joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009cb0
Capabilities:
Hash data with crc32

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x1008df28]
push edi
mov edi, dword [esp + 0x28]
mov ebp, dword [esi + 0x3e60]
mov ecx, ebp
mov eax, dword [ebp + 0xc]
and eax, 4
or eax, 0x1000103
or edi, eax
cmp dword [ebp + 0x190], 0
mov dword [esp + 0x28], edi
jne 0x10009cef
cmp dword [esi + 0x4a74], 0
mov eax, 0x228
je 0x10009cf4
mov eax, 0x1f8
movss xmm4, dword [eax + ebp]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebp + 4]
mov edx, 1
subss xmm4, dword [ecx + 0xf0]
subss xmm5, dword [ecx + 0xf4]
mov ecx, dword [esp + 0x20]
mov ebx, 2
movss xmm2, dword [0x10076260]
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
cmovnp ecx, edx
ucomiss xmm0, xmm3
lahf
xor edx, edx
test ah, 0x44
cmovnp edx, ebx
or edx, ecx
comiss xmm3, xmm1
mov dword [esp + 0x10], edx
jb 0x10009d6e
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x10009d6e
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x10009d7f
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x10009d7f
movaps xmm0, xmm2
or dword [esi + 0x471c], ebx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movss dword [esi + 0x473c], xmm1
movss dword [esi + 0x4740], xmm0
mov dword [esi + 0x4724], 1
mov eax, dword [ebp + 4]
push ebx
test ecx, ecx
je 0x10009dc7
push ecx
push eax
push str._s__s__08X
lea eax, [esp + 0x30]
push 0
push eax
call fcn.10011bc0
add esp, 0x18
jmp 0x10009ddc
push eax
push str._s__08X
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.10011bc0
add esp, 0x14
cmp byte [esp + 0x24], 0
movss xmm0, dword [esi + 0x37b8]
movss dword [esp + 0x18], xmm0
jne 0x10009dfb
mov dword [esi + 0x37b8], 0
push edi
push 0
push dword [esp + 0x28]
call fcn.10007450
mov edi, dword [esi + 0x3e60]
add esp, 0xc
movss xmm0, dword [esp + 0x18]
movss dword [esi + 0x37b8], xmm0
mov byte [esp + 0x24], al
cmp word [edi + 0xb6], 1
mov eax, dword [esp + 0x10]
mov dword [edi + 0x74], ebx
mov byte [edi + 0xc6], al
jne 0x10009e4b
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebp + 0xf0], ecx
mov dword [ebp + 0xf4], eax
mov ebp, ebx
mov al, 0x23
not ebp
mov edx, 0x100786c1
mov ebx, ebp
cmp al, 0x23
jne 0x10009e66
cmp byte [edx], al
jne 0x10009e66
cmp byte [edx + 1], al
cmove ebx, ebp
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x100762d8]
test al, al
jne 0x10009e58
not ebx
cmp dword [esi + 0x3eac], ebx
jne 0x10009e95
push 0
push 0
call fcn.1001f260
add esp, 8
mov eax, dword [esp + 0x1c]
cmp dword [esi + 0x4804], eax
jne 0x10009ee4
test dword [esp + 0x28], 0x800000
jne 0x10009ee4
cmp word [edi + 0x14c], 0
jne 0x10009ebe
cmp byte [edi + 0x152], 0
je 0x10009ee4
push 0
push edi
call fcn.1000ffe0
push 0
push edi
call fcn.10016040
push edi
push ebx
call fcn.1001f260
mov eax, dword [esi + 0x4828]
add esp, 0x18
mov dword [esi + 0x3ecc], eax
mov al, byte [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10010770
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
jg 0x10010796
push 0x737
push str.D:Projectm2extLibrariesimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [esp + 0x10]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100762d8]
sub esi, 1
jne 0x100107b1
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x100107e7
push esi
push dword [esp + 0x14]
push 4
push ebx
call fcn.1000cb70
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x10010870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
jg 0x10010896
push 0x737
push str.D:Projectm2extLibrariesimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [esp + 0x10]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100762d8]
sub esi, 1
jne 0x100108b1
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x100108e7
push esi
push dword [esp + 0x14]
push 0xc
push ebx
call fcn.1000cb70
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x100108f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xe4], 0
jg 0x10010918
push 0x737
push str.D:Projectm2extLibrariesimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov edi, 0x10
movss xmm1, dword [esi + 0x100]
movss xmm2, dword [esi + 0x104]
mov ecx, dword [esi + 0xe4]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [esp + 8], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [esp + 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [esp + 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xec]
subss xmm0, xmm2
lea esi, [esp + 8]
mov edx, dword [eax + ecx*4 - 4]
movss dword [esp + 0x14], xmm0
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100762d8]
sub edi, 1
jne 0x10010982
not edx
pop edi
mov eax, edx
pop esi
add esp, 0x10
ret 4
Function at 0x10012a40
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
test edi, edi
je 0x10012aa2
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10012a86
cmp edi, 2
jb 0x10012a86
cmp byte [esi], cl
jne 0x10012a86
cmp byte [esi + 1], cl
jne 0x10012a86
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100762d8]
jmp 0x10012a57
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100762d8]
test edi, edi
jne 0x10012a57
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10012ad8
nop dword [eax]
cmp cl, 0x23
jne 0x10012abf
cmp byte [esi], cl
jne 0x10012abf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100762d8]
test cl, cl
jne 0x10012ab0
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x10012eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
xor ecx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x10012ed1
cmp eax, ebp
jae 0x10013036
mov bl, byte [eax]
test bl, bl
je 0x10013036
movzx ecx, bl
mov edx, ebp
shr ecx, 3
movsx edi, byte [ecx + 0x10077250]
xor ecx, ecx
test edi, edi
mov dword [esp + 0x14], edi
sete cl
add ecx, edi
mov dword [esp + 0x18], ecx
test ebp, ebp
jne 0x10012f02
lea edx, [ecx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, bl
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x10012f17
mov bh, byte [esi]
jmp 0x10012f19
xor bh, bh
lea esi, [eax + 2]
mov byte [esp + 0x12], bh
cmp esi, edx
jae 0x10012f28
mov ch, byte [esi]
jmp 0x10012f2a
xor ch, ch
lea esi, [eax + 3]
mov byte [esp + 0x11], ch
cmp esi, edx
jae 0x10012f39
mov bl, byte [esi]
jmp 0x10012f3b
xor bl, bl
mov edi, dword [edi*4 + 0x10077270]
movzx edx, ch
movzx ecx, cl
and edi, ecx
movzx esi, bh
shl edi, 6
mov ecx, esi
and ecx, 0x3f
mov byte [esp + 0x28], bl
or edi, ecx
movzx ebx, bl
shl edi, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or edi, ecx
and esi, 0xc0
mov ecx, ebx
shl edi, 6
and ecx, 0x3f
shr ebx, 2
or edi, ecx
or ebx, edx
mov ecx, dword [esp + 0x14]
shr ebx, 2
or ebx, esi
mov esi, dword [esp + 0x14]
shr ebx, 2
mov ecx, dword [ecx*4 + 0x10077298]
shr edi, cl
cmp edi, dword [esi*4 + 0x10077284]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or ebx, ecx
mov ecx, edi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or ebx, edx
cmp ecx, edi
sbb ecx, ecx
and ecx, 0x100
or ebx, ecx
mov ecx, dword [esi*4 + 0x100772ac]
xor ebx, 0x2a
sar ebx, cl
test ebx, ebx
je 0x10013026
xor edx, edx
cmp byte [esp + 0x28], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x13], cl
setne cl
add edx, ecx
cmp dword [esp + 0x18], edx
cmovl edx, dword [esp + 0x18]
mov ecx, edx
add eax, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
jmp 0x10012ec1
mov ecx, dword [esp + 0x18]
add eax, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
jmp 0x10012ec1
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
Function at 0x10013090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
dec eax
push ebp
mov ebp, edx
mov dword [esp + 0x10], ebp
lea eax, [edx + eax*2]
mov dword [esp + 0x14], eax
cmp edx, eax
mov eax, dword [esp + 0x24]
jae 0x10013264
push esi
mov esi, dword [esp + 0x2c]
push ebx
push edi
nop dword [eax]
test esi, esi
je 0x100130cc
cmp eax, esi
jae 0x1001325d
mov cl, byte [eax]
mov byte [esp + 0x2c], cl
test cl, cl
je 0x1001325d
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x10077250]
test ecx, ecx
mov dword [esp + 0x18], ecx
sete bl
add ebx, ecx
test esi, esi
jne 0x100130fd
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [esp + 0x2c]
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x10013118
mov ch, byte [esi]
mov byte [esp + 0x11], ch
jmp 0x1001311d
mov byte [esp + 0x11], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x1001312c
mov ch, byte [esi]
mov byte [esp + 0x2c], ch
jmp 0x10013131
mov byte [esp + 0x2c], 0
lea esi, [eax + 3]
cmp esi, edx
jae 0x1001313c
mov ch, byte [esi]
jmp 0x1001313e
xor ch, ch
mov ebp, dword [esp + 0x18]
movzx esi, byte [esp + 0x11]
movzx edx, byte [esp + 0x2c]
movzx edi, ch
mov ebp, dword [ebp*4 + 0x10077270]
mov byte [esp + 0x12], ch
movzx ecx, cl
and ebp, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [esp + 0x14], ebp
shl dword [esp + 0x14], 6
and esi, 0xc0
or dword [esp + 0x14], ecx
mov ecx, edx
shl dword [esp + 0x14], 6
and ecx, 0x3f
or dword [esp + 0x14], ecx
and edx, 0xc0
shl dword [esp + 0x14], 6
mov ecx, edi
mov ebp, dword [esp + 0x14]
and ecx, 0x3f
or ebp, ecx
shr edi, 2
mov ecx, dword [esp + 0x18]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10077298]
shr ebp, cl
mov esi, ebp
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x18]
cmp esi, dword [ebp*4 + 0x10077284]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebp*4 + 0x100772ac]
mov ebp, dword [esp + 0x1c]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x10013242
xor edx, edx
mov esi, 0xfffd
cmp byte [esp + 0x12], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x2c], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x13], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
mov word [ebp], si
add eax, ebx
mov esi, dword [esp + 0x34]
add ebp, 2
mov dword [esp + 0x1c], ebp
cmp ebp, dword [esp + 0x20]
jb 0x100130c0
mov edx, dword [esp + 0x28]
pop edi
pop ebx
pop esi
xor ecx, ecx
mov word [ebp], cx
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x10013274
mov dword [ecx], eax
sub ebp, edx
sar ebp, 1
mov eax, ebp
pop ebp
add esp, 0x14
ret
Function at 0x10015910
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x5b90], 0
lea esi, [edi + 0x5b94]
je 0x1001598a
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x10015944
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.10025f90
push dword [esp + 0x14]
mov ecx, esi
mov dword [esi], 0
push dword [esp + 0x14]
call fcn.10025a30
mov edx, dword [esi]
mov ecx, 0x1008df2c
push dword [edi + 0x5b90]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5b9c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
ret
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.10025a30
pop edi
pop esi
ret
Function at 0x1001ed30
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x1008df28]
push esi
mov esi, dword [esp + 8]
mov dword [eax + 0x5b24], 0
test esi, esi
je 0x1001ed8a
lea eax, [esp + 8]
mov dword [esp + 8], 0
push edi
push eax
call fcn.1001ed90
push 0x1007cbfc
push esi
mov edi, eax
call fcn.100119c0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1001ed89
push esi
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
ret

Function at 0x10024210
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [0x1008df28]
cmp byte [esi + 0x5b20], 0
jne 0x10024349
cmp dword [esi + 0x5b40], 0
je 0x10024245
push 0x3289
push str.D:Projectm2extLibrariesimguiimgui.cpp
push str.g.SettingsWindows.empty__
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10024342
push edi
push 0x1007cbf8
push eax
call fcn.100119c0
mov edi, eax
add esp, 8
test edi, edi
je 0x10024341
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push ebp
push edi
call ebx
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x10024335
push 2
push 0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10024335
push edi
call ebx
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10024335
push 0
push ebp
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10024335
mov eax, dword [0x1008df28]
test eax, eax
je 0x100242c9
inc dword [eax + 0xb0]
push dword [0x1008df30]
push ebx
call dword [0x1008d00c]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x10024335
push edi
push ebx
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push edi
cmp eax, ebx
je 0x100242fd
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
jmp 0x10024314
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x10024314
push ebx
push ebp
call fcn.100152b0
add esp, 8
mov eax, dword [0x1008df28]
test eax, eax
je 0x10024323
dec dword [eax + 0xb0]
push dword [0x1008df30]
push ebp
call dword [0x1008d010]
add esp, 8
jmp 0x1002433f
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop ebp
pop ebx
pop edi
mov byte [esi + 0x5b20], 1
movss xmm0, dword [esi + 0x5b24]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x10024398
subss xmm0, dword [esi + 0x18]
comiss xmm1, xmm0
movss dword [esi + 0x5b24], xmm0
jb 0x10024398
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10024387
push eax
call fcn.1001ed30
add esp, 4
mov dword [esi + 0x5b24], 0
pop esi
ret
mov byte [esi + 0x96], 1
mov dword [esi + 0x5b24], 0
pop esi
ret
Function at 0x1002a440
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp edi, 8
ja 0x1002a569
test byte [esi], 2
jne 0x1002a569
cmp dword [esi + 0x468], 0xffffffff
jne 0x1002a47b
push 0x91c
push str.D:Projectm2extLibrariesimguiimgui_draw.cpp
push str.PackIdMouseCursors____1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
push dword [esi + 0x468]
mov ecx, esi
call fcn.1002a3e0
lea edx, [edi + edi*2]
movss xmm2, dword [edx*8 + 0x1007e1a8]
movss xmm4, dword [edx*8 + 0x1007e1ac]
movzx ecx, word [eax + 4]
movzx eax, word [eax + 6]
pop edi
movd xmm5, ecx
movd xmm3, eax
mov eax, dword [esp + 0x10]
cvtdq2ps xmm5, xmm5
cvtdq2ps xmm3, xmm3
addss xmm5, dword [edx*8 + 0x1007e1a0]
addss xmm3, dword [edx*8 + 0x1007e1a4]
movss dword [eax + 4], xmm4
movss dword [eax], xmm2
mov ecx, dword [edx*8 + 0x1007e1b0]
mov edx, dword [edx*8 + 0x1007e1b4]
movaps xmm1, xmm5
mov eax, dword [esp + 0xc]
addss xmm4, xmm3
movaps xmm0, xmm3
mov dword [eax], ecx
mov dword [eax + 4], edx
mulss xmm1, dword [esi + 0x2c]
mov eax, dword [esp + 0x14]
mulss xmm0, dword [esi + 0x30]
movss dword [eax], xmm1
movaps xmm1, xmm2
movss dword [eax + 4], xmm0
addss xmm1, xmm5
addss xmm5, dword [0x10082890]
movaps xmm0, xmm4
mulss xmm0, dword [esi + 0x30]
mulss xmm1, dword [esi + 0x2c]
movss dword [eax + 0xc], xmm0
movaps xmm0, xmm5
addss xmm5, xmm2
movss dword [eax + 8], xmm1
mulss xmm0, dword [esi + 0x2c]
mov eax, dword [esp + 0x18]
mulss xmm3, dword [esi + 0x30]
movss dword [eax], xmm0
movss dword [eax + 4], xmm3
mulss xmm5, dword [esi + 0x2c]
mulss xmm4, dword [esi + 0x30]
pop esi
movss dword [eax + 8], xmm5
movss dword [eax + 0xc], xmm4
mov al, 1
ret 0x14
pop edi
xor al, al
pop esi
ret 0x14
Function at 0x1002a7d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x1c], 0
jne 0x1002a7fe
cmp dword [edi + 0x20], 0
jne 0x1002a7fe
push 0xb42
push str.D:Projectm2extLibrariesimguiimgui_draw.cpp
push str.atlas__TexPixelsAlpha8___0__atlas__TexPixelsRGBA32___0
call esi
add esp, 0xc
push edi
call fcn.1002aeb0
push edi
call fcn.1002b0d0
mov eax, dword [edi + 0x48]
add esp, 8
xor ebp, ebp
test eax, eax
jle 0x1002a97f
xor ecx, ecx
mov dword [esp + 0x14], ecx
test ebp, ebp
js 0x1002a828
cmp ebp, eax
jl 0x1002a840
push 0x72e
push str.D:Projectm2extLibrariesimguiimgui.h
push str.i___0__i___Size
call esi
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov ebx, dword [edi + 0x50]
add ebx, ecx
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x1002a96c
cmp dword [ebx + 8], 0
je 0x1002a96c
cmp dword [eax + 0x30], edi
je 0x1002a873
push 0xb4e
push str.D:Projectm2extLibrariesimguiimgui_draw.cpp
push str.r__Font__ContainerAtlas__atlas
call esi
add esp, 0xc
cmp dword [edi + 0x24], 0
jle 0x1002a87f
cmp dword [edi + 0x28], 0
jg 0x1002a893
push 0x90f
push str.D:Projectm2extLibrariesimguiimgui_draw.cpp
push str.TexWidth___0__TexHeight___0
call esi
add esp, 0xc
mov eax, 0xffff
cmp word [ebx + 4], ax
jne 0x1002a8b2
push 0x910
push str.D:Projectm2extLibrariesimguiimgui_draw.cpp
push str.rect__IsPacked__
call esi
add esp, 0xc
movzx eax, word [ebx + 4]
sub esp, 0x24
movzx esi, word [ebx]
movzx ecx, word [ebx + 6]
movzx edx, word [ebx + 2]
movss xmm0, dword [ebx + 0xc]
movss xmm4, dword [ebx + 0x14]
movss dword [esp + 0x20], xmm0
movd xmm6, eax
add eax, esi
movss xmm5, dword [ebx + 0x10]
movd xmm3, ecx
movd xmm0, edx
movd xmm2, eax
lea eax, [edx + ecx]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movzx eax, word [ebx + 8]
mov ecx, dword [ebx + 0x18]
cvtdq2ps xmm0, xmm0
mulss xmm1, dword [edi + 0x30]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm3, xmm3
mulss xmm2, dword [edi + 0x2c]
addss xmm0, xmm4
mulss xmm3, dword [edi + 0x30]
cvtdq2ps xmm6, xmm6
movss dword [esp + 0x1c], xmm1
mulss xmm6, dword [edi + 0x2c]
movss dword [esp + 0x18], xmm2
movss dword [esp + 0x14], xmm3
movss dword [esp + 0x10], xmm6
movss dword [esp + 0xc], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
addss xmm0, xmm5
movss dword [esp + 8], xmm0
movss dword [esp + 4], xmm4
movss dword [esp], xmm5
push eax
push 0
call fcn.10027c50
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x48]
inc ebp
add ecx, 0x1c
mov dword [esp + 0x14], ecx
cmp ebp, eax
jl 0x1002a820
mov esi, dword [edi + 0x44]
mov eax, dword [edi + 0x3c]
lea ebx, [esi + eax*4]
cmp esi, ebx
je 0x1002a9a4
nop dword [eax]
mov ecx, dword [esi]
cmp byte [ecx + 0x48], 0
je 0x1002a99d
call fcn.10029360
add esi, 4
cmp esi, ebx
jne 0x1002a990
mov byte [edi + 0x18], 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10030120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10030147
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10015b20
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1003016c
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10015b20
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10030191
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10015b20
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x100301d2
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10015b20
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x100301f7
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10015b20
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1003021c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10015b20
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1002a130
Function at 0x10039f10
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push esi
call fcn.100105d0
test eax, eax
je 0x10039f24
call fcn.10010a00
mov esi, dword [eax + 0x68]
jmp 0x10039f26
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10039f49
mov dword [esi], eax
pop esi
ret
Function at 0x100472b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
or eax, 2
mov dword [esp + 0xc], eax
jmp fcn.100472c0
Function at 0x1005a270
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x30]
lea esi, [edi + 5]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x1c]
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], esi
push ecx
push 0x40
push esi
push eax
call ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x14], ebp
push eax
push 0x40
push esi
push ebp
mov dword [esp + 0x2c], esi
call ebx
mov esi, dword [esp + 0x10]
push edi
push ebp
push esi
call sub.VCRUNTIME140.dll_memcpy
mov cl, byte [esp + 0x38]
mov eax, ebp
sub eax, esi
mov byte [edi + esi], cl
sub eax, 5
add esp, 0xc
mov dword [edi + esi + 1], eax
mov eax, dword [esp + 0x28]
sub eax, ebp
mov byte [ebp], cl
sub eax, 5
mov dword [ebp + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esp + 0x20]
call ebx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x1005a350
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
lea ecx, [edi + 4]
mov dword [edi], esi
push ecx
push 0x40
push edx
push esi
mov dword [edi + 8], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, edi
pop edi
pop esi
ret

Function at 0x1005d4c0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x10075455
push 0x80
push 0x1008e058
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
push 0x7f
push 0x1008e058
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov eax, 0x1008e058
ret