joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52aaeb
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a5766
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x19e8
call fcn.00403d90
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0052a9df
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x10]
call fcn.0058dfec
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0058df86
lea ecx, [ebp - 0x10]
call fcn.00403d90
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x19ec], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x19ec], 0
jne 0x52aba5
push 0
push 0
push 0x5fc20c
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
jmp 0x52ac16
push 4
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x19ec]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x19f0], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x19f0], 0
jne 0x52abf4
push 0
push 0
push 0x5fc23c
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
jmp 0x52ac16
mov ecx, dword [ebp - 0x18]
call fcn.004120d0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x19f0]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x52bd1b
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a58ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x19e8
call fcn.00403d90
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0052bc32
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x10]
call fcn.0058dfec
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0058df86
lea ecx, [ebp - 0x10]
call fcn.00403d90
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x19f4], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x19f4], 0
jne 0x52bdd5
push 0
push 0
push 0x5fc5c0
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
jmp 0x52be46
push 4
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x19f4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x19f8], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x19f8], 0
jne 0x52be24
push 0
push 0
push 0x5fc5f0
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
jmp 0x52be46
mov ecx, dword [ebp - 0x18]
call fcn.004120d0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x19f8]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x533d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a5c3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x48]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00533e20
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push ecx
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 1
call fcn.00533ec0
mov esi, dword [esp + 0x40]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00533e20
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.00533eb0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x5349a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a5cef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00533e20
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x38], 1
push ecx
lea ecx, [esp + 0xc]
call fcn.00534a50
mov esi, dword [esp + 0x40]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00533e20
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.00533eb0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x538f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a60cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00533e20
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x38], 1
push ecx
lea ecx, [esp + 0xc]
call fcn.00539040
mov esi, dword [esp + 0x40]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00533e20
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.00533eb0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x53ab20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a628f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00533e20
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x38], 1
push ecx
lea ecx, [esp + 0xc]
call fcn.0053ac30
mov esi, dword [esp + 0x40]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00533e20
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.00533eb0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x53aba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a62bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00533e20
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push ecx
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 1
call fcn.00533ec0
mov esi, dword [esp + 0x40]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00533e20
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.00533eb0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x53d3c0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push edi
