joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005fc10
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov eax, dword [0x1025ad40]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x3c]
lea edx, [ecx - 1]
shl edx, 4
add edx, dword [esi + 0x44]
add eax, 0x14
cmp ecx, 1
cmovae eax, edx
movdqu xmm0, xmmword [eax]
movdqu xmmword [esp + 8], xmm0
mov ebx, dword [esi]
test ebx, ebx
jle 0x1005fc8c
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1005fc8c
lea edi, [ebx - 1]
mov dword [esp + 4], edi
shl edi, 5
lea edx, [ecx + edi]
mov ebp, dword [edx]
mov dword [esp], ebp
test ebp, ebp
je 0x1005fc85
movdqu xmm0, xmmword [ecx + edi + 4]
movdqu xmm1, xmmword [esp + 8]
pcmpeqb xmm1, xmm0
pmovmskb ebp, xmm1
cmp ebp, 0xffff
jne 0x1005fc8c
cmp dword [ecx + edi + 0x18], 0
je 0x1005fca5
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10157981
mov ecx, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1005fb10
add edx, 0xffffffe0
xor ebp, ebp
cmp ebx, 2
cmovae ebp, edx
cmp dword [esp], 0
jne 0x1005fcfb
cmp ebx, 2
jb 0x1005fcfb
movdqu xmm0, xmmword [ebp + 4]
movdqu xmm1, xmmword [esp + 8]
pcmpeqb xmm1, xmm0
pmovmskb edx, xmm1
cmp edx, 0xffff
jne 0x1005fcfb
mov edx, dword [ebp + 0x14]
mov ebx, dword [esi + 0x48]
test ebx, ebx
je 0x1005fcef
mov dword [esp], ebp
mov ebp, dword [esi + 0x50]
mov ebx, dword [ebp + ebx*4 - 4]
mov ebp, dword [esp]
jmp 0x1005fcf1
xor ebx, ebx
cmp edx, ebx
jne 0x1005fcfb
cmp dword [ebp + 0x18], 0
je 0x1005fd18
movdqu xmm0, xmmword [eax]
movdqu xmmword [ecx + edi + 4], xmm0
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10157981
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
mov dword [esi], eax
jmp 0x1005fd05
Function at 0x1005fd20
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x3c]
lea edx, [ecx - 1]
shl edx, 4
add edx, dword [esi + 0x44]
add eax, 0x14
cmp ecx, 1
cmovae eax, edx
movups xmm2, xmmword [eax]
mov eax, dword [esi + 0x48]
test eax, eax
je 0x1005fb44
mov ecx, dword [esi + 0x50]
mov ebx, dword [ecx + eax*4 - 4]
jmp 0x1005fb46
xor ebx, ebx
movaps xmm0, xmm2
unpckhpd xmm0, xmm2
ucomiss xmm0, xmm2
jb 0x1005fc08
movaps xmm0, xmm2
shufps xmm0, xmm2, 0x55
movaps xmm1, xmm2
shufps xmm1, xmm2, 0xff
ucomiss xmm1, xmm0
jb 0x1005fc08
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jne 0x1005fbd8
lea ebp, [eax + 1]
test eax, eax
je 0x1005fb88
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x1005fb8d
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x1005fbd8
movups xmmword [esp], xmm2
mov eax, ebp
shl eax, 5
push eax
call fcn.100485a0
add esp, 4
mov edi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1005fbcc
mov ecx, dword [esi]
shl ecx, 5
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esi + 8]
call fcn.100485d0
add esp, 4
mov dword [esi + 8], edi
mov dword [esi + 4], ebp
mov eax, dword [esi]
movups xmm2, xmmword [esp]
mov ecx, dword [esi + 8]
shl eax, 5
mov dword [ecx + eax], 0
movups xmmword [ecx + eax + 4], xmm2
mov dword [ecx + eax + 0x14], ebx
mov dword [ecx + eax + 0x1c], 0
mov dword [ecx + eax + 0x18], 0
inc dword [esi]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ecx + 0x48]
test eax, eax
je 0x1005fd37
