joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
push edi
xor edi, edi
push edi
lea eax, [esi + 0x10c]
push 0x8000
mov ebp, ecx
push eax
call fcn.005fbe12
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esi + 0x214], eax
je 0x522b6e
lea ecx, [esp + 0x10]
push 0x2c
push ecx
push eax
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jg 0x522b6e
mov edx, dword [esi + 0x214]
push edx
call fcn.005fbb69
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
push 4
lea eax, [esp + 0x14]
push str.RIFF
push eax
call fcn.005fd930
add esp, 0xc
test eax, eax
jne 0x522d50
cmp word [esp + 0x24], 1
jne 0x522d50
push 4
lea ecx, [esp + 0x38]
push str.data
push ecx
call fcn.005fd930
add esp, 0xc
test eax, eax
je 0x522c06
push 4
lea edx, [esp + 0x38]
push str.fact
push edx
call fcn.005fd930
add esp, 0xc
test eax, eax
jne 0x522d50
mov edx, dword [esi + 0x214]
lea ecx, [esp + 0x38]
push 4
push ecx
push edx
call fcn.005fbc1c
mov ecx, dword [esi + 0x214]
lea eax, [esp + 0x40]
push 4
push eax
push ecx
call fcn.005fbc1c
mov eax, dword [esi + 0x214]
lea edx, [esp + 0x50]
push 4
push edx
push eax
call fcn.005fbc1c
add esp, 0x24
mov cx, word [esp + 0x24]
lea eax, [esi + 0x25c]
mov dx, word [esp + 0x26]
mov word [esi + 0x26c], di
mov word [eax], cx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x260], ecx
mov cx, word [esp + 0x30]
mov word [esi + 0x268], cx
mov cx, word [esp + 0x32]
mov word [esi + 0x26a], cx
mov word [esi + 0x25e], dx
mov edx, dword [esp + 0x2c]
lea ecx, [esi + 0x244]
mov dword [esi + 0x264], edx
mov dword [esi + 0x248], 0x10108
mov dword [ecx], 0x14
mov ebx, dword [ebp + 0x78]
imul ebx, edx
mov dword [esi + 0x24c], ebx
mov dword [esi + 0x254], eax
mov al, byte [esi + 0x24c]
mov ebx, 1
test bl, al
mov dword [esi + 0x250], edi
je 0x522ca3
mov edx, dword [esi + 0x24c]
inc edx
mov al, dl
mov dword [esi + 0x24c], edx
test bl, al
jne 0x522c90
mov eax, dword [ebp + 0x70]
lea ebp, [esi + 0x258]
push edi
push ebp
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0xc]
test eax, eax
jne 0x522d5f
mov eax, dword [esi + 0x214]
push eax
call fcn.005fc0e2
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x220], eax
mov dword [esi + 0x224], ecx
mov ecx, dword [esi + 0x24c]
mov eax, ecx
add esp, 4
shr eax, 1
mov dword [esi + 0x234], ecx
mov dword [esi + 0x278], ecx
mov dword [esi + 0x27c], ecx
lea edx, [eax - 1]
dec ecx
mov dword [esi + 0x23c], edi
mov dword [esi + 0x240], edi
mov dword [esi + 0x270], edi
mov dword [esi + 0x280], edi
mov dword [esi + 0x228], edi
mov dword [esi + 0x238], eax
mov dword [esi + 0x274], eax
mov dword [esi + 0x284], edx
mov dword [esi + 0x288], eax
mov dword [esi + 0x28c], eax
mov dword [esi + 0x290], ecx
mov dword [esi + 0x294], eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x2c
ret 4
mov eax, dword [esi + 0x214]
push eax
call fcn.005fbb69
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret 4
Function at 0x53d4da
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60bc48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push 1
push eax
mov dword [esp + 0xc], esi
call fcn.004095d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x30], ecx
push edx
mov ecx, esi
mov dword [esp + 0x14], 0
mov dword [esi], 0x6270c4
mov word [esi + 4], 0x6b
call fcn.00409aa0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x54148a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60be48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push 1
push eax
mov dword [esp + 0xc], esi
call fcn.004095d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x30], ecx
push edx
mov ecx, esi
mov dword [esp + 0x14], 0
mov dword [esi], 0x627538
mov word [esi + 4], 0x6c
call fcn.00409aa0
mov eax, dword [esi + 8]
push 1
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x8c]
movsx eax, word [edx + 0x48]
push eax
call fcn.005fab6a
mov ecx, dword [esp + 0x10]
add esp, 8
mov dword [esi + 0x40], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x5499e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 8]
mov ax, word [ecx + 0x16]
cmp ax, 0x14
je 0x549a15
cmp ax, 0x15
je 0x549a15
cmp ax, 0x16
je 0x549a15
cmp ax, 2
je 0x549a15
cmp ax, 0x35
jne 0x549b15
mov eax, dword [esi + 8]
xor ebx, ebx
mov edx, dword [eax + 0xc]
mov ecx, dword [edx + 0x78]
mov edx, dword [ecx + 8]
mov ebp, dword [ecx + 4]
test edx, edx
jle 0x549a6f
mov edi, dword [ebp]
cmp edi, eax
je 0x549a5d
mov eax, dword [edi + 8]
cmp word [eax + 0x10], 0x9c
jne 0x549a5d
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xd8]
cmp eax, dword [esi + 0x10]
jne 0x549a5d
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x150]
cmp al, 2
jne 0x549b1d
mov eax, dword [esi + 8]
inc ebx
add ebp, 4
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x78]
cmp ebx, dword [edx + 8]
jl 0x549a2a
mov edi, dword [esi + 8]
fld dword [edi + 0x38]
call fcn.005faa4c
mov dword [esp + 0x20], eax
fld dword [edi + 0x3c]
call fcn.005faa4c
mov ebx, dword [esi + 0x10]
mov dword [esp + 0x24], eax
fld dword [ebx + 0x38]
call fcn.005faa4c
mov dword [esp + 0x18], eax
fld dword [ebx + 0x3c]
call fcn.005faa4c
push 1
push 2
lea ecx, [esp + 0x30]
push 2
push ecx
lea edx, [esp + 0x28]
lea ecx, [esp + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [edi]
push edx
push ecx
mov ecx, edi
call dword [eax + 0x1dc]
cmp eax, 1
jne 0x549b15
fild dword [esp + 0x28]
mov ecx, dword [esi + 0x10]
push 0
push eax
push 0
fadd dword [0x61b588]
fst dword [esp + 0x20]
fstp dword [esi + 0x20]
fild dword [esp + 0x38]
fadd dword [0x61b588]
fst dword [esp + 0x1c]
fstp dword [esi + 0x24]
mov eax, dword [ecx + 0x40]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [edx + 0x17c]
mov ecx, dword [esi + 0x10]
mov dl, byte [ecx + 0x134]
mov byte [esi + 0x40], dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x150]
cmp al, 0xb
jne 0x549b64
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x130]
call fcn.00406100
mov ecx, eax
call fcn.00409da0
mov edx, dword [esi + 0x10]
fstp dword [esi + 0x20]
mov ecx, dword [edx + 0x130]
call fcn.00406100
mov ecx, eax
call fcn.004bf7f0
fstp dword [esi + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov eax, dword [esi + 0x10]
pop edi
mov ecx, dword [eax + 0x38]
mov dword [esi + 0x20], ecx
mov edx, dword [eax + 0x3c]
mov dword [esi + 0x24], edx
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x55afb0
Capabilities:
Parse pe header

Disassembly:
mov ax, word [esp + 4]
cmp ax, 0x53
je 0x55b32b
mov cx, word [esp + 8]
cmp cx, 4
je 0x55b32b
cmp ax, 0x1e7
je case.0x55b235.487
cmp cx, 0x27
je case.0x55b235.487
movsx eax, ax
cmp eax, 0x11
jg 0x55b035
je 0x55b02f
add eax, 0xfffffffc
cmp eax, 9
ja case.0x55b29c.567
jmp dword [eax*4 + 0x55b334]
mov eax, 1
ret
mov eax, 0x1c
ret
mov eax, 0x1f
ret
mov eax, 0x20
ret
mov eax, 0x22
ret
mov eax, 0x3c
ret
mov eax, 0x3e
ret
mov eax, 0x4c
ret
mov eax, 0x51
ret
cmp eax, 0x11a
jg 0x55b19e
je 0x55b198
cmp eax, 0x54
jg 0x55b0fa
je 0x55b0f4
add eax, 0xffffffeb
cmp eax, 0x3d
ja case.0x55b29c.567
xor ecx, ecx
mov cl, byte [eax + 0x55b3bc]
jmp dword [ecx*4 + 0x55b35c]
mov eax, 4
ret
mov eax, 6
ret
mov eax, 7
ret
mov eax, 0xc
ret
mov eax, 0x10
ret
mov eax, 0x13
ret
mov eax, 0x14
ret
mov eax, 0x19
ret
mov eax, 0x1d
ret
mov eax, 0x1e
ret
mov eax, 0x24
ret
mov eax, 0x25
ret
mov eax, 0x26
ret
mov eax, 0x2b
ret
mov eax, 0x2c
ret
mov eax, 0x3a
ret
mov eax, 0x3b
ret
mov eax, 0x40
ret
mov eax, 0x53
ret
mov eax, 0x55
ret
mov eax, 0x56
ret
mov eax, 0x61
ret
mov eax, 0xf
ret
add eax, 0xffffffa9
cmp eax, 0xc2
ja case.0x55b29c.567
xor edx, edx
mov dl, byte [eax + 0x55b458]
jmp dword [edx*4 + 0x55b3fc]
xor eax, eax
ret
mov eax, 2
ret
mov eax, 3
ret
mov eax, 5
ret
mov eax, 8
ret
mov eax, 9
ret
mov eax, 0xb
ret
mov eax, 0xd
ret
mov eax, 0x15
ret
mov eax, 0x16
ret
mov eax, 0x17
ret
mov eax, 0x18
ret
mov eax, 0x1a
ret
mov eax, 0x28
ret
mov eax, 0x41
ret
mov eax, 0x43
ret
mov eax, 0x44
ret
mov eax, 0x45
ret
mov eax, 0x50
ret
mov eax, 0x54
ret
mov eax, 0x59
ret
mov eax, 0x5b
ret
mov eax, 0x3d
ret
cmp eax, 0x21e
jg 0x55b284
je 0x55b27e
cmp eax, 0x1da
jg 0x55b21f
je 0x55b219
add eax, 0xfffffee5
cmp eax, 0xbe
ja case.0x55b29c.567
xor ecx, ecx
mov cl, byte [eax + 0x55b54c]
jmp dword [ecx*4 + 0x55b51c]
mov eax, 0x27
ret
mov eax, 0x29
ret
mov eax, 0x42
ret
mov eax, 0x3f
ret
mov eax, 0x46
ret
mov eax, 0x4d
ret
mov eax, 0x57
ret
mov eax, 0x5e
ret
mov eax, 0x5f
ret
mov eax, 0x60
ret
mov eax, 0x64
ret
mov eax, 0x21
ret
add eax, 0xfffffe19
cmp eax, 0x34
ja case.0x55b29c.567
xor edx, edx
mov dl, byte [eax + 0x55b63c]
jmp dword [edx*4 + 0x55b60c]
mov eax, 0xa
ret
mov eax, 0x1b
ret
mov eax, 0x32
ret
mov eax, 0x37
ret
mov eax, 0x39
ret
mov eax, 0x47
ret
mov eax, 0x49
ret
mov eax, 0x4a
ret
mov eax, 0x4b
ret
mov eax, 0x4e
ret
mov eax, 0x4f
ret
mov eax, 0x58
ret
add eax, 0xfffffddf
cmp eax, 0x95
ja case.0x55b29c.567
xor ecx, ecx
mov cl, byte [eax + 0x55b6d0]
jmp dword [ecx*4 + 0x55b674]
mov eax, 0xe
ret
mov eax, 0x11
ret
mov eax, 0x12
ret
mov eax, 0x23
ret
mov eax, 0x2a
ret
mov eax, 0x2d
ret
mov eax, 0x2e
ret
mov eax, 0x2f
ret
mov eax, 0x30
ret
mov eax, 0x31
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x36
ret
mov eax, 0x38
ret
mov eax, 0x48
ret
mov eax, 0x52
ret
mov eax, 0x5a
ret
mov eax, 0x5c
ret
mov eax, 0x5d
ret
mov eax, 0x62
ret
mov eax, 0x63
ret
or eax, 0xffffffff
ret
mov eax, 0x65
ret
Function at 0x563b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push esi
push edi
mov edi, ecx
push eax
mov ecx, dword [edi + 0x100]
call fcn.00410f00
mov ebx, eax
xor esi, esi
cmp ebx, esi
mov dword [esp + 0x24], ebx
jne 0x563b6f
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret 4
mov ecx, dword [ebx + 8]
push ebp
mov eax, dword [edi + 0x2b8]
mov dword [esp + 0x14], esi
mov bp, word [ecx + 0x16]
mov dword [esp + 0x18], 0x3e8
sub bp, 0x13
mov dword [esp + 0x20], esi
neg bp
sbb ebp, ebp
and ebp, 0xffffffd9
add ebp, 0x54
cmp eax, esi
mov dword [esp + 0x1c], ebp
jle 0x563d01
mov dword [esp + 0x10], esi
jmp 0x563bb2
mov ebx, dword [esp + 0x28]
mov edx, dword [edi + 0x2bc]
mov ecx, dword [edx + esi]
lea eax, [edx + esi]
cmp ecx, 0xffffffff
je 0x563cdf
mov edx, dword [edi + 0x100]
xor ecx, ecx
mov cl, byte [eax + 0xb]
mov eax, ecx
mov ecx, dword [edx + 0xf0]
cmp eax, dword [ecx + 0x9c]
je 0x563cdf
push eax
call fcn.004ad860
cmp al, 3
je 0x563cdf
mov eax, dword [edi + 0x2bc]
add eax, esi
movsx ecx, word [eax + 4]
cmp ecx, ebp
jne 0x563cdf
mov edx, dword [eax]
mov ecx, dword [edi + 0x100]
push edx
call fcn.00410f00
mov esi, eax
test esi, esi
je 0x563cdf
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 8]
push esi
push 2
push 1
push eax
push ecx
mov ecx, dword [edi + 0x100]
movsx eax, word [edx + 0x10]
mov edx, dword [ecx + 0xf0]
push eax
mov ecx, dword [edx + 0x78]
call fcn.0049acf0
test eax, eax
je 0x563cdf
mov ecx, dword [ebx + 8]
mov edx, dword [eax]
mov ebx, dword [ecx + 0xc4]
mov ecx, dword [ecx + 0x104]
push ebx
push ecx
mov ecx, dword [esi + 0x3c]
push ecx
mov ecx, dword [esi + 0x38]
push ecx
mov ecx, eax
call dword [edx + 0x228]
fcomp dword [0x628848]
fnstsw ax
test ah, 1
jne 0x563cdf
mov edx, dword [edi + 0x2bc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov bl, byte [edx + eax + 9]
lea ebp, [edx + eax]
fld dword [ecx + 0x3c]
call fcn.005faa4c
mov edx, dword [esp + 0x28]
mov esi, ebx
xor ebx, ebx
sub esi, eax
fld dword [edx + 0x38]
mov bl, byte [ebp + 8]
call fcn.005faa4c
mov ecx, ebx
sub ecx, eax
mov eax, ecx
imul eax, ecx
mov ecx, esi
imul ecx, esi
add eax, ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x563cd3
cmp eax, dword [esp + 0x18]
jge 0x563cdb
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
mov ecx, dword [edi + 0x2b8]
inc eax
add esi, 0x2c
cmp eax, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], esi
jl 0x563bae
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x5a6cb0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x60da48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004af510
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push 1
xor eax, eax
push edx
push 1
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov byte [esi + 0x2e4], al
mov dword [esi + 0x2ec], eax
mov dword [esi + 0x2f0], eax
mov byte [esi + 0x2f4], al
mov byte [esi + 0x3fc], al
mov dword [esi + 0x3f4], eax
mov dword [esi + 0x19c], eax
mov byte [esi + 0x2d4], al
mov dword [esi + 0x2d8], eax
mov dword [esi + 0x2dc], eax
mov dword [esi + 0x3f8], eax
mov dword [esi + 0x614], eax
mov byte [esi + 0x5fc], al
mov dword [esi + 0x604], eax
mov byte [esi + 0x5fe], al
mov byte [esi + 0x5fd], al
mov dword [esi + 0x608], eax
mov dword [esi + 0x600], eax
mov dword [esi + 0x610], eax
mov dword [esi + 0x618], eax
mov dword [esi + 0x61c], eax
push eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x2e8], ecx
mov ecx, dword [esp + 0x38]
push eax
push ecx
mov ecx, esi
mov dword [esi], 0x62a978
mov dword [esi + 0x60c], 0x64
mov dword [esi + 0x620], 0xffffffff
call fcn.004af710
test eax, eax
jne 0x5a6dbc
mov dword [esi + 0xdc], 1
mov eax, esi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
mov ecx, esi
call fcn.004afc20
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x5ad3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60db38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004a0630
xor edi, edi
mov dword [esi], 0x62aef8
mov dword [esi + 0x80], edi
mov ecx, dword [0x6633d4]
push 0xb
mov dword [esp + 0x18], edi
call fcn.0041f700
mov eax, dword [eax]
lea edx, [esi + 0x15c]
xor ecx, ecx
mov dword [esi + 0xf8], eax
mov dword [esi + 0xfc], 0xffffff
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x110], edi
mov dword [edx], ecx
or eax, 0xffffffff
push edi
push edi
mov dword [edx + 4], ecx
push edi
push edi
push edi
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x130], eax
mov dword [esi + 0x170], eax
mov dword [esi + 0x174], eax
mov eax, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x114], edi
mov dword [esi + 0x118], edi
mov dword [esi + 0x11c], edi
mov dword [esi + 0x120], edi
mov dword [esi + 0x124], edi
mov dword [esi + 0x128], edi
mov dword [esi + 0x138], edi
mov dword [esi + 0x16c], edi
mov dword [esi + 0x134], edi
call fcn.004a0820
test eax, eax
jne 0x5ad4b4
mov dword [esi + 0xdc], 1
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x5d60c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x10c]
test edi, edi
je 0x5d6345
fld dword [edi + 0x168]
fcomp dword [esi + 0x13c]
fnstsw ax
test ah, 0x40
je 0x5d60ff
fld dword [edi + 0x16c]
fcomp dword [esi + 0x140]
fnstsw ax
test ah, 0x40
jne 0x5d6345
fld dword [edi + 0x168]
push ebx
push ebp
call fcn.005faa4c
mov word [esi + 0x12e], ax
fld dword [edi + 0x16c]
call fcn.005faa4c
movsx ecx, word [esi + 0x12e]
mov dword [esp + 0x10], ecx
mov word [esi + 0x130], ax
fild dword [esp + 0x10]
movsx edx, ax
fsubr dword [edi + 0x168]
mov eax, dword [edi + 0x168]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fsubr dword [edi + 0x16c]
mov dword [esi + 0x13c], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [edi + 0x16c]
cdq
fstp dword [esp + 0x14]
sub eax, edx
mov dword [esi + 0x140], ecx
fmul dword [0x61b588]
mov edi, eax
mov eax, dword [esi + 0x18]
fld dword [esp + 0x14]
cdq
fmul dword [0x61b588]
sub eax, edx
mov cx, word [esi + 0x11a]
movsx edx, word [esi + 0x114]
mov dword [esp + 0x14], edx
mov ebx, eax
fild dword [esp + 0x14]
sar edi, 1
add di, word [esi + 0x90]
fld st(0)
sub di, word [esi + 0x118]
fmul st(2)
fxch st(1)
fmul st(3)
sar ebx, 1
add bx, word [esi + 0x94]
mov word [esi + 0x126], di
faddp st(1)
sub ebx, ecx
mov word [esi + 0x128], bx
call fcn.005faa4c
mov bp, ax
movsx eax, word [esi + 0x116]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
neg ebp
fld st(0)
fmul st(2)
fxch st(1)
fmul st(3)
fsubp st(1)
call fcn.005faa4c
mov cx, word [esi + 0x11a]
add edi, ebp
add eax, ecx
mov ecx, dword [esi + 0x110]
neg eax
movsx edx, word [esi + 0x130]
fstp st(0)
fstp st(0)
add ebx, eax
mov dword [esp + 0x14], edi
mov word [esi + 0x126], di
mov word [esi + 0x128], bx
mov edi, dword [ecx + 0x8e8c]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ebx
lea ebx, [ecx*8]
mov edx, dword [edi + edx*4]
sub ebx, ecx
movsx edi, word [edx + ebx*4]
lea ecx, [edx + ebx*4]
xor ebx, ebx
movsx edx, word [esp + 0x14]
sub edi, edx
movsx edx, word [esi + 0x11c]
mov dword [esi + 0xf8], edi
mov bl, byte [ecx + 6]
movsx ecx, word [ecx + 2]
imul edx, ebx
add edx, ecx
movsx ecx, word [esp + 0x18]
sub edx, ecx
mov dword [esi + 0xfc], edx
mov edx, edi
mov dword [0x771034], edx
mov ecx, dword [esi + 0xfc]
mov dword [0x771038], ecx
mov cx, word [esi + 0x12e]
mov dx, word [esi + 0x130]
mov di, word [esi + 0x118]
add dx, cx
mov bx, word [esi + 0x11a]
imul edx, edi
add edx, ebp
pop ebp
mov word [esi + 0x12a], dx
mov dx, word [esi + 0x130]
sub dx, cx
imul edx, ebx
add edx, eax
mov ax, word [esi + 0x130]
mov word [esi + 0x138], ax
mov word [esi + 0x12c], dx
movsx eax, word [esi + 0x122]
cdq
sub eax, edx
sar eax, 1
add eax, 2
sub word [esi + 0x138], ax
imul edi, eax
sub ecx, eax
movsx eax, word [esi + 0x124]
cdq
mov word [esi + 0x136], cx
mov cx, word [esi + 0x126]
sub eax, edx
mov dx, word [esi + 0x128]
shl edi, 1
sar eax, 1
sub cx, di
inc eax
imul ebx, eax
add word [esi + 0x136], ax
sub word [esi + 0x138], ax
shl ebx, 1
sub dx, bx
mov word [esi + 0x132], cx
mov word [esi + 0x134], dx
pop ebx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x605339
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x661668
cmp edx, dword [eax]
je 0x60535b
add eax, 8
inc ecx
cmp eax, 0x6616f8
jl 0x60534c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x661668]
jne 0x605489
mov eax, dword [0x771598]
cmp eax, 1
je 0x605463
test eax, eax
jne 0x60538c
cmp dword [0x660ab4], 1
je 0x605463
cmp edx, 0xfc
je 0x605489
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6053c3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00603520
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005fe2b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x605406
lea eax, [ebp - 0x1a4]
push eax
call fcn.005fe2b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x642594
push edi
call fcn.005fac20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00603520
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00603530
lea eax, [ebp - 0xa0]
push 0x653b80
push eax
call fcn.00603530
push dword [esi + 0x66166c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00603530
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0060670f
add esp, 0x2c
pop edi
jmp 0x605489
lea eax, [ebp + 8]
lea esi, [esi + 0x66166c]
push 0
push eax
push dword [esi]
call fcn.005fe2b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x401280
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
push 0x40
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0x44
push 0
push eax
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 7
jbe 0x4012b8
mov esi, dword [esi]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401315
lea ecx, [esp + 8]
mov dword [esp + 8], 0xa
mov dword [esp + 0xc], 0
call fcn.00401a70
push 0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
call fcn.00401fdc
mov esp, ebp
pop ebp
ret

Function at 0x401770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
push 4
call fcn.00401fea
add esp, 4
lea ecx, [esp + 0x14]
mov dword [eax], 0x401330
push ecx
push 0
push eax
push 0x401e00
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esp + 0x10], eax
test eax, eax
je 0x40184d
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x401845
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x401845
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
xorps xmm0, xmm0
push eax
push eax
push eax
lea eax, [esp + 0x24]
movlpd qword [esp + 0x1c], xmm0
push eax
call esi
test eax, eax
je 0x401820
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x18]
push eax
call edi
lea eax, [esp + 0x18]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
jne 0x401801
cmp dword [esp + 0x14], 0
je 0x40182d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401fdc
mov esp, ebp
pop ebp
ret 0x10
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [esp + 0x18], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3