joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a00e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x8c]
push edi
lea ecx, [esp + 0x78]
push eax
lea edx, [esp + 0x6c]
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x78]
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esi + 0xdc]
push edx
mov edx, dword [esi + 0xd8]
shr eax, 4
and eax, 1
push eax
mov eax, dword [esi + 0x6c]
push ecx
mov ecx, dword [esi + 0x68]
push edx
mov edx, dword [esi + 0xb4]
push eax
mov eax, dword [esi + 0xb0]
push ecx
mov ecx, dword [esi + 0x44]
push edx
mov edx, dword [esi + 0x40]
push eax
push ecx
push edx
call fcn.004a02f0
lea ebx, [esi + 0x30]
mov dword [esp + 0x7c], eax
lea edi, [esi + 0x10]
push ebx
lea eax, [esp + 0x50]
push edi
push eax
call fcn.00418960
add esp, 0x48
lea eax, [esi + 0xa0]
add esi, 0x80
lea ecx, [esp + 0x30]
push eax
push esi
push ecx
mov dword [esp + 0x50], eax
call fcn.00418960
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [esp + 0x2c], edx
mov edx, dword [edi + 0xc]
mov edi, dword [esp + 0x4c]
mov esi, 1
add esp, 0xc
cmp edi, esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
jl 0x4a02d1
fld qword [esp + 0x10]
fmul qword [esp + 0x68]
fld qword [esp + 0x18]
fmul qword [esp + 0x70]
lea eax, [esp + 0x58]
lea ecx, [esp + 0x80]
push eax
push ebx
fsubp st(1)
push ecx
fstp qword [esp + 0x64]
fld qword [esp + 0x1c]
fmul qword [esp + 0x7c]
fld qword [esp + 0x24]
fmul qword [esp + 0x74]
faddp st(1)
fstp qword [esp + 0x6c]
fld qword [esp + 0x3c]
fmul qword [esp + 0x9c]
fld qword [esp + 0x44]
fmul qword [esp + 0x84]
fsubp st(1)
fstp qword [esp + 0x54]
fld qword [esp + 0x3c]
fmul qword [esp + 0x84]
fld qword [esp + 0x44]
fmul qword [esp + 0x9c]
faddp st(1)
fstp qword [esp + 0x5c]
call fcn.004189a0
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0xa8]
push eax
push ecx
call fcn.004189a0
lea edx, [esp + 0x38]
lea eax, [esp + 0xb0]
push edx
lea ecx, [esp + 0x9c]
push eax
push ecx
call dword [ebp + 0x14]
add esp, 0x24
test eax, eax
jne 0x4a02da
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x8c]
inc esi
cmp esi, edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
jle 0x4a01af
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
imul eax, dword [esp + 0xc]
mov ecx, eax
dec eax
test ecx, ecx
je 0x4a22ad
push ebx
mov ebx, dword [0x550bec]
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [eax + 1]
call ebx
and eax, 0x800000ff
jns 0x4a22a0
dec eax
or eax, 0xffffff00
inc eax
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec edi
jne 0x4a2290
pop edi
pop esi
pop ebx
ret
Function at 0x4aa190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
and eax, 0xe00
cmp eax, 0x600
jne 0x4aa318
fld qword [esi + 0x68]
fmul qword [0x55b6a8]
mov dword [esp + 0xc], esi
call fcn.00547c92
mov ebx, eax
cmp ebx, 1
jge 0x4aa1cf
mov ebx, 1
lea ecx, [ebx + ebx]
lea edx, [esi + 0x10]
mov dword [esp + 0x10], ecx
mov edi, dword [ebp + 0xc]
fild dword [esp + 0x10]
mov eax, dword [edx]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0
fdivr qword [0x550f30]
mov ecx, dword [edx + 4]
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x2c], eax
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x34], ecx
fstp qword [esp + 0x20]
call fcn.00418b10
add esp, 8
mov eax, ebx
dec ebx
test eax, eax
je 0x4aa2f0
jmp 0x4aa233
mov edi, dword [ebp + 0xc]
fld qword [esp + 0x10]
fadd qword [esp + 0x18]
lea ecx, [esp + 0x40]
push ecx
fstp qword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
push esi
call fcn.00440080
fld qword [esp + 0x20]
fadd qword [esp + 0x28]
lea ecx, [esp + 0x40]
push ecx
fstp qword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push edx
push eax
push esi
call fcn.00440080
lea ecx, [esp + 0x60]
push edi
push ecx
call fcn.00418b10
lea edx, [esp + 0x58]
push edi
push edx
call fcn.00418b10
push 0x40c38800
lea eax, [esp + 0x64]
push 0
lea ecx, [esp + 0x78]
push eax
lea edx, [esp + 0x5c]
push ecx
push edx
call fcn.00409120
mov edi, eax
add esp, 0x44
test edi, edi
je 0x4aa30c
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push edi
call fcn.0043f8b0
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x30], eax
add esp, 0xc
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x3c]
mov eax, ebx
dec ebx
mov dword [esp + 0xc], edi
test eax, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
jne 0x4aa230
mov ecx, dword [ebp + 0x10]
push ecx
push esi
call fcn.0043f900
push esi
call fcn.00488710
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
lea edi, [esi + 0x10]
push ebx
push edi
call fcn.00418b10
lea edx, [esi + 0x20]
push ebx
push edx
call fcn.00418b10
lea eax, [esi + 0x30]
push eax
push esi
push edi
call fcn.0043f950
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x244
push ebx
push ebp
push esi
mov esi, dword [esp + 0x254]
xor eax, eax
push edi
cmp esi, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x40], al
je 0x4caaff
mov ebx, dword [0x550e94]
mov ebp, dword [0x550bf4]
test esi, esi
je 0x4ca97e
mov eax, dword [esi + 0x20]
lea ecx, [esp + 0x34]
push 0xa
push ecx
push eax
call ebx
mov ecx, esi
call fcn.00548456
lea edx, [esp + 0x74]
push 0x4f
push edx
mov ecx, esi
mov edi, eax
call fcn.0054841a
lea eax, [esp + 0x34]
push str.Button
push eax
call ebp
add esp, 8
test eax, eax
jne 0x4caa6b
mov ecx, edi
and ecx, 0xf
cmp cl, 9
jne 0x4caa6b
cmp esi, dword [esp + 0x14]
je 0x4ca9d6
test edi, 0x20000
jne 0x4caa6b
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x40]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 3]
cmp eax, 0x32
jae 0x4caa21
lea ecx, [esp + 0x74]
lea edi, [esp + 0x40]
push ecx
or ecx, 0xffffffff
xor eax, eax
push str.__s_
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + ecx + 0x48]
push edx
call dword [0x550c38]
add esp, 0xc
mov edi, dword [esp + 0x260]
push 0x5718a8
lea eax, [esp + 0x78]
push edi
push eax
mov dword [esp + 0x24], esi
call fcn.005472ee
add esp, 0xc
test eax, eax
jne 0x4caa4f
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4caab2
mov dword [esp + 0x10], esi
mov esi, dword [esi + 0x20]
push 2
push esi
call dword [0x550eac]
push eax
call fcn.005482ca
mov esi, eax
test esi, esi
jne 0x4ca97b
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x4caaff
mov esi, dword [esp + 0x14]
mov edi, dword [0x550e20]
mov edx, dword [esi + 0x20]
xor ecx, ecx
cmp esi, ebx
push 0
sete cl
push ecx
push 0xf1
push edx
call edi
cmp esi, dword [esp + 0x18]
je 0x4caaf2
mov esi, dword [esi + 0x20]
push 2
push esi
call dword [0x550eac]
push eax
call fcn.005482ca
mov esi, eax
jmp 0x4caa81
mov ecx, dword [esp + 0x25c]
push edi
push ecx
lea edx, [esp + 0xcc]
push str._s___s
push edx
call dword [0x550c38]
mov eax, dword [0x582794]
lea ecx, [esp + 0xd4]
lea edx, [esp + 0x50]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
push 3
lea eax, [esp + 0x30]
jmp 0x4cab44
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x244
ret
mov eax, dword [esp + 0x260]
mov ecx, dword [esp + 0x25c]
push eax
push ecx
lea edx, [esp + 0x194]
push str._s___s
push edx
call dword [0x550c38]
mov eax, dword [0x582790]
lea ecx, [esp + 0x19c]
lea edx, [esp + 0x50]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
push 3
lea eax, [esp + 0x3c]
push eax
call fcn.004c9c60
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x244
ret
Function at 0x4d4b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
fld dword [0x584b3c]
push ebx
mov ebx, dword [ebp + 8]
fstp qword [esp + 8]
mov dword [0x57e5c4], ebx
push esi
fld dword [ebx + 0x60]
lea eax, [esp + 0x7c]
push edi
fstp qword [esp + 0x98]
fld dword [ebx + 0x64]
lea ecx, [esp + 0x98]
push eax
fstp qword [esp + 0xa4]
fld dword [ebx + 0x68]
push ecx
fstp qword [esp + 0xb0]
fld dword [ebx + 0x6c]
fstp qword [esp + 0x88]
fld dword [ebx + 0x70]
fstp qword [esp + 0x90]
fld dword [ebx + 0x74]
fstp qword [esp + 0x98]
call fcn.00418fd0
call fcn.00547db0
fmul qword [0x550f60]
fabs
fdiv qword [esp + 0x18]
fstp qword [esp]
call dword [0x550cc0]
add esp, 8
call fcn.00547c92
mov ecx, 1
mov dword [esp + 0xc], eax
cmp eax, ecx
jge 0x4d4c35
mov dword [esp + 0xc], ecx
mov eax, ecx
fild dword [esp + 0xc]
mov edx, dword [ebx + 0x10]
mov esi, dword [ebx + 0x14]
mov dword [esp + 0x30], edx
mov edx, dword [ebx + 0x18]
fdivr qword [0x550f30]
mov dword [esp + 0x34], esi
mov esi, dword [ebx + 0x1c]
cmp eax, ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x10], ecx
fstp qword [esp + 0x48]
fld dword [ebx + 0x40]
fstp qword [esp + 0x40]
fld dword [ebx + 0x60]
fstp qword [esp + 0x68]
fld dword [ebx + 0x64]
fstp qword [esp + 0x70]
fld dword [ebx + 0x68]
fstp qword [esp + 0x78]
jl 0x4d4d8d
fild dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
fmul qword [esp + 0x4c]
fld qword [ebx + 0x20]
fsub qword [ebx + 0x10]
fmul st(1)
fadd qword [ebx + 0x10]
fstp qword [esp + 0x54]
fld qword [ebx + 0x28]
fsub qword [ebx + 0x18]
fmul st(1)
fadd qword [ebx + 0x18]
fstp qword [esp + 0x5c]
fld dword [ebx + 0x44]
fsub dword [ebx + 0x40]
fmul st(1)
fadd dword [ebx + 0x40]
fstp qword [esp + 0x64]
fld dword [ebx + 0x6c]
fsub dword [ebx + 0x60]
fmul st(1)
fadd dword [ebx + 0x60]
fstp qword [esp + 0x1c]
fld dword [ebx + 0x70]
fsub dword [ebx + 0x64]
fmul st(1)
fadd dword [ebx + 0x64]
fstp qword [esp + 0x24]
fld dword [ebx + 0x74]
fsub dword [ebx + 0x68]
fmul st(1)
fadd dword [ebx + 0x68]
fstp qword [esp + 0x2c]
fstp st(0)
call fcn.00418ee0
fstp st(0)
fld qword [esp + 0x1c]
mov ecx, dword [0x57e618]
push 0x580354
fstp dword [0x580364]
fld qword [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
fstp dword [0x580368]
fld qword [esp + 0x34]
lea eax, [esp + 0x74]
push edx
fstp dword [0x58036c]
fld qword [0x57e5b0]
lea ecx, [esp + 0x60]
push eax
fstp dword [0x580354]
lea edx, [esp + 0x44]
push ecx
push edx
call fcn.004f0c00
mov ecx, 6
lea esi, [esp + 0x6c]
lea edi, [esp + 0x4c]
lea eax, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
lea esi, [esp + 0x34]
lea edi, [esp + 0x84]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004d4db0
add esp, 0x20
test eax, eax
jne 0x4d4d96
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jle 0x4d4c87
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e4370
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
jmp 0x4e43b5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4eca60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
push 0xc0
push 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.00547150
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4eca99
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x50
ret
mov esi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
test esi, esi
je 0x4ecb2f
test dword [esi + 4], 0x400000
je 0x4ecb24
lea eax, [esp + 0x18]
push eax
push ebp
push esi
call fcn.004ecee0
add esp, 0xc
cmp eax, 2
jne 0x4ecb24
lea ecx, [esp + 0x18]
lea edi, [ebp + 0x60]
push ecx
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.004464c0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push edi
push ecx
call fcn.004464c0
lea edx, [esp + 0x48]
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00418a80
fcomp qword [esp + 0x8c]
add esp, 0x20
fnstsw ax
test ah, 0x41
jne 0x4ecb24
lea ecx, [esp + 0x30]
push ebx
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0043f9f0
add esp, 0xc
test eax, eax
je 0x4eca8c
mov esi, dword [esi + 0x34]
test esi, esi
jne 0x4ecaa9
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
push eax
push ecx
push ebx
call fcn.004ecc10
mov eax, dword [ebx + 0xc]
add esp, 0xc
test eax, eax
je 0x4ecbd9
mov edi, dword [esp + 0x78]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
push 1
push edx
push eax
push ebx
call fcn.00410340
mov esi, eax
mov eax, dword [0x584b84]
add esp, 0x10
test eax, eax
jne 0x4ecbd9
test esi, esi
je 0x4ecbce
mov ecx, dword [esi]
push 3
and ecx, 0xfffffffe
push esi
or ecx, 2
mov dword [esi], ecx
call fcn.004ac0f0
push esi
push edi
call fcn.004894b0
mov edx, dword [esp + 0x84]
push esi
mov dword [esi + 0x38], 1
mov dword [esi + 0xa4], ebp
mov dword [esi + 0xac], edx
call fcn.0048cbe0
add esp, 0x14
test eax, eax
je 0x4ecbbd
mov dword [esp + 0x14], 1
push esi
call fcn.0046e160
add esp, 4
mov dword [esp + 0x10], 1
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4ecb51
push ebx
call fcn.004888a0
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x4ecbf6
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x50
ret
Function at 0x4f6b70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
mov eax, 3
mov ebx, dword [esp + 0x14]
mov word [esi + 6], ax
mov word [esi + 4], ax
mov ax, word [esp + 0x18]
and ecx, 1
shl ecx, 1
and edx, 1
mov word [esi + 0xc], ax
mov eax, dword [esi]
or ecx, edx
shl ecx, 0x14
and eax, 0xffcfffff
push edi
or ecx, eax
xor ebp, ebp
mov eax, 0x3ff00000
push 4
mov dword [esi + 0x68], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x70], ebp
mov dword [esi + 0x60], ebp
push ebx
mov word [esi + 0xe], bx
mov dword [esi], ecx
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x74], eax
mov dword [esi + 0x64], eax
call fcn.00547150
add esp, 8
cmp eax, ebp
mov dword [esp + 0x18], eax
jne 0x4f6bf2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
xor edi, edi
cmp ebx, ebp
jle 0x4f6caa
mov ecx, dword [esp + 0x2c]
cmp ecx, ebp
je 0x4f6c0c
lea edx, [edi + edi*2]
lea ecx, [ecx + edx*8]
jmp 0x4f6c0e
xor ecx, ecx
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x4f6c1e
lea edx, [edi + edi*2]
lea eax, [eax + edx*8]
jmp 0x4f6c20
xor eax, eax
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esi]
shr eax, 0x14
and eax, 1
push eax
mov eax, dword [edx + edi*4]
push ecx
push eax
call fcn.004b8c80
add esp, 0x18
test eax, eax
jne 0x4f6be8
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
cmp edi, ebp
mov edx, dword [ecx + 0xc]
mov dword [eax + edi*4], edx
jne 0x4f6c6f
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x18], ecx
mov dx, word [eax + 6]
mov word [esi + 8], dx
jmp 0x4f6c8d
mov eax, dword [esp + 0x38]
push 8
movsx ecx, word [eax + 6]
mov edx, dword [eax + 0x14]
add ecx, 8
push ecx
push edx
call fcn.0054714a
mov eax, dword [esp + 0x44]
add esp, 0xc
push 0xb0
push 1
push eax
call fcn.0054714a
add esp, 0xc
inc edi
cmp edi, ebx
jl 0x4f6bfc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push esi
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ebx
push ecx
push eax
call fcn.004f6cd0
add esp, 0x18
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
ret
Function at 0x4f6cd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
push 4
push ebx
call fcn.00547150
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4f6cfb
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
xor edi, edi
test ebx, ebx
jle 0x4f6d26
mov esi, eax
mov ebp, dword [esp + 0x2c]
push 0x18
push ebp
call fcn.00547150
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x4f6daa
inc edi
add esi, 4
cmp edi, ebx
jl 0x4f6d03
jmp 0x4f6d2a
mov ebp, dword [esp + 0x2c]
test ebx, ebx
jle 0x4f6d8b
mov eax, dword [esp + 0x18]
xor ebp, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jle 0x4f6d6e
mov eax, dword [esp + 0x24]
xor edx, edx
mov ebx, ecx
mov edi, dword [eax]
mov ecx, dword [esp + 0x14]
mov esi, ebp
add eax, 4
add esi, edi
mov edi, dword [ecx]
add edi, edx
mov ecx, 6
add edx, 0x18
dec ebx
rep movsd dword es:[edi], dword [esi]
jne 0x4f6d4c
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
add ebp, 0x18
add ecx, 4
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jne 0x4f6d3c
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
push ebx
push ebp
push edx
call fcn.004f5f30
push 4
push ebx
call fcn.00547150
add esp, 0x14
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x4f6db7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
xor edi, edi
test ebx, ebx
jle 0x4f6dd8
mov esi, eax
push 0x18
push ebp
call fcn.00547150
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x4f6daa
inc edi
add esi, 4
cmp edi, ebx
jl 0x4f6dbf
mov edi, dword [esp + 0x38]
xor esi, esi
test ebx, ebx
jle 0x4f6e90
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x4f6df6
lea eax, [esi + esi*2]
lea ecx, [ecx + eax*8]
jmp 0x4f6df8
xor ecx, ecx
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4f6e08
lea edx, [esi + esi*2]
lea eax, [eax + edx*8]
jmp 0x4f6e0a
xor eax, eax
lea edx, [esp + 0x10]
push edx
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [edi]
mov edx, dword [ecx + esi*4]
shr eax, 0x15
and eax, 1
push eax
push ebp
push edx
call fcn.004b8c80
add esp, 0x18
test eax, eax
jne 0x4f6daa
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
test esi, esi
mov ecx, dword [eax + 0xc]
mov dword [edx + esi*4], ecx
jne 0x4f6e59
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [edi + 0x1c], ecx
mov dx, word [eax + 6]
mov word [edi + 0xa], dx
jmp 0x4f6e77
mov eax, dword [esp + 0x10]
push 8
movsx ecx, word [eax + 6]
mov edx, dword [eax + 0x14]
add ecx, 8
push ecx
push edx
call fcn.0054714a
mov eax, dword [esp + 0x1c]
add esp, 0xc
push 0xb0
push 1
push eax
call fcn.0054714a
add esp, 0xc
inc esi
cmp esi, ebx
jl 0x4f6de6
mov eax, dword [esp + 0x18]
push ebp
push ebx
push eax
call fcn.004f5f30
mov ecx, dword [esp + 0x38]
push edi
mov dword [edi + 0x10], ecx
call fcn.00503120
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4fcfe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push ebx
push esi
push edi
push 0xc0
push 1
call fcn.00547150
mov edi, eax
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [esp + 0x1c], edi
test edi, edi
mov dword [eax], edi
jne 0x4fd019
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [edi]
mov eax, dword [ebp + 8]
or esi, 0x40
mov dword [edi + 0x38], 1
mov dword [edi], esi
mov esi, dword [eax]
not esi
shr esi, 6
and esi, 1
push eax
mov dword [esp + 0x1c], esi
call fcn.00481600
fstp qword [esp + 0x2c]
fild dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add esp, 4
xor ebx, ebx
fsub qword [0x550f30]
test eax, eax
mov dword [esp + 0x10], ebx
fdivr qword [0x550f30]
fstp qword [esp + 0x20]
jle 0x4fd197
jmp 0x4fd073
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
fild dword [esp + 0x10]
test esi, esi
fmul qword [esp + 0x20]
fmul qword [esp + 0x28]
fstp qword [esp + 0x10]
je 0x4fd0ea
test ebx, ebx
je 0x4fd093
mov ecx, dword [ebp + 0xc]
dec ecx
cmp ebx, ecx
jne 0x4fd0ea
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x48]
lea eax, [esp + 0x60]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.004fb610
fld qword [esp + 0x5c]
add esp, 0x14
test ebx, ebx
jne 0x4fd0d4
fstp dword [esp + 0x30]
fld qword [esp + 0x50]
fstp dword [esp + 0x34]
fld qword [esp + 0x58]
fstp dword [esp + 0x38]
jmp 0x4fd178
fstp dword [esp + 0x3c]
fld qword [esp + 0x50]
fstp dword [esp + 0x40]
fld qword [esp + 0x58]
fstp dword [esp + 0x44]
jmp 0x4fd107
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x60]
push 0
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call fcn.00489db0
add esp, 0x14
test ebx, ebx
jle 0x4fd178
lea edx, [esp + 0x60]
push edi
lea eax, [esp + 0x7c]
push edx
push eax
call fcn.00440210
add esp, 0xc
test eax, eax
je 0x4fd00d
test esi, esi
je 0x4fd178
cmp ebx, 1
je 0x4fd137
mov ecx, dword [ebp + 0xc]
dec ecx
cmp ebx, ecx
jne 0x4fd178
mov eax, dword [edi + 0x10]
mov edx, dword [eax + 4]
or edx, 8
cmp ebx, 1
mov dword [eax + 4], edx
jne 0x4fd161
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
add eax, 0x48
mov dword [eax], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
jmp 0x4fd178
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
add eax, 0x48
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov eax, dword [ebp + 0xc]
inc ebx
mov ecx, 6
lea esi, [esp + 0x60]
lea edi, [esp + 0x78]
cmp ebx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], ebx
jl 0x4fd06b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5044a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [0x580070]
xor ebp, ebp
test esi, esi
je 0x504519
push ebx
mov bl, byte [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov ecx, dword [esi]
test cl, 1
jne 0x50450b
test ch, 0x20
jne 0x50450b
fld qword [esi + 0x24]
fcomp qword [edi]
fnstsw ax
test ah, 0x41
jne 0x50450b
fld qword [esi + 0x3c]
fcomp qword [edi + 0x10]
fnstsw ax
test ah, 1
je 0x50450b
fld qword [esi + 0x2c]
fcomp qword [edi + 8]
fnstsw ax
test ah, 0x41
jne 0x50450b
fld qword [esi + 0x44]
fcomp qword [edi + 0x18]
fnstsw ax
test ah, 1
je 0x50450b
or ecx, 1
test bl, 2
mov dword [esi], ecx
je 0x50450a
push esi
call fcn.004fef40
add esp, 4
inc ebp
mov esi, dword [esi + 0x78]
test esi, esi
jne 0x5044b8
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
ret
mov eax, ebp
pop esi
pop ebp
ret