebp - 8]
inc eax
add ecx, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 0x40]
jl 0x1011ed58
mov edx, dword [edi + 0x34]
xor esi, esi
test edx, edx
jle 0x1011ee80
mov eax, dword [edi + 0x3c]
mov ecx, dword [eax + esi*4]
cmp byte [ecx + 0x54], 0
je 0x1011ee78
cmp esi, edx
jge 0x1011ee87
call fcn.1011e9a0
mov edx, dword [edi + 0x34]
inc esi
cmp esi, edx
jl 0x1011ee63
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1011f020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014947d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov eax, edx
mov dword [ebp - 0x10], eax
push esi
mov esi, ecx
push edi
test eax, eax
je 0x1011f19f
mov eax, dword [esi + 0x40]
cmp eax, 1
jl 0x1011f19f
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.1003cdc0
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
mov edi, dword [ebp - 0x14]
shl eax, 4
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x40]
add esp, 0xc
xor ecx, ecx
test eax, eax
jle 0x1011f0e7
mov edx, dword [ebp - 0x14]
xor edi, edi
add edx, 6
cmp ecx, eax
jge 0x1011f19f
mov eax, dword [esi + 0x48]
movzx eax, word [edi + eax + 4]
cmp ecx, ebx
jge 0x1011f19f
mov word [edx - 2], ax
cmp ecx, dword [esi + 0x40]
jge 0x1011f19f
mov eax, dword [esi + 0x48]
inc ecx
mov ax, word [edi + eax + 6]
add edi, 0x1c
mov word [edx], ax
add edx, 0x10
mov eax, dword [esi + 0x40]
cmp ecx, eax
jl 0x1011f0ae
mov edi, dword [ebp - 0x14]
test ebx, ebx
jle 0x1011f19f
mov ecx, dword [ebp - 0x10]
mov edx, edi
push ebx
call fcn.10128c80
mov edx, dword [ebp - 0x14]
add esp, 4
xor edi, edi
xor ebx, ebx
add edx, 8
cmp dword [edx + 4], 0
je 0x1011f162
movzx ecx, word [edx]
cmp edi, dword [esi + 0x40]
jge 0x1011f19f
mov eax, dword [esi + 0x48]
mov word [ebx + eax + 8], cx
movzx ecx, word [edx + 2]
cmp edi, dword [esi + 0x40]
jge 0x1011f19f
mov eax, dword [esi + 0x48]
mov word [ebx + eax + 0xa], cx
cmp edi, dword [esi + 0x40]
jge 0x1011f19f
mov ecx, dword [esi + 0x48]
mov ax, word [edx - 4]
cmp ax, word [ecx + ebx + 4]
jne 0x1011f19f
movzx eax, word [edx - 2]
cmp ax, word [ecx + ebx + 6]
jne 0x1011f19f
mov ecx, eax
movzx eax, word [edx + 2]
add ecx, eax
cmp dword [esi + 0x20], ecx
cmovge ecx, dword [esi + 0x20]
mov dword [esi + 0x20], ecx
inc edi
add ebx, 0x1c
add edx, 0x10
cmp edi, dword [ebp - 0x1c]
jl 0x1011f107
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1011f191
mov eax, dword [0x101e6b78]
test eax, eax
je 0x1011f187
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10120de0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movss dword [ebp - 8], xmm3
mov dword [ebp - 4], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x101e6b78]
test eax, eax
je 0x10120e25
inc dword [eax + 0x36c]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx edx, byte [esi]
add esp, 4
movzx ecx, byte [esi + 1]
shl edx, 8
add edx, ecx
mov dword [ebp + 8], eax
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x10120f08
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x10120f08
movzx edi, byte [esi + 8]
movzx eax, byte [esi + 9]
shl edi, 8
add edi, eax
mov dword [0x101e6d7c], esi
movzx eax, byte [esi + 0xa]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0xb]
shl edi, 8
add esi, 0x10
add edi, eax
mov ecx, esi
mov eax, dword [ebp + 8]
add edi, eax
mov dword [0x101e8b6c], edi
mov dword [0x101e9d38], eax
mov dword [0x101e9d3c], eax
call fcn.1011dd70
cmp eax, esi
je 0x10120ee9
nop dword [eax]
cmp dword [0x101e9d3c], edi
ja 0x10120f92
mov ecx, eax
mov esi, eax
call fcn.1011dd70
cmp eax, esi
jne 0x10120ed0
cmp byte [eax], 5
jne 0x10120f92
cmp byte [eax + 1], 0xfa
jne 0x10120f92
cmp dword [0x101e9d3c], edi
jne 0x10120f92
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10120f1e
mov ecx, 0x1d
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x80]
jmp 0x10120f26
lea ecx, [ebp - 0x80]
call fcn.10121750
mov ecx, 0x1d
lea edi, [ebp - 0xf8]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xf8], 0
jne 0x10120f92
mov edx, dword [ebp - 4]
mov byte [ebp - 0xf0], 1
cmp byte [edx], 0
jne 0x10120f92
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xf8]
movss xmm0, dword [ebp - 8]
lea edi, [ebp - 0x80]
mov ecx, 0x1d
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [ebp - 0x7c], ebx
cmovne ecx, eax
movss dword [ebp - 0x70], xmm0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x50], ecx
push eax
mov ecx, edx
call fcn.101211b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x101211b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx], 0
jne 0x10121333
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x10121333
cmp dword [esi + 4], 0
jle 0x10121333
movss xmm0, dword [esi + 0x10]
comiss xmm0, dword [0x1017f060]
jbe 0x10121333
cmp byte [esi + 0x3c], 0
jne 0x1012122e
mov ecx, 0x58
call fcn.10119260
mov dword [ebp - 8], eax
test eax, eax
je 0x1012121b
mov ecx, eax
call fcn.1012a0b0
mov dword [ebp - 8], eax
lea ecx, [ebx + 0x34]
lea eax, [ebp - 8]
push eax
call fcn.1003c8d0
jmp 0x10121238
xor eax, eax
lea ecx, [ebx + 0x34]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.1003c8d0
jmp 0x10121238
cmp dword [ebx + 0x34], 0
je 0x10121333
mov edi, dword [ebx + 0x4c]
mov ecx, dword [ebx + 0x50]
cmp edi, ecx
jne 0x101212be
inc edi
test ecx, ecx
je 0x10121252
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10121257
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x101212be
mov eax, dword [0x101e6b78]
test eax, eax
je 0x1012126f
inc dword [eax + 0x36c]
imul eax, edi, 0x74
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, dword [ebx + 0x54]
add esp, 4
mov dword [ebp - 8], eax
test edx, edx
je 0x101212b8
imul ecx, dword [ebx + 0x4c], 0x74
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebx + 0x54]
add esp, 0xc
test ecx, ecx
je 0x101212ab
mov eax, dword [0x101e6b78]
test eax, eax
je 0x101212ab
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 8]
add esp, 4
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x50], edi
imul eax, dword [ebx + 0x4c], 0x74
mov ecx, 0x1d
mov edi, dword [ebx + 0x54]
add edi, eax
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x4c]
inc eax
mov dword [ebx + 0x4c], eax
test eax, eax
jle 0x10121333
mov edi, dword [ebx + 0x54]
imul esi, eax, 0x74
cmp dword [esi + edi - 4], 0
jne 0x101212f4
lea ecx, [ebx + 0x34]
call fcn.1003c870
mov eax, dword [eax]
mov dword [esi + edi - 4], eax
cmp byte [esi + edi - 0x6c], 0
jne 0x1012131f
mov ecx, dword [esi + edi - 0x70]
call fcn.10119260
mov ecx, dword [ebp + 8]
push dword [esi + edi - 0x70]
mov dword [esi + edi - 0x74], eax
mov byte [esi + edi - 0x6c], 1
push dword [ecx]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, ebx
call fcn.10121580
mov eax, dword [esi + edi - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10121580
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x101215d8
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x101215a8
mov eax, dword [0x101e6b78]
test eax, eax
je 0x1012159e
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x101215c8
mov eax, dword [0x101e6b78]
test eax, eax
je 0x101215be
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x101215f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
jne 0x1012173e
mov ecx, dword [esi + 0x4c]
lea eax, [esi + 0x54]
xor edi, edi
mov dword [ebp - 4], eax
test ecx, ecx
jle 0x10121667
xor ebx, ebx
