joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a4b9f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push edi
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
jne 0x5a4bd4
push 0x406634
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x8007000e
jmp 0x5a4cad
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov edi, eax
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fld dword [ebx + 0x40]
mov edx, eax
push 4
pop ecx
lea eax, [edx + 0x10]
lea esi, [ebp - 4]
push esi
fstp dword [eax]
add eax, ecx
fld dword [ebx + 0x20]
push edx
push 0x2c
fstp dword [eax]
add eax, ecx
fld dword [ebx + 0x24]
xor esi, esi
push esi
fstp dword [eax]
add eax, ecx
fld dword [ebx + 0x28]
push esi
push 0x406568
fstp dword [eax]
add eax, ecx
fld dword [ebx + 0x30]
fstp dword [eax]
add eax, ecx
fld dword [ebx + 0x34]
fstp dword [eax]
fld dword [ebx + 0x38]
fstp dword [eax + 4]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov edi, eax
cmp edi, esi
jl 0x5a4c7f
mov ebx, dword [ebx + 0x44]
cmp ebx, esi
je 0x5a4c8c
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.005a47d7
cmp eax, esi
jne 0x5a4c54
mov edi, 0x8007000e
jmp 0x5a4cab
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x5a4c59
mov edx, dword [ebp - 4]
sub ecx, edi
mov edi, dword [edx]
lea ebx, [ebp - 8]
push ebx
push eax
inc ecx
push ecx
push esi
push esi
push 0x4065c8
push edx
call dword [edi + 0x1c]
mov edi, eax
cmp edi, esi
jge 0x5a4c8c
push 0x40660c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x5a4cab
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x5a4cab
cmp dword [eax], esi
je 0x5a4cab
push dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.005a4abe
mov edi, eax
pop esi
pop ebx
mov eax, dword [ebp - 8]
test eax, eax
je 0x5a4cbe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x5a4ccf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop edi
leave
ret 0x18
Function at 0x5a4d99
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
and dword [ebp - 4], 0
push ebx
push esi
push edi
push eax
call dword [ecx + 0x10]
mov esi, eax
mov edi, esi
imul edi, edi, 0xc
lea eax, [edi + 4]
push eax
mov dword [ebp + 0xc], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x5a4dd0
mov esi, 0x8007000e
jmp 0x5a4e10
imul esi, esi, 3
push edi
push dword [ebp + 0x10]
lea eax, [ebx + 4]
push eax
mov dword [ebx], esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push ebx
push dword [ebp + 0xc]
push 0
push 0
push 0x401c00
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jge 0x5a4e10
push 0x40660c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5a4e21
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x5a5c80
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebx*4 + 4]
mov ecx, edi
imul eax, esi
imul ecx, ecx, 0xc
lea eax, [eax + ecx + 8]
push eax
mov dword [ebp - 8], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
mov dword [ebp + 0x20], eax
jne 0x5a5cc5
mov esi, 0x8007000e
jmp 0x5a5d8a
mov dword [eax], edi
add eax, 4
xor edx, edx
test edi, edi
jbe 0x5a5cfc
mov ecx, dword [ebp + 0x24]
mov edi, dword [ecx + 0xc0]
mov esi, dword [ecx + 0x94]
imul edi, edx
add edi, dword [ebp + 0xc]
movzx esi, word [esi + 2]
add esi, edi
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add eax, 0xc
inc edx
cmp edx, dword [ebp + 0x10]
movsd dword es:[edi], dword [esi]
jb 0x5a5cd3
mov esi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov dword [eax], esi
add eax, 4
test edx, edx
je 0x5a5d30
test esi, esi
jbe 0x5a5d5d
mov dword [eax], ebx
add eax, 4
xor ecx, ecx
test ebx, ebx
jbe 0x5a5d24
mov edi, dword [edx + ecx*4]
mov dword [eax], edi
add eax, 4
