joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8ce0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
sub esp, 8
mov eax, dword [0x6400a0]
test eax, eax
je 0x4f8d72
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4f8d0b
cmp dword [eax + 4], 0
mov esi, eax
je 0x4f8d0b
add esi, 8
jmp 0x4f8d23
mov eax, dword [0x6400a0]
test eax, eax
je 0x4f8d81
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor esi, esi
cmp eax, 1
jne 0x4f8d2a
mov eax, esi
add esp, 8
pop esi
ret
test eax, eax
mov esi, eax
jne 0x4f8d96
movzx eax, byte [0x640d9c]
mov ecx, 0xc
mov edx, 4
call fcn.00403fe0
test eax, eax
je 0x4f8dd9
mov dword [eax], 0x6400a0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x6400a0]
test eax, eax
jne 0x4f8d8d
mov ecx, 0x6400a0
call fcn.00579700
jmp 0x4f8d8e
mov ecx, 0x6400a0
call fcn.00579700
jmp 0x4f8cf2
mov ecx, 0x6400a0
call fcn.00579700
jmp 0x4f8d15
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.00579e00
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x4f8d06
test ecx, ecx
je 0x4f8d06
lock dec dword [ecx]
jne 0x4f8d06
lea ecx, [esp + 4]
call fcn.004f8df0
jmp 0x4f8d06
mov ecx, 4
mov edx, 0xc
call fcn.00576700
ud2

Function at 0x4f8f90
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x6400c0]
test eax, eax
je 0x4f9075
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4f8fc1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4f906a
mov eax, dword [0x6400c0]
test eax, eax
je 0x4f9084
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4f9047
mov esi, eax
test eax, eax
jne 0x4f9027
movzx eax, byte [0x640d9c]
mov ecx, 0x20
mov edx, 8
call fcn.00403fe0
test eax, eax
je 0x4f909f
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x6400c0
mov esi, eax
mov eax, dword [0x6400c0]
test eax, eax
je 0x4f9093
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x4f904b
movaps xmm0, xmmword [esp]
jmp 0x4f9059
xor esi, esi
jmp 0x4f906d
lea ecx, [esp + 0x10]
call fcn.004f2980
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x6400c0
call fcn.00579700
jmp 0x4f8fa8
mov ecx, 0x6400c0
call fcn.00579700
jmp 0x4f8fcf
mov ecx, 0x6400c0
call fcn.00579700
jmp 0x4f901f
mov ecx, 8
mov edx, 0x20
call fcn.00576700
ud2
Function at 0x4fc29d
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x48]
mov edx, dword [edx + 0x50]
push 0x621cd0
push dword [edi + 0x40]
call fcn.004fc1f4
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x70]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x4fc3db
test eax, eax
je 0x4fc369
cmp eax, 0x90317
je 0x4fc3d4
cmp eax, 0x90321
jne 0x4fc3e8
mov dword [edi + 8], 0x10000
mov byte [edi + 0xc], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x40]
jne 0x4fc354
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.004fc223
and dword [edi + 0x90], 0
jmp 0x4fc3f9
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x48]
mov edx, dword [edi + 0x50]
mov ebp, dword [esp + 0xc]
and dword [edi + 0x38], 0
lea ebx, [edi + 0x30]
sub eax, ecx
add ebp, eax
push 0x621ce0
push ebp
push eax
call fcn.004fc411
add esp, 0xc
mov ebp, edx
mov edx, eax
mov ecx, ebx
add ebp, eax
push ebp
call fcn.00461899
pop eax
and dword [edi + 0x2c], 0
and dword [edi + 0x28], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x40]
jne 0x4fc3b8
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.004fc223
mov eax, dword [edi + 0x40]
xor ecx, ecx
or eax, dword [edi + 0x44]
sete cl
mov dword [edi + 0x90], ecx
jmp 0x4fc3f9
mov word [esi], 0x104
jmp 0x4fc3fe
cmp dword [esp + 0x10], 4
jne 0x4fc3f0
mov eax, dword [esp + 0xc]
jmp 0x4fc3f3
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4fc3fe
xor eax, eax
inc eax
mov dword [edi + 0x90], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4fde8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x4fdec9
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x4fded3
mov dword [esp + 4], 0
jmp 0x4fdee6
mov dword [esp + 4], 0
jmp 0x4fdee6
call fcn.004fde6d
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x4fdf0e
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.004618ca
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x4fdf3d
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x624ed4
push esi
push eax
call fcn.0045c462
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.004fe0a7
pop eax
cmp byte [esp + 8], 4
je 0x4fdf95
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x4fe07f
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fae84
pop eax
jmp 0x4fdef6
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4fe094
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x62d914
push eax
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x62d924
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x4fdef4
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x4fdef4
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.004fe14a
add esp, 0x10
cmp byte [esp + 8], 4
je 0x4fe043
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x4fe07f
mov ecx, ebp
call fcn.0051f916
jmp 0x4fe014
mov edx, dword [esp + 0xc]
test edx, edx
je 0x4fe09a
xor ecx, ecx
push 0x624ee4
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.0045c462
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00461899
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x4fdef4
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x4fe09c
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x4fe08c
Function at 0x50012d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x50016a
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x500174
mov dword [esp + 4], 0
jmp 0x500187
mov dword [esp + 4], 0
jmp 0x500187
call fcn.004fde6d
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x5001af
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.004618ca
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x5001de
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x624ed4
push esi
push eax
call fcn.0045c462
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.00500348
pop eax
cmp byte [esp + 8], 4
je 0x500236
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x500320
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fae84
pop eax
jmp 0x500197
mov esi, dword [esp + 0x28]
test esi, esi
je 0x500335
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x62d914
push eax
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x62d924
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x500195
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x500195
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.004ffeae
add esp, 0x10
cmp byte [esp + 8], 4
je 0x5002e4
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x500320
mov ecx, ebp
call fcn.0051f916
jmp 0x5002b5
mov edx, dword [esp + 0xc]
test edx, edx
je 0x50033b
xor ecx, ecx
push 0x624ee4
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.0045c462
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00461899
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x500195
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x50033d
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x50032d
Function at 0x5003eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x500428
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x500432
mov dword [esp + 4], 0
jmp 0x500445
mov dword [esp + 4], 0
jmp 0x500445
call fcn.004fde6d
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x50046d
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.004618ca
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x50049c
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x624ed4
push esi
push eax
call fcn.0045c462
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], eax
sub esp, 4
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push ebp
call fcn.0050060a
add esp, 0x10
cmp byte [esp + 8], 4
je 0x5004f8
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x5005e2
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fae84
pop eax
jmp 0x500455
mov esi, dword [esp + 0x28]
test esi, esi
je 0x5005f7
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x62d914
push eax
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x62d924
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x500453
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x500453
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.00500673
add esp, 0x10
cmp byte [esp + 8], 4
je 0x5005a6
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x5005e2
mov ecx, ebp
call fcn.0051f916
jmp 0x500577
mov edx, dword [esp + 0xc]
test edx, edx
je 0x5005fd
xor ecx, ecx
push 0x624ee4
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.0045c462
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00461899
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x500453
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x5005ff
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x5005ef
Function at 0x5007a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x5007e5
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x5007ef
mov dword [esp + 4], 0
jmp 0x500802
mov dword [esp + 4], 0
jmp 0x500802
call fcn.004fde6d
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x50082a
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.004618ca
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x500859
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x624ed4
push esi
push eax
call fcn.0045c462
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.005009c3
pop eax
cmp byte [esp + 8], 4
je 0x5008b1
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x50099b
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fae84
pop eax
jmp 0x500812
mov esi, dword [esp + 0x28]
test esi, esi
je 0x5009b0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x62d914
push eax
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x62d924
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x500810
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x500810
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.00500a66
add esp, 0x10
cmp byte [esp + 8], 4
je 0x50095f
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x50099b
mov ecx, ebp
call fcn.0051f916
jmp 0x500930
mov edx, dword [esp + 0xc]
test edx, edx
je 0x5009b6
xor ecx, ecx
push 0x624ee4
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.0045c462
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00461899
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x500810
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x5009b8
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x5009a8
Function at 0x500b85
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x500bc2
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x500bcc
mov dword [esp + 4], 0
jmp 0x500bdf
mov dword [esp + 4], 0
jmp 0x500bdf
call fcn.004fde6d
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x500c07
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.004618ca
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x500c36
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x624ed4
push esi
push eax
call fcn.0045c462
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.00500d9c
pop eax
cmp byte [esp + 8], 4
je 0x500c8e
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x500d74
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fae84
pop eax
jmp 0x500bef
mov esi, dword [esp + 0x28]
test esi, esi
je 0x500d89
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x62d914
push eax
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x62d924
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x500bed
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x500bed
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
sub esp, 8
push dword [esp + 0x24]
push ebp
call fcn.00500e3b
add esp, 0x10
cmp byte [esp + 8], 4
je 0x500d38
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x500d74
mov ecx, ebp
call fcn.0051f916
jmp 0x500d0d
mov edx, dword [esp + 0xc]
test edx, edx
je 0x500d8f
xor ecx, ecx
push 0x624ee4
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.0045c462
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00461899
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x500bed
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x500d91
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x500d81
Function at 0x500fd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x501011
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x50101b
mov dword [esp + 4], 0
jmp 0x50102e
mov dword [esp + 4], 0
jmp 0x50102e
call fcn.004fde6d
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x501056
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.004618ca
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x501085
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x624ed4
push esi
push eax
call fcn.0045c462
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.005011ef
pop eax
cmp byte [esp + 8], 4
je 0x5010dd
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x5011c7
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fae84
pop eax
jmp 0x50103e
mov esi, dword [esp + 0x28]
test esi, esi
je 0x5011dc
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x62d914
push eax
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x62d924
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.0045c462
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x50103c
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x50103c
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
push 0x20
lea eax, [esp + 0x40]
push eax
call fcn.00501298
pop eax
pop ecx
cmp byte [esp + 8], 4
je 0x50118b
mov ecx, ebp
call fcn.004fdb10
test al, al
je 0x5011c7
mov ecx, ebp
call fcn.0051f916
jmp 0x50115c
mov edx, dword [esp + 0xc]
test edx, edx
je 0x5011e2
xor ecx, ecx
push 0x624ee4
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.0045c462
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00461899
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x50103c
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x5011e4
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x5011d4