joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..rsrc]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x402da5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405537], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Magnetick
push str.Charge_Window_App
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402dec
xor eax, eax
jmp 0x402e03
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x403222
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404488
push 0x403384
push eax
mov eax, dword [0x4055b4]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x4055b0]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.0040337a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x4055ac]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d0
push 0x4040cc
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4032bd
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x4032b5
cmp al, 0x22
jne 0x4032aa
cmp byte [esi], 0x22
jne 0x4032c7
inc esi
jmp 0x4032c7
cmp al, 0x20
jbe 0x4032c7
inc esi
cmp byte [esi], 0x20
ja 0x4032c1
cmp byte [esi], 0
je 0x4032d7
cmp byte [esi], 0x20
ja 0x4032d7
inc esi
cmp byte [esi], 0
jne 0x4032cc
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x4032f7
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x403333
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43cf56
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43ccda
mov eax, 0xe2f528e7
call fcn.0043cf77
or eax, ecx
xor dword [edi], esi
or eax, ecx
mov ecx, ecx
inc edi
cmp edi, ebx
jne fcn.0043cf56
ret
Function at 0x401b07
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx - 0x2e], al
mov dword [ebp - 0x697a9c20], 0xb56246e3
cmp byte [edi + edx], dh
invalid
Function at 0x405e80
Capabilities:
Initialize winsock library

Disassembly:
clc
mov dword [ebp - 0x26], eax
lea eax, [ebx*4 - 0x1ff49fc]
push eax
push esi
adc eax, sym.imp.MSVCRT.dll_malloc
mov ch, 0xd2
inc ebp
jmp 0x405eef
pop esp
rol dword [eax], 0xb5
rol byte [ebp - 0x15], cl
pop eax
outsd dx, dword [si]
inc eax
add dword [esi - 0x56], edx
push esi
stosb byte es:[edi], al
jne 0x405e9b
call dword [0x40ff5c]
add esp, 8
lea esp, [0x8d070afc]
push ebp
adc byte [ecx + 0x50], dl
mov ecx, dword [esp + ecx]
push edx
push edx
call 0x410bf0
mov ecx, ebp
cld
mov eax, dword [edi]
sub esi, edx
push esi
push eax
outsd dx, dword [esi]
adc eax, sym.imp.MSVCRT.dll_realloc
int1
add dword [eax], eax
out dx, al
add byte [ebx - 0x26c4f73c], al
mov dword [edi], eax
jle 0x405f02
adc cl, byte [ebx + 0x65]
mov ch, 0x47
add al, 0x89
dec ebp
inc byte [ecx - 0x75]
push eax
or eax, 0x8902c283
adc byte [ebx + 0x46168a30], cl
mov esi, dword [eax]
mov dl, byte [esi]
inc esi
test dl, dl
jno 0x405f24
jne 0x405eeb
mov edx, dword [ebp + 0xc]
xor dword [esp + eax + 0x4a], 0xffffff89
push ebp
or al, 0x75
loope 0x405e8e
mov eax, dword [ebp + 8]
mov dword [edi + ecx*8], 0xe00
inc ebp
or bh, al
add al, 0xcf
add byte [esi], cl
add byte [eax], al
mov dword [eax], edi
pop edi
mov esi, ebx
movsb byte es:[edi], byte [esi]
salc
rcr byte [eax + 0x5d], 1
ret
in al, dx
and dword [ecx + 0x65a10000], 0x8b214103
enter 0xffffffffffff8540, 0xffffffffffffffd5
mov dword [0x410388], eax
je 0x405f40
rol al, cl
mov esp, ebp
pop ebp
stc
lea edx, [ebp - 8]
push edx
call fcn.0040a720
add esp, 4
test dword [esp + ebp], esi
test dword [edx - 0xffff26], eax
push esp
pushal
rol byte [eax + 0x15], 0xf9
push esp
or dword [ecx], eax
call 0xb42f4940
test eax, eax
jne 0x405f94
push eax
push eax
lea eax, [ebp - 0x2f]
