joyce8/EMBER2024-capa huggingface dataset:
Function at 0x575dd0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
test ecx, ecx
jne 0x575de1
xor eax, eax
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
xor edi, edi
test ebx, ebx
jbe 0x575ed8
mov eax, 3
sub eax, ebp
cmp esi, ebx
mov dword [esp + 0x14], eax
jae 0x575e11
mov al, byte [ecx + esi]
mov byte [esp + 0x12], al
jmp 0x575e16
mov byte [esp + 0x12], 0
lea eax, [esi + 1]
cmp eax, ebx
jae 0x575e27
mov dl, byte [esi + ecx + 1]
mov byte [esp + 0x13], dl
jmp 0x575e2c
mov byte [esp + 0x13], 0
inc eax
cmp eax, ebx
jae 0x575e3b
mov al, byte [esi + ecx + 2]
mov byte [esp + 0x11], al
jmp 0x575e40
mov byte [esp + 0x11], 0
add esi, 3
test ebp, ebp
je 0x575ecd
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
lea edx, [edi + ebp]
add ecx, edx
cmp eax, ecx
jb 0x575ec9
movzx ecx, byte [esp + 0x12]
mov eax, ecx
shr eax, 2
mov al, byte [eax + 0x79dd60]
mov byte [edx], al
movzx edx, byte [esp + 0x13]
and ecx, 3
shl ecx, 4
mov eax, edx
shr eax, 4
or eax, ecx
mov cl, byte [eax + 0x79dd60]
lea eax, [ebx + 2]
cmp esi, eax
mov byte [edi + ebp + 1], cl
mov cl, byte [esp + 0x11]
jne 0x575e99
mov al, 0x3d
jmp 0x575ead
movzx eax, cl
and edx, 0xf
shr eax, 6
shl edx, 2
or eax, edx
mov al, byte [eax + 0x79dd60]
lea edx, [ebx + 1]
cmp esi, edx
mov byte [edi + ebp + 2], al
jb 0x575ebc
mov al, 0x3d
jmp 0x575ec5
and ecx, 0x3f
mov al, byte [ecx + 0x79dd60]
mov byte [edi + ebp + 3], al
mov ecx, dword [esp + 0x1c]
add edi, 4
cmp esi, ebx
jb 0x575e08
cmp byte [esp + 0x2c], 1
jne 0x575eee
test ebp, ebp
je 0x575eed
cmp dword [esp + 0x28], edi
jbe 0x575eed
mov byte [edi + ebp], 0
inc edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x577570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x74
push ebx
push esi
xor eax, eax
mov esi, ecx
cmp word [esi + 0x1e], ax
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
jbe 0x5776d2
mov ebx, dword [ebp + 8]
mov dword [esp + 0x20], eax
lea ecx, [ecx]
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x20]
fld dword [eax + ecx]
add eax, ecx
fld dword [eax + 4]
mov ecx, dword [esp + 0x18]
fld dword [eax + 8]
mov dword [eax + 0xc], ecx
fstp dword [esp + 0x78]
mov edx, dword [esp + 0x78]
fxch st(1)
fstp dword [eax]
mov dword [eax + 8], edx
fstp dword [eax + 4]
mov eax, dword [esi + 4]
cmp eax, 2
fild dword [esp + 0x1c]
mov byte [esi + 0x18], 1
fst dword [esp + 0x24]
fld dword [esi + 0xc]
jne 0x5775f1
movzx edx, word [esi + 0x1e]
fstp st(0)
dec edx
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fxch st(1)
fcomp st(1)
fnstsw ax
fstp st(0)
test ah, 5
jp 0x5776b2
mov eax, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x58]
push ecx
mov ecx, esi
call fcn.005702d0
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov edi, 1
cmp ebx, edi
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x28], edi
jl 0x5776b2
fild dword [ebp + 8]
fstp dword [esp + 0x2c]
fild dword [esp + 0x28]
push 0
push ecx
lea edx, [esp + 0x68]
fdiv dword [esp + 0x34]
mov ecx, esi
fadd dword [esp + 0x2c]
fstp dword [esp]
push edx
call fcn.005702d0
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x34], ecx
push eax
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x40], edx
call fcn.0043ce80
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
add esp, 8
fadd dword [esp + 0x18]
inc edi
cmp edi, ebx
fstp dword [esp + 0x18]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x28], edi
jle 0x577641
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add edx, 0x10
mov dword [esp + 0x20], edx
movzx edx, word [esi + 0x1e]
inc eax
cmp eax, edx
mov dword [esp + 0x1c], eax
jl 0x5775a0
mov eax, dword [esp + 0x18]
mov ecx, esi
mov dword [esi + 0x14], eax
call fcn.0056fed0
pop edi
mov byte [esi + 0x18], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x57a4d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x77852c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
xor edx, edx
mov dword [esi + 0x84], edx
lea eax, [esi + 0x90]
mov dword [esi + 0x88], edx
push edi
mov dword [esp + 0xc], esi
mov dword [eax], eax
mov dword [eax + 4], eax
lea ebp, [esi + 0x98]
mov dword [esp + 0x18], edx
mov dword [ebp], ebp
mov dword [ebp + 4], ebp
or eax, 0xffffffff
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0xd0], eax
xor eax, eax
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
mov dword [esi + 0x88], edx
mov dword [esi + 0x74], edx
mov dword [esi + 0xd4], edx
mov dword [esi + 0xd8], edx
mov dword [esi + 0xdc], edx
mov dword [esi + 0xc4], 0x41700000
mov dword [esi + 0xa0], edx
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x20], connect
mov dword [esi + 0x8c], edx
mov dword [esi + 0xa4], edx
mov dword [esi + 0xa8], edx
mov dword [esi + 0xb0], edx
mov dword [esi + 0xb4], edx
mov dword [esi + 0xb8], edx
mov dword [esi + 0xbc], edx
mov dword [esi + 0xc0], edx
mov dword [esi + 0xc8], edx
mov dword [esi + 0xcc], edx
mov dword [esi + 0x40e4], edx
mov dword [esi + 0x40e8], edx
mov ecx, 0x400
lea edi, [esi + 0x40ec]
rep stosd dword es:[edi], eax
cmp byte [0x865564], dl
mov byte [esp + 0x18], 1
je 0x57a609
mov eax, dword [0x86558c]
mov dword [esi + 0x8c], eax
push 0x865590
mov ecx, ebp
mov dword [0x86558c], edx
call fcn.0043bf10
mov ecx, dword [esp + 0x10]
pop edi
mov byte [esi + 0x50ec], 1
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5821c0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 1
jl 0x5821d2
cmp eax, 0xa
jle 0x582262
cmp eax, 0xb
jl 0x5821e2
cmp eax, 0x14
jg 0x5821e2
mov eax, 1
ret
cmp eax, 0x15
jl 0x5821f2
cmp eax, 0x1e
jg 0x5821f2
mov eax, 3
ret
cmp eax, 0x1f
jl 0x582202
cmp eax, 0x28
jg 0x582202
mov eax, 2
ret
cmp eax, 0x29
jl 0x582212
cmp eax, 0x32
jg 0x582212
mov eax, 4
ret
cmp eax, 0x33
jl 0x58221c
cmp eax, 0x3c
jle 0x5821dc
cmp eax, 0x3d
je 0x582262
cmp eax, 0x43
je 0x582262
cmp eax, 0x3e
je 0x5821dc
cmp eax, 0x44
je 0x5821dc
cmp eax, 0x3f
je 0x5821ec
cmp eax, 0x45
je 0x5821ec
cmp eax, 0x40
je 0x5821fc
cmp eax, 0x46
je 0x5821fc
cmp eax, 0x41
je 0x58220c
cmp eax, 0x47
je 0x58220c
cmp eax, 0x42
je 0x58225c
cmp eax, 0x48
je 0x58225c
or eax, 0xffffffff
ret
mov eax, 5
ret
xor eax, eax
ret
Function at 0x582370