call fcn.00590470
test eax, eax
jge 0x53d3dc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 4
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edi
push 1
lea eax, [esi + 0x120]
push 8
push eax
call ebx
add esp, 0x10
cmp eax, 1
jae 0x53d401
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 4
push edi
push 1
lea ecx, [esi + 0x128]
push 8
push ecx
call ebx
add esp, 0x10
cmp eax, 1
jae 0x53d420
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 4
push edi
push 1
lea edx, [esi + 0x130]
push 4
push edx
call ebx
add esp, 0x10
cmp eax, 1
jae 0x53d43f
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 4
push edi
push 1
add esi, 0x134
push 4
push esi
call ebx
add esp, 0x10
cmp eax, 1
sbb eax, eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x540eb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a691b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push esi
push eax
push ecx
push edi
push edx
call fcn.0053f360
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov ebx, eax
lea eax, [esp + 0x74]
push eax
push esi
push edi
push ecx
push edx
push ebx
mov dword [esp + 0x44], ebx
call fcn.0053f440
add esp, 0x2c
xor esi, esi
lea ecx, [esp + 0x30]
push 0x3ff00000
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call fcn.00540e20
cmp edi, esi
mov dword [esp + 0x158], esi
jl 0x54101b
mov ecx, ebx
mov edx, edi
shl ecx, 5
lea eax, [edi*8]
xor ebx, ebx
shl edx, 5
inc edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], edi
jmp 0x540f61
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, ebx
sub eax, edx
mov edx, dword [esp + 0x2c]
add eax, ecx
mov ecx, dword [ebp + 0x14]
lea edi, [eax + ecx]
mov ecx, dword [ebp + 0x18]
mov eax, esi
sub eax, edx
mov edx, dword [esp + 0x18]
lea eax, [eax + edx*8]
fld qword [eax + ecx]
mov ecx, edi
fstp qword [esp + 0x1c]
call fcn.005381d0
fmul qword [esp + esi + 0x60]
lea ecx, [esp + 0x30]
fmul qword [esp + 0x1c]
fstp qword [esp + 0xc]
call fcn.00540db0
fadd qword [esp + 0xc]
sub esp, 8
lea ecx, [esp + 0x38]
fstp qword [esp]
call fcn.005807a0
mov ecx, edi
call fcn.005381e0
fmul qword [esp + esi + 0x60]
lea ecx, [esp + 0x30]
fmul qword [esp + 0x1c]
fstp qword [esp + 0xc]
call fcn.00540dc0
fadd qword [esp + 0xc]
sub esp, 8
lea ecx, [esp + 0x38]
fstp qword [esp]
call fcn.005807c0
lea ecx, [esp + 0x30]
call fcn.00540de0
fld qword [esp + 0x1c]
fmul qword [esp + esi + 0x60]
sub esp, 8
lea ecx, [esp + 0x38]
faddp st(1)
fstp qword [esp]
call fcn.00580800
mov eax, dword [esp + 0x14]
add ebx, 0x20
add esi, 8
dec eax
mov dword [esp + 0x14], eax
jne 0x540f59
lea ecx, [esp + 0x30]
call fcn.00540db0
fstp qword [esp + 0xc]
lea ecx, [esp + 0x30]
call fcn.00540de0
fdivr qword [esp + 0xc]
mov esi, dword [ebp + 0x24]
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00540100
lea ecx, [esp + 0x30]
call fcn.00540dc0
fstp qword [esp + 0xc]
lea ecx, [esp + 0x30]
call fcn.00540de0
fdivr qword [esp + 0xc]
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00540120
lea ecx, [esp + 0x30]
mov dword [esp + 0x158], 0xffffffff
call fcn.00540df0
mov ecx, dword [esp + 0x150]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x546b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a6c5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00546a90
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push ecx
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 1
call fcn.00546b90
mov esi, dword [esp + 0x38]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00546a90
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.00546810
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x550900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a771b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.005509f0
xor edi, edi
lea ecx, [esi + 0x58]
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
call fcn.00537a20
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 1
call fcn.00537a20
lea ecx, [esi + 0xa8]
mov byte [esp + 0x18], 2
call fcn.00537a20
lea ecx, [esi + 0xd0]
mov byte [esp + 0x18], 3
call fcn.00537a20
lea ecx, [esi + 0xf8]
mov byte [esp + 0x18], 4
call fcn.00537a20
lea ecx, [esi + 0x120]
mov byte [esp + 0x18], 5
call fcn.005389d0
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x148], edi
mov dword [esi + 0x150], edi
mov dword [esi + 0x158], edi
mov dword [esi + 0x160], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x154], edi
mov dword [esi + 0x15c], edi
mov dword [esi + 0x164], edi
