joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fa20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0x9c
mov dword [esi + 0x7fc], 5
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fa6b
mov ecx, dword [esp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00405780
jmp 0x44fa6d
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x778], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x778]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x778]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x778]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x44fb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push pe_nt_image_headers32
mov dword [esi + 0x7fc], 6
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fb76
push eax
mov ecx, esi
call fcn.00433a70
jmp 0x44fb78
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x77c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x77c]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x77c]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x77c]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x44fc30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0x320
mov dword [esi + 0x7fc], 7
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fc7a
mov ecx, dword [esp + 0x14]
push ecx
push esi
push eax
call fcn.0042dae0
jmp 0x44fc7c
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x780], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x780]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x780]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x780]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x44fdc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64997b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0x1f40
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44fdfd
push eax
call fcn.00483380
jmp 0x44fdff
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
jmp 0x7a6c80

Function at 0x459010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e2b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
lea edi, [esp + 0xc]
mov ebx, ecx
call fcn.00519520
mov dword [esp + 0x30], 0
cmp dword [esi + 0x290], 0xffffffff
je 0x4590a8
cmp dword [esi + 0x88], 0
jle 0x4590a8
mov edi, dword [esp + 0x24]
cmp edi, 0x10
mov dword [esi + 0x318], ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
jae 0x459068
lea ecx, [esp + 0x10]
lea edx, [esi + 0x298]
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x459070
mov eax, dword [esi + 0x294]
mov ecx, dword [esi + 0x88]
add eax, 0x65
cmp ecx, eax
jge 0x459093
mov eax, ecx
cmp edi, 0x10
mov dword [esi + 0x88], eax
jb 0x4591c8
push ebx
jmp 0x4591c0
mov edi, esi
call fcn.00458fc0
mov ecx, dword [esp + 0x10]
mov edi, 0x10
cmp dword [esp + 0x24], edi
jae 0x4590c2
lea ecx, [esp + 0x10]
lea edx, [esi + 4]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4590c5
cmp ebx, 6
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x290], 0xffffffff
je 0x459190
cmp ebx, 0xc
je 0x459190
cmp ebx, 0x11
je 0x459190
cmp ebx, 0xb
je 0x459190
cmp ebx, 0xa
jne 0x45911b
mov dword [esi + 0x88], 0x1f4
jmp 0x45919a
cmp ebx, 7
je 0x45910c
cmp ebx, 9
je 0x45910c
cmp ebx, 0xd
je 0x45910c
cmp ebx, 1
je 0x45910c
cmp ebx, 3
je 0x45910c
cmp ebx, 4
je 0x45910c
cmp ebx, 8
je 0x459184
cmp ebx, 2
je 0x459184
cmp ebx, 5
je 0x459184
cmp ebx, 0xe
jne 0x459159
mov dword [esi + 0x88], 0xfa
jmp 0x45919a
cmp ebx, 0xf
jne 0x459174
mov dword [esi + 0x88], 0x2ee
mov dword [esi + 0x290], 0x62
jmp 0x45919a
cmp ebx, edi
jne 0x45919a
mov dword [esi + 0x88], 0x2ee
jmp 0x45919a
mov dword [esi + 0x88], 0x2710
jmp 0x45919a
mov dword [esi + 0x88], 0x5dc
cmp dword [esi + 0x290], 0xffffffff
je 0x4591a9
push esi
call fcn.004591e0
cmp dword [esp + 0x24], edi
mov eax, dword [esi + 0x88]
mov dword [esi + 0x84], eax
jb 0x4591c8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret
Function at 0x460060
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x3c], 0x22
je 0x460197
mov eax, dword [edi + 0x1c]
push eax
push edi
xor ecx, ecx
call fcn.004675c0
mov esi, eax
test esi, esi
je 0x460316
mov eax, dword [edi]
cmp byte [eax + 0x8c5], 0
jne 0x4600e3
fldz
mov ecx, dword [0x6a9f00]
mov ebx, dword [eax + 0x784]
fst dword [esp + 0x14]
fcomp dword [ecx + 0xdd4]
fnstsw ax
test ah, 0x44
jnp 0x4600cf
fld dword [ecx + 0xdd4]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x18]
add esp, 4
fld dword [esp + 0x14]
push ecx
mov eax, 0x44
fstp dword [esp]
mov ecx, ebx
call fcn.00515020
push 0
mov eax, esi
mov dword [edi + 0x3c], 0x22
jmp fcn.00798862
cmp dword [edi + 0x54], 0x32
jne 0x4601eb
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0x12c]
add ecx, 0x90
test edx, edx
je 0x4601eb
movzx eax, dx
cmp eax, dword [ecx + 8]
jae 0x4601eb
imul eax, eax, 0x508
add eax, dword [ecx]
mov esi, eax
cmp dword [esi + 0x504], edx
jne 0x4601eb
mov edi, esi
mov dword [esi + 0x64], 3
call fcn.0052f440
mov eax, esi
call fcn.00524310
push 0
mov eax, esi
call fcn.0052f6d0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x54], 0x14
jne 0x4602cf
mov esi, dword [edi + 0x1c]
mov edx, dword [edi + 0xc]
imul esi, esi, 0x2710
mov eax, dword [edi + 8]
add edx, 7
mov dword [esp + 0x14], edx
add esi, 0x4af38
push esi
fild dword [esp + 0x18]
sub eax, 0x17
sub esp, 8
mov dword [esp + 0x20], eax
mov eax, dword [edi]
fstp dword [esp + 4]
mov ebx, 0x20
fild dword [esp + 0x20]
fstp dword [esp]
call fcn.00453c30
fld dword [0x6799d8]
push 0x16
fst dword [eax + 0x24]
push esi
fstp dword [eax + 0x34]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
mov eax, dword [edi]
add ecx, 0x40
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
mov ecx, dword [eax + 0x820]
mov esi, dword [ecx]
sub esp, 8
add edx, 0x1f
fstp dword [esp + 4]
mov dword [esp + 0x24], edx
fild dword [esp + 0x24]
fstp dword [esp]
call fcn.00518a70
mov eax, dword [edi]
cmp byte [eax + 0x8c5], 0
jne 0x4602cf
fldz
mov ecx, dword [0x6a9f00]
mov esi, dword [eax + 0x784]
fst dword [esp + 0x14]
fcomp dword [ecx + 0xac8]
fnstsw ax
test ah, 0x44
jnp 0x4602bb
fld dword [ecx + 0xac8]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x18]
add esp, 4
fld dword [esp + 0x14]
push ecx
mov eax, 0x35
fstp dword [esp]
mov ecx, esi
call fcn.00515020
cmp dword [edi + 0x54], 0
jne 0x460316
push edi
call fcn.004679b0
mov ecx, dword [edi + 0x12c]
mov edi, dword [edi + 4]
add edi, 0x90
test ecx, ecx
je 0x460316
movzx eax, cx
cmp eax, dword [edi + 8]
jae 0x460316
imul eax, eax, 0x508
add eax, dword [edi]
mov esi, eax
cmp dword [esi + 0x504], ecx
jne 0x460316
mov ecx, esi
call fcn.00530510
mov eax, esi
call fcn.00530170
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x463150
Capabilities:
Check http status code

Disassembly:
push ecx
push esi
push edi
mov edi, eax
jmp fcn.007b2c38

Function at 0x4664b0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push ebx
push esi
push 0
mov eax, edi
call fcn.0045eb10
mov edx, dword [edi + 4]
lea esi, [esp + 0xc]
mov ebx, eax
mov dword [esp + 0xc], 0
call fcn.0041c8f0
test al, al
je 0x46653d
jmp 0x4664e0
mov esi, dword [esp + 0xc]
jmp loc.007ae74b
mov edx, dword [edi + 4]
lea esi, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.0041cad0
test al, al
je 0x466587
mov ebx, 3
lea ebx, [ebx]
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x14]
cmp eax, dword [esp + 0x14]
jne 0x466577
cmp dword [esi + 8], ebx
jne 0x466577
call fcn.0044d000
mov edx, dword [edi + 4]
lea esi, [esp + 0xc]
call fcn.0041cad0
test al, al
jne 0x466560
mov edx, dword [edi + 4]
call fcn.0041d390
test eax, eax
je 0x4665a4
mov ecx, dword [esp + 0x14]
cmp ecx, dword [eax + 0x148]
jne 0x4665a4
call fcn.00535630
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x46ebc0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x46ec88
cmp eax, 1
je 0x46ec88
cmp eax, 0xd
je 0x46ec88
cmp eax, 0xb
jne 0x46ec13
mov eax, dword [esi + 0x10]
cdq
sub eax, edx
mov edx, dword [esi + 8]
sar eax, 1
lea eax, [eax + edx - 0x73]
mov dword [ecx], eax
mov eax, dword [esi + 0x14]
cdq
sub eax, edx
mov edx, dword [esi + 0xc]
sar eax, 1
lea eax, [eax + edx - 0x73]
mov dword [ecx + 4], eax
mov eax, 0xe6
mov dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
mov eax, ecx
ret
cmp eax, 3
je 0x46ec6a
cmp eax, 5
je 0x46ec6a
cmp eax, 6
mov edx, dword [esi + 8]
jmp fcn.0079d819
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
add edx, 0x14
mov dword [ecx], edx
mov edx, dword [esi + 0x14]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0x3c
mov dword [ecx + 0xc], edx
mov eax, ecx
ret
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
sub eax, 0xf
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
add eax, 0xf
mov dword [ecx + 4], edx
mov edx, dword [esi + 0x14]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov eax, ecx
ret
Function at 0x487250
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push edi
mov edi, eax
mov eax, dword [edi]
cmp dword [eax + 0x7fc], 3
jne 0x487375
cmp dword [edi + 0x34], 0xffffffff
je 0x487375
mov ecx, dword [edi + 4]
cmp dword [ecx + 0x5568], 0
jne 0x487280
call fcn.00487190
cmp byte [edi + 0x48], 0
jne 0x4872ac
cmp byte [edi + 0x49], 0
je 0x4872ac
jmp 0x7c34b5
mov eax, dword [edi + 0x3c]
test eax, eax
jle 0x487375
lea ecx, [eax - 1]
lea edx, [ecx - 0x190]
mov dword [esp + 8], edx
fild dword [esp + 8]
mov dword [edi + 0x3c], ecx
fdiv qword [0x679730]
fstp dword [esp + 8]
fldz
fld dword [esp + 8]
fcom st(1)
fnstsw ax
fld1
test ah, 0x41
jp 0x4872f0
fstp st(1)
fld dword [0x679320]
jmp 0x487311
fcom st(1)
fnstsw ax
test ah, 0x41
jp 0x487303
fstp st(1)
fld dword [0x6793e0]
jmp 0x487311
fxch st(1)
fmul qword [0x679a40]
fadd qword [0x6793b8]
fstp dword [esp + 8]
fld dword [esp + 8]
fmul qword [0x679530]
fadd dword [edi + 0x44]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [edi + 0x44]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 1
jne 0x487366
test ecx, ecx
mov eax, dword [edi + 0x40]
mov dword [edi + 0x34], eax
jne 0x487350
fstp st(0)
mov byte [edi + 0x48], 1
fstp dword [edi + 0x44]
pop edi
add esp, 8
ret
fstp st(1)
push edi
fsub qword [0x65b8f8]
fstp dword [edi + 0x44]
call fcn.00487070
pop edi
add esp, 8
ret
test ecx, ecx
fstp st(0)
fstp st(0)
jne 0x487375
mov dword [edi + 0x3c], 1
pop edi
add esp, 8
ret
Function at 0x489630
Capabilities:
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x64ede0
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
push edi
mov edi, dword [esp + 0x78]
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x15c]
test eax, eax
je 0x48967b
mov ecx, dword [eax]
cmp dword [ecx + 0x7fc], 2
jne 0x48967b
cmp byte [eax + 0x34], 0
sete al
test al, al
jne 0x489956
mov edx, dword [edi]
cmp dword [edx + 0x7fc], 3
je 0x48969e
mov eax, dword [edi + 4]
fld dword [ebp + 8]
fisub dword [eax + 0x30]
fstp dword [ebp + 8]
mov ecx, dword [edi + 4]
fld dword [ebp + 0xc]
fisub dword [ecx + 0x34]
fstp dword [ebp + 0xc]
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x4896c8
cmp dword [eax + 0x7f8], 0x12
jne 0x4896c8
mov ebx, dword [0x6a77f4]
push 0
push 0
mov eax, ebp
call fcn.00587150
jmp 0x489781
mov esi, dword [edi + 4]
mov eax, esi
call fcn.0041be50
test al, al
je 0x48972d
mov ebx, dword [0x6a7668]
push 0
push 0x53
mov eax, ebp
call fcn.00587150
mov eax, dword [edi + 0x34c]
cdq
and edx, 3
add eax, edx
sar eax, 2
cdq
mov ecx, 6
idiv ecx
mov ecx, dword [0x6a73c8]
push 0
push 0x3f
push 0x5a
push ebp
mov edi, edx
call fcn.00587e80
push 0x258
push 0x1f5
push 0
push 0x5a
mov esi, ebp
call fcn.00587790
mov edi, dword [esp + 0x78]
jmp 0x489781
mov eax, esi
call fcn.0041c290
mov ebx, dword [0x6a7950]
mov edx, dword [ebx + 0x24]
mov ecx, dword [ebx + 0x28]
sub edx, eax
add eax, 0xc
push 0
sub edx, 0xc
mov dword [esp + 0x1c], eax
push 0
mov eax, ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], ecx
call fcn.00587150
mov eax, dword [0x6a7950]
mov ecx, dword [eax + 0x24]
push 0
sub ecx, 0xc
push ecx
push eax
lea eax, [esp + 0x1c]
mov ecx, ebp
call fcn.00587270
xor ebx, ebx
cmp dword [edi + 0x24], ebx
jle 0x4897d3
lea esi, [edi + 0x30]
jmp 0x489790
cmp dword [esi + 0x2c], 0xffffffff
je 0x4897c8
cmp byte [esi + 0x10], 0
je 0x4897c8
fild dword [esi]
push ebp
lea edx, [esi - 8]
push edx
fadd dword [ebp + 8]
fstp dword [ebp + 8]
fild dword [esi + 4]
fadd dword [ebp + 0xc]
fstp dword [ebp + 0xc]
call fcn.00488220
fld dword [ebp + 8]
fisub dword [esi]
fstp dword [ebp + 8]
fld dword [ebp + 0xc]
fisub dword [esi + 4]
fstp dword [ebp + 0xc]
add ebx, 1
add esi, 0x50
cmp ebx, dword [edi + 0x24]
jl 0x489790
mov ecx, ebp
call fcn.00587760
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x489813
cmp dword [eax + 0x7f8], 0x12
jne 0x489813
mov eax, dword [0x6a7950]
call fcn.00588a20
neg eax
cmp dword [edi + 0xc], eax
jle 0x489813
mov ebx, dword [0x6a7880]
push 0xfffffffffffffffe
push 0xbd
mov eax, ebp
call fcn.00587150
mov esi, dword [edi + 4]
mov eax, esi
call fcn.0041be50
test al, al
jne 0x489933
jmp 0x7c33f0
mov eax, dword [edi]
cmp dword [eax + 0x7fc], 3
je 0x489956
mov ecx, dword [edi + 4]
fild dword [ecx + 0x30]
fadd dword [ebp + 8]
fstp dword [ebp + 8]
mov edx, dword [edi + 4]
fild dword [edx + 0x34]
fadd dword [ebp + 0xc]
fstp dword [ebp + 0xc]
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret 8
Function at 0x48bad0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebx, eax
cmp dword [ebx + 0x164], 0x78
push esi
push edi
mov dword [ebx + 0x198], 0xffffffff
jl 0x48bd9d
cmp byte [ebx + 0x188], 0
jne 0x48bd9d
cmp dword [ebx + 0x19c], 0
jg 0x48bd9d
cmp byte [ebx + 0x1b1], 0
jne 0x48bd9d
mov eax, dword [ebx + 0x150]
mov eax, dword [eax + 0x320]
mov edi, dword [eax + 0xe0]
mov eax, dword [eax + 0xe4]
sub eax, dword [ebx + 0x34]
sub edi, dword [ebx + 0x30]
xor ebp, ebp
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], eax
lea esi, [ebp + 0x4c]
mov eax, ebp
mov edx, ebx
call fcn.0048a760
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x48bb93
mov ecx, ebx
call fcn.0048aad0
test al, al
jne 0x48bb93
cmp ebp, 3
jg 0x48bb72
lea eax, [esi + 0x15a]
mov ecx, 0xce
jmp 0x48bb79
mov eax, esi
mov ecx, 0x136
cmp edi, eax
jl 0x48bb93
add eax, 0x32
cmp edi, eax
jge 0x48bb93
mov eax, dword [esp + 0x14]
cmp eax, ecx
jl 0x48bb93
add ecx, 0x57
cmp eax, ecx
jl 0x48bba6
add esi, 0x4a
add ebp, 1
cmp esi, 0x29c
jl 0x48bb43
jmp 0x48bd47
mov edi, dword [esp + 0x18]
or eax, 0xffffffff
jmp 0x7a45e9
mov edx, dword [ebx + 0x154]
cmp byte [edx + 0x59], 0
jne 0x48bd72
mov eax, dword [ebx + 0x158]
cmp byte [eax + 0x59], 0
jne 0x48bd72
mov ecx, dword [ebx + 0x15c]
cmp byte [ecx + 0x59], 0
jne 0x48bd72
cmp byte [esp + 0x13], 0
je 0x48bd89
mov eax, 1
mov ecx, dword [ebx + 0x150]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp fcn.005548c0
xor eax, eax
mov ecx, dword [ebx + 0x150]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp fcn.005548c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x51c470
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x642183
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, 0xf
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x14], eax
mov byte [ebx + 4], al
mov dword [esp + 0xc], eax
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x30], eax
mov byte [ebx + 0x20], al
mov byte [esp + 0xc], 1
call fcn.0051c4d0
mov ecx, dword [esp + 4]
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4

Function at 0x51d110
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64e468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push eax
lea edi, [esp + 0x24]
call fcn.005869b0
jmp loc.007c06ea
Function at 0x522580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x6c], eax
mov eax, 0x28
mov dword [edi + 0x1c], esi
call fcn.005af400
jmp loc.007963e0

Function at 0x524c70
Capabilities:
Packed with generic packer

Disassembly:
fld dword [0x679638]
sub esp, 0x18
push ebx
push esi
push edi
push ecx
fstp dword [esp]
push 0x14
push 3
mov edi, eax
push str.anim_grab
call fcn.00528b00
mov esi, dword [edi + 0x80]
cmp esi, 8
mov ebx, dword [edi + 0x1c]
mov edx, dword [edi + 4]
ja 0x524d5d
cmp ebx, 5
ja 0x524d5d
mov ecx, dword [edx + 0x8c]
call fcn.00453840
test al, al
je 0x524cd0
mov eax, dword [edx + 0x15c]
call fcn.0043c1e0
test al, al
je 0x524d5d
jmp 0x7a646d
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x524ef0
Capabilities:
Packed with generic packer

Disassembly:
fldz
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
cmp dword [ebp + 0x28], 4
push esi
push edi
jne 0x524f9e
fld dword [0x67a2c8]
fcomp dword [ebp + 0x84]
fnstsw ax
test ah, 0x41
jne 0x524f9e
mov eax, dword [ebp]
cmp dword [eax + 0x768], 0
je 0x524f45
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x23
je 0x524f9e
test ecx, ecx
jne 0x524f45
mov ecx, dword [eax + 0x82c]
cmp dword [ecx + 0x24], 0x32
je 0x524f9e
cmp byte [eax + 0x8c5], 0
jne 0x524f97
mov ecx, dword [0x6a9f00]
fst dword [esp + 0x24]
fcomp dword [ecx + 0x8f4]
mov esi, dword [eax + 0x784]
fnstsw ax
test ah, 0x44
jnp 0x524f81
fld dword [ecx + 0x8f4]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x28]
add esp, 4
fld dword [esp + 0x24]
push ecx
mov eax, 0x2c
fstp dword [esp]
mov ecx, esi
call fcn.00515020
fldz
mov dword [ebp + 0x28], 5
fld dword [0x67959c]
fcomp dword [ebp + 0x84]
fnstsw ax
test ah, 5
jnp 0x525165
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x80]
mov edx, dword [ebp + 4]
call fcn.0041d3d0
mov edi, eax
test edi, edi
je 0x52505f
mov ecx, dword [ebp]
fstp st(0)
mov edx, dword [ecx]
mov eax, dword [0x6a7274]
mov edx, dword [edx + 0xd8]
push eax
call edx
mov eax, dword [ebp]
cmp byte [eax + 0x8c5], 0
jne 0x52503a
fldz
mov ecx, dword [0x6a9f00]
mov esi, dword [eax + 0x784]
fst dword [esp + 0x24]
fcomp dword [ecx + 0xed8]
fnstsw ax
test ah, 0x44
jnp 0x525026
fld dword [ecx + 0xed8]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x28]
add esp, 4
fld dword [esp + 0x24]
push ecx
mov eax, 0x49
fstp dword [esp]
mov ecx, esi
call fcn.00515020
push edi
call fcn.004666a0
mov dword [ebp + 0x28], 8
mov dword [ebp + 0x20], 0x61a81
mov byte [ebp + 0x88], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov esi, dword [ebp + 0x80]
cmp esi, 8
mov edi, dword [ebp + 0x1c]
mov edx, dword [ebp + 4]
ja 0x52509e
cmp edi, 5
ja 0x52509e
mov ecx, dword [edx + 0x8c]
call fcn.00453840
test al, al
je 0x525093
mov eax, dword [edx + 0x15c]
call fcn.0043c1e0
test al, al
je 0x52509e
push edi
push esi
lea ebx, [esp + 0x18]
call fcn.0040d2a0
fcom dword [ebp + 0x84]
fnstsw ax
test ah, 5
jnp 0x525165
mov edx, dword [ebp + 4]
fstp dword [ebp + 0x84]
mov ecx, dword [ebp + 0xf0]
jmp 0x7a67b1
pop edi
fstp st(0)
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x525180
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
cmp byte [edi + 0xec], 0
push esi
jne 0x525348
mov eax, dword [edi + 0x28]
cmp eax, 1
je 0x525348
cmp eax, 2
je 0x525348
cmp eax, 3
je 0x525348
cmp dword [edi + 0xb4], 0
jg 0x525348
cmp dword [edi + 0xb0], 0
jg 0x525348
cmp eax, 4
je 0x5252d3
cmp eax, 5
je 0x5252d3
cmp eax, 6
jne 0x5251fd
cmp dword [edi + 0x68], 0
jg 0x525332
mov eax, edi
call fcn.00524c70
mov dword [edi + 0x28], 7
jmp 0x525332
cmp eax, 7
jne 0x52523e
mov eax, dword [edi]
mov ecx, dword [eax + 0x820]
mov eax, dword [edi + 0x118]
mov edx, dword [ecx + 8]
mov ecx, dword [edx]
and eax, 0xffff
lea eax, [eax + eax*4]
shl eax, 5
cmp dword [ecx + eax + 0x5c], 0
jle 0x525332
mov eax, edi
call fcn.00524d70
jmp 0x7a1aa3
cmp eax, 9
jne 0x525259
cmp dword [edi + 0x68], 0
jg 0x525332
mov ecx, edi
call fcn.005302f0
jmp 0x525332
cmp eax, 8
jne 0x525295
fld dword [edi + 0x84]
fadd qword [0x679290]
fstp dword [esp + 4]
fld dword [esp + 4]
fst dword [edi + 0x84]
fcomp dword [0x679fe4]
fnstsw ax
test ah, 1
jne 0x525332
mov ecx, edi
call fcn.00530510
jmp 0x525332
cmp eax, 0xa
jne 0x525332
mov esi, dword [edi + 0x68]
push 0xc
push 0
push 0x28
mov eax, esi
xor ecx, ecx
mov edx, 0xc8
call fcn.00511c40
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
add esp, 0xc
test esi, esi
fstp dword [edi + 0x84]
jg 0x525332
mov dword [edi + 0x68], 0xc8
jmp 0x525332
fld dword [edi + 0x84]
fstp dword [esp + 8]
fld dword [edi + 0x84]
fsub qword [0x679290]
fstp dword [esp + 4]
fld dword [esp + 4]
fst dword [edi + 0x84]
fld dword [0x67a2dc]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 1
jne 0x52532a
fcomp dword [esp + 8]
fnstsw ax
test ah, 5
jp 0x52532c
cmp dword [edi + 0xf0], 0
jne 0x52532c
mov eax, dword [edi]
mov esi, 0x4a
call fcn.00453630
jmp 0x52532c
fstp st(0)
push edi
call fcn.00524ef0
fld dword [edi + 0x2c]
call fcn.006397d0
fld dword [edi + 0x30]
mov dword [edi + 8], eax
call fcn.006397d0
mov dword [edi + 0xc], eax
pop esi
add esp, 8
ret