joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100874f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
jle 0x10087602
movsd xmm1, qword [0x102d2bb8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
add edi, 2
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
mov eax, ecx
movzx esi, byte [edi - 1]
mov ebp, edx
and edx, 0x7f
shr eax, 7
and ecx, 0x7f
add edx, edx
shl ecx, 8
or edx, eax
movzx eax, byte [edi - 2]
or esi, ecx
shl esi, 8
and ebp, 0x80
or esi, eax
test edx, edx
jne 0x10087552
test esi, esi
jne 0x10087552
xorps xmm0, xmm0
jmp 0x100875ee
lea eax, [edx - 0x7f]
neg edx
sbb edx, edx
or esi, 0x800000
and edx, eax
movd xmm0, esi
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x101f367c]
cvtps2pd xmm0, xmm0
cvtpd2ps xmm0, xmm0
movss dword [esp + 0x20], xmm0
test ebp, ebp
je 0x1008758f
mulss xmm0, dword [0x101f36a0]
movss dword [esp + 0x20], xmm0
test edx, edx
jle 0x100875b6
movaps xmm0, xmm1
movd xmm1, edx
cvtdq2pd xmm1, xmm1
call fcn.10121930
movss xmm1, dword [esp + 0x20]
cvtps2pd xmm1, xmm1
mulsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
jmp 0x100875e6
jns 0x100875ee
mov eax, edx
cvtps2pd xmm0, xmm0
cdq
xor eax, edx
sub eax, edx
movsd qword [esp + 0x10], xmm0
movaps xmm0, xmm1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
call fcn.10121930
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movsd xmm1, qword [0x102d2bb8]
movss dword [edi - 2], xmm0
add edi, 4
sub ebx, 1
jne 0x10087512
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1008a9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
jle 0x1008aaec
movsd xmm2, qword [0x102d2bb8]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
add esi, 6
movzx ecx, byte [esi]
movzx ebp, byte [esi + 1]
mov eax, ecx
movzx edi, byte [esi - 1]
and ecx, 0xf
shl ecx, 8
mov edx, ebp
or edi, ecx
shr eax, 4
movzx ecx, byte [esi - 4]
and edx, 0x7f
shl edx, 4
or edx, eax
shl edi, 8
movzx eax, byte [esi - 2]
or edi, eax
shl ecx, 8
movzx eax, byte [esi - 3]
shl edi, 8
or edi, eax
movzx eax, byte [esi - 5]
or ecx, eax
movzx eax, byte [esi - 6]
shl ecx, 8
or ecx, eax
test edx, edx
jne 0x1008aa40
test edi, edi
jne 0x1008aa40
test ecx, ecx
jne 0x1008aa40
xorps xmm1, xmm1
jmp 0x1008aad8
movd xmm1, ecx
sub edx, 0x3ff
movd xmm0, edi
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
mulsd xmm1, qword [0x101ffc30]
addsd xmm1, xmm0
addsd xmm1, qword [0x101ffc48]
mulsd xmm1, qword [0x101ffc28]
movsd qword [esp + 0x10], xmm1
cmp ebp, 0x80
jb 0x1008aa8e
mulsd xmm1, qword [0x101f4bf0]
movsd qword [esp + 0x10], xmm1
test edx, edx
jle 0x1008aaad
movd xmm1, edx
movaps xmm0, xmm2
cvtdq2pd xmm1, xmm1
call fcn.10121930
mulsd xmm0, qword [esp + 0x10]
movaps xmm1, xmm0
jmp 0x1008aad0
jns 0x1008aad8
mov eax, edx
movaps xmm0, xmm2
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
call fcn.10121930
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movsd xmm2, qword [0x102d2bb8]
movsd qword [esi - 6], xmm1
add esi, 8
sub ebx, 1
