joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d680
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448f86
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x238], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call fcn.004043b0
push 0x44f420
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
mov ecx, 0x46b110
call fcn.0043d460
add esp, 4
cmp dword [ebp - 0x220], 8
jb 0x43d751
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 0x46b110
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret 4

Function at 0x43d820
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448feb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x224], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x220], 0x46b12c
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [0x46b140], 7
mov dword [0x46b13c], 0
mov word [0x46b12c], ax
mov dword [ebp - 4], eax
mov ecx, 0x46b12c
lea eax, [ebp - 0x21c]
push eax
call fcn.004043b0
mov eax, 0x46b12c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret 4
Function at 0x43e2f0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449207
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x250], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call fcn.004043b0
push str.lddownloader_
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24c]
call fcn.0043d460
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0043ddf0
cmp dword [ebp - 0x238], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x43e3d4
push dword [ebp - 0x24c]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x238], 7
cmp dword [ebp - 0x220], 8
mov dword [ebp - 0x23c], 0
mov word [ebp - 0x24c], ax
jb 0x43e405
push dword [ebp - 0x234]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x234]
call fcn.004043b0
sub esp, 0x18
mov dword [ebp - 4], 4
mov ecx, esp
lea edx, [ebp - 0x234]
push str.lddownloaderlddownloader.log
call fcn.0043d460
add esp, 4
mov ecx, edi
call fcn.0043de90
add esp, 0x18
cmp dword [ebp - 0x220], 8
jb 0x43e478
push dword [ebp - 0x234]
call esi
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00443810
mov esp, ebp
pop ebp
ret 4
Function at 0x440c30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x302c
call fcn.00444380
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x300c], 0
lea eax, [ebp - 0x302c]
mov esi, edx
push eax
mov edi, ecx
movdqu xmmword [ebp - 0x302c], xmm0
movdqu xmmword [ebp - 0x301c], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3018]
mov dword [edi], eax
mov dword [esi], eax
mov eax, dword [0x46b1ac]
test al, 1
jne 0x440cb3
push str.GetLogicalProcessorInformation
or eax, 1
push str.kernel32.dll
mov dword [0x46b1ac], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x46b1b0], esi
jmp 0x440cb9
mov esi, dword [0x46b1b0]
test esi, esi
je 0x440d27
push 0x3000
lea eax, [ebp - 0x3004]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x3008], 0x3000
lea eax, [ebp - 0x3008]
push eax
lea eax, [ebp - 0x3004]
push eax
call esi
test eax, eax
je 0x440d27
mov eax, 0xaaaaaaab
xor esi, esi
mul dword [ebp - 0x3008]
shr edx, 4
test edx, edx
je 0x440d27
lea ecx, [ebp - 0x3000]
jmp 0x440d10
mov eax, dword [ecx]
sub eax, 0
je 0x440d1a
dec eax
jmp 0x440d1b
inc esi
add ecx, 0x18
dec edx
jne 0x440d10
test esi, esi
je 0x440d27
mov dword [edi], esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00443810
mov esp, ebp
pop ebp
ret
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4084f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
mov edi, dword [esp + 0x1c]
imul edi, edi, 0x30
mov ebx, dword [esp + 0x24]
mov esi, dword [0x6f76fc]
mov eax, ebx
add eax, dword [esp + 0x28]
mov dword [0x6f7710], eax
mov eax, ebx
shr eax, 0x18
mov ebp, dword [eax*4 + 0x6f76d0]
push 0
add esi, edi
mov dword [esi + 0x18], ebp
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [0x6f7718], 0
je 0x4085e0
cmp dword [esi + 4], 0
jne 0x408545
cmp byte [esi + 0xe], 0
je 0x408550
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, ebx
mov dword [esi + 0x10], 0
and eax, 0xffffff
mov dword [esi], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 8], eax
mov byte [esi + 0xd], 0
mov eax, dword [esp + 0x1c]
mov ebp, dword [0x6f7708]
mov edi, dword [0x6f7700]
mov dword [edi + ebp*4], eax
inc dword [0x6f7708]
mov eax, dword [0x6f7708]
cdq
idiv dword [0x6f770c]
mov eax, edx
mov dword [0x6f7708], edx
mov ebx, dword [0x6f7704]
cmp ebx, eax
jne 0x4085b4
push str.Queue_is_full_n
call fcn.00401000
pop ecx
mov eax, dword [0x6f76f4]
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_ReleaseSemaphore]
test eax, eax
jne 0x4085d3
push str.Signal_Sema_Error_n
call fcn.00648ac0
pop ecx
add esp, 8
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
cmp dword [0x6f7714], 0
je 0x408637
mov edx, ebx
mov eax, dword [0x6f76fc]
and edx, 0xffffff
add eax, edi
shl edx, 0xb
mov dword [eax + 0x24], edx
add eax, 0x1c
push eax
mov eax, dword [esp + 0x2c]
shl eax, 0xb
push 0
push eax
push dword [esp + 0x2c]
push ebp
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
mov bl, 1
jne 0x40862c
call dword [fcn.00a1215c]
cmp eax, 0x3e5
je 0x40862c
xor bl, bl
movzx eax, bl
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, ebx
and eax, 0xffffff
shl eax, 0xb
push 0
push 0
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 4]
shl eax, 0xb
push 0
push ecx
push eax
push dword [esp + 0x2c]
push ebp
call dword [sym.imp.kernel32.dll_ReadFile]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4086f0
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
sub esp, 0x10
lea ecx, [esp + 0xc]
lea eax, [esp + 8]
push ecx
lea edx, [esp + 8]
push eax
lea eax, [esp + 8]
push edx
push eax
mov esi, dword [esp + 0x30]
push 0
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
cmp dword [esp + 4], 0x800
mov dword [0x6f771c], 0
ja 0x40873f
push str.Using_no_buffered_loading_for_streaming_n
or dword [0x6f771c], 0x20000000
call fcn.00401000
pop ecx
mov eax, dword [esp + 4]
mov dword [0x6f7714], 1
push eax
or dword [0x6f771c], 0x40000000
push 0x800
mov dword [0x6f7718], 0
call fcn.005805d0
pop ecx
pop ecx
push 0
mov ebx, eax
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, esi
mov dword [0x6f76c8], 0
imul eax, eax, 0x30
mov dword [0x6f76cc], esi
push eax
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
push eax
mov dword [0x6f76fc], eax
push str.cdvd_stream
push str._s:_read_info__p_n
call fcn.00401000
add esp, 0xc
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [0x6f771c]
or eax, 0x10000001
push 0
push eax
push 3
push 0
push 1
push 0x80000000
push 0x6866c4
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ecx, dword [0x6f76c8]
mov dword [ecx*4 + 0x6f76d0], eax
mov eax, dword [0x6f76c8]
cmp dword [eax*4 + 0x6f76d0], 0
je 0x40880f
mov edi, eax
mov esi, 0x6866c4
shl edi, 6
add edi, 0x6f7488
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc dword [0x6f76c8]
push 1
push 0
push ebx
push 0
call fcn.004084f0
xor esi, esi
add esp, 0x10
cmp dword [0x6f76cc], 0
mov edi, eax
jle 0x408840
mov eax, eax
lea eax, [eax]
push esi
call fcn.004083d0
inc esi
pop ecx
cmp esi, dword [0x6f76cc]
jl 0x408830
xor esi, esi
cmp dword [0x6f76c8], 0
jle 0x40887a
mov eax, eax
lea eax, [eax]
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [esi*4 + 0x6f76d0]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi*4 + 0x6f76d0], 0
inc esi
cmp esi, dword [0x6f76c8]
jl 0x408850
cmp edi, 1
mov dword [0x6f76c8], 0
jne 0x4088a0
mov dword [0x6f7718], 1
push str.Using_async_loading_for_streaming_n
jmp 0x4088c3
and dword [0x6f771c], 0xbfffffff
mov dword [0x6f7714], 0
mov dword [0x6f7718], 1
push str.Using_sync_loading_for_streaming_n
call fcn.00401000
pop ecx
call fcn.004088e0
push ebx
call fcn.005805c0
pop ecx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4088e0
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
xor ebx, ebx
cmp dword [0x6f76cc], 0
jle 0x40893c
xor ebp, ebp
push 0
push 2
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
mov ecx, dword [0x6f76fc]
mov dword [ecx + ebp + 0x14], eax
mov eax, dword [0x6f76fc]
cmp dword [eax + ebp + 0x14], 0
jne 0x408930
push str.cdvd_stream
push str._s:_failed_to_create_sync_semaphore_n
call fcn.00648ac0
pop ecx
pop ecx
pop ebp
pop ebx
ret
inc ebx
add ebp, 0x30
cmp ebx, dword [0x6f76cc]
jl 0x4088f7
mov eax, dword [0x6f76cc]
inc eax
lea eax, [eax*4]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov dword [0x6f7700], eax
mov eax, dword [0x6f76cc]
inc eax
mov dword [0x6f7704], 0
push str.CdStream
push 5
push 0
push 0
mov dword [0x6f7708], 0
mov dword [0x6f770c], eax
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
test eax, eax
mov dword [0x6f76f4], eax
jne 0x4089a4
push str.cdvd_stream
push str._s:_failed_to_create_stream_semaphore_n
call fcn.00648ac0
pop ecx
pop ecx
pop ebp
pop ebx
ret
push 0x6f76f8
push 4
push 0
push 0x408260
push 0x10000
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov dword [0x6f76f0], eax
jne 0x4089e0
push str.cdvd_stream
push str._s:_failed_to_create_streaming_thread_n
call fcn.00648ac0
pop ecx
pop ecx
pop ebp
pop ebx
ret
call dword [fcn.00a1215c]
push eax
call dword [fcn.00a1215c]
dec eax
push eax
mov eax, dword [0x6f76f0]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, dword [0x6f76f0]
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
pop ebp
pop ebx
ret
Function at 0x450cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, ecx
push esi
mov esi, str.noname
push edi
lea edi, [edx + 8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [edx + 4], 0
mov eax, dword [edx + 4]
mov dword [edx], eax
mov dword [edx + 0x10], 0
xor eax, eax
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
mov dword [edx + 0x28], 0
mov word [edx + 0x2c], 0
mov dword [edx + 0x7c], 0
mov byte [edx + 0x78], 0
mov byte [edx + 0x79], 0
mov byte [edx + 0x7a], 0
mov byte [edx + 0x7b], 0
lea eax, [eax]
movzx ecx, ax
add eax, 6
cmp ax, 0x12
mov dword [edx + ecx*4 + 0x30], 0
mov dword [edx + ecx*4 + 0x34], 0
mov dword [edx + ecx*4 + 0x38], 0
mov dword [edx + ecx*4 + 0x3c], 0
mov dword [edx + ecx*4 + 0x40], 0
mov dword [edx + ecx*4 + 0x44], 0
jb 0x450d60
mov word [edx + 0x80], 0
mov byte [edx + 0x82], 0
mov byte [edx + 0x83], 1
mov byte [edx + 0x84], 0
mov byte [edx + 0x85], 0
pop edi
pop esi
ret
Function at 0x48bd80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push ebp
mov ebp, 0x3d
sub esp, 0x98
lea edx, [esp + 0x94]
lea eax, [esp + 0x90]
push edx
lea esi, [esp + 0x50]
push eax
lea eax, [esp + 0x94]
push esi
lea ebx, [esp + 0x40]
push eax
lea eax, [esp + 0x84]
push ebx
lea edx, [esp + 0x70]
push eax
lea eax, [esp + 0x34]
push edx
lea esi, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push esi
push eax
mov eax, dword [esp + 0xd0]
push str._d__s__s__s__s__s__x__s__d__d
push eax
call fcn.0064a730
mov eax, dword [esp + 0x30]
add esp, 0x30
push eax
call fcn.0055f580
mov ebx, eax
lea edx, [esp + 8]
lea eax, [ebx + 4]
pop ecx
push edx
push eax
call fcn.00642560
lea eax, [esp + 0x24]
pop ecx
pop ecx
push eax
mov ecx, ebx
call fcn.0053f1f0
mov ecx, ebx
lea eax, [esp + 0x4c]
mov esi, dword [ecx]
push eax
call dword [esi + 0x18]
mov dword [ebx + 0x1c], 0x978a10
mov byte [ebx + 0x1b], 0
lea eax, [esp + 0x5c]
push eax
call fcn.00530860
mov dword [ebx + 0x34], eax
lea eax, [esp + 0x78]
pop ecx
push eax
call fcn.0052ffc0
xor esi, esi
pop ecx
mov dword [ebx + 0x38], eax
nop
push esi
call fcn.00405980
pop ecx
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00642620
test eax, eax
pop ecx
pop ecx
jne 0x48be60
mov ebp, esi
jmp 0x48be66
inc esi
cmp esi, 0x3d
jl 0x48be40
mov dword [ebx + 0x30], ebp
mov eax, dword [esp + 0x8c]
mov dword [ebx + 0x3c], eax
mov edx, dword [esp + 0x94]
mov al, byte [esp + 0x90]
mov byte [ebx + 0x44], al
mov byte [ebx + 0x45], dl
add esp, 0x98
pop ebp
pop esi
pop ebx
ret
Function at 0x4d1300
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and esp, 0xfffffff8
push 0x691040
call fcn.00401000
lea eax, [esp + 4]
mov dword [0x97f264], 0x3f800000
fld dword [0x97f264]
pop ecx
push eax
fstp dword [0x975424]
mov dword [0x705310], 0
mov byte [0xa10b36], 0
mov dword [0xa0d894], 0
mov byte [0xa10b76], 0
mov dword [0x978d8c], 0
mov dword [0x974b2c], 1
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4d13a0
push str.Performance_counter_available_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0
push 0x3e8
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0065aa90
push 0x705300
mov dword [0x691010], eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
jmp 0x4d13bf
push str.Performance_counter_not_available__using_millesecond_timer_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov dword [0x691010], 0
call fcn.006030f0
mov dword [0xa10680], eax
mov eax, dword [0x978d8c]
mov ecx, 0xa10b8a
mov dword [0x974b2c], eax
mov eax, dword [0x974b2c]
push eax
mov dword [0xa0d898], 0
call fcn.005f98d0
push str.CTimer_ready_n
call fcn.00401000
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x564940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0x40
mov eax, dword [esp + 0x5c]
mov ebp, dword [esp + 0x58]
mov ebx, dword [esp + 0x7c]
fldz
fld dword [eax]
fsub dword [ebp]
lea edi, [esp + 0x18]
fstp dword [esp + 0x30]
fld dword [eax + 4]
fsub dword [ebp + 4]
lea esi, [esp + 0x30]
fstp dword [esp + 0x34]
fld dword [eax + 8]
fsub dword [ebp + 8]
fstp dword [esp + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fld dword [esp + 0x1c]
fst st(1)
fmul st(0)
fld dword [esp + 0x18]
fmul st(0)
faddp st(1)
fld dword [esp + 0x20]
fstp st(2)
fld st(1)
fmul st(0)
faddp st(1)
fst st(1)
fsqrt
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp st(1)
fdiv dword [esp + 0x64]
fld dword [0x698320]
fcomp st(1)
fnstsw ax
test ah, 0x45
jne 0x5649c2
fld dword [0x698320]
fstp st(1)
fld st(0)
fnstcw word [esp + 4]
mov eax, dword [esp + 4]
or byte [esp + 5], 0xc
fldcw word [esp + 4]
fistp dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 0x10], esi
xor edi, edi
fldcw word [esp + 4]
fild dword [esp + 0x10]
test esi, esi
fdivr dword [0x698320]
fstp st(1)
fld dword [esp + 0x18]
fmul st(1)
fstp dword [esp + 0x18]
fld dword [esp + 0x1c]
fmul st(1)
fstp dword [esp + 0x1c]
fld dword [esp + 0x20]
fmul st(1)
fstp dword [esp + 0x20]
jle 0x564ad0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
fldz
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
nop
mov dword [esp + 0x10], edi
mov eax, dword [0x77e8f9]
fild dword [esp + 0x10]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push ebx
fmul dword [esp + 0xc]
push dword [esp + 0x7c]
push dword [esp + 0x7c]
fadd dword [ebp + 8]
mov dword [esp + 0x1c], edi
push dword [esp + 0x7c]
fstp st(1)
fild dword [esp + 0x20]
push eax
push dword [esp + 0x80]
fmul dword [esp + 0x24]
push dword [esp + 0x80]
push dword [esp + 0x7c]
fadd dword [ebp + 4]
mov dword [esp + 0x30], edi
fstp st(2)
fild dword [esp + 0x30]
fmul dword [esp + 0x38]
fadd dword [ebp]
fstp dword [esp + 0x44]
fld st(1)
lea eax, [esp + 0x44]
fstp dword [esp + 0x48]
fst dword [esp + 0x4c]
fcompp
push eax
push dword [esp + 0x78]
call fcn.00563cc0
inc edi
add esp, 0x28
cmp edi, esi
jl 0x564ac0
add esp, 0x40
pop ebp
pop edi
pop esi
pop ebx
ret
fldz
fldz
jmp 0x564a30
fstp st(0)
jmp 0x564ab4
Function at 0x585840
Capabilities:
Check for software breakpoints

Disassembly:
xor ecx, ecx
mov eax, dword [esp + 4]
jmp 0x58599a
cmp dx, 0x80
jb 0x585990
cmp dx, 0x80
jb 0x585877
cmp dx, 0x83
ja 0x585877
add dl, 0x40
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0x84
jb 0x585893
cmp dx, 0x8d
ja 0x585893
add dl, 0x42
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0x8e
jb 0x5858b0
cmp dx, 0x91
ja 0x5858b0
add dl, 0x44
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0x92
jb 0x5858d0
cmp dx, 0x95
ja 0x5858d0
add dl, 0x47
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0x96
jb 0x5858f0
cmp dx, 0x9a
ja 0x5858f0
add dl, 0x49
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0x9b
jb 0x585910
cmp dx, 0xa4
ja 0x585910
add dl, 0x4b
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0xa5
jb 0x585930
cmp dx, 0xa8
ja 0x585930
add dl, 0x4d
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0xa9
jb 0x585950
cmp dx, 0xcc
ja 0x585950
add dl, 0x50
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0xcd
jne 0x585962
add dl, 4
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0xce
jne 0x585974
add dl, 0x23
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
cmp dx, 0xcf
jne 0x585986
add dl, 0xf0
mov byte [ecx + 0x77f48c], dl
jmp 0x585996
mov byte [ecx + 0x77f48c], 0x23
jmp 0x585996
mov byte [ecx + 0x77f48c], dl
add eax, 2
inc ecx
test eax, eax
je 0x5859b2
cmp ecx, 0xff
jge 0x5859b2
mov dx, word [eax]
test dx, dx
jne 0x585850
mov eax, 0x77f48c
mov byte [ecx + 0x77f48c], 0
ret
Function at 0x5a78b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [ebx], 0x3e8
mov eax, dword [0x974c34]
push esi
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [0x9b6ce4]
lea edx, [ecx + 4]
xor ebx, ebx
push edi
add esi, 8
push ebp
xor ebp, ebp
mov dword [edx], eax
lea eax, [eax]
mov edx, dword [ebp + 0x7e4040]
mov edi, esi
mov dword [esi], edx
mov eax, dword [ebp + 0x7e4044]
mov dword [esi + 4], eax
fld dword [ebp + 0x7e4048]
fstp dword [esi + 8]
fld dword [ebp + 0x7e404c]
fstp dword [esi + 0xc]
fld dword [ebp + 0x7e4050]
fstp dword [esi + 0x10]
fld dword [ebp + 0x7e4054]
fstp dword [esi + 0x14]
fld dword [ebp + 0x7e4058]
fstp dword [esi + 0x18]
fld dword [ebp + 0x7e405c]
fstp dword [esi + 0x1c]
fld dword [ebp + 0x7e4060]
fstp dword [esi + 0x20]
fld dword [ebp + 0x7e4064]
fstp dword [esi + 0x24]
fld dword [ebp + 0x7e4068]
fstp dword [esi + 0x28]
fld dword [ebp + 0x7e406c]
fstp dword [esi + 0x2c]
fld dword [ebp + 0x7e4070]
fstp dword [esi + 0x30]
fld dword [ebp + 0x7e4074]
fstp dword [esi + 0x34]
fld dword [ebp + 0x7e4078]
fstp dword [esi + 0x38]
fld dword [ebp + 0x7e407c]
fstp dword [esi + 0x3c]
fld dword [ebp + 0x7e4080]
fstp dword [esi + 0x40]
fld dword [ebp + 0x7e4084]
fstp dword [esi + 0x44]
fld dword [ebp + 0x7e4088]
fstp dword [esi + 0x48]
fld dword [ebp + 0x7e408c]
fstp dword [esi + 0x4c]
fld dword [ebp + 0x7e4090]
fstp dword [esi + 0x50]
fld dword [ebp + 0x7e4094]
fstp dword [esi + 0x54]
fld dword [ebp + 0x7e4098]
fstp dword [esi + 0x58]
fld dword [ebp + 0x7e409c]
fstp dword [esi + 0x5c]
fld dword [ebp + 0x7e40a0]
fstp dword [esi + 0x60]
fld dword [ebp + 0x7e40a4]
fstp dword [esi + 0x64]
fld dword [ebp + 0x7e40a8]
fstp dword [esi + 0x68]
mov eax, dword [ebp + 0x7e40ac]
mov dword [esi + 0x6c], eax
mov ecx, dword [ebp + 0x7e40b0]
mov dword [esi + 0x70], ecx
mov al, byte [ebp + 0x7e40b4]
mov byte [esi + 0x74], al
mov dl, byte [ebp + 0x7e40b5]
mov byte [esi + 0x75], dl
mov al, byte [ebp + 0x7e40b6]
mov byte [esi + 0x76], al
mov cl, byte [ebp + 0x7e40b7]
mov byte [esi + 0x77], cl
mov al, byte [ebp + 0x7e40b8]
mov byte [esi + 0x78], al
mov dl, byte [ebp + 0x7e40b9]
mov byte [esi + 0x79], dl
mov al, byte [ebp + 0x7e40ba]
mov byte [esi + 0x7a], al
mov eax, dword [edi]
test eax, eax
je 0x5a7a3a
mov ecx, dword [0x97f240]
push eax
call fcn.0043cee0
inc eax
mov dword [edi], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x5a7a51
mov ecx, dword [0x94dbe0]
push eax
call fcn.00434a40
inc eax
mov dword [edi + 4], eax
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x5a7a68
mov ecx, dword [0xa0fde4]
push eax
call fcn.005a95d0
inc eax
mov dword [edi + 0x6c], eax
inc ebx
add esi, 0x7c
add ebp, 0x7c
cmp ebx, 8
jl 0x5a78e0
pop ebp
pop edi
pop esi
pop ebx
ret