joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5eb0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
imul eax, ebp
push esi
movzx esi, word [ecx + 0x38]
push edi
lea ebx, [eax + edx*2]
mov eax, dword [ecx + 0x14]
add ebx, dword [ecx + 0xc]
cmp byte [ecx + 0x3e], 0
mov dword [esp + 0x18], eax
je 0x5eb1c8
movzx edi, word [ecx + 0x3c]
xor edx, ebp
mov dword [esp + 0x24], edi
test dl, 1
je 0x5eb10a
movzx eax, di
mov edi, esi
mov dword [esp + 0x24], edi
mov esi, eax
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x14], eax
js 0x5eb20c
mov ecx, dword [esp + 0x28]
lea ecx, [ecx]
mov eax, ecx
movzx edx, si
movzx ecx, di
mov ebp, ebx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
test ecx, ecx
jle 0x5eb1a4
test bl, 2
je 0x5eb15e
lea eax, [ecx - 1]
movzx edx, di
movzx ecx, si
lea ebp, [ebx + 2]
mov word [ebx], si
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x2c], ecx
mov ecx, eax
movzx edx, dx
mov eax, dword [esp + 0x2c]
movzx eax, ax
shl eax, 0x10
sar ecx, 1
or eax, edx
cmp ecx, 0x12c
jle 0x5eb183
mov edi, ebp
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x24]
jmp 0x5eb18f
push ecx
push eax
push ebp
call dword [0x73ec04]
add esp, 0xc
mov eax, dword [esp + 0x20]
test al, 1
je 0x5eb1a0
mov ecx, dword [esp + 0x10]
mov word [ebp + eax*2 - 2], cx
mov ecx, dword [esp + 0x28]
add ebx, dword [esp + 0x18]
dec dword [esp + 0x14]
movzx eax, di
movzx edi, si
mov esi, eax
mov dword [esp + 0x24], edi
jns 0x5eb120
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ebp, dword [esp + 0x2c]
dec ebp
js 0x5eb20c
mov eax, dword [esp + 0x28]
cmp eax, 0x12c
jle 0x5eb1f5
mov ecx, eax
mov edi, ebx
mov eax, esi
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x5eb201
push eax
push esi
push ebx
call dword [0x73ec00]
add esp, 0xc
add ebx, dword [esp + 0x18]
dec ebp
mov eax, dword [esp + 0x28]
jns 0x5eb1d3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10

Function at 0x5eb430
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x20
mov ecx, dword [esp + 0x1c]
movzx ecx, cl
inc ecx
mov edx, dword [esi + 0x14]
imul edx, dword [esp + 0x14]
imul ecx, dword [esi + 0x34]
mov ebp, dword [esi + 0x14]
push edi
mov edi, dword [esi + 0x30]
shr ecx, 0xb
imul edi, ecx
lea eax, [edx + eax*2]
add eax, dword [esi + 0xc]
sub ebx, ecx
mov esi, dword [esp + 0x1c]
jmp 0x5eb470
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, ebp
dec esi
jne 0x5eb470
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x5eb4b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x20
mov ecx, dword [esp + 0x1c]
movzx ecx, cl
inc ecx
mov edx, dword [esi + 0x14]
imul edx, dword [esp + 0x14]
mov ebp, dword [esi + 0x14]
push edi
mov edi, dword [esi + 0x30]
shr ecx, 3
imul edi, ecx
lea eax, [edx + eax*2]
add eax, dword [esi + 0xc]
sub ebx, ecx
mov esi, dword [esp + 0x1c]
jmp 0x5eb4f0
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, ebp
dec esi
jne 0x5eb4f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x5ede70
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6ae5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, ecx
mov ebx, dword [esp + 0x38]
mov eax, dword [ebp]
mov edi, dword [ebx + 0xc]
mov esi, dword [ebx + 8]
mov eax, dword [eax + 8]
sub edi, dword [ebx + 4]
sub esi, dword [ebx]
call eax
movzx eax, al
neg eax
mov dword [esp + 0x14], esi
push 0
sbb eax, eax
mov dword [esp + 0x1c], edi
add eax, 2
mov dword [esp + 0x20], 5
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x2c], 0
call fcn.005d5010
add esp, 8
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], 1
mov ecx, dword [esp + 0x38]
test ecx, ecx
jne 0x5edefd
xor esi, esi
jmp 0x5edf52
call fcn.0059e0d0
push 1
push 0
mov ecx, eax
call fcn.0057b8b0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
neg eax
push 0
sub esp, 8
neg ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 4], xmm0
movd xmm0, ecx
mov ecx, dword [esp + 0x44]