push eax
call 0xffaf4f60
test esi, ebx
je 0x405fa4
mov eax, 0x4b004e22
mov esp, ebp
pop ebp
ret
call dword [edx + 0x6a]
popfd
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test dword [eax], edx
xchg ebx, eax
cmp dword [esi - 0x75], esp
test dword [eax - 2], ebp
invalid

Function at 0x406a01
Capabilities:
Encode data using xor

Disassembly:
mov ebp, esp
sbb dword [0xf8458ddf], 0x2f
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
xor esi, esi
xor ecx, ecx
dec ecx
salc
sub eax, 0xa5fc844
push edx
push ecx
cdq
dec ebx
add byte [edx], ch
pop edi
add byte [eax - 0x7a], al
dec eax
pop esi
sbb edx, 0xf7295e35
mov esp, ebp
pop ebp
adc byte [ebp - 0x5c], ch
push edx
mov ecx, 0x8b559090
in al, dx
mov ebp, dword [esi + 0x56c9330c]
xor esi, esi
or ax, 0xe48
lea ecx, [ecx + ecx*4]
lea edx, [ebp - 0x76eb7277]
mov ecx, dword [ebp + 8]
shl edx, 3
mov ebx, esp
xor ebp, dword [esi]
xor eax, 0x890c508b
push ecx
add al, 0x33
shl byte [esi - 0x75], cl
push eax
aaa
mov dword [ecx + 8], edx
xor edx, edx
js fcn.00406a01
push eax
or byte [ecx + 0x78330c51], cl
mov sp, word [esi]
cmp cl, byte [ecx - 0x2dccefaf]
dec di
push eax
add dh, al
mov dword [ecx + 0x14], edx
xor esp, dword [ebx - 0x6cef749a]
ljmp 0x5189
Function at 0x40b080
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
inc ecx
mov esi, dword [ebp - 0x79]
push edi
lea edi, [ecx + 0x10]
mov ecx, dword [eax - 0x290f74f0]
or eax, ecx
mov dword [ebp + 0x10], 0x100ba
jne 0x40b0ef
in al, dx
inc esi
pushal
test al, al
je 0x40b10d
mov edx, dword [esi - 0x55]
lea ecx, [ebp + 8]
push 0
push ecx
jle 0x40b0ae
push 0
push 0
push edx
xlatb
and eax, sym.imp.KERNEL32.dll_PeekNamedPipe
test dword [edx + 0x75], eax
xor eax, 0xc098358b
add byte [eax], 0xff
salc
test eax, eax
jne 0x40b0d2
mov ecx, dword [ebp - 0x3c]
pop edi
pop esi
mov dword [ecx], eax
pop ebp
ret
call esi
add eax, 0xac780
cmp eax, 0xafced
jne 0x40b0d9
mov eax, 0x7f01117e
mov esp, eax
in al, dx
pop edi
aam 0xc7
add ecx, esi
inc edi
xor ebx, dword [ebp + 0x4510c35d]
or byte [ebp - 0x74628a76], al
push ebp
adc al, 0x5f
pop esi
fiadd word [edx]
mov eax, 0xa30b
pop ebp
ret
popfd
pop ebp
ret
mov eax, dword [esi + 0x54]
test eax, eax
je 0x40b137
mov cl, byte [esi + 0x72]
test cl, cl
jne 0x40b137
mov ecx, dword [esi + 0x50]
mov dword [eax + 8], ecx
mov eax, dword [esi - 0x57]
mov edx, dword [esi + 0x54]
aam 0x20
add al, 0
add al, ch
xchg ebx, eax
cmp dword [eax], eax
add byte [ebx + 0x42892756], cl
or al, 0x8b
dec ebx
or al, 0x8b
push ebp
or al, 0x53
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0xc]
push ebx
lea ecx, [ebp + 0x39]
imul ecx, dword [ebx + 0x6b519f6f], 0x52
mov al, 0xff
dec ebp
cmp dword [ebx - 0x75], ebp
outsd dx, dword [esi]
lahf
push ecx
imul edx, dword [edx - 0x50], 0xffffffff
adc eax, sym.imp.KERNEL32.dll_ReadFile
mov bl, 0x27
je 0x40b1bb
leave
jne 0x40b13f
sub eax, dword [ecx]
add byte [eax], al
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi - 0x7b]
ror byte [edi], 0x84
sbb eax, dword [ecx]
add byte [eax], al
call edi
add eax, 0xafc5b
cmp eax, 0x950b5665
jne 0x5bb24f
mov ebx, dword [0x5a40c09c]
mov ecx, dword [esi + 0x14]
adc al, 0x46
adc byte [ebp + 0x7f167cc9], al
and al, byte [ebp + 0x1310a6c0]
mov esi, 0x3e868
add byte [ebx], dl
push eax
call fcn.0040b590
add ecx, dword [0xf8cac123]
push dword [ebp + 4]
or eax, eax
jmp 0x40b1af
mov ecx, dword [esi - 0x58]
and cl, byte [ebx + 0x31521051]
rcl eax, cl
clc
cmp edi, 0x5e
je 0x40b182
test dword [edi], edx
je 0x40b1f8
mov eax, dword [0x412c60]