jne 0x1008a9e2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1009c850
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
xor edi, edi
movzx ecx, word [esi + edi*2]
movsx eax, cx
imul eax, eax
push ecx
push ebp
sar eax, 2
add ebx, eax
call fcn.1009cab0
movzx eax, al
add esp, 8
mov word [esi + edi*2], ax
inc edi
cmp edi, 0xa0
jl 0x1009c863
mov ecx, dword [ebp + 0x6c]
mov eax, ecx
shl ebx, 0xc
mov dword [esp + 0x20], ebx
sub eax, 0
je 0x1009ca3c
sub eax, 1
je 0x1009c914
sub eax, 1
je 0x1009c8c7
push ecx
push str._Error_:_Unhandled_NMS_ADPCM_type__d._n
push dword [esp + 0x30]
call fcn.10069fd0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, dword [esp + 0x34]
xor edx, edx
nop dword [eax]
lea eax, [edx + edx]
add edx, 4
mov cx, word [eax + esi]
lea edi, [edi + 2]
shl cx, 4
or cx, word [eax + esi + 2]
shl cx, 4
or cx, word [eax + esi + 4]
shl cx, 4
or cx, word [eax + esi + 6]
mov word [edi - 2], cx
cmp edx, 0xa0
jl 0x1009c8d0
mov word [edi], bx
mov eax, 0xa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov dword [esp + 0x10], eax
nop
lea eax, [esi + ecx*2]
mov dword [esp + 0x14], eax
lea ebx, [esi + ecx*2]
lea edx, [esi + ecx*2]
lea edi, [esi + ecx*2]
lea ebp, [esi + ecx*2]
lea eax, [esi + 4]
lea eax, [eax + ecx*2]
mov dword [esp + 0x18], eax
lea eax, [ecx*2 + 0x18]
add ecx, 0x10
mov dword [esp + 0x1c], ecx
movzx ecx, word [eax + esi]
and cx, 0xf
shl cx, 4
or cx, word [eax + esi + 2]
shl cx, 4
or cx, word [eax + esi + 4]
movzx eax, word [eax + esi + 6]
shr ax, 1
shl cx, 3
or cx, ax
movzx eax, word [edx + 0x10]
shl ax, 4
or ax, word [edx + 0x12]
shl ax, 4
or ax, word [edi + 0x14]
movzx ecx, cx
shl ax, 4
or ax, word [edi + 0x16]
mov dword [esp + 0x2c], ecx
and ecx, 0x1111
shr word [esp + 0x2c], 1
or ax, cx
movzx ecx, word [ebx + 8]
mov edx, dword [esp + 0x2c]
shl cx, 4
or cx, word [ebx + 0xa]
mov ebx, dword [esp + 0x14]
movzx edi, ax
mov eax, edx
shl cx, 4
and eax, 0x1111
or cx, word [ebp + 0xc]
shl cx, 4
or cx, word [ebp + 0xe]
or cx, ax
shr edx, 1
movzx eax, word [ebx]
and edx, 0x1111
shl ax, 4
or ax, word [ebx + 2]
mov ebx, dword [esp + 0x18]
shl ax, 4
movzx ecx, cx
or ax, word [ebx]
shl ax, 4
or ax, dx
mov edx, dword [esp + 0x10]
or ax, word [ebx + 2]
mov word [edx], ax
mov word [edx + 2], cx
mov ecx, dword [esp + 0x1c]
mov word [edx + 4], di
add edx, 6
mov dword [esp + 0x10], edx
cmp ecx, 0xa0
jl 0x1009c920
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov word [edx], ax
mov eax, 0xa0
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x34]
xor edi, edi
lea eax, [edi + edi]
add edi, 8
mov cx, word [eax + esi]
lea edx, [eax + esi]
shl cx, 2
lea ebp, [ebp + 2]
or cx, word [eax + esi + 8]
shl cx, 2
or cx, word [eax + esi + 2]
shl cx, 2
or cx, word [eax + esi + 0xa]
shl cx, 2
or cx, word [edx + 4]
shl cx, 2
or cx, word [eax + esi + 0xc]
mov ax, word [eax + esi + 0xe]
shl cx, 2
sar ax, 2
or cx, ax
or cx, word [edx + 6]
mov word [ebp - 2], cx
cmp edi, 0xa0
jl 0x1009ca42
pop edi
pop esi
mov word [ebp], bx
mov eax, 0xa0
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100b00d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
movsx eax, word [esi + 0x20]
push eax
movsx eax, word [esi + 0x10]
sar eax, 2
push eax
call fcn.100afc60
add esp, 8
mov dword [esp + 0x1c], eax
lea ebp, [esi + 0x12]
mov dword [esp + 0x10], 5
nop
movsx edi, word [ebp]
movsx ebx, word [ebp + 0x10]
sar edi, 2
movzx ecx, di
mov eax, ecx
test edi, edi
jle 0x100b0116
jmp 0x100b011d
neg eax
and eax, 0x1fff
mov esi, 0x102e4dc8
xor edx, edx
mov cx, word [esi]
lea esi, [esi + 2]
cmp ax, cx
jl 0x100b0135
inc edx
cmp edx, 0xf
jl 0x100b0124
lea ecx, [edx - 6]
movzx edx, cx
test ax, ax
jne 0x100b0147
mov ecx, 0x20
jmp 0x100b015e
test dx, dx
js 0x100b0154
mov cx, dx
sar ax, cl
jmp 0x100b015b
mov ecx, edx
neg ecx
shl ax, cl
movzx ecx, ax
movsx esi, word [ebp + 0x10]
add edx, 0xfffffff3
mov eax, ebx
sar eax, 6
and eax, 0xf
add eax, edx
movzx edx, ax
mov dword [esp + 0x14], edx
mov edx, esi
movzx ebx, ax
and edx, 0x3f
movsx eax, cx
imul edx, eax
sar edx, 4
movzx eax, dx
test bx, bx
js 0x100b019e
mov cl, bl
shl ax, cl
mov ecx, 0x7fff
and ax, cx
jmp 0x100b01a7
mov cl, byte [esp + 0x14]
neg cl
sar ax, cl
mov edx, dword [esp + 0x1c]
movzx eax, ax
movsx ecx, ax
mov eax, ecx
neg eax
xor edi, esi
cmovns eax, ecx
add ebp, 2
add edx, eax
sub dword [esp + 0x10], 1
mov dword [esp + 0x1c], edx
jne 0x100b0100
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
add esp, 8
ret
Function at 0x100b3f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1b4
mov eax, dword [0x102e5cc0]
xor eax, esp
mov dword [esp + 0x1b0], eax
mov ecx, dword [esp + 0x1bc]
mov eax, dword [esp + 0x1b8]
mov edx, dword [esp + 0x1c0]
push ebx
push ebp
mov dword [esp + 0x24], ecx
lea ebp, [eax + 0xf0]
mov ecx, dword [esp + 0x1cc]
lea ebx, [esp + 0x78]
push esi
mov esi, dword [esp + 0x1e0]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x1d8]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1dc]
push edi
mov edi, dword [esp + 0x1d8]
sub dword [esp + 0x10], edi
sub dword [esp + 0x14], edi
sub edx, edi
mov dword [esp + 0x28], esi
mov esi, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 4
nop word [eax + eax]
lea eax, [esp + 0x30]
push eax
movzx eax, word [edi]
push ecx
push eax
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + edi]
push eax
call fcn.100be210
push ebp
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + edi]
push eax
mov eax, dword [esp + 0x40]
movzx eax, word [eax + edi]
push eax
push esi
call fcn.100bb1c0
movups xmm0, xmmword [ebp]
mov ecx, dword [esp + 0x3c]
lea ebx, [ebx + 0x50]
add ecx, 0x1a
lea edi, [edi + 2]
movups xmmword [ebx - 0x50], xmm0
add esp, 0x24
sub dword [esp + 0x1c], 1
movups xmm0, xmmword [ebp + 0x10]
mov dword [esp + 0x18], ecx
movups xmmword [ebx - 0x40], xmm0
movups xmm0, xmmword [ebp + 0x20]
movups xmmword [ebx - 0x30], xmm0
movups xmm0, xmmword [ebp + 0x30]
movups xmmword [ebx - 0x20], xmm0
movups xmm0, xmmword [ebp + 0x40]
