joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101288c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov eax, dword [edi + 8]
test eax, eax
js 0x10128a1f
xor ecx, ecx
mov dword [edi + 4], ecx
cmp ecx, eax
jge 0x101289e2
xor ebx, ebx
mov dword [ebp - 4], ebx
nop dword [eax + eax]
mov ecx, dword [edi + 4]
mov esi, dword [edi + 8]
cmp ecx, esi
jge 0x10128953
mov ebx, dword [edi]
mov al, byte [ebx + ecx]
cmp al, 0x1c
jb 0x1012894f
cmp al, 0x1e
jne 0x10128946
lea eax, [ecx + 1]
cmp eax, esi
jg 0x10128a1f
test eax, eax
js 0x10128a1f
mov dword [edi + 4], eax
cmp eax, esi
jge 0x101288f0
mov cl, byte [ebx + eax]
inc eax
movzx edx, cl
mov ecx, edx
mov dword [edi + 4], eax
and ecx, 0xf
cmp cl, 0xf
je 0x101288f0
and edx, 0xfffffff0
cmp edx, 0xf0
je 0x101288f0
cmp eax, esi
jl 0x10128921
jmp 0x101288f0
mov ecx, edi
call fcn.10128aa0
jmp 0x101288f0
cmp ecx, esi
jl 0x10128959
xor al, al
mov edx, ecx
jmp 0x10128964
mov eax, dword [edi]
lea edx, [ecx + 1]
mov al, byte [ecx + eax]
mov dword [edi + 4], edx
movzx eax, al
cmp eax, 0xc
jne 0x10128985
cmp edx, esi
jl 0x10128974
xor al, al
jmp 0x1012897d
mov eax, dword [edi]
mov al, byte [edx + eax]
inc edx
mov dword [edi + 4], edx
movzx eax, al
or eax, 0x100
cmp eax, dword [ebp - 8]
je 0x10128996
cmp edx, esi
jge 0x101289e2
mov dword [ebp - 4], edx
jmp 0x101288f0
mov ebx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 0x14], 0
sub ecx, ebx
mov dword [ebp - 0x10], edx
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
test ebx, ebx
js 0x101289d1
test ecx, ecx
js 0x101289d1
cmp ebx, esi
jg 0x101289d1
sub esi, ebx
cmp ecx, esi
jg 0x101289d1
mov eax, dword [edi]
mov edx, ecx
add eax, ebx
mov dword [ebp - 0x14], eax
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
jl 0x10128a0a
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10128aa0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
cmp edx, edi
jl 0x10128ab2
xor al, al
jmp 0x10128abb
mov eax, dword [esi]
mov al, byte [edx + eax]
inc edx
mov dword [esi + 4], edx
movzx ecx, al
lea eax, [ecx - 0x20]
cmp eax, 0xd6
ja 0x10128ad1
pop edi
lea eax, [ecx - 0x8b]
pop esi
ret
lea eax, [ecx - 0xf7]
push ebx
cmp eax, 3
ja 0x10128b10
cmp edx, edi
jl 0x10128af4
xor bl, bl
shl ecx, 8
movzx eax, bl
pop ebx
add eax, 0xffff096c
pop edi
add eax, ecx
pop esi
ret
mov eax, dword [esi]
shl ecx, 8
mov bl, byte [edx + eax]
lea eax, [edx + 1]
mov dword [esi + 4], eax
movzx eax, bl
pop ebx
add eax, 0xffff096c
pop edi
add eax, ecx
pop esi
ret
lea eax, [ecx - 0xfb]
cmp eax, 3
ja 0x10128b52
cmp edx, edi
jl 0x10128b34
shl ecx, 8
xor bl, bl
mov eax, 0xfa94
sub eax, ecx
movzx ecx, bl
pop ebx
pop edi
sub eax, ecx
pop esi
ret
mov eax, dword [esi]
shl ecx, 8
mov bl, byte [edx + eax]
lea eax, [edx + 1]
mov dword [esi + 4], eax
mov eax, 0xfa94
sub eax, ecx
movzx ecx, bl
pop ebx
pop edi
sub eax, ecx
pop esi
ret
cmp ecx, 0x1c
jne 0x10128b64
pop ebx
lea edx, [ecx - 0x1a]
mov ecx, esi
pop edi
pop esi
jmp fcn.10128cf0
cmp ecx, 0x1d
jne 0x10128b76
pop ebx
lea edx, [ecx - 0x19]
mov ecx, esi
pop edi
pop esi
jmp fcn.10128cf0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10128b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov ebx, dword [esi + 4]
mov edi, dword [esi + 8]
cmp ebx, edi
jl 0x10128b9d
xor edx, edx
mov ecx, ebx
xor al, al
jmp 0x10128bbc
mov eax, dword [esi]
lea ecx, [ebx + 1]
mov al, byte [ebx + eax]
mov dword [esi + 4], ecx
movzx edx, al
cmp ecx, edi
jl 0x10128bb3
xor al, al
jmp 0x10128bbc
mov eax, dword [esi]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 4], ecx
shl edx, 8
movzx eax, al
or edx, eax
je 0x10128c13
cmp ecx, edi
jl 0x10128bce
xor al, al
jmp 0x10128bd7
mov eax, dword [esi]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 4], ecx
movzx eax, al
mov dword [ebp - 4], eax
dec eax
cmp eax, 3
ja 0x10128c5c
mov eax, dword [ebp - 4]
imul edx, eax
add edx, ecx
cmp edx, edi
jg 0x10128c5c
test edx, edx
js 0x10128c5c
mov dword [esi + 4], edx
mov ecx, esi
mov edx, eax
call fcn.10128cf0
mov ecx, dword [esi + 4]
mov edi, dword [esi + 8]
dec ecx
add ecx, eax
cmp ecx, edi
jg 0x10128c5c
test ecx, ecx
js 0x10128c5c
mov dword [esi + 4], ecx
xor edx, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], edx
sub ecx, ebx
movq xmm0, qword [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
test ebx, ebx
js 0x10128c4b
test ecx, ecx
js 0x10128c4b
cmp ebx, edi
jg 0x10128c4b
sub edi, ebx
cmp ecx, edi
jg 0x10128c4b
mov eax, dword [esi]
mov edx, ecx
add eax, ebx
mov dword [ebp - 0x10], eax
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10128d40
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 4]
add eax, edx
cmp eax, dword [ecx + 8]
jg 0x10128d52
test eax, eax
js 0x10128d52
mov dword [ecx + 4], eax
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10129330
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
movzx esi, word [edx]
add eax, ecx
mov dword [ebp - 0x10], eax
push edi
cmp esi, ecx
jg 0x10129407
mov eax, dword [edx + 4]
movzx eax, word [eax]
cmp eax, ecx
jle 0x10129407
xor edi, edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 0x10]
jge 0x101293f9
movzx eax, word [edx + 2]
mov dword [ebp - 8], eax
cmp eax, edi
jle 0x101293b4
mov ecx, eax
mov dword [ebp - 4], eax
movzx eax, word [edx]
sub ecx, edi
mov edx, dword [edx + 4]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
imul ecx, ebx
movzx esi, word [edx]
mov eax, esi
cmp dword [ebp - 8], edi
jge 0x101293a8
sub eax, edi
add ebx, eax
mov eax, esi
movzx esi, ax
jmp 0x101293e2
sub eax, dword [ebp - 8]
add ebx, eax
mov eax, esi
movzx esi, ax
jmp 0x101293e2
mov esi, dword [edx + 4]
movzx eax, word [edx]
mov edx, dword [ebp + 0xc]
sub edx, ebx
mov dword [ebp - 0x14], esi
movzx edi, word [esi]
mov ecx, edi
mov esi, edi
sub ecx, eax
lea eax, [ecx + ebx]
cmp eax, dword [ebp + 0xc]
cmovle edx, ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
add ebx, edx
imul ecx, edx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add eax, ecx
movzx ecx, si
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp - 0x10]
jl 0x10129372
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10129410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
mov dword [ebp - 4], eax
push esi
mov esi, ecx
movd xmm0, ebx
pshufd xmm1, xmm0, 0
push edi
cmp eax, 0xffff
jg 0x10129597
cmp dword [ebp + 8], 0xffff
jg 0x10129597
mov ecx, dword [ebp + 0x10]
xor edi, edi
dec ecx
test ecx, ecx
jle 0x10129535
cmp ecx, 8
jb 0x10129516
movaps xmm2, xmmword [0x1017f470]
mov eax, ecx
and eax, reloc.WS2_32.dll_getsockopt
jns 0x10129470
dec eax
or eax, 0xfffffff8
inc eax
movaps xmm3, xmmword [str._b_b_b_b]
mov edx, ecx
sub edx, eax
mov dword [ebp - 8], edx
lea edx, [ebx + 0xc]
mov ebx, dword [ebp - 8]
movd xmm0, edi
lea eax, [edi + 4]
pshufd xmm0, xmm0, 0
lea edx, [edx + 0x40]
paddd xmm0, xmm2
add edi, 8
pslld xmm0, 3
paddd xmm0, xmm1
paddd xmm0, xmm3
movd dword [edx - 0x48], xmm0
psrldq xmm0, 4
movd dword [edx - 0x40], xmm0
psrldq xmm0, 4
movd dword [edx - 0x38], xmm0
psrldq xmm0, 4
movd dword [edx - 0x30], xmm0
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
pslld xmm0, 3
paddd xmm0, xmm1
paddd xmm0, xmm3
movd dword [edx - 0x28], xmm0
psrldq xmm0, 4
movd dword [edx - 0x20], xmm0
psrldq xmm0, 4
movd dword [edx - 0x18], xmm0
psrldq xmm0, 4
movd dword [edx - 0x10], xmm0
cmp edi, ebx
jl 0x10129484
mov ebx, dword [ebp + 0xc]
cmp edi, ecx
jge 0x10129532
lea eax, [edi*8 + 4]
mov edx, ecx
add eax, ebx
sub edx, edi
mov edi, ecx
lea ecx, [eax + 4]
mov dword [eax], ecx
lea eax, [eax + 8]
sub edx, 1
jne 0x10129525
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x20]
mov dword [ebx + edi*8 + 4], 0
mov dword [esi], eax
dec eax
mov dword [esi + 0x1c], ebx
mov ebx, dword [ebp + 0x10]
add eax, ebx
mov dword [esi + 4], edx
cdq
idiv ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov word [ecx], ax
mov ecx, dword [ebp - 4]
mov word [esi + 0x22], ax
lea eax, [esi + 0x28]
mov dword [esi + 0x24], eax
mov word [eax], cx
mov eax, 0xffff
pop edi
mov word [esi + 0x2a], ax
mov dword [esi + 0x2c], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1012a600
Capabilities:
Terminate process

Disassembly:
mov edx, ecx
cmp dword [edx + 0x64], 0
jg 0x1012a610
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [edx + 0x60]
test eax, eax
je 0x1012a67d
movq xmm0, qword [edx]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x70]
movq qword [eax + ecx*8], xmm0
lea ecx, [eax + ecx*8]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0x60]
movq xmm0, qword [edx + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x70]
movq qword [eax + ecx*8 + 0xc], xmm0
lea ecx, [eax + ecx*8]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
mov ecx, dword [edx + 0x70]
mov dword [edx + 0x60], 0
movq xmm0, qword [ecx]
movq qword [edx], xmm0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
movq xmm0, qword [ecx + 0xc]
movq qword [edx + 0xc], xmm0
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x14], eax
mov ecx, dword [edx + 0xc]
lea eax, [eax + ecx*2]
mov dword [edx + 0x38], eax
ret 4
Function at 0x1012c190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
test dword [ebp + 0xc], 0xff000000
push ebx
push esi
push edi
mov esi, ecx
je 0x1012c220
mov edi, dword [ebp + 0x10]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1012c1b0
sub edx, ecx
lea eax, [edx + edi]
mov dword [ebp + 0x10], eax
cmp edi, eax
je 0x1012c220
mov edx, dword [esi + 0x28]
mov ebx, dword [esi + 0x48]
mov eax, dword [edx + 8]
test ebx, ebx
jle 0x1012c229
mov eax, dword [eax + 0x38]
mov ecx, dword [esi + 0x50]
mov eax, dword [eax + 8]
cmp eax, dword [ecx + ebx*4 - 4]
jne 0x1012c229
mov ecx, dword [esi + 0x3c]
test ecx, ecx
jle 0x1012c229
mov eax, dword [esi + 0x44]
movss xmm2, dword [edx + 0xc]
push 0
shl ecx, 4
push ecx
mov dword [esp], 0
push dword [ebp + 0x10]
movups xmm0, xmmword [ecx + eax - 0x10]
mov ecx, dword [edx + 8]
lea eax, [ebp - 0x10]
push edi
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
movups xmmword [ebp - 0x10], xmm0
push dword [eax + 4]
push dword [eax]
push esi
call fcn.1011e180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1012e110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
movzx esi, word [edx]
add eax, ecx
mov dword [ebp - 0x10], eax
push edi
cmp esi, ecx
jg 0x1012e1e7
mov eax, dword [edx + 4]
movzx eax, word [eax]
cmp eax, ecx
jle 0x1012e1e7
xor edi, edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 0x10]
jge 0x1012e1d9
movzx eax, word [edx + 2]
mov dword [ebp - 8], eax
cmp eax, edi
jle 0x1012e194
mov ecx, eax
mov dword [ebp - 4], eax
movzx eax, word [edx]
sub ecx, edi
mov edx, dword [edx + 4]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
imul ecx, ebx
movzx esi, word [edx]
mov eax, esi
cmp dword [ebp - 8], edi
jge 0x1012e188
sub eax, edi
add ebx, eax
mov eax, esi
movzx esi, ax
jmp 0x1012e1c2
sub eax, dword [ebp - 8]
add ebx, eax
mov eax, esi
movzx esi, ax
jmp 0x1012e1c2
mov esi, dword [edx + 4]
movzx eax, word [edx]
mov edx, dword [ebp + 0xc]
sub edx, ebx
mov dword [ebp - 0x14], esi
movzx edi, word [esi]
mov ecx, edi
mov esi, edi
sub ecx, eax
lea eax, [ecx + ebx]
cmp eax, dword [ebp + 0xc]
cmovle edx, ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
add ebx, edx
imul ecx, edx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add eax, ecx
movzx ecx, si
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp - 0x10]
jl 0x1012e152
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1012e1f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
mov dword [ebp - 4], eax
push esi
mov esi, ecx
movd xmm0, ebx
pshufd xmm1, xmm0, 0
push edi
cmp eax, 0xffff
jg 0x1012e374
mov ecx, dword [ebp + 0x10]
xor edi, edi
dec ecx
test ecx, ecx
jle 0x1012e311
cmp ecx, 8
jb 0x1012e2f2
movaps xmm2, xmmword [0x1017f470]
mov eax, ecx
and eax, reloc.WS2_32.dll_getsockopt
jns 0x1012e243
dec eax
or eax, 0xfffffff8
inc eax
movaps xmm3, xmmword [str._b_b_b_b]
mov edx, ecx
sub edx, eax
mov dword [ebp - 8], edx
lea edx, [ebx + 0xc]
mov ebx, dword [ebp - 8]
nop word [eax + eax]
movd xmm0, edi
lea eax, [edi + 4]
pshufd xmm0, xmm0, 0
lea edx, [edx + 0x40]
paddd xmm0, xmm2
add edi, 8
pslld xmm0, 3
paddd xmm0, xmm1
paddd xmm0, xmm3
movd dword [edx - 0x48], xmm0
psrldq xmm0, 4
movd dword [edx - 0x40], xmm0
psrldq xmm0, 4
movd dword [edx - 0x38], xmm0
psrldq xmm0, 4
movd dword [edx - 0x30], xmm0
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
pslld xmm0, 3
paddd xmm0, xmm1
paddd xmm0, xmm3
movd dword [edx - 0x28], xmm0
psrldq xmm0, 4
movd dword [edx - 0x20], xmm0
psrldq xmm0, 4
movd dword [edx - 0x18], xmm0
psrldq xmm0, 4
movd dword [edx - 0x10], xmm0
cmp edi, ebx
jl 0x1012e260
mov ebx, dword [ebp + 0xc]
cmp edi, ecx
jge 0x1012e30e
lea eax, [edi*8 + 4]
mov edx, ecx
add eax, ebx
sub edx, edi
mov edi, ecx
lea ecx, [eax + 4]
mov dword [eax], ecx
lea eax, [eax + 8]
sub edx, 1
jne 0x1012e301
mov eax, dword [ebp - 4]
mov dword [ebx + edi*8 + 4], 0
lea ecx, [esi + 0x20]
mov dword [esi], eax
dec eax
mov dword [esi + 0x1c], ebx
mov ebx, dword [ebp + 0x10]
add eax, ebx
cdq
idiv ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0x8000
mov word [ecx], ax
mov ecx, dword [ebp - 4]
mov word [esi + 0x22], ax
lea eax, [esi + 0x28]
mov dword [esi + 0x24], eax
mov word [eax], cx
mov eax, 0xffff
pop edi
mov word [esi + 0x2a], ax
mov dword [esi + 0x2c], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1012e8e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101e6b78]
sub esp, 0x14
push ebx
push esi
push edi
test eax, eax
je 0x1012ea38
mov esi, dword [eax + 0x94]
lea ecx, [eax + 0x94]
mov dword [ebp - 0xc], ecx
cmp dword [esi + 0x18], 0
jne 0x1012e989
cmp dword [esi + 0x14], 0
jne 0x1012e934
cmp dword [esi + 0x4c], 0
jne 0x1012e91f
push ecx
mov ecx, esi
call fcn.10121170
cmp byte [esi], 0
jne 0x1012ea38
mov ecx, esi
call fcn.1011f3a0
mov eax, dword [0x101e6b78]
mov edi, dword [esi + 0x14]
test edi, edi
je 0x1012e989
mov ecx, dword [esi + 0x1c]
imul ecx, dword [esi + 0x20]
shl ecx, 2
test eax, eax
je 0x1012e94f
inc dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [esi + 0x20]
add esp, 4
imul ecx, dword [esi + 0x1c]
mov edx, eax
mov dword [esi + 0x18], edx
test ecx, ecx
jle 0x1012e989
nop dword [eax]
movzx eax, byte [edi]
lea edi, [edi + 1]
shl eax, 0x18
lea edx, [edx + 4]
or eax, 0xffffff
dec ecx
mov dword [edx - 4], eax
test ecx, ecx
jg 0x1012e970
mov ecx, dword [0x101eddc8]
mov edx, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov edi, dword [esi + 0x18]
push 0
push 0x101eddc0
push 0
push 0x15
push 0x200
push 1
push ebx
mov dword [0x101eddc0], 0
mov eax, dword [ecx]
push edx
push ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], ebx
call dword [eax + 0x5c]
test eax, eax
js 0x1012ea2f
mov ecx, dword [0x101eddc0]
lea edx, [ebp - 0x14]
push 0
push 0
push edx
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x4c]
test eax, eax
jne 0x1012ea2f
xor esi, esi
test ebx, ebx
jle 0x1012ea0c
mov ebx, dword [ebp - 4]
shl ebx, 2
nop dword [eax]
mov eax, dword [ebp - 0x14]
imul eax, esi
push ebx
push edi
add eax, dword [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll_memcpy
inc esi
add esp, 0xc
add edi, ebx
cmp esi, dword [ebp - 8]
jl 0x1012e9f0
mov eax, dword [0x101eddc0]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [0x101eddc0]
mov dword [ecx + 8], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10130560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movss xmm0, dword [0x1017f0d8]
sub esp, 0x10
xorps xmm2, xmm2
push ebx
push esi
mov esi, edx
push edi
movss xmm3, dword [esi]
comiss xmm2, xmm3
jbe 0x10130584
xorps xmm1, xmm1
jmp 0x1013058b
movaps xmm1, xmm0
minss xmm1, xmm3
movss xmm3, dword [0x1017f2b8]
movss xmm4, dword [0x1017f094]
movss xmm5, dword [esi + 4]
comiss xmm2, xmm5
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si eax, xmm1
mov dword [ebp - 0xc], eax
jbe 0x101305b9
xorps xmm1, xmm1
jmp 0x101305c0
movaps xmm1, xmm0
minss xmm1, xmm5
movss xmm5, dword [esi + 8]
comiss xmm2, xmm5
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si eax, xmm1
mov dword [ebp - 8], eax
jbe 0x101305de
xorps xmm1, xmm1
jmp 0x101305e5
movaps xmm1, xmm0
minss xmm1, xmm5
mov edi, dword [ebp + 8]
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si eax, xmm1
mov dword [ebp - 4], eax
and edi, 2
je 0x10130603
mov ebx, 0xff
jmp 0x10130622
movss xmm1, dword [esi + 0xc]
comiss xmm2, xmm1
jbe 0x10130612
xorps xmm0, xmm0
jmp 0x10130616
minss xmm0, xmm1
mulss xmm0, xmm3
addss xmm0, xmm4
cvttss2si ebx, xmm0
mov dl, 1
call fcn.10110c90
mov edx, str.ColorButton
mov eax, edx
cmp eax, 0xffffffff
jae 0x10130662
mov cl, byte [edx]
test cl, cl
je 0x1013064b
cmp cl, 0x23
jne 0x10130645
cmp byte [edx + 1], cl
je 0x1013064b
inc edx
cmp edx, 0xffffffff
jb 0x10130635
cmp edx, str.ColorButton
jbe 0x10130662
mov ecx, str.ColorButton
call fcn.101395d0
call fcn.1013c910
movss xmm1, dword [0x1017f35c]
xorps xmm0, xmm0
call fcn.1011d510
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
test edi, edi
je 0x101306bf
movss xmm0, dword [esi + 8]
sub esp, 0x18
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esi + 4]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esi]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push eax
push ecx
push edx
push eax
push ecx
push edx
push str._02X_02X_02X_nR:__d__G:__d__B:__d_n__.3f___.3f___.3f_
call fcn.1013d080
add esp, 0x34
jmp 0x1013070d
movss xmm0, dword [esi + 0xc]
sub esp, 0x20
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
movss xmm0, dword [esi + 8]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esi + 4]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esi]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push ebx
push eax
push ecx
push edx
push ebx
push eax
push ecx
push edx
push str._02X_02X_02X_02X_nR:_d__G:_d__B:_d__A:_d_n__.3f___.3f___.3f___.3f_
call fcn.1013d080
add esp, 0x44
mov eax, dword [0x101e6b78]
mov eax, dword [eax + 0x19e4]
test dword [eax + 8], 0x2000000
jne 0x10130729
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.1011d370
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10135180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push ebx
lea ecx, [eax + 0x18]
mov dword [ebp - 8], eax
mov edx, edi
call fcn.10133eb0
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x101351d7
xor ecx, ecx
test ebx, ebx
jle 0x101351d7
lea edx, [edi + edi]
lea eax, [ecx + edi]
cmp eax, dword [esi + 4]
jge 0x101351f2
mov eax, dword [esi + 0xc]
mov ebx, dword [ebp - 4]
mov ax, word [edx + eax]
add edx, 2
mov word [ebx + ecx*2], ax
inc ecx
mov ebx, dword [ebp + 0xc]
cmp ecx, ebx
jl 0x101351b6
push ebx
mov edx, edi
mov ecx, esi
call fcn.10135720
mov eax, dword [ebp - 8]
add esp, 4
pop edi
pop esi
mov byte [eax + 0xf], 0
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10135230
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov ebx, edx
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 8], eax
xor esi, esi
mov dword [ebp - 0xc], edi
mov ecx, dword [ebx + 0x2c]
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ecx
jne 0x101352cc
cmp dword [ebp + 0xc], eax
je 0x1013528e
push esi
lea ecx, [ebp - 0x24]
call fcn.101359c0
movss xmm0, dword [ebp - 0x14]
add esp, 4
subss xmm0, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dword [edi + 4], esi
movss dword [edi + 8], xmm0
movss xmm0, dword [ebp - 0x20]
movss dword [edi], xmm0
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], 0x3f800000
test ecx, ecx
jle 0x101352ba
mov edi, ecx
push esi
mov edx, ebx
lea ecx, [ebp - 0x24]
call fcn.101359c0
mov eax, esi
add esp, 4
add esi, dword [ebp - 0x10]
cmp esi, edi
jl 0x101352a0
mov edi, dword [ebp - 0xc]
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0x24]
mov dword [edi + 4], eax
call fcn.101359c0
mov ecx, dword [ebp - 0x10]
add esp, 4
cmp dword [ebp + 8], ecx
jl 0x10135311
movss xmm0, dword [ebp - 0x1c]
mov edx, ebx
addss xmm0, dword [edi + 4]
mov dword [ebp - 8], esi
add esi, ecx
push esi
lea ecx, [ebp - 0x24]
movss dword [edi + 4], xmm0
call fcn.101359c0
mov ecx, dword [ebp - 0x10]
add esp, 4
lea eax, [ecx + esi]
cmp dword [ebp + 8], eax
jge 0x101352e4
movss xmm0, dword [ebp - 0x14]
subss xmm0, dword [ebp - 0x18]
movss xmm1, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], ecx
movss dword [edi + 8], xmm0
mov dword [edi + 0x14], eax
movss dword [edi], xmm1
cmp esi, dword [ebp + 8]
jge 0x101352c5
cmp esi, dword [ebx + 4]
jge 0x101353ba
movss xmm3, dword [0x1017f35c]
lea ecx, [esi + esi]
mov edx, ecx
mov dword [ebp - 8], edx
nop
mov eax, dword [ebx + 0xc]
movzx eax, word [ecx + eax]
cmp eax, 0xa
jne 0x10135361
movaps xmm0, xmm3
jmp 0x1013539b
mov ecx, dword [0x101e6b78]
mov edx, eax
mov ecx, dword [ecx + 0x18fc]
cmp edx, dword [ecx]
jge 0x1013537d
mov eax, dword [ecx + 8]
movss xmm2, dword [eax + edx*4]
jmp 0x10135382
movss xmm2, dword [ecx + 0xc]
mov eax, dword [0x101e6b78]
mov edx, dword [ebp - 8]
movss xmm0, dword [eax + 0x1900]
divss xmm0, dword [ecx + 0x10]
mulss xmm0, xmm2
addss xmm1, xmm0
add edx, 2
inc esi
mov dword [ebp - 8], edx
movss dword [edi], xmm1
cmp esi, dword [ebp + 8]
jge 0x101352c5
mov ecx, edx
cmp esi, dword [ebx + 4]
jl 0x10135350
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3