mov esi, dword [esp + eax - 0x7b]
push esp
jne 0x40b1eb
push eax
push 0x2500ec
push eax
popal
idiv edi
inc dword [ebx + 0x60a30cc4]
xor byte [ecx], al
test eax, eax
je 0x40b1f0
push ebx
call eax
jmp 0x40b1f8
push 1
call dword [0x40e74c]
mov ecx, dword [esi + 0xc]
sahf
push esi
add al, 0x8d
inc ebp
adc eax, 0x5150016a
push edx
dec dword [esi]
mov ah, 0xc0
inc eax
add byte [ebp + 0x680474c0], al
sal byte [ecx], 0x71
mov ebx, dword [0x8bc098]
jmp 0x75013784
Function at 0x409890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
fld dword [0x44b360]
push esi
fsub qword [0x4454b0]
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
fsub qword [0x4454a8]
imul esi, dword [ebp + 0x10]
fmul dword [0x44b22c]
fstp dword [0x44b22c]
fld dword [0x44b360]
fld1
mov dword [ebp - 4], 0
fadd st(1), st(0)
fxch st(1)
fstp dword [0x44b360]
mov dword [0x44b0c0], 0x6d170ba
test esi, esi
jne 0x40995c
fld dword [0x44b1a8]
fsub st(1)
fstp dword [0x44b1a8]
fld qword [0x44b018]
fld dword [0x44b1a8]
fcompp
fnstsw ax
test ah, 1
jne 0x409952
fld dword [0x44b1a8]
mov ax, word [0x44b408]
movsx ecx, ax
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
fsubp st(1)
fcomp qword [0x4454a0]
fnstsw ax
fadd dword [0x44b1a8]
fstp dword [0x44b1a8]
test ah, 0x41
jp 0x409954
dec dword [0x44b34c]
mov edx, dword [0x44b34c]
mov eax, dword [0x44b48c]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
fstp st(0)
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov cx, word [0x44b290]
movsx edx, cx
add edx, 0x31e5df6b
mov dword [ebp + 0xc], edx
fild dword [ebp + 0xc]
fld qword [0x44b380]
fld qword [0x44b528]
fsubp st(2)
fcompp
fnstsw ax
fld qword [0x44b528]
fadd st(1)
fstp qword [0x44b528]
fld qword [0x44b380]
fsub st(1)
fstp qword [0x44b380]
test ah, 5
jp 0x4099e4
mov ax, word [0x44b440]
movsx ecx, ax
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
fld dword [0x44b278]
fsub qword [0x445498]
fsub qword [0x445490]
fsubp st(1)
fistp qword [ebp - 0xc]
mov dx, word [ebp - 0xc]
mov word [0x44b440], dx
fadd dword [0x44b278]
fstp dword [0x44b278]
jmp 0x4099e6
fstp st(0)
mov ecx, dword [ebp + 0x14]
call fcn.00439d50
mov cx, word [0x44b4a0]
movsx edx, cx
sub edx, 0x561b9027
push 0
mov dword [ebp + 0xc], edx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
fild dword [ebp + 0xc]
push ecx
push esi
push edx
fmul qword [0x44b558]
push eax
fstp qword [0x44b558]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ax, word [0x44b598]
movsx ecx, ax
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
fld dword [0x44b5d8]
mov eax, dword [ebp - 4]
fsubr qword [0x445488]
fsubp st(1)
fistp qword [ebp - 0xc]
mov dx, word [ebp - 0xc]
mov word [0x44b598], dx
xor edx, edx
div edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x44b264]
sub eax, 0x5358ef6b
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fmul dword [0x44b074]
fstp dword [0x44b074]
inc dword [0x44b264]
call fcn.00420fc0
mov ecx, dword [0x44b48c]
mov edx, dword [ebp + 8]
mov eax, 0x922035fd
sub eax, ecx
add dword [0x44b30c], eax
inc dword [0x44b48c]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x42b5b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, word [0x44b378]
imul eax, eax, 0x67f707c
push esi
mov word [0x44b378], ax
call fcn.0043ee40
fld dword [0x44b1a0]
fsub qword [0x444ac8]
fstp dword [0x44b1a0]
fld dword [0x44b1a0]
fstp dword [0x44b338]
call fcn.0041a1f0
fld dword [0x44b4e8]
push 0x441130
fld1
push 0x441128
fsub st(1), st(0)
fxch st(1)
fstp dword [0x44b4e8]
fld dword [0x44b4e8]
fsub dword [0x44b454]
movzx ecx, word [0x44b280]
movsx edx, cx
fadd qword [0x44a788]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fmulp st(1)
fistp qword [ebp - 8]
movzx eax, word [ebp - 8]
mov word [0x44b280], ax
fadd dword [0x44b454]
fstp dword [0x44b454]
call fcn.0041a8b0
movzx ecx, word [0x44b1dc]
movsx edx, cx
mov dword [ebp - 4], edx
add esp, 8
fild dword [ebp - 4]
fld dword [0x44b300]
fadd qword [0x44a780]
fsubp st(1)
fistp qword [ebp - 8]
movzx eax, word [ebp - 8]
mov word [0x44b1dc], ax
call fcn.00403510
mov ecx, dword [0x44b34c]
add ecx, 0x7d598374
mov dword [ebp - 4], ecx
mov esi, eax
fild dword [ebp - 4]
fmul dword [0x44b534]
fstp dword [0x44b534]
inc dword [0x44b34c]
call fcn.00420fc0
mov dx, word [0x44b0f4]
movsx eax, dx
mov dword [ebp - 4], eax
push esi
fild dword [ebp - 4]
fadd qword [0x44b388]
mov ecx, dword [0x44b1e4]
mov dword [ebp - 4], ecx
fsub qword [0x44a778]
fild dword [ebp - 4]
fmulp st(1)
fistp qword [ebp - 8]
mov edx, dword [ebp - 8]
mov dword [0x44b1e4], edx
inc word [0x44b0f4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x430d90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
fld dword [0x44b450]
fistp qword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [0x44b03c], eax
fld dword [0x44b450]
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x44b450]
mov dword [ecx], 0
mov dx, word [0x44b490]
movsx eax, dx
cmp eax, 0x1ec42a8d
jge 0x430dfa
inc word [0x44b490]
mov dx, word [0x44b490]
movsx eax, dx
mov edx, 0xd1bd1e87
sub edx, eax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fmul qword [0x44b250]
fstp qword [0x44b250]
mov dword [ecx + 4], 0
fld qword [0x44b040]
fsub qword [0x445770]
fcomp qword [0x445768]
fnstsw ax
fld qword [0x44b040]
fadd st(1)
fstp qword [0x44b040]
test ah, 5
jp 0x430e9b
mov ax, word [0x44b1e8]
push esi
movsx edx, ax
mov esi, 0x933712b2
sub esi, edx
mov eax, 0xffffffff
add word [0x44b1e8], ax
cmp esi, 0xd2254a30
pop esi
jle 0x430e85
add dword [0x44b054], eax
fld qword [0x44b4a8]
fsub st(1)
fstp qword [0x44b4a8]
fld qword [0x44b4a8]
fld qword [0x44b3e0]
mov eax, dword [0x44b054]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
faddp st(2)
fsubrp st(1)
fstp qword [0x44b3e0]
jmp 0x430e9b
fld dword [0x44b140]
fstp st(0)
fld dword [0x44b140]
fsub st(1)
fstp dword [0x44b140]
mov dword [ecx + 8], 0x67452301
mov dx, word [0x44b128]
movsx eax, dx
mov edx, dword [0x44b470]
add edx, eax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fmul dword [0x44b22c]
fstp dword [0x44b22c]
mov dword [ecx + 0xc], 0xefcdab89
fld dword [0x44b06c]
fsub qword [0x445760]
fadd qword [0x44b020]
fstp qword [0x44b020]
mov dword [ecx + 0x10], 0x98badcfe
mov ax, word [0x44b3a8]
movsx edx, ax
cmp edx, 0x898ad9e6
jl 0x430f1e
mov ax, word [0x44b4bc]
movsx edx, ax
mov eax, dword [0x44b34c]
sub eax, edx
mov dx, word [0x44b36c]
movsx edx, dx
sub eax, edx
mov dword [0x44b34c], eax
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x44b39c]
sub eax, 0x68ab9ca9
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fld qword [0x44b388]
fsub qword [0x445758]
fucompp
fnstsw ax
fsubr qword [0x44b388]
fstp qword [0x44b388]
test ah, 0x44
jnp 0x430f8b
mov cx, word [0x44b2a0]
movsx edx, cx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fsub dword [0x44b0bc]
mov eax, dword [0x44b2d0]
mov dword [ebp - 4], eax
fsub qword [0x445750]
fild dword [ebp - 4]
faddp st(1)
fistp qword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [0x44b2d0], ecx
mov esp, ebp
pop ebp
ret