joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10115c30
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10115c6f
cmp bl, 0x23
jne 0x10115c51
cmp byte [esi], bl
jne 0x10115c51
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x101752a0]
test bl, bl
jne 0x10115c42
mov ecx, dword [0x101e6b78]
not eax
mov esi, dword [ecx + 0x19d4]
mov edi, dword [ecx + 0x19dc]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10115cae
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10115ca8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10115caa
mov esi, edx
test esi, esi
jne 0x10115c90
cmp edi, ebx
je 0x10115cbd
cmp dword [edi], eax
jne 0x10115cbd
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10115d80
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [0x101e6b78]
push edi
mov edi, ecx
mov ebx, dword [edi + 0x1c0]
lea ecx, [edi + 0x1a4]
test dl, dl
je 0x10115dd4
mov word [ecx], bx
mov eax, dword [edi + 0x198]
mov word [ecx + 2], ax
mov eax, dword [esi + 0x1a7c]
mov word [ecx + 4], ax
mov eax, dword [esi + 0x1a4c]
mov word [ecx + 6], ax
mov eax, dword [esi + 0x1a58]
mov word [ecx + 8], ax
add ecx, 0xa
mov eax, dword [esi + 0x1a64]
mov word [ecx], ax
jmp 0x10115e1a
movsx eax, word [ecx]
cmp eax, ebx
jne 0x10115e24
movsx eax, word [ecx + 2]
cmp eax, dword [edi + 0x198]
jne 0x10115e24
movsx eax, word [ecx + 4]
cmp eax, dword [esi + 0x1a7c]
jne 0x10115e24
movsx eax, word [ecx + 6]
cmp eax, dword [esi + 0x1a4c]
jl 0x10115e24
movsx eax, word [ecx + 8]
cmp eax, dword [esi + 0x1a58]
jl 0x10115e24
movsx eax, word [ecx + 0xa]
add ecx, 0xa
cmp eax, dword [esi + 0x1a64]
jl 0x10115e24
lea eax, [edi + 0x1ae]
cmp ecx, eax
je 0x10115e2c
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
pop esi
pop ebx
ret
Function at 0x10115e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [0x101e6b78]
lea eax, [ebp - 0x1c]
mov ebx, ecx
mov dword [ebp - 8], edx
push eax
mov dword [ebp - 0x1c], 5
movups xmm0, xmmword [edi + 0x15fc]
lea ecx, [edi + 0x1a4c]
movups xmmword [ebp - 0x18], xmm0
call fcn.1003c6b0
movaps xmm0, xmmword [0x1017f820]
lea eax, [ebp - 0x14]
mov esi, dword [0x101e6b78]
movups xmmword [edi + 0x15fc], xmm0
push eax
movss xmm0, dword [edi + 0x1540]
movss dword [ebp - 4], xmm0
lea ecx, [esi + 0x1a58]
movss xmm0, dword [esi + 0x1528]
mov dword [ebp - 0x14], 6
movss dword [ebp - 0x10], xmm0
call fcn.1003c5f0
movss xmm0, dword [ebp - 4]
lea eax, [ebp - 0x14]
movss dword [esi + 0x1528], xmm0
mov esi, dword [0x101e6b78]
movss xmm0, dword [edi + 0x1544]
movss dword [ebp - 4], xmm0
push eax
movss xmm0, dword [esi + 0x152c]
lea ecx, [esi + 0x1a58]
mov dword [ebp - 0x14], 7
movss dword [ebp - 0x10], xmm0
call fcn.1003c5f0
movss xmm0, dword [ebp - 4]
lea eax, [ebp - 0x14]
movss dword [esi + 0x152c], xmm0
mov esi, dword [0x101e6b78]
push eax
mov dword [ebp - 0x14], 1
movss xmm0, dword [esi + 0x1508]
lea ecx, [esi + 0x1a58]
movss xmm1, dword [esi + 0x150c]
movss dword [ebp - 0x10], xmm0
movss dword [ebp - 0xc], xmm1
call fcn.1003c5f0
mov eax, dword [edi + 0x1538]
mov ecx, dword [edi + 0x153c]
mov dword [esi + 0x1508], eax
mov dword [esi + 0x150c], ecx
test ebx, ebx
jne 0x10115f62
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
sub esp, 8
mov edx, ebx
push dword [ebp - 8]
call fcn.10116840
add esp, 0xc
mov ecx, 3
mov bl, al
call fcn.101117a0
mov ecx, 1
call fcn.1011d870
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10116660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [0x101e6b78]
mov esi, dword [edi + 0x19e4]
test dword [esi + 8], 0x1000000
jne 0x10116685
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xorps xmm1, xmm1
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], 0x41300000
call fcn.10119760
cmp word [esi + 0x84], 1
jle 0x101166b3
call fcn.1011d1f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
movss xmm2, dword [esi + 0x14]
movss xmm0, dword [esi + 0x18]
mov eax, dword [esi + 0x9c]
movss xmm1, dword [0x1017f200]
movss dword [ebp - 8], xmm2
movss dword [ebp - 0x10], xmm2
movss dword [ebp - 4], xmm0
movss dword [ebp - 0xc], xmm0
test al, 1
je 0x101166fc
movaps xmm0, xmm1
maxss xmm0, xmm2
movaps xmm2, xmm0
movss xmm0, dword [ebp - 4]
movss dword [ebp - 8], xmm2
movss dword [ebp - 0x10], xmm2
test al, 2
je 0x10116711
maxss xmm1, xmm0
movaps xmm0, xmm1
movss dword [ebp - 4], xmm0
movss dword [ebp - 0xc], xmm0
call fcn.1011d1f0
mov eax, dword [edi + 0x19e4]
lea ecx, [ebp - 0x10]
xorps xmm1, xmm1
movss xmm3, dword [eax + 0xc8]
movss xmm0, dword [eax + 0xcc]
movaps xmm4, xmm3
addss xmm4, dword [ebp - 8]
movaps xmm2, xmm0
movss dword [ebp - 0x20], xmm3
addss xmm2, dword [ebp - 4]
movss dword [ebp - 0x1c], xmm0
movss dword [ebp - 0x18], xmm4
movss dword [ebp - 0x14], xmm2
call fcn.10119760
cmp dword [esi + 0x13c], 0
jne 0x10116771
cmp byte [esi + 0x145], 0
je 0x10116808
test dword [esi + 8], 0x800000
jne 0x10116808
mov edx, dword [esi + 0x54]
lea ecx, [ebp - 0x20]
push 0
call fcn.1011ce30
mov edx, dword [esi + 0x54]
lea ecx, [ebp - 0x20]
add esp, 4
push 1
call fcn.1011a5d0
add esp, 4
cmp dword [esi + 0x13c], 0
jne 0x10116817
cmp esi, dword [edi + 0x1af8]
jne 0x10116817
movss xmm2, dword [0x1017f1b4]
lea ecx, [ebp - 0x20]
movss xmm4, dword [ebp - 0x18]
movss xmm3, dword [ebp - 0x14]
addss xmm4, xmm2
movss xmm1, dword [ebp - 0x20]
addss xmm3, xmm2
movss xmm0, dword [ebp - 0x1c]
subss xmm1, xmm2
mov edx, dword [edi + 0x1afc]
subss xmm0, xmm2
push 2
movss dword [ebp - 0x18], xmm4
movss dword [ebp - 0x14], xmm3
movss dword [ebp - 0x20], xmm1
movss dword [ebp - 0x1c], xmm0
call fcn.1011a5d0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.1011ce30
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10116840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
mov edi, dword [0x101e6b78]
mov dword [ebp - 0xc], edx
mov ebx, dword [edi + 0x19e4]
movss xmm4, dword [ebx + 0xc8]
movss xmm5, dword [ebx + 0xcc]
movss xmm3, dword [ebx + 0x218]
mov esi, dword [ebx + 0x1bc]
movss xmm2, dword [ebx + 0x214]
subss xmm4, dword [ebx + 0xc]
subss xmm5, dword [ebx + 0x10]
subss xmm3, dword [ebx + 0x10]
subss xmm2, dword [ebx + 0xc]
test esi, esi
je 0x101168d6
mov edx, dword [esi + 0xc]
lea eax, [edx + 1]
test eax, eax
cmovns edx, eax
cmp edx, dword [esi + 0x2c]
jl 0x101168b1
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movss xmm2, dword [esi + 0x18]
lea ecx, [edx*8]
subss xmm2, dword [esi + 0x14]
mov eax, dword [esi + 0x34]
sub ecx, edx
mulss xmm2, dword [eax + ecx*4]
addss xmm2, dword [esi + 0x14]
subss xmm2, dword [ebx + 0x3c]
mov ecx, dword [ebp + 8]
subss xmm3, xmm5
xorps xmm5, xmm5
subss xmm2, xmm4
movss xmm4, dword [0x1017f200]
mov edx, 1
mov esi, 2
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm5
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
cmovnp ecx, edx
ucomiss xmm0, xmm5
lahf
xor edx, edx
test ah, 0x44
cmovnp edx, esi
or edx, ecx
comiss xmm5, xmm1
mov dword [ebp - 0x14], edx
jb 0x10116937
addss xmm1, xmm2
maxss xmm1, xmm4
comiss xmm5, xmm0
jb 0x10116944
addss xmm0, xmm3
maxss xmm0, xmm4
push 0
push 0x1017de4c
lea eax, [ebp - 0x114]
movss dword [edi + 0x1ab8], xmm1
push 0x100
push eax
movss dword [edi + 0x1abc], xmm0
mov dword [edi + 0x1a90], 1
call fcn.1011c480
movss xmm0, dword [edi + 0x152c]
lea ecx, [ebp - 0x114]
push 0x21010107
xor edx, edx
movss dword [ebp - 0x10], xmm0
call fcn.10112130
mov esi, dword [edi + 0x19e4]
add esp, 0x14
movss xmm0, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
movss dword [edi + 0x152c], xmm0
cmp word [esi + 0x84], 1
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x54], edx
mov dword [esi + 0x9c], eax
jne 0x101169d9
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
mov dword [ebx + 0xc8], ecx
mov dword [ebx + 0xcc], eax
cmp dword [edi + 0x1b00], edx
jne 0x10116a1a
cmp dword [esi + 0x13c], 0
jne 0x101169f3
cmp byte [esi + 0x145], 0
je 0x10116a1a
mov ecx, esi
call fcn.10111e20
xor dl, dl
mov ecx, esi
call fcn.1010f080
mov ecx, dword [ebp - 0xc]
mov edx, esi
lea ecx, [ecx + 1]
call fcn.10119ac0
mov dword [edi + 0x1a34], 2
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10116eb0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
xor ecx, ecx
push esi
push edi
mov edi, dword [0x101e6b78]
mov eax, dword [edi + 0x1a48]
test eax, eax
je 0x10116ee7
test dword [eax + 8], 0x200
cmove ecx, eax
cmp byte [edi + 0xaf], 0
movss xmm1, dword [edi + 0x155c]
movss xmm7, dword [edi + 0x1558]
movaps xmm6, xmm1
movss dword [ebp - 4], xmm1
movaps xmm5, xmm7
je 0x10116f1b
maxss xmm5, dword [0x1017f200]
maxss xmm6, dword [0x1017f200]
mov eax, dword [edi + 0x19a4]
lea edx, [eax - 1]
test edx, edx
js 0x10116fe8
nop dword [eax]
cmp edx, eax
jge 0x10117007
mov eax, dword [edi + 0x19ac]
mov eax, dword [eax + edx*4]
cmp byte [eax + 0x7a], 0
je 0x10116fd9
cmp byte [eax + 0x81], 0
jne 0x10116fd9
mov esi, dword [eax + 8]
test esi, 0x200
jne 0x10116fd9
movups xmm0, xmmword [eax + 0x1dc]
movups xmmword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0x20]
movss xmm3, dword [ebp - 0x1c]
test esi, 0x1000002
jne 0x10116f90
subss xmm0, xmm5
movaps xmm2, xmm5
subss xmm3, xmm6
movaps xmm1, xmm6
jmp 0x10116f9b
subss xmm0, xmm7
movaps xmm2, xmm7
subss xmm3, xmm1
movss xmm4, dword [edi + 0xe0]
comiss xmm4, xmm0
addss xmm1, dword [ebp - 0x14]
addss xmm2, dword [ebp - 0x18]
jb 0x10116fd4
movss xmm0, dword [edi + 0xe4]
comiss xmm0, xmm3
jb 0x10116fd4
comiss xmm2, xmm4
jbe 0x10116fd4
comiss xmm1, xmm0
jbe 0x10116fd4
test ecx, ecx
cmovne eax, ecx
mov ecx, eax
test ecx, ecx
jne 0x10116fe8
movss xmm1, dword [ebp - 4]
sub edx, 1
mov eax, dword [edi + 0x19a4]
jns 0x10116f30
mov dword [edi + 0x19e8], ecx
test ecx, ecx
je 0x1011700f
mov eax, dword [ecx + 0x2f0]
mov dword [edi + 0x19ec], eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor eax, eax
mov dword [edi + 0x19ec], eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10117790
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x101e6b78]
push esi
mov eax, dword [ecx + 0x19e4]
mov byte [eax + 0x7c], 1
mov esi, dword [ecx + 0x19e4]
mov ecx, dword [esi + 0x274]
mov eax, dword [ecx + 0x3c]
test eax, eax
jle 0x10117805
dec eax
mov dword [ecx + 0x3c], eax
call fcn.10121f20
mov eax, dword [esi + 0x274]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
jle 0x10117805
mov eax, dword [eax + 0x44]
add ecx, ecx
movss xmm0, dword [eax + ecx*8 - 0xc]
movss xmm1, dword [eax + ecx*8 - 8]
movss xmm2, dword [eax + ecx*8 - 4]
mov eax, dword [eax + ecx*8 - 0x10]
mov dword [esi + 0x1cc], eax
movss dword [esi + 0x1d0], xmm0
movss dword [esi + 0x1d4], xmm1
movss dword [esi + 0x1d8], xmm2
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10117810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x101e6b78]
mov eax, dword [esi + 0x19e4]
mov byte [eax + 0x7c], 1
push dword [edx + 4]
mov esi, dword [esi + 0x19e4]
push dword [edx]
push dword [ecx + 4]
push dword [ecx]
mov ecx, dword [esi + 0x274]
push dword [ebp + 8]
call fcn.1012bca0
mov eax, dword [esi + 0x274]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
jg 0x10117857
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [eax + 0x44]
add ecx, ecx
movss xmm0, dword [eax + ecx*8 - 0xc]
movss xmm1, dword [eax + ecx*8 - 8]
movss xmm2, dword [eax + ecx*8 - 4]
mov eax, dword [eax + ecx*8 - 0x10]
mov dword [esi + 0x1cc], eax
movss dword [esi + 0x1d0], xmm0
movss dword [esi + 0x1d4], xmm1
movss dword [esi + 0x1d8], xmm2
pop esi
pop ebp
ret

Function at 0x10117a90
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x10117b31
jle 0x10117b34
mov eax, dword [esi + 8]
mov edx, ecx
shl edx, 5
cmp dword [edx + eax - 0x20], 0
jne 0x10117ac5
cmp dword [edx + eax - 8], 0
jne 0x10117ac5
lea eax, [ecx - 1]
mov dword [esi], eax
test eax, eax
je 0x10117b31
mov edx, dword [esi + 0x18]
test edx, edx
je 0x10117ada
mov eax, dword [esi + 0x20]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4]
cmp dword [esi + 0x34], eax
jne 0x10117b34
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10117aec
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
cmp dword [esi + 0x38], eax
jne 0x10117b34
mov eax, dword [esi + 0x30]
cmp eax, edx
jne 0x10117b34
cmp eax, 0x10000
jae 0x10117b34
mov ecx, dword [edi + 4]
push ebx
mov ebx, dword [edi]
cmp ebx, ecx
jne 0x10117b26
inc ebx
test ecx, ecx
je 0x10117b14
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10117b19
mov eax, 8
cmp eax, ebx
mov ecx, edi
cmovg ebx, eax
push ebx
call fcn.1003c7c0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
pop ebx
mov dword [eax + ecx*4], esi
inc dword [edi]
pop edi
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10117b40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
cmp ecx, esi
jne 0x10117b76
inc ecx
test esi, esi
je 0x10117b64
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10117b69
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, ebx
call fcn.1003c7c0
mov ecx, dword [ebx]
mov eax, dword [ebx + 8]
mov dword [eax + ecx*4], edi
inc dword [ebx]
cmp byte [edi + 0x7a], 0
je 0x10117bd9
mov eax, dword [edi + 0x150]
mov dword [ebp - 4], eax
cmp eax, 1
jle 0x10117baf
push 0x10117bf0
push 4
push eax
push dword [edi + 0x158]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
add esp, 0x10
xor esi, esi
jmp 0x10117bb5
xor esi, esi
test eax, eax
jle 0x10117bd9
cmp esi, dword [edi + 0x150]
jge 0x10117be0
mov eax, dword [edi + 0x158]
mov edx, dword [eax + esi*4]
cmp byte [edx + 0x7a], 0
je 0x10117bd3
mov ecx, ebx
call fcn.10117b40
inc esi
cmp esi, dword [ebp - 4]
jl 0x10117bb5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10117c50
Capabilities:
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10117da6
cmp byte [edi + 0x2c94], 0
jne 0x10117da6
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x1017de21
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x10117c9e
cmp byte [esi], al
jne 0x10117c9e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x101752a0]
test al, al
jne 0x10117c90
mov esi, dword [edi + 0x2ca8]
not edx
mov ecx, dword [edi + 0x2cac]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x1010b370
mov dword [ebp - 0xc], 0x1010b2a0
mov dword [ebp - 8], 0x1010b0a0
cmp esi, ecx
jne 0x10117d74
inc esi
test ecx, ecx
je 0x10117cf5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10117cfa
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10117d74
mov eax, dword [0x101e6b78]
test eax, eax
je 0x10117d12
inc dword [eax + 0x36c]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2cb0]
test eax, eax
je 0x10117d68
mov ecx, dword [edi + 0x2ca8]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2cb0]
add esp, 0xc
test ecx, ecx
je 0x10117d5e
mov eax, dword [0x101e6b78]
test eax, eax
je 0x10117d5e
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi + 0x2cb0], ebx
mov dword [edi + 0x2cac], esi
mov eax, dword [edi + 0x2ca8]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2cb0]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2ca8]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x101192f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movss xmm4, dword [ebp + 0xc]
movaps xmm6, xmm1
movss xmm1, dword [ebp + 8]
xorps xmm5, xmm5
comiss xmm5, xmm1
push ebx
push esi
mov ebx, ecx
push edi
movaps xmm7, xmm2
xorps xmm3, xmm3
xorps xmm2, xmm2
ja 0x10119326
comiss xmm5, xmm4
ja 0x10119326
mov ecx, dword [0x101e6b78]
jmp 0x101193a9
mov ecx, dword [0x101e6b78]
mov edi, dword [ecx + 0x19e4]
movss xmm3, dword [edi + 0x218]
mov esi, dword [edi + 0x1bc]
movss xmm2, dword [edi + 0x214]
subss xmm3, dword [edi + 0x10]
subss xmm2, dword [edi + 0xc]
test esi, esi
je 0x10119399
mov edx, dword [esi + 0xc]
lea eax, [edx + 1]
test eax, eax
cmovns edx, eax
cmp edx, dword [esi + 0x2c]
jl 0x1011936e
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movss xmm2, dword [esi + 0x18]
lea ecx, [edx*8]
subss xmm2, dword [esi + 0x14]
mov eax, dword [esi + 0x34]
sub ecx, edx
mulss xmm2, dword [eax + ecx*4]
mov ecx, dword [0x101e6b78]
addss xmm2, dword [esi + 0x14]
subss xmm2, dword [edi + 0x3c]
mov eax, dword [ecx + 0x19e4]
addss xmm2, dword [eax + 0xc]
addss xmm3, dword [eax + 0x10]
comiss xmm5, xmm1
movss xmm0, dword [0x1017f200]
jb 0x101193df
ucomiss xmm1, xmm5
lahf
test ah, 0x44
jp 0x101193c4
movaps xmm1, xmm6
jmp 0x101193da
mov eax, dword [ecx + 0x19e4]
subss xmm2, dword [eax + 0xc8]
maxss xmm2, xmm0
addss xmm1, xmm2
movss dword [ebp + 8], xmm1
comiss xmm5, xmm4
jb 0x10119416
ucomiss xmm4, xmm5
lahf
test ah, 0x44
jp 0x10119400
movaps xmm4, xmm7
movss dword [ebx], xmm1
movss dword [ebx + 4], xmm4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ecx + 0x19e4]
subss xmm3, dword [eax + 0xcc]
maxss xmm3, xmm0
addss xmm4, xmm3
pop edi
pop esi
movss dword [ebx], xmm1
mov eax, ebx
movss dword [ebx + 4], xmm4
pop ebx
pop ebp
ret

Function at 0x101199f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101e6b78]
sub esp, 0x10
push esi
test ecx, ecx
jne 0x10119a07
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [edx + 0x134]
cmp dword [eax + 0x1af8], edx
je 0x10119a1c
mov byte [eax + 0x1b5d], 0
mov dword [eax + 0x1afc], ecx
mov dword [eax + 0x1af8], edx
mov dword [eax + 0x1b50], esi
mov dword [edx + esi*4 + 0x300], ecx
cmp dword [edx + 0x10c], ecx
jne 0x10119a93
movss xmm0, dword [edx + 0x118]
add esi, esi
movss xmm4, dword [edx + 0x11c]
movss xmm3, dword [edx + 0x120]
movss xmm1, dword [edx + 0x114]
subss xmm0, dword [edx + 0x10]
subss xmm4, dword [edx + 0xc]
subss xmm3, dword [edx + 0x10]
subss xmm1, dword [edx + 0xc]
movss dword [ebp - 0xc], xmm0
movss dword [ebp - 8], xmm4
movss dword [ebp - 4], xmm3
movss dword [ebp - 0x10], xmm1
movups xmm0, xmmword [ebp - 0x10]
movups xmmword [edx + esi*8 + 0x308], xmm0
cmp dword [eax + 0x1a34], 2
jne 0x10119aa8
mov byte [eax + 0x1b5b], 1
pop esi
mov esp, ebp
pop ebp
ret
mov byte [eax + 0x1b5a], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10119b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x101e6b78]
mov eax, dword [esi + 0x1af8]
test eax, eax
je 0x10119bc3
test edx, edx
je 0x10119b8d
cmp edx, 1
jne 0x10119bc3
mov dword [esi + 0x1afc], ecx
mov dword [eax + edx*4 + 0x300], ecx
add edx, edx
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x1af8]
movups xmm0, xmmword [eax]
movups xmmword [ecx + edx*8 + 0x308], xmm0
mov word [esi + 0x1b59], 1
mov byte [esi + 0x1b5b], 1
pop esi
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10119c40
Capabilities:
Encode data using xor
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, ecx
push esi
mov esi, dword [edx + 0x1c0]
test esi, esi
jg 0x10119c5b
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp + 8]
push edi
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [edx + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [edx + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [edx + 0x10]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [edx + 0x1c8]
mov edx, dword [eax + esi*4 - 4]
lea esi, [ebp - 0x10]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x101752a0]
sub edi, 1
jne 0x10119cb6
mov eax, dword [0x101e6b78]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a04], edx
jne 0x10119ce7
mov dword [eax + 0x1a0c], edx
cmp dword [eax + 0x1a08], edx
jne 0x10119cf6
mov byte [eax + 0x1a19], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4

Function at 0x10119d00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x1c0]
test edx, edx
jg 0x10119d15
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ecx + 0x1c8]
mov ecx, dword [ebp + 8]
push dword [eax + edx*4 - 4]
xor edx, edx
call fcn.1011c390
add esp, 4
pop ebp
ret 8

Function at 0x10119d30
Capabilities:
Encode data using xor
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x1c0]
test edx, edx
jg 0x10119d45
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ecx + 0x1c8]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101752a0]
sub edi, 1
jne 0x10119d60
mov ecx, dword [0x101e6b78]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a04], eax
jne 0x10119d92
mov dword [ecx + 0x1a0c], eax
cmp dword [ecx + 0x1a08], eax
jne 0x10119da1
mov byte [ecx + 0x1a19], 1
pop ebp
ret 4