joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a3e6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044e0a2
and dword [ebp - 4], 0
cmp dword [0x49140c], 0
mov ebx, eax
jne 0x45a497
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45a548
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45a548
push eax
call fcn.0044e030
mov dword [esp], 0x475ff4
push edi
mov dword [0x49140c], eax
call esi
push eax
call fcn.0044e030
mov dword [esp], 0x475fe0
push edi
mov dword [0x491410], eax
call esi
push eax
call fcn.0044e030
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x491414], eax
call esi
push eax
call fcn.0044e030
pop ecx
mov dword [0x49141c], eax
test eax, eax
je 0x45a497
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044e030
pop ecx
mov dword [0x491418], eax
mov eax, dword [0x491418]
cmp eax, ebx
je 0x45a4ef
cmp dword [0x49141c], ebx
je 0x45a4ef
push eax
call fcn.0044e0ab
push dword [0x49141c]
mov esi, eax
call fcn.0044e0ab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45a4ef
test edi, edi
je 0x45a4ef
call esi
test eax, eax
je 0x45a4e6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45a4e6
test byte [ebp - 0xc], 1
jne 0x45a4ef
or dword [ebp + 0x10], 0x200000
jmp 0x45a528
mov eax, dword [0x491410]
cmp eax, ebx
je 0x45a528
push eax
call fcn.0044e0ab
pop ecx
test eax, eax
je 0x45a528
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45a528
mov eax, dword [0x491414]
cmp eax, ebx
je 0x45a528
push eax
call fcn.0044e0ab
pop ecx
test eax, eax
je 0x45a528
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x49140c]
call fcn.0044e0ab
pop ecx
test eax, eax
je 0x45a548
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45a54a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401110
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.MSVCR100.dll_printf]
push 0x57b6bc
call esi
push 0x57b694
call esi
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
jne 0x401135
mov eax, 0x57b690
push eax
push str._ERROR_:__s_n
call esi
mov eax, dword [esp + 0x10]
push eax
push str._FILE__:__s_n
call esi
mov ecx, dword [esp + 0x1c]
push ecx
push str._LINE__:__d_n
call esi
push str._n_n
call esi
add esp, 0x1c
push 1
call dword [sym.imp.MSVCR100.dll_exit]
pop esi
int3

Function at 0x401d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5709fb
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59ad00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0xc]
xor ebx, ebx
cmp ecx, ebx
je 0x401d66
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jge 0x401d66
lea edx, [eax + eax*2]
inc eax
mov dword [esi], eax
mov eax, dword [esp + 0x40]
lea ecx, [ecx + edx*8]
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.004010c0
jmp 0x401e4d
mov eax, dword [esi + 4]
mov edi, 1
cmp eax, 1
jl 0x401d76
lea edi, [eax + eax]
xor ecx, ecx
mov eax, edi
mov edx, 0x18
mul edx
seto cl
mov dword [esi + 4], edi
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.005518e0
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], ebx
cmp eax, ebx
je 0x401dc6
push 0x4010b0
push 0x401090
push edi
lea ebp, [eax + 4]
push 0x18
push ebp
mov dword [eax], edi
call fcn.00551a22
jmp 0x401dc8
xor ebp, ebp
mov dword [esp + 0x38], 0xffffffff
cmp ebp, ebx
jne 0x401de8
push 0x57b7b4
push 0x8d
push 0x57b760
call fcn.00401110
cmp dword [esi], 0
jle 0x401e0b
xor edi, edi
nop
mov ecx, dword [esi + 0xc]
add ecx, edi
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [edi + ebp]
call fcn.004010c0
inc ebx
add edi, 0x18
cmp ebx, dword [esi]
jl 0x401df0
mov eax, dword [esi]
mov edx, dword [esp + 0x40]
lea ecx, [eax + eax*2]
inc eax
mov dword [esi], eax
push edx
lea eax, [esp + 0x1c]
lea ecx, [ebp + ecx*8]
push eax
call fcn.004010c0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x401e4a
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x4010b0
push ecx
push 0x18
push eax
call fcn.00551b0e
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0xc], ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x41ac00
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x571838
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x59ad00]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59ad00]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x41ad40
cmp byte [edi + 0x49], bl
je 0x41ad40
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x41ad33
mov ecx, 0xf
xor eax, eax
mov byte [esp + 0x18], bl
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 8
cmp ecx, 0x10
jae 0x41ac82
lea eax, [esp + 0x18]
mov byte [eax + 8], bl
mov dword [esp + 0x40], ebx
lea ebp, [edi + 0x4c]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x41aca1
lea ecx, [esp + 0x18]
mov eax, ecx
add ecx, dword [esp + 0x28]
lea edx, [esp + 0x14]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
push ebp
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x41acc8
dec eax
je 0x41accb
sub eax, 2
lea ecx, [esp + 0x18]
jne 0x41ad2e
jmp 0x41ad3b
mov byte [edi + 0x49], bl
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x41acde
lea ecx, [esp + 0x18]
mov esi, dword [esp + 0x14]
sub esi, ecx
je 0x41ad0c
cmp edx, 0x10
jae 0x41acef
lea eax, [esp + 0x18]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x41ad2a
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp byte [edi + 0x49], bl
je 0x41ad37
cmp esi, ebx
jne 0x41ac94
push ebx
push 8
lea ecx, [esp + 0x20]
call fcn.0041a800
jmp 0x41ac8c
lea ecx, [esp + 0x18]
call fcn.00419f70
xor al, al
jmp 0x41ad42
lea ecx, [esp + 0x18]
call fcn.00419f70
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00551a8e
add esp, 0x30
ret
Function at 0x41c680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x59ad00]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
lea ecx, [esp + 0x14]
push 4
push ecx
mov dword [esp + 0x20], eax
call edi
add esp, 0x10
cmp eax, 1
je 0x41c6ca
xor al, al
pop edi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00551a8e
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [esp + 0xc], ebx
jle 0x41c727
push esi
push 2
lea edx, [esp + 0x20]
push 8
push edx
call edi
add esp, 0x10
cmp eax, 2
jne 0x41c6b7
push esi
push 1
lea eax, [esp + 0x1c]
push 4
push eax
call edi
add esp, 0x10
cmp eax, 1
jne 0x41c6b7
fld qword [esp + 0x20]
mov ecx, dword [esp + 0x14]
fld qword [esp + 0x18]
lea edx, [esp + 0x28]
fstp qword [esp + 0x28]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x10]
push edx
fstp qword [esp + 0x34]
call fcn.0040cf20
inc ebx
cmp ebx, dword [esp + 0xc]
jl 0x41c6d2
mov ecx, dword [esp + 0x44]
pop edi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00551a8e
mov esp, ebp
pop ebp
ret

Function at 0x41c740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x59ad00]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [edi]
mov dword [esp + 8], eax
mov eax, dword [edi + 4]
cmp ecx, eax
je 0x41c77b
mov edx, dword [esp + 8]
push edx
push ecx
push eax
push eax
call fcn.004193a0
add esp, 0x10
mov dword [edi + 4], eax
mov ebx, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
lea eax, [esp + 0x14]
push 4
push eax
call ebx
add esp, 0x10
cmp eax, 1
je 0x41c7a8
xor al, al
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00551a8e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 8]
push esi
push 1
push 8
push ecx
call ebx
add esp, 0x10
cmp eax, 1
jne 0x41c795
push esi
push eax
lea edx, [esp + 0x18]
push 8
push edx
call ebx
add esp, 0x10
cmp eax, 1
jne 0x41c795
xor ebx, ebx
cmp dword [esp + 0xc], ebx
jle 0x41c80d
push edi
call fcn.0041c680
add esp, 4
test al, al
je 0x41c795
fld qword [0x57b8c8]
lea eax, [esp + 0x18]
fst qword [esp + 0x18]
push eax
mov ecx, edi
fstp qword [esp + 0x24]
mov dword [esp + 0x2c], 0x270f
call fcn.0040cf20
inc ebx
cmp ebx, dword [esp + 0xc]
jl 0x41c7d7
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00551a8e
mov esp, ebp
pop ebp
ret
Function at 0x423460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x571dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x59ad00]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x59ad00]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
fld qword [0x57b620]
mov ebx, dword [ebp + 8]
mov eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0x18]
fst qword [ecx]
mov dword [esp + 0x14], ecx
fstp qword [ecx + 8]
mov edx, dword [eax + 0x5a8]
sub edx, dword [eax + 0x5a4]
sar edx, 2
cmp edx, 1
jb 0x42360f
fld qword [ebp + 0x10]
xor edi, edi
fmul qword [0x57b940]
mov dword [esp + 0x18], edi
fld qword [ebx]
mov dword [esp + 0x1c], edi
fld qword [ebx + 8]
mov dword [esp + 0x20], edi
fld qword [ebx]
fsub st(3)
fstp qword [esp + 0x44]
fsub st(2)
fstp qword [esp + 0x4c]
fadd st(1)
fstp qword [esp + 0x54]
fadd qword [ebx + 8]
fstp qword [esp + 0x5c]
lea esi, [eax + 0x5a0]
mov ecx, esi
mov dword [esp + 0x78], edi
call fcn.004037e0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x1c], edi
cmp eax, ecx
je 0x42353c
push edi
push ecx
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 0x14]
push edi
push ecx
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.00408720
fld qword [0x57b628]
mov ecx, dword [esp + 0x18]
fst qword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x1c]
je 0x4235e5
lea esp, [esp]
mov ecx, dword [esp + 0x10]
fstp st(0)
mov edx, dword [ecx]
mov esi, dword [edx + 0x20]
mov ecx, dword [esp + 0x28]
shl esi, 4
add esi, dword [ecx]