mov eax, dword [eax]
mov edx, dword [ebx + eax]
test edx, edx
je 0x10121657
cmp edi, ecx
jge 0x1012173e
cmp byte [ebx + eax + 8], 0
je 0x10121657
mov eax, dword [0x101e6b78]
test eax, eax
je 0x1012163a
dec dword [eax + 0x36c]
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp edi, dword [esi + 0x4c]
jge 0x1012173e
mov eax, dword [esi + 0x54]
mov dword [ebx + eax], 0
mov ecx, dword [esi + 0x4c]
lea eax, [esi + 0x54]
inc edi
add ebx, 0x74
cmp edi, ecx
jl 0x10121613
jmp 0x1012166a
mov dword [ebp - 4], eax
mov edx, dword [esi + 0x34]
xor ecx, ecx
test edx, edx
jle 0x101216bc
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + ecx*4]
mov eax, dword [ebp - 4]
mov ebx, dword [edi + 0x3c]
cmp ebx, dword [eax]
jb 0x101216b4
cmp ecx, edx
jge 0x1012173e
imul eax, dword [esi + 0x4c], 0x74
mov edx, dword [ebp - 4]
add eax, dword [edx]
cmp ebx, eax
jae 0x101216b4
mov dword [edi + 0x3c], 0
cmp ecx, dword [esi + 0x34]
jge 0x1012173e
mov eax, dword [esi + 0x3c]
xor edx, edx
mov eax, dword [eax + ecx*4]
mov word [eax + 0x40], dx
mov edx, dword [esi + 0x34]
inc ecx
cmp ecx, edx
jl 0x10121673
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x101216f5
mov eax, dword [0x101e6b78]
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
test eax, eax
je 0x101216e0
dec dword [eax + 0x36c]
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ecx
call ebx
add esp, 4
mov dword [esi + 0x54], 0
jmp 0x101216fb
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10121730
mov eax, dword [0x101e6b78]
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
test eax, eax
je 0x1012171f
dec dword [eax + 0x36c]
push ecx
call ebx
add esp, 4
mov dword [esi + 0x48], 0
nop dword [eax]
pop edi
mov dword [esi + 0x58], 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10121e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, ecx
push ebx
push esi
push edi
mov edi, dword [edx + 0x48]
test edi, edi
je 0x10121e5b
mov eax, dword [edx + 0x50]
mov edi, dword [eax + edi*4 - 4]
jmp 0x10121e5d
xor edi, edi
mov esi, dword [edx]
mov dword [ebp - 4], edi
test esi, esi
je 0x10121f0d
jg 0x10121e74
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ebx, dword [edx + 8]
mov ecx, esi
shl ecx, 5
add ebx, 0xffffffe0
add ebx, ecx
je 0x10121f0d
mov eax, dword [ebx]
test eax, eax
je 0x10121e92
cmp dword [ebx + 0x14], edi
jne 0x10121f0d
cmp dword [ebx + 0x18], 0
jne 0x10121f0d
xor ecx, ecx
lea edi, [ebx - 0x20]
cmp esi, 1
cmovle edi, ecx
mov dword [ebp - 8], edi
test eax, eax
jne 0x10121f00
test edi, edi
je 0x10121f00
mov eax, dword [ebp - 4]
cmp dword [edi + 0x14], eax
jne 0x10121f00
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x10121eca
mov eax, dword [edx + 0x44]
shl ecx, 4
add eax, 0xfffffff0
add ecx, eax
jmp 0x10121ed0
mov ecx, dword [edx + 0x28]
add ecx, 0x14
lea esi, [edi + 4]
mov edi, 0xc
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x10121f00
add esi, 4
add ecx, 4
sub edi, 4
jae 0x10121ed8
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x10121f00
mov ecx, edx
call fcn.1003c9c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov dword [ebx + 0x14], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.10122010
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10122010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
test edx, edx
je 0x1012203f
mov eax, dword [ecx + 0x44]
shl edx, 4
add eax, 0xfffffff0
add eax, edx
jmp 0x10122045
mov eax, dword [ecx + 0x28]
add eax, 0x14
movups xmm0, xmmword [eax]
mov edx, dword [ecx + 0x48]
movups xmmword [ebp - 0x1c], xmm0
test edx, edx
je 0x1012205f
mov eax, dword [ecx + 0x50]
mov eax, dword [eax + edx*4 - 4]
mov dword [ebp - 0xc], eax
