joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5119b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov eax, dword [0x961870]
push ebx
push esi
mov esi, dword [0x96186c]
cmp esi, eax
push edi
jae 0x5119e7
mov dword [esi], str.TtSphereTriangle
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
add esi, 0xc
mov dword [0x96186c], esi
mov edi, dword [ebp + 8]
mov edx, dword [edi]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 8]
add eax, 0x20
mov dword [esp + 0xc], edx
mov edx, dword [edi + 8]
fld dword [edx + 0x50]
add edx, 0x50
fsub dword [eax + 0x30]
mov esi, dword [ebx]
fld dword [edx + 4]
add ecx, 0x10
fsub dword [eax + 0x34]
fld dword [edx + 8]
lea edx, [esp + 0x10]
fsub dword [eax + 0x38]
fld st(0)
fmul dword [eax + 8]
fld st(2)
fmul dword [eax + 4]
faddp st(1)
fld st(3)
fmul dword [eax]
faddp st(1)
fstp dword [esp + 0x10]
fld st(0)
fmul dword [eax + 0x18]
fld st(2)
fmul dword [eax + 0x14]
faddp st(1)
fld st(3)
fmul dword [eax + 0x10]
faddp st(1)
fstp dword [esp + 0x14]
fmul dword [eax + 0x28]
fxch st(1)
fmul dword [eax + 0x24]
faddp st(1)
fxch st(1)
fmul dword [eax + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
lea ecx, [esi + 0x10]
faddp st(1)
push ecx
push edx
fstp dword [esp + 0x28]
call fcn.00529f30
mov eax, dword [esp + 0x1c]
fld dword [esi + 0xc]
fadd dword [eax + 0xc]
add esp, 0x10
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x511a8e
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push ebx
push edi
call dword [edx + 4]
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
jae 0x511ab8
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x511ad0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x44
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
push ebx
push esi
push edi
jae 0x511b06
mov dword [ecx], str.TtSphereTriangle
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
mov edx, dword [ebp + 0xc]
mov esi, dword [edx]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
lea eax, [esp + 0x20]
push eax
lea edi, [esi + 0x10]
push edi
mov dword [esp + 0x14], ecx
call fcn.00529a50
mov ecx, dword [ebx + 8]
mov edx, dword [ebp + 0xc]
fld dword [ecx + 0x50]
mov eax, dword [edx + 8]
fsub dword [eax + 0x50]
add eax, 0x20
fld dword [ecx + 0x54]
add ecx, 0x50
fsub dword [eax + 0x34]
lea edx, [esp + 0x18]
fld dword [ecx + 8]
lea ecx, [esp + 0x28]
fsub dword [eax + 0x38]
fld st(0)
fmul dword [eax + 8]
fld st(2)
fmul dword [eax + 4]
faddp st(1)
fld st(3)
fmul dword [eax]
faddp st(1)
fstp dword [esp + 0x18]
fld st(0)
fmul dword [eax + 0x18]
fld st(2)
fmul dword [eax + 0x14]
faddp st(1)
fld st(3)
fmul dword [eax + 0x10]
faddp st(1)
fstp dword [esp + 0x1c]
fmul dword [eax + 0x28]
fxch st(1)
fmul dword [eax + 0x24]
faddp st(1)
fxch st(1)
fmul dword [eax + 0x20]
lea eax, [esp + 0x38]
push eax
push ecx
faddp st(1)
push edi
push edx
fstp dword [esp + 0x30]
call fcn.00529f30
mov eax, dword [esp + 0x24]
fld dword [esi + 0xc]
fadd dword [eax + 0xc]
add esp, 0x18
fcomp dword [esp + 0x40]
fnstsw ax
test ah, 0x41
jne 0x511bbf
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push eax
push ebx
call dword [edx + 4]
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
jae 0x511be9
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x512930
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
push ebx
push esi
push edi
jae 0x512966
mov dword [ecx], str.TtSphereCapsule
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
fld dword [esi + 0x10]
mov ebx, dword [ebp + 8]
fld dword [esi + 0x14]
mov edi, dword [ebx + 8]
fld dword [esi + 0x18]
mov eax, dword [eax + 8]
fld st(0)
add edi, 0x50
fmul dword [eax + 0x40]
add eax, 0x20
fld st(2)
mov ecx, dword [ebx]
fmul dword [eax + 0x10]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x10], ecx
faddp st(1)
lea ecx, [esp + 0x24]
fld st(3)
fmul dword [eax]
faddp st(1)
fadd dword [eax + 0x30]
fstp dword [esp + 0x24]
fld st(2)
fmul dword [eax + 4]
fld st(1)
fmul dword [eax + 0x24]
faddp st(1)
fld st(2)
fmul dword [eax + 0x14]
faddp st(1)
fadd dword [eax + 0x34]
fstp dword [esp + 0x28]
fxch st(2)
fmul dword [eax + 8]
fxch st(2)
fmul dword [eax + 0x28]
faddp st(2)
fmul dword [eax + 0x18]
faddp st(1)
fadd dword [eax + 0x38]
mov dword [esp + 0x30], 0
fstp dword [esp + 0x2c]
fld dword [esi + 0x20]
fld dword [esi + 0x24]
fld dword [esi + 0x28]
fld st(0)
fmul dword [eax + 0x20]
fld st(2)
fmul dword [eax + 0x10]
faddp st(1)
fld st(3)
fmul dword [eax]
faddp st(1)
fadd dword [eax + 0x30]
fstp dword [esp + 0x34]
fld st(2)
fmul dword [eax + 4]
fld st(1)
fmul dword [eax + 0x24]
faddp st(1)
fld st(2)
fmul dword [eax + 0x14]
faddp st(1)
fadd dword [eax + 0x34]
fstp dword [esp + 0x38]
fxch st(2)
fmul dword [eax + 8]
fxch st(2)
fmul dword [eax + 0x28]
faddp st(2)
fmul dword [eax + 0x18]
faddp st(1)
fadd dword [eax + 0x38]
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x44], 0
fstp dword [esp + 0x40]
push ecx
push edi
call fcn.005298f0
fld dword [esp + 0x20]
fsub dword [edi]
mov edx, dword [esp + 0x1c]
fld dword [esp + 0x24]
add esp, 0x10
fsub dword [edi + 4]
fld dword [esp + 0x18]
fsub dword [edi + 8]
fld dword [esi + 0xc]
fadd dword [edx + 0xc]
fld st(1)
fmul st(2)
fld st(3)
fmul st(4)
faddp st(1)
fld st(4)
fmul st(5)
faddp st(1)
fld st(1)
fmul st(2)
fcompp
fstp st(0)
fstp st(0)
fnstsw ax
fstp st(0)
test ah, 0x41
fstp st(0)
jne 0x512aa0
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
push edx
push ebx
call dword [eax + 4]
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
jae 0x512aca
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x512e50
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x961870]
push esi
push edi
mov edi, dword [0x96186c]
cmp edi, eax
jae 0x512e88
mov ecx, edi
mov dword [ecx], str.TtSphereSphere
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea edi, [ecx + 0xc]
mov dword [ecx + 4], eax
mov dword [0x96186c], edi
mov eax, dword [ebp + 8]
mov esi, dword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [esp + 0x40], eax
mov eax, dword [eax + 8]
mov dword [esp + 0x44], ecx
fld dword [eax + 0x50]
mov ecx, dword [ecx + 8]
fsub dword [ecx + 0x50]
add eax, 0x50
add ecx, 0x50
fstp dword [esp + 0x10]
fld dword [eax + 4]
fsub dword [ecx + 4]
fstp dword [esp + 0x14]
fld dword [eax + 8]
fsub dword [ecx + 8]
fstp dword [esp + 0x18]
fld dword [eax + 0xc]
mov eax, dword [ebp + 0x10]
fsub dword [ecx + 0xc]
fstp dword [esp + 0x1c]
fld dword [esp + 0x18]
fmul dword [esp + 0x18]
fld dword [esp + 0x14]
fmul dword [esp + 0x14]
faddp st(1)
fld dword [esp + 0x10]
fmul dword [esp + 0x10]
faddp st(1)
fstp dword [esp + 0xc]
fld dword [eax + 8]
fadd dword [edx + 0xc]
fadd dword [esi + 0xc]
fld st(0)
fmul st(1)
fld dword [esp + 0xc]
fcompp
fnstsw ax
fstp st(0)
test ah, 5
jp 0x512fea
fld dword [esp + 0xc]
fcomp dword [0x641de0]
fnstsw ax
test ah, 0x41
jne 0x512f5c
fld dword [esp + 0xc]
fsqrt
fdivr dword [0x6419bc]
fld dword [esp + 0x10]
fmul st(1)
fstp dword [esp + 0x30]
fld dword [esp + 0x14]
fmul st(1)
fstp dword [esp + 0x34]
fld dword [esp + 0x18]
fmul st(1)
fstp dword [esp + 0x38]
fld dword [esp + 0x1c]
fmul st(1)
fstp dword [esp + 0x3c]
fmul dword [esp + 0xc]
jmp 0x512f86
mov eax, dword [0x6a80b0]
fld dword [0x641de0]
mov dword [esp + 0x30], eax
mov eax, dword [0x6a80b4]
mov dword [esp + 0x34], eax
mov eax, dword [0x6a80b8]
mov dword [esp + 0x38], eax
mov eax, dword [0x6a80bc]
mov dword [esp + 0x3c], eax
fld dword [esi + 0xc]
fld dword [edx + 0xc]
fld dword [edx + 0xc]
mov edx, dword [ecx]
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x24], eax
fld dword [ecx + 8]
fld dword [esp + 0x30]
mov ecx, dword [ebp + 0x14]
fmul st(2)
mov edx, dword [ecx]
lea eax, [esp + 0x20]
push eax
fadd dword [esp + 0x24]
fstp dword [esp + 0x24]
fld dword [esp + 0x38]
fmul st(2)
fadd dword [esp + 0x28]
fstp dword [esp + 0x28]
fld dword [esp + 0x3c]
fmul st(2)
fadd st(1)
fstp dword [esp + 0x2c]
fstp st(0)
fstp st(0)
fadd st(1)
fsubr st(2)
fstp dword [esp + 0x30]
fstp st(0)
fstp st(0)
call dword [edx + 4]
mov edi, dword [0x96186c]
cmp edi, dword [0x961870]
jae 0x51300e
mov dword [edi], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], ecx
add edi, 0xc
mov dword [0x96186c], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5131f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 8
mov eax, dword [0x961870]
push esi
push edi
mov edi, dword [0x96186c]
cmp edi, eax
jae 0x513228
mov ecx, edi
mov dword [ecx], str.TtSphereSphere
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea edi, [ecx + 0xc]
mov dword [ecx + 4], eax
mov dword [0x96186c], edi
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, dword [edx + 8]
fld dword [ecx + 0x50]
fsub dword [eax + 0x50]
add ecx, 0x50
fld dword [ecx + 4]
add eax, 0x50
fsub dword [eax + 4]
fld dword [ecx + 8]
mov ecx, dword [edx]
fsub dword [eax + 8]
mov eax, dword [esi]
fld dword [ecx + 0xc]
fadd dword [eax + 0xc]
fld st(1)
fmul st(2)
fld st(3)
fmul st(4)
faddp st(1)
fld st(4)
fmul st(5)
faddp st(1)
fld st(1)
fmul st(2)
fcompp
fstp st(0)
fstp st(0)
fnstsw ax
fstp st(0)
test ah, 0x41
fstp st(0)
jne 0x51328b
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
push esi
push edx
call dword [eax + 4]
mov edi, dword [0x96186c]
cmp edi, dword [0x961870]
jae 0x5132af
mov dword [edi], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], ecx
add edi, 0xc
mov dword [0x96186c], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5137f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x138
mov eax, dword [0x961870]
push esi
push edi
mov edi, ecx
mov ecx, dword [0x96186c]
cmp ecx, eax
jae 0x51382b
mov dword [ecx], 0x65c5b4
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
fld dword [eax + 0xc]
mov esi, dword [ebp + 0xc]
fld st(0)
mov ecx, dword [esi]
fadd dword [eax + 0x10]
fstp dword [esp + 0x20]
fld st(0)
fadd dword [eax + 0x14]
fstp dword [esp + 0x24]
fld st(0)
fadd dword [eax + 0x18]
fstp dword [esp + 0x28]
fadd dword [eax + 0x1c]
mov eax, dword [ebp + 0x10]
fstp dword [esp + 0x2c]
fld dword [ecx + 0xc]
fld st(0)
fadd dword [ecx + 0x10]
fstp dword [esp + 0x10]
fld st(0)
fadd dword [ecx + 0x14]
fstp dword [esp + 0x14]
fld st(0)
fadd dword [ecx + 0x18]
fstp dword [esp + 0x18]
fadd dword [ecx + 0x1c]
mov ecx, dword [eax + 8]
push ecx
lea ecx, [esp + 0x14]
push ecx
fstp dword [esp + 0x24]
mov ecx, dword [esi + 8]
add ecx, 0x20
push ecx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [edx + 8]
add ecx, 0x20
push ecx
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [edi + 8]
push ecx
push eax
push esi
push edx
lea ecx, [esp + 0x58]
call fcn.00513730
add edi, 0x10
push edi
lea ecx, [esp + 0x34]
call fcn.0052d6c0
mov eax, dword [0x96186c]
cmp eax, dword [0x961870]
jae 0x5138ea
mov ecx, eax
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x513900
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x168
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
push esi
push edi
jae 0x513938
mov dword [ecx], 0x65c5b4
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
fld dword [eax + 0xc]
mov edi, dword [ebp + 0xc]
fld st(0)
mov ecx, dword [edi]
fadd dword [eax + 0x10]
fstp dword [esp + 0x20]
fld st(0)
fadd dword [eax + 0x14]
fstp dword [esp + 0x24]
fld st(0)
fadd dword [eax + 0x18]
fstp dword [esp + 0x28]
fadd dword [eax + 0x1c]
lea eax, [esp + 0x10]
fstp dword [esp + 0x2c]
fld dword [ecx + 0xc]
fld st(0)
fadd dword [ecx + 0x10]
fstp dword [esp + 0x10]
fld st(0)
fadd dword [ecx + 0x14]
fstp dword [esp + 0x14]
fld st(0)
fadd dword [ecx + 0x18]
fstp dword [esp + 0x18]
fadd dword [ecx + 0x1c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 8]
mov ecx, dword [edi + 8]
push edx
fstp dword [esp + 0x20]
push eax
mov eax, dword [esi + 8]
add ecx, 0x20
push ecx
lea edx, [esp + 0x2c]
push edx
add eax, 0x20
push eax
push 0
push 0
push 0
push edi
push esi
lea ecx, [esp + 0x88]
call fcn.00513730
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x68]
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], edi
call fcn.0052d570
mov al, byte [esp + 8]
test al, al
je 0x5139ef
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
lea edx, [esp + 0x30]
push edx
call dword [eax + 4]
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
jae 0x513a19
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x513b50
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x138
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
push esi
push edi
jae 0x513b88
mov dword [ecx], 0x65c5b4
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
fld dword [eax + 0xc]
mov edi, dword [ebp + 0xc]
fld st(0)
mov ecx, dword [edi]
fadd dword [eax + 0x10]
fstp dword [esp + 0x20]
fld st(0)
fadd dword [eax + 0x14]
fstp dword [esp + 0x24]
fld st(0)
fadd dword [eax + 0x18]
fstp dword [esp + 0x28]
fadd dword [eax + 0x1c]
lea eax, [esp + 0x10]
fstp dword [esp + 0x2c]
fld dword [ecx + 0xc]
fld st(0)
fadd dword [ecx + 0x10]
fstp dword [esp + 0x10]
fld st(0)
fadd dword [ecx + 0x14]
fstp dword [esp + 0x14]
fld st(0)
fadd dword [ecx + 0x18]
fstp dword [esp + 0x18]
fadd dword [ecx + 0x1c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 8]
mov ecx, dword [edi + 8]
push edx
fstp dword [esp + 0x20]
push eax
mov eax, dword [esi + 8]
add ecx, 0x20
push ecx
lea edx, [esp + 0x2c]
push edx
add eax, 0x20
push eax
push 0
push 0
push 0
push edi
push esi
lea ecx, [esp + 0x58]
call fcn.00513730
lea ecx, [esp + 0x30]
call fcn.0052b610
lea ecx, [esp + 0xb]
push ecx
lea ecx, [esp + 0x34]
call fcn.0052b8e0
mov al, byte [esp + 0xb]
test al, al
je 0x513c35
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edi
push esi
call dword [edx + 4]
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
jae 0x513c5f
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5172d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x114
mov edx, dword [0x96186c]
cmp edx, dword [0x961870]
push ebx
push esi
push edi
jae 0x51730b
mov esi, edx
mov dword [esi], str.TtShapeCollection
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea edx, [esi + 0xc]
mov dword [esi + 4], eax
mov dword [0x96186c], edx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov esi, dword [ecx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [eax + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
dec eax
js 0x517374
inc eax
mov dword [esp + 0xc], eax
lea esp, [esp]
mov edi, dword [esi]
mov edx, dword [ebx]
lea eax, [esp + 0x20]
push eax
push edi
mov ecx, ebx
call dword [edx + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], edi
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [edx + 0x10]
mov eax, dword [esp + 0xc]
add esi, 8
dec eax
mov dword [esp + 0xc], eax
jne 0x517330
mov edx, dword [0x96186c]
cmp edx, dword [0x961870]
jae 0x51739a
mov ecx, edx
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5173b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x114
mov edx, dword [0x96186c]
cmp edx, dword [0x961870]
push ebx
push esi
push edi
jae 0x5173eb
mov esi, edx
mov dword [esi], str.TtShapeCollection
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea edx, [esi + 0xc]
mov dword [esi + 4], eax
mov dword [0x96186c], edx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov esi, dword [ecx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [eax + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
dec eax
js 0x517454
inc eax
mov dword [esp + 0xc], eax
lea esp, [esp]
mov edi, dword [esi]
mov edx, dword [ebx]
lea eax, [esp + 0x20]
push eax
push edi
mov ecx, ebx
call dword [edx + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], edi
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
add esi, 8
dec eax
mov dword [esp + 0xc], eax
jne 0x517410
mov edx, dword [0x96186c]
cmp edx, dword [0x961870]
jae 0x51747a
mov ecx, edx
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x517490
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x124
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
push ebx
push esi
push edi
jae 0x5174c9
mov dword [ecx], str.TtShapeCollection
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x28], ecx
mov ecx, dword [edx]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
call dword [eax + 0x14]
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x18], eax
call dword [edx + 0x2c]
mov edi, eax
cmp edi, 0xffffffff
je 0x517562
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push edi
push esi
push edx
mov edx, dword [ebp + 0xc]
push edx
push ebx
lea edx, [esp + 0x33]
push edx
call dword [eax]
cmp byte [eax], 0
je 0x517553
mov eax, dword [esi]
lea ecx, [esp + 0x30]
push ecx
push edi
mov ecx, esi
call dword [eax + 0x34]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edi
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov edx, dword [ebp + 0x14]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [ebp + 0xc]
push ebx
push edx
shl eax, 5
lea edx, [esp + 0x2c]
add eax, ecx
mov ecx, dword [ebx]
push edx
call dword [ecx + eax*4 + 0x218c]
add esp, 0x10
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x30]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5174f8
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
jae 0x51758c
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5175a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x114
mov eax, dword [0x961870]
push ebx
push esi
mov esi, dword [0x96186c]
cmp esi, eax
push edi
jae 0x5175da
mov dword [esi], str.TtShapeCollection
rdtsc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
add esi, 0xc
mov dword [0x96186c], esi
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov ebx, dword [ecx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 0x10]
dec eax
mov dword [esp + 0x18], edx
js 0x517638
inc eax
mov dword [esp + 0xc], eax
mov esi, dword [ebx]
mov eax, dword [edi]
lea ecx, [esp + 0x20]
push ecx
push esi
mov ecx, edi
call dword [eax + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], esi
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x20]
push eax
call dword [edx + 0xc]
dec dword [esp + 0xc]
jne 0x5175f8
mov esi, dword [0x96186c]
cmp esi, dword [0x961870]
jae 0x51765c
mov dword [esi], 0x6594f4
rdtsc
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], ecx
add esi, 0xc
mov dword [0x96186c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x517670
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x124
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
push ebx
push esi
push edi
jae 0x5176a9
mov dword [ecx], str.TtShapeCollection
rdtsc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
add ecx, 0xc
mov dword [0x96186c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x28], ecx
mov ecx, dword [edx]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
call dword [eax + 0x14]
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x18], eax
call dword [edx + 0x2c]
mov edi, eax
cmp edi, 0xffffffff
je 0x517746
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push edi
push esi
push edx
mov edx, dword [ebp + 0xc]
push edx
push ebx
lea edx, [esp + 0x33]
push edx
call dword [eax]
cmp byte [eax], 0
je 0x517737
mov eax, dword [esi]
lea ecx, [esp + 0x30]
push ecx
push edi
mov ecx, esi
call dword [eax + 0x34]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edi
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov edx, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0xc]
push ebx
push edx
shl eax, 5
lea edx, [esp + 0x30]
add eax, ecx
mov ecx, dword [ebx]
push edx
call dword [ecx + eax*4 + 0x318c]
add esp, 0x14
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x30]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5176d8
mov ecx, dword [0x96186c]
cmp ecx, dword [0x961870]
jae 0x517770
mov dword [ecx], 0x6594f4
rdtsc
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
add ecx, 0xc
mov dword [0x96186c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret