joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x6b436c]
mov eax, dword [eax + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
cmp eax, 0xffffffff
push edi
mov dword [esp + 0x18], 0x3f800000
mov dword [esp + 0x1c], 0x3f666666
mov dword [esp + 0x20], 0x3f666666
mov dword [esp + 0x24], 0x3f666666
je 0x4ac66b
push 0xffffffffffffffff
push esi
push esi
xor edi, edi
mov word [esp + 0x1c], si
mov word [esp + 0x1e], si
mov word [esp + 0x20], 0x1e0
mov word [esp + 0x22], 0x280
call fcn.0043f2a0
add esp, 4
push eax
lea eax, [esp + 0x1c]
mov ecx, eax
call fcn.0049bbc0
add esp, 0xc
mov ecx, dword [0x6b43d4]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [0x6b436c]
mov dword [0x67f624], ecx
mov dword [0x67f630], edi
mov dword [0x67f634], ebx
mov dword [0x67f638], ebp
mov dword [0x67f63c], edx
mov word [0x67f62c], 0xffff
mov word [0x67f62e], si
mov dword [0x67f628], esi
mov ecx, dword [eax + 0x2c]
cmp ecx, 0xffffffff
je 0x4ac6fa
mov edx, dword [0x6b437c]
call fcn.0055b240
push eax
lea eax, [esp + 0x14]
push esi
push esi
mov ecx, eax
mov word [esp + 0x1c], 0x4e
mov word [esp + 0x1e], 0x72
mov word [esp + 0x20], 0x6e
mov word [esp + 0x22], 0x280
call fcn.005184f0
add esp, 0xc
mov ecx, dword [0x6b436c]
mov eax, dword [ecx + 0x2c]
cmp eax, 0xffffffff
mov edx, 0x61170c
je 0x4ac741
mov ecx, dword [0x816d04]
and eax, 0xffff
shl eax, 5
mov eax, dword [eax + ecx + 0x14]
cmp dword [eax], 0xe
jle 0x4ac741
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x118]
add ecx, 0x118
cmp eax, esi
jle 0x4ac741
mov edx, dword [ecx + 0xc]
shr eax, 1
mov word [edx + eax*2 - 2], si
mov eax, dword [0x6b43d4]
mov ecx, dword [esp + 0x24]
push edx
mov dword [0x67f624], eax
lea eax, [esp + 0x14]
mov dword [0x67f63c], ecx
push esi
push esi
mov ecx, eax
mov word [esp + 0x1c], 0x19e
mov word [esp + 0x1e], si
mov word [esp + 0x20], 0x1c2
mov word [esp + 0x22], 0x276
mov dword [0x67f630], edi
mov dword [0x67f634], ebx
mov dword [0x67f638], ebp
mov word [0x67f62c], 0xffff
mov word [0x67f62e], 1
mov dword [0x67f628], esi
call fcn.005184f0
lea edx, [esp + 0x1c]
push edx
mov word [esp + 0x20], 0x76
mov word [esp + 0x22], 0x78
mov word [esp + 0x24], 0x8f
mov word [esp + 0x26], 0x208
call fcn.004ac3f0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4cb6c0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
push ecx
push 0x4cb690
push 0x10400
push 0
mov dword [0x6b4b30], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4cb720
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4cb708
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x6b4b30]
test eax, eax
je 0x4cb720
mov eax, 1
pop esi
pop ecx
ret
mov dword [0x6b4b34], 0
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4cb850
Capabilities:
Create thread

Disassembly:
mov al, byte [0x6bd096]
sub esp, 0x24
push ebx
xor ebx, ebx
cmp al, bl
je 0x4cb887
push str.Connect_functions_unavailable_in__devmode.
xor eax, eax
call fcn.00499bd0
add esp, 4
mov byte [0x6b4a42], bl
mov byte [0x6b4a62], bl
mov byte [0x6b4a41], bl
mov al, 1
pop ebx
add esp, 0x24
ret
push esi
mov esi, dword [esp + 0x30]
cmp esi, ebx
push edi
mov edi, dword [esp + 0x38]
jne 0x4cb8b6
cmp edi, ebx
jne 0x4cb8b6
mov byte [0x6b4a42], bl
mov byte [0x6b4a62], bl
mov byte [0x6b4a41], bl
pop edi
mov bl, 1
pop esi
mov al, bl
pop ebx
add esp, 0x24
ret
mov eax, esi
call fcn.004dfbe0
test al, al
je 0x4cb9c6
push 8
push edi
push 0x6b4a62
call fcn.005c8ba0
lea eax, [esp + 0x1b]
push eax
lea ecx, [esp + 0x24]
push ecx
push esi
mov byte [0x6b4a6a], bl
call fcn.004dfa90
add esp, 0x18
test al, al
je 0x4cb925
cmp byte [esp + 0xf], bl
jne 0x4cb9c6
push 0x1f
lea edx, [esp + 0x18]
push edx
push 0x6b4a42
mov byte [0x6b4a41], 1
call fcn.005c8ba0
add esp, 0xc
mov byte [0x6b4a61], bl
pop edi
mov bl, 1
pop esi
mov al, bl
pop ebx
add esp, 0x24
ret
push ebx
mov eax, esi
call fcn.004dfa10
add esp, 4
test al, al
je 0x4cb9c6
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4cb940
sub eax, edx
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov edx, edi
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4cb960
call fcn.0049b6f0
call fcn.0049a970
mov eax, esi
mov dword [0x6b3f4c], 3
call fcn.0049a950
cmp dword [0x6b4b2c], ebx
je 0x4cb99e
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call esi
cmp dword [0x6b4b2c], ebx
jne 0x4cb993
lea eax, [esp + 0x10]
push eax
push ebx
push edi
push 0x4cb730
push 0x4000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov bl, 1
mov dword [0x6b4b2c], eax
pop esi
mov al, bl
pop ebx
add esp, 0x24
ret
push ebx
push ebx
call fcn.004cb850
push ebx
push 1
push 0xffffffffffffffff
push 0x35
call fcn.0049bfc0
add esp, 0x18
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x24
ret
Function at 0x4d0470
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push edi
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x18]
push ecx
call esi
call fcn.005c91df
mov edx, dword [esp + 0x14]
push 0
push 0x3e8
mov ebx, eax
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.005d2e50
mov esi, dword [0x647764]
mov edi, dword [0x647760]
push esi
push edi
push edx
push eax
call fcn.005de0d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push esi
push edi
push ecx
push edx
mov ebp, eax
call fcn.005de0d0
pop edi
xor ebp, eax
xor ebx, ebp
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret

Function at 0x4d36d0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x6b4ca0]
test al, al
jne 0x4d36ea
mov edx, 0x652968
call fcn.004d3730
mov byte [0x6b4ca0], 1
push esi
mov esi, dword [esp + 0x10]
test esi, esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
jle 0x4d371c
mov edx, dword [esp + 0x10]
mov edi, edi
xor ecx, ecx
mov cl, byte [edx]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x652968]
shr eax, 8
inc edx
xor eax, ecx
dec esi
jne 0x4d3700
mov dword [edi], eax
pop edi
pop esi
ret

Function at 0x4d3730
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
xor ecx, ecx
mov edi, 0x100
lea esp, [esp]
mov eax, ecx
mov esi, 8
test al, 1
je 0x4d3754
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d3756
shr eax, 1
dec esi
jne 0x4d3747
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x4d3740
pop edi
pop esi
ret
Function at 0x4ddc70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov al, byte [ebx + 0x15e]
sub esp, 0xc
test al, 2
je 0x4ddc8c
cmp word [ebx + 0x156], 0x10
mov byte [esp + 3], 1
jl 0x4ddc91
mov byte [esp + 3], 0
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea esi, [edi + 0x18]
mov ebp, 9
mov al, byte [esi + 0x115]
test al, al
je 0x4ddce9
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push 0x3e8
push ecx
push edx
call fcn.005d2e50
mov ecx, dword [0x647764]
push ecx
mov ecx, dword [0x647760]
push ecx
push edx
push eax
call fcn.005de0d0
sub eax, dword [esi]
cmp eax, 0x1770
jle 0x4ddcf9
mov ecx, 0x4c
xor eax, eax
lea edi, [esi - 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
add esi, 0x130
dec ebp
jne 0x4ddca0
mov edx, dword [ebx]
xor eax, eax
mov ecx, edi
cmp edx, dword [ecx]
je 0x4ddd5f
inc eax
add ecx, 0x130
cmp eax, 9
jl 0x4ddd08
xor eax, eax
mov ecx, edi
lea esp, [esp]
mov dl, byte [ecx + 0x12d]
test dl, dl
je 0x4ddd5f
inc eax
add ecx, 0x130
cmp eax, 9
jl 0x4ddd20
mov al, byte [esp + 0xf]
test al, al
je 0x4ddd56
xor eax, eax
mov cl, byte [edi + 0x12c]
test cl, cl
je 0x4ddd63
inc eax
add edi, 0x130
cmp eax, 9
jl 0x4ddd40
pop edi
pop esi
xor al, al
pop ebp
add esp, 0xc
ret
mov ebp, ecx
jmp 0x4ddd6e
mov ecx, 0x4c
xor eax, eax
mov ebp, edi
rep stosd dword es:[edi], eax
mov byte [ebp + 0x12d], 1
mov edx, ebx
mov ecx, dword [edx]
mov eax, ebp
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov edx, dword [edx + 0x14]
mov dword [eax + 0x14], edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push 0x3e8
push ecx
push edx
call fcn.005d2e50
mov ecx, dword [0x647764]
push ecx
mov ecx, dword [0x647760]
push ecx
push edx
push eax
call fcn.005de0d0
mov dword [ebp + 0x18], eax
mov dx, word [ebx + 0x1c]
lea eax, [ebx + 0x1e]
mov word [ebp + 0x12a], dx
cmp word [eax], 0
push 0x3f
je 0x4dddf1
push eax
lea eax, [ebp + 0x1c]
push eax
jmp 0x4dddfa
push 0x609844
lea ecx, [ebp + 0x1c]
push ecx
call fcn.005cca83
mov word [ebp + 0x9a], 0
mov dx, word [ebx + 0x154]
mov word [ebp + 0x120], dx
lea esi, [ebx + 0xd0]
lea edi, [ebp + 0x9c]
mov ecx, 0x21
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebx + 0x156]
mov word [ebp + 0x122], ax
mov cx, word [ebx + 0x158]
mov word [ebp + 0x124], cx
mov dx, word [ebx + 0x15a]
mov cl, byte [esp + 0x1b]
mov word [ebp + 0x126], dx
mov ax, word [ebx + 0x15c]
mov word [ebp + 0x128], ax
mov byte [ebp + 0x12c], cl
mov dl, byte [ebx + 0x15e]
shr dl, 2
and dl, 1
add esp, 0xc
cmp word [ebp + 0x120], 3
mov byte [ebp + 0x12e], dl
jne 0x4ddea5
test byte [ebx + 0x15e], 8
je 0x4ddea5
pop edi
mov eax, 1
pop esi
mov byte [ebp + 0x12f], al
pop ebp
add esp, 0xc
ret
pop edi
xor eax, eax
mov byte [ebp + 0x12f], al
pop esi
mov al, 1
pop ebp
add esp, 0xc
ret
Function at 0x4e3d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x73
mov byte [esp + 2], cl
mov byte [esp + 3], cl
mov cl, 0x20
mov dl, 0x61
mov byte [esp + 7], cl
mov byte [esp + 0xc], cl
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov dword [eax], 0
mov byte [esp], 0x6d
mov byte [esp + 1], 0x65
mov ecx, dword [esp]
mov byte [esp + 4], dl
mov dword [eax], ecx
mov byte [esp + 5], 0x67
mov byte [esp + 6], 0x65
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6e
mov ecx, dword [esp + 8]
mov byte [esp + 0xd], 0x62
mov byte [esp + 0xe], 0x6f
mov byte [esp + 0xf], 0x74
mov edx, dword [esp + 0xc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
add esp, 0x14
ret

Function at 0x4e4b30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 4]
push eax
call esi
mov ecx, dword [esp + 0x10]
mov dl, byte [ecx + 6]
shr dl, 2
test dl, 1
je 0x4e4ba1
lea eax, [esp + 4]
push eax
call esi
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push 0x3e8
push ecx
push edx
call fcn.005d2e50
mov ecx, dword [0x647764]
push ecx
mov ecx, dword [0x647760]
push ecx
push edx
push eax
call fcn.005de0d0
mov ecx, dword [0x6b72b8]
mov esi, eax
mov edx, esi
sub edx, ecx
cmp edx, 0x3a98
jbe 0x4e4ba1
call fcn.004e65a0
mov dword [0x6b72b8], esi
mov al, 1
pop esi
add esp, 8
ret
Function at 0x4f03f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
xor ebx, ebx
push esi
mov esi, eax
push edi
xor eax, eax
mov byte [esp + 0x20], bl
mov ecx, 0x24
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xbc]
mov eax, dword [ecx*4 + 0x5fba60]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x30], edx
sub edx, eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x38], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], esi
lea edx, [eax - 1]
lea esi, [esp + 0x20]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
mov byte [esp + 0x20], 1
call fcn.004f07b0
mov eax, dword [esp + 0xcc]
cmp eax, ebx
jle 0x4f05b1
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xc8]
sub edx, ebp
mov ecx, ebp
sub esi, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
jmp 0x4f04c0
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, edi
cmp dword [esp + 0xc0], ebx
jne 0x4f04cd
xor edi, edi
jmp 0x4f04d0
mov edi, dword [edx + ecx]
cmp dword [esp + 0xb8], ebx
mov ebp, dword [ecx]
jne 0x4f04df
xor esi, esi
jmp 0x4f04e2
mov esi, dword [esi + ecx]
lea eax, [esp + 0x20]
call fcn.004f0610
push esi
push ebp
push edi
lea eax, [esp + 0x2c]
call fcn.004f06b0
mov eax, dword [esp + 0x70]
add esp, 0xc
cmp eax, ebx
jg 0x4f050b
cmp byte [esp + 0xd0], bl
je 0x4f0538
mov ecx, dword [esp + 0x60]
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x5c]
add eax, ecx
mov ecx, dword [esp + 0x58]
add edi, eax
sub esi, eax
add edx, eax
inc ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
cmp dword [esp + 0x28], 1
jne 0x4f0562
mov dword [esp + 0x68], 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add ecx, 4
dec eax
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jne 0x4f04b2
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
mov edi, dword [edx*4 + 0x5fba60]
xor eax, eax
cmp ecx, ebx
jle 0x4f05fd
mov eax, dword [edi + 0x14]
cmp eax, 1
jle 0x4f05f6
movzx esi, byte [eax + 0x5fbb47]
mov eax, dword [esp + 0x58]
dec eax
mov dword [esp + 0x14], eax
push esi
lea ecx, [esp + 0x18]
lea eax, [esp + 0x40]
call fcn.004d2cf0
add esp, 4
mov dword [esp + 0xac], esi
mov eax, dword [edi + 0xc]
add eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x509c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x74]
jmp 0x509c80
mov ecx, dword [0x7fb2d0]
mov edx, dword [ecx + 0x34]
mov eax, edi
and eax, 0xffff
lea eax, [eax + eax*2]
mov ebp, dword [edx + eax*4 + 8]
cmp edi, dword [esp + 0x88]
je 0x509ec1
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x509ec1
test eax, 0x1000000
jne 0x509ec1
test byte [ebp + 0x106], 4
je 0x509cd1
cmp word [ebp + 0xb4], 0
je 0x509ec1
fld dword [esp + 0x7c]
mov esi, dword [esp + 0x78]
fadd dword [ebp + 0xac]
fld dword [ebp + 0xa0]
fsub dword [esi]
fld dword [ebp + 0xa4]
fsub dword [esi + 4]
fld dword [ebp + 0xa8]
fsub dword [esi + 8]
fld st(2)
fmul st(3)
fld st(1)
fmul st(2)
faddp st(1)
fld st(2)
fmul st(3)
faddp st(1)
fld st(4)
fmul st(5)
fcompp
fstp st(0)
fstp st(0)
fnstsw ax
fstp st(0)
test ah, 1
fstp st(0)
jne 0x509ec1
movsx eax, word [ebp + 0xb4]
mov edx, dword [esp + 0x70]
lea ecx, [eax + 8]
mov ebx, 1
shl ebx, cl
test edx, ebx
je case.0x509d4f.2
cmp eax, 8
ja case.0x509d4f.2
movzx ecx, byte [eax + 0x509ee4]
jmp dword [ecx*4 + 0x509ed8]
test edx, 0x200000
je 0x509d6b
test byte [ebp + 0x4cc], 0x10