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push ebp
call fcn.0059e0d0
mov ecx, eax
call fcn.0057bb40
mov ecx, dword [esp + 0x38]
push 1
call fcn.0059e0f0
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x5edf76
lea eax, [ecx + 4]
or edx, 0xffffffff
lock xadd dword [eax], edx
cmp edx, 1
jne 0x5edf76
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x38], 0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x5ee230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6ae6c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
test edi, edi
setne al
movzx eax, al
push eax
push dword [esp + 0x30]
push dword [esp + 0x2c]
call fcn.005ee550
add esp, 0x10
test al, al
je 0x5ee30f
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5ee30f
push dword [esp + 0xc]
push eax
call fcn.00592d00
mov esi, eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x20], 1
push 0x54
call fcn.00547bd8
add esp, 0xc
mov dword [esp + 0xc], eax
mov byte [esp + 0x18], 2
test eax, eax
je 0x5ee2cf
push 0
push edi
push dword [esp + 0x30]
mov ecx, eax
push esi
push dword [esp + 0x30]
call fcn.005ee050
mov edi, eax
jmp 0x5ee2d1
xor edi, edi
mov dword [esp + 0x18], 0xffffffff
test esi, esi
je 0x5ee2f3
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x5ee2f3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [esp + 0x2c], 0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x5ee8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6ae7bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push dword [esp + 0x28]
call fcn.00589920
mov dword [esp + 0x14], 0
mov eax, 1
mov edx, dword [esp + 0x1c]
mov dword [esi], vtable.SkImageShader.0
lea ecx, [edx + 4]
lock xadd dword [ecx], eax
lea eax, [esi + 0x30]
mov dword [eax], edx
mov dword [esp + 0x28], eax
mov byte [esp + 0x14], 2
mov eax, dword [esp + 0x20]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x38], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x5ee970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6ae7fb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], 0
lea edi, [esi + 0x30]
mov dword [esp + 0x10], edi
mov byte [esp + 0x1c], 0
mov ecx, dword [edi]
test ecx, ecx
je 0x5ee9c9
lea eax, [ecx + 4]
or edx, 0xffffffff
lock xadd dword [eax], edx
cmp edx, 1
jne 0x5ee9c9
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi], 0
mov dword [esp + 0x1c], 0xffffffff
mov ecx, esi
call fcn.00589a00
test byte [esp + 0x24], 1
je 0x5ee9ee
push esi
call fcn.005472b4
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4
Function at 0x5ef550
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
imul eax, esi
sub esi, dword [ecx + 0x50]
imul esi, dword [ecx + 0x34]
push edi
lea ebp, [eax + edx*2]
sub edx, dword [ecx + 0x4c]
mov eax, dword [ecx + 0x14]
add ebp, dword [ecx + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x34]
lea edx, [esi + edx*2]
add edx, dword [ecx + 0x2c]
mov dword [esp + 0x18], eax
movzx eax, byte [ecx + 0x58]
inc eax
mov dword [esp + 0x24], ebp
sar eax, 3
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], eax
lea ecx, [ecx]
mov ebx, dword [esp + 0x28]
mov edi, edx
mov eax, ebp
sub edi, ebp
mov ebp, dword [esp + 0x10]
mov edi, edi
movzx edx, word [eax]
lea eax, [eax + 2]
movzx ecx, word [edi + eax - 2]
mov esi, edx
and esi, 0x7e0
shl esi, 0x10
or esi, edx
mov edx, ecx
and edx, 0x7e0
and esi, 0xfffff81f
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
sub edx, esi
imul edx, ebp
shr edx, 5
add edx, esi
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax - 2], cx
dec ebx
jne 0x5ef5b0
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
add ebp, dword [esp + 0x14]
add edx, dword [esp + 0x18]
dec dword [esp + 0x2c]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], edx
jne 0x5ef5a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x5ef730
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 0x20]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
imul eax, esi
sub esi, dword [ecx + 0x50]
imul esi, dword [ecx + 0x34]
push edi
lea eax, [eax + edx*2]
sub edx, dword [ecx + 0x4c]
add eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
lea ebx, [esi + edx*2]
mov edx, dword [ecx + 0x14]
add ebx, dword [ecx + 0x2c]
mov dword [esp + 0x24], edx
mov edx, dword [ecx + 0x34]
movzx ecx, byte [ecx + 0x58]
mov ebp, ecx
mov dword [esp + 0x14], ebx
shr ebp, 3
add ebp, ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], ebp
mov ecx, dword [esp + 0x38]
mov edx, eax
mov dword [esp + 0x30], ecx
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x1c], ecx
mov eax, ecx
jmp 0x5ef7a0
movzx edi, word [edx]
movzx ecx, word [eax + edx]
mov edx, ecx
and ecx, 0xf0f
and edx, 0xf0f0
shl edx, 0xc
or edx, ecx
imul edx, ebp
shr edx, 4
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
shr edx, 0xc
and ecx, 0xf0f
xor ecx, edx
movzx ecx, cx
mov esi, ecx
mov ebx, ecx
mov edx, ecx
shr ebx, 0xc
shr ecx, 4
and esi, 0xf
and ecx, 0xf
shr edx, 8
mov dword [esp + 0x20], ecx
and edx, 0xf
mov ecx, 0xf
sub ecx, esi
shr esi, 3
mov ebp, ecx
not esi
shr ebp, 3
and esi, 1
add ebp, ecx
not esi
mov dword [esp + 0x1c], ebp
lea ecx, [edx*4]
mov ebp, edx
mov edx, ebx
shr ebp, 2
or ebp, ecx
shr edx, 3
mov ecx, edi
and ebp, esi
mov esi, dword [esp + 0x1c]
shr ecx, 5
and ecx, 0x3f
imul ecx, esi
shr ecx, 4
add ebp, ecx
lea ecx, [ebx + ebx]
or edx, ecx
shl ebp, 5
mov ecx, edi
and edi, 0x1f
shr ecx, 0xb
imul ecx, esi
imul edi, esi
shr ecx, 4
add edx, ecx
shr edi, 4
mov ecx, dword [esp + 0x20]
shl edx, 0xb
or ebp, edx
mov edx, ecx
shr edx, 3
add ecx, ecx
or edx, ecx
add edx, edi
or ebp, edx
mov edx, dword [esp + 0x34]
mov word [edx], bp
add edx, 2
dec dword [esp + 0x30]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x34], edx
jne 0x5ef7a0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add eax, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
dec dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
jne 0x5ef780
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x5efc00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x30]
imul eax, ebp
sub ebp, dword [esi + 0x50]
imul ebp, dword [esi + 0x34]
sub ebp, dword [esi + 0x4c]
add ebp, dword [esi + 0x2c]
lea ebx, [eax + edx*2]
mov eax, dword [esi + 0x14]
add ebp, edx
add ebx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x1c], eax
call fcn.005920d0
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 0x58]
inc eax
sar eax, 3
mov dword [esp + 0x10], eax
lea ebx, [ebx]
mov eax, ebx
mov edi, ebp
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov cl, byte [edi]
lea edi, [edi + 1]
mov esi, dword [esp + 0x14]
lea eax, [eax + 2]
movzx edx, word [eax - 2]
movzx ecx, cl
movzx ecx, word [esi + ecx*2]
mov esi, edx
and esi, 0x7e0
shl esi, 0x10
or esi, edx
mov edx, ecx
and edx, 0x7e0
and esi, 0xfffff81f
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
sub edx, esi
imul edx, ebp
shr edx, 5
add edx, esi
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax - 2], cx
dec ebx
jne 0x5efc70
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add ebx, dword [esp + 0x18]
add ebp, dword [esp + 0x1c]
dec dword [esp + 0x30]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebp
jne 0x5efc60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10

Function at 0x5f0850
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
lea esp, [esp]
movzx ecx, word [ebp]
lea ebp, [ebp + 2]
mov esi, dword [ebx]
lea ebx, [ebx + 4]
mov edx, ecx
mov eax, ecx
and edx, 0xf
and eax, 0xf000
shl edx, 0x14
or edx, eax
mov eax, ecx
shl edx, 4
and ecx, 0xf00
shr eax, 4
and eax, 0xf
or edx, eax
or edx, ecx
mov ecx, 0x100
mov edi, edx
shl edi, 4
or edi, edx
mov edx, esi
mov eax, edi
and edx, 0xff00ff
shr eax, 0x18
sub ecx, eax
mov eax, esi
imul edx, ecx
shr eax, 8
and eax, 0xffff00ff
shr esi, 8
imul eax, ecx
and esi, 0xff00ff
imul esi, ecx