lea edi, [esp + 0x34]
lea eax, [esi + 0x10]
push eax
mov ecx, ebx
call fcn.004046c0
fld qword [esp + 0x30]
fcom st(1)
add esp, 4
fnstsw ax
test ah, 0x41
jne 0x4235cc
mov eax, dword [esp + 0x14]
fstp st(0)
fst qword [esp + 0x2c]
fld qword [esp + 0x34]
fstp qword [eax]
fld qword [esp + 0x3c]
fstp qword [eax + 8]
jmp 0x4235ce
fstp st(1)
mov eax, dword [esp + 0x10]
add eax, 4
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x1c]
jne 0x423580
mov ecx, dword [esp + 0x18]
xor edi, edi
fld qword [ebp + 0x10]
fmul st(0), st(0)
fcompp
fnstsw ax
test ah, 5
jp 0x423613
fld qword [0x57b620]
mov eax, dword [esp + 0x14]
fst qword [eax]
fstp qword [eax + 8]
cmp ecx, edi
je 0x42360f
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x423622
cmp ecx, edi
je 0x423620
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00551a8e
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4325b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push eax
push 0x57bfd0
mov byte [ecx + 0xe5], 1
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop esi
int3
Function at 0x44b670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5725be
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x59ad00]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x20], 0
lea edi, [esi + 0x50]
mov dword [esp + 0x10], edi
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.0044b050
mov edi, dword [edi + 4]
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
lea edi, [esi + 0x40]
add esp, 4
mov dword [esp + 0x14], edi
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x2c], 3
call fcn.0044b050
mov edi, dword [edi + 4]
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esi, 0x30
add esp, 4
mov dword [esp + 0x14], esi
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 4
call fcn.0044b050
mov eax, dword [esi + 4]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x45c2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5727f9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x59ad00]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::_Lockit::constructor_int_]
mov eax, dword [0x59ba64]
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::locale::id_std::ctype_wchar_t_::id]
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
call dword [sym.imp.MSVCP100.dll_public:_unsigned_int___thiscall_std::locale::id::operator_unsigned_int_void_]
mov edi, dword [esp + 0x30]
mov esi, eax
mov eax, dword [edi]
cmp esi, dword [eax + 0xc]
jae 0x45c32e
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x45c332
cmp byte [eax + 0x14], 0
je 0x45c332
call dword [sym.imp.MSVCP100.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Getgloballocale_void_]
cmp esi, dword [eax + 0xc]
jae 0x45c338
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x45c334
xor ecx, ecx
jmp 0x45c315
mov esi, ecx
test esi, esi
jne 0x45c38f
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x45c38f
lea eax, [esp + 0xc]
push edi
push eax
call dword [sym.imp.MSVCP100.dll_public:_static_unsigned_int___cdecl_std::ctype_wchar_t_::_Getcat_class_std::locale::facet_const____class_std::locale_const__]
add esp, 8
cmp eax, 0xffffffff
jne 0x45c372
push str.bad_cast
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::bad_cast::constructor_char_const__]
push 0x589970
lea ecx, [esp + 0x18]
push ecx
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [esp + 0xc]
mov esi, ecx
mov dword [0x59ba64], ecx
mov edi, ecx
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::locale::facet::_Incref_void_]
push edi
call fcn.00551901
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x45f330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x572988
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x59ad00]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
test byte [esi + 0x98], 1
jne 0x45f382
fld1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x24]
call fcn.0047e760
lea eax, [ebp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x84], 0
call fcn.0045eb00
mov ecx, dword [esi + 0x98]
mov eax, dword [esi + 0x94]
movsd xmm0, qword [ebp + 8]
shr ecx, 2
and cl, 1
movzx edx, cl
mov ecx, dword [esi + 0x90]
push edx
push eax
push ecx
sub esp, 8
lea edx, [esi + 0xb4]
movsd qword [esp], xmm0
push edx
lea ecx, [esp + 0x3c]
call fcn.0047ed60
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
xorps xmm2, xmm2
movapd xmm0, xmm2
movsd qword [esp + 0x1c], xmm0
cmp ecx, ebx
jg 0x45f55d
mov eax, ebx
sub eax, ecx
inc eax
cmp eax, 4
jl 0x45f509
mov esi, dword [esi + 0x90]
mov eax, ecx
sub eax, esi
mov dword [esp + 0x18], eax
lea edx, [eax + 2]
mov eax, dword [esp + 0x24]
lea ebx, [eax + ecx*8 + 0x10]
