joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2730
Capabilities:
Get number of processors

Disassembly:
jmp 0x4b2730
push 0xffffffffffffffff
push 0x6a5217
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x774458]
xor eax, esp
mov dword [esp + 0xdc], eax
push ebx
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
mov esi, ecx
push str.RUTADEF
lea eax, [esp + 0x60]
push eax
lea ecx, [esi + 0x30]
call fcn.0040de9a
mov ecx, dword [esi + 0x88]
push ecx
lea edx, [esp + 0x34]
push edx
mov ecx, eax
mov dword [esp + 0x100], 0
call fcn.004045d4
mov bl, 2
lea ecx, [esp + 0x5c]
mov byte [esp + 0xf8], bl
call fcn.00406cda
mov ecx, dword [esi + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0x64
lea eax, [esp + 0x8c]
push eax
push 0x4d3
push ecx
call edi
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0x14]
call fcn.004024af
lea eax, [esp + 0x10]
push eax
push str.NOMBRE
lea ecx, [esp + 0x38]
mov byte [esp + 0x100], 3
call fcn.0040c65d
lea ecx, [esp + 0x10]
mov byte [esp + 0xf8], bl
call fcn.0040934a
mov ecx, dword [esi + 0x14]
push 0
push 0
push 0x147
push 0x4b7
push ecx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edx, dword [eax*4 + 0x755df8]
push edx
lea ecx, [esp + 0x14]
call fcn.004024af
lea eax, [esp + 0x10]
push eax
push str.TIPORUTA
lea ecx, [esp + 0x38]
mov byte [esp + 0x100], 4
call fcn.0040c65d
lea ecx, [esp + 0x10]
mov byte [esp + 0xf8], bl
call fcn.0040934a
mov edx, dword [esi + 0x14]
push 0x64
lea ecx, [esp + 0x8c]
push ecx
push 0x4a9
push edx
call edi
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x14]
call fcn.004024af
lea ecx, [esp + 0x10]
push ecx
push 0x6e4ff4
lea ecx, [esp + 0x38]
mov byte [esp + 0x100], 5
call fcn.0040c65d
lea ecx, [esp + 0x10]
mov byte [esp + 0xf8], bl
call fcn.0040934a
lea ecx, [esp + 0x30]
call fcn.00405cf9
lea ecx, [esp + 0x30]
mov dword [esp + 0xf8], 0xffffffff
call fcn.00406cda
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xdc]
xor ecx, esp
call fcn.00651675
add esp, 0xec
ret
Function at 0x4b2960
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
jmp 0x4b2960
push 0xffffffffffffffff
push 0x6a528c
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x774458]
xor eax, esp
mov dword [esp + 0xc4], eax
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x5c]
push str.RUTADEF
lea eax, [esp + 0x50]
push eax
call fcn.00401b9a
mov ecx, dword [edi + 0x88]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, eax
mov dword [esp + 0xe4], 0
call fcn.0040204a
lea ecx, [esp + 0x4c]
mov byte [esp + 0xdc], 2
call fcn.0040934a
push str.TIPORUTA
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
call fcn.00401b9a
push 0x64
lea ecx, [esp + 0x70]
push ecx
mov ecx, eax
mov byte [esp + 0xe4], 3
call fcn.0040470f
lea ecx, [esp + 0xc]
mov byte [esp + 0xdc], 2
call fcn.0040934a
xor esi, esi
jmp 0x4b2a20
mov ecx, dword [esi*4 + 0x755df8]
lea eax, [esp + 0x6c]
jmp 0x4b2a30
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4b2a50
test dl, dl
je 0x4b2a4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4b2a50
add eax, 2
add ecx, 2
test dl, dl
jne 0x4b2a30
xor eax, eax
jmp 0x4b2a55
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4b2a63
add esi, 1
cmp esi, 5
jl 0x4b2a20
jmp 0x4b2a7a
mov edx, dword [edi + 0x14]
push 0
push esi
push 0x14e
push 0x4b7
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x6e4ff4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
call fcn.00401b9a
push 0x64
lea ecx, [esp + 0x70]
push ecx
mov ecx, eax
mov byte [esp + 0xe4], 4
call fcn.0040470f
lea ecx, [esp + 0xc]
mov byte [esp + 0xdc], 2
call fcn.0040934a
mov eax, dword [edi + 0x14]
lea edx, [esp + 0x6c]
push edx
push 0x4a9
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xdc], 0xffffffff
call fcn.0040934a
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.00651675
add esp, 0xd4
ret
Function at 0x4be8a0
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4be8a0
push 0xffffffffffffffff
push 0x6a6571
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x774458]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov esi, dword [esp + 0xf0]
mov ebp, dword [esp + 0xf4]
imul esi, esi, 0xb0
mov edi, ecx
mov eax, dword [edi + 0x60]
lea ecx, [eax + esi + 0xc]
lea ebx, [edi + 0x30]
push ecx
mov ecx, ebx
call fcn.0040d99a
test eax, eax
jne 0x4be968
push ebp
lea edx, [esp + 0x90]
push str._s____
push edx
call fcn.00651689
add esp, 0xc
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x18]
call fcn.004024af
mov edx, dword [edi + 0x60]
lea ecx, [esp + 0x14]
push ecx
lea eax, [edx + esi + 0xc]
push eax
mov ecx, ebx
mov dword [esp + 0xf0], 0
call fcn.00408558
lea ecx, [esp + 0x14]
mov dword [esp + 0xe8], 0xffffffff
call fcn.0040934a
mov ecx, ebx
call fcn.00403283
mov ecx, dword [edi + 0x60]
lea edx, [ecx + esi + 0xc]
push edx
lea eax, [esp + 0x38]
push eax
mov ecx, ebx
call fcn.0040de9a
mov ebx, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0xe8], ebx
call fcn.0040cf1d
cmp eax, 2
jne 0x4be9cf
push ebx
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x3c]
call fcn.004045d4
add edi, 0x24
push edi
lea edx, [esp + 0x64]
push edx
push ebp
mov byte [esp + 0xf4], 2
call fcn.0040504c
add esp, 0xc
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], bl
call fcn.00406cda
lea ecx, [esp + 0x34]
mov dword [esp + 0xe8], 0xffffffff
call fcn.00406cda
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00651675
add esp, 0xd8
ret 8
Function at 0x4c0b70
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x4c0b70
sub esp, 0x1ec
mov eax, dword [0x774458]
xor eax, esp
mov dword [esp + 0x1e8], eax
mov eax, dword [esp + 0x1f4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ebp
push esi
push edi
mov edi, dword [esp + 0x200]
push 0
push 0
push 0x14b
mov esi, ecx
mov ecx, dword [esi + 0x14]
push edi
push ecx
mov dword [esp + 0x24], eax
call ebx
mov edx, dword [esi + 0x14]
push 0
push 0
push 0x151
push edi
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.DATOSRECURSOSELEM_
call fcn.0062a670
push eax
lea eax, [esp + 0x17c]
push 0x6e6320
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x178]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4c0c8d
lea esp, [esp]
xor eax, eax
mov cl, byte [esp + eax + 0x40]
mov byte [esp + eax + 0x154], cl
add eax, 1
test cl, cl
jne 0x4c0c12
lea eax, [esp + 0x154]
push eax
call fcn.006541c7
lea ecx, [esp + 0x158]
push 0x6e3c90
push ecx
call fcn.00652d00
add esp, 0xc
test eax, eax
je 0x4c0c4d
mov byte [eax], 0
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x154]
push edx
push 0
push 0x143
push edi
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c0c10
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esi + 0x14]
push 0x6e0280
push 0
push 0x143
push edi
push edx
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c0cb7
push eax
mov eax, dword [esi + 0x14]
push 0
push 0x14c
push edi
push eax
call ebx
test eax, eax
jl 0x4c0cb7
mov ecx, dword [esi + 0x14]
push 0
push eax
push 0x14e
push edi
push ecx
call ebx
mov ecx, dword [esp + 0x1f8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00651675
add esp, 0x1ec
ret 8
Function at 0x4cddb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x4cddb0
push 0xffffffffffffffff
push 0x6a81e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0xffffffffffffffff
push eax
push ecx
push edx
push str.D_EA_VACIA
mov ecx, esi
call fcn.0040908e
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x20], 0
mov dword [esi], vtable.WinEditVariable.2.0
mov dword [esi + 0x1c], vtable.WinEditVariable.1.0
mov dword [esi + 0x24], vtable.WinEditVariable.0
mov dword [esi + 0x60], eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, esi
call fcn.00409700
mov ecx, esi
call fcn.004017df
push 0x20
call fcn.00651953
mov edi, eax
add esp, 4
mov dword [esp + 0x30], edi
test edi, edi
mov byte [esp + 0x18], 1
je 0x4cde62
push esi
mov ecx, edi
call fcn.00408f53
mov dword [edi], vtable.ClassEXYZ.0
mov dword [esi + 0x6c], edi
jmp 0x4cde67
xor eax, eax
mov dword [esi + 0x6c], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14

Function at 0x4db530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x4db530
push 0xffffffffffffffff
push 0x6a954c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 0x1c]
fld dword [ecx]
fsub dword [eax + 8]
add eax, 8
test byte [0x77f298], 1
fstp dword [esp + 0x30]
fld dword [ecx + 4]
fsub dword [eax + 4]
fstp dword [esp + 0xc]
fld dword [ecx + 8]
fsub dword [eax + 8]
fstp dword [esp + 0x10]
fld dword [esp + 0x30]
fstp dword [esp + 0x14]
fld dword [esp + 0xc]
fstp dword [esp + 0x18]
fld dword [esp + 0x10]
fstp dword [esp + 0x1c]
jne 0x4db5c8
or dword [0x77f298], 1
push str.MSGO_MOTOR_SETANG
mov dword [esp + 0x2c], 0
call fcn.0040cb0d
add esp, 4
mov dword [0x77f294], eax
mov dword [esp + 0x28], 0xffffffff
mov edi, dword [esi + 0x20]
lea ecx, [esp + 0x14]
call fcn.0040672b
fstp dword [esp + 0x30]
mov eax, dword [esi + 0x1c]
cmp dword [eax + 0x208], 0
je 0x4db603
mov ecx, dword [eax + 0x208]
fld dword [esp + 0x30]
mov eax, dword [ecx]
mov edx, dword [0x77f294]
mov eax, dword [eax + 0xc]
push edi
push ecx
fstp dword [esp]
push 0
push edx
call eax
mov eax, 2
test byte [0x77f298], al
jne 0x4db638
or dword [0x77f298], eax
push str.MSGA_FIJAR_VISTA
mov dword [esp + 0x2c], 1
call fcn.0040cb0d
add esp, 4
mov dword [0x77f290], eax
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x4c]
lea eax, [esi + 0x94]
push eax
mov eax, dword [0x77f290]
add esi, 0xac
push esi
push eax
call edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x4db6c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x4db6c0
push 0xffffffffffffffff
push 0x6a958e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x30]
mov eax, dword [edi + 0x1c]
fld dword [esi]
fsub dword [eax + 8]
add eax, 8
lea ecx, [esp + 0x14]
fstp dword [esp + 0x30]
fld dword [esi + 4]
fsub dword [eax + 4]
fstp dword [esp + 0xc]
fld dword [esi + 8]
fsub dword [eax + 8]
fstp dword [esp + 0x10]
fld dword [esp + 0x30]
fstp dword [esp + 0x14]
fld dword [esp + 0xc]
fstp dword [esp + 0x18]
fld dword [esp + 0x10]
fstp dword [esp + 0x1c]
call fcn.0040672b
push esi
fstp dword [esp + 0x34]
mov ecx, edi
call fcn.0040286a
mov eax, 1
test byte [0x77f2a0], al
jne 0x4db770
or dword [0x77f2a0], eax
push str.MSGA_APUNTAR_AT
mov dword [esp + 0x2c], 0
call fcn.0040cb0d
add esp, 4
mov dword [0x77f29c], eax
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
push 0
lea edx, [esp + 0x34]
push edx
mov edx, dword [0x77f29c]
push edx
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x4e5c90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x4e5c90
push 0xffffffffffffffff
push 0x6aa738
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 1
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0040748c
fldz
mov dword [esi], vtable.ClassAcBoundAround.0
fst dword [esi + 0x30]
fst dword [esi + 0x2c]
push esi
fst dword [esi + 0x28]
mov dword [esp + 0x18], 0
fst dword [esi + 0x3c]
fst dword [esi + 0x38]
fstp dword [esi + 0x34]
mov ecx, dword [esi]
mov dword [0x77f4f4], ecx
call fcn.0040b690
mov eax, dword [esi + 0x1c]
add esp, 4
mov dword [esi + 0x24], 2
mov dword [esi + 0x48], 0x12c
mov dword [esi + 0x44], 0
or dword [eax + 0x228], 0x100000
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x4e9c80
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4e9c80
push 0xffffffffffffffff
push 0x6aaf33
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ClassAcCaeCarga12.0
lea ecx, [esi + 0xbc]
mov dword [esp + 0x14], 1
call fcn.0040d427
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.0040d427
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00405ad8
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4f7d30
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4f7d30
jmp 0x4f7f80
push 0xffffffffffffffff
push 0x6acd8e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
push 1
call fcn.00406f8c
mov eax, dword [esi + 0x50]
fld dword [eax + 0x58]
mov dword [esi + 0x54], eax
fadd dword [esi + 0x30]
lea edi, [esi + 0x34]
fstp dword [esi + 0x30]
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x30]
mov dword [edi], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
fld dword [esi + 0x28]
fsub dword [eax + 8]
add eax, 8
test byte [0x77f98c], 1
fstp dword [esp + 0xc]
fld dword [esi + 0x2c]
fsub dword [eax + 4]
fstp dword [esp + 0x10]
fld dword [esp + 0xc]
fld dword [esp + 0x10]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
fstp dword [esi + 0x40]
jne 0x4f7de0
or dword [0x77f98c], 1
push str.MSGA_FIJAR_VISTA
mov dword [esp + 0x20], 0
call fcn.0040cb0d
add esp, 4
mov dword [0x77f988], eax
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
push edi
add edx, 0x14
push edx
mov edx, dword [0x77f988]
push edx
call eax
mov dword [esi + 0x4c], 2
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4f801a
test dword [eax + 0x228], 0x1000
jne 0x4f800e
mov ecx, dword [eax + 0x180]
cmp dword [ecx], 2
je 0x4f801a
mov ecx, dword [esi + 0x54]
cmp eax, ecx
je 0x4f7ff3
test ecx, ecx
je 0x4f7fe8
mov edx, dword [esi + 0x1c]
add edx, 8
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x28]
call fcn.0040b69a
fld dword [eax + 4]
fld dword [eax]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
fstp dword [esp + 4]
fld dword [esp + 4]
fld dword [esi + 0x40]
fcompp
fnstsw ax
test ah, 0x41
jne 0x4f801a
mov ecx, esi
pop esi
add esp, 0x10
jmp 0x40b80c
lea ecx, [esi + 0x28]
push ecx
lea ecx, [esi + 0x34]
call fcn.00405119
test eax, eax
je 0x4f801a
mov ecx, esi
pop esi
add esp, 0x10
jmp 0x40b80c
cmp eax, dword [esi + 0x54]
jne 0x4f801a
mov dword [esi + 0x4c], 3
pop esi
add esp, 0x10
ret
Function at 0x4fa840
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4fa840
jmp 0x4fa950
push 0xffffffffffffffff
push 0x6ad38e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
push 1
call fcn.00402167
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x2c]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x34], ecx
lea edi, [esi + 0x34]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
fld dword [esi + 0x28]
mov eax, dword [esi + 0x1c]
fsub dword [eax + 8]
add eax, 8
test byte [0x77fa38], 1
fstp dword [esp + 0xc]
fld dword [esi + 0x2c]
fsub dword [eax + 4]
fstp dword [esp + 0x10]
fld dword [esp + 0xc]
fld dword [esp + 0x10]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
fstp dword [esi + 0x40]
jne 0x4fa8e8
or dword [0x77fa38], 1
push str.MSGA_FIJAR_VISTA
mov dword [esp + 0x20], 0
call fcn.0040cb0d
add esp, 4
mov dword [0x77fa34], eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x4c]
push edi
add eax, 0x14
push eax
mov eax, dword [0x77fa34]
push eax
call edx
mov dword [esi + 0x50], 2
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
test eax, eax
je 0x4fa9ea
test dword [eax + 0x228], 0x1000
jne 0x4fa9de
mov ecx, dword [eax + 0x180]
cmp dword [ecx], 2
je 0x4fa9ea
mov ecx, dword [esi + 0x58]
cmp eax, ecx
je 0x4fa9c3
test ecx, ecx
je 0x4fa9b8
mov edx, dword [esi + 0x1c]
add edx, 8
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x28]
call fcn.0040b69a
fld dword [eax + 4]
fld dword [eax]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
fstp dword [esp + 4]
fld dword [esp + 4]
fld dword [esi + 0x40]
fcompp
fnstsw ax
test ah, 0x41
jne 0x4fa9ea
mov ecx, esi
pop esi
add esp, 0x10
jmp 0x401e0b
lea ecx, [esi + 0x28]
push ecx
lea ecx, [esi + 0x34]
call fcn.00405119
test eax, eax
je 0x4fa9ea
mov ecx, esi
pop esi
add esp, 0x10
jmp 0x401e0b
cmp eax, dword [esi + 0x58]
jne 0x4fa9ea
mov dword [esi + 0x50], 3
pop esi
add esp, 0x10
ret
Function at 0x505560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test byte [eax + 0x38], 2
push edi
je 0x505583
mov ecx, dword [0x7b72f0]
push eax
call fcn.00619940
mov eax, dword [esi + 0x1c]
test byte [eax + 0x38], 8
je 0x505598
mov ecx, dword [0x7b72f0]
push eax
call fcn.006197f0
mov ecx, 1
mov dword [esi + 0x7c], ecx
mov eax, dword [esi + 0x70]
xor edi, edi
cmp eax, edi
je 0x5055ac
mov dword [eax + 8], ecx
mov dword [esi + 0x78], ecx
mov eax, dword [esi + 0x68]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x2c], ecx
fild dword [esp + 0x2c]
jge 0x5055c6
fadd dword [0x6ddeec]
cmp eax, edi
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
fld st(0)
fdivr qword [0x6defd8]
fstp dword [esp + 0x28]
fld dword [0x6e0d90]
fstp dword [esp + 0x10]
fdivr qword [0x6e2568]
fstp dword [esp + 0x2c]
fld dword [0x6dcf1c]
fstp dword [esp + 0x14]
jbe 0x505727
fld dword [esp + 0x10]
mov edx, dword [esi + 0x6c]
fst dword [esp + 0x3c]
lea eax, [edx + edi + 8]
fld qword [0x6de3f8]
fmul st(1)
fstp dword [esp + 0x40]
fld dword [esi + 0x28]
fadd dword [esp + 0x3c]
fstp dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
fld dword [esi + 0x2c]
fadd dword [esp + 0x40]
fstp dword [esp + 0x34]
mov edx, dword [esp + 0x34]
fld dword [esi + 0x30]
mov dword [eax], ecx
fadd qword [0x6e6870]
mov dword [eax + 4], edx
fstp dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
mov dword [eax + 8], ecx
fabs
mov edx, dword [esi + 0x6c]
fstp dword [esp + 0x18]
lea ebx, [edx + edi + 0x14]
fld dword [esp + 0x18]
fmul qword [0x6ed650]
fsubr qword [0x6de408]
fstp dword [esp + 0x18]
fld dword [esp + 0x14]
fadd qword [0x6dd1a0]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fmul qword [0x6dd478]
fst qword [esp + 0x20]
call fcn.00651ec0
fmul dword [esp + 0x18]
fstp dword [ebx]
fld qword [esp + 0x20]
call fcn.00651d90
fmul dword [esp + 0x18]
lea ecx, [esi + 0xc4]
fstp dword [ebx + 4]
call fcn.0040bf6e
xor edx, edx
mov ecx, 3
div ecx
sub edx, 1
cmp dword [ebp + 8], 0
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
mov edx, dword [esi + 0x6c]
fstp dword [edx + edi + 0x1c]
je 0x5056f8
mov eax, dword [esi + 0x6c]
fld dword [eax + edi + 0x14]
lea eax, [eax + edi + 0x14]
fchs
fstp dword [eax]
mov ecx, dword [esi + 0x6c]
fld dword [ecx + edi + 0x18]
lea eax, [ecx + edi + 0x18]
fchs
fstp dword [eax]
fld dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
fadd dword [esp + 0x28]
add eax, 1
add edi, 0x24
cmp eax, dword [esi + 0x68]
fstp dword [esp + 0x10]
mov dword [esp + 0x1c], eax
fld dword [esp + 0x14]
fsub dword [esp + 0x2c]
fstp dword [esp + 0x14]
jb 0x505604
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x521070
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x521070
push 0xffffffffffffffff
push 0x6b1ac8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
push eax
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0040748c
xor edi, edi
mov dword [esi], vtable.ClassAcPSChispas.0
push esi
mov dword [esp + 0x1c], edi
mov dword [0x780138], 0x6ee7f0
call fcn.0040b690
add esp, 4
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x10

Function at 0x5302b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x5302b0
push 0xffffffffffffffff
push 0x6b3888
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 1
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0040748c
fldz
mov dword [esi], vtable.ClassAcMisil.0
fst dword [esi + 0x34]
fst dword [esi + 0x30]
push esi
fstp dword [esi + 0x2c]
mov dword [esp + 0x18], 0
mov ecx, dword [esi]
mov dword [0x7803f0], ecx
call fcn.0040b690
mov eax, dword [esi + 0x1c]
add esp, 4
or dword [eax + 0x228], 1
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14