joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b9dc0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x19c]
push edi
movss dword [esp + 0x10], xmm3
mov dword [esp + 0x14], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x1024b4a8]
test eax, eax
je 0x100b9e09
inc dword [eax + 0x370]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx edx, byte [esi]
add esp, 4
movzx ecx, byte [esi + 1]
mov ebp, eax
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x100b9eb8
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x100b9eb8
movzx ecx, byte [esi + 8]
movzx eax, byte [esi + 9]
movzx edi, byte [esi + 0xb]
shl ecx, 8
add ecx, eax
mov dword [0x102811c4], esi
movzx eax, byte [esi + 0xa]
add esi, 0x10
shl ecx, 8
add ecx, eax
mov dword [0x102812cc], ebp
shl ecx, 8
add ecx, ebp
mov dword [0x102812d0], ebp
add edi, ecx
mov ecx, esi
mov dword [0x102812c8], edi
call fcn.100bc4b0
cmp eax, esi
je 0x100b9eb8
cmp dword [0x102812d0], edi
ja 0x100b9eb8
mov ecx, eax
mov esi, eax
call fcn.100bc4b0
cmp eax, esi
jne 0x100b9ea3
mov esi, dword [esp + 0x1a8]
test esi, esi
je 0x100b9eda
mov ecx, 0x20
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x118]
jmp 0x100b9f29
push 0x80
lea eax, [esp + 0x1c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0xffff
mov byte [esp + 0x2c], 1
add esp, 0xc
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 1
lea esi, [esp + 0x18]
mov dword [esp + 0x50], 0x7f7fffff
mov dword [esp + 0x68], 0
mov dword [esp + 0x5c], 0x3f800000
mov word [esp + 0x60], ax
movss xmm0, dword [esp + 0x10]
lea edi, [esp + 0x98]
comiss xmm0, dword [0x102404e0]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x20
mov byte [esp + 0xa0], 1
lea esi, [esp + 0x98]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
jbe 0x100b9f6e
movss dword [esp + 0x28], xmm0
mov eax, dword [esp + 0x1ac]
test eax, eax
mov ecx, dword [esp + 0x48]
cmovne ecx, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.100b9ab0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18c
ret 0x10
Function at 0x100bda50
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [0x1024b4a8]
push ebp
push esi
push edi
test ebx, ebx
je 0x100bda69
mov ebp, dword [ebx + 0xc4]
jmp 0x100bda6b
xor ebp, ebp
lea eax, [esp + 0x28]
xorps xmm0, xmm0
push eax
movups xmmword [esp + 0x2c], xmm0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
movd xmm1, eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x18]
mov ecx, edi
sub ecx, dword [ebp + 8]
mov esi, dword [esp + 0x1c]
mov edx, esi
sbb edx, dword [ebp + 0xc]
call fcn.1018c8b0
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
call fcn.1018c8b0
movss xmm1, dword [esp + 0x10]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [ebp + 0xc], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp + 8], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov esi, dword [0x1024b4a8]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
test esi, esi
je 0x100bdb4e
mov edi, dword [esi + 0xc4]
jmp 0x100bdb50
xor edi, edi
cmp byte [esi + 0x357], 0
je 0x100bdb90
cvttss2si eax, dword [esi + 0xe4]
mov dword [esp + 0x10], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x100bdb90
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x100bdc02
mov ecx, dword [edi]
cmp eax, ecx
je 0x100bdbc0
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x100bdc02
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100bdc02
lea eax, [esp + 0x20]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100bdc02
movd xmm0, dword [esp + 0x20]
movd xmm1, dword [esp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xb0], 0
je 0x100bdc10
or eax, 0xffffffff
jmp 0x100bdc1b
mov eax, dword [0x1024b4a8]
mov eax, dword [eax + 0x1e84]