movups xmmword [ebx - 0x10], xmm0
jne 0x100b3fd0
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x80]
mov ebx, dword [esp + 0x20]
push esi
push eax
push dword [esp + 0x34]
push ebx
call fcn.100bd7c0
movzx eax, word [ebx + 0x284]
add esp, 0x10
mov edx, 0xa0
movsx ecx, ax
mov ebp, 0xffff8000
nop dword [eax + eax]
imul eax, ecx, 0x6e14
dec edx
movsx ecx, word [esi]
add eax, 0x4000
sar eax, 0xf
cwde
add eax, ecx
cmp eax, 0x7fff
jl 0x100b40a3
mov eax, 0x7fff
jmp 0x100b40ab
cmp eax, 0xffff8000
cmovle eax, ebp
movzx edi, ax
movsx ecx, di
lea eax, [ecx + ecx]
cmp eax, 0x7fff
jl 0x100b40c2
mov eax, 0x7fff
jmp 0x100b40ca
cmp eax, 0xffff8000
cmovle eax, ebp
and eax, 0xfffffff8
mov word [esi], ax
add esi, 2
test edx, edx
jne 0x100b4080
mov ecx, dword [esp + 0x1c0]
mov word [ebx + 0x284], di
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d06f
add esp, 0x1b4
ret
Function at 0x100be280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x102e5cc0]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x84]
push ebx
mov ebx, dword [esp + 0x8c]
push ebp
mov ebp, dword [esp + 0x94]
push edi
mov edi, dword [esp + 0x8c]
mov dword [esp + 0xc], eax
mov eax, 0x14
mov dword [esp + 0x10], ebp
mov ebp, 0x7fff
push esi
movsx ecx, word [eax + edi - 0x10]
movsx edx, word [eax + edi - 0x18]
add edx, ecx
movsx ecx, word [eax + edi - 0x1e]
imul esi, edx, 0x806
movsx edx, word [eax + edi - 0xa]
add edx, ecx
imul ecx, edx, 0x86
movsx edx, word [eax + edi - 0xc]
sub esi, ecx
movsx ecx, word [eax + edi - 0x1c]
add edx, ecx
imul ecx, edx, 0x176
movsx edx, word [eax + edi - 0x16]
sub esi, ecx
movsx ecx, word [eax + edi - 0x12]
add edx, ecx
imul ecx, edx, 0x166d
add esi, ecx
movsx ecx, word [eax + edi - 0x14]
shl ecx, 0xd
add ecx, 0x1000
add ecx, esi
sar ecx, 0xd
cmp ecx, 0xffff8000
jge 0x100be330
mov ecx, 0xffff8000
jmp 0x100be335
cmp ecx, ebp
cmovg ecx, ebp
mov word [esp + eax + 0x24], cx
add eax, 2
cmp eax, 0x62
jle 0x100be2c0
pop esi
push ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.100be450
push dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push ebp
push eax
call fcn.100bdd40
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x30]
push dword [esp + 0x3c]
push ebp
call fcn.100bdc80
push edi
lea eax, [esp + 0x4c]
push eax
movzx eax, word [ebx]
push eax
call fcn.100be3b0
mov ecx, dword [esp + 0xc0]
add esp, 0x3c
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d06f
add esp, 0x7c
ret
Function at 0x100d7a70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x20]
mov ecx, 2
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
cmp edi, 8
jle 0x100d7ad6
push dword [esp + 0x28]
push esi
push edi
call fcn.100d7590
add esp, 0xc
mov ecx, 8
mov dword [esp + 0x18], ecx
cmp edi, 0x20
jle 0x100d7ad6
mov dword [esp + 0x20], 0x20
nop
push dword [esp + 0x28]
push esi
push ecx
push edi
call fcn.100d7df0
mov ecx, dword [esp + 0x30]
add esp, 0x10
lea eax, [ecx*4]
mov dword [esp + 0x20], eax
cmp eax, edi
jl 0x100d7ab0
mov dword [esp + 0x18], ecx
lea eax, [ecx*4]
cmp eax, edi
jne 0x100d7bdd
xor edx, edx
test ecx, ecx
jle 0x100d7c39
lea eax, [ecx + ecx*2]
lea edi, [esi + eax*8]
lea eax, [esi + ecx*8]
mov dword [esp + 0x20], eax
mov eax, ecx
shl eax, 4
add eax, esi
mov ecx, dword [esp + 0x20]
movsd xmm3, qword [esi + edx*8]
movsd xmm6, qword [eax]
movsd xmm5, qword [esi + edx*8 + 8]
movsd xmm7, qword [ecx]
movsd xmm2, qword [ecx + 8]
addsd xmm7, xmm3
subsd xmm3, qword [ecx]
xorps xmm5, xmmword [0x101f4c00]
movsd xmm4, qword [eax + 8]
subsd xmm5, xmm2
subsd xmm2, qword [esi + edx*8 + 8]
movsd qword [esp + 0x10], xmm3
movaps xmm3, xmm6
addsd xmm3, qword [edi]
subsd xmm6, qword [edi]
movsd qword [esp + 8], xmm2
movaps xmm2, xmm4
addsd xmm2, qword [edi + 8]
subsd xmm4, qword [edi + 8]
movaps xmm0, xmm3
addsd xmm0, xmm7
subsd xmm7, xmm3
movsd qword [esi + edx*8], xmm0
movaps xmm0, xmm5
subsd xmm0, xmm2
addsd xmm2, xmm5
movsd qword [esi + edx*8 + 8], xmm0
add edx, 2
movsd xmm0, qword [esp + 0x10]
subsd xmm0, xmm4
movsd qword [eax], xmm7
addsd xmm4, qword [esp + 0x10]
movsd qword [eax + 8], xmm2
add eax, 0x10
movsd qword [ecx], xmm0
movsd xmm0, qword [esp + 8]
subsd xmm0, xmm6
addsd xmm6, qword [esp + 8]
movsd qword [ecx + 8], xmm0
add ecx, 0x10
movsd qword [edi], xmm4
movsd qword [edi + 8], xmm6
add edi, 0x10
mov dword [esp + 0x20], ecx
cmp edx, dword [esp + 0x18]
jl 0x100d7b03
pop edi
pop esi
add esp, 0x14
ret
xor eax, eax
test ecx, ecx
jle 0x100d7c39
movsd xmm5, qword [0x101f4c00]
lea edx, [esi + 8]
lea edx, [edx + ecx*8]
movsd xmm3, qword [edx - 8]
movsd xmm4, qword [esi + eax*8]
movaps xmm0, xmm3
movsd xmm1, qword [esi + eax*8 + 8]
addsd xmm0, xmm4
movsd xmm2, qword [edx]
subsd xmm4, xmm3
subsd xmm2, xmm1
xorps xmm1, xmm5
movsd qword [esi + eax*8], xmm0
subsd xmm1, qword [edx]
movsd qword [esi + eax*8 + 8], xmm1
add eax, 2
movsd qword [edx - 8], xmm4
movsd qword [edx], xmm2
add edx, 0x10
cmp eax, ecx
jl 0x100d7bf1
pop edi
pop esi
add esp, 0x14
ret
Function at 0x100d93d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
mov ecx, 2
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
cmp edi, 8
jle 0x100d9436
push dword [esp + 0x20]
push esi
push edi
call fcn.100d8ee0
add esp, 0xc
mov ecx, 8
mov dword [esp + 0x10], ecx
cmp edi, 0x20
jle 0x100d9436
mov dword [esp + 0x18], 0x20
nop
push dword [esp + 0x20]
push esi
push ecx
push edi
call fcn.100d9750
mov ecx, dword [esp + 0x28]
add esp, 0x10
lea eax, [ecx*4]
mov dword [esp + 0x18], eax
cmp eax, edi
jl 0x100d9410
mov dword [esp + 0x10], ecx
lea eax, [ecx*4]
cmp eax, edi
jne 0x100d954a
xor edx, edx
test ecx, ecx
jle 0x100d95a8
lea eax, [ecx + ecx*2]
lea eax, [esi + eax*4]
mov dword [esp + 0xc], eax
lea edi, [esi + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
nop word [eax + eax]
movss xmm3, dword [esi + edx*4]
movss xmm7, dword [edi]
mov ecx, dword [esp + 0x18]
addss xmm7, xmm3
subss xmm3, dword [edi]
movss xmm5, dword [esi + edx*4 + 4]
movss xmm2, dword [edi + 4]
movss xmm6, dword [ecx]
xorps xmm5, xmmword [0x101f36d0]
movss xmm4, dword [ecx + 4]
subss xmm5, xmm2
subss xmm2, dword [esi + edx*4 + 4]
movss dword [esp + 0xc], xmm3
movaps xmm3, xmm6
addss xmm3, dword [eax]
subss xmm6, dword [eax]
movss dword [esp + 8], xmm2
movaps xmm2, xmm4
addss xmm2, dword [eax + 4]
subss xmm4, dword [eax + 4]
movaps xmm0, xmm3
addss xmm0, xmm7
subss xmm7, xmm3
movss dword [esi + edx*4], xmm0
movaps xmm0, xmm5
subss xmm0, xmm2
addss xmm2, xmm5
movss dword [esi + edx*4 + 4], xmm0
add edx, 2
movss xmm0, dword [esp + 0xc]
subss xmm0, xmm4
movss dword [ecx], xmm7
addss xmm4, dword [esp + 0xc]
movss dword [ecx + 4], xmm2
add ecx, 8
mov dword [esp + 0x18], ecx
movss dword [edi], xmm0
movss xmm0, dword [esp + 8]
subss xmm0, xmm6
addss xmm6, dword [esp + 8]
movss dword [edi + 4], xmm0
add edi, 8
movss dword [eax], xmm4
movss dword [eax + 4], xmm6
add eax, 8
cmp edx, dword [esp + 0x10]
jl 0x100d9470
pop edi
pop esi
add esp, 0xc
ret
xor eax, eax
test ecx, ecx
jle 0x100d95a8
movss xmm5, dword [0x101f36d0]
lea edx, [esi + 4]
lea edx, [edx + ecx*4]
nop
movss xmm3, dword [edx - 4]
movss xmm4, dword [esi + eax*4]
movaps xmm0, xmm3
movss xmm1, dword [esi + eax*4 + 4]
addss xmm0, xmm4
movss xmm2, dword [edx]
subss xmm4, xmm3
subss xmm2, xmm1
xorps xmm1, xmm5
movss dword [esi + eax*4], xmm0
subss xmm1, dword [edx]
movss dword [esi + eax*4 + 4], xmm1
add eax, 2
movss dword [edx - 4], xmm4
movss dword [edx], xmm2
add edx, 8
cmp eax, ecx
jl 0x100d9560
pop edi
pop esi
add esp, 0xc
ret
Function at 0x100efce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov eax, dword [ecx + 0x1c]
mov edx, dword [ecx + 4]
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], edx
push 4
push 0x80
mov dword [edi + 4], 0x80
mov dword [edi + 8], 0x40
mov ecx, dword [eax + 0xb74]
mov dword [edi], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 0xa4], 0x80
mov eax, dword [eax + 4]
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0xb0], eax
call fcn.101128c3
mov dword [edi + 0x24], eax
lea eax, [edi + 0x10]
push 0x80
push eax
call fcn.100ef290
add esp, 0x10
xor esi, esi
nop dword [eax]
movd xmm0, esi
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x101fe830]
mulsd xmm0, qword [0x10283eb8]
call fcn.101163e0
mov eax, dword [edi + 0x24]
cvtsd2ss xmm0, xmm0
movss dword [eax + esi*4], xmm0
mov eax, dword [edi + 0x24]
movss xmm0, dword [eax + esi*4]
mulss xmm0, xmm0
movss dword [eax + esi*4], xmm0
inc esi
cmp esi, 0x80
jl 0x100efd50
mov dword [edi + 0x28], 2
lea esi, [edi + 0x34]
mov dword [edi + 0x2c], 4
mov dword [edi + 0x38], 4
mov dword [edi + 0x3c], 5
mov dword [edi + 0x48], 6
mov dword [edi + 0x4c], 6
mov dword [edi + 0x58], 9
mov dword [edi + 0x5c], 8
mov dword [edi + 0x68], 0xd
mov dword [edi + 0x6c], 8
mov dword [edi + 0x78], 0x11
mov dword [edi + 0x7c], 8
mov dword [edi + 0x88], 0x16
mov dword [edi + 0x8c], 8
mov dword [esp + 0x24], 7
nop word [eax + eax]
mov ebp, dword [esi - 8]
lea eax, [ebp*4]
push eax
