joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bf90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [esp + 0x18], esi
jne 0x47bfb7
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x47bfc3
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0x14], ecx
jle 0x47c0ec
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x14], edx
jmp 0x47c008
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x47c029
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov ebp, dword [edx + ecx*4]
lea eax, [edi + 0xfe]
lea esi, [edi + edi - 2]
cdq
idiv esi
xor ebx, ebx
mov dword [esp + 0x24], ebp
xor esi, esi
mov edx, eax
cmp esi, edx
jle 0x47c081
mov ecx, ebx
lea ebp, [edi + edi - 2]
imul ecx, ecx, 0x1fe
jmp 0x47c060
add ecx, 0x1fe
lea eax, [ecx + edi + 0xfe]
cdq
idiv ebp
add ebx, 1
mov edx, eax
cmp esi, edx
jg 0x47c060
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov al, byte [esp + 0x18]
imul bl
mov byte [esi + ebp], al
add esi, 1
cmp esi, 0xff
jle 0x47c046
cmp dword [esp + 0x10], 0
je 0x47c0d1
mov eax, 1
lea edx, [ebp - 1]
jmp 0x47c0b0
movzx ebx, byte [ebp]
mov byte [edx], bl
movzx ebx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], bl
add eax, 1
sub edx, 1
cmp eax, 0xff
jle 0x47c0b0
mov eax, dword [esp + 0x2c]
add dword [esp + 0x14], 4
add ecx, 1
cmp ecx, dword [eax + 0x64]
mov dword [esp + 0x1c], ecx
jl 0x47c000
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x488db0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x663dc1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov ecx, 1
mov dword [esp + 0x1c], ecx
mov edx, 0xf
mov dword [esi + 0x18], edx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esp + 8], ecx
lea ecx, [esp + 0x44]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], edx
push eax
lea edx, [esp + 0x50]
mov dword [ecx + 0x14], eax
push edx
mov byte [ecx + 4], al
call fcn.00402610
call fcn.00488c10
cmp dword [esp + 0x40], 0x10
jb 0x488e3a
mov eax, dword [esp + 0x2c]
push eax
call fcn.0060445c
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret
Function at 0x489550
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x66382d
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x702ca8]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 8], ebx
push 1
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x6be468
mov ecx, esi
mov dword [esp + 0x14], esi
mov byte [esi + 4], bl
call fcn.004027b0
push 0x104
lea eax, [esp + 0x30]
push ebx
mov dword [esp + 0x144], ebx
push eax
mov dword [esp + 0x14], 1
call fcn.00615fd0
add esp, 0xc
push 1
push 0x23
lea ecx, [esp + 0x34]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x489649
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x489601
sub eax, edx
push eax
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x18]
call fcn.004027b0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esp + 0x148], 1
call fcn.00402610
cmp dword [esp + 0x28], 0x10
jb 0x489649
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0060445c
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00615b69
add esp, 0x138
ret

Function at 0x489700
Capabilities:
Copy file

Disassembly:
mov ecx, dword [esp + 0x24]
push esi
mov esi, 0x10
cmp dword [esp + 0x3c], esi
jae 0x489714
lea ecx, [esp + 0x28]
cmp dword [esp + 0x20], esi
mov eax, dword [esp + 0xc]
jae 0x489722
lea eax, [esp + 0xc]
push 0
push ecx
push eax
call dword [sym.imp.kernel32.dll_CopyFileA]
cmp dword [esp + 0x20], esi
jb 0x48973f
mov eax, dword [esp + 0xc]
push eax
call fcn.0060445c
add esp, 4
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
pop esi
jb 0x489766
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0060445c
pop ecx
ret
Function at 0x489770
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x30
push ebp
mov ebp, 0x10
cmp dword [esp + 0x50], ebp
push esi
jae 0x489788
lea eax, [esp + 0x40]
push 0
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
je 0x48988f
cmp dword [esp + 0x54], ebp
mov esi, dword [esp + 0x40]
jae 0x4897a7
lea esi, [esp + 0x40]
lea eax, [esp + 0xc]
push eax
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 4
push 1
push esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
test eax, eax
jne 0x48988f
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
push 1
mov dword [esp + 0x28], 0x10000000
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 3
mov dword [esp + 0x3c], 1
mov dword [esp + 0x44], 0x6cce40
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
je 0x489865
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LocalFree]
cmp dword [esp + 0x54], ebp
jb 0x4898a2
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0060445c
add esp, 4
pop esi
pop ebp
add esp, 0x30
ret
mov edx, dword [esp + 0x10]
push 0
push edx
push 0
push 0
push 4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.kernel32.dll_LocalFree]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
cmp dword [esp + 0x54], ebp
jb 0x4898a2
mov edx, dword [esp + 0x40]
push edx
call fcn.0060445c
add esp, 4
pop esi
pop ebp
add esp, 0x30
ret
Function at 0x48a200
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x665018
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x702ca8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x88], ebx
je 0x48a297
push 0x30
push 0x6ccf34
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004027b0
mov dword [esp + 0x3c], ebx
cmp dword [esp + 0x2c], 0x10
mov eax, dword [esp + 0x18]
jae 0x48a26f
lea eax, [esp + 0x18]
mov ebx, dword [esp + 0x28]
push eax
call fcn.0048a740
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x2c], 0x10
jb 0x48a295
mov eax, dword [esp + 0x18]
push eax
call fcn.0060445c
add esp, 4
xor ebx, ebx
lea ecx, [esp + 0xc]
push ecx
push ebx
push esi
push 0x489cf0
push ebx
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.kernel32.dll_CreateThread]
cmp eax, ebx
jne 0x48a2f0
mov dword [esi + 0x4c], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x23
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6ccf68
mov byte [ecx + 4], bl
call fcn.004027b0
add esi, 4
call fcn.00488d30
add esp, 0x20
jmp 0x48a2f9
push 1
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00615b69
add esp, 0x34
ret
Function at 0x48a7e0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x60
mov eax, dword [0x702ca8]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
push 0
push 4
lea eax, [esp + 0x10]
push eax
mov eax, 0x20
mov esi, ecx
mov edi, edx
lea ecx, [eax - 0x1c]
lea edx, [esp + 0x78]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.0048e010
test esi, esi
jle 0x48a863
mov ecx, dword [esp + 8]
shr ecx, 3
and ecx, 0x3f
push ecx
push esi
lea edx, [esp + 0x10]
push edx
lea eax, [esi*8]
mov ecx, esi
mov edx, ebx
call fcn.0048e010
lea esi, [esp + 8]
call fcn.0048e0c0
mov ecx, dword [esp + 0x64]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00615b69
add esp, 0x60
ret 4

Function at 0x48d7b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test edx, edx
jle 0x48d7e1
push esi
push edi
lea esp, [esp]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x708190]
add ecx, 1
sub edx, 1
jne 0x48d7c0
pop edi
pop esi
not eax
ret
Function at 0x4ec080
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6547f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004eb100
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor ebx, ebx
mov dword [esi], 0x6919b8
mov dword [esi + 0x20], 0x6919a4
push 7
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6bc5fc
mov dword [esp + 0x44], ebx
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
fldz
push 1
fstp dword [esi + 0x414]
fld dword [0x691aa4]
push ecx
fstp dword [esp]
mov ecx, esi
push ebx
mov dword [esi + 0x41c], eax
mov dword [esi + 0x418], ebx
mov dword [esi + 0x410], 0x1f4
mov byte [esi + 0x2f1], 1
mov dword [esi + 0x1f8], 0x2710
mov dword [esi + 0x1f4], 0x10
mov dword [esi + 0x1f0], 0x80
call fcn.00562710
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4f13d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x656e98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00564650
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor ebx, ebx
mov dword [esi], 0x692408
mov dword [esi + 0x20], 0x6923f4
push 9
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6bca8c
mov dword [esp + 0x44], ebx
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
fldz
fstp dword [esi + 0x404]
push 1
fld qword [0x6ddd38]
push ecx
fstp qword [esi + 0x318]
mov ecx, esi
fld qword [0x6ddb58]
mov dword [esi + 0x400], eax
fst qword [esi + 0x308]
mov dword [esi + 0x320], 3
fstp qword [esi + 0x310]
mov dword [esi + 0x300], 0x1388
fld qword [0x6ddb18]
mov dword [esi + 0x1f8], 0x186a0
fstp qword [esi + 0x328]
mov dword [esi + 0x1f4], 0x40
fld1
mov dword [esi + 0x1f0], ebx
fstp dword [esp]
push ebx
call fcn.00562710
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x5078b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x656e98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00564650
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor ebx, ebx
mov dword [esi], 0x6940c8
mov dword [esi + 0x20], 0x6940b4
push 0x13
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6bc898
mov dword [esp + 0x44], ebx
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
mov dword [esi + 0x400], eax
mov dword [esi + 0x404], ebx
mov dword [esi + 0x408], ebx
mov byte [esi + 0x2f0], bl
mov dword [esi + 0x1f8], 0x320
mov dword [esi + 0x300], 0xc8
mov dword [esi + 0x1f4], 2
mov dword [esi + 0x1f0], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x515150
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x656d08
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00512680
fld dword [0x6ddb00]
mov edi, dword [esi + 0x1ac]
fstp dword [esi + 0x2e4]
push 1
sub esp, 0x1c
mov ecx, esp
xor eax, eax
mov dword [esp + 0x30], esp
mov dword [esi], 0x696328
mov dword [esi + 0x20], 0x696314
mov dword [esi + 0x2c8], 2
mov dword [esi + 0x2cc], 0x46
mov byte [esi + 0x2d8], al
push 0xf
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
push 0x6963f0
mov dword [esp + 0x44], eax
mov byte [ecx + 4], al
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
push eax
mov ecx, edi
call fcn.0042e580
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x51f5d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x656e98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00564650
fld1
push 1
fstp dword [esi + 0x400]
fld dword [0x6926a8]
sub esp, 0x1c
mov ecx, esp
fstp dword [esi + 0x404]
mov dword [esp + 0x30], esp
xor ebx, ebx
mov dword [esi], 0x698318
mov dword [esi + 0x20], 0x698304
push 5
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6bc488
mov dword [esp + 0x44], ebx
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
fld dword [0x6ddd50]
push 1
push ecx
fstp dword [esp]
push 2
lea ecx, [esi + 0x410]
mov dword [esi + 0x408], eax
call fcn.0042ba10
call fcn.00615c6f
and eax, 0xffff
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
mov byte [esi + 0x2f1], 1
mov dword [esi + 0x1f4], 0x80
fmul qword [0x6ddab8]
mov dword [esi + 0x1f0], ebx
mov eax, esi
fstp dword [esi + 0x4d8]
fld dword [0x6ddad0]
fstp dword [esi + 0x2f4]
fld qword [0x6dda50]
fstp qword [esi + 0x308]
fld qword [0x6ddcb0]
fstp qword [esi + 0x310]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x527ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x657449
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.0042f2c0
xor ebx, ebx
push 0x90
mov dword [esp + 0x30], ebx
mov dword [esi], 0x699370
mov dword [esi + 0x20], 0x69935c
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
call fcn.00604431
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x2c], 1
je 0x527f4a
mov ecx, eax
call fcn.00432fc0
jmp 0x527f4c
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x30], bl
mov dword [esi + 0xfc], eax
call fcn.0043f5f0
push 0xf8
call fcn.00604431
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x2c], 2
je 0x527f81
mov ecx, eax
call fcn.0044dc20
jmp 0x527f83
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x30], bl
mov dword [esi + 0x100], eax
call fcn.0043f5f0
push 0xb0
call fcn.00604431
mov ecx, eax
add esp, 4
mov dword [esp + 0x14], ecx
cmp ecx, ebx
mov byte [esp + 0x2c], 3
je 0x528016
mov eax, dword [0x717c9c]
mov edx, dword [eax + 0x1c]
mov eax, dword [edx + 0x1c]
cdq
sub eax, edx
sar eax, 1
mov edx, 0xa
sub edx, eax
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
push 0x24
push 1
sub esp, 0xc
fstp dword [esp + 0x20]
mov eax, esp
fldz
fst dword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
fld dword [esp + 0x20]
mov dword [eax], edx
fstp dword [esp + 0x30]
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
fstp dword [esp + 0x34]
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
mov eax, dword [0x717c98]
mov edx, dword [eax + 0xf57f8]
push edx
call fcn.0057ea10
jmp 0x528018
xor eax, eax
mov ecx, dword [esi + 0x100]
push eax
mov byte [esp + 0x30], bl
mov dword [esi + 0x10c], eax
call fcn.0043f5f0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x1c]
fild dword [ecx + 0x18]
mov edx, dword [esi + 0x10c]
fmul qword [0x6ddc00]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fstp dword [edx + 0x90]
mov eax, dword [esi + 0x10c]
mov byte [eax + 0x94], bl
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x5280b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66163b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xec]
fld dword [eax + 0x98]
push 0xf0
fstp dword [esp + 0x28]
call fcn.00604431
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x528123
mov ecx, dword [esp + 0x1c]
sub esp, 0xc
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x2c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 8], ecx
mov ecx, eax
call fcn.0051db10
jmp 0x528125
xor eax, eax
mov edx, dword [esp + 0x30]
fld qword [esp + 0x28]
fstp qword [eax + 0xd0]
mov dword [eax + 0xc8], edx
mov ecx, dword [esi + 0xec]
push eax
mov dword [esp + 0x18], 0xffffffff
call fcn.0043f5f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x558df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6598c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00558780
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor ebx, ebx
mov dword [esi], 0x69c7d8
mov dword [esi + 0x20], 0x69c7c8
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x69c8b4
mov dword [esp + 0x44], ebx
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
mov dword [esi + 0x410], eax
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x69c8a8
mov byte [ecx + 4], bl
call fcn.004027b0
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x2c]
call fcn.0043fe00
mov dword [esi + 0x414], eax
mov dword [esi + 0x418], 0x7d0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x559040
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6598c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00558780
fld qword [0x6ddb58]
fstp qword [esi + 0x318]
push 1
fld qword [0x6ddb20]
sub esp, 0x1c
fst qword [esi + 0x308]
mov ecx, esp
fstp qword [esi + 0x310]
mov dword [esp + 0x30], esp
fld qword [0x6ddb18]
xor ebx, ebx
fstp qword [esi + 0x328]
mov dword [esi], 0x69c8e0
mov dword [esi + 0x20], 0x69c8cc
mov dword [esi + 0x418], 0xbb8
mov dword [esi + 0x320], 1
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x69c9cc
mov dword [esp + 0x44], ebx
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
mov dword [esi + 0x410], eax
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x69c9c0
mov byte [ecx + 4], bl
call fcn.004027b0
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x2c]
call fcn.0043fe00
mov dword [esi + 0x414], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x559b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65998e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00432fc0
fld qword [0x69cc28]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [esi], 0x69cbd8
mov dword [esi + 0x20], 0x69cbc4
xor ebx, ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
fst qword [esi + 0x98]
fstp qword [esi + 0xa0]
push 0x90
fldz
mov dword [esp + 0x34], ebx
fst dword [esi + 0xa8]
fst dword [esi + 0xac]
fst dword [esi + 0xb0]
fst dword [esi + 0xb4]
fst dword [esi + 0xb8]
fst dword [esi + 0xbc]
fst dword [esi + 0xc0]
fst dword [esi + 0xc4]
fstp dword [esi + 0xc8]
fld qword [esp + 0x54]
mov dword [esi + 0xdc], eax
mov eax, dword [esp + 0x70]
fstp qword [esi + 0xd0]
fld dword [esp + 0x50]
mov dword [esi + 0xe0], ecx
fstp dword [esi + 0xd8]
mov dword [esi + 0xe4], edx
mov dword [esi + 0xe8], eax
call fcn.00604431
add esp, 4
mov dword [esp + 0x4c], eax
cmp eax, ebx
mov byte [esp + 0x30], 1
je 0x559c88
mov ecx, eax
call fcn.00432fc0
jmp 0x559c8a
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x34], bl
mov dword [esi + 0x90], eax
call fcn.0043f5f0
push 0x90
call fcn.00604431
add esp, 4
mov dword [esp + 0x4c], eax
cmp eax, ebx
mov byte [esp + 0x30], 2
je 0x559cbf
mov ecx, eax
call fcn.00432fc0
jmp 0x559cc1
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x34], bl
mov dword [esi + 0x94], eax
call fcn.0043f5f0
fld dword [esp + 0x44]
call fcn.006152d0
fstp dword [esp + 0x4c]
fld dword [esp + 0x4c]
fstp dword [esp + 0x1c]
fld dword [esp + 0x44]
call fcn.00615400
fstp dword [esp + 0x44]
fld dword [esp + 0x44]
fstp dword [esp + 0x20]
fld dword [esp + 0x1c]
fld dword [esp + 0x48]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
fld dword [esp + 0x20]
mov dword [esi + 0xc0], ecx
fmul st(1)
fstp dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov dword [esi + 0xc4], edx
fmul qword [0x6dd9e8]
fstp dword [esp + 0x18]
mov eax, dword [esp + 0x18]
fld qword [esp + 0x58]
mov dword [esi + 0xc8], eax
fstp dword [esp + 0x44]
fld dword [esi + 0xc0]
fld dword [esp + 0x44]
fld st(0)
fmulp st(2)
fxch st(1)
fstp dword [esp + 0x10]
fld dword [esi + 0xc4]
fmul st(1)
fstp dword [esp + 0x14]
fmul dword [esi + 0xc8]
fstp dword [esp + 0x18]
fld dword [esp + 0x38]
fadd dword [esp + 0x10]
fstp dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
fld dword [esp + 0x3c]
mov dword [esi + 0xa8], ecx
fadd dword [esp + 0x14]
fstp dword [esp + 0x20]
mov edx, dword [esp + 0x20]
fld dword [esp + 0x40]
mov dword [esi + 0xac], edx
fadd dword [esp + 0x18]
fstp dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esi + 0xb0], eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 0x38