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5585c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a81f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [ecx + 0x1c]
mov edx, dword [ecx + 0x18]
push esi
push eax
mov eax, dword [ecx + 0x14]
push edx
mov edx, dword [ecx + 0x10]
push eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
push edx
push eax
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0
call fcn.00533e70
mov esi, dword [esp + 0x40]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00533e20
mov dword [esp + 4], 1
lea ecx, [esp + 8]
call fcn.00533eb0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 4

Function at 0x55de80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a8b18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x38]
push esi
xor esi, esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], esi
call fcn.00546a90
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x30], esi
push ecx
lea ecx, [esp + 0xc]
call fcn.0055def0
mov esi, dword [esp + 0x38]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00546a90
lea ecx, [esp + 8]
call fcn.00546810
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x55f370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a8d13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x38]
push 0xc0b38800
push 0
push 0xc0b38800
push 0
push 0xc0b38800
push 0
lea ecx, [esp + 0x50]
call fcn.00546970
push 0x40b38800
push 0
push 0x40b38800
push 0
push 0x40b38800
push 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x78], 0
call fcn.00546970
push 0x50
mov byte [esp + 0x64], 1
call sub.MFC42.DLL_operatornew
mov edi, eax
add esp, 4
mov dword [esp + 0xc], edi
test edi, edi
mov byte [esp + 0x60], 2
je 0x55f438
sub esp, 0x20
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00546910
sub esp, 0x20
lea eax, [esp + 0x78]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
mov byte [esp + 0xa4], 3
call fcn.00546910
mov ecx, edi
mov byte [esp + 0xa0], 2
call fcn.00549950
jmp 0x55f43a
xor eax, eax
lea ecx, [esp + 0x18]
mov dword [esi + 8], eax
mov byte [esp + 0x60], 0
call fcn.00537fc0
lea ecx, [esp + 0x38]
mov dword [esp + 0x60], 0xffffffff
call fcn.00537fc0
mov ecx, dword [esp + 0x58]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x55f850
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a8dae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.005499f0
mov edi, dword [esp + 0x1c]
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], 0
lea eax, [edi + 0x10]
push eax
call fcn.00546910
add edi, 0x30
lea ecx, [esi + 0x30]
push edi
mov byte [esp + 0x18], 1
call fcn.00546910
mov ecx, esi
mov byte [esp + 0x14], 2
mov dword [esi], 0x5bba34
call fcn.00592470
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x57c9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, ecx
push ebx
push esi
push edi
lea esi, [eax + 0x88]
mov ebx, 4
mov edx, esi
xor edi, edi
mov ecx, 4
mov dword [edx - 0x80], edi
mov dword [edx - 0x7c], edi
mov dword [edx], edi
mov dword [edx + 4], edi
add edx, 8
dec ecx
jne 0x57ca02
dec ebx
jne 0x57c9fd
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 2
lea edx, [ecx + 0x50]
mov dword [esp + 0x10], edx
mov edi, 2
mov ebx, dword [edx - 0x48]
add edx, 8
mov dword [esi - 0x80], ebx
mov ebx, dword [edx - 0x4c]
mov dword [esi - 0x7c], ebx
mov ebx, dword [edx - 8]
mov dword [esi], ebx
mov ebx, dword [edx - 4]
mov dword [esi + 4], ebx
add esi, 8
dec edi
jne 0x57ca31
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add esi, 0x20
add edx, 0x18
dec edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
jne 0x57ca2c
mov edx, dword [ecx + 0x38]
mov esi, 0x3ff00000
mov dword [eax + 0x68], edx
mov edx, dword [ecx + 0x3c]
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0x40]
mov dword [eax + 0x70], edx
mov edx, dword [ecx + 0x44]
mov dword [eax + 0x74], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x20], edx
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x24], edx
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x40], edx
mov edx, dword [ecx + 0x34]
mov dword [eax + 0x44], edx
xor edx, edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x80], edx
mov dword [eax + 0x5c], esi
mov dword [eax + 0x84], esi
mov edi, dword [ecx + 0x80]
mov dword [eax + 0xe8], edi
mov edi, dword [ecx + 0x84]
mov dword [eax + 0xec], edi
mov edi, dword [ecx + 0x88]
mov dword [eax + 0xf0], edi
mov edi, dword [ecx + 0x8c]
mov dword [eax + 0xf4], edi
mov edi, dword [ecx + 0x60]
mov dword [eax + 0xa0], edi
mov edi, dword [ecx + 0x64]
