joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9d98b3
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ecx*2 + 0x7273bc9]
not ebx
not word [esp + 0xc]
not dword [esp + 0xc]
lea ecx, [ecx + ebp*8 + 0x584d0a7b]
seto byte [esp + 0x14]
and bp, 0x410c
neg bp
neg dword [esp + 0x14]
add ebx, ebx
xor ebx, dword [esp + 0xc]
lea ebx, [ebx + 0x443800ca]
add word [esp + 0xc], bp
mov ebp, dword [esp + 0x30]
xor byte [esp + 0x14], 0x26
not byte [esp + 0x14]
setbe byte [esp + 0xc]
not dword [esp + 0xc]
setbe cl
js 0x9d98e9
and cl, byte [esp + 0x29]
call fcn.008f1f27
mov eax, dword [edi]
cmp eax, 0x46364fa
sbb edx, esp
or dx, bp
mov edx, dword [eax]
mov dword [edi], edx
rcl edx, 0x6e
mov edx, dword [ebp]
clc
lea ebp, [ebp + 4]
xor edx, ebx
test esi, 0x48b86119
clc
sub edx, 0x7c91b54
clc
stc
jmp 0xab0b73
push esi
ret
rol edx, 3
xor edx, 0x37566fc9
jmp 0xc57f20
add edx, 0x71d35f2d
stc
cmc
clc
ror edx, 1
xor ebx, edx
test di, cx
clc
add esi, edx
jmp 0xa59f72

Function at 0x9ecd49
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
neg ebp
or dword [esp + 8], 0x1a10295a
mov ebx, edx
lea ecx, [edi + edx + 0x39563b96]
sub ebx, ebp
movzx cx, bl
and edi, 0x155a1483
movzx cx, word [esp + 0x26]
add bl, byte [esp + 0xa]
and dword [esp + 8], ebx
push edi
add ecx, 0x16d81c61
test dword [esp], 0x787624fe
push esi
lea edi, [esi*4 + 0x65ee691e]
push esi
movzx ecx, word [esp + 0x30]
lea ecx, [ebp*2 + 0x36ce1f0c]
push edx
jbe 0xb59dd5
mov ecx, dword [esp + 0x2c]
mov byte [esp], 0xe9
neg dl
add ebx, dword [esp + 0xc]
test dl, 0xb7
call fcn.00b040cf
push esi
mov esi, 0x390f3de8
pushfd
xor si, 0x1071
or si, 0x334e
lea esi, [esi + esi*4 + 0x3fca6acf]
push esi
movzx esi, byte [esp]
lea esi, [esi + esi*4 + 0x462e2041]
sub word [esp], 0x77d8
neg byte [esp]
jg 0x9ecdbf
movsx esi, word [esp]
sete byte [esp]
push edi
add dword [esp + 0x10], 0x1c097c
or dword [esp + 4], esi
test byte [esp + 4], 0x80
mov edi, 0x17041b4d
push ebx
mov esi, dword [esp + 0x10]
push dword [esp + 0xc]
popfd
mov edi, dword [esp + 4]
lea esp, [esp + 0x14]
ret 4

Function at 0xa090fc
Capabilities:
Check for software breakpoints

Disassembly:
push edi
mov ecx, dword [esp + 0x10]
bswap ebx
lea edi, [ebp + esi*8 + 0x71b34412]
and ebx, dword [esp]

Function at 0xaa9fcb
Capabilities:
Encode data using xor

Disassembly:
push edi
setge byte [esp + 0x18]
push 0x2eb47757
test byte [esp + 0x1c], 0xca
mov edx, dword [esp + 0xc]
seta byte [esp]
mov edi, dword [esp + 0x1c]
xor byte [esp + 0x10], 0xd8
add di, word [esp + 1]
test byte [esp + 0x1c], 0x6a
jg 0xaa9fcc
neg dword [esp + 0x1c]
cmp edi, 0x1fa9677f
setno byte [esp + 0x10]
or dword [esp], 0x7f76f1f
cmp byte [esp + 0x10], 0x54
cmovg di, word [esp + 0x12]
add dword [esp + 8], 0x41359
mov edi, dword [esp + 0x1c]
add dword [esp + 0x18], 0xff9a8e39
mov edi, dword [esp + 4]
lea esp, [esp + 8]
ret 8
Function at 0xaf295a
Capabilities:
Check for software breakpoints

Disassembly:
cmovbe dx, word [esp + 0x1e]
test word [esp + 0x1c], dx
movzx dx, cx
call fcn.00af295a
xor edx, ebx
jmp 0xaeded1
inc edx
not edx
stc
clc
ror edx, 1
test ebx, edi
cmp si, 0x6f5a
sub edx, 0x11c42648
jmp 0xa1da64
je 0xbaa628
xor dl, byte [esp + 0x2a]
cmp dword [esp + 0x28], ecx
mov dword [esp + 0x30], 0x10492f1b
mov edx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
call int.00ab8fa7
mov eax, dword [edi]
bts edx, edi
rol cx, cl
not cl
add edi, 4
btr ecx, eax
movzx ecx, byte [ebp]
adc edx, edi
add ebp, 1
xadd dl, dh
bts dx, di
xor cl, bl
dec cl
btc dx, si
not cl
movzx edx, si
bt edx, edi
rol cl, 1
movzx edx, sp
bswap dx
mov edx, 0x69e33211
dec cl
and dx, 0x973
xor cl, 0x15
dec dx
movzx dx, cl
inc cl
add edx, ebp
xor cl, 0xe2
btr edx, edx
shl dx, 0x9b
xor bl, cl
shr dh, 0x6b
mov dword [esp + ecx], eax
and edx, 0x79553998
mov edx, dword [ebp]
clc
lea ebp, [ebp + 4]
cmp edi, edx
jmp 0x9dd521
push edx
push ecx
mov ecx, 0x20f16a8c
pushfd
mov edx, 0x4ab75493
mov ecx, 0x5fb673a5
lea edx, [edx + edx*4 + 0x22617dd2]
lea ecx, [edx + edx*4 + 0x7d560219]
mov edx, 0x76521fa0
not ecx
and cx, cx
jle 0x9ab4f9
mov cl, 0xb5
lea edx, [ecx*2 + 0x56490c88]
or cx, 0x6430
mov edx, dword [esp + 8]
mov dword [esp + 8], 0x5f87bf17
xor ecx, ecx
push esi
mov cx, 0xd32
neg ecx
lea ecx, [ecx + 0x797a052b]
lea ecx, [ecx*2 + 0x599a7dfd]
push ebx
mov ebx, 0x51696eeb

Function at 0xb51849
Capabilities:
Encode data using xor

Disassembly:
neg dword [esp + 0xc]
or dword [esp + 0xc], 0x648f6a3e
not edx
add dword [esp + 0x10], 0x3e5b0b11
setno byte [esp + 0x20]
and dword [esp + 0x20], 0x5d385fcb
sets byte [esp + 0xc]
or dx, word [esp + 0x21]
add dword [esp + 0x14], 0xff8379d0
xor dword [esp + 0x10], edx
jns 0xb51864
test byte [esp + 0x20], 0x3d
not dword [esp + 0x10]
mov di, dx
movzx edx, byte [esp + 0xc]
movzx di, byte [esp + 0xc]
mov edi, dword [esp + 0x10]
mov edi, dword [esp + 0x28]
jle 0xb518a3
or word [esp + 0xc], 0x48ec
mov dx, 0x537b
and byte [esp + 0x20], 0xad
jl fcn.00a5c934
test edx, edx
call fcn.00c043c3

Function at 0xbb938b
Capabilities:
Encode data using xor

Disassembly:
call fcn.00c6a108
fsub dword [ebp - 0x348bfc2d]
mov al, byte [0x6a50ca59]
sub byte [esp + edi], al
and esp, dword [ecx + 0x37]
dec edx
push cs
adc edx, dword [edx - 0x1b52a3a3]
salc
cmp al, 0xcd
aad 0x95
inc ebx
cmp al, 0xa2
sub dword [esp + ebx*2 + 0x53], edi
xchg esp, eax
test dword [esi + 0x721e1f9b], eax
loope 0xbb93f0
cmp dword [ebx + 0x34dae8fc], 0xffffffdd
xchg esi, eax
mov dh, 0x9e
test dword gs:[esi + 0x12b48d7b], ebp
sub cl, byte [esi]
ret 0x4ee9
sbb al, 0x8f
lds ecx, [edx - 0x55501a82]
pushfd
pushfd
loopne 0xbb9462
push edx
sbb eax, 0xb3181922
and eax, 0x958937
sbb dword [edx + 0x3716e69c], edi
dec edx
add edx, esp
imul eax, dword [ebp - 0x26633103], 0x551e7efa
inc edx
inc ecx
imul ecx, dword [ecx], 0xffffff80
xor al, 0xc4
invalid
in al, dx
mov esi, 0x2f7ccf1f
push ss
and eax, 0x5e3641cb
jmp dword [eax]
Function at 0xbdef6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
push ebp
pushfd
sbb ebp, 0x77e83d54
bt ebp, 3
push edi
xadd ecx, edi
clc
sub bp, sp
push esi
push edx
cwd
push eax
rdtsc
push ebx
cbw
lahf
mov ecx, 0
push ecx
mov ebp, dword [esp + 0x28]
not ebp
xor ebp, 0x3e9c3a95
xchg bl, dh
cmovl esi, ecx
cdq
inc ebp
rcr si, 0xd6
movsx dx, dh
rcl dh, 0xa2
rol ebp, 1
add ebp, ecx
cmc
bt bx, 0x6e
rcl bh, cl
mov edi, esp
sub esp, 0xc0
rdtsc
rol al, 0x51