mov edx, dword [ecx + 0x50]
mov eax, dword [edx + eax*4 - 4]
jmp 0x1005fd39
xor eax, eax
mov ebx, dword [ecx]
test ebx, ebx
je 0x1005fd6c
jle 0x1005fdf8
mov edx, dword [ecx + 8]
test edx, edx
je 0x1005fd6c
lea edi, [ebx - 1]
mov dword [esp + 8], edi
shl edi, 5
lea esi, [edx + edi]
mov ebp, dword [esi]
test ebp, ebp
je 0x1005fd65
cmp dword [edx + edi + 0x14], eax
jne 0x1005fd6c
cmp dword [edx + edi + 0x18], 0
je 0x1005fd78
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1005fb10
add esi, 0xffffffe0
mov dword [esp], 0
cmp ebx, 2
mov dword [esp + 4], eax
mov eax, dword [esp]
cmovae eax, esi
mov dword [esp], eax
mov eax, dword [esp + 4]
mov esi, dword [esp]
test ebp, ebp
jne 0x1005fde4
cmp ebx, 2
jb 0x1005fde4
cmp dword [esi + 0x14], eax
jne 0x1005fde4
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x3c]
lea ebp, [ebx - 1]
shl ebp, 4
add ebp, dword [ecx + 0x44]
add esi, 0x14
cmp ebx, 1
cmovae esi, ebp
mov ebx, dword [esp]
movdqu xmm0, xmmword [ebx + 4]
movdqu xmm1, xmmword [esi]
pcmpeqb xmm1, xmm0
pmovmskb esi, xmm1
cmp esi, 0xffff
mov esi, dword [esp]
jne 0x1005fde4
cmp dword [esi + 0x18], 0
je 0x1005fdf0
mov dword [edx + edi + 0x14], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 8]
mov dword [ecx], eax
jmp 0x1005fde8
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
Function at 0x1005ff50
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 0x3c]
test eax, eax
jle 0x1005ff60
dec eax
mov dword [ecx + 0x3c], eax
jmp fcn.1005fc10
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10060000
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 0x48]
test eax, eax
jle 0x10060010
dec eax
mov dword [ecx + 0x48], eax
jmp fcn.1005fd20
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100624d0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x1025ad40]
xor eax, esp
mov dword [esp + 0x38], eax
cmp dword [esp + 0x5c], 0x1000000
jb 0x10062606
mov esi, ecx
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x60]
test eax, eax
je 0x10062507
cmp eax, edi
jne 0x10062519
jmp 0x10062606
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, edi
cmp eax, edi
je 0x10062606
movss xmm0, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
test ecx, ecx
jne 0x1006252d
mov ecx, dword [esi + 0x28]
mov ecx, dword [ecx + 8]
xorps xmm1, xmm1
ucomiss xmm0, xmm1
jne 0x1006253f
jp 0x1006253f
mov edx, dword [esi + 0x28]
movss xmm0, dword [edx + 0xc]
mov edx, dword [esi + 0x48]
test edx, edx
jle 0x1006261b
mov ebx, dword [ecx + 0x38]
mov ebx, dword [ebx + 8]
mov ebp, dword [esi + 0x50]
cmp ebx, dword [ebp + edx*4 - 4]
jne 0x1006261b
mov ebx, dword [esi + 0x3c]
test ebx, ebx
jle 0x1006261b
mov ebp, dword [esp + 0x6c]
movss xmm1, dword [esp + 0x68]
mov edx, dword [esp + 0x58]
mov edi, dword [esi + 0x44]
shl ebx, 4
movups xmm2, xmmword [ebx + edi - 0x10]
movups xmmword [esp + 0x28], xmm2
test ebp, ebp
je 0x100625b3
movups xmm2, xmmword [ebp]
movups xmm3, xmmword [esp + 0x28]
movaps xmm4, xmm2
cmpleps xmm4, xmm3
movaps xmm5, xmm3
cmpltps xmm5, xmm2
movsd xmm5, xmm4
andps xmm3, xmm5
andnps xmm5, xmm2
orps xmm5, xmm3
movups xmmword [esp + 0x28], xmm5
xor ebx, ebx
test ebp, ebp
setne bl
movss xmm2, dword [edx]
movss xmm3, dword [edx + 4]
mov dword [esp + 0x24], ebx
movss dword [esp + 0x20], xmm1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
movss dword [esp + 0xc], xmm3
movss dword [esp + 8], xmm2
movss dword [esp + 4], xmm0
mov dword [esp], esi
call fcn.10062630
sub esp, 0x28
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10157981
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
mov dword [esp], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100632c0
Capabilities:
Terminate process

Disassembly:
push esi
cmp byte [ecx], 0
jne 0x100632f8
mov esi, ecx
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x100632d8
push eax
call fcn.100485d0
add esp, 4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100632e8
push eax
call fcn.100485d0
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
Function at 0x10063b30
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x78
mov eax, dword [0x1025ad40]
xor eax, esp
mov dword [esp + 0x74], eax
cmp byte [ecx], 0
jne 0x10063b99
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x10063ba1
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esp], xmm0
mov edx, dword [eax + 0x70]
mov dword [esp + 0x70], edx
movups xmm0, xmmword [eax + 0x60]
movups xmmword [esp + 0x60], xmm0
movups xmm0, xmmword [eax + 0x50]
movups xmmword [esp + 0x50], xmm0
movups xmm0, xmmword [eax + 0x40]
movups xmmword [esp + 0x40], xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [esp + 0x30], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm1
cmp dword [esp], 0
je 0x10063c07
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov byte [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 1
mov byte [esp + 0x1c], 0
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0x7f7fffff
mov byte [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x3f800000
movups xmmword [esp + 0x48], xmm0
movups xmmword [esp + 0x58], xmm0
movups xmmword [esp + 0x64], xmm0
mov eax, dword [esp + 0x90]
movss xmm0, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
mov dword [esp], esi
mov dword [esp + 4], edx
movss dword [esp + 0x10], xmm0
test eax, eax
je 0x10063c3a
mov dword [esp + 0x30], eax
mov eax, esp
push eax
call fcn.10063720
mov esi, eax
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10157981
mov eax, esi
add esp, 0x78
pop esi
ret 0x14
Function at 0x100647d0
Capabilities:
Terminate process

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
cmp eax, 7
ja 0x100648b3
test byte [ecx + 4], 2
jne 0x100648b3
mov edi, dword [ecx + 0x58]
cmp edi, 0xffffffff
je 0x100648ba
cmp dword [ecx + 0x40], edi
jle 0x100648ba
mov edx, dword [ecx + 0x48]
lea esi, [edi + edi*8]
lea esi, [esi + esi*2]
add esi, edi
cmp dword [edx + esi], 0x80000000
jne 0x100648ba
movd xmm2, dword [edx + esi + 8]
shl eax, 3
movsd xmm0, qword [eax + eax*2 + 0x101aa018]
movq xmm3, qword [eax + eax*2 + 0x101aa020]
movsd xmm1, qword [eax + eax*2 + 0x101aa010]
mov eax, dword [esp + 0x14]
movsd qword [eax], xmm0
mov eax, dword [esp + 0x10]
movq qword [eax], xmm3
mov eax, dword [esp + 0x18]
pxor xmm3, xmm3
punpcklwd xmm2, xmm3
cvtdq2ps xmm2, xmm2
addps xmm1, xmm2
movsd xmm2, qword [ecx + 0x24]
mulps xmm2, xmm1
movlps qword [eax], xmm2
movaps xmm2, xmm0
addps xmm2, xmm1
movsd xmm3, qword [ecx + 0x24]
mulps xmm3, xmm2
movlps qword [eax + 8], xmm3
mov eax, dword [esp + 0x1c]
movss xmm3, dword [0x101b0230]
movaps xmm4, xmm1
movsd xmm5, qword [ecx + 0x24]
addss xmm1, xmm3
mulps xmm1, xmm5
movlps qword [eax], xmm1
movsd xmm1, qword [ecx + 0x24]
addss xmm4, xmm3
addss xmm4, xmm0
movss xmm2, xmm4
mulps xmm2, xmm1
movlps qword [eax + 8], xmm2
mov al, 1
jmp 0x100648b5
xor eax, eax
pop esi
pop edi
ret 0x14
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10068e70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x50
mov eax, dword [esp + 0x54]
movss xmm0, dword [esp + 0x58]
shufps xmm0, xmm0, 0
movups xmmword [esp + 0x40], xmm0
movdqa xmm0, xmmword [0x101b0270]
movdqa xmm7, xmmword [str._b_t_n_v]
movdqa xmm1, xmmword [0x101b0290]
movaps xmm5, xmmword [0x101b02a0]
xor ecx, ecx
nop word [eax + eax]
movups xmmword [esp + 0x30], xmm5
movdqu xmmword [esp], xmm1
movdqu xmmword [esp + 0x10], xmm7
movdqu xmmword [esp + 0x20], xmm0
movups xmm1, xmmword [esp]
movaps xmm0, xmmword [0x101b02b0]
andps xmm1, xmm0
movaps xmm3, xmmword [0x101b02c0]
orps xmm1, xmm3
movdqu xmm6, xmmword [esp]
psrld xmm6, 0x10
movdqa xmm4, xmmword [0x101b02d0]
por xmm6, xmm4
movaps xmm2, xmmword [0x101b02e0]
subps xmm6, xmm2
movaps xmm7, xmm2
addps xmm6, xmm1
movaps xmm1, xmm5
andps xmm1, xmm0
orps xmm1, xmm3
movdqu xmm5, xmmword [esp + 0x30]
psrld xmm5, 0x10
por xmm5, xmm4
subps xmm5, xmm2
addps xmm5, xmm1
movups xmm2, xmmword [esp + 0x20]
andps xmm2, xmm0
orps xmm2, xmm3
movdqu xmm1, xmmword [esp + 0x20]
psrld xmm1, 0x10
por xmm1, xmm4
subps xmm1, xmm7
addps xmm1, xmm2
movups xmm7, xmmword [esp + 0x10]
andps xmm7, xmm0
orps xmm7, xmm3
movdqu xmm2, xmmword [esp + 0x10]
psrld xmm2, 0x10
por xmm2, xmm4
subps xmm2, xmmword [0x101b02e0]
addps xmm2, xmm7
movups xmm0, xmmword [esp + 0x40]
mulps xmm2, xmm0
mulps xmm1, xmm0
mulps xmm5, xmm0
mulps xmm6, xmm0
cvttps2dq xmm0, xmm6
movdqa xmm7, xmm0
psrad xmm7, 0x1f
movaps xmm4, xmmword [0x101b02f0]
subps xmm6, xmm4
cvttps2dq xmm6, xmm6
pand xmm6, xmm7
por xmm6, xmm0
cvttps2dq xmm0, xmm5
movdqa xmm7, xmm0
psrad xmm7, 0x1f
subps xmm5, xmm4
cvttps2dq xmm5, xmm5
pand xmm5, xmm7
por xmm5, xmm0
cvttps2dq xmm3, xmm1
movdqa xmm0, xmm3
psrad xmm0, 0x1f
subps xmm1, xmm4
cvttps2dq xmm7, xmm1
pand xmm7, xmm0
por xmm7, xmm3
cvttps2dq xmm0, xmm2
movdqa xmm1, xmm0
psrad xmm1, 0x1f
subps xmm2, xmm4
cvttps2dq xmm2, xmm2
pand xmm2, xmm1
por xmm2, xmm0
movdqa xmm0, xmm2
movdqa xmm3, xmmword [0x101a97e0]
pxor xmm0, xmm3
movdqa xmm4, xmmword [0x101b0300]
movdqa xmm1, xmm4
pcmpgtd xmm1, xmm0
pand xmm2, xmm1
movdqa xmm0, xmmword [0x101b0310]
pandn xmm1, xmm0
por xmm1, xmm2
movdqa xmm0, xmm7
pxor xmm0, xmm3
movdqa xmm2, xmm4
pcmpgtd xmm2, xmm0
pand xmm7, xmm2
pandn xmm2, xmmword [0x101b0310]
por xmm2, xmm7
movdqu xmm7, xmmword [esp + 0x10]
packuswb xmm1, xmm2
movdqa xmm0, xmm5
pxor xmm0, xmm3
movdqa xmm2, xmm4
pcmpgtd xmm2, xmm0
pand xmm5, xmm2
movdqa xmm0, xmmword [0x101b0310]
pandn xmm2, xmm0
por xmm2, xmm5
movdqu xmm5, xmmword [esp + 0x30]
movdqa xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm4
pcmpgtd xmm3, xmm0
pand xmm6, xmm3
pandn xmm3, xmmword [0x101b0310]
por xmm3, xmm6
packuswb xmm2, xmm3
packuswb xmm2, xmm1
movdqu xmm1, xmmword [esp]
movdqu xmmword [eax + ecx], xmm2
movdqu xmm0, xmmword [esp + 0x20]
add ecx, 0x10
movdqa xmm2, xmmword [0x101b0320]
paddd xmm5, xmm2
paddd xmm1, xmm2
paddd xmm7, xmm2
paddd xmm0, xmm2
cmp ecx, 0x100
jne 0x10068eb0
add esp, 0x50
ret
Function at 0x10069730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1006ebd0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x1006990e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
test ecx, ecx
jle 0x1006990e
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
cmp ecx, 9
mov eax, 8
cmovge eax, ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], eax
shl eax, 4
mov dword [ebp - 0x10], 1
push eax
mov dword [ebp - 0x2c], ecx
call fcn.100485a0
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edi
mov ecx, edi
shl ecx, 4
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x40], 0
jle 0x10069832
xor eax, eax
xor ecx, ecx
xor edx, edx
nop dword [eax]
cmp dword [ebp - 0x28], edx
jle 0x1006990e
mov esi, dword [ebx + 0x48]
movzx esi, word [esi + ecx + 4]
mov edi, dword [ebp - 0x20]
mov word [edi + eax + 4], si
cmp dword [ebx + 0x40], edx
jle 0x1006990e
cmp dword [ebp - 0x28], edx
jle 0x1006990e
mov esi, dword [ebx + 0x48]
movzx esi, word [esi + ecx + 6]
mov edi, dword [ebp - 0x20]
mov word [edi + eax + 6], si
inc edx
add ecx, 0x1c
add eax, 0x10
cmp edx, dword [ebx + 0x40]
jl 0x100697e0
mov edi, dword [ebp - 0x28]
test edi, edi
jle 0x1006990e
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, esi
push edi
call fcn.10069950
add esp, 4
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x1006985f
inc edx
add ecx, 0x10
add eax, 0x1c
cmp edx, edi
jge 0x100698ed
cmp dword [esi + ecx + 0xc], 0
je 0x10069850
cmp dword [ebx + 0x40], edx
jle 0x1006990e
movzx esi, word [esi + ecx + 8]
mov edi, dword [ebx + 0x48]
mov word [edi + eax + 8], si
cmp dword [ebp - 0x28], edx
jle 0x1006990e
cmp dword [ebx + 0x40], edx
jle 0x1006990e
mov esi, dword [ebp - 0x20]
movzx esi, word [esi + ecx + 0xa]
mov edi, dword [ebx + 0x48]
mov word [edi + eax + 0xa], si
mov esi, dword [ebp - 0x28]
cmp esi, edx
jle 0x1006990e
mov dword [ebp - 0x2c], esi
cmp dword [ebx + 0x40], edx
jle 0x1006990e
mov esi, dword [ebp - 0x20]
movzx edi, word [esi + ecx + 4]
mov ebx, dword [ebx + 0x48]
cmp di, word [ebx + eax + 4]
jne 0x1006990e
movzx edi, word [esi + ecx + 6]
cmp di, word [ebx + eax + 6]
jne 0x1006990e
movzx ebx, word [esi + ecx + 0xa]
add ebx, edi
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x20]
cmp edi, ebx
cmovg ebx, edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x20], ebx
mov ebx, edi
mov edi, dword [ebp - 0x2c]
jmp 0x10069850
mov dword [ebp - 0x10], 0
push esi
call fcn.100485d0
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop word cs:[eax + eax]
push ebp
sub esp, 0xc
add ebp, 0xc
lea ecx, [ebp - 0x28]
call fcn.1005f200
add esp, 0xc
pop ebp
ret
Function at 0x1006a0d0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov ebx, dword [ecx + 0x20]
mov eax, dword [ecx + 0x24]
lea ebp, [ebx + 1]
cmp eax, ebx
jg 0x1006a14a
test eax, eax
je 0x1006a0f5
mov edi, eax
shr edi, 0x1f
add edi, eax
sar edi, 1
add edi, eax
jmp 0x1006a0fa
mov edi, 8
cmp edi, ebp
cmovle edi, ebp
cmp eax, edi
jge 0x1006a14a
lea eax, [edi*8]
lea eax, [eax + eax*4]
push eax
call fcn.100485a0
add esp, 4
mov edx, dword [esi + 0x28]
test edx, edx
je 0x1006a144
mov ecx, dword [esi + 0x20]
shl ecx, 3
lea ecx, [ecx + ecx*4]
push ecx
push edx
push eax
mov dword [esp + 0xc], eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esi + 0x28]
call fcn.100485d0
mov eax, dword [esp + 4]
add esp, 4
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], ebp
test ebx, ebx
js 0x1006a252
movss xmm0, dword [esp + 0x1c]
movzx eax, word [esp + 0x18]
mov ecx, dword [esi + 0x28]
lea edx, [ebx + ebx*4]
mov word [ecx + edx*8], ax
movss dword [ecx + edx*8 + 8], xmm0
movss xmm0, dword [esp + 0x20]
movss dword [ecx + edx*8 + 0xc], xmm0
movss xmm0, dword [esp + 0x24]
movss dword [ecx + edx*8 + 0x10], xmm0
movss xmm0, dword [esp + 0x28]
movss dword [ecx + edx*8 + 0x14], xmm0
movss xmm0, dword [esp + 0x2c]
movss dword [ecx + edx*8 + 0x18], xmm0
movss xmm0, dword [esp + 0x30]
movss dword [ecx + edx*8 + 0x1c], xmm0
movss xmm0, dword [esp + 0x34]
movss dword [ecx + edx*8 + 0x20], xmm0
movss xmm0, dword [esp + 0x38]
movss dword [ecx + edx*8 + 0x24], xmm0
movss xmm0, dword [esp + 0x3c]
lea eax, [ecx + edx*8 + 0x18]
mov edi, dword [esi + 0x3c]
addss xmm0, dword [edi + 0x20]
movss dword [ecx + edx*8 + 4], xmm0
mov edi, dword [esi + 0x3c]
cmp byte [edi + 0x1c], 0
je 0x1006a1fe
addss xmm0, dword [0x101a82c0]
lea ecx, [ecx + edx*8]
add ecx, 4
cvttps2dq xmm0, xmm0
cvtdq2ps xmm0, xmm0
movss dword [ecx], xmm0
mov byte [esi + 0x54], 1
movss xmm0, dword [eax + 8]
subss xmm0, dword [eax]
mov ecx, dword [esi + 0x38]
cvtsi2ss xmm1, dword [ecx + 0x1c]
mulss xmm1, xmm0
movss xmm0, dword [0x101b0350]
addss xmm1, xmm0
cvttss2si edx, xmm1
movss xmm1, dword [eax + 0xc]
subss xmm1, dword [eax + 4]
cvtsi2ss xmm2, dword [ecx + 0x20]
mulss xmm2, xmm1
addss xmm2, xmm0
cvttss2si eax, xmm2
imul eax, edx
add dword [esi + 0x50], eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x28
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1006a900
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov eax, dword [0x1025ad40]
xor eax, esp
mov dword [esp + 8], eax
lea ebp, [esp + 4]
jmp 0x1006a932
add ebx, eax
test edi, edi
je 0x1006a950
xor eax, eax
cmp ebx, edi
setb al
test eax, eax
jne 0x1006a957
jmp 0x1006a9a0
movsx eax, byte [ebx]
test eax, eax
je 0x1006a9a0
mov dword [esp + 4], 0
push edi
push ebx
push ebp
call fcn.10048350
add esp, 0xc
test eax, eax
je 0x1006a9a0
mov ecx, dword [esp + 4]
cmp ecx, 0xffff
ja 0x1006a930
mov dword [esp], ebx
mov edx, ecx
shr edx, 5
cmp dword [esi], edx
jle 0x1006a9b5
mov ebx, edi
mov edi, ebp
mov ebp, 1
shl ebp, cl
mov ecx, dword [esi + 8]
or dword [ecx + edx*4], ebp
mov ebp, edi
mov edi, ebx
mov ebx, dword [esp]
jmp 0x1006a930
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.10157981
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1006a9c0
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push esi
mov eax, ecx
mov edx, dword [esp + 0x10]
movzx ecx, word [edx]
jmp 0x1006a9d7
movzx ecx, word [edx + 4]
add edx, 4
test cx, cx
je 0x1006aa08
nop dword [eax]
cmp cx, word [edx + 2]
ja 0x1006a9d0
movzx ecx, cx
mov esi, ecx
shr esi, 5
cmp dword [eax], esi
jle 0x1006aa0e
mov edi, 1
shl edi, cl
mov ebx, dword [eax + 8]
or dword [ebx + esi*4], edi
inc ecx
cmp cx, word [edx + 2]
jbe 0x1006a9e6
jmp 0x1006a9d0
pop esi
pop edi
pop ebx
ret 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1006aa20
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov dword [esp], ecx
jmp 0x1006aa51
mov esi, edi
lea edi, [esi + 1]
cmp esi, 0xffff
jge 0x1006ab91
mov eax, edi
sar eax, 5
cmp dword [ecx], eax
jle 0x1006ac0a
mov edx, dword [ecx + 8]
mov eax, dword [edx + eax*4]
bt eax, edi
jae 0x1006aa40
mov eax, dword [ebp]
cmp eax, dword [ebp + 4]
jne 0x1006aacf
lea ebx, [eax + 1]
test eax, eax
je 0x1006aa85
mov edx, eax
shr edx, 0x1f
add edx, eax
sar edx, 1
add edx, eax
jmp 0x1006aa8a
mov edx, 8
cmp edx, ebx
cmovg ebx, edx
cmp eax, ebx
jge 0x1006aacf
lea eax, [ebx + ebx]
push eax
call fcn.100485a0
add esp, 4
mov esi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1006aac3
mov ecx, dword [ebp]
add ecx, ecx
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [ebp + 8]
call fcn.100485d0
add esp, 4
mov dword [ebp + 8], esi
mov dword [ebp + 4], ebx
mov eax, dword [ebp]
mov ecx, dword [esp]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], di
mov eax, dword [ebp]
mov dword [esp + 4], eax
inc eax
mov dword [ebp], eax
mov ebx, dword [ecx]
mov edx, dword [ecx + 8]
nop word cs:[eax + eax]
mov esi, edi
cmp edi, 0x10000
je 0x1006ab12
lea edi, [esi + 1]
mov ebp, edi
sar ebp, 5
cmp ebx, ebp
jle 0x1006ac0a
mov ebp, dword [edx + ebp*4]
bt ebp, edi
jb 0x1006aaf0
mov ebp, dword [esp + 0x1c]
cmp eax, dword [ebp + 4]
jne 0x1006ab7f
mov ebx, dword [esp + 4]
add ebx, 2
test eax, eax
mov ecx, dword [esp]
je 0x1006ab36
mov edx, eax
shr edx, 0x1f
add edx, eax
sar edx, 1
add edx, eax
jmp 0x1006ab3b
mov edx, 8
cmp edx, ebx
cmovg ebx, edx
cmp eax, ebx
jge 0x1006ab82
lea eax, [ebx + ebx]
push eax
call fcn.100485a0
add esp, 4
mov edi, ebp
mov ebp, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x1006ab75
mov ecx, dword [edi]
add ecx, ecx
push ecx
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [edi + 8]
call fcn.100485d0
add esp, 4
mov dword [edi + 8], ebp
mov dword [edi + 4], ebx
mov eax, dword [edi]
mov ebp, edi
mov ecx, dword [esp]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], si
inc dword [ebp]
jmp 0x1006aa42
mov eax, dword [ebp]
cmp eax, dword [ebp + 4]
jne 0x1006abf4
lea edi, [eax + 1]
test eax, eax
je 0x1006abad
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x1006abb2
mov ecx, 8
cmp ecx, edi
cmovg edi, ecx
cmp eax, edi
jge 0x1006abf4
lea eax, [edi + edi]
push eax
call fcn.100485a0
add esp, 4
mov esi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1006abeb
mov ecx, dword [ebp]
add ecx, ecx
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [ebp + 8]
call fcn.100485d0
add esp, 4
mov dword [ebp + 8], esi
mov dword [ebp + 4], edi
mov eax, dword [ebp]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], 0
inc dword [ebp]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3