jmp 0x10122066
mov dword [ebp - 0xc], 0
movss xmm0, dword [ebp - 0x14]
comiss xmm0, dword [ebp - 0x1c]
jb 0x10122089
movss xmm0, dword [ebp - 0x10]
comiss xmm0, dword [ebp - 0x18]
jb 0x10122089
lea eax, [ebp - 0x20]
push eax
call fcn.1003d0e0
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10125160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x3c], 0
jne 0x10125188
push dword [ebp + 8]
call fcn.10126b30
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [esp + 0x10], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x3c], 0
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
movups xmmword [esp + 0x4c], xmm0
mov dword [esp + 0x70], 0
movups xmmword [esp + 0x5c], xmm0
call fcn.101253a0
mov ebx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x10125240
mov eax, dword [esp + 0x3c]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [0x101e6b78]
add ecx, ecx
test eax, eax
je 0x10125209
inc dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebx], eax
mov dword [esp + 0x68], eax
mov edx, edi
lea eax, [esp + 0x40]
mov ecx, esi
push eax
call fcn.101253a0
add esp, 4
test eax, eax
je 0x10125240
mov eax, dword [esp + 0x6c]
cmp eax, dword [esp + 0x3c]
je 0x10125248
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101252e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x34], 1
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0
push eax
mov edi, edx
mov dword [ebp - 0xc], 0
mov ebx, ecx
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x4c], xmm0
call fcn.101253a0
mov esi, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x10125391
mov eax, dword [ebp - 8]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [0x101e6b78]
add ecx, ecx
test eax, eax
je 0x10125361
inc dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [esi], eax
mov edx, edi
mov dword [ebp - 0x3c], eax
mov ecx, ebx
lea eax, [ebp - 0x64]
push eax
call fcn.101253a0
add esp, 8
test eax, eax
je 0x10125391
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 8]
je 0x10125399
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101265d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 0x78]
movq xmm0, qword [edi + 0x70]
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], eax
test eax, eax
js 0x10126752
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
jg 0x10126610
xor ecx, ecx
jmp 0x10126622
mov bl, byte [esi]
mov ecx, 1
mov dword [ebp - 0x20], 1
test bl, bl
jne 0x10126653
add ecx, edx
cmp ecx, eax
jg 0x10126752
test ecx, ecx
js 0x10126752
cmp ecx, eax
jl 0x10126645
xor al, al
movzx eax, al
mov dword [ebp - 4], eax
jmp 0x101266e5
mov al, byte [esi + ecx]
movzx eax, al
mov dword [ebp - 4], eax
jmp 0x101266e5
cmp bl, 3
jne 0x101266e5
mov edx, 2
lea ecx, [ebp - 0x24]
call fcn.10128bb0
mov esi, eax
lea ecx, [ebp - 0x24]
mov edx, 2
mov dword [ebp - 0x14], esi
call fcn.10128bb0
xor ebx, ebx
mov dword [ebp - 8], eax
test esi, esi
jle 0x101266e5
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
nop dword [eax]
cmp edx, edi
jl 0x10126698
xor al, al
jmp 0x1012669c
mov al, byte [esi + edx]
inc edx
movzx eax, al
mov dword [ebp - 0x18], eax
cmp edx, edi
jl 0x101266aa
xor al, al
jmp 0x101266ae
mov al, byte [esi + edx]
inc edx
movzx eax, al
cmp edx, edi
jl 0x101266b9
xor cl, cl
jmp 0x101266bd
mov cl, byte [esi + edx]
inc edx
shl eax, 8
movzx ecx, cl
or eax, ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jl 0x101266d1
cmp ecx, eax
jl 0x101266dc
inc ebx
mov dword [ebp - 8], eax
cmp ebx, dword [ebp - 0x14]
jl 0x10126690
jmp 0x101266e2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0xc]
movq xmm0, qword [edi + 0x64]
sub esp, 0xc
mov eax, dword [edi + 0x6c]
mov edx, esp
mov ecx, dword [ebp - 4]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [ebp - 0x24]
push eax
call fcn.10128590
add esp, 4
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [edi + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [edi + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x30]
push eax
call fcn.10128130
mov edx, dword [ebp + 8]
add esp, 0x1c
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x101277b0
Capabilities:
Terminate process

Disassembly:
cmp dword [ecx + 0x3c], 0
push ebx
mov ebx, edx
je 0x101277c1
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp ebx, dword [ecx + 0xc]
jge 0x1012786d
mov eax, dword [ecx + 0x30]
cmp eax, 2
jge 0x1012786d
mov edx, dword [ecx + 0x18]
push esi
push edi
mov edi, dword [ecx + 0x10]
add edi, dword [ecx + 4]
test eax, eax
jne 0x10127816
movzx ecx, byte [edi + ebx*2]
movzx eax, byte [edi + ebx*2 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*2 + 3]
lea esi, [edx + ecx*2]
movzx ecx, byte [edi + ebx*2 + 2]
shl ecx, 8
add ecx, eax
pop edi
lea eax, [edx + ecx*2]
or ecx, 0xffffffff
cmp esi, eax
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
ret
movzx ecx, byte [edi + ebx*4]
movzx eax, byte [edi + ebx*4 + 1]
movzx esi, byte [edi + ebx*4 + 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 5]
shl ecx, 8
add ecx, edx
add esi, ecx
movzx ecx, byte [edi + ebx*4 + 4]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [edi + ebx*4 + 7]
shl ecx, 8
add ecx, edx
add eax, ecx
or ecx, 0xffffffff
cmp esi, eax
pop edi
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop ebx
ret
Function at 0x10128130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push edi
push eax
mov edx, 0x12
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 0x18]
mov dword [ebp - 8], 0
call fcn.10128780
add esp, 4
xor esi, esi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
jge 0x1012818e
lea ecx, [ebp - 0x18]
call fcn.10128960
mov dword [ebp + esi*4 - 0xc], eax
inc esi
cmp esi, 2
jge 0x1012818e
mov eax, dword [ebp - 0x10]
jmp 0x10128172
mov edi, dword [ebp - 8]
test edi, edi
je 0x10128291
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x10128291
xor edx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edx
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x18], xmm0
push ebx
mov ebx, dword [ebp + 0x14]
test edi, edi
js 0x101281e1
test ecx, ecx
js 0x101281e1
cmp edi, ebx
jg 0x101281e1
mov eax, ebx
sub eax, edi
cmp ecx, eax
jg 0x101281e1
mov eax, dword [ebp + 0xc]
mov edx, ecx
add eax, edi
mov dword [ebp - 0x18], eax
movq xmm0, qword [ebp - 0x18]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], edx
push eax
mov edx, 0x13
movq qword [ebp - 0x18], xmm0
lea ecx, [ebp - 0x18]
call fcn.10128780
add esp, 4
xor esi, esi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
nop
cmp dword [ebp - 0x14], eax
jge 0x1012822c
lea ecx, [ebp - 0x18]
call fcn.10128960
mov dword [ebp + esi*4 - 4], eax
inc esi
cmp esi, 1
jge 0x1012822c
mov eax, dword [ebp - 0x10]
jmp 0x10128210
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10128253
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
movq xmm0, qword [ebp - 0x18]
pop ebx
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
add eax, edi
cmp eax, ebx
jg 0x10128289
test eax, eax
js 0x10128289
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.10128a40
mov edx, dword [ebp + 8]
add esp, 4
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop ebx
pop edi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movq xmm0, qword [ebp - 0x18]
pop edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop esi
mov esp, ebp
pop ebp
ret