jne case.0x509d4f.2
mov ecx, dword [ebp + 0x11c]
mov eax, 0xffffffff
cmp ecx, eax
je 0x509d87
cmp word [ebp + 0x2f0], ax
jne case.0x509d4f.2
lea edx, [esp + 0x74]
push edx
lea ebx, [esp + 0x14]
lea eax, [esp + 0x18]
mov ecx, edi
call fcn.0055dc50
fld dword [esp + 0x20]
fadd dword [esp + 0x78]
mov ecx, dword [esp + 0x90]
add esp, 4
push 0xff
fstp dword [esp + 0x20]
push 0
fld dword [esp + 0x18]
push 0xffffffffffffffff
fadd dword [esp + 0x90]
push edi
sub esp, 8
or edi, 0xffffffff
fstp dword [esp + 4]
lea esi, [esp + 0x2c]
fld dword [esp + 0x8c]
fadd dword [esp + 0x98]
fstp dword [esp]
call fcn.00506e10
mov esi, dword [esp + 0x90]
jmp 0x509e79
mov ebx, 1
mov ecx, eax
shl ebx, cl
test bl, 2
je 0x509e41
test edx, 0x400000
je 0x509e41
mov ebx, edi
lea eax, [esp + 0x30]
call fcn.0050af60
test al, al
je case.0x509d4f.2
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
push eax
push ecx
push edx
lea ebx, [esp + 0x3c]
call fcn.0050b240
add esp, 0xc
jmp case.0x509d4f.2
lea ecx, [esp + 0x20]
call fcn.005088c0
test al, al
je case.0x509d4f.2
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0x80]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.00508cb0
add esp, 0x18
mov eax, dword [ebp + 0x118]
cmp eax, 0xffffffff
je 0x509ec1
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push ecx
push edx
push esi
push eax
mov eax, dword [esp + 0x8c]
push eax
call fcn.00509c70
add esp, 0x20
mov edi, dword [ebp + 0x114]
cmp edi, 0xffffffff
jne 0x509c80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x50b0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
lea ebp, [edi + 8]
lea edx, [esp + 0x20]
mov esi, eax
mov ecx, ebp
mov byte [esp + 0xf], 0
mov dword [ebx], 0x7f7fffff
call fcn.004cf380
mov edx, dword [esp + 0x40]
push ebp
lea eax, [esp + 0x18]
call fcn.004cf410
mov ecx, dword [edi + 4]
mov eax, dword [ecx + 0x74]
add esp, 4
xor esi, esi
test eax, eax
jle 0x50b231
xor eax, eax
jmp 0x50b110
mov edi, dword [ecx + 0x78]
shl eax, 7
mov ecx, dword [eax + edi + 0x68]
add eax, edi
push ecx
add eax, 0x38
push eax
lea ecx, [esp + 0x34]
lea edi, [esp + 0x18]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x28]
call fcn.004d17a0
add esp, 8
test al, al
je 0x50b1a5
fld dword [ebx]
fcomp dword [esp + 0x10]
fnstsw ax
test ah, 0x41
jne 0x50b1a5
fld dword [esp + 0x14]
mov edx, dword [esp + 0x10]
fmul dword [esp + 0x10]
mov dword [ebx], edx
mov edx, dword [esp + 0x2c]
lea eax, [ebx + 4]
fadd dword [esp + 0x20]
mov ecx, eax
fld dword [esp + 0x18]
mov dword [ecx], edx
fmul dword [esp + 0x10]
mov edx, dword [esp + 0x30]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x34]
fadd dword [esp + 0x24]
mov dword [ecx + 8], edx
fld dword [esp + 0x1c]
mov byte [esp + 0xf], 1
fmul dword [esp + 0x10]
fadd dword [esp + 0x28]
fmul dword [eax + 8]
fxch st(1)
fmul dword [eax + 4]
faddp st(1)
fxch st(1)
fmul dword [eax]
faddp st(1)
fstp dword [eax + 0xc]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x74]
inc esi
movsx eax, si
cmp eax, edx
jl 0x50b110
mov al, byte [esp + 0xf]
test al, al
je 0x50b235
fld dword [ebx + 4]
pop edi
fld dword [ebx + 8]
pop esi
fld dword [ebx + 0xc]
fld st(0)
fmul dword [ebp + 0x1c]
fld st(2)
fmul dword [ebp + 0x10]
faddp st(1)
fld st(3)
fmul dword [ebp + 4]
faddp st(1)
fstp dword [ebx + 4]
fld st(0)
fmul dword [ebp + 0x20]
fld st(2)
fmul dword [ebp + 0x14]
faddp st(1)
fld st(3)
fmul dword [ebp + 8]
faddp st(1)
fstp dword [ebx + 8]
fmul dword [ebp + 0x24]
fxch st(1)
fmul dword [ebp + 0x18]
faddp st(1)
fxch st(1)
fmul dword [ebp + 0xc]
faddp st(1)
fst dword [ebx + 0xc]
fmul dword [ebp + 0x30]
fld dword [ebp + 0x2c]
fmul dword [ebx + 8]
faddp st(1)
fld dword [ebx + 0x10]
fmul dword [ebp]
faddp st(1)
fld dword [ebp + 0x28]
pop ebp
fmul dword [ebx + 4]
faddp st(1)
fstp dword [ebx + 0x10]
add esp, 0x2c
ret
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
Function at 0x5184f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
push ebx
mov ebx, eax
mov al, byte [0x6249e2]
test al, al
push esi
push edi
mov edi, ecx
je 0x5186e8
cmp word [0x75c140], 1
jne 0x5186e8
mov al, byte [0x673690]
inc word [0x637d5c]
mov ecx, dword [0x67369c]
neg al
sbb eax, eax
and eax, ecx
mov dword [esp + 0x1c], eax
je 0x5186e8
mov eax, dword [ebp + 0x10]
cmp word [eax], 0
je 0x5186e8
push eax
call fcn.005cab5a
mov edx, dword [0x75e060]
mov si, word [0x75e062]
add esp, 4
test edi, edi
jne 0x5185ae
mov ecx, dword [0x75e068]
mov eax, dword [0x75e06c]
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x14]
shr edi, 0x10
mov cx, si
neg cx
add di, cx
mov dword [esp + 0x18], eax
mov word [esp + 0x16], di
mov edi, dword [esp + 0x18]
mov eax, edx
shr edi, 0x10
neg eax
add word [esp + 0x14], ax
add di, cx
add word [esp + 0x18], ax
mov word [esp + 0x1a], di
jmp 0x5185bb
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
test ebx, ebx
jne 0x5185fa
mov ecx, dword [0x75e064]
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0xc]
neg si
mov edi, ecx
shr ebx, 0x10
shr edi, 0x10
neg edx
add word [esp + 0xc], dx
add bx, si
add di, si
mov dword [esp + 0x10], ecx
add word [esp + 0x10], dx
mov word [esp + 0xe], bx
mov word [esp + 0x12], di
jmp 0x518651
mov ax, word [ebx + 4]
cmp ax, 0x1e0
movsx esi, ax
jl 0x51860c
mov esi, 0x1e0
mov ax, word [ebx + 6]
cmp ax, 0x280
movsx edx, ax
jl 0x51861e
mov edx, 0x280
mov ax, word [ebx]
test ax, ax
jge 0x51862a
xor ecx, ecx
jmp 0x51862d
movsx ecx, ax
mov ax, word [ebx + 2]
test ax, ax
jge 0x51863a
xor eax, eax
jmp 0x51863d
movsx eax, ax
mov word [esp + 0xe], ax
mov word [esp + 0xc], cx
mov word [esp + 0x12], dx
mov word [esp + 0x10], si
xor eax, eax
mov ecx, 0x23
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
movsx edx, word [eax + 4]
mov dword [esp + 0x1c], edx
movsx ecx, word [eax + 6]
fild dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
fdivr dword [0x612224]
lea edi, [esp + 0x20]
mov dword [esp + 0x4c], 0x3f800000
mov dword [esp + 0x48], 0x3f800000
mov dword [esp + 0x20], ecx
mov byte [esp + 0xaa], cl
mov word [esp + 0xa8], cx
mov dword [esp + 0x2c], eax
fstp dword [esp + 0x60]
fild dword [esp + 0x1c]
fdivr dword [0x612224]
fstp dword [esp + 0x64]
call fcn.00534c50
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x24]
push eax
push 0x518720
call fcn.0055a0a0
add esp, 0x18
call fcn.00534f60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51d260
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0
push 0x8000000
push 3
push 0
push 0
push closesocket
mov dword [eax], 0
push ecx
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x51d29c
pop esi
xor al, al
pop ebp
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x51d2ba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebp
ret
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x51d2e5
push 0
lea edx, [esp + 0x1c]
push edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x51d2f3
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.0051d1f0
test al, al
jne 0x51d313
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret
mov eax, dword [esp + 0x14]
mov dword [eax], ebx
pop ebx
mov dword [ebp], edi
pop edi
pop esi
mov al, 1
pop ebp
ret