movsd xmm1, qword [ebx - 0x10]
cmp ecx, esi
mov edi, ecx
cmovge edi, dword [esp + 0x18]
ucomisd xmm1, xmm2
lahf
test ah, 0x44
jnp 0x45f44f
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xa8]
movsd xmm3, qword [eax + edi*8]
mulsd xmm3, xmm1
addsd xmm0, xmm3
lea edi, [esi + edx - 1]
cmp edi, esi
jl 0x45f45a
lea edi, [edx - 1]
movsd xmm1, qword [ebx - 8]
ucomisd xmm1, xmm2
lahf
test ah, 0x44
jnp 0x45f480
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xa8]
movsd xmm3, qword [eax + edi*8]
mulsd xmm3, xmm1
addsd xmm0, xmm3
movsd xmm1, qword [ebx]
lea edi, [edx + esi]
cmp edi, esi
cmovge edi, edx
ucomisd xmm1, xmm2
lahf
test ah, 0x44
jnp 0x45f4ad
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xa8]
movsd xmm3, qword [eax + edi*8]
mulsd xmm3, xmm1
addsd xmm0, xmm3
lea edi, [esi + edx + 1]
cmp edi, esi
jl 0x45f4b8
lea edi, [edx + 1]
movsd xmm1, qword [ebx + 8]
ucomisd xmm1, xmm2
lahf
test ah, 0x44
jnp 0x45f4de
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xa8]
movsd xmm3, qword [eax + edi*8]
mulsd xmm3, xmm1
addsd xmm0, xmm3
mov eax, dword [esp + 0x38]
add dword [esp + 0x18], 4
add ecx, 4
add eax, 0xfffffffd
add ebx, 0x20
add edx, 4
cmp ecx, eax
jle 0x45f420
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x14]
movsd qword [esp + 0x1c], xmm0
cmp ecx, ebx
jg 0x45f55d
mov edx, ecx
sub edx, dword [esi + 0x90]
jmp 0x45f520
cmp ecx, dword [esi + 0x90]
mov eax, dword [esp + 0x24]
movsd xmm1, qword [eax + ecx*8]
mov edi, ecx
cmovge edi, edx
ucomisd xmm1, xmm2
lahf
test ah, 0x44
jnp 0x45f551
mov eax, dword [esi + 0xa8]
movsd xmm3, qword [eax + edi*8]
mulsd xmm3, xmm1
addsd xmm0, xmm3
inc ecx
inc edx
cmp ecx, ebx
jle 0x45f520
movsd qword [esp + 0x1c], xmm0
lea ecx, [esp + 0x24]
mov dword [esp + 0x80], 0xffffffff
call fcn.0047e7e0
fld qword [esp + 0x1c]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x470690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x572e0e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x59ad00]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00477630
xor eax, eax
mov dword [esi], vtable.CGeom_CNurbs.0
mov ecx, 1
mov dword [esp + 0x14], eax
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xac], ecx
mov dword [esi + 0xb0], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xbc], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xd0], ecx
mov dword [esi + 0xd4], eax
mov dword [esi + 0xcc], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], 5
call fcn.00467fc0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c
Function at 0x474eb0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5734f0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x59ad00]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str._14.6f
lea ecx, [esp + 0xc]
call fcn.004d3bd0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x28]
push 0x57d02c
push ecx
mov dword [esp + 0x3c], 0
call fcn.004731b0
push 0x57d028
push eax
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x48], 1
call fcn.0045b8e0
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x54], 2
call fcn.0045b830
push 0x57d028
push eax
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x60], 3
call fcn.0045b8e0
lea ecx, [esp + 0x38]
push ecx
push eax
lea edx, [esp + 0x4c]
push edx
mov byte [esp + 0x6c], 4
call fcn.0045b830
push 0x57d030
push eax
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x78], 5
call fcn.0045b8e0
add esp, 0x48
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 7
call fcn.004d3ac0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 8
call fcn.004d3ac0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 9
call fcn.004d3ac0
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 0xa
call fcn.004d3ac0
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 0xb
call fcn.004d3ac0
mov dword [esp + 0xc], 0
movsd xmm0, qword [esi + 0x10]
mov ecx, dword [esp + 0x10]
sub esp, 0x18
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [esi + 8]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [esi]
mov byte [esp + 0x48], 0xc
movsd qword [esp], xmm0
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.004d3c20
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______cdecl_std::endl_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t____]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x58]
add esp, 0x20
push eax
push ecx
push edx
call fcn.0045cb00
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0xb
call fcn.004d3ac0
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.004d3ac0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.004d3ac0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4