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor edx, esi
add edx, edi
dec dword [esp + 0x1c]
mov dword [ebx - 4], edx
jne 0x5f0860
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5f2090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6acfa0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.SkRefCntBase.0
mov dword [esi + 4], 1
mov dword [esp + 0x14], 0
mov dword [esi], vtable.SkRefCnt.0
mov dword [esp + 0x14], 1
mov dword [esi], vtable.SkFlattenable.0
mov dword [esp + 0x14], 2
mov dword [esi], vtable.SkColorFilter.0
mov dword [esp + 0x14], 3
mov eax, dword [esp + 0x1c]
mov dword [esi], vtable.SkColorMatrixFilter.0
push eax
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi + 8], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x18], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [esi + 0x28], xmm0
movdqu xmm0, xmmword [eax + 0x30]
movdqu xmmword [esi + 0x38], xmm0
movdqu xmm0, xmmword [eax + 0x40]
movdqu xmmword [esi + 0x48], xmm0
call fcn.005f28c0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x5f5b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x73d6e0]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
mov ebx, esi
lea ebp, [esi + 0x60]
mov dword [esp + 0x10], ebp
jmp 0x5f5b80
mov eax, dword [ebx + 0x88]
lea ecx, [esp + 0x3c]
sub esp, 0xc
mov edi, dword [eax + 0x20]
movsd xmm0, qword [eax]
movsd qword [esp + 4], xmm0
movsd qword [esp + 0x28], xmm0
movss xmm0, dword [edi + 0xc8]
mov eax, dword [edi + 0xd4]
movss dword [esp], xmm0
push dword [edi + 0xb4]
mov dword [esp + 0x24], edi
mov eax, dword [eax*4 + 0x6d3070]
push ecx
call eax
add esp, 8
lea ecx, [esp + 0x58]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esp + 0x98], xmm0
mov eax, dword [ebx + 0x8c]
movsd xmm0, qword [eax]
mov eax, dword [edi + 0xd4]
movsd qword [esp + 4], xmm0
movsd qword [esp + 0x30], xmm0
movss xmm0, dword [edi + 0xc8]
mov eax, dword [eax*4 + 0x6d3070]
movss dword [esp], xmm0
push dword [edi + 0xb4]
push ecx
call eax
movdqu xmm0, xmmword [eax]
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x78]
push eax
movdqu xmmword [esp + 0xcc], xmm0
call fcn.005f33c0
movsd xmm0, qword [esp + 0x44]
add esp, 0x20
addsd xmm0, qword [esp + 0x1c]
mov edi, dword [ebp]
mulsd xmm0, qword [0x6f8780]
movsd qword [esp + 0x34], xmm0
cmp edi, esi
je 0x5f5d75
mov ebp, dword [esp + 0x18]
jmp 0x5f5c70
mov eax, dword [edi + 0x88]
mov ecx, dword [esp + 0x14]
push edi
sub esp, 8
mov esi, dword [eax + 0x20]
movsd qword [esp], xmm0
call fcn.005faf30
movsd xmm0, qword [esp + 0x24]
fstp st(0)
mov ecx, dword [esp + 0x14]
push edi
sub esp, 8
movsd qword [esp], xmm0
call fcn.005faf30
mov eax, dword [edi + 0x88]
lea ecx, [esp + 0x7c]
sub esp, 0xc
fstp st(0)
movsd xmm0, qword [eax]
mov eax, dword [esi + 0xd4]
movsd qword [esp + 4], xmm0
movsd qword [esp + 0x28], xmm0
movss xmm0, dword [esi + 0xc8]
mov eax, dword [eax*4 + 0x6d3070]
movss dword [esp], xmm0
push dword [esi + 0xb4]
push ecx
call eax
movdqu xmm0, xmmword [eax]
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x88]
push eax
movdqu xmmword [esp + 0xbc], xmm0
call fcn.005f33c0
mov eax, dword [edi + 0x8c]
add esp, 0x20
mov ecx, esi
movsd xmm0, qword [eax]
movsd qword [esp + 0x2c], xmm0
addsd xmm0, qword [esp + 0x1c]
push ebx
sub esp, 8
mulsd xmm0, qword [0x6f8780]
movsd qword [esp], xmm0
call fcn.005faf30
movsd xmm0, qword [esp + 0x2c]
fstp st(0)
push ebx
sub esp, 8
mov ecx, esi
movsd qword [esp], xmm0
call fcn.005faf30
mov edi, dword [edi + 0x60]
fstp st(0)
movsd xmm0, qword [esp + 0x34]
cmp edi, ebp
jne 0x5f5c70
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov ebx, dword [ebp]
lea ebp, [ebx + 0x60]
mov dword [esp + 0x10], ebp
cmp dword [ebp], esi
jne 0x5f5b80
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005472b9
add esp, 0xb0
ret
Function at 0x604d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6aec7f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005e2700
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x1c]
mov dword [esi], vtable.SkBigPicture.0
movdqu xmm0, xmmword [eax]
mov eax, dword [esp + 0x30]
mov dword [esi + 0x1c], eax
movdqu xmmword [esi + 0xc], xmm0
mov dword [esi + 0x20], 0
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
mov dword [ecx], eax
mov byte [esp + 0x14], 3
lea ecx, [esi + 0x28]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [ecx], eax
mov byte [esp + 0x14], 5
lea ecx, [esi + 0x2c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ecx
mov dword [ecx], eax
mov byte [esp + 0x14], 7
lea ecx, [esi + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], ecx
mov dword [ecx], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18

Function at 0x6055e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6aedce
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
call fcn.005e2700
mov dword [esp + 0x20], 0
lea esi, [edi + 0x1c]
movdqu xmm0, xmmword [esp + 0x28]
mov ecx, esi
mov dword [edi], vtable.SkMiniPicture_struct_SkRecords::DrawPath_.0
mov dword [esp + 0x10], esi
movdqu xmmword [edi + 0xc], xmm0
call fcn.005758d0
mov byte [esp + 0x20], 1
lea ecx, [esi + 0x44]
mov dword [esp + 0x14], ecx
call fcn.005836a0
mov byte [esp + 0x20], 4
mov eax, dword [esp + 0x38]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [esi + 0x20], xmm0
movdqu xmm0, xmmword [eax + 0x30]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmm0, xmmword [eax + 0x40]
movdqu xmmword [esi + 0x40], xmm0
mov dword [esp + 0x20], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x14
Function at 0x6056a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6aee0b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
call fcn.005e2700
mov dword [esp + 0x1c], 0
lea esi, [edi + 0x1c]
movdqu xmm0, xmmword [esp + 0x24]
mov ecx, esi
mov dword [edi], vtable.SkMiniPicture_struct_SkRecords::DrawRect_.0
mov dword [esp + 0x10], esi
movdqu xmmword [edi + 0xc], xmm0
call fcn.005758d0
mov byte [esp + 0x1c], 2
mov eax, dword [esp + 0x34]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [esi + 0x20], xmm0
movdqu xmm0, xmmword [eax + 0x30]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmm0, xmmword [eax + 0x40]
movdqu xmmword [esi + 0x40], xmm0
mov eax, dword [eax + 0x50]
mov dword [esi + 0x50], eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x14

Function at 0x605760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6aee56
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
call fcn.005e2700
mov dword [esp + 0x1c], 0
lea esi, [edi + 0x1c]
movdqu xmm0, xmmword [esp + 0x24]
mov ecx, esi
mov dword [edi], vtable.SkMiniPicture_struct_SkRecords::DrawTextBlob_.0
mov dword [esp + 0x10], esi
movdqu xmmword [edi + 0xc], xmm0
call fcn.005758d0
mov byte [esp + 0x1c], 3
mov eax, dword [esp + 0x34]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [esi + 0x20], xmm0
movdqu xmm0, xmmword [eax + 0x30]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmm0, xmmword [eax + 0x40]
movdqu xmmword [esi + 0x40], xmm0
mov dword [esp + 0x1c], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x14
Function at 0x609590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6af7c1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov edx, dword [esp + 0x20]
push 2
mov eax, dword [edx + 4]
mov dword [esi], eax
mov eax, dword [esp + 0x20]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi + 4], xmm0
mov eax, dword [edx + 4]
shl eax, 4
push eax
call fcn.00570200
add esp, 8
mov dword [esi + 0x14], eax
mov dword [esp + 0x14], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov byte [esp + 0x14], 1
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov byte [esp + 0x14], 2
call fcn.005729f0
movdqu xmm0, xmmword [esi + 4]
mov dword [esi + 0x1c], eax
movdqu xmmword [esi + 0x20], xmm0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8