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test ecx, ecx
jne 0x5823e7
mov ecx, dword [esp + 4]
cmp ecx, 1
jl 0x58238f
cmp ecx, 0xa
jg 0x58238f
mov eax, 6
ret
cmp ecx, 0xb
jl 0x58239f
cmp ecx, 0x14
jg 0x58239f
mov eax, 7
ret
cmp ecx, 0x15
jl 0x5823af
cmp ecx, 0x1e
jg 0x5823af
mov eax, 8
ret
cmp ecx, 0x1f
jl 0x5823bf
cmp ecx, 0x28
jg 0x5823bf
mov eax, 9
ret
cmp ecx, 0x29
jl 0x5823cf
cmp ecx, 0x32
jg 0x5823cf
mov eax, 0xa
ret
cmp ecx, 0x33
jl 0x5824ed
cmp ecx, 0x3c
jg 0x5824ed
mov eax, 0xb
ret
cmp ecx, 1
jne 0x582458
mov ecx, dword [esp + 4]
cmp ecx, 1
jl 0x582400
cmp ecx, 0xa
jg 0x582400
mov eax, 0xc
ret
cmp ecx, 0xb
jl 0x582410
cmp ecx, 0x14
jg 0x582410
mov eax, 0xd
ret
cmp ecx, 0x15
jl 0x582420
cmp ecx, 0x1e
jg 0x582420
mov eax, 0xe
ret
cmp ecx, 0x1f
jl 0x582430
cmp ecx, 0x28
jg 0x582430
mov eax, 0xf
ret
cmp ecx, 0x29
jl 0x582440
cmp ecx, 0x32
jg 0x582440
mov eax, 0x10
ret
cmp ecx, 0x33
jl 0x5824ed
cmp ecx, 0x3c
jg 0x5824ed
mov eax, 0x11
ret
cmp ecx, 2
jne 0x5824a3
mov ecx, dword [esp + 4]
cmp ecx, 0x3d
jne 0x58246c
mov eax, 0x12
ret
cmp ecx, 0x3e
jne 0x582477
mov eax, 0x13
ret
cmp ecx, 0x3f
jne 0x582482
mov eax, 0x14
ret
cmp ecx, 0x40
jne 0x58248d
mov eax, 0x15
ret
cmp ecx, 0x41
jne 0x582498
mov eax, 0x16
ret
cmp ecx, 0x42
jne 0x5824ed
mov eax, 0x17
ret
cmp ecx, 3
jne 0x5824ed
mov ecx, dword [esp + 4]
cmp ecx, 0x43
jne 0x5824b7
mov eax, 0x18
ret
cmp ecx, 0x44
jne 0x5824c2
mov eax, 0x19
ret
cmp ecx, 0x45
jne 0x5824cd
mov eax, 0x1a
ret
cmp ecx, 0x46
jne 0x5824d8
mov eax, 0x1b
ret
cmp ecx, 0x47
jne 0x5824e3
mov eax, 0x1c
ret
cmp ecx, 0x48
jne 0x5824ed
mov eax, 0x1d
ret
Function at 0x5a7be0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x778b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
xor edi, edi
lea ecx, [esi + 0x30]
push ecx
mov dword [esp + 0x18], edi
mov dword [esi], 0x7a20c4
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
call fcn.0043c7e0
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x118], edi
mov dword [esi + 0x120], edi
mov dword [esi + 0x124], edi
mov dword [esi + 0x128], edi
fld dword [esi + 0x114]
fld dword [esi + 0x118]
mov edx, edi
mov dword [esi + 0x130], edx
fxch st(1)
fstp dword [esi + 0x134]
add esp, 4
fstp dword [esi + 0x138]
mov eax, dword [esi + 0x120]
fld dword [esi + 0x124]
fld dword [esi + 0x128]
mov dword [esi + 0x140], eax
fxch st(1)
mov eax, 1
fstp dword [esi + 0x144]
fstp dword [esi + 0x148]
mov dword [esi + 0x200], edi
mov dword [esi + 0x204], edi
mov dword [esi + 0x15c], edi
mov dword [esi + 0x208], 0x3f800000
mov dword [esi + 0x150], eax
mov dword [esi + 0x154], eax
mov dword [esi + 0x158], eax
mov ecx, dword [0x7fbef0]
mov dword [esi + 0x160], ecx
mov ecx, esi
call fcn.0059b600
lea edx, [esi + 0xc]
push 0x7a20bc
push edx
call fcn.0043dc40
mov ecx, dword [esp + 0x14]
add esp, 8
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x5a8fe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x778928
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x7a2144
mov dword [esp + 0x18], 0
call fcn.0059e850
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x5a901f
mov eax, dword [ecx]
push 1
call dword [eax]
mov edi, dword [esi + 0x14]
test edi, edi
je 0x5a9036
mov ecx, edi
call fcn.00577140
push edi
call fcn.005752c0
add esp, 4
mov ecx, dword [esi + 0x18]
push ecx
call fcn.005752c0
mov edx, dword [esi + 0x28]
push edx
call fcn.005752c0
mov eax, dword [esi + 0x2c]
push eax
call fcn.005752c0
add esp, 0xc
lea edi, [esi + 0x38]
mov ebx, 4
lea esp, [esp]
mov ecx, dword [edi]
test ecx, ecx
je 0x5a906c
mov edx, dword [ecx]
push 1
call dword [edx]
add edi, 4
dec ebx
jne 0x5a9060
mov ecx, dword [esp + 0x10]
pop edi
mov dword [esi], 0x78427c
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5a9d90
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x778979
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 3
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.005a01b0
mov dword [esi], 0x7a2208
mov eax, dword [0x86b254]
mov ecx, dword [0x86b27c]
inc eax
cmp eax, ecx
mov dword [0x86b254], eax
jle 0x5a9de2
mov dword [0x86b27c], eax
mov byte [esi + 0x12], 0
push fcn.004022d0
push fcn.0059f810
lea ebx, [esi + 0x70]
push 9
xor edi, edi
push 0x30
lea ecx, [ebx + 0x20]
mov dword [esi], 0x7a22a8
push ecx
mov dword [esp + 0xa0], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
call fcn.0075c18d
mov dword [ebx + 0x10], 2
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x1d4], edi
mov byte [ebx + 0x1d0], 0
mov eax, dword [0x86b25c]
mov ecx, dword [0x86b284]
inc eax
cmp eax, ecx
mov byte [esp + 0x8c], 1
mov dword [0x86b25c], eax
jle 0x5a9e4e
mov dword [0x86b284], eax
call fcn.00440f10
cmp eax, edi
je 0x5a9e5c
mov dword [eax + 8], esi
jmp 0x5a9e5e
xor eax, eax
mov ecx, dword [0x86b5a4]
mov edi, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [0x86b5a4], eax
mov dword [eax + 4], ecx
mov dword [eax], 0x86b5a0
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x68], eax
sub edi, dword [eax + 8]
movsx edx, word [eax + 0x30]
push edx
sar edi, 5
call fcn.005d6ac0
push eax
push edi
lea eax, [esp + 0x34]
push str.TrackPolygon_d__s
push eax
call fcn.00440120
push 0x28
lea ecx, [esp + 0x40]
push ecx
lea edx, [esi + 0x30]
push edx
call fcn.0043dc70
mov edi, dword [ebp + 0x10]
mov ecx, dword [esi + 0x68]
add esp, 0x20
push edi
mov byte [esi + 0x57], 0
call fcn.005e0a00
mov dword [esi + 0x60], eax
mov dword [eax + 0x10], esi
cmp byte [edi], 0
setne al
mov byte [esi + 0x64], al
mov eax, dword [esi + 0x60]
fld dword [eax + 0x44]
fadd dword [eax + 0x30]
fmul dword [0x784550]
call fcn.0075bc00
and eax, 0xff
inc byte [eax + 0x86afa8]
mov ecx, dword [0x7a1878]
mov eax, dword [esi + 0x60]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.005a1740
mov eax, dword [esi + 0x60]
lea ecx, [eax + 0x1c]
push ecx
add eax, 0x14
push eax
mov ecx, esi
call fcn.005a0340
lea edx, [esp + 0x40]
push edx
call fcn.0043c7e0
mov ecx, dword [esp + 0x88]
add esp, 4
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5aa280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x778b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp + 0x1c]
mov dword [esi], 0x7a235c
fld dword [ecx + 8]
fld dword [ecx]
mov eax, 9