cmp dword [ebp + 0x18], eax
je 0x100bdc28
mov dword [ebp + 0x18], eax
call fcn.100bd6b0
call fcn.100bd7e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x100ecc30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 0x24], edx
push edi
mov edi, 1
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
sub ecx, dword [eax]
sub ecx, 0x10
sar ecx, 4
sub ecx, ebx
je 0x100ecdf3
dec ecx
mov edx, ebx
mov dword [esp + 0x2c], ecx
mov ecx, esi
call fcn.100de8a0
cmp eax, 0x1020fac8
je 0x100ecd4e
mov eax, dword [eax + 8]
and eax, 0xf
cmp al, 3
jne 0x100ecd4e
mov edx, ebx
mov ecx, esi
call fcn.100de8a0
mov edx, ebx
mov ecx, esi
cmp dword [eax + 8], 0x13
jne 0x100ecce7
call fcn.100de8a0
cmp dword [eax + 8], 0x13
jne 0x100eccbb
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
push ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
push str._lld
jmp 0x100ecd2b
push 0
lea edx, [esp + 0x34]
mov ecx, eax
call fcn.101017a0
add esp, 4
test eax, eax
jne 0x100eccd8
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
push dword [esp + 0x34]
push dword [esp + 0x34]
push str._lld
jmp 0x100ecd2b
call fcn.100de8a0
cmp dword [eax + 8], 3
jne 0x100eccfe
movsd xmm0, qword [eax]
movsd qword [esp + 0x38], xmm0
jmp 0x100ecd1e
lea edx, [esp + 0x38]
mov ecx, eax
call fcn.10101700
test eax, eax
jne 0x100ecd18
xorps xmm0, xmm0
movsd qword [esp + 0x38], xmm0
jmp 0x100ecd1e
movsd xmm0, qword [esp + 0x38]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x34]
call fcn.1009b620
add esp, 0x10
test edi, edi
je 0x100ecdc9
test eax, eax
jle 0x100ecdc9
mov edi, 1
jmp 0x100ecdcb
mov edx, ebx
mov ecx, esi
call fcn.100de8a0
mov ecx, dword [eax + 8]
and ecx, 0xf
cmp ecx, 4
je 0x100ecd8d
cmp ecx, 3
jne 0x100ece02
mov edx, eax
mov ecx, esi
call fcn.100f2860
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xc], 0
jle 0x100ecd84
mov ecx, esi
call fcn.100eb2e0
mov edx, ebx
mov ecx, esi
call fcn.100de8a0
mov eax, dword [eax]
cmp byte [eax + 4], 4
jne 0x100ecd9b
movzx ebx, byte [eax + 7]
jmp 0x100ecd9e
mov ebx, dword [eax + 0xc]
add eax, 0x10
je 0x100ecdff
test edi, edi
je 0x100ecdc6
push dword [esp + 0x28]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, ebx
jne 0x100ecdc6
mov ebx, dword [ebp + 8]
mov edi, 1
jmp 0x100ecdcb
mov ebx, dword [ebp + 8]
xor edi, edi
mov ecx, dword [esp + 0x2c]
inc ebx
mov dword [ebp + 8], ebx
test ecx, ecx
jne 0x100ecc60
test edi, edi
jne 0x100ecdf3
push edi
mov edx, edi
mov ecx, esi
call fcn.100e04b0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
push 4
mov edx, ebx
mov ecx, esi
call fcn.100e03c0
int3
Function at 0x100f0530
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10c
push esi
push edi
push str._5_3
push dword [esp + 0x11c]
mov esi, ecx
mov dword [esp + 0x10], edx
push str._s_s
push esi
call fcn.100deea0
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x100f057b
push dword [esp + 0x118]
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edi, eax
add esp, 4
test edi, edi
je 0x100f05aa
mov edx, dword [esi + 0x10]
mov ecx, esi
add edx, 0x28
push str.LUA_NOENV
call fcn.100def80
mov eax, dword [esi + 0xc]
add esp, 4
add eax, 0xfffffff0
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100f05e9
cmp ecx, 1
jne 0x100f05a7
cmp dword [eax], 0
je 0x100f05e9
mov dword [esi + 0xc], eax
mov edx, dword [esp + 0x11c]
test edx, edx
jne 0x100f05bd
mov eax, dword [esi + 0xc]
mov dword [eax + 8], edx
jmp 0x100f05d3
mov ecx, esi
call fcn.100f9490
mov ecx, dword [esi + 0xc]
mov dword [ecx], eax
movzx eax, byte [eax + 4]
or eax, 0x40
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0xc], 0x10
cmp dword [eax + 0xc], 0
jle 0x100f0629
mov ecx, esi
call fcn.100eb2e0
jmp 0x100f0629
push 0x10237854
push 0x10237858
mov edx, edi
mov dword [esi + 0xc], eax
mov ecx, esi
call fcn.100e1ad0
push dword [esp + 0x124]
mov edx, eax
mov ecx, esi
push 0x10237848
call fcn.100e1ad0
push 0xffffffffffffffff
mov edx, 0xfffffffe
mov ecx, esi
call fcn.100dea50
add esp, 0x14
add dword [esi + 0xc], 0xfffffff0
push 0x105
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100f06ee
cmp eax, 0x105
je 0x100f06ee
lea eax, [esp + 0xc]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 8
test eax, eax
je 0x100f06ee
mov byte [eax], 0
mov eax, dword [esi + 0xc]
sub eax, 0x10
mov ecx, dword [eax + 8]
and ecx, 0xf
cmp ecx, 4
je 0x100f06a2
cmp ecx, 3
je 0x100f0683
xor edx, edx
jmp 0x100f06a7
mov edx, eax
mov ecx, esi
call fcn.100f2860
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xc], 0
jle 0x100f069c
mov ecx, esi
call fcn.100eb2e0
mov eax, dword [esi + 0xc]
sub eax, 0x10
mov edx, dword [eax]
add edx, 0x10
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0x10237844
call fcn.100e1ad0
push 0xffffffffffffffff
mov edx, 0xfffffffe
mov ecx, esi
call fcn.100dea50
add dword [esi + 0xc], 0xfffffff0
add esp, 0xc
mov edx, dword [esi + 0xc]
mov ecx, esi
push dword [esp + 8]
lea edx, [edx - 0x30]
call fcn.100df120
add esp, 4
add dword [esi + 0xc], 0xfffffff0
pop edi
pop esi
add esp, 0x10c
ret
push str.unable_to_get_ModuleFileName
push esi
call fcn.100e0470
int3
Function at 0x100f22f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x18], ecx
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [ebx], esi
mov cl, byte [esi]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
movzx eax, cl
test byte [eax + 0x1020f5f9], 8
je 0x100f2348
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
test byte [eax + 0x1020f5f9], 8
jne 0x100f2338
lea edx, [esi + 1]
cmp cl, 0x2d
jne 0x100f235a
mov dword [esp + 0x20], 1
jmp 0x100f2364
cmp cl, 0x2b
mov dword [esp + 0x20], edi
cmovne edx, esi
cmp byte [edx], 0x30
jne 0x100f24b4
mov al, byte [edx + 1]
cmp al, 0x78
je 0x100f237c
cmp al, 0x58
jne 0x100f24b4
movsd xmm2, qword [0x10240718]
add edx, 2
mov eax, dword [esp + 0x10]
nop dword [eax + eax]
mov bl, byte [edx]
mov esi, edx
movsx ecx, bl
cmp ecx, eax
jne 0x100f23ad
cmp dword [esp + 0xc], 0
jne 0x100f240c
mov dword [esp + 0xc], 1
inc edx
jmp 0x100f2390
movzx eax, bl
test byte [eax + 0x1020f5f9], 0x10
je 0x100f240c
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x100f23cc
cmp bl, 0x30
jne 0x100f23cc
inc dword [esp + 0x18]
jmp 0x100f23fd
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x1e
jg 0x100f23fc
test byte [ecx + 0x1020f5f9], 2
je 0x100f23e4
add ecx, 0xffffffd0
jmp 0x100f23ea
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x100f23fd
inc edi
cmp dword [esp + 0xc], 0
mov eax, dword [esp + 0x10]
je 0x100f2409
dec edi
inc edx
jmp 0x100f2390
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
je 0x100f24b4
mov eax, dword [esp + 0x1c]
shl edi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x100f242d
cmp al, 0x50
jne 0x100f2483
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x100f243f
lea edx, [esi + 2]
lea esi, [ecx + 1]
jmp 0x100f2448
cmp al, 0x2b
jne 0x100f2446
lea edx, [esi + 2]
xor esi, esi
mov bl, byte [edx]
movzx eax, bl
test byte [eax + 0x1020f5f9], 2
je 0x100f24b4
movsx eax, bl
lea ecx, [ecx + ecx*4]
mov bl, byte [edx + 1]
lea ecx, [ecx - 0x18]
inc edx
lea ecx, [eax + ecx*2]
movzx eax, bl
test byte [eax + 0x1020f5f9], 2
jne 0x100f2456
mov eax, ecx
neg eax
test esi, esi
cmove eax, ecx
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
cmp dword [esp + 0x20], 0
je 0x100f2491
xorps xmm1, xmmword [0x10240c10]
push edi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
fstp qword [esp + 0x2c]
movsd xmm0, qword [esp + 0x2c]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xorps xmm0, xmm0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f26e0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xdc
push ebx
push ebp
push esi
mov ebp, edx
lea edx, [esp + 0xc]
push edi
mov edi, ecx
call fcn.100f2540
mov esi, eax
test esi, esi
je 0x100f2723
mov edx, dword [esp + 0x10]
sub esi, edi
mov ecx, dword [esp + 0x14]
mov eax, 0x13
mov dword [ebp], edx
mov dword [ebp + 4], ecx
mov dword [ebp + 8], eax
lea eax, [esi + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
push str..xXnN
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x100f274e
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x100f2750
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
xor ebx, ebx
push ebx
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.100f24c0
mov esi, eax
add esp, 4
test esi, esi
jne 0x100f27df
push 0x2e
push edi
call dword [sym.imp.VCRUNTIME140.dll_strchr]
mov edx, edi
mov esi, eax
add esp, 8
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100f2778
sub edx, eax
cmp edx, 0xc8
ja 0x100f2741
test esi, esi
je 0x100f2741
lea edx, [esp + 0x18]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100f2795
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
lea edx, [esp + 0x10]
push ebx
lea ecx, [esp + 0x1c]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x1c], al
call fcn.100f24c0
mov esi, eax
add esp, 4
test esi, esi
je 0x100f2741
mov eax, edi
lea ecx, [esp + 0x18]
sub eax, ecx
add esi, eax
test esi, esi
je 0x100f2741
movsd xmm0, qword [esp + 0x10]
sub esi, edi
mov eax, 3
movsd qword [ebp], xmm0
pop edi
mov dword [ebp + 8], eax
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret

Function at 0x100f9150
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, esi
mov eax, esi
xor eax, dword [esp + 0x10]
shr edi, 5
inc edi
cmp esi, edi
jb 0x100f918b
nop word [eax + eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x100f9170
pop edi
pop esi
pop ebx
ret
Function at 0x100fbb30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
movsd xmm0, qword [ebp + 0x10]
ucomisd xmm0, qword [0x102408f8]
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [esp + 0xc], esi
lahf
test ah, 0x44
jnp 0x100fbd1b
ucomisd xmm0, qword [0x102409d8]
lahf
test ah, 0x44
jnp 0x100fbd1b
xorps xmm5, xmm5
ucomisd xmm0, xmm5
lahf
test ah, 0x44
jp 0x100fbb97
sub esp, 8
movsd qword [esp], xmm0
push str._.14gx0p0
push edi
call fcn.10028f40
mov ecx, eax
mov dword [esp + 0x18], ecx
jmp 0x100fbd34
lea eax, [esp + 8]
push eax
sub esp, 8
movsd qword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_frexp]
fstp qword [esp + 0x1c]
movsd xmm4, qword [esp + 0x1c]
xorps xmm5, xmm5
add esp, 0xc
xor esi, esi
comisd xmm5, xmm4
jbe 0x100fbbd1
xorps xmm4, xmmword [0x10240c10]
mov esi, 1
mov byte [edi], 0x2d
movsd xmm2, qword [0x10240910]
addsd xmm4, xmm4
movsd xmm1, qword [0x10240838]
mov eax, 0x30
mov edx, 0x57
mov word [esi + edi], 0x7830
andps xmm2, xmm4
movaps xmm0, xmm4
xorps xmm0, xmm2
movaps xmm3, xmm4
cmpltsd xmm0, xmm1
andps xmm1, xmm0
orps xmm1, xmm2
addsd xmm3, xmm1
subsd xmm3, xmm1
movsd xmm1, qword [0x102406c0]
movaps xmm0, xmm3
subsd xmm0, xmm4
cmpnlesd xmm0, xmm2
andps xmm0, xmm1
subsd xmm3, xmm0
cvttsd2si ecx, xmm3
subsd xmm4, xmm3
cmp ecx, 0xa
cmovge eax, edx
add al, cl
mov byte [esi + edi + 2], al
add esi, 3
mov eax, dword [esp + 8]
dec eax
movsd qword [esp + 0x10], xmm4
comisd xmm4, xmm5
mov dword [esp + 8], eax
jbe 0x100fbcfc
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
movsd xmm6, qword [0x10240718]
xorps xmm5, xmm5
movsd xmm4, qword [esp + 0x10]
mov edx, 0x57
movsd xmm7, qword [0x10240910]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esi + edi], al
inc esi
nop dword [eax + eax]
movsd xmm1, qword [0x10240838]
movaps xmm2, xmm7
mulsd xmm4, xmm6
mov eax, 0x30
andps xmm2, xmm4
movaps xmm0, xmm4
xorps xmm0, xmm2
movaps xmm3, xmm4
cmpltsd xmm0, xmm1
andps xmm1, xmm0
orps xmm1, xmm2
addsd xmm3, xmm1
subsd xmm3, xmm1
movsd xmm1, qword [0x102406c0]
movaps xmm0, xmm3
subsd xmm0, xmm4
cmpnlesd xmm0, xmm2
andps xmm0, xmm1
subsd xmm3, xmm0
cvttsd2si ecx, xmm3
subsd xmm4, xmm3
cmp ecx, 0xa
cmovge eax, edx
add al, cl
mov byte [esi + edi], al
inc esi
comisd xmm4, xmm5
ja 0x100fbc90
mov eax, dword [esp + 8]
push eax
lea eax, [esi + edi]
push str.p_d
push eax
call fcn.10028f40
add esp, 0xc
lea ecx, [esi + eax]
mov esi, dword [esp + 0xc]
mov dword [esp + 8], ecx
jmp 0x100fbd37
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push edi
call fcn.10028f40
mov ecx, eax
mov dword [esp + 0x18], eax
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov al, byte [eax + 1]
cmp al, 0x41
jne 0x100fbd72
xor esi, esi
test ecx, ecx
jle 0x100fbd6a
nop word [eax + eax]
movzx eax, byte [esi + edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov ecx, dword [esp + 0xc]
add esp, 4
mov byte [esi + edi], al
inc esi
cmp esi, ecx
jl 0x100fbd50
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
cmp al, 0x61
je 0x100fbd6a
push str.modifiers_for_format___a___A_not_implemented
push esi
call fcn.100e0470
int3
Function at 0x101059b0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10105aae
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10105aa7
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop
cmp dword [esp + 0x14], 0x10
jb 0x10105a8b
call ebx
cmp dword [esp + 0x20], eax
jne 0x10105a8b
call ebp
cmp dword [esp + 0x1c], eax
je 0x10105a8b
mov edx, dword [esi]
test edx, edx
jne 0x10105a50
push 0x200
push edx
push dword [0x1024b4b4]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10105aa7
jmp 0x10105a7b
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10105a7b
shl eax, 3
push eax
push edx
push 0
push dword [0x1024b4b4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10105aa7
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4], eax
lea eax, [ecx + 1]
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10105a10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10105af8
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10105af8
mov ebp, dword [esp + 0x34]
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10105af2
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push ebp
call fcn.10105860
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10105ac0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x10105b00
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x10105b50
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x10105b3f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10105b37
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10105b18
pop edi
pop ebp
push dword [ebx]
push 0
push dword [0x1024b4b4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x10105b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10288bb0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10105ba6
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
pop ecx
ret
test ebx, ebx
je 0x10105bc7
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10105be8
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10105be8
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10105be2
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10105be8
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
shl bl, 2
add cl, cl
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
xor eax, eax
pop edi
mov byte [esi + 0x14], bl
pop esi
pop ebp
pop ebx
pop ecx
ret