mov dword [eax + 0xa4], edi
mov edi, dword [ecx + 0x78]
mov dword [eax + 0xc0], edi
mov ecx, dword [ecx + 0x7c]
mov dword [eax + 0xd8], edx
mov dword [eax + 0x100], edx
mov dword [eax + 0xdc], esi
mov dword [eax + 0x104], esi
pop edi
pop esi
mov dword [eax + 0xc4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x57cbb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5aa52f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 8], 0
call fcn.00537a20
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x50], 1
mov ecx, edi
call fcn.00533a20
fstp qword [esp + 0x14]
mov ecx, edi
call fcn.00533a30
fstp qword [esp + 0xc]
mov ecx, edi
call fcn.00533a40
fld st(0)
fmul qword [esi + 0x58]
fld qword [esp + 0xc]
fmul qword [esi + 0x38]
sub esp, 8
lea ecx, [esp + 0x28]
sub esp, 8
faddp st(1)
fld qword [esp + 0x24]
fmul qword [esi + 0x18]
sub esp, 8
faddp st(1)
fstp qword [esp + 0x10]
fld st(0)
fmul qword [esi + 0x50]
fld qword [esp + 0x24]
fmul qword [esi + 0x30]
faddp st(1)
fld qword [esp + 0x2c]
fmul qword [esi + 0x10]
faddp st(1)
fstp qword [esp + 8]
fmul qword [esi + 0x48]
fld qword [esp + 0x24]
fmul qword [esi + 0x28]
faddp st(1)
fld qword [esp + 0x2c]
fmul qword [esi + 8]
faddp st(1)
fstp qword [esp]
call fcn.00537a40
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00533e20
mov dword [esp + 8], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], 0
call fcn.00533eb0
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x57cdb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5aa57f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 8], 0
call fcn.00442a20
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x50], 1
mov ecx, edi
call fcn.00442960
fstp qword [esp + 0xc]
mov ecx, edi
call fcn.004429a0
fstp qword [esp + 0x14]
mov ecx, edi
call fcn.004429e0
fld qword [esp + 0xc]
fld qword [esp + 0x14]
fld st(2)
fmul qword [esi + 0x60]
fld st(1)
fmul qword [esi + 0x40]
sub esp, 8
lea ecx, [esp + 0x28]
sub esp, 8
faddp st(1)
fld st(2)
fmul qword [esi + 0x20]
sub esp, 8
sub esp, 8
faddp st(1)
fadd qword [esi + 0x80]
fstp qword [esp + 0x18]
fld st(2)
fmul qword [esi + 0x58]
fld st(1)
fmul qword [esi + 0x38]
faddp st(1)
fld st(2)
fmul qword [esi + 0x18]
faddp st(1)
fadd qword [esi + 0x78]
fstp qword [esp + 0x10]
fld st(2)
fmul qword [esi + 0x50]
fld st(1)
fmul qword [esi + 0x30]
faddp st(1)
fld st(2)
fmul qword [esi + 0x10]
faddp st(1)
fadd qword [esi + 0x70]
fstp qword [esp + 8]
fxch st(2)
fmul qword [esi + 0x48]
fxch st(2)
fmul qword [esi + 0x28]
faddp st(2)
fmul qword [esi + 8]
faddp st(1)
fadd qword [esi + 0x68]
fstp qword [esp]
call fcn.00442f00
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00533b20
mov dword [esp + 8], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], 0
call fcn.00442d70
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x57f130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
fld qword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 8]
push esi
push edi
fchs
fstp qword [esp + 0x88]
fld qword [ebp + 0x18]
mov dword [esp + 0x44], ecx
mov ecx, 0x12
mov esi, eax
lea edi, [esp + 0xa0]
rep movsd dword es:[edi], dword [esi]
fchs
fstp qword [esp + 0x90]
mov dword [esp + 0x48], edx
mov edi, eax
lea edx, [esp + 0xa8]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x3ff00000
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x3ff00000
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0x3ff00000
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0x3ff00000
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0x3ff00000
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0x3ff00000
lea ecx, [esp + 0xa8]
sub edi, edx
mov ebx, 3
lea eax, [esp + 0x28]
lea edx, [edi + ecx]
mov esi, 3
fld qword [eax - 0x18]
fmul qword [ecx - 8]
fld qword [eax + 0x18]
fmul qword [ecx + 8]
add eax, 8
add edx, 8
dec esi
faddp st(1)
fld qword [eax - 8]
fmul qword [ecx]
faddp st(1)
fstp qword [edx - 8]
jne 0x57f295
add ecx, 0x18
dec ebx
jne 0x57f289
mov eax, dword [ebp + 0xc]
mov ecx, 0x12
mov esi, eax
lea edi, [esp + 0xa0]
rep movsd dword es:[edi], dword [esi]
mov edi, eax
lea eax, [esp + 0x60]
lea ecx, [esp + 0x60]
sub edi, eax
mov ebx, 3
lea eax, [esp + 0xb8]
lea edx, [edi + ecx]
mov esi, 3
fld qword [eax - 0x18]
fmul qword [ecx - 8]
fld qword [eax + 0x18]
fmul qword [ecx + 8]
add eax, 8
add edx, 8
dec esi
faddp st(1)
fld qword [ecx]
fmul qword [eax - 8]
faddp st(1)
fstp qword [edx - 8]
jne 0x57f2ef
add ecx, 0x18
dec ebx
jne 0x57f2e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18