fst dword [esi + 0x28]
mov dword [esi + 0x24], eax
fld st(1)
lea edx, [ecx + 0x10]
fstp dword [esi + 0x2c]
mov dword [esi + 0x34], edx
fxch st(1)
lea edx, [ecx + 0x58]
fsub st(1)
xor ebx, ebx
mov dword [esp + 0x14], ebx
fdivr dword [0x7881f4]
fstp dword [esi + 0x30]
fstp st(0)
fld dword [ecx + 8]
fld dword [ecx]
mov dword [esi + 0x48], edx
fst dword [esi + 0x3c]
mov dword [esi + 0x38], 3
fld st(1)
lea edx, [ecx + 0x34]
fstp dword [esi + 0x40]
fxch st(1)
fsub st(1)
fdivr dword [0x7844c0]
fstp dword [esi + 0x44]
fstp st(0)
fld dword [ecx + 8]
fld dword [ecx]
mov dword [esi + 0x4c], eax
fst dword [esi + 0x50]
mov dword [esi + 0x5c], edx
fld st(1)
fstp dword [esi + 0x54]
fxch st(1)
fsub st(1)
fdivr dword [0x7881f4]
fstp dword [esi + 0x58]
fstp st(0)
fld dword [ecx + 4]
fld dword [ecx]
mov dword [esi + 0x60], eax
fst dword [esi + 0x64]
mov eax, dword [esp + 0x20]
fld st(1)
mov dword [esi + 0x70], 0x7fbf38
fstp dword [esi + 0x68]
fxch st(1)
fsub st(1)
fdivr dword [0x7881f4]
fstp dword [esi + 0x6c]
mov dword [esi + 0x1c], eax
mov eax, 0x3f800000
fstp st(0)
mov dword [esi + 0x18], ecx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x8c], 0xbf800000
mov dword [esi + 0x94], ebx
mov dword [esi + 0x80], eax
mov dword [esi + 0x90], eax
mov byte [esi + 0x88], bl
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xa4], ebx
call fcn.00457af0
fstp dword [esi + 0x98]
lea ecx, [esi + 0xc]
push str.Engine
push ecx
mov dword [esi + 0x20], ebx
call fcn.0043dc40
mov ecx, dword [esp + 0x14]
add esp, 8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x5ab8d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov ecx, dword [eax + 0x434]
push edi
mov edi, 1
cmp ecx, edi
je 0x5ab98c
mov al, byte [0x89e7e2]
test al, al
jne 0x5ab98c
mov eax, dword [0x890100]
test eax, eax
jne 0x5ab98c
mov eax, dword [0x890110]
test eax, eax
jne 0x5ab98c
mov ecx, dword [esi + 4]
fld dword [ecx + 0x20c]
fcomp dword [ecx + 0x214]
fnstsw ax
test ah, 0x41
jne 0x5ab972
fld dword [ecx + 0x210]
fcomp dword [ecx + 0x20c]
fnstsw ax
test ah, 5
jp 0x5ab972
fld dword [ecx + 0x214]
fcomp dword [0x784260]
fnstsw ax
test ah, 5
jp 0x5ab953
push 0
call fcn.005eb670
mov ecx, dword [esi + 4]
fld dword [ecx + 0x210]
fcomp dword [0x784260]
fnstsw ax
test ah, 5
jp 0x5ab98c
push 0
call fcn.005eb680
jmp 0x5ab98c
fld dword [ecx + 0x20c]
fcomp dword [0x784260]
fnstsw ax
test ah, 5
jp 0x5ab98c
push 0
call fcn.005eb690
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x20c]
mov dword [esp + 8], ecx
fld dword [esp + 8]
fcomp dword [0x7844f0]
fnstsw ax
test ah, 0x41
jp 0x5ab9b4
mov dword [esp + 8], 0
jmp 0x5ab9ff
fld dword [esp + 8]
fcomp dword [0x7d7d3c]
fnstsw ax
test ah, 0x41
jne 0x5ab9ff
mov eax, dword [esi + 0x4c]
cmp dword [eax + 0x3c], edi
jle 0x5ab9ff
mov ecx, dword [esi + 0x48]
fld dword [ecx + 0x14]
fmul dword [0x7a1d28]
fcomp dword [0x78759c]
fnstsw ax
test ah, 5
jp 0x5ab9ff
fld dword [0x784260]
fcomp dword [esp + 8]
fnstsw ax
test ah, 0x41
jne 0x5ab9ff
mov dword [esp + 8], 0x3f000000
movzx edx, word [edx + 0x1e0]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [esi + 0x48]