inc ecx
cmp ecx, ebx
jb 0x5a5d17
mov ecx, ebx
shl ecx, 2
add edx, ecx
dec esi
jne 0x5a5d0c
jmp 0x5a5d5d
test esi, esi
jbe 0x5a5d5d
mov edx, dword [ebp + 0x14]
lea edi, [ebx + ebx]
mov dword [ebp + 0x10], esi
mov dword [eax], ebx
add eax, 4
xor ecx, ecx
test ebx, ebx
jbe 0x5a5d56
movzx esi, word [edx + ecx*2]
mov dword [eax], esi
add eax, 4
inc ecx
cmp ecx, ebx
jb 0x5a5d48
add edx, edi
dec dword [ebp + 0x10]
jne 0x5a5d3d
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push dword [ebp + 0x20]
push dword [ebp - 8]
push 0
push 0
push 0x4065b8
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jge 0x5a5d8a
push 0x40660c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5a5d9b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push dword [ebp + 0x20]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x24
Function at 0x5a5db2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esi*8 + 4]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x5a5de2
mov esi, 0x8007000e
jmp 0x5a5e4c
cmp esi, ebx
mov dword [edi], esi
lea ecx, [edi + 4]
mov dword [ebp + 0x10], ebx
jbe 0x5a5e23
mov edx, dword [ebp + 0x14]
mov ebx, dword [edx + 0xc0]
imul ebx, dword [ebp + 0x10]
mov eax, dword [edx + 0xa0]
movzx eax, word [eax + 2]
add ebx, dword [ebp + 0xc]
add eax, ebx
fld dword [eax]
fstp dword [ecx]
add ecx, 4
fld dword [eax + 4]
fstp dword [ecx]
add ecx, 4
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], esi
jb 0x5a5df1
xor ebx, ebx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push edi
push dword [ebp - 8]
push ebx
push ebx
push 0x4065a8
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jge 0x5a5e4c
push 0x40660c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x5a5e5c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], ebx
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14

Function at 0x5a5e71
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
imul edi, edi, 0x14
add edi, 4
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x5a5ea1
mov esi, 0x8007000e
jmp 0x5a5f18
cmp dword [ebp + 0x10], ebx
mov dword [eax], esi
lea esi, [eax + 4]
jbe 0x5a5eed
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ecx + 0xc0]
imul eax, ebx
add eax, dword [ebp + 0xc]
push eax
call fcn.005a5b7e
fld dword [ebp - 0x18]
mov dword [esi], ebx
push 4
pop eax
add esi, eax
fstp dword [esi]
add esi, eax
fld dword [ebp - 0x14]
fstp dword [esi]
add esi, eax
fld dword [ebp - 0x10]
fstp dword [esi]
add esi, eax
fld dword [ebp - 0xc]
fstp dword [esi]
add esi, eax
inc ebx
cmp ebx, dword [ebp + 0x10]
jb 0x5a5eab
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push dword [ebp - 8]
push edi
push 0
push 0
push 0x4065d8
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jge 0x5a5f18
push 0x40660c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5a5f29
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x5a5f40
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xec
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
push esi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.0057c7ec
cmp esi, edi
je 0x5a6109
xor eax, eax
and esi, 0xffffffaf
cmp eax, dword [ebp - 0x54]
mov ebx, esi
sbb eax, eax
neg eax
cmp dword [ebp - 0x54], edi
mov dword [ebp + 0x14], eax
jbe 0x5a5fa7
push edi
lea ecx, [ebp - 0x6c]
call fcn.0057c8c3
cmp eax, 8
jne 0x5a5fa7
movzx eax, bx
shr ebx, 2
sub eax, 0x100
and ebx, 0x3fffc000
or ebx, eax
mov dword [ebp + 0x14], edi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.005a5b2a
push ebx
lea ecx, [ebp - 0xec]
call fcn.0057c7ec
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp - 0xac]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xa8]
add eax, 0xfffffff4
je 0x5a6109
test al, 3
je 0x5a5feb
mov dword [ebp - 4], 0x8876086c
jmp 0x5a6109
mov esi, eax
imul esi, dword [ebp + 0x10]
lea eax, [esi + 8]
push eax
mov dword [ebp - 4], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
test edx, edx
pop ecx
mov dword [ebp - 8], edx
jne 0x5a6011
mov eax, 0x8007000e
jmp 0x5a6115
mov eax, dword [ebp + 0x10]
shr esi, 2
mov dword [edx], ebx
lea edi, [edx + 4]
push 4
mov dword [edi], esi
mov esi, dword [ebp + 0xc]
pop ebx
xor ecx, ecx
add edi, ebx
cmp eax, ecx
jbe 0x5a60ce
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x34]
add esi, 0xc
cmp eax, ecx
jbe 0x5a6048
mov edx, dword [esi]
mov dword [edi], edx
add edi, ebx
add esi, ebx
dec eax
jne 0x5a603d
cmp dword [ebp - 0x64], ecx
jbe 0x5a6050
add esi, 0xc
cmp dword [ebp - 0x5c], ecx
jbe 0x5a6065
cmp dword [ebp - 0x9c], ecx
jbe 0x5a6063
mov eax, dword [esi]
mov dword [edi], eax
add edi, ebx
add esi, ebx
cmp dword [ebp - 0x58], ecx
jbe 0x5a6072
mov eax, dword [esi]
mov dword [edi], eax
add edi, ebx
add esi, ebx
cmp dword [ebp + 0x14], ecx
je 0x5a608e
push dword [ebp - 0x2c]
push esi
push edi
call sub.msvcrt.dll_memcpy
add edi, dword [ebp - 0x2c]
add esi, dword [ebp - 0x2c]
add esp, 0xc
xor ecx, ecx
jmp 0x5a6091
add esi, dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jbe 0x5a60c2
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + eax*4 - 0x2c]
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
add edi, ebx
add esi, ebx
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x30]
jb 0x5a609c
push 4
pop ebx
xor ecx, ecx
dec dword [ebp + 0xc]
jne 0x5a6033
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x18]
mov esi, dword [eax]
lea edi, [ebp - 0xc]
push edi
push edx
push dword [ebp - 4]
push ecx
push ecx
push 0x401c70
push eax
call dword [esi + 0x1c]
test eax, eax
mov dword [ebp - 4], eax
jge 0x5a60f8
push 0x40660c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5a6109
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0xc], 0
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x5a687a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x398
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi + 4]
xor ebx, ebx
push edi
xor edi, edi
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x5a699f
mov ecx, dword [esi + 0xc0]
imul ecx, dword [ebp + 0x10]
add ecx, 3
shr ecx, 2
lea eax, [ecx + eax*4]
lea eax, [eax*4 + 8]
push eax
mov dword [ebp + 0x18], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x5a68d1
mov edi, 0x8007000e
jmp 0x5a698e
mov eax, dword [esi + 4]
mov dword [ebx], eax
mov eax, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
lea edi, [ebx + 4]
jbe 0x5a6911
add eax, 5
movzx edx, byte [eax - 1]
mov dword [edi], edx
movzx edx, byte [eax]
add edi, 4
mov dword [edi], edx
movzx edx, byte [eax + 1]
add edi, 4
mov dword [edi], edx
movzx edx, byte [eax + 2]
add edi, 4
mov dword [edi], edx
add edi, 4
add eax, 8
inc ecx
cmp ecx, dword [esi + 4]
jb 0x5a68e5
mov eax, dword [esi + 0xc0]
imul eax, dword [ebp + 0x10]
add eax, 3
shr eax, 2
mov dword [edi], eax
push dword [esi]
mov eax, dword [ebp + 0x14]
push dword [eax]
lea ecx, [ebp - 0x398]
call fcn.0058301c
add edi, 4
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x398]
call fcn.0057cb5a
xor edi, edi
xor esi, esi
cmp dword [ebp + 0x10], edi
jbe 0x5a6965
push 1
push esi
push esi
lea ecx, [ebp - 0x398]
call fcn.0057cb8a
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x5a6950
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push ebx
push dword [ebp + 0x18]
push edi
push edi
push 0x401c90
push eax
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
jge 0x5a698e
push 0x40660c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5a699f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x5ebeb4
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
test edi, edi
je 0x5ebede
cmp edi, 1
je 0x5ebede
push 0x406880
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0x8876086c
jmp 0x5ebfe9
push esi
push 1
push 0x1c0
call sub.msvcrt.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x5ebeff
mov dword [ebp - 4], 0x8007000e
jmp 0x5ebfdc
fld dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
fstp dword [esi + 4]
mov dword [esi + 0xc], edi
call fcn.005eb656
test eax, eax
je 0x5ebf2c
fld dword [ebp + 0x10]
push edi
push ecx
fstp dword [esp]
call fcn.005ed05d
test eax, eax
mov dword [esi + 0x1bc], eax
jne 0x5ebf38
mov dword [ebp - 4], 0x80004005
jmp 0x5ebfdb
and dword [esi + 0x1c], 0
call fcn.006f9962
mov ebx, eax
test ebx, ebx
jne 0x5ebf53
mov dword [ebp - 4], 0x8007000e
jmp 0x5ebfdb
push 0x5ed623
push 0x1870a
push ebx
call fcn.006f9b29
push fcn.0065cca2
push 0x18706
push ebx
call fcn.006f9b29
push 0x5ed683
push 0x1870b
push ebx
call fcn.006f9b29
push 0x5eb5a3
push 0x1870d
push ebx
call fcn.006f9b29
push 0x5eb542
push 0x1870f
push ebx
call fcn.006f9b29
fld1
sub esp, 0x18
fstp qword [esp + 0x10]
fldz
fst qword [esp + 8]
fstp qword [esp]
push ebx
call fcn.006f9b06
fld qword [0x406878]
push ecx
push ecx
fstp qword [esp]
push 0x1872c
push ebx
call fcn.006f9a1b
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x1c], ebx
mov dword [eax], esi
xor esi, esi
pop ebx
test esi, esi
je 0x5ebfe8
push dword [ebp + 8]
call fcn.005eb725
pop esi
mov eax, dword [ebp - 4]
leave
ret 0x10

Function at 0x5ec898
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
and dword [ebx], 0
push esi
push edi
push 0xc
mov edi, eax
call sub.msvcrt.dll_malloc
mov esi, eax
test esi, esi
pop ecx
je 0x5ec8cf
push 0x140
call sub.msvcrt.dll_malloc
test eax, eax
pop ecx
jne 0x5ec8d8
push esi
call sub.msvcrt.dll_free
pop ecx
mov dword [ebp - 4], 0x8007000e
jmp 0x5ec922
and dword [esi + 4], 0
mov dword [esi], eax
mov dword [esi + 8], 0xa
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
jae 0x5ec910
push esi
push edi
lea eax, [ebp - 8]
call fcn.005ec758
test eax, eax
je 0x5ec929
mov eax, dword [edi + 0x10]
add eax, dword [edi + 0x14]
cmp dword [ebp - 8], eax
jb 0x5ec8f7
and dword [ebp - 0xc], 0
mov dword [ebx], esi
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x5ec922
call fcn.005eb871
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
push 0x4068ac
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0x80004005
jmp 0x5ec916
Function at 0x5ecf1d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x773b90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x5ed016
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call edi
mov dword [ebp - 0xac], eax
call fcn.0074f950
cmp dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], esp
jne 0x5ecfc7
push 0x4068dc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x8876086c
jmp 0x5ed041
push esi
push esi
push dword [ebp - 0xac]
push dword [ebp - 0xa8]
push 0xffffffffffffffff
push ebx
push esi
push esi
call edi
fld dword [ebp + 0x18]
push dword [ebp - 0xa4]
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push ecx
push ecx
fstp dword [esp + 4]
fld dword [ebp + 0x14]
fstp dword [esp]
push dword [ebp - 0xa8]
push dword [ebp - 0xb0]
push dword [ebp - 0xb4]
call sym.d3dx9_35.dll_D3DXCreateTextA
jmp 0x5ed041
fld dword [ebp + 0x18]
push 1
push dword [ebp - 0xa4]
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push ecx
push ecx
fstp dword [esp + 4]
fld dword [ebp + 0x14]
fstp dword [esp]
push ebx
push edi
push esi
call fcn.005eca8c
lea esp, [ebp - 0xc0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0074f205
leave
ret 0x20

Function at 0x5ed896
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [eax + 4], 0
fldz
fstp qword [ebp - 0x18]
jne 0x5ed8b0
mov eax, 0x900
leave
ret
push edi
call fcn.005ed142
mov edi, dword [eax + 0x10]
cmp edi, 3
jb 0x5ed944
push esi
mov esi, dword [eax + 0xc]
fld dword [esi]
lea eax, [esi + edi*8 - 0x10]
fsub dword [eax]
fstp dword [ebp - 0x10]
fld dword [esi + 4]
fsub dword [eax + 4]
fstp dword [ebp - 0xc]
jmp 0x5ed910
mov eax, esi
add esi, 8
fld dword [esi]
fsub dword [eax]
fstp dword [ebp - 8]
fld dword [esi + 4]
fsub dword [eax + 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
fstp dword [ebp - 4]
call fcn.005ed3e3
fadd qword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
fstp qword [ebp - 0x18]
mov dword [ebp - 0xc], eax
dec edi
jne 0x5ed8dc
fld qword [ebp - 0x18]
pop esi
fabs
fcomp qword [0x406af8]
fnstsw ax
test ah, 5
jp 0x5ed933
push 0x406a98
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x5ed944
fldz
fcomp qword [ebp - 0x18]
fnstsw ax
test ah, 5
mov eax, 0x901
jnp 0x5ed949
mov eax, 0x900
pop edi
leave
ret
Function at 0x5fefb3
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
sub eax, 0
push edi
je 0x5ff126
dec eax
je 0x5ff048
dec eax
jne 0x5ff0c5
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov ecx, dword [esi + 0x20]
mov edi, dword [ebp + 0xc]
add ecx, edi
cmp ecx, eax
jbe 0x5ff022
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
lea ebx, [ecx + edi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
add eax, eax
cmp ebx, eax
jbe 0x5ff006
mov eax, ebx
jmp 0x5ff011
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
add eax, eax
mov ecx, dword [esi + 0x14]
push eax
call fcn.0054ccc6
test eax, eax
jl 0x5ff128
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push edi
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
add eax, dword [esi + 0x20]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [eax], edi
add dword [esi + 0x20], edi
jmp 0x5ff126
mov eax, dword [esi + 0x1c]
mov ebx, dword [ebp + 0xc]
lea ecx, [eax + ebx]
mov edi, 0x10000
cmp ecx, edi
ja 0x5ff079
mov ecx, dword [esi + 0x18]
push ebx
push dword [ebp + 8]
add ecx, eax
push ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [esi + 0x1c], ebx
mov dword [eax], ebx
jmp 0x5ff126
cmp eax, edi
je 0x5ff0a4
test eax, eax
je 0x5ff0a4
mov ebx, dword [ebp + 8]
mov ecx, edi
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x18]
add ecx, eax
push ebx
push ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x1c]
sub ebx, eax
add esp, 0xc
add ebx, edi
mov dword [ebp + 8], ebx
jmp 0x5ff0aa
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x5ff0d9
push 0
push dword [ebp + 0x10]
push edi
push dword [esi + 0x18]
push dword [esi]
call ebx
test eax, eax
jne 0x5ff0cc
mov eax, 0x80004005
jmp 0x5ff128
add dword [esi + 0x20], edi
sub edi, dword [esi + 0x1c]
and dword [esi + 0x1c], 0
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
sub edi, dword [ebp - 4]
shr edi, 0x10
je 0x5ff101
push 0
push dword [ebp + 0x10]
shl edi, 0x10
push edi
push dword [ebp + 8]
push dword [esi]
call ebx
test eax, eax
je 0x5ff0c5
add dword [esi + 0x20], edi
add dword [ebp - 4], edi
add dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 4], edi
jae 0x5ff11e
sub edi, dword [ebp - 4]
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esi + 0x1c], edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc