joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070c4
Capabilities:
Query environment variable

Disassembly:
dec eax
mov dword [esp + 8], ebx
dec eax
mov dword [esp + 0x10], esi
push edi
dec eax
sub esp, 0x20
mov edx, 0x2a
dec eax
mov edi, ecx
call fcn.0040cfac
dec eax
test eax, eax
jne 0x4070ea
dec eax
mov eax, edi
jmp 0x40713a
mov dl, 0x3b
dec eax
mov ecx, edi
call fcn.00406c80
dec eax
mov ecx, eax
dec eax
mov ebx, eax
call fcn.00406f64
mov dl, 0x3b
dec eax
mov ecx, ebx
call fcn.00406bbc
dec eax
mov ecx, ebx
dec eax
mov esi, eax
call fcn.00406b60
dec eax
lea ecx, [0x1434d]
call fcn.0040acf8
dec eax
test eax, eax
je 0x407137
dec eax
lea ecx, [0x15b0c]
dec esp
mov eax, esi
dec eax
mov edx, edi
call fcn.0040ab90
dec eax
mov eax, esi
dec eax
mov ebx, dword [esp + 0x30]
dec eax
mov esi, dword [esp + 0x38]
dec eax
add esp, 0x20
pop edi
ret

Function at 0x40724c
Capabilities:
Read file on windows

Disassembly:
dec eax
mov eax, esp
dec eax
mov dword [eax + 8], ebx
dec eax
mov dword [eax + 0x10], ebp
dec eax
mov dword [eax + 0x18], esi
dec eax
mov dword [eax + 0x20], edi
inc ecx
push esp
dec eax
sub esp, 0x80
dec eax
cmp dword [edx + 8], 0xffffffff
dec ecx
mov ebp, eax
dec eax
mov edi, edx
mov esi, ecx
je 0x4072c1
dec eax
cmp dword [edx], 0xffffffff
je 0x4072c1
mov edx, dword [edx + 0x10]
inc ebp
xor eax, eax
call fcn.004185c4
test eax, eax
js 0x4072c1
dec eax
mov ecx, dword [edi + 8]
dec eax
inc ecx
call fcn.0040c234
dec eax
mov ebx, eax
dec eax
test eax, eax
je 0x4072c1
dec esp
mov esp, dword [edi + 8]
dec eax
mov edx, eax
mov ecx, esi
inc ebp
mov eax, esp
call fcn.004178f4
dec eax
arpl ax, cx
dec ecx
cmp ecx, esp
je 0x4072e1
dec eax
mov ecx, ebx
call fcn.0040c3c0
xor eax, eax
dec esp
lea ebx, [esp + 0x80]
dec ecx
mov ebx, dword [ebx + 0x10]
dec ecx
mov ebp, dword [ebx + 0x18]
dec ecx
mov esi, dword [ebx + 0x20]
dec ecx
mov edi, dword [ebx + 0x28]
dec ecx
mov esp, ebx
inc ecx
pop esp
ret
cmp dword [edi + 0x14], 0
jne 0x4072fc
inc ecx
mov byte [esp + ebx], 0
dec eax
test ebp, ebp
je 0x4072f7
mov eax, dword [edi + 8]
mov dword [ebp], eax
dec eax
mov eax, ebx
jmp 0x4072c3
cmp dword [edi + 0x14], 8
jne 0x4072c1
mov eax, dword [edi + 8]
dec eax
and dword [esp + 0x50], 0
dec eax
and dword [esp + 0x58], 0
dec eax
and dword [esp + 0x60], 0
inc ecx
mov ecx, 0x58
dec esp
lea eax, [0x159b4]
dec eax
lea ecx, [esp + 0x20]
inc ecx
lea edx, [ecx - 0x67]
dec eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
call fcn.0040814c
test eax, eax
js 0x4072b9
dec eax
mov ecx, dword [edi]
dec eax
inc ecx
call fcn.0040c234
dec eax
mov esi, eax
dec eax
test eax, eax
je 0x4072b9
dec eax
mov dword [esp + 0x30], eax
mov eax, dword [edi]
dec eax
lea ecx, [esp + 0x20]
mov edx, 1
mov dword [esp + 0x38], eax
call fcn.00408334
dec eax
mov ecx, ebx
test eax, eax
jns 0x407388
call fcn.0040c3c0
dec eax
mov ecx, esi
jmp 0x4072bc
dec eax
mov eax, dword [edi]
mov byte [esi + eax], 0
call fcn.0040c3c0
dec eax
lea ecx, [esp + 0x20]
call fcn.004098b4
test eax, eax
js 0x407380
dec eax
test ebp, ebp
je 0x4073ac
mov eax, dword [edi]
mov dword [ebp], eax
dec eax
mov eax, esi
jmp 0x4072c3
Function at 0x4073b4
Capabilities:
Read file on windows

Disassembly:
dec eax
mov eax, esp
dec eax
mov dword [eax + 8], ebx
dec eax
mov dword [eax + 0x10], ebp
dec eax
mov dword [eax + 0x18], esi
dec eax
mov dword [eax + 0x20], edi
inc ecx
push esp
dec eax
sub esp, 0x20
dec eax
mov ebp, edx
mov edx, 0xffffffea
mov ebx, ecx
inc esp
lea eax, [edx + 0x18]
call fcn.004185c4
mov edi, eax
test eax, eax
js 0x40751f
inc ecx
mov eax, 0x16
dec eax
mov edx, ebp
mov ecx, ebx
call fcn.004178f4
test eax, eax
js 0x40751f
movzx eax, byte [ebp + 2]
movzx ecx, byte [ebp + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x407430
mov eax, edi
jmp 0x407522
xor edx, edx
mov ecx, ebx
inc esp
lea eax, [edx + 2]
call fcn.004185c4
inc esp
mov esp, eax
test eax, eax
js 0x40751f
mov edi, 0x10015
inc ecx
mov eax, 2
mov ecx, ebx
cmp eax, edi
mov esi, edi
cmovl esi, eax
mov edx, esi
neg edx
call fcn.004185c4
test eax, eax
js 0x40751f
mov ecx, edi
call fcn.0040c234
dec eax
mov edi, eax
dec eax
test eax, eax
je 0x40751f
inc esp
mov eax, esi
dec eax
mov edx, eax
mov ecx, ebx
call fcn.004178f4
test eax, eax
js 0x407517
dec eax
arpl ax, si
add eax, 0xffffffea
dec eax
arpl ax, bx
dec eax
add esi, edi
dec eax
add ebx, edi
dec eax
cmp ebx, edi
jb 0x407517
cmp byte [ebx], 0x50
jne 0x4074ed
movzx eax, byte [ebx + 2]
movzx ecx, byte [ebx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x4074ed
movzx eax, byte [ebx + 0x15]
shl eax, 8
dec eax
arpl ax, cx
movzx eax, byte [ebx + 0x14]
dec eax
or ecx, eax
dec eax
lea eax, [ecx + ebx + 0x16]
dec eax
cmp eax, esi
je 0x4074f2
dec eax
dec ebx
jmp 0x4074a4
inc ecx
mov eax, 0x16
dec eax
mov edx, ebx
dec eax
mov ecx, ebp
call fcn.0040b0a0
dec eax
mov ecx, edi
call fcn.0040c3c0
inc ebp
mov ebx, esp
dec esp
sub ebx, esi
dec edx
lea eax, [ebx + ebx]
jmp 0x407522
dec eax
mov ecx, edi
call fcn.0040c3c0
or eax, 0xffffffff
dec eax
mov ebx, dword [esp + 0x30]
dec eax
mov ebp, dword [esp + 0x38]
dec eax
mov esi, dword [esp + 0x40]
dec eax
mov edi, dword [esp + 0x48]
dec eax
add esp, 0x20
inc ecx
pop esp
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427004]
jne 0x401010
repz ret
jmp fcn.00401734

Function at 0x407785
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404e66
and dword [ebp - 4], 0
cmp dword [0x42917c], 0
mov ebx, eax
jne 0x407836
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4078e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4078e7
push eax
call fcn.00404df4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42917c], eax
call esi
push eax
call fcn.00404df4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429180], eax
call esi
push eax
call fcn.00404df4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429184], eax
call esi
push eax
call fcn.00404df4
pop ecx
mov dword [0x42918c], eax
test eax, eax
je 0x407836
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404df4
pop ecx
mov dword [0x429188], eax
mov eax, dword [0x429188]
cmp eax, ebx
je 0x40788e
cmp dword [0x42918c], ebx
je 0x40788e
push eax
call fcn.00404e6f
push dword [0x42918c]
mov esi, eax
call fcn.00404e6f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40788e
test edi, edi
je 0x40788e
call esi
test eax, eax
je 0x407885
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407885
test byte [ebp - 0xc], 1
jne 0x40788e
or dword [ebp + 0x10], 0x200000
jmp 0x4078c7
mov eax, dword [0x429180]
cmp eax, ebx
je 0x4078c7
push eax
call fcn.00404e6f
pop ecx
test eax, eax
je 0x4078c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4078c7
mov eax, dword [0x429184]
cmp eax, ebx
je 0x4078c7
push eax
call fcn.00404e6f
pop ecx
test eax, eax
je 0x4078c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42917c]
call fcn.00404e6f
pop ecx
test eax, eax
je 0x4078e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4078e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100065e0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x100065fb
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10006606
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10006611
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000661c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10006627
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10006632
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000663d
bts eax, 1
test cl, 2
je 0x10006646
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x100066e2
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x100066d3
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x100065f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006710
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x1012ef7c
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call fcn.100e2af1
add esp, 0xc
test eax, eax
je 0x10006760
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.100e2b38
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x10006796
call fcn.100e2d7f
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100e2f88
add esp, 0x10
test eax, eax
je 0x100067eb
push esi
nop dword [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x100067b2
push dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
push 0x400
push 1
push ebx
call fcn.100e2f88
add esp, 0x10
test eax, eax
jne 0x100067b0
pop esi
push ebx
call fcn.100e30c3
push dword [ebp - 8]
call fcn.100e2d7f
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.1008b7da
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006820
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov dword [esi], vtable.CAntiHack.0
test eax, eax
je 0x1000684c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], 0
test byte [ebp + 8], 1
je 0x1000685d
push 0x64
push esi
call fcn.1008bb02
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10006a20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov dword [esi], vtable.CAutoClick.0
test eax, eax
je 0x10006a4c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
test byte [ebp + 8], 1
je 0x10006a5d
push 0x14
push esi
call fcn.1008bb02
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10006b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
test ebx, ebx
jle 0x10006b98
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
nop word [eax + eax]
lea esi, [ecx + eax]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
inc ecx
mov al, byte [edx + 0x1012f014]
xor al, byte [edi + esi]
mov byte [esi], al
mov eax, dword [ebp + 8]
cmp ecx, ebx
jl 0x10006b70
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x100089f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREWebzenMuConfig
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10008baf
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
mov dword [0x10305af8], eax
nop dword [eax]
test esi, esi
je 0x10008a5b
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x38]
push str.ID__d
push eax
call sym.Main.dll_sprintf
add esp, 0xc
jmp 0x10008a6c
lea eax, [ebp - 0x38]
push 0x1012efc4
push eax
call sym.Main.dll_sprintf
add esp, 8
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xb
push eax
mov eax, dword [0x10305af8]
lea ecx, [eax*8]
sub ecx, eax
lea eax, [ecx*4 + 0x10305afc]
push eax
push 0
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x44]
call edi
test eax, eax
jne 0x10008b5b
cmp dword [ebp - 0x3c], 1
jb 0x10008b5b
test esi, esi
je 0x10008ac7
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x38]
push str.PW__d
push eax
call sym.Main.dll_sprintf
add esp, 0xc
jmp 0x10008ad8
lea eax, [ebp - 0x38]
push 0x1012f098
push eax
call sym.Main.dll_sprintf
add esp, 8
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xb
push eax
mov eax, dword [0x10305af8]
lea ecx, [eax*8]
sub ecx, eax
lea eax, [ecx*4 + 0x10305b07]
push eax
push 0
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x44]
call edi
test eax, eax
jne 0x10008b2d
cmp dword [ebp - 0x3c], 1
jb 0x10008b2d
mov eax, dword [0x10305af8]
lea ecx, [eax*8]
sub ecx, eax
mov dword [ecx*4 + 0x10305b14], esi
inc dword [0x10305af8]
jmp 0x10008b87
mov eax, dword [0x10305af8]
xorps xmm0, xmm0
lea ecx, [eax*8]
sub ecx, eax
movq qword [ecx*4 + 0x10305b07], xmm0
mov word [ecx*4 + 0x10305b0f], 0
mov byte [ecx*4 + 0x10305b11], 0
jmp 0x10008b87
mov eax, dword [0x10305af8]
xorps xmm0, xmm0
lea ecx, [eax*8]
sub ecx, eax
movq qword [ecx*4 + 0x10305afc], xmm0
mov word [ecx*4 + 0x10305b04], 0
mov byte [ecx*4 + 0x10305b06], 0
inc esi
cmp esi, 5
jl 0x10008a40
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 4
push eax
push 0x10305ab0
push 0
push 0
push str.SavePass
push dword [ebp - 0x44]
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x10305ab0], 1
pop esi
call fcn.1008b7da
mov esp, ebp
pop ebp
ret
Function at 0x1000aee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1013cf2c]
push esi
mov esi, dword [0x1013cf30]
push edi
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10132c50]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
andps xmm0, xmmword [0x10133270]
mulsd xmm0, qword [0x10132bd0]
push esi
addsd xmm0, qword [0x10132cc8]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x1013cf2c]
mov esi, dword [0x1013cf34]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10132c50]
push eax
push 0x40
push 8
push esi
andps xmm0, xmmword [0x10133270]
mulsd xmm0, qword [0x10132bd0]
addsd xmm0, qword [0x10132cc8]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x1013cf2c]
mov esi, dword [0x1013cf38]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10132c50]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10133270]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x10132c28]
addss xmm0, dword [0x101330e0]
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov eax, dword [0x1013cf2c]
mov esi, dword [0x1013cf3c]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10132c50]
push eax
andps xmm0, xmmword [0x10133270]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x10132c28]
addss xmm0, dword [0x101330e0]
movss dword [ebp - 0xc], xmm0
push 0x40
push 4
push esi
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov eax, dword [0x1013cf2c]
mov esi, dword [0x1013cf40]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10132c50]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10133270]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x10132c28]
addss xmm0, dword [0x101330dc]
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1008b7da
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000b0d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1013c018]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x58], 0
je 0x1000b2c4
movss xmm0, dword [ebx + 0x5c]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x60]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x34]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x64]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x38]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movsd xmm0, qword [ebx + 0x68]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x3c]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x70]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x40]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
movsd qword [esi], xmm0
push eax
push dword [esp + 0x1c]
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x78]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x44]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movss xmm0, dword [ebx + 0x80]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x48]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x84]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x4c]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x88]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x50]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008b7da
mov esp, ebp
pop ebp
ret
Function at 0x10014e40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x483414
call esi
lea eax, [ebp - 8]
mov byte [0x483414], 0
push eax
push dword [ebp - 8]
push 1
push 0x483414
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x483402
call esi
lea eax, [ebp - 8]
mov dword [0x483402], 7
push eax
push dword [ebp - 8]
push 4
push 0x483402
call esi
push 0x10014760
push 0x4d5691
push 0xe8
call fcn.100866a0
push 0x10014860
push 0x48346b
push 0xe8
call fcn.100866a0
push 0x10014830
push 0x48345d
push 0xe8
call fcn.100866a0
add esp, 0x24
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d5703
call esi
lea eax, [ebp - 8]
mov dword [0x4d5703], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d5703
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d5723
call esi
lea eax, [ebp - 8]
mov dword [0x4d5723], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d5723
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d5743
call esi
lea eax, [ebp - 8]
mov dword [0x4d5743], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d5743
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d5763
call esi
lea eax, [ebp - 8]
mov dword [0x4d5763], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d5763
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d57c8
call esi
lea eax, [ebp - 8]
mov dword [0x4d57c8], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d57c8
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d57e8
call esi
lea eax, [ebp - 8]
mov dword [0x4d57e8], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d57e8
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d5808
call esi
lea eax, [ebp - 8]
mov dword [0x4d5808], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d5808
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d5828
call esi
lea eax, [ebp - 8]
mov dword [0x4d5828], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d5828
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d56cd
call esi
lea eax, [ebp - 8]
mov dword [0x4d56cd], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d56cd
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d56ad
call esi
lea eax, [ebp - 8]
mov dword [0x4d56ad], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d56ad
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d566d
call esi
lea eax, [ebp - 8]
mov dword [0x4d566d], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d566d
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d562d
call esi
lea eax, [ebp - 8]
mov dword [0x4d562d], 0x1012f6cc
push eax
push dword [ebp - 8]
push 4
push 0x4d562d
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1008b7da
mov esp, ebp
pop ebp
ret