mov ecx, dword [esp + 8]
mov dword [eax + 0x78], ecx
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
call dword [edx + 0x24]
cmp eax, edi
mov ecx, dword [esi + 0x4c]
jle 0x5aba42
mov edx, dword [ecx + 0x18]
mov edx, dword [edx + 0x18]
inc edx
cmp eax, edx
jg 0x5aba42
cmp dword [ecx + 0x54], edi
jne 0x5aba3f
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], eax
mov ecx, dword [esi + 0x58]
call fcn.0059f6f0
mov ecx, dword [esi + 0x48]
mov dword [ecx + 0x84], eax
fld dword [0x7fbed8]
fcomp dword [0x784258]
fnstsw ax
test ah, 0x44
jnp 0x5aba72
mov edx, dword [0x7fbed8]
mov dword [esp + 0xc], edx
jmp 0x5aba7f
mov eax, dword [esi + 0x5c]
mov ecx, dword [eax + 0x440]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0xc]
mov edi, dword [ecx]
push edx
call dword [edi + 0x20]
mov ecx, dword [esi + 0x4c]
push eax
call fcn.005aa640
mov ecx, dword [esi + 4]
push eax
call dword [edi + 0x28]
mov edx, dword [esi + 0x4c]
mov ecx, dword [esi + 4]
mov edx, dword [edx + 0x54]
mov eax, dword [ecx]
push edx
call dword [eax + 0x2c]
mov eax, dword [esi + 0x50]
mov ecx, dword [esp + 8]
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x58]
fild dword [edx + 0x3e4]
mov eax, dword [esi + 0x50]
pop edi
pop esi
fmul dword [0x784d28]
fstp dword [eax + 0x14]
add esp, 8
ret
Function at 0x5ab8d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov ecx, dword [eax + 0x434]
push edi
mov edi, 1
cmp ecx, edi
je 0x5ab98c
mov al, byte [0x89e7e2]
test al, al
jne 0x5ab98c
mov eax, dword [0x890100]
test eax, eax
jne 0x5ab98c
mov eax, dword [0x890110]
test eax, eax
jne 0x5ab98c
mov ecx, dword [esi + 4]
fld dword [ecx + 0x20c]
fcomp dword [ecx + 0x214]
fnstsw ax
test ah, 0x41
jne 0x5ab972
fld dword [ecx + 0x210]
fcomp dword [ecx + 0x20c]
fnstsw ax
test ah, 5
jp 0x5ab972
fld dword [ecx + 0x214]
fcomp dword [0x784260]
fnstsw ax
test ah, 5
jp 0x5ab953
push 0
call fcn.005eb670
mov ecx, dword [esi + 4]
fld dword [ecx + 0x210]
fcomp dword [0x784260]
fnstsw ax
test ah, 5
jp 0x5ab98c
push 0
call fcn.005eb680
jmp 0x5ab98c
fld dword [ecx + 0x20c]
fcomp dword [0x784260]
fnstsw ax
test ah, 5
jp 0x5ab98c
push 0
call fcn.005eb690
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x20c]
mov dword [esp + 8], ecx
fld dword [esp + 8]
fcomp dword [0x7844f0]
fnstsw ax
test ah, 0x41
jp 0x5ab9b4
mov dword [esp + 8], 0
jmp 0x5ab9ff
fld dword [esp + 8]
fcomp dword [0x7d7d3c]
fnstsw ax
test ah, 0x41
jne 0x5ab9ff
mov eax, dword [esi + 0x4c]
cmp dword [eax + 0x3c], edi
jle 0x5ab9ff
mov ecx, dword [esi + 0x48]
fld dword [ecx + 0x14]
fmul dword [0x7a1d28]
fcomp dword [0x78759c]
fnstsw ax
test ah, 5
jp 0x5ab9ff
fld dword [0x784260]
fcomp dword [esp + 8]
fnstsw ax
test ah, 0x41
jne 0x5ab9ff
mov dword [esp + 8], 0x3f000000
movzx edx, word [edx + 0x1e0]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [esi + 0x48]
mov ecx, dword [esp + 8]
mov dword [eax + 0x78], ecx
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
call dword [edx + 0x24]
cmp eax, edi
mov ecx, dword [esi + 0x4c]
jle 0x5aba42
mov edx, dword [ecx + 0x18]
mov edx, dword [edx + 0x18]
inc edx
cmp eax, edx
jg 0x5aba42
cmp dword [ecx + 0x54], edi
jne 0x5aba3f
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], eax
mov ecx, dword [esi + 0x58]
call fcn.0059f6f0
mov ecx, dword [esi + 0x48]
mov dword [ecx + 0x84], eax
fld dword [0x7fbed8]
fcomp dword [0x784258]
fnstsw ax
test ah, 0x44
jnp 0x5aba72
mov edx, dword [0x7fbed8]
mov dword [esp + 0xc], edx
jmp 0x5aba7f
mov eax, dword [esi + 0x5c]
mov ecx, dword [eax + 0x440]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0xc]
mov edi, dword [ecx]
push edx
call dword [edi + 0x20]
mov ecx, dword [esi + 0x4c]
push eax
call fcn.005aa640
mov ecx, dword [esi + 4]
push eax
call dword [edi + 0x28]
mov edx, dword [esi + 0x4c]
mov ecx, dword [esi + 4]
mov edx, dword [edx + 0x54]
mov eax, dword [ecx]
push edx
call dword [eax + 0x2c]
mov eax, dword [esi + 0x50]
mov ecx, dword [esp + 8]
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x58]
fild dword [edx + 0x3e4]
mov eax, dword [esi + 0x50]
pop edi
pop esi
fmul dword [0x784d28]
fstp dword [eax + 0x14]
add esp, 8
ret
Function at 0x5ad5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x7789fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
or eax, 0xffffffff
push 2
sub eax, ebx
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.005a01b0
mov dword [esi], 0x7a2208
mov eax, dword [0x86b254]
mov ecx, dword [0x86b27c]
inc eax
cmp eax, ecx
mov dword [0x86b254], eax
jle 0x5ad627
mov dword [0x86b27c], eax
mov byte [esi + 0x12], 0
mov dword [esi], 0x7a23a0
mov eax, dword [0x86b268]
mov ecx, dword [0x86b290]
inc eax
cmp eax, ecx
mov dword [esp + 0x8c], 0
mov dword [0x86b268], eax
jle 0x5ad656
mov dword [0x86b290], eax
mov ebx, dword [ebp + 8]
mov dword [esi + 0x5c], ebx
mov edi, dword [0x86b5a8]
mov ecx, 0x86b5a8
call fcn.005d7ab0
cmp edi, eax
je 0x5ad680
mov ecx, dword [ebx]
cmp dword [edi + 0x80], ecx
je 0x5ad682
mov edi, dword [edi]
cmp edi, eax
jne 0x5ad672
xor edi, edi
mov dword [esi + 0x60], edi
mov dword [ebx + 0xc], esi
mov ecx, dword [esi + 0x5c]
movzx edx, word [ecx + 4]
push edx
call fcn.005d6180
add esp, 4
test eax, eax
je 0x5ad6a7
and byte [eax + 4], 0xef
mov ecx, eax
call fcn.005dae50
mov eax, dword [esi + 0x60]
add eax, 8
push eax
lea ecx, [esp + 0x14]
push 0x7a2388
push ecx
call fcn.00440120
push 0x28
lea edx, [esp + 0x20]
push edx
lea eax, [esi + 0x30]
push eax
call fcn.0043dc70
mov eax, dword [esi + 0x5c]
lea ecx, [eax + 0x20]
add esp, 0x18
push ecx
add eax, 0x10
push eax
mov ecx, esi
mov byte [esi + 0x57], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x17], 0
mov byte [esi + 0x19], 0
call fcn.005a0340
mov eax, dword [esi + 0x5c]
fld dword [eax + 0x20]
lea edx, [esp + 0x40]
fsub dword [eax + 0x10]
push edx
fld dword [eax + 0x24]
fsub dword [eax + 0x14]
fld dword [eax + 0x28]
fsub dword [eax + 0x18]
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fld st(3)
fmul st(4)
faddp st(1)
fsqrt
fstp st(3)
fstp st(0)
fstp st(0)
fmul dword [0x784260]
fstp dword [esi + 0x1c]
call fcn.0043c7e0
mov ecx, dword [esp + 0x88]
add esp, 4
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8