call fcn.10115a2f
add esp, 4
mov edi, eax
xor ebx, ebx
mov dword [esi - 4], edi
test ebp, ebp
jle 0x100efe85
movd xmm1, ebp
cvtdq2pd xmm1, xmm1
movsd qword [esp + 0x14], xmm1
nop dword [eax]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [0x102d2bb0]
divsd xmm0, xmm1
mulsd xmm0, qword [0x10283eb8]
call fcn.101163e0
movsd xmm1, qword [esp + 0x14]
cvtsd2ss xmm0, xmm0
movss dword [edi + ebx*4], xmm0
mov edi, dword [esi - 4]
movss xmm0, dword [edi + ebx*4]
inc ebx
addss xmm0, dword [esi]
movss dword [esi], xmm0
cmp ebx, ebp
jl 0x100efe40
movss xmm0, dword [esi]
movsd xmm1, qword [0x101f33a8]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss dword [esi], xmm0
add esi, 0x10
sub dword [esp + 0x24], 1
jne 0x100efe10
mov ecx, dword [esp + 0x10]
push 0x90
lea eax, [ecx*8]
sub eax, ecx
push eax
call fcn.101128c3
mov edi, dword [esp + 0x28]
push 4
push dword [edi + 0xa4]
mov dword [edi + 0x98], eax
call fcn.101128c3
add esp, 0x10
mov dword [edi + 0xa0], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100feda1
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x100fedc4
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x100fedb2
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1010c9c1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.10124662
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x1010ca00
sub eax, 1
je 0x1010c9fb
sub eax, 1
je 0x1010c9f7
xor eax, eax
leave
ret
push 3
jmp 0x1010ca02
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x1011bf7d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10321598]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1011bfbd
cmp byte [ebx], 0xa
jne 0x1011bfbd
or byte [edi + eax + 0x28], 4
jmp 0x1011bfc2
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1011c0c1
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1011c0a4
inc eax
cmp dl, 0xd
je 0x1011bfee
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1011c014
cmp eax, ecx
jae 0x1011c022
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1011bfd6
jmp 0x1011c0c1
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1011c09f
cmp dword [ebp - 0x10], 0
je 0x1011c09f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10321598]
test byte [eax + edi + 0x28], 0x48
je 0x1011c079
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1011c064
mov byte [esi], dl
jmp 0x1011c075
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10321598]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1011c0c1
cmp byte [ebp - 1], 0xa
jne 0x1011c088
cmp esi, ebx
jne 0x1011c088
mov byte [esi], 0xa
jmp 0x1011c0c0
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1011bf1f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1011c0c1
mov byte [esi], 0xd
jmp 0x1011c0c0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10321598]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1011c0be
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1011c0c1
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret