joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5af6d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x778b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x18], ecx
mov dword [esi], 0x7a2508
mov dword [esi + 0xf0], 3
mov dword [esi + 0x20], edx
mov edi, dword [eax]
mov dword [esi + 0x24], edi
mov edi, dword [eax + 4]
mov dword [esi + 0x28], edi
mov edi, dword [eax + 8]
mov dword [esi + 0x2c], edi
mov eax, dword [eax + 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x34], eax
xor ebx, ebx
mov eax, 1
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x44], 2
mov dword [esi + 0x48], ebx
mov dword [esi + 0x58], ebx
mov eax, dword [eax + 0x10]
mov dword [esi + 0xec], eax
lea eax, [esi + 0xa8]
push eax
lea eax, [esi + 0x84]
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov edx, dword [edx + 0x18]
push eax
push edx
push ecx
mov dword [esp + 0x28], ebx
call fcn.005ac4b0
add esp, 0x10
mov ecx, esi
call fcn.005943f0
mov eax, dword [esi + 0x1c]
fld dword [eax + 0x10]
mov edx, dword [0x7a18c0]
fmul dword [esi + 0x88]
mov eax, edx
push str.Drvtrn
fstp dword [esi + 0x88]
mov ecx, dword [0x7fc294]
fld dword [0x7a18bc]
mov dword [esi + 0xcc], ecx
fstp dword [esi + 0xd0]
mov dword [esi + 0xd4], edx
fld dword [0x7a18c4]
lea ecx, [esi + 0xc]
fstp dword [esi + 0xd8]
mov dword [esi + 0xdc], eax
fld dword [0x7a18c4]
mov eax, 0x3f800000
fstp dword [esi + 0xe0]
push ecx
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe8], eax
mov byte [esi + 0x74], bl
call fcn.0043dc40
add esp, 8
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x5b7840
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
push edi
xor eax, eax
mov dword [esp + 0x10], 0
mov ecx, 0x49
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
mov ebx, 3
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x5b7931
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x5b78fe
lea ecx, [esp + 0x34]
push 0x5c
push ecx
call fcn.0075d380
add esp, 8
test eax, eax
je 0x5b78c0
inc eax
lea edx, [esp + 0x138]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5b78b4
jmp 0x5b78d2
xor eax, eax
mov cl, byte [esp + eax + 0x34]
mov byte [esp + eax + 0x138], cl
inc eax
test cl, cl
jne 0x5b78c2
mov eax, dword [esp + 0x240]
lea edx, [esp + 0x138]
push edx
push eax
call fcn.0075da8f
add esp, 8
test eax, eax
jne 0x5b78ef
inc edi
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x5b7897
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x244]
dec ebx
cmp edi, eax
jle 0x5b793e
test ebx, ebx
jl 0x5b793e
push 0x3e8
call ebp
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x5b7880
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x22c
ret
xor edx, edx
cmp edi, eax
pop edi
pop esi
setg dl
pop ebp
mov al, dl
pop ebx
add esp, 0x22c
ret

Function at 0x5b7960
Capabilities:
Create process on windows

Disassembly:
push ecx
call fcn.005706c0
cmp eax, 0xc
ja case.0x5b796b.1
jmp dword [eax*4 + 0x5b7a00]
mov eax, str.http:__patches.ea.com_nfs_underground2_EN_US_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_KO_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_JP_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_TW_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_TH_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_ZH_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_FR_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_DE_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_IT_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_ES_home.html
jmp 0x5b79e9
call fcn.004ff5c0
cmp eax, 7
ja case.0x5b796b.1
jmp dword [eax*4 + 0x5b7a34]
mov eax, str.http:__patches.ea.com_nfs_underground2_EN_UK_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_NL_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_SV_home.html
jmp 0x5b79e9
mov eax, str.http:__patches.ea.com_nfs_underground2_DA_home.html
jmp 0x5b79e9
mov eax, dword [esp]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ecx
ret
Function at 0x5bdec0
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
mov eax, dword [0x8ad670]
push eax
je 0x5bded5
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret
Function at 0x5bef30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov cl, byte [esp + 0x3c]
mov byte [esp], 0x20
mov byte [esp + 1], 0x2e
mov byte [esp + 2], 0x2c
mov byte [esp + 3], 0x5f
mov byte [esp + 4], 0x40
mov byte [esp + 5], 0x2d
mov byte [esp + 6], 0x60
mov byte [esp + 7], 0x3d
mov byte [esp + 8], 0x5b
mov byte [esp + 9], 0x5d
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0x3b
mov byte [esp + 0xc], 0x27
mov byte [esp + 0xd], 0x2f
mov byte [esp + 0xe], 0x3c
mov byte [esp + 0xf], 0x3e
mov byte [esp + 0x10], 0x3f
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x22
mov byte [esp + 0x13], 0x7b
mov byte [esp + 0x14], 0x7d
mov byte [esp + 0x15], 0x7c
mov byte [esp + 0x16], 0x2b
mov byte [esp + 0x17], 0x28
mov byte [esp + 0x18], 0x29
mov byte [esp + 0x19], 0x2a
mov byte [esp + 0x1a], 0x26
mov byte [esp + 0x1b], 0x25
mov byte [esp + 0x1c], 0x23
mov byte [esp + 0x1d], 0x21
mov byte [esp + 0x1e], 0x7e
mov byte [esp + 0x1f], 0xe5
mov byte [esp + 0x20], 0xe4
mov byte [esp + 0x21], 0xe0
mov byte [esp + 0x22], 0xe2
mov byte [esp + 0x23], 0xeb
mov byte [esp + 0x24], 0xe8
mov byte [esp + 0x25], 0xe9
mov byte [esp + 0x26], 0xea
mov byte [esp + 0x27], 0xef
mov byte [esp + 0x28], 0xee
mov byte [esp + 0x29], 0xf6
mov byte [esp + 0x2a], 0xf4
mov byte [esp + 0x2b], 0xfc
mov byte [esp + 0x2c], 0xf9
mov byte [esp + 0x2d], 0xfb
mov byte [esp + 0x2e], 0xe7
mov byte [esp + 0x2f], 0x9c
mov byte [esp + 0x30], 0xf2
mov byte [esp + 0x31], 0xec
mov byte [esp + 0x32], 0xc5
mov byte [esp + 0x33], 0xc4
mov byte [esp + 0x34], 0xd6
mov byte [esp + 0x35], 0xdc
mov byte [esp + 0x36], 0xa7
xor eax, eax
lea esp, [esp]
cmp byte [esp + eax], cl
je 0x5bf062
inc eax
cmp eax, 0x37
jl 0x5bf050
xor al, al
add esp, 0x38
ret
mov al, 1
add esp, 0x38
ret

Function at 0x5bf120
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov bl, 0x41
mov edi, 1
mov byte [esp + 0x10], bl
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebp, ebp
push 0x400
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebp
call fcn.005752a0
mov esi, eax
add esp, 4
cmp esi, ebp
mov byte [0x80057f], 0
je 0x5bf201
test dword [esp + 0x14], edi
je 0x5bf1a4
movsx eax, bl
push eax
push str._c:_
push esi
call fcn.0075c4a4
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x5bf18e
mov ecx, dword [0x79dc60]
test ecx, ecx
je 0x5bf1a4
cmp eax, 2
je 0x5bf1a4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005bf0a0
add esp, 4
test al, al
jne 0x5bf1b8
inc bl
shl edi, 1
inc ebp
cmp ebp, 0x20
mov byte [esp + 0x10], bl
jl 0x5bf160
mov edi, dword [esp + 0x18]
jmp 0x5bf1bd
mov edi, 1
push esi
call fcn.005752c0
add esp, 4
test edi, edi
je 0x5bf1fa
mov byte [0x80057f], bl
mov byte [0x86e8b0], bl
mov byte [0x86e8b1], 0x3a
mov byte [0x86e8b2], 0x5c
mov byte [0x86e8b3], 0
call fcn.005b7730
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret
mov byte [0x80057f], 0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x5bf8d0
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x100
push esi
lea eax, [esp + 0x10c]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [esp + 4]
push eax
call esi
push 0x7a38dc
call esi
pop esi
add esp, 0x100
ret
Function at 0x5d1970
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
push edi
call fcn.005bdee0
mov esi, 0x86eb28
nop
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x11c]
add esi, 4
cmp esi, 0x86eb84
jl 0x5d1980
call fcn.005ba3b0
call fcn.005bba00
mov al, byte [0x86b7c4]
test al, al
je 0x5d19c2
mov eax, dword [0x86b7a4]
test eax, eax
je 0x5d19c2
mov edx, dword [eax]
push eax
call dword [edx + 0x30]
mov byte [0x86b7c4], 0
mov ecx, 0x86b7a4
call fcn.005c54b0
mov eax, dword [0x86b7a4]
test eax, eax
je 0x5d19db
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [0x870974]
mov edx, dword [eax]
push 0x86f870
push eax
call dword [edx + 0x40]
mov eax, dword [0x870974]
mov ecx, dword [eax]
push 0x86f870
push eax
call dword [ecx + 0x40]
mov esi, eax
test esi, esi
je 0x5d1ae5
mov eax, dword [0x870d08]
test eax, eax
jle 0x5d1a18
mov dword [0x870d08], 0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, 0x8718b0
call fcn.005bf2e0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.005b9780
add esp, 8
xor edi, edi
mov eax, dword [0x870974]
mov ecx, dword [eax]
push 0x86f870
push eax
call dword [ecx + 0x40]
mov esi, eax
test esi, esi
je 0x5d1ac8
inc edi
cmp edi, 3
jl 0x5d1a40
mov eax, dword [0x870d1c]
test eax, eax
je 0x5d1b50
lea esp, [esp]
mov eax, dword [0x870d1c]
dec eax
lea edx, [esp + 8]
mov dword [0x870d1c], eax
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, 0x8718b0
call fcn.005bf2e0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.005b9780
mov eax, dword [0x870974]
mov ecx, dword [eax]
add esp, 8
push 0x86f870
push eax
call dword [ecx + 0x40]
mov esi, eax
test esi, esi
je 0x5d1ac8
mov eax, dword [0x870d1c]
test eax, eax
jne 0x5d1a70
pop edi
mov eax, esi
pop esi
add esp, 8
ret
push str.UI_Options.fng
push 0xaf0bbd92
call fcn.0055da10
add esp, 8
test esi, esi
je 0x5d1ae5
push 0
call fcn.0075d2b3
call fcn.005b9da0
call fcn.005ba250
call fcn.005b9f90
call fcn.005b9630
call fcn.005bb570
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
mov ecx, 0x86b7a4
mov dword [esp + 0x14], 0x3e8
mov dword [esp + 0x10], 0
call fcn.005baf50
call fcn.005c2100
mov edi, 0x86eb28
lea esp, [esp]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x20]
mov edx, dword [eax]
push eax
call dword [edx + 0x120]
mov ecx, dword [edi]
call fcn.005d1900
add edi, 4
cmp edi, 0x86eb84
jl 0x5d1b30
pop edi
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x5d3300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x94
push ebx
push esi
mov esi, ecx
push edi
movsx edi, byte [esi + 9]
test edi, edi
jle 0x5d3350
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x18]
lea eax, [esi + 0x38]
fld dword [eax - 8]
add eax, 0x10
fsub dword [edx]
fld dword [eax - 0x14]
add ecx, 0x10
dec edi
fsub dword [edx + 4]
fld dword [eax - 0x10]
fsub dword [edx + 8]
fstp dword [esp + 0x58]
mov ebx, dword [esp + 0x58]
fxch st(1)
fstp dword [ecx - 0x18]
mov dword [ecx - 0x10], ebx
fstp dword [ecx - 0x14]
jne 0x5d3323
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.0043d250
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x84]
push edx
call fcn.0043d250
mov al, byte [esi + 9]
add esp, 0x18
cmp al, 4
lea edx, [esp + 0x80]
lea ecx, [esp + 0x30]
jne 0x5d33b8
lea eax, [esp + 0x40]
push eax
push ecx
push edx
call fcn.0043d250
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.0043d250
add esp, 0x18
jmp 0x5d33c7
lea eax, [esp + 0x10]
push eax
push ecx
push edx
call fcn.0043d250
add esp, 0xc
movsx edi, byte [esi + 9]
xor edx, edx
test edi, edi
jle 0x5d33ff
lea ecx, [esp + 0x64]
fld dword [ecx + 4]
fmul dword [esi + 0x78]
fld dword [ecx - 4]
fmul dword [esi + 0x70]
faddp st(1)
fld dword [esi + 0x74]
fmul dword [ecx]
faddp st(1)
fcomp dword [0x7d7d3c]
fnstsw ax
test ah, 5
jnp 0x5d342e
inc edx
add ecx, 0x10
cmp edx, edi
jl 0x5d33d5
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5d3423
fld dword [esp + 0x14]
fmul dword [esi + 0x74]
fld dword [esp + 0x18]
fmul dword [esi + 0x78]
faddp st(1)
fld dword [esp + 0x10]
fmul dword [esi + 0x70]
faddp st(1)
fchs
fstp dword [eax]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5d3670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x28], edi
call fcn.0043d5b0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.0043d680
mov eax, dword [edi + 0x2e0]
add esp, 0x1c
xor ebx, ebx
test eax, eax
mov dword [esp + 0x18], 0x497423f0
jle 0x5d3704
add edi, 0x3c
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
mov esi, dword [edi]
push ecx
push edx
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x3c]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.005d3540
test al, al
jne 0x5d370f
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x2e0]
inc ebx
add edi, 4
cmp ebx, eax
jl 0x5d36c6
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x5d3727
fld dword [esi + 0x78]
mov ecx, dword [esi + 0x70]
fld dword [esi + 0x74]
mov dword [eax], ecx
fstp dword [eax + 4]
fstp dword [eax + 8]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5d7c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x44
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov al, byte [edi + 2]
mov byte [esi + 0xb], al
mov cl, byte [edi + 3]
mov byte [esi + 0xa], cl
xor eax, eax
mov byte [esi + 8], al
mov dword [esi + 0x10], eax
movzx eax, byte [edi + 1]
mov edx, eax
shr edx, 2
and edx, 3
movsx ecx, word [edi + edx*2 + 0x10]
shl ecx, 0xd
mov edx, eax
shr edx, 4
mov dword [esp + 0x14], ecx
and edx, 3
movsx ecx, word [edi + edx*2 + 8]
shl ecx, 0xd
mov edx, eax
mov dword [esp + 0x18], ecx
shr edx, 6
movsx ecx, word [edi + edx*2 + 0x10]
and eax, 3
movsx edx, word [edi + eax*2 + 8]
shl edx, 0xd
mov dword [esp + 0x10], edx
shl ecx, 0xd
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x10]
lea ebx, [esi + 0x30]
push ebx
fmul dword [0x784278]
mov ecx, edi
fstp dword [esi + 0x14]
fild dword [esp + 0x18]
fmul dword [0x784278]
fstp dword [esi + 0x18]
fild dword [esp + 0x1c]
fmul dword [0x784278]
fstp dword [esi + 0x1c]
fild dword [esp + 0x20]
fmul dword [0x784278]
fstp dword [esi + 0x20]
call fcn.005d2a10
mov al, byte [esi + 0xa]
test al, 0x10
mov byte [esi + 9], 4
jne 0x5d7d3f
mov byte [esi + 9], 3
test al, 4
je 0x5d7d59
mov ecx, 0xc5000000
mov eax, 0x45000000
mov dword [esi + 0x38], ecx
mov dword [esi + 0x48], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x68], ecx
fld dword [esi + 0x40]
lea eax, [esp + 0x30]
fsub dword [ebx]
push eax
lea ecx, [esp + 0x44]
push ecx
fstp dword [esp + 0x48]
lea edx, [esp + 0x28]
fld dword [esi + 0x44]
push edx
fsub dword [ebx + 4]
fstp dword [esp + 0x50]
fld dword [esi + 0x48]
fsub dword [ebx + 8]
fstp dword [esp + 0x54]
fld dword [esi + 0x50]
fsub dword [ebx]
fstp dword [esp + 0x3c]
fld dword [esi + 0x54]
fsub dword [ebx + 4]
fstp dword [esp + 0x40]
fld dword [esi + 0x58]
fsub dword [ebx + 8]
fstp dword [esp + 0x44]
call fcn.0043d250
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.0043cf80
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x70], edx
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ecx
fld dword [ebx + 8]
fmul dword [esi + 0x78]
mov edx, esi
fld dword [ebx + 4]
add esp, 0x14
fmul dword [esi + 0x74]
mov eax, esi
faddp st(1)
fld dword [ebx]
fmul dword [esi + 0x70]
faddp st(1)
fstp dword [esi + 0x7c]
mov ecx, dword [0x883d90]
sub edx, ecx
sar edx, 7
mov word [edi + 6], dx
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d9630
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x883db8]
push esi
push edi
xor edi, edi
test eax, eax
mov dword [0x883db4], eax
jbe 0x5d969a
push ebx
xor ebx, ebx
jmp 0x5d9650
mov eax, dword [0x883db0]
mov edx, dword [ebx + eax + 0xc]
lea esi, [ebx + eax]
mov eax, dword [esi + 0xc]
shr eax, 8
and eax, 0xf
xor edx, eax
mov eax, dword [esi + 0xc]
and edx, 0xf
xor edx, eax
mov eax, edx
shr eax, 0xc
and eax, 0xf
shl eax, 4
xor eax, edx
and eax, 0xf0
xor eax, edx
mov dword [esi], 0
mov dword [esi + 0xc], eax
mov eax, dword [0x883db4]
inc edi
add ebx, 0x20
cmp edi, eax
jb 0x5d9650
pop ebx
mov edx, 2
lea eax, [ecx + 0x18]
mov esi, 0xfffffffd
lea ecx, [edx - 2]
test ecx, ecx
jl 0x5d96b8
mov ecx, dword [eax - 4]
test ecx, ecx
je 0x5d96b8
and dword [ecx + 0x70], esi
lea ecx, [edx - 1]
test ecx, ecx
jl 0x5d96c8
mov ecx, dword [eax]
test ecx, ecx
je 0x5d96c8
and dword [ecx + 0x70], esi
test edx, edx
jl 0x5d96d6
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x5d96d6
and dword [ecx + 0x70], esi
lea ecx, [edx + 1]
test ecx, ecx
jl 0x5d96e7
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x5d96e7
and dword [ecx + 0x70], esi
lea ecx, [edx + 2]
test ecx, ecx
jl 0x5d96f8
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x5d96f8
and dword [ecx + 0x70], esi
lea ecx, [edx + 3]
test ecx, ecx
jl 0x5d9709
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x5d9709
and dword [ecx + 0x70], esi
lea ecx, [edx + 4]
test ecx, ecx
jl 0x5d971a
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x5d971a
and dword [ecx + 0x70], esi
lea ecx, [edx + 5]
test ecx, ecx
jl 0x5d972b
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x5d972b
and dword [ecx + 0x70], esi
lea ecx, [edx + 6]
test ecx, ecx
jl 0x5d973c
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x5d973c
and dword [ecx + 0x70], esi
lea ecx, [edx + 7]
test ecx, ecx
jl 0x5d974d
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x5d974d
and dword [ecx + 0x70], esi
add edx, 0xa
lea ecx, [edx - 2]
add eax, 0x28
cmp ecx, 0x5dc
jl 0x5d96a7
pop edi
pop esi
ret
Function at 0x5fc5d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x779a07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov eax, dword [esi + 0x24]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], 1
jle 0x5fc619
push ebp
lea ebp, [esi + 0x30]
mov ecx, ebp
call fcn.005f76d0
mov eax, dword [esi + 0x24]
inc edi
add ebp, 0x1f0
cmp edi, eax
jl 0x5fc603
pop ebp
mov eax, dword [esi + 0xc34]
test eax, eax
je 0x5fc62c
push eax
call fcn.005752c0
add esp, 4
lea ecx, [esi + 0xc40]
mov dword [0x890118], 0
mov byte [esp + 0x14], 0
call fcn.0040be30
push 0x5fc010
push 6
push 0x1f0
add esi, 0x30
push esi
mov dword [esp + 0x24], 0xffffffff
call fcn.0075c12d
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5fc880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x779a5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea eax, [esi + 4]
xor ebx, ebx
mov dword [esi], 0x7a63d8
mov dword [ebp - 4], ebx
mov dword [eax], eax
mov dword [eax + 4], eax
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 1
call fcn.005ef0c0
push 0xa
lea ecx, [esi + 0x190]
mov dword [esi + 0x184], ebx
call fcn.00579bc0
push 5
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], 2
mov dword [esi + 0x1bc], ebx
call fcn.00579bc0
push 5
lea ecx, [esi + 0x1f8]
mov byte [ebp - 4], 3
call fcn.00579bc0
mov dword [esi + 0x220], ebx
mov dword [esi + 0x224], ebx
mov dword [esi + 0x228], ebx
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x23c], ebx
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
xor eax, eax
mov ecx, 0x28
lea edi, [esi + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 0x30]
mov dword [edx + 0x214], 0x3f800000
mov eax, dword [0x86b390]
fld dword [0x86b394]
fld dword [0x86b398]
mov dword [esi + 0x160], eax
fxch st(1)
fstp dword [esi + 0x164]
fstp dword [esi + 0x168]
mov ecx, dword [0x86b390]
fld dword [0x86b394]
fld dword [0x86b398]
mov dword [esi + 0x170], ecx
fxch st(1)
fstp dword [esi + 0x174]
fstp dword [esi + 0x178]
mov eax, dword [esi + 0x10]
mov dword [esi + 0x180], ebx
mov byte [esi + 0x150], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x188], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x1b8], 0xbf800000
fld dword [eax + 0x64]
fld dword [eax + 0x68]
mov edx, dword [eax + 0x60]
add eax, 0x60
fxch st(1)
fstp dword [esi + 0x1c4]
mov dword [esi + 0x1c0], edx
fstp dword [esi + 0x1c8]
mov dword [esi + 0x230], ebx
mov dword [esi + 0x234], ebx
mov dword [esi + 0x238], ebx
mov dword [esi + 0x23c], ebx
mov dword [esi + 0x184], ebx
mov dword [esi + 0x1bc], ebx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x220], ebx
mov dword [esi + 0x224], ebx
mov dword [esi + 0x228], ebx
mov dword [esi + 0x22c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4