joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a95b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x7192d4]
mov eax, dword [eax + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
cmp eax, 0xffffffff
push edi
mov dword [esp + 0x18], 0x3f800000
mov dword [esp + 0x1c], 0x3f666666
mov dword [esp + 0x20], 0x3f666666
mov dword [esp + 0x24], 0x3f666666
je 0x4a961b
push 0xffffffffffffffff
push esi
push esi
xor edi, edi
mov word [esp + 0x1c], si
mov word [esp + 0x1e], si
mov word [esp + 0x20], 0x1e0
mov word [esp + 0x22], 0x280
call fcn.0043f290
add esp, 4
push eax
lea eax, [esp + 0x1c]
mov ecx, eax
call fcn.00498bd0
add esp, 0xc
mov ecx, dword [0x71933c]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [0x7192d4]
mov dword [0x6e4654], ecx
mov dword [0x6e4660], edi
mov dword [0x6e4664], ebx
mov dword [0x6e4668], ebp
mov dword [0x6e466c], edx
mov word [0x6e465c], 0xffff
mov word [0x6e465e], si
mov dword [0x6e4658], esi
mov ecx, dword [eax + 0x2c]
cmp ecx, 0xffffffff
je 0x4a96aa
mov edx, dword [0x7192e4]
call fcn.00557cf0
push eax
lea eax, [esp + 0x14]
push esi
push esi
mov ecx, eax
mov word [esp + 0x1c], 0x4e
mov word [esp + 0x1e], 0x72
mov word [esp + 0x20], 0x6e
mov word [esp + 0x22], 0x280
call fcn.00514c50
add esp, 0xc
mov ecx, dword [0x7192d4]
mov eax, dword [ecx + 0x2c]
cmp eax, 0xffffffff
mov edx, 0x671fd4
je 0x4a96f1
mov ecx, dword [0x87b7b4]
and eax, 0xffff
shl eax, 5
mov eax, dword [eax + ecx + 0x14]
cmp dword [eax], 0xe
jle 0x4a96f1
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x118]
add ecx, 0x118
cmp eax, esi
jle 0x4a96f1
mov edx, dword [ecx + 0xc]
shr eax, 1
mov word [edx + eax*2 - 2], si
mov eax, dword [0x71933c]
mov ecx, dword [esp + 0x24]
push edx
mov dword [0x6e4654], eax
lea eax, [esp + 0x14]
mov dword [0x6e466c], ecx
push esi
push esi
mov ecx, eax
mov word [esp + 0x1c], 0x19e
mov word [esp + 0x1e], si
mov word [esp + 0x20], 0x1c2
mov word [esp + 0x22], 0x276
mov dword [0x6e4660], edi
mov dword [0x6e4664], ebx
mov dword [0x6e4668], ebp
mov word [0x6e465c], 0xffff
mov word [0x6e465e], 1
mov dword [0x6e4658], esi
call fcn.00514c50
lea edx, [esp + 0x1c]
push edx
mov word [esp + 0x20], 0x76
mov word [esp + 0x22], 0x78
mov word [esp + 0x24], 0x8f
mov word [esp + 0x26], 0x208
call fcn.004a93a0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4c83f0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
push ecx
push 0x4c83c0
push 0x10400
push 0
mov dword [0x719a90], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4c8450
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4c8438
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x719a90]
test eax, eax
je 0x4c8450
mov eax, 1
pop esi
pop ecx
ret
mov dword [0x719a94], 0
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4c8580
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
xor ebx, ebx
cmp edi, ebx
jne 0x4c85b3
cmp esi, ebx
jne 0x4c85b3
pop edi
pop esi
mov byte [0x7199a2], bl
mov byte [0x7199c2], bl
mov byte [0x7199a1], bl
mov al, 1
pop ebx
add esp, 0x1c
ret
mov eax, edi
call fcn.004dc7d0
test al, al
je 0x4c86d1
push 8
push esi
push 0x7199c2
call fcn.00623ce0
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
mov byte [0x7199ca], bl
call fcn.004dc680
add esp, 0x18
test al, al
je 0x4c8620
cmp byte [esp + 0x2c], bl
jne 0x4c86d1
push 0x1f
lea edx, [esp + 0x10]
push edx
push 0x7199a2
mov byte [0x7199a1], 1
call fcn.00623ce0
add esp, 0xc
pop edi
pop esi
mov byte [0x7199c1], bl
mov al, 1
pop ebx
add esp, 0x1c
ret
push ebx
mov eax, edi
call fcn.004dc600
add esp, 4
test al, al
je 0x4c86d1
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4c8638
sub eax, edx
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov edx, esi
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4c8652
call fcn.00498700
call fcn.00497980
cmp edi, ebx
mov dword [0x718eb4], 3
jne 0x4c867d
mov word [0x6b2e50], bx
jmp 0x4c868c
push 0x40
mov eax, 0x6b2e50
call fcn.00557dc0
add esp, 4
cmp dword [0x719a8c], ebx
je 0x4c86ab
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push ebx
call edi
cmp dword [0x719a8c], ebx
jne 0x4c86a0
lea eax, [esp + 0x2c]
push eax
push ebx
push esi
push 0x4c8460
push 0x4000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov dword [0x719a8c], eax
mov al, 1
pop ebx
add esp, 0x1c
ret
push ebx
push ebx
call fcn.004c8580
push ebx
push 1
push 0xffffffffffffffff
push 0x35
call fcn.00498fd0
add esp, 0x18
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x1c
ret
Function at 0x4cd0b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push edi
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x18]
push ecx
call esi
call fcn.0062431f
mov edx, dword [esp + 0x14]
push 0
push 0x3e8
mov ebx, eax
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.0062e0c0
mov esi, dword [0x6ac824]
mov edi, dword [0x6ac820]
push esi
push edi
push edx
push eax
call fcn.00639340
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push esi
push edi
push ecx
push edx
mov ebp, eax
call fcn.00639340
pop edi
xor ebp, eax
xor ebx, ebp
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret

Function at 0x4d0310
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x719c00]
test al, al
jne 0x4d032a
mov edx, 0x6b7a28
call fcn.004d0370
mov byte [0x719c00], 1
push esi
mov esi, dword [esp + 0x10]
test esi, esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
jle 0x4d035c
mov edx, dword [esp + 0x10]
mov edi, edi
xor ecx, ecx
mov cl, byte [edx]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6b7a28]
shr eax, 8
inc edx
xor eax, ecx
dec esi
jne 0x4d0340
mov dword [edi], eax
pop edi
pop esi
ret

Function at 0x4d0370
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
xor ecx, ecx
mov edi, 0x100
lea esp, [esp]
mov eax, ecx
mov esi, 8
test al, 1
je 0x4d0394
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d0396
shr eax, 1
dec esi
jne 0x4d0387
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x4d0380
pop edi
pop esi
ret
Function at 0x4da860
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov al, byte [ebx + 0x15e]
sub esp, 0xc
test al, 2
je 0x4da87c
cmp word [ebx + 0x156], 0x10
mov byte [esp + 3], 1
jl 0x4da881
mov byte [esp + 3], 0
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea esi, [edi + 0x18]
mov ebp, 9
mov al, byte [esi + 0x115]
test al, al
je 0x4da8d9
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push 0x3e8
push ecx
push edx
call fcn.0062e0c0
mov ecx, dword [0x6ac824]
push ecx
mov ecx, dword [0x6ac820]
push ecx
push edx
push eax
call fcn.00639340
sub eax, dword [esi]
cmp eax, 0x1770
jle 0x4da8e9
mov ecx, 0x4c
xor eax, eax
lea edi, [esi - 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
add esi, 0x130
dec ebp
jne 0x4da890
mov edx, dword [ebx]
xor eax, eax
mov ecx, edi
cmp edx, dword [ecx]
je 0x4da94f
inc eax
add ecx, 0x130
cmp eax, 9
jl 0x4da8f8
xor eax, eax
mov ecx, edi
lea esp, [esp]
mov dl, byte [ecx + 0x12d]
test dl, dl
je 0x4da94f
inc eax
add ecx, 0x130
cmp eax, 9
jl 0x4da910
mov al, byte [esp + 0xf]
test al, al
je 0x4da946
xor eax, eax
mov cl, byte [edi + 0x12c]
test cl, cl
je 0x4da953
inc eax
add edi, 0x130
cmp eax, 9
jl 0x4da930
pop edi
pop esi
xor al, al
pop ebp
add esp, 0xc
ret
mov ebp, ecx
jmp 0x4da95e
mov ecx, 0x4c
xor eax, eax
mov ebp, edi
rep stosd dword es:[edi], eax
mov byte [ebp + 0x12d], 1
mov edx, ebx
mov ecx, dword [edx]
mov eax, ebp
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov edx, dword [edx + 0x14]
mov dword [eax + 0x14], edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push 0x3e8
push ecx
push edx
call fcn.0062e0c0
mov ecx, dword [0x6ac824]
push ecx
mov ecx, dword [0x6ac820]
push ecx
push edx
push eax
call fcn.00639340
mov dword [ebp + 0x18], eax
mov dx, word [ebx + 0x1c]
lea eax, [ebx + 0x1e]
mov word [ebp + 0x12a], dx
cmp word [eax], 0
push 0x3f
je 0x4da9e1
push eax
lea eax, [ebp + 0x1c]
push eax
jmp 0x4da9ea
push 0x669d70
lea ecx, [ebp + 0x1c]
push ecx
call fcn.00627c87
mov word [ebp + 0x9a], 0
mov dx, word [ebx + 0x154]
mov word [ebp + 0x120], dx
lea esi, [ebx + 0xd0]
lea edi, [ebp + 0x9c]
mov ecx, 0x21
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebx + 0x156]
mov word [ebp + 0x122], ax
mov cx, word [ebx + 0x158]
mov word [ebp + 0x124], cx
mov dx, word [ebx + 0x15a]
mov cl, byte [esp + 0x1b]
mov word [ebp + 0x126], dx
mov ax, word [ebx + 0x15c]
mov word [ebp + 0x128], ax
mov byte [ebp + 0x12c], cl
mov dl, byte [ebx + 0x15e]
shr dl, 2
and dl, 1
add esp, 0xc
cmp word [ebp + 0x120], 3
mov byte [ebp + 0x12e], dl
jne 0x4daa95
test byte [ebx + 0x15e], 8
je 0x4daa95
pop edi
mov eax, 1
pop esi
mov byte [ebp + 0x12f], al
pop ebp
add esp, 0xc
ret
pop edi
xor eax, eax
mov byte [ebp + 0x12f], al
pop esi
mov al, 1
pop ebp
add esp, 0xc
ret
Function at 0x4e0910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x73
mov byte [esp + 2], cl
mov byte [esp + 3], cl
mov cl, 0x20
mov dl, 0x61
mov byte [esp + 7], cl
mov byte [esp + 0xc], cl
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov dword [eax], 0
mov byte [esp], 0x6d
mov byte [esp + 1], 0x65
mov ecx, dword [esp]
mov byte [esp + 4], dl
mov dword [eax], ecx
mov byte [esp + 5], 0x67
mov byte [esp + 6], 0x65
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6e
mov ecx, dword [esp + 8]
mov byte [esp + 0xd], 0x62
mov byte [esp + 0xe], 0x6f
mov byte [esp + 0xf], 0x74
mov edx, dword [esp + 0xc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
add esp, 0x14
ret

Function at 0x4e16b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 4]
push eax
call esi
mov ecx, dword [esp + 0x10]
mov dl, byte [ecx + 6]
shr dl, 2
test dl, 1
je 0x4e1721
lea eax, [esp + 4]
push eax
call esi
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push 0x3e8
push ecx
push edx
call fcn.0062e0c0
mov ecx, dword [0x6ac824]
push ecx
mov ecx, dword [0x6ac820]
push ecx
push edx
push eax
call fcn.00639340
mov ecx, dword [0x71c218]
mov esi, eax
mov edx, esi
sub edx, ecx
cmp edx, 0x3a98
jbe 0x4e1721
call fcn.004e2fc0
mov dword [0x71c218], esi
mov al, 1
pop esi
add esp, 8
ret
Function at 0x4e32d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x270
push esi
push 0x66d8c4
mov esi, 0x71c230
call fcn.004e4250
push eax
call fcn.006243d6
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x30], esi
je 0x4e34e5
push esi
lea eax, [esp + 0x78]
push 0x200
push eax
call fcn.00625706
add esp, 0xc
test eax, eax
je 0x4e34dc
push ebx
push ebp
push edi
jmp 0x4e3320
cmp byte [esp + 0x80], 0x23
je 0x4e34b7
lea ecx, [esp + 0x80]
mov edx, ecx
push 0x2c
push edx
mov dword [esp + 0x18], ecx
call fcn.00625a30
add esp, 8
test eax, eax
je 0x4e34b7
mov byte [eax], 0
inc eax
push 0x2c
push eax
mov dword [esp + 0x1c], eax
call fcn.00625a30
mov esi, eax
add esp, 8
test esi, esi
je 0x4e336b
mov byte [esi], 0
inc esi
lea edi, [esp + 0x10]
call fcn.004e41f0
lea edi, [esp + 0x14]
call fcn.004e41f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.004e3a20
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4e34b7
test esi, esi
je 0x4e34b3
push 0x2c
push esi
call fcn.00625a30
add esp, 8
test eax, eax
je 0x4e34b7
push esi
mov byte [eax], 0
lea ebx, [eax + 1]
call fcn.00625b76
add esp, 4
mov edi, 0x66b0e0
mov esi, ebx
mov ecx, 3
xor edx, edx
mov word [ebp + 0x2e], ax
repe cmpsb byte [esi], byte es:[edi]
je 0x4e34b3
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x64]
push ecx
push str._32s__32s
push ebx
call fcn.006267c2
add esp, 0x10
cmp eax, 2
jne 0x4e34ac
xor edx, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x40], edx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x4c]
push str._02d:_02d:_02d
push eax
mov dword [esp + 0x2c], 0
call fcn.006267c2
add esp, 0x14
cmp eax, 3
jne 0x4e34ac
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x6c]
push str._04d__02d__02d
push ecx
call fcn.006267c2
add esp, 0x14
cmp eax, 3
jne 0x4e34ac
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
sub eax, 0x76c
lea edx, [esp + 0x18]
dec ebx
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], 0xffffffff
call fcn.006269b6
add esp, 4
cmp eax, 0xffffffff
mov dword [ebp + 0x34], eax
setne al
test al, al
jne 0x4e34b7
mov dword [ebp + 0x34], 0
mov byte [ebp + 0x30], 1
mov esi, dword [esp + 0x3c]
push esi
lea eax, [esp + 0x84]
push 0x200
push eax
call fcn.00625706
add esp, 0xc
test eax, eax
jne 0x4e3320
pop edi
pop ebp
pop ebx
push esi
call fcn.00624435
add esp, 4
pop esi
add esp, 0x270
ret
Function at 0x4ecae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
xor ebx, ebx
push esi
mov esi, eax
push edi
xor eax, eax
mov byte [esp + 0x20], bl
mov ecx, 0x24
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xbc]
mov eax, dword [ecx*4 + 0x65d490]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x30], edx
sub edx, eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x38], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], esi
lea edx, [eax - 1]
lea esi, [esp + 0x20]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
mov byte [esp + 0x20], 1
call fcn.004ecea0
mov eax, dword [esp + 0xcc]
cmp eax, ebx
jle 0x4ecca1
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xc8]
sub edx, ebp
mov ecx, ebp
sub esi, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
jmp 0x4ecbb0
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, edi
cmp dword [esp + 0xc0], ebx
jne 0x4ecbbd
xor edi, edi
jmp 0x4ecbc0
mov edi, dword [edx + ecx]
cmp dword [esp + 0xb8], ebx
mov ebp, dword [ecx]
jne 0x4ecbcf
xor esi, esi
jmp 0x4ecbd2
mov esi, dword [esi + ecx]
lea eax, [esp + 0x20]
call fcn.004ecd00
push esi
push ebp
push edi
lea eax, [esp + 0x2c]
call fcn.004ecda0
mov eax, dword [esp + 0x70]
add esp, 0xc
cmp eax, ebx
jg 0x4ecbfb
cmp byte [esp + 0xd0], bl
je 0x4ecc28
mov ecx, dword [esp + 0x60]
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x5c]
add eax, ecx
mov ecx, dword [esp + 0x58]
add edi, eax
sub esi, eax
add edx, eax
inc ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
cmp dword [esp + 0x28], 1
jne 0x4ecc52
mov dword [esp + 0x68], 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add ecx, 4
dec eax
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jne 0x4ecba2
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
mov edi, dword [edx*4 + 0x65d490]
xor eax, eax
cmp ecx, ebx
jle 0x4ecced
mov eax, dword [edi + 0x14]
cmp eax, 1
jle 0x4ecce6
movzx esi, byte [eax + 0x65d56f]
mov eax, dword [esp + 0x58]
dec eax
mov dword [esp + 0x14], eax
push esi
lea ecx, [esp + 0x18]
lea eax, [esp + 0x40]
call fcn.004cf930
add esp, 4
mov dword [esp + 0xac], esi
mov eax, dword [edi + 0xc]
add eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x506360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x74]
jmp 0x506370
mov ecx, dword [0x85ff50]
mov edx, dword [ecx + 0x34]
mov eax, edi
and eax, 0xffff
lea eax, [eax + eax*2]
mov ebp, dword [edx + eax*4 + 8]
cmp edi, dword [esp + 0x88]
je 0x5065b1
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x5065b1
test eax, 0x1000000
jne 0x5065b1
test byte [ebp + 0x106], 4
je 0x5063c1
cmp word [ebp + 0xb4], 0
je 0x5065b1
fld dword [esp + 0x7c]
mov esi, dword [esp + 0x78]
fadd dword [ebp + 0xac]
fld dword [ebp + 0xa0]
fsub dword [esi]
fld dword [ebp + 0xa4]
fsub dword [esi + 4]
fld dword [ebp + 0xa8]
fsub dword [esi + 8]
fld st(2)
fmul st(3)
fld st(1)
fmul st(2)
faddp st(1)
fld st(2)
fmul st(3)
faddp st(1)
fld st(4)
fmul st(5)
fcompp
fstp st(0)
fstp st(0)
fnstsw ax
fstp st(0)
test ah, 1
fstp st(0)
jne 0x5065b1
movsx eax, word [ebp + 0xb4]
mov edx, dword [esp + 0x70]
lea ecx, [eax + 8]
mov ebx, 1
shl ebx, cl
test edx, ebx
je case.0x50643f.2
cmp eax, 8
ja case.0x50643f.2
movzx ecx, byte [eax + 0x5065d4]
jmp dword [ecx*4 + 0x5065c8]
test edx, 0x200000
je 0x50645b
test byte [ebp + 0x4cc], 0x10
jne case.0x50643f.2
mov ecx, dword [ebp + 0x11c]
mov eax, 0xffffffff
cmp ecx, eax
je 0x506477
cmp word [ebp + 0x2f0], ax
jne case.0x50643f.2
lea edx, [esp + 0x74]
push edx
lea ebx, [esp + 0x14]
lea eax, [esp + 0x18]
mov ecx, edi
call fcn.0055a710
fld dword [esp + 0x20]
fadd dword [esp + 0x78]
mov ecx, dword [esp + 0x90]
add esp, 4
push 0xff
fstp dword [esp + 0x20]
push 0
fld dword [esp + 0x18]
push 0xffffffffffffffff
fadd dword [esp + 0x90]
push edi
sub esp, 8
or edi, 0xffffffff
fstp dword [esp + 4]
lea esi, [esp + 0x2c]
fld dword [esp + 0x8c]
fadd dword [esp + 0x98]
fstp dword [esp]
call fcn.00503500
mov esi, dword [esp + 0x90]
jmp 0x506569
mov ebx, 1
mov ecx, eax
shl ebx, cl
test bl, 2
je 0x506531
test edx, 0x400000
je 0x506531
mov ebx, edi
lea eax, [esp + 0x30]
call fcn.00507650
test al, al
je case.0x50643f.2
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
push eax
push ecx
push edx
lea ebx, [esp + 0x3c]
call fcn.00507930
add esp, 0xc
jmp case.0x50643f.2
lea ecx, [esp + 0x20]
call fcn.00504fb0
test al, al
je case.0x50643f.2
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0x80]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.005053a0
add esp, 0x18
mov eax, dword [ebp + 0x118]
cmp eax, 0xffffffff
je 0x5065b1
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push ecx
push edx
push esi
push eax
mov eax, dword [esp + 0x8c]
push eax
call fcn.00506360
add esp, 0x20
mov edi, dword [ebp + 0x114]
cmp edi, 0xffffffff
jne 0x506370
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x5077b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
lea ebp, [edi + 8]
lea edx, [esp + 0x20]
mov esi, eax
mov ecx, ebp
mov byte [esp + 0xf], 0
mov dword [ebx], 0x7f7fffff
call fcn.004cbfc0
mov edx, dword [esp + 0x40]
push ebp
lea eax, [esp + 0x18]
call fcn.004cc050
mov ecx, dword [edi + 4]
mov eax, dword [ecx + 0x74]
add esp, 4
xor esi, esi
test eax, eax
jle 0x507921
xor eax, eax
jmp 0x507800
mov edi, dword [ecx + 0x78]
shl eax, 7
mov ecx, dword [eax + edi + 0x68]
add eax, edi
push ecx
add eax, 0x38
push eax
lea ecx, [esp + 0x34]
lea edi, [esp + 0x18]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x28]
call fcn.004ce3e0
add esp, 8
test al, al
je 0x507895
fld dword [ebx]
fcomp dword [esp + 0x10]
fnstsw ax
test ah, 0x41
jne 0x507895
fld dword [esp + 0x14]
mov edx, dword [esp + 0x10]
fmul dword [esp + 0x10]
mov dword [ebx], edx
mov edx, dword [esp + 0x2c]
lea eax, [ebx + 4]
fadd dword [esp + 0x20]
mov ecx, eax
fld dword [esp + 0x18]
mov dword [ecx], edx
fmul dword [esp + 0x10]
mov edx, dword [esp + 0x30]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x34]
fadd dword [esp + 0x24]
mov dword [ecx + 8], edx
fld dword [esp + 0x1c]
mov byte [esp + 0xf], 1
fmul dword [esp + 0x10]
fadd dword [esp + 0x28]
fmul dword [eax + 8]
fxch st(1)
fmul dword [eax + 4]
faddp st(1)
fxch st(1)
fmul dword [eax]
faddp st(1)
fstp dword [eax + 0xc]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x74]
inc esi
movsx eax, si
cmp eax, edx
jl 0x507800
mov al, byte [esp + 0xf]
test al, al
je 0x507925
fld dword [ebx + 4]
pop edi
fld dword [ebx + 8]
pop esi
fld dword [ebx + 0xc]
fld st(0)
fmul dword [ebp + 0x1c]
fld st(2)
fmul dword [ebp + 0x10]
faddp st(1)
fld st(3)
fmul dword [ebp + 4]
faddp st(1)
fstp dword [ebx + 4]
fld st(0)
fmul dword [ebp + 0x20]
fld st(2)
fmul dword [ebp + 0x14]
faddp st(1)
fld st(3)
fmul dword [ebp + 8]
faddp st(1)
fstp dword [ebx + 8]
fmul dword [ebp + 0x24]
fxch st(1)
fmul dword [ebp + 0x18]
faddp st(1)
fxch st(1)
fmul dword [ebp + 0xc]
faddp st(1)
fst dword [ebx + 0xc]
fmul dword [ebp + 0x30]
fld dword [ebp + 0x2c]
fmul dword [ebx + 8]
faddp st(1)
fld dword [ebx + 0x10]
fmul dword [ebp]
faddp st(1)
fld dword [ebp + 0x28]
pop ebp
fmul dword [ebx + 4]
faddp st(1)
fstp dword [ebx + 0x10]
add esp, 0x2c
ret
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
add esp, 0x2c
ret