Function at 0xc0cbc3
Capabilities:
Check for software breakpoints

Disassembly:
rol ecx, 3
cmp ecx, esp
clc
xor ebx, ecx
add edi, ecx
jmp 0xb745f3
xor ecx, 0x3d025b0
not ecx
stc
ror ecx, 2
cmc
add ecx, 0x245e4dd3
neg ecx
cmc
not ecx
stc
jmp 0xa77edc
lea ebp, [ebp + 4]
xor ecx, ebx
cmc
not ecx
jmp 0xb121ec
push edi
ret
xor ebx, esi
add dword [esp + 0x14], 0x2b3b2a3e
jb 0x96a616
jo 0xa09124
setns byte [esp + 0x14]
test dword [esp + 0xc], 0x45ea420b
setne byte [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov ebp, esi
cmp byte [esp + 0xc], 0xb8
bswap esi
cmova esi, dword [esp + 0x14]
call fcn.00bf2a3c
mov edx, dword [esi]
shrd cx, cx, 0x32
mov ecx, dword [esi + 4]
cmc
cmp dx, di
lea esi, [esi + 8]
stc
cmc
jmp 0xc4175e
mov dword fs:[edx], ecx
btc ecx, 0x64
btr cx, bx
mov ecx, dword [ebp]
jmp 0xb6a000
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40288e
pop dword [ebp - 0x30]
mov eax, 0x40288e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xa26af8d1
sub dword [ebp - 0x40], 0x5418b386
mov dword [ebp - 0x3c], 0x42cb9b43
sub dword [ebp - 0x3c], 0x10984efe
mov dword [ebp - 0x38], 0x26a76b72
sub dword [ebp - 0x38], 0xda5b2744
mov dword [ebp - 0x34], 0x7fc6c738
sub dword [ebp - 0x34], 0x7fc6c738
lea eax, [ebp - 0x40]
push eax
mov eax, 0x6babb63a
add eax, 0x9494ba2a
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x4a6d9110
add dword [ebp - 0x40], 0x2a04d846
mov dword [ebp - 0x3c], 0xfa7a0b0d
sub dword [ebp - 0x3c], 0xb90da998
mov dword [ebp - 0x38], 0xbe168448
sub dword [ebp - 0x38], 0x5aa717dc
mov dword [ebp - 0x34], 0x61d25212
add dword [ebp - 0x34], 0x9e2dadee
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x1538de4d
sub eax, 0x14f86da5
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x374c2
push 0
call eax
mov ecx, 0xc98324c3
sub ecx, 0xc982d9f5
xor esi, esi
add esi, eax
mov edx, 0xc277918e
sub edx, 0xc236918e
add edx, dword [ebp - 0x30]
mov ebx, 0x326b5da1
add ebx, 0xd8161c24
mov dword [ebp - 0x20], 0xe4d4ffcf
mov edi, dword [edx]
xor dword [ebp - 0x28], ecx
xor edi, ebx
add dword [ebp - 0x14], eax
mov dword [esi], edi
sub dword [ebp - 0x28], esi
add esi, 4
add edx, 0xfa5d0480
sub edx, 0xfa5d047c
loop 0x4029ad
add eax, 0x994534eb
sub eax, 0x994416e0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401230
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call fcn.004011d0
add esp, 0xc
push 1
call dword [sym.imp.MSVCR90.dll_exit]
int3

Function at 0x401d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4569cb
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x461b6c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0xc]
xor ebx, ebx
cmp ecx, ebx
je 0x401d86
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jge 0x401d86
lea edx, [eax + eax*2]
inc eax
mov dword [esi], eax
mov eax, dword [esp + 0x40]
lea ecx, [ecx + edx*8]
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00401180
jmp 0x401e6d
mov eax, dword [esi + 4]
cmp eax, 1
mov edi, 1
jl 0x401d96
lea edi, [eax + eax]
xor ecx, ecx
mov eax, edi
mov edx, 0x18
mul edx
seto cl
mov dword [esi + 4], edi
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00440560
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], ebx
cmp eax, ebx
je 0x401de6
push 0x401170
push 0x401150
push edi
lea ebp, [eax + 4]
push 0x18
push ebp
mov dword [eax], edi
call fcn.004405f8
jmp 0x401de8
xor ebp, ebp
mov dword [esp + 0x38], 0xffffffff
cmp ebp, ebx
jne 0x401e08
push str.Memory_Allocation_Failure
push 0x8d
push str.d:devwncdevwncobjinternalincwctl_sh3_array.hpp
call fcn.00401230
cmp dword [esi], 0
jle 0x401e2b
xor edi, edi
nop
mov ecx, dword [esi + 0xc]
add ecx, edi
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [edi + ebp]
call fcn.00401180
inc ebx
add edi, 0x18
cmp ebx, dword [esi]
jl 0x401e10
mov eax, dword [esi]
mov edx, dword [esp + 0x40]
lea ecx, [eax + eax*2]
inc eax
mov dword [esi], eax
push edx
lea eax, [esp + 0x1c]
lea ecx, [ebp + ecx*8]
push eax
call fcn.00401180
mov eax, dword [esi + 0xc]
test eax, eax
je 0x401e6a
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x401170
push ecx
push 0x18
push eax
call fcn.004406c2
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0xc], ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x403270
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x456a50
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x461b6c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 0x64
mov eax, dword [esp + 0x58]
fld qword [eax + 8]
mov ebx, 1
fld qword [eax]
mov dword [esp + 0x50], ebx
fstp qword [esp + 0x38]
mov dword [esp + 0x30], esi
fstp qword [esp + 0x40]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 2
call fcn.00401d30
mov eax, dword [esp + 0x5c]
fld qword [eax + 8]
mov dword [esp + 0x30], esi
fld qword [eax]
fstp qword [esp + 0x38]
fstp qword [esp + 0x40]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 3
call fcn.00401d30
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0x64
lea edx, [esp + 0x10]
push edx
push esi
lea eax, [esp + 0x28]
push edi
push eax
mov byte [esp + 0x60], 5
call fcn.0040db40
add esp, 0x10
cmp eax, esi
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x50], bl
je 0x4033b1
cmp eax, esi
je 0x403361
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x401170
push ecx
push 0x18
push eax
call fcn.004406c2
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x50], 0xffffffff
cmp eax, esi
je 0x40339a
mov edx, dword [eax - 4]
lea esi, [eax - 4]
push 0x401170
push edx
push 0x18
push eax
call fcn.004406c2
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 8
cmp dword [esp + 0x10], ebx
setl byte [esp + 0x58]
cmp eax, esi
je 0x4033db
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x401170
push ecx
push 0x18
push eax
call fcn.004406c2
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x50], 0xffffffff
cmp eax, esi
je 0x403414
mov edx, dword [eax - 4]
lea esi, [eax - 4]
push 0x401170
push edx
push 0x18
push eax
call fcn.004406c2
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov al, byte [esp + 0x58]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 8
Function at 0x40be50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fread]
push esi
push 1
lea eax, [esp + 0x10]
push 4
push eax
call edi
add esp, 0x10
cmp eax, 1
je 0x40be7d
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [esp + 8], ebx
jle 0x40bed1
push esi
push 2
lea ecx, [esp + 0x18]
push 8
push ecx
call edi
add esp, 0x10
cmp eax, 2
jne 0x40be75
push esi
push 1
lea edx, [esp + 0x14]
push 4
push edx
call edi
add esp, 0x10
cmp eax, 1
jne 0x40be75
fld qword [esp + 0x10]
mov ecx, dword [ebp + 8]
fstp qword [esp + 0x20]
lea eax, [esp + 0x20]
fld qword [esp + 0x18]
push eax
fstp qword [esp + 0x2c]
call fcn.00406ec0
inc ebx
cmp ebx, dword [esp + 8]
jl 0x40be85
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bee0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fread]
mov esi, eax
push esi
push 1
push 4
push ebx
call edi
add esp, 0x10
cmp eax, 1
je 0x40bf0b
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x18
ret
mov eax, dword [esp + 0x2c]
push esi
push 1
push 8
push eax
call edi
add esp, 0x10
cmp eax, 1
jne 0x40bf02
push esi
push eax
lea ecx, [esp + 0x14]
push 8
push ecx
call edi
add esp, 0x10
cmp eax, 1
jne 0x40bf02
xor edi, edi
cmp dword [ebx], edi
jle 0x40bf60
fld qword [0x459468]
fst qword [esp + 0x14]
fstp qword [esp + 0x1c]
push ebp
call fcn.0040be50
add esp, 4
lea edx, [esp + 0x14]
push edx
mov ecx, ebp
call fcn.00406ec0
inc edi
cmp edi, dword [ebx]
jl 0x40bf46
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x18
ret
Function at 0x40c680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fread]
push esi
push 1
lea eax, [esp + 0x10]
push 4
push eax
call edi
add esp, 0x10
cmp eax, 1
je 0x40c6ad
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [esp + 8], ebx
jle 0x40c709
push esi
push 2
lea ecx, [esp + 0x18]
push 8
push ecx
call edi
add esp, 0x10
cmp eax, 2
jne 0x40c6a5
push esi
push 1
lea edx, [esp + 0x14]
push 4
push edx
call edi
add esp, 0x10
cmp eax, 1
jne 0x40c6a5
fld qword [esp + 0x18]
mov eax, dword [esp + 0xc]
fld qword [esp + 0x10]
lea ecx, [esp + 0x20]
fstp qword [esp + 0x20]
push ecx
mov ecx, dword [ebp + 8]
fstp qword [esp + 0x2c]
mov dword [esp + 0x34], eax
call fcn.0040c5f0
inc ebx
cmp ebx, dword [esp + 8]
jl 0x40c6b5
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push esi
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fread]
mov esi, eax
mov eax, dword [ebp + 8]
push esi
push 1
push 4
push eax
call edi
add esp, 0x10
cmp eax, 1
je 0x40c74e
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
push esi
push 1
push 8
push ecx
call edi
add esp, 0x10
cmp eax, 1
jne 0x40c746
push esi
push eax
lea edx, [esp + 0x10]
push 8
push edx
call edi
add esp, 0x10
cmp eax, 1
jne 0x40c746
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [eax], edi
jle 0x40c7c5
fld qword [0x459468]
fst qword [esp + 0x10]
fstp qword [esp + 0x18]
jmp 0x40c790
push ebx
call fcn.0040c680
fld qword [esp + 0x14]
fstp qword [esp + 0x24]
add esp, 4
fld qword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
fstp qword [esp + 0x2c]
mov ecx, ebx
mov dword [esp + 0x34], 0x270f
call fcn.0040c5f0
mov edx, dword [ebp + 8]
inc edi
cmp edi, dword [edx]
jl 0x40c790
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416410
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
test eax, eax
je 0x416488
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, esi
imul ecx, edi
push ecx
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
test eax, eax
jne 0x4164cb
push edi
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push str.ReallocateArray_____Cannot_get__d_elements_of__d_bytes..._n
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
mov byte [0x462284], 1
push str.ReallocateArray_____memory_reallocation_failed__n
push str._nERROR_in__s_n
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 0x10
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push esi
push edi
call dword [sym.imp.MSVCR90.dll_calloc]
add esp, 8
test eax, eax
jne 0x4164cb
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push edi
push str.ReallocateArray_____Cannot_get__d_elements_of__d_bytes..._n
call esi
mov edi, dword [sym.imp.MSVCR90.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
mov byte [0x462284], 1
push 0x459800
jmp 0x416464
pop edi
pop esi
ret

Function at 0x417b20
Capabilities:
Terminate process

Disassembly:
call fcn.00413a20
test al, al
jne 0x417b65
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push 0x459938
push str._nERROR_in__s_n
mov byte [0x462284], 1
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 0x10
push 1
call dword [sym.imp.MSVCR90.dll_exit]
pop esi
call fcn.0041ab30
jmp 0x41b050
sub esp, 8
call fcn.00413a00
test al, al
je 0x41b061
call fcn.00414000
call fcn.004139f0
test al, al
jne 0x41b06f
call fcn.0041b860
cmp byte [esp + 0xc], 0
je 0x41b088
cmp byte [esp + 0x10], 0
je 0x41b095
mov byte [esp + 0xc], 0
mov byte [esp], 1
jmp 0x41b099
cmp byte [esp + 0x10], 0
jne 0x41b095
mov byte [esp], 1
jmp 0x41b099
mov byte [esp], 0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp]
push esi
lea eax, [esp + 8]
push eax
push 0
push ecx
push edx
call fcn.004185f0
xor esi, esi
add esp, 0x10
cmp dword [0x4622d0], esi
jle 0x41b0e8
mov eax, dword [0x4622cc]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41b0e8
push eax
call fcn.0041afa0
inc esi
add esp, 4
cmp esi, dword [0x4622d0]
jge 0x41b0e8
mov ecx, dword [0x4622cc]
mov eax, dword [ecx + esi*4]
cmp eax, 0xffffffff
jne 0x41b0c8
mov byte [0x4622d8], 1
pop esi
add esp, 8
ret
Function at 0x41b860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x70
mov eax, dword [0x462148]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x24], eax
test eax, eax
jle 0x41ba25
mov edi, dword [0x462144]
xor esi, esi
jmp 0x41b890
cmp byte [esi + edi + 0x28], 0
fldz
jne 0x41ba15
mov eax, dword [esi + edi]
mov ebx, dword [esi + edi + 4]
lea ecx, [eax + eax*2]
mov eax, dword [0x462120]
shl ecx, 4
cmp byte [ecx + eax + 0x20], 0
lea edx, [ecx + eax]
jne 0x41ba15
lea ecx, [ebx + ebx*2]
shl ecx, 4
cmp byte [ecx + eax + 0x20], 0
jne 0x41ba15
cmp dword [esi + edi + 8], 2
mov eax, dword [esi + edi + 0xc]
mov ecx, dword [esi + edi + 0x14]
jne 0x41ba15
cmp dword [esi + edi + 0x10], 2
jne 0x41ba15
shl eax, 5
add eax, dword [0x46216c]
shl ecx, 5
fld qword [eax]
add ecx, dword [0x46216c]
fst qword [esp + 0x50]
fld qword [eax + 8]
fst qword [esp + 0x58]
fld qword [ecx]
fst qword [esp + 0x40]
fld qword [ecx + 8]
fst qword [esp + 0x48]
fld qword [edx]
fld qword [edx + 8]
fxch st(5)
fsub st(3)
fst qword [esp + 0x28]
fld st(2)
fsubrp st(5)
fxch st(4)
fst qword [esp + 0x30]
fxch st(3)
fsubrp st(1)
fmulp st(2)
fsubrp st(3)
fxch st(2)
fmulp st(1)
faddp st(1)
fcom st(1)
fnstsw ax
test ah, 0x41
je 0x41ba13
fcompp
fnstsw ax
test ah, 5
jp 0x41ba17
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x74]
push eax
push ebx
call fcn.00418150
fld qword [esp + 0x4c]
fsub qword [esp + 0x7c]
lea ecx, [esp + 0x3c]
push ecx
fmul qword [esp + 0x40]
fld qword [esp + 0x58]
fsub qword [esp + 0x88]
fmul qword [esp + 0x38]
faddp st(1)
fstp qword [esp + 0x40]
call fcn.0041b830
add esp, 0x10
cmp eax, 1
jne 0x41ba17
fld qword [esp + 0x40]
fadd qword [esp + 0x50]
fld qword [0x4593d0]
fmul st(1), st(0)
fxch st(1)
fstp qword [esp + 0x60]
fld qword [esp + 0x48]
fld st(0)
fld qword [esp + 0x58]
fadd st(1), st(0)
fxch st(1)
fmulp st(3)
fxch st(2)
fstp qword [esp + 0x68]
fld qword [esp + 0x28]
fxch st(2)
fsubrp st(1)
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
call sub.MSVCR90.dll__CIsqrt
fmul qword [0x4593d0]
sub esp, 0x18
fstp qword [esp + 0x10]
fld qword [esp + 0x80]
fstp qword [esp + 8]
fld qword [esp + 0x78]
fstp qword [esp]
call fcn.00413b20
push 0
push eax
push ebp
call fcn.00413e10
mov edi, dword [0x462144]
add esp, 0x24
jmp 0x41ba17
fstp st(0)
fstp st(0)
inc ebp
add esi, 0x34
cmp ebp, dword [esp + 0x24]
jl 0x41b890
call fcn.004139e0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret