joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov edx, dword [ebp + 0xc]
sub esp, 0x34
mov ecx, eax
sub ecx, 0xa74b20
push ebx
add ecx, 0x160
cmp ecx, 0x20600
push esi
push edi
jge 0x4e85ec
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 0x78]
movzx ecx, byte [esi + 0x13]
movsx ebx, word [esi + 8]
movzx edi, word [esi + 0xa]
lea ecx, [ecx + edx + 1]
add ebx, esi
mov dword [eax + 0x100], eax
shl edx, 4
add edx, ebx
mov ebx, dword [ebp + 8]
mov dword [eax + 0x10c], ebx
mov bl, byte [ebp + 0xc]
mov dword [eax + 0x104], edx
mov byte [eax + 0x109], bl
lea ecx, [ecx + ecx*2]
shl ecx, 4
mov dl, byte [ecx + esi + 0x17]
add ecx, esi
or dl, 0x40
mov byte [eax + 0x108], dl
movss xmm0, dword [0x6e5b14]
movss xmm2, dword [ecx + 0x3c]
add edi, ecx
movaps xmm1, xmm0
unpcklps xmm1, xmm0
movaps xmm3, xmm0
unpcklps xmm3, xmm2
movaps xmm2, xmmword [ecx + 0x30]
shufps xmm3, xmm1, 0x44
subps xmm2, xmm3
movss xmm3, dword [edi + 0xc]
movaps xmm4, xmm0
unpcklps xmm4, xmm3
movaps xmm3, xmmword [edi]
shufps xmm4, xmm1, 0x44
subps xmm3, xmm4
movss xmm4, dword [edi + 0x3c]
movaps xmm5, xmm0
unpcklps xmm5, xmm4
movaps xmm4, xmmword [edi + 0x30]
shufps xmm5, xmm1, 0x44
subps xmm4, xmm5
movss xmm5, dword [ecx + 0xc]
unpcklps xmm0, xmm5
shufps xmm0, xmm1, 0x44
movaps xmm1, xmmword [ecx]
subps xmm1, xmm0
movaps xmmword [eax + 0x110], xmm1
movaps xmmword [eax + 0x120], xmm2
movaps xmmword [eax + 0x130], xmm3
movaps xmmword [eax + 0x140], xmm4
mov dx, word [esi + 0xc]
mov esi, dword [eax + 0x104]
mov word [eax + 0x10a], dx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0x150], ecx
movzx ecx, dx
lea edi, [ecx + ecx]
lea edx, [ecx*4]
mov ebx, ecx
mov dword [esp + 0x1c], esi
add esi, edi
sub ebx, edi
lea ecx, [ecx + ecx*2]
sub ecx, edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], 4
lea edx, [eax + 0x20]
mov dword [esp + 0x20], ecx
jmp 0x4e85b4
mov ecx, dword [esp + 0x20]
movaps xmm2, xmmword [ecx + esi]
movaps xmm0, xmmword [ebx + esi]
movaps xmm1, xmmword [esi]
movaps xmm3, xmmword [edi]
mov ecx, dword [esp + 0x3c]
movaps xmmword [edx - 0x20], xmm3
movaps xmmword [edx - 0x10], xmm0
movaps xmmword [edx], xmm1
movaps xmmword [edx + 0x10], xmm2
add edi, ecx
add esi, ecx
add edx, 0x40
sub dword [esp + 0x18], 1
jne 0x4e85b0
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x154], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eae70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x434
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x448]
fld dword [edi + 0x20]
mov dword [esp + 0x1c], 0xffffffff
fld dword [esp + 0x44c]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esp + 0x20]
mov eax, dword [esp + 0x20]
fld dword [edi + 0x24]
mov dword [esp + 0x34], eax
fmul st(1)
fstp dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x38], ecx
fmul dword [edi + 0x28]
fstp dword [esp + 0x28]
mov edx, dword [esp + 0x28]
fldz
mov dword [esp + 0x3c], edx
fld dword [esp + 0x20]
fucompi st(1)
fstp st(0)
lahf
test ah, 0x44
jp 0x4eaeec
movss xmm0, dword [esp + 0x28]
ucomiss xmm0, dword [0x6e5b14]
lahf
test ah, 0x44
jnp 0x4eb097
lea eax, [esp + 0x34]
push eax
call fcn.004e76f0
fld dword [esp + 0x450]
mov esi, dword [0xa95120]
add esp, 4
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x244]
push edx
push ecx
fstp dword [esp]
push esi
mov eax, edi
mov dword [esp + 0x24], esi
call fcn.004ea940
xorps xmm6, xmm6
add esp, 0x10
lea ebp, [esi + 0x250]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], ebp
jbe 0x4eafb4
lea ecx, [ecx]
mov esi, dword [esp + ebx*4 + 0x40]
movzx eax, byte [esi + 0x6f]
mov edi, dword [esp + ebx*4 + 0x240]
lea eax, [eax + edi + 1]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [esi + 0x78]
movzx eax, byte [eax + 0x19]
cmp eax, dword [esp + 0x1c]
je 0x4eaf7a
mov ecx, dword [esp + 0x448]
push ecx
mov dword [esp + 0x20], eax
call fcn.004e3ed0
add esp, 4
mov edx, dword [esp + 0x14]
comiss xmm6, dword [edx + 0x3c]
jae 0x4eafa0
mov eax, dword [esp + 0x448]
mov ecx, dword [eax]
push ecx
push edi
push esi
mov eax, ebp
call fcn.004e8460
add esp, 0xc
add ebp, 0x160
add ebx, 1
cmp ebx, dword [esp + 0x18]
jb 0x4eaf40
mov edi, dword [esp + 0x448]
mov esi, dword [esp + 0x14]
mov edx, dword [edi]
mov edi, dword [edi + 0x3c]
imul edx, edx, 0x70
movzx eax, byte [edx + 0xa9a0c4]
mov ecx, dword [eax*4 + 0xa95ddc]
movss xmm0, dword [edi*4 + 0x93a1d8]
comiss xmm6, xmm0
movss xmm1, dword [ecx + 4]
movss dword [esp + 0x18], xmm1
movss dword [esp + 0x14], xmm0
jbe 0x4eaff2
movaps xmm0, xmm1
movss dword [esp + 0x14], xmm0
fld dword [esp + 0x18]
fld dword [esp + 0x14]
fcomi st(1)
jbe 0x4eb02d
fld dword [esp + 0x44c]
fmul qword [0x6f9c40]
fsubp st(1)
fstp dword [esp + 0x14]
fsubr dword [esp + 0x14]
fstp dword [esp + 0x18]
fldz
fld dword [esp + 0x18]
fcompi st(1)
fstp st(0)
jb 0x4eb05c
movss xmm0, dword [esp + 0x14]
jmp 0x4eb065
fxch st(1)
fcomi st(1)
jbe 0x4eb061
fld dword [esp + 0x44c]
fmul qword [0x6f9c40]
faddp st(2)
fxch st(1)
fstp dword [esp + 0x14]
fsubr dword [esp + 0x14]
fstp dword [esp + 0x18]
fldz
fld dword [esp + 0x18]
fcompi st(1)
fstp st(0)
jb 0x4eb025
movaps xmm0, xmm1
jmp 0x4eb065
fstp st(1)
fstp st(0)
mov ecx, ebp
sub ecx, dword [esp + 0x30]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
movss dword [edi*4 + 0x93a1d8], xmm0
je 0x4eb097
mov byte [esi + 0x41], al
add dword [0xa95124], 1
mov dword [0xa95120], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x434
ret
Function at 0x4f2d20
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x28
mov edx, dword [esi + 0x1c]
push edi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
je 0x4f2e24
test edi, edi
jbe 0x4f2e24
push str.Client_Connected._n
call fcn.00408d10
add esp, 4
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push edi
mov dword [esi + 0x20], edi
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4f2da3
call fcn.004f2a90
push eax
push str.CSimpleTCP_Server::Start:_Couldnt_Make_Non_Blocking_Server_Socket.__s_n
call fcn.00408d10
mov ecx, dword [esi + 0x20]
add esp, 8
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
pop edi
add esp, 0x28
ret
mov edx, dword [0x93a12c]
mov eax, dword [esi + 0x20]
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1002
push 0xffff
add edx, 8
push eax
mov dword [esp + 0x20], edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4f2df2
call fcn.004f2a90
push eax
push str.CSimpleTCP_Client::Connect:_Couldnt_Set_Server_Socket_Recieve_Buffer_Size.__s_n
call fcn.00408d10
mov edx, dword [esi + 0x20]
add esp, 8
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
pop edi
add esp, 0x28
ret
mov eax, dword [esp + 0x1a]
push eax
call dword [sym.imp.WSOCK32.dll_ntohs]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi]
mov edx, dword [edx + 4]
mov word [esp + 0x14], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ecx
push eax
mov ecx, esi
mov dword [esi + 4], 2
call edx
pop edi
add esp, 0x28
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4f2e44
call fcn.004f2a90
push eax
push str.Accept_Failed:__s_n
call fcn.00408d10
add esp, 8
pop edi
add esp, 0x28
ret
Function at 0x4f2e50
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
sub esp, 8
cmp dword [esi + 4], 0
je 0x4f2e6c
push str.CSimpleTCP_Server::Start:_Couldnt_Start_Server._Not_Stopped__n
call fcn.00408d10
add esp, 4
xor eax, eax
add esp, 8
ret
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
jne 0x4f2ea3
push str.CSimpleTCP_Server::Start:_Couldnt_Create_Socket._n
call fcn.00408d10
call fcn.004f2a90
push eax
push str.CSimpleTCP_Server::Start:_Couldnt_Create_Socket.__s_n
call fcn.00408d10
add esp, 0xc
xor eax, eax
add esp, 8
ret
push 4
lea ecx, [esp + 4]
push ecx
push 4
push 0xffff
push eax
mov dword [esp + 0x14], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4f2ee8
call fcn.004f2a90
push eax
push str.CSimpleTCP_Server::Start:_Couldnt_Make_Reusable_Server_Socket.__s_n
call fcn.00408d10
mov edx, dword [esi + 0x1c]
add esp, 8
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
add esp, 8
ret
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x10], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4f2f2c
call fcn.004f2a90
push eax
push 0x6b23f8
call fcn.00408d10
mov edx, dword [esi + 0x1c]
add esp, 8
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
add esp, 8
ret
mov ecx, dword [esi + 0x1c]
push 0x10
lea eax, [esi + 0xc]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
jne 0x4f2f64
call fcn.004f2a90
push eax
push str.CSimpleTCP_Server::Start:_Couldnt_Bind_Socket.__s_n
call fcn.00408d10
mov edx, dword [esi + 0x1c]
add esp, 8
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
add esp, 8
ret
mov eax, dword [esi + 0x1c]
push 1
push eax
call dword [sym.imp.WSOCK32.dll_listen]
cmp eax, 0xffffffff
jne 0x4f2f98
call fcn.004f2a90
push eax
push str.CSimpleTCP_Server::Start:_Couldnt_Set_Socket_Listen.__s_n
call fcn.00408d10
mov ecx, dword [esi + 0x1c]
add esp, 8
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
add esp, 8
ret
mov dword [esi + 4], 1
mov eax, 1
add esp, 8
ret
Function at 0x4fd4c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + 4]
mov ecx, dword [0xa35fd0]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
xor edi, edi
mov dword [0xa35ffc], edi
mov dword [0xa36000], edi
mov esi, dword [eax + 4]
mov al, byte [esi]
add esi, 1
test al, al
mov dword [esp + 0x14], esi
je 0x4fd6d3
cmp al, 0xff
je 0x4fd663
movzx edx, al
mov eax, edi
mov dword [esp + 0x10], edx
shl eax, 5
lea esi, [edi + 2]
mov dword [esp + 0x18], 2
test byte [esp + 0x10], 1
je 0x4fd55a
mov ecx, dword [ebx]
mov edx, edi
shr edx, 3
lea ebp, [edx + ecx]
mov ecx, edi
and ecx, 7
mov dl, 1
shl dl, cl
or byte [ebp], dl
mov ecx, dword [0xa35fd0]
mov edx, 1
add dword [0xa35ffc], edx
cmp dword [eax + ecx + 0x30], 0
jne 0x4fd55a
cmp dword [eax + ecx + 0x34], 0
jne 0x4fd55a
add dword [0xa36000], edx
mov edx, dword [esp + 0x10]
shr edx, 1
test dl, 1
mov dword [esp + 0x10], edx
je 0x4fd5a6
mov ecx, dword [ebx]
lea edx, [esi - 1]
shr edx, 3
lea ebp, [edx + ecx]
lea ecx, [esi - 1]
and ecx, 7
mov dl, 1
shl dl, cl
or byte [ebp], dl
mov ecx, dword [0xa35fd0]
mov edx, 1
add dword [0xa35ffc], edx
cmp dword [eax + ecx + 0x50], 0
jne 0x4fd5a6
cmp dword [eax + ecx + 0x54], 0
jne 0x4fd5a6
add dword [0xa36000], edx
mov edx, dword [esp + 0x10]
shr edx, 1
test dl, 1
mov dword [esp + 0x10], edx
je 0x4fd5f0
mov ecx, dword [ebx]
mov edx, esi
shr edx, 3
lea ebp, [edx + ecx]
mov ecx, esi
and ecx, 7
mov dl, 1
shl dl, cl
or byte [ebp], dl
mov ecx, dword [0xa35fd0]
mov edx, 1
add dword [0xa35ffc], edx
cmp dword [eax + ecx + 0x70], 0
jne 0x4fd5f0
cmp dword [eax + ecx + 0x74], 0
jne 0x4fd5f0
add dword [0xa36000], edx
mov edx, dword [esp + 0x10]
shr edx, 1
test dl, 1
mov dword [esp + 0x10], edx
je 0x4fd640
mov edx, dword [ebx]
lea ecx, [esi + 1]
mov ebp, ecx
shr ebp, 3
add ebp, edx
and ecx, 7
mov dl, 1
shl dl, cl
or byte [ebp], dl
mov ecx, dword [0xa35fd0]
mov edx, 1
add dword [0xa35ffc], edx
cmp dword [eax + ecx + 0x90], 0
jne 0x4fd640
cmp dword [eax + ecx + 0x94], 0
jne 0x4fd640
add dword [0xa36000], edx
shr dword [esp + 0x10], 1
add edi, 4
add esi, 4
add eax, 0x80
sub dword [esp + 0x18], 1
jne 0x4fd518
mov esi, dword [esp + 0x14]
jmp 0x4fd6f0
movzx eax, byte [esi]
movzx edx, word [ecx + 6]
add eax, eax
add eax, eax
add eax, eax
add esi, 1
lea ebp, [eax + edi]
cmp ebp, edx
mov dword [esp + 0x14], esi
jb 0x4fd682
sub edx, edi
mov eax, edx
add dword [0xa35ffc], eax
test eax, eax
jbe 0x4fd6f0
mov esi, edi
shl esi, 5
mov ebp, eax
mov eax, dword [ebx]
mov ecx, edi
shr ecx, 3
add eax, ecx
mov ecx, edi
and ecx, 7
mov dl, 1
shl dl, cl
or byte [eax], dl
mov ecx, dword [0xa35fd0]
cmp dword [esi + ecx + 0x30], 0
jne 0x4fd6c2
cmp dword [esi + ecx + 0x34], 0
jne 0x4fd6c2
add dword [0xa36000], 1
add edi, 1
add esi, 0x20
sub ebp, 1
jne 0x4fd693
mov esi, dword [esp + 0x14]
jmp 0x4fd6f0
movzx eax, byte [esi]
movzx edx, word [ecx + 6]
add eax, eax
add eax, eax
add eax, eax
lea ebp, [eax + edi]
add esi, 1
cmp ebp, edx
jb 0x4fd6ee
sub edx, edi
mov eax, edx
add edi, eax
movzx eax, word [ecx + 6]
cmp edi, eax
jb 0x4fd4e8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x501fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
movss xmm0, dword [esp + 0x30]
fld dword [esp + 0x34]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
push 0
sub esp, 8
fstp dword [esp + 4]
mov esi, eax
mov ax, word [esp + 0x48]
fld dword [esp + 0x4c]
movss dword [esp + 0x2c], xmm0
fstp dword [esp]
movss xmm0, dword [esp + 0x50]
lea edi, [esp + 0x24]
mov byte [esp + 0x28], 0
mov byte [esp + 0x29], 0
mov word [esp + 0x24], ax
movss dword [esp + 0x30], xmm0
call fcn.004e69d0
mov ax, word [esp + 0x24]
add esp, 0xc
test ax, ax
jl 0x5021a7
mov edx, dword [ebp + esi*4 + 0x159b0]
movsx ecx, ax
cmp edx, ecx
mov dword [esp + 0x14], edx
je 0x5021a7
mov eax, ecx
sub eax, edx
mov dword [ebp + esi*4 + 0x159b0], ecx
mov dword [esp + 0x38], 0xffffffff
jns 0x50205c
mov dword [esp + 0x38], 1
neg eax
cmp eax, 0xa
jg 0x5021a7
cmp word [esp + 0x1a], 0
jl 0x5021a7
mov eax, dword [esp + 0x38]
fld dword [esp + 0x4c]
fld dword [esp + 0x48]
movss xmm0, dword [esp + 0x54]
fldz
movss xmm1, dword [esp + 0x50]
fld dword [esp + 0x40]
movss xmm2, dword [esp + 0x4c]
movss xmm3, dword [esp + 0x48]
fld dword [esp + 0x44]
mov esi, ecx
mov edi, esi
imul edi, edi, 0x88
imul eax, eax, 0x88
mov dword [esp + 0x3c], esi
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0x159ac]
cmp ecx, 0x190
jge 0x50219d
mov edx, dword [0xa6f96c]
movzx ebx, byte [edi + edx + 0x6c]
lea eax, [edi + edx]
movsx edx, word [esp + 0x1a]
cmp edx, ebx
jge 0x502187
cmp word [eax + 0x76], 0
jl 0x502187
mov esi, dword [eax + 0x78]
fld st(1)
movzx edx, byte [esi + 0x13]
fmul st(4)
add edx, 1
fld st(1)
lea edx, [edx + edx*2]
fmul st(6)
shl edx, 4
add edx, esi
lea ecx, [ecx + ecx*4]
faddp st(1)
lea ecx, [ebp + ecx*8 + 0x11b2c]
mov dword [ecx], edx
movsx edx, word [eax + 0x76]
mov dword [ecx + 4], edx
mov dl, byte [esp + 0x1a]
mov byte [ecx + 9], dl
fstp dword [ecx + 0x20]
movss dword [ecx + 0x24], xmm1
movss dword [ecx + 0x14], xmm0
movss dword [ecx + 0x18], xmm3
movss dword [ecx + 0x1c], xmm2
fld dword [eax + 0x60]
fmul st(4)
fld dword [eax + 0x64]
fmul st(6)
faddp st(1)
fstp dword [esp + 0x40]
fld dword [esp + 0x40]
fcompi st(3)
jbe 0x502167
mov edx, dword [ecx]
lea eax, [ebx + ebx*2]
shl eax, 4
mov byte [ecx + 0xa], 1
mov byte [ecx + 8], bl
add eax, edx
jmp 0x502171
mov eax, dword [ecx]
mov byte [ecx + 0xa], 0xff
mov byte [ecx + 8], 0xff
fld dword [eax]
mov esi, dword [esp + 0x3c]
fstp dword [ecx + 0xc]
fld dword [eax + 8]
fstp dword [ecx + 0x10]
add dword [ebp + 0x159ac], 1
add esi, dword [esp + 0x38]
add edi, dword [esp + 0x10]
cmp esi, dword [esp + 0x14]
mov dword [esp + 0x3c], esi
jne 0x5020b7
fstp st(4)
fstp st(2)
fstp st(0)
fstp st(1)
fstp st(0)
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x20
Function at 0x544b70
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, 0x9e3779b9
xor esi, esi
cmp edx, 0xc
mov ebp, edx
mov ebx, edi
jb 0x544c7c
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
mov dword [esp + 0x10], edx
jmp 0x544ba0
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, edi
shl eax, 8
lea edi, [edx + eax]
movzx eax, byte [ecx + 0xb]
movzx edx, byte [ecx + 0xa]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, esi
shl eax, 8
lea esi, [edx + eax]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 2]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 1]
shl eax, 8
add eax, edx
movzx edx, byte [ecx]
shl eax, 8
add eax, edx
sub eax, esi
sub eax, edi
sub edi, esi
mov edx, esi
shr edx, 0xd
add eax, ebx
xor eax, edx
sub edi, eax
mov edx, eax
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 0xd
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 0xc
xor eax, edx
sub edi, esi
sub edi, eax
mov edx, eax
shl edx, 0x10
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 5
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 3
xor eax, edx
sub edi, esi
mov ebx, eax
sub edi, ebx
shl eax, 0xa
xor edi, eax
sub esi, edi
mov edx, edi
sub esi, ebx
shr edx, 0xf
xor esi, edx
add ecx, 0xc
sub ebp, 0xc
sub dword [esp + 0x10], 1
jne 0x544ba0
mov edx, dword [esp + 0x18]
add ebp, 0xffffffff
add esi, edx
cmp ebp, 0xa
ja case.default.0x544c86
jmp dword [ebp*4 + 0x544d54]
movzx eax, byte [ecx + 0xa]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 9]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 8]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 7]
shl edx, 0x18
add edi, edx
movzx eax, byte [ecx + 6]
shl eax, 0x10
add edi, eax
movzx edx, byte [ecx + 5]
shl edx, 8
add edi, edx
movzx eax, byte [ecx + 4]
add edi, eax
movzx edx, byte [ecx + 3]
shl edx, 0x18
add ebx, edx
movzx eax, byte [ecx + 2]
shl eax, 0x10
add ebx, eax
movzx edx, byte [ecx + 1]
shl edx, 8
add ebx, edx
movzx eax, byte [ecx]
add ebx, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xd
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, ebx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xc
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0x10
xor edi, edx
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 5
xor esi, eax
mov eax, esi
sub ebx, eax
sub ebx, edi
mov ecx, eax
sub edi, eax
shr ecx, 3
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0xa
xor edi, edx
sub eax, edi
sub eax, ebx
shr edi, 0xf
xor eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x54ce50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push esi
mov esi, dword [esp + 0x84]
push 0x50
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004ae0b0
add esp, 0xc
cmp dword [0x9cdccc], 0
je 0x54ce83
fld dword [0x939f04]
fld st(0)
fmul dword [esp + 0x64]
jmp 0x54cee4
cmp dword [0x942398], 0
je 0x54ceb7
movzx ecx, word [0x9cdcd6]
mov dword [esp + 0x84], ecx
fild dword [esp + 0x84]
fsub qword [0x6f9b00]
fmul qword [0x6f99e0]
fadd dword [esp + 0x68]
fstp dword [esp + 0x68]
jmp 0x54cf0c
fld dword [esp + 0x64]
movzx edx, word [0x9cdcd4]
fsub qword [0x6f9d38]
mov dword [esp + 0x64], edx
fld dword [0x939f04]
fld st(0)
fmulp st(2)
fild dword [esp + 0x64]
fmul qword [0x6f99e0]
faddp st(2)
fxch st(1)
fstp dword [esp + 0x64]
fld dword [0x939f00]
fld st(0)
fmul dword [esp + 0x68]
fstp dword [esp + 0x68]
fld dword [esp + 0x6c]
fmulp st(2)
fxch st(1)
fstp dword [esp + 0x6c]
fmul dword [esp + 0x70]
fstp dword [esp + 0x70]
test esi, esi
fld dword [esp + 0x64]
fadd dword [esp + 0x6c]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
movss xmm4, dword [esp + 0x64]
fstp dword [esp + 0x6c]
fld dword [esp + 0x68]
movss xmm0, dword [esp + 0x6c]
fadd dword [esp + 0x70]
movss xmm5, dword [esp + 0x68]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x80]
fstp dword [esp + 0x6c]
movaps xmm1, xmm0
movss xmm2, dword [esp + 0x6c]
movaps xmm3, xmm2
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
movss dword [esp + 8], xmm4
movss dword [esp + 0xc], xmm5
movss dword [esp + 0x10], xmm1
movss dword [esp + 0x14], xmm5
movss dword [esp + 0x18], xmm4
movss dword [esp + 0x1c], xmm3
movss dword [esp + 0x20], xmm0
movss dword [esp + 0x24], xmm2
je 0x54cffe
test edi, edi
je 0x54cffe
movss xmm0, dword [esi]
fld dword [esi + 8]
movss xmm1, dword [esi + 4]
movss dword [esp + 0x68], xmm0
fadd dword [esp + 0x68]
movss dword [esp + 0x38], xmm0
movss dword [esp + 0x40], xmm0
movss xmm0, dword [esi + 0xc]
fstp dword [esp + 0x68]
movss dword [esp + 0x64], xmm1
fld dword [esp + 0x68]
movss dword [esp + 0x68], xmm0
fst dword [esp + 0x3c]
movss dword [esp + 0x48], xmm1
fstp dword [esp + 0x44]
movss dword [esp + 0x4c], xmm1
fld dword [esp + 0x68]
movss dword [esp + 0x50], xmm0
fadd dword [esp + 0x64]
fstp dword [esp + 0x54]
mov ecx, dword [esp + 0x60]
push edi
push ecx
lea eax, [esp + 0x10]
call fcn.00402f70
pop esi
add esp, 0x58
ret
Function at 0x555420
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x104
cmp dword [0x942110], 0
jne 0x555438
xor eax, eax
add esp, 0x104
ret
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x55542f
push 0x104
lea eax, [esp + 4]
push eax
push str._SystemRoot_ehomeehshell.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x55542f
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x55542f
push 1
push 0
push 0
lea edx, [esp + 0xc]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